{
    # Traefik terminates TLS; Caddy should serve plain HTTP internally
    auto_https off
}

:80 {
    encode gzip
    root * /var/www/html

    # CORS is handled at the edge by Traefik's headers middleware.
    # Do not set or strip Access-Control-* headers here to avoid conflicts.

<<<<<<< HEAD
    # Replication bootstrap snapshots contain sensitive failover credentials.
    @replication_bootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
    respond @replication_bootstrap 404
=======
    # Do not expose local replication bootstrap material from the public web root.
    @replicationBootstrap path /storage/replication-bootstrap.json
    respond @replicationBootstrap 404
>>>>>>> refs/remotes/origin/master

    # PHP handling via FastCGI to php-fpm pool
    php_fastcgi php-staging:9000

    try_files {path} {path}/ /index.php
    file_server

    log {
        output file /var/log/caddy/access.log {
            roll_size 10MiB
            roll_keep 5
            roll_keep_for 720h
        }
        format json
    }
}
