Wrote a deep-dive on server-side GTM + Stape, including why "custom domain = long Safari cookies" hasn't been true since 2023
I do tracking implementation for a living and kept seeing the same outdated claim repeated in setup guides: that pointing your sGTM tagging server at a custom subdomain gives you long-lived cookies in Safari.
That stopped being fully true with Safari 16.4 (April 2023).
Safari now caps server-set cookies at 7 days too, if the tagging server's IP prefix doesn't match your website's IP prefix. Since your site and your Stape/Cloud Run server sit on different infrastructure by default, most "properly configured" setups are still hitting the 7-day cap and nobody notices.
Wrote up the full setup process end to end: container creation, custom domain, the two actual Safari fixes (Own CDN vs Cookie Keeper), GA4 server-side, Meta CAPI with real event deduplication (not just "turn on the toggle"), Google Ads Enhanced Conversions, Consent Mode V2, and a 7-point QA checklist to verify your own setup isn't leaking before you trust the data. Also listed the 8 mistakes I run into most in actual audits.
Not trying to just drop a link and run, happy to answer specific questions here about sGTM, EMQ scores, or Meta CAPI dedup if anyone's stuck on their own setup.
https://muhammadabdullah.co/blog/server-side-gtm-setup-guide