server {
    listen 80;
    server_name dev-apparel-demo.printxpand.net;

    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 1024M;
    fastcgi_hide_header X-Powered-By;
    fastcgi_hide_header X-Frame-Options;
    fastcgi_hide_header Strict-Transport-Security;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
    add_header Content-Security-Policy "frame-ancestors 'self';" always;

    # Get real client IP from Kubernetes / Load Balancer
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.42.0.0/16;
    real_ip_recursive on;

    # Block heavy crawling bots
    if ($http_user_agent ~* (meta-externalagent|ClaudeBot)) {
        return 403;
    }
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    # Block Magento version disclosure
    location ~* ^/magento_version {
        deny all;
        return 404;
    }
    # Block quote/ temp folder entirely
    # location ^~ /media/custom_options/quote/ {
    #     deny all;
    #     return 403;
    # }

    location ^~ /media/ {
        # Allow expected static media and frontend asset file types only.
        location ~* \.(?:jpg|jpeg|png|gif|webp|avif|svg|ico|bmp|woff|woff2|ttf|otf|eot|pdf|csv|txt|xml|zip|gz|bz2|tar|rar|css|js|map|json|ai|eps|evd|gltf|glb|kfpx)$ {
            try_files $uri =404;
            access_log off;
            log_not_found off;
        }
        # Deny everything else (no extension, php, unknown)
        return 403;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen 80;
    server_name dev-headless-am-commercial-demo-backend.printxpand.net;

    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 1024M;
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
        add_header Content-Security-Policy "frame-ancestors 'self' https://dev-headless-am-commerical-demo.printxpand.net;" always;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        add_header Content-Security-Policy "frame-ancestors 'self' https://dev-headless-am-commerical-demo.printxpand.net;" always;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen 80;
    server_name dev-headless-marketplace-demo-backend.printxpand.net;

    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 1024M;
    fastcgi_hide_header X-Powered-By;
    fastcgi_hide_header X-Frame-Options;
    fastcgi_hide_header Strict-Transport-Security;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
    add_header Content-Security-Policy "frame-ancestors 'self' https://dev-headless-artist-marketplace-demo.printxpand.net;" always;

    # Get real client IP from Kubernetes / Load Balancer
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.42.0.0/16;
    real_ip_recursive on;

    # Block heavy crawling bots
    if ($http_user_agent ~* (meta-externalagent|ClaudeBot)) {
        return 403;
    }

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    # Block Magento version disclosure
    location ~* ^/magento_version {
        deny all;
        return 404;
    }
    location ^~ /media/ {
        # Allow expected static media and frontend asset file types only.
        location ~* \.(?:jpg|jpeg|png|gif|webp|avif|svg|ico|bmp|woff|woff2|ttf|otf|eot|pdf|csv|txt|xml|zip|gz|bz2|tar|rar|css|js|map|json|ai|eps|evd|gltf|glb|kfpx)$ {
            try_files $uri =404;
            access_log off;
            log_not_found off;
        }
        # Deny everything else (no extension, php, unknown)
        return 403;
    }
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
    }
}
server {
    listen 80;
    server_name dev-headless-commerical-demo-backend.printxpand.net;

    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 1024M;
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
        add_header Content-Security-Policy "frame-ancestors 'self' https://dev-headless-commerical-demo.printxpand.net;" always;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
        add_header Content-Security-Policy "frame-ancestors 'self' https://dev-headless-commerical-demo.printxpand.net;" always;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen 80;
    server_name headless-designer-demo.printxpand.net;

    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 1024M;
    fastcgi_hide_header X-Powered-By;
    fastcgi_hide_header X-Frame-Options;
    fastcgi_hide_header Strict-Transport-Security;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
    add_header Content-Security-Policy "frame-ancestors 'self' https://dev-headless-demo.printxpand.net;" always;

    # Get real client IP from Kubernetes / Load Balancer
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.42.0.0/16;
    real_ip_recursive on;

    # Block heavy crawling bots
    if ($http_user_agent ~* (meta-externalagent|ClaudeBot)) {
        return 403;
    }
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    # Block Magento version disclosure
    location ~* ^/magento_version {
        deny all;
        return 404;
    }
    location ^~ /media/ {
        # Allow expected static media and frontend asset file types only.
        location ~* \.(?:jpg|jpeg|png|gif|webp|avif|svg|ico|bmp|woff|woff2|ttf|otf|eot|pdf|csv|txt|xml|zip|gz|bz2|tar|rar|css|js|map|json|ai|eps|evd|gltf|glb|kfpx)$ {
            try_files $uri =404;
            access_log off;
            log_not_found off;
        }
        # Deny everything else (no extension, php, unknown)
        return 403;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen 80;
    server_name dev-cards-demo.printxpand.net;
    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 50M;
    fastcgi_hide_header X-Powered-By;
    fastcgi_hide_header X-Frame-Options;
    fastcgi_hide_header Strict-Transport-Security;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
    add_header Content-Security-Policy "frame-ancestors 'self';" always;

    # Get real client IP from Kubernetes / Load Balancer
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.42.0.0/16;
    real_ip_recursive on;

    # Block heavy crawling bots
    if ($http_user_agent ~* (meta-externalagent|ClaudeBot)) {
        return 403;
    }
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    # Block Magento version disclosure
    location ~* ^/magento_version {
        deny all;
        return 404;
    }
    location ^~ /media/ {
        # Allow expected static media and frontend asset file types only.
        location ~* \.(?:jpg|jpeg|png|gif|webp|avif|svg|ico|bmp|woff|woff2|ttf|otf|eot|pdf|csv|txt|xml|zip|gz|bz2|tar|rar|css|js|map|json|ai|eps|evd|gltf|glb|kfpx)$ {
            try_files $uri =404;
            access_log off;
            log_not_found off;
        }
        # Deny everything else (no extension, php, unknown)
        return 403;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen 80;
    server_name dev-wide-demo.printxpand.net;
    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 50M;
    fastcgi_hide_header X-Powered-By;
    fastcgi_hide_header X-Frame-Options;
    fastcgi_hide_header Strict-Transport-Security;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
    add_header Content-Security-Policy "frame-ancestors 'self';" always;

    # Get real client IP from Kubernetes / Load Balancer
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.42.0.0/16;
    real_ip_recursive on;

    # Block heavy crawling bots
    if ($http_user_agent ~* (meta-externalagent|ClaudeBot)) {
        return 403;
    }
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    # Block Magento version disclosure
    location ~* ^/magento_version {
        deny all;
        return 404;
    }
    location ^~ /media/ {
        # Allow expected static media and frontend asset file types only.
        location ~* \.(?:jpg|jpeg|png|gif|webp|avif|svg|ico|bmp|woff|woff2|ttf|otf|eot|pdf|csv|txt|xml|zip|gz|bz2|tar|rar|css|js|map|json|ai|eps|evd|gltf|glb|kfpx)$ {
            try_files $uri =404;
            access_log off;
            log_not_found off;
        }
        # Deny everything else (no extension, php, unknown)
        return 403;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen 80;
    server_name dev-box-3d-demo.printxpand.net;

    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 50M;
    fastcgi_hide_header X-Powered-By;
    fastcgi_hide_header X-Frame-Options;
    fastcgi_hide_header Strict-Transport-Security;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
    add_header Content-Security-Policy "frame-ancestors 'self';" always;

    # Get real client IP from Kubernetes / Load Balancer
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.42.0.0/16;
    real_ip_recursive on;

    # Block heavy crawling bots
    if ($http_user_agent ~* (meta-externalagent|ClaudeBot)) {
        return 403;
    }
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    # Block Magento version disclosure
    location ~* ^/magento_version {
        deny all;
        return 404;
    }
    location ^~ /media/ {
        # Allow expected static media and frontend asset file types only.
        location ~* \.(?:jpg|jpeg|png|gif|webp|avif|svg|ico|bmp|woff|woff2|ttf|otf|eot|pdf|csv|txt|xml|zip|gz|bz2|tar|rar|css|js|map|json|ai|eps|evd|gltf|glb|kfpx)$ {
            try_files $uri =404;
            access_log off;
            log_not_found off;
        }
        # Deny everything else (no extension, php, unknown)
        return 403;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen 80;
    server_name dev-gifts-demo.printxpand.net;

    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 50M;
    fastcgi_hide_header X-Powered-By;
    fastcgi_hide_header X-Frame-Options;
    fastcgi_hide_header Strict-Transport-Security;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
    add_header Content-Security-Policy "frame-ancestors 'self';" always;

    # Get real client IP from Kubernetes / Load Balancer
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.42.0.0/16;
    real_ip_recursive on;

    # Block heavy crawling bots
    if ($http_user_agent ~* (meta-externalagent|ClaudeBot)) {
        return 403;
    }
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    # Block Magento version disclosure
    location ~* ^/magento_version {
        deny all;
        return 404;
    }
    location ^~ /media/ {
        # Allow expected static media and frontend asset file types only.
        location ~* \.(?:jpg|jpeg|png|gif|webp|avif|svg|ico|bmp|woff|woff2|ttf|otf|eot|pdf|csv|txt|xml|zip|gz|bz2|tar|rar|css|js|map|json|ai|eps|evd|gltf|glb|kfpx)$ {
            try_files $uri =404;
            access_log off;
            log_not_found off;
        }
        # Deny everything else (no extension, php, unknown)
        return 403;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen 80;
    server_name dev-photobooks-demo.printxpand.net;

    root /var/www/html/pub;
    index index.php index.html index.htm;
    client_max_body_size 50M;
    fastcgi_hide_header X-Powered-By;
    fastcgi_hide_header X-Frame-Options;
    fastcgi_hide_header Strict-Transport-Security;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
    add_header Content-Security-Policy "frame-ancestors 'self';" always;

    # Get real client IP from Kubernetes / Load Balancer
    real_ip_header X-Forwarded-For;
    set_real_ip_from 10.42.0.0/16;
    real_ip_recursive on;

    # Block heavy crawling bots
    if ($http_user_agent ~* (meta-externalagent|ClaudeBot)) {
        return 403;
    }
    
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
    # Block Magento version disclosure
    location ~* ^/magento_version {
        deny all;
        return 404;
    }
    location ^~ /media/ {
        # Allow expected static media and frontend asset file types only.
        location ~* \.(?:jpg|jpeg|png|gif|webp|avif|svg|ico|bmp|woff|woff2|ttf|otf|eot|pdf|csv|txt|xml|zip|gz|bz2|tar|rar|css|js|map|json|ai|eps|evd|gltf|glb|kfpx)$ {
            try_files $uri =404;
            access_log off;
            log_not_found off;
        }
        # Deny everything else (no extension, php, unknown)
        return 403;
    }
    # Node process running
    location /node {
        rewrite ^/node(/.*)$ $1 break;
        proxy_pass http://127.0.0.1:3000/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass 127.0.0.1:9000; # Ensure this matches your PHP-FPM socket or IP:port
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
         # Timeouts
        fastcgi_connect_timeout  3600s;
        fastcgi_send_timeout 36600s;
        fastcgi_read_timeout 3600s;
        # Manually adding the common FastCGI parameters
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        # fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_param REQUEST_METHOD $request_method;
        fastcgi_param CONTENT_TYPE $content_type;
        fastcgi_param CONTENT_LENGTH $content_length;

        fastcgi_intercept_errors on;
        fastcgi_buffers 16 16k;
        fastcgi_buffer_size 32k;
    }
    location ~* ^/(cron|update|install)\.php$ {
        deny all;
        return 404;
    }
    location ~* ^/pub/(media|static|assets|images)/.*\.php$ {
        deny all;
        return 403;
    }
    location ~ /\.ht {
        deny all;
    }
}