{
    # Traefik terminates TLS; Caddy should serve plain HTTP internally
    auto_https off
}

:80 {
    encode gzip
    root * /var/www/html

    # CORS is handled at the edge by Traefik's headers middleware.
    # Do not set or strip Access-Control-* headers here to avoid conflicts.

    # Do not expose local replication bootstrap material from the public web root.
    # Bootstrap snapshots contain sensitive failover credentials.
    @replicationBootstrap path /storage/replication-bootstrap.json /storage/replication-bootstrap-*
    respond @replicationBootstrap 404

    # PHP handling via FastCGI to php-fpm pool
    php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000

    try_files {path} {path}/ /index.php
    file_server

    log {
        output file /var/log/caddy/access.log {
            roll_size 10MiB
            roll_keep 5
            roll_keep_for 720h
        }
        format json
    }
}