
    header @cors_origin {
        # Ensure no duplicate CORS headers from upstream app
        -Access-Control-Allow-Origin
        -Access-Control-Allow-Credentials
        -Access-Control-Allow-Methods
        -Access-Control-Allow-Headers
        -Access-Control-Max-Age
        Access-Control-Allow-Origin "*"
        Access-Control-Allow-Credentials "true"
        Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
        Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number"
        Access-Control-Max-Age 86400
    }

    # Preflight fast-path
    respond @options 204 {
        header @cors_origin
    }

    # PHP handling via FastCGI to php-fpm pool
    php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000

    try_files {path} {path}/ /index.php
    file_server

    log {
        output file /var/log/caddy/access.log {
            roll_size 10MiB
            roll_keep 5
            roll_keep_for 720h
        }
        format json
    }
}
