Serve the script from your own domain

// next.config.js
module.exports = {
  async rewrites() {
    return [
      { source: '/js/script.js', destination: 'https://t.tallybyoutpost.com/script.js' },
      { source: '/api/event', destination: 'https://t.tallybyoutpost.com/api/event' },
    ];
  },
};

On Vercel the rewrite carries X-Forwarded-For. An /api/event route of the app's own takes precedence: use another path and data-api.

{
  "rewrites": [
    { "source": "/js/script.js", "destination": "https://t.tallybyoutpost.com/script.js" },
    { "source": "/api/event", "destination": "https://t.tallybyoutpost.com/api/event" }
  ]
}

vercel.json, for a site on Vercel without Next.js.

# netlify.toml
[[redirects]]
  from = "/js/script.js"
  to = "https://t.tallybyoutpost.com/script.js"
  status = 200
  force = true

[[redirects]]
  from = "/api/event"
  to = "https://t.tallybyoutpost.com/api/event"
  status = 200
  force = true

location = /js/script.js {
    proxy_pass https://t.tallybyoutpost.com/script.js;
    proxy_set_header Host t.tallybyoutpost.com;
    proxy_ssl_server_name on;
}

location = /api/event {
    proxy_pass https://t.tallybyoutpost.com/api/event;
    proxy_set_header Host t.tallybyoutpost.com;
    proxy_ssl_server_name on;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Cookie "";
}

yoursite.com {
    handle /js/script.js {
        rewrite * /script.js
        reverse_proxy https://t.tallybyoutpost.com {
            header_up Host {upstream_hostport}
        }
    }
    handle /api/event {
        reverse_proxy https://t.tallybyoutpost.com {
            header_up Host {upstream_hostport}
            header_up -Cookie
        }
    }
    # … the site's own handlers
}

Caddy sets X-Forwarded-For itself.

// Routed on yoursite.com/js/script.js and yoursite.com/api/event.
const UPSTREAM = {
  '/js/script.js': 'https://t.tallybyoutpost.com/script.js',
  '/api/event': 'https://t.tallybyoutpost.com/api/event',
};

export default {
  async fetch(request) {
    const upstream = UPSTREAM[new URL(request.url).pathname];
    if (!upstream) return fetch(request);
    const headers = new Headers(request.headers);
    headers.set('X-Forwarded-For', request.headers.get('CF-Connecting-IP') || '');
    headers.delete('Cookie');
    return fetch(upstream, { method: request.method, headers, body: request.body });
  },
};

// Node 18 or later.
const express = require('express');

const UPSTREAM = 'https://t.tallybyoutpost.com';
const app = express();
app.set('trust proxy', true); // when Express runs behind a proxy, so req.ip is the visitor's

app.get('/js/script.js', async (req, res) => {
  const upstream = await fetch(UPSTREAM + '/script.js');
  res.set('Content-Type', 'application/javascript; charset=utf-8');
  res.set('Cache-Control', upstream.headers.get('cache-control') || 'public, max-age=3600');
  res.send(await upstream.text());
});

app.post('/api/event', express.text({ type: '*/*', limit: '8kb' }), (req, res) => {
  fetch(UPSTREAM + '/api/event', {
    method: 'POST',
    headers: {
      'Content-Type': 'text/plain',
      'User-Agent': req.get('user-agent') || '',
      'X-Forwarded-For': req.ip,
    },
    body: req.body,
  }).catch(() => {});
  res.status(202).end();
});