diff --git a/services/caddy/Caddyfile b/services/caddy/Caddyfile
index 133b40ce..0545b591 100644
--- a/services/caddy/Caddyfile
+++ b/services/caddy/Caddyfile
@@ -1,16 +1,3 @@
-{
-    # Traefik terminates TLS; Caddy serves HTTP behind Traefik only
-    auto_https off
-}
-
-:80 {
-    encode gzip
-    root * /var/www/html
-
-    # CORS (reflect allowed origins; credentials-compatible)
-    # Allow truckwash.dk and truckwash.io subdomains and localhost for dev
-    @cors_origin header_regexp Origin ^https?://([a-z0-9-]+\.)?truckwash\.(dk|io)(:\d+)?$|^https?://localhost(:\d+)?$
-    @options method OPTIONS
 
     header @cors_origin {
         # Ensure no duplicate CORS headers from upstream app
@@ -19,16 +6,17 @@
         -Access-Control-Allow-Methods
         -Access-Control-Allow-Headers
         -Access-Control-Max-Age
-        Access-Control-Allow-Origin "{http.request.header.Origin}"
+        Access-Control-Allow-Origin "*"
+        Access-Control-Allow-Credentials "true"
         Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
         Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number"
-        Access-Control-Allow-Credentials true
         Access-Control-Max-Age 86400
-        Vary Origin
     }
 
     # Preflight fast-path
-    respond @options 204
+    respond @options 204 {
+        header @cors_origin
+    }
 
     # PHP handling via FastCGI to php-fpm pool
     php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000