From ac542a705edd8cb55535785d2a4a29fdd7ee10d2 Mon Sep 17 00:00:00 2001
From: Jeppe Bundgaard <jb@truckwash.dk>
Date: Mon, 16 Feb 2026 12:21:02 +0100
Subject: [PATCH] Update Caddyfile with refined CORS handling and stricter
 origin matching for truckwash.dk subdomains and localhost

---
 services/caddy/Caddyfile | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/services/caddy/Caddyfile b/services/caddy/Caddyfile
index 84838959..d55054ab 100644
--- a/services/caddy/Caddyfile
+++ b/services/caddy/Caddyfile
@@ -7,14 +7,27 @@
     encode gzip
     root * /var/www/html
 
-    # CORS headers matching prior Nginx behavior
+    # CORS (reflect allowed origins; credentials-compatible)
+    # Allow only truckwash.dk subdomains and localhost for dev
+    @cors_origin header_regexp Origin ^https?://([a-z0-9-]+\.)?truckwash\.dk(:\d+)?$|^https?://localhost(:\d+)?$
     @options method OPTIONS
-    header {
+
+    header @cors_origin {
+        # Ensure no duplicate CORS headers from upstream app
+        -Access-Control-Allow-Origin
+        -Access-Control-Allow-Credentials
+        -Access-Control-Allow-Methods
+        -Access-Control-Allow-Headers
+        -Access-Control-Max-Age
+        Access-Control-Allow-Origin "{http.request.header.Origin}"
         Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
         Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number"
         Access-Control-Allow-Credentials true
-        Access-Control-Allow-Origin "*"
+        Access-Control-Max-Age 86400
+        Vary Origin
     }
+
+    # Preflight fast-path
     respond @options 204
 
     # PHP handling via FastCGI to php-fpm pool