From 629c13499de4810cdfc3a4996ca43372f34d4f33 Mon Sep 17 00:00:00 2001
From: Jeppe Bundgaard <jb@truckwash.dk>
Date: Mon, 23 Feb 2026 23:45:22 +0100
Subject: [PATCH] Add CORS rule for `api.truckwash.io` and new preflight route

- Introduce preflight handling for `OPTIONS` method on `api.truckwash.io` with high priority routing and secure headers middleware.
- Extend CORS configuration to include `https://api.truckwash.io`.
---
 services/traefik/dynamic.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/services/traefik/dynamic.yml b/services/traefik/dynamic.yml
index a5914eca..27c30f46 100644
--- a/services/traefik/dynamic.yml
+++ b/services/traefik/dynamic.yml
@@ -25,6 +25,15 @@ http:
       tls:
         certResolver: le
 
+    api-preflight-io:
+      rule: Host(`api.truckwash.io`) && Method(`OPTIONS`)
+      entryPoints: [websecure]
+      middlewares: [secure-headers]
+      service: noop@internal
+      priority: 1000
+      tls:
+        certResolver: le
+
     cloud-preflight:
       rule: Host(`cloud.truckwash.dk`) && Method(`OPTIONS`)
       entryPoints: [websecure]
@@ -66,6 +75,7 @@ http:
         accessControlMaxAge: 86400
         accessControlAllowOriginList:
           - "https://truckwash.io"
+          - "https://api.truckwash.io"
           - "https://web.truckwash.dk"
           - "https://api.truckwash.dk"
           - "https://truckwash.dk"