Enhance CORS handling in Traefik and Caddy

- Add preflight routers and attach `secure-headers` middleware in Traefik for `api.truckwash.dk` and `cloud.truckwash.dk`.
- Update `secure-headers` middleware with refined CORS headers and stricter origin/method/header configurations.
- Remove redundant CORS logic in Caddy, delegating CORS management entirely to Traefik.

services/caddy/Caddyfile

@@ -7,23 +7,8 @@
     encode gzip
     root * /var/www/html
 
-    # Global CORS headers: allow all origins and headers (no credentials)
-    header {
-        # Ensure no duplicate CORS headers from upstream app
-        -Access-Control-Allow-Origin
-        -Access-Control-Allow-Credentials
-        -Access-Control-Allow-Methods
-        -Access-Control-Allow-Headers
-        -Access-Control-Max-Age
-        Access-Control-Allow-Origin "*"
-        Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
-        Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number"
-        Access-Control-Max-Age 86400
-    }
-
-    # Preflight fast-path
-    @options method OPTIONS
-    respond @options 204
+    # CORS is handled at the edge by Traefik's headers middleware.
+    # Do not set or strip Access-Control-* headers here to avoid conflicts.
 
     # PHP handling via FastCGI to php-fpm pool
     php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000

services/traefik/dynamic.yml

@@ -5,14 +5,35 @@ http:
       rule: Host(`cloud.truckwash.dk`)
       entryPoints: [websecure]
       service: cloud-svc
+      middlewares: [secure-headers]
       tls:
         certResolver: le
     cloud-http:
       rule: Host(`cloud.truckwash.dk`)
       entryPoints: [web]
-      middlewares: [redirect-to-https]
+      middlewares: [redirect-to-https, secure-headers]
       service: cloud-svc
 
+    # CORS preflight handlers (Traefik generates the OPTIONS response)
+    # Return an empty 204 from Traefik itself and attach CORS headers via the middleware.
+    api-preflight:
+      rule: Host(`api.truckwash.dk`) && Method(`OPTIONS`)
+      entryPoints: [websecure]
+      middlewares: [secure-headers]
+      service: noop@internal
+      priority: 1000
+      tls:
+        certResolver: le
+
+    cloud-preflight:
+      rule: Host(`cloud.truckwash.dk`) && Method(`OPTIONS`)
+      entryPoints: [websecure]
+      middlewares: [secure-headers]
+      service: noop@internal
+      priority: 1000
+      tls:
+        certResolver: le
+
     # Dashboard routers are declared via labels; middlewares are defined below.
 
   middlewares:
@@ -35,17 +56,14 @@ http:
           - 192.168.0.0/16
     secure-headers:
       headers:
-        sslRedirect: true
-        stsSeconds: 31536000
-        stsIncludeSubdomains: true
-        stsPreload: false
         contentTypeNosniff: true
         browserXssFilter: true
         referrerPolicy: "strict-origin-when-cross-origin"
         customFrameOptionsValue: "SAMEORIGIN"
         permissionsPolicy: "geolocation=(), microphone=(), camera=(), payment=()"
         addVaryHeader: true
-        # CORS: allow all origins (with credentials). Attach this middleware where needed.
+        accessControlAllowCredentials: true
+        accessControlMaxAge: 86400
         accessControlAllowOriginList:
           - "https://truckwash.io"
         accessControlAllowMethods:
@@ -56,9 +74,9 @@ http:
           - DELETE
           - OPTIONS
         accessControlAllowHeaders:
-          - "*"
-        accessControlAllowCredentials: true
-        accessControlMaxAge: 86400
+          - Authorization
+          - Content-Type
+          - X-Customer-Number
     api-ratelimit:
       rateLimit:
         average: 100