ORIGIN = "https://${domain}";

          add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ${domain} *.${domain} cdn.jsdelivr.net *.posthog.com *.sanity.io *.googletagmanager.com *.google-analytics.com *.vercel.app vercel.live *.vercel.com; object-src 'self' ${domain} *.${domain}; base-uri 'self'; frame-ancestors 'self'; font-src 'self' ${domain} *.${domain} cdn.jsdelivr.net; connect-src 'self' ${domain} *.${domain} *.posthog.com *.sanity.io *.googletagmanager.com *.google-analytics.com *.vercel.app vercel.live *.vercel.com; img-src 'self' ${domain} *.${domain} *.sanity.io cdn.sanity.io data:;" always;

          add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ${domain} *.${domain} cdn.jsdelivr.net unpkg.com *.posthog.com *.sanity.io *.googletagmanager.com *.google-analytics.com; object-src 'self' ${domain} *.${domain}; base-uri 'self'; frame-ancestors 'self'; form-action 'self' ${domain} *.${domain}; font-src 'self' ${domain} *.${domain} cdn.jsdelivr.net; connect-src 'self' ${domain} *.${domain} unpkg.com *.posthog.com *.sanity.io *.googletagmanager.com *.google-analytics.com; img-src 'self' ${domain} *.${domain} unpkg.com *.tile.openstreetmap.org *.sanity.io cdn.sanity.io data:;" always;