Update CORS handling in Traefik and Caddy configurations

- Add origin-specific CORS settings to Traefik for `truckwash.io` with credentials support. - Simplify and standardize CORS headers in Caddy, removing upstream duplication and adjusting preflight logic.
2026-02-16 13:08:38 +01:00
parent 22790705b4
commit dd33fa2b19
2 changed files with 18 additions and 8 deletions
@@ -45,6 +45,20 @@ http:
        customFrameOptionsValue: "SAMEORIGIN"
        permissionsPolicy: "geolocation=(), microphone=(), camera=(), payment=()"
        addVaryHeader: true
+        # CORS: allow all origins (with credentials). Attach this middleware where needed.
+        accessControlAllowOriginList:
+          - "https://truckwash.io"
+        accessControlAllowMethods:
+          - GET
+          - POST
+          - PUT
+          - PATCH
+          - DELETE
+          - OPTIONS
+        accessControlAllowHeaders:
+          - "*"
+        accessControlAllowCredentials: true
+        accessControlMaxAge: 86400
    api-ratelimit:
      rateLimit:
        average: 100