네트워크나 프록시 서버에서의 아웃바운드 트래픽을 차단하는 경우, 태그 관리 서버 인스턴스가 올바르게 작동하기 위해서는 Google 태그 관리자 도메인을 허용해야 합니다. 아웃바운드 트래픽을 허용하는 방법은 네트워크 환경과 프록시 소프트웨어에 따라 다릅니다. 엔드포인트를 허용하기 전에 네트워크 토폴로지를 이해하고 있어야 합니다.
다음 도메인은 Google 태그 관리자 컨테이너를 가져오고, 미리 보고 디버그할 때 사용됩니다.
https://www.googletagmanager.com
https://tagmanager.google.com
${Preview server URL}
프록시 서버가 있는 네트워크와 다른 네트워크에 미리보기 서버를 호스팅하거나 제한적인 네트워크 규칙이 있는 경우 프록시에서 미리보기로 서버로 이동하는 아웃바운드 트래픽을 허용해야 합니다. 미리보기 서버 URL은 서버 컨테이너를 배포할 때 정의됩니다.
선택사항: 프록시 서버에서 BASIC 인증 사용
조직에서 인증이 필요한 경우 모든 서버 유형에서 BASIC 인증을 사용할 수 있습니다.
BASIC 인증을 사용하려면 아래 형식에 나와 있는 것처럼 사용자 인증 정보(사용자 이름 및 비밀번호)를 프록시 서버 URL의 일부로 포함하세요.
HTTP_PROXY=http(s)://USER_NAME:PASSWORD@PROXY_URL
프록시로 전송되는 모든 요청의 프록시-인증 헤더에 사용자 이름과 비밀번호가 Base64 값으로 지정됩니다.
Cloud Run을 사용하는 경우 프록시 엔드포인트 사용자 인증 정보를 Secret Manager에 보관합니다. 시작 시간에 Secret Manager는 보안 비밀에 액세스할 권한을 Cloud Run에 부여하여 값을 해결합니다.
Cloud Run에서 보안 비밀을 구성하는 방법을 알아보세요.
선택사항: 특정 호스트에 대해 프록시 사용 중지
NO_PROXY 환경 변수를 사용하여 프록시 서버를 통해 전송될 수 없는 호스트 이름을 쉼표로 구분된 목록으로 정의할 수 있습니다.
예로 NO_PROXY=example.com,169.254.169.254,diagnostics.example2.com:3131을 들어 보겠습니다.
[null,null,["최종 업데이트: 2024-04-17(UTC)"],[[["\u003cp\u003eThis guide explains how to route all server-side Google Tag Manager traffic through a proxy server for enhanced security and control.\u003c/p\u003e\n"],["\u003cp\u003eBefore starting, ensure you have a Cloud Run or manually deployed server container (App Engine is not supported), a proxy server supporting \u003ccode\u003eHTTP CONNECT\u003c/code\u003e requests, and the ability to allowlist outbound traffic.\u003c/p\u003e\n"],["\u003cp\u003eTo set up proxy routing, define an \u003ccode\u003eHTTP_PROXY\u003c/code\u003e environment variable with your proxy server's URI for your server container.\u003c/p\u003e\n"],["\u003cp\u003eVerification involves checking Google Tag Manager's debug mode and your proxy server logs for successful requests to Google Tag Manager and other relevant endpoints.\u003c/p\u003e\n"],["\u003cp\u003eOptionally, you can allowlist specific outbound traffic, use BASIC authentication with your proxy, or disable the proxy for certain hosts using the \u003ccode\u003eNO_PROXY\u003c/code\u003e environment variable.\u003c/p\u003e\n"]]],["To route server-side tagging traffic through a proxy, ensure you have a deployed server container and a proxy server supporting HTTP CONNECT. Configure the `HTTP_PROXY` environment variable with the proxy server URI in your Cloud Run or manual deployment settings. Verify by checking Google Tag Manager's \"Requests\" tab and your proxy server logs. Optionally, allowlist specific domains and use BASIC authentication by adding credentials to the `HTTP_PROXY` value. Use `NO_PROXY` to specify hosts to bypass the proxy.\n"],null,["# Set up proxy server routing\n\n\u003e This document is for developers who want to route all server-side tagging\n\u003e traffic through a proxy server.\n\nBefore you begin\n----------------\n\nBefore you can set up proxy server routing, make sure you have:\n\n- A server container deployed on [Cloud Run](https://developers.google.com/tag-platform/tag-manager/server-side/cloud-run-setup-guide) or via\n [manual setup](https://developers.google.com/tag-platform/tag-manager/server-side/manual-setup-guide).\n\n | **Note:** App Engine deployments don't support proxying traffic.\n- A [proxy server](https://developer.mozilla.org/en-US/docs/Web/HTTP/Proxy_servers_and_tunneling) deployed that supports\n [`HTTP CONNECT`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT) requests.\n\n- The ability to allowlist specific outbound traffic from the proxy server,\n for example, using [VPC](https://cloud.google.com/vpc),\n [Firewall](https://cloud.google.com/firewall), or Proxy access control lists\n (ACLs).\n\nConfigure proxy server routing\n------------------------------\n\n### Cloud Run\n\nTo forward traffic to a proxy for Cloud Run deployments:\n\n1. [Open Cloud Run](https://console.cloud.google.com/run)\n2. Choose your server-side tagging Cloud Run instance.\n3. Click **EDIT \\& DEPLOY NEW REVISION**. The deploy revision screen opens.\n4. Under **Container(s)**, choose your server container. A new screen with the container setting opens.\n5. To expand the service configuration, select the **Variables \\& Secrets**\n tab. Click the **Add Variable** button and add the following environment\n variable:\n\n 1. **Name** : `HTTP_PROXY`\n 2. **Value** : URI of the proxy server (e.g. `https://proxy.example.com:3333` or `http://32.12.83.10`)\n\n | **Note:** The protocol must be either HTTP or HTTPS\n6. Click **Done**.\n\n7. Confirm your revisions and click **Deploy**.\n\n### Manual deployment\n\nTo forward traffic to a proxy for manual deployments:\n\n1. Define an environment variable accessible to the Docker image:\n\n 1. **Name** : `HTTP_PROXY`\n 2. **Value** : URI of the proxy server (e.g. `https://proxy.example.com` or `http://32.12.83.10:1234`)\n\n | **Note:** The protocol must be either HTTP or HTTPS\n2. Run your Docker image with the new environment variable.\n\n docker run -p 8080:8080 \\\n -e CONTAINER_CONFIG=\u003cvar label=\"container_config\" translate=\"no\"\u003eCONTAINER_CONFIG\u003c/var\u003e \\\n -e HTTP_PROXY=\u003cvar label=\"proxy_url\" translate=\"no\"\u003ePROXY_URL\u003c/var\u003e \\\n gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable\n\n**Result:** Your server-side tagging deployment sends all outbound traffic to\nthe proxy endpoint you specified in the environment variable.\n\nVerify the proxy server setup\n-----------------------------\n\nTo verify your proxy requests setup, check both Google Tag Manager and your\nproxy server configuration.\n\nTo verify your server container proxies requests:\n\n1. [Open Google Tag Manager](https://tagmanager.google.com/#/home)\n\n2. Open your server container.\n\n3. Open [Preview](https://developers.google.com/tag-platform/tag-manager/server-side/debug) mode. In the **Requests** tab:\n\n 1. Ensure your client claims the incoming request.\n 2. Ensure that your tags and variables successfully send outgoing HTTP requests.\n 3. To check whether a request was sent through a proxy server, click a HTTP request to view the **HTTP Request Details**.\n\nTo verify your proxy setup:\n\n1. Check your network and proxy server logs. At a minimum you should see successful requests to the following endpoints:\n - \u003chttps://www.googletagmanager.com\u003e\n - \u003chttps://tagmanager.google.com\u003e\n2. Check if there are requests to other endpoints.\n3. Depending on the server-side tagging features you use, you may also see requests made to other endpoints, such as [www.google-analytics.com](/tag-platform/tag-manager/server-side/www.google-analytics.com), [bigquery.googleapis.com](/tag-platform/tag-manager/server-side/bigquery.googleapis.com), or third-party endpoints. Allow-list any other endpoints that are needed for your tagging setup.\n\nOptional: Allow-list outbound traffic from your proxy server\n------------------------------------------------------------\n\nIf you block outbound traffic from your network or from your proxy server, you\nmust allowlist Google Tag Manager domains for your tagging server instance to\nwork. How you allowlist outbound traffic depends on your network environment and\nproxy software. Before you begin allowlisting endpoints, make sure that you\nunderstand your network topology.\n\nThe following domains are used to fetch, preview, and [debug](https://developers.google.com/tag-platform/tag-manager/server-side/debug)\nyour Google Tag Manager container:\n\n- `https://www.googletagmanager.com`\n- `https://tagmanager.google.com`\n- `${Preview server URL}`\n\nIf you host your Preview server on a different network than your proxy server or\nhave restrictive network rules, allowlist outbound traffic from\nthe proxy to the Preview server. The Preview server URL is defined when you\n[deploy your server container](https://developers.google.com/tag-platform/tag-manager/server-side/cloud-run-setup-guide).\n\nOptional: Use BASIC Authentication with your proxy server\n---------------------------------------------------------\n\nIf your organization requires authentication, you can use BASIC authentication\nwith all server types.\n\nTo use BASIC authentication, include the credentials (username/password) as part\nof the proxy server URL in the following format: \n\n HTTP_PROXY=http(s)://\u003cvar label=\"user_name\" translate=\"no\"\u003eUSER_NAME\u003c/var\u003e:\u003cvar label=\"password\" translate=\"no\"\u003ePASSWORD\u003c/var\u003e@\u003cvar label=\"proxy_url\" translate=\"no\"\u003ePROXY_URL\u003c/var\u003e\n\nEach request to the proxy sets the username and password in the\n[Proxy-Authorization header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authorization) as Base64 values.\n| **Caution:** Follow your cloud provider's best practices when storing and providing the `HTTP_PROXY` environment variable with BASIC authentication to the tagging server.\n\nIf you use Cloud Run, store the proxy endpoint credentials\nin [Secret Manager](https://cloud.google.com/secret-manager). Secret Manager\ngives Cloud Run access to the secret at startup time and resolves the value.\nLearn how to [configure secrets in Cloud Run](https://cloud.google.com/run/docs/configuring/services/secrets).\n\nOptional: Disable the proxy for specific hosts\n----------------------------------------------\n\nThe `NO_PROXY` environment variable lets you define a comma delimited list\nof hostnames that can't be sent through the proxy server.\n\nFor example, given:\n`NO_PROXY=example.com,169.254.169.254,diagnostics.example2.com:3131`\n\nThe sGTM container doesn't proxy any of the following requests:\n\n- `http://example.com`, `https://sub.example.com`, `https://other.example.com:123`\n- `http://169.254.169.254`, `https://169.254.169.254`, `http://169.254.169.254:123`\n- `http://diagonstics.example2.com:3131`, `https://diagonstics.example2.com:3131`\n\n| **Tip:** If you integrate with Bigquery or Firestore and deploy your tagging server to Google Cloud, you may need to define an exception for Google's [metadata server](https://cloud.google.com/compute/docs/metadata/overview#limitations) with `NO_PROXY=169.254.169.254,metadata.google.internal`"]]
를 클릭합니다. 버전 배포 화면이 표시됩니다.