From 115c8144cd241cc0f06d46124d2bee7ee1cce45e Mon Sep 17 00:00:00 2001
From: Vula Builder <deploy@vula.app>
Date: Tue, 28 Jul 2026 09:03:24 +0000
Subject: [PATCH] Deploy

---
 next.config.js | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 next.config.js

diff --git a/next.config.js b/next.config.js
new file mode 100644
index 0000000..e429abb
--- /dev/null
+++ b/next.config.js
@@ -0,0 +1,31 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  images: {
+    remotePatterns: [
+      { protocol: 'https', hostname: 'images.pexels.com' },
+      { protocol: 'https', hostname: 'images.unsplash.com' },
+      // MinIO (self-hosted S3) — user-uploaded images via the Replace Image chip
+      { protocol: 'https', hostname: 'uploads.vulai.co.za' },
+      // Demo product thumbnails seeded at build time
+      { protocol: 'https', hostname: 'picsum.photos' },
+      // Medusa product images — local dev backend and production backend fallback
+      { protocol: 'http', hostname: 'localhost' },
+      { protocol: 'https', hostname: 'localhost' },
+      { protocol: 'https', hostname: 'ide.vulai.co.za' },
+    ],
+  },
+  // Silence Next.js 14+ cross-origin warning when the preview iframe is served
+  // from sandbox.vulai.co.za but /_next/* assets are fetched from the same origin.
+  allowedDevOrigins: ['sandbox.vulai.co.za', 'localhost:3100', '*.vulai.co.za'],
+  // Allow Vula IDE to embed this preview in an iframe.
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [{ key: 'X-Frame-Options', value: 'ALLOWALL' }],
+      },
+    ]
+  },
+}
+
+module.exports = nextConfig