Caddyfile

{
    frankenphp
    order php_server before file_server
    auto_https off
}

:80 {
    root * /app/public

    # Disable local environment
    # encode zstd br gzip

    # Enable HSTS (HTTP Strict Transport Security)
    # header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # Security headers
    # header X-Content-Type-Options "nosniff"
    # header X-Frame-Options "SAMEORIGIN"
    # header Referrer-Policy "strict-origin-when-cross-origin"

    php_server

    # ✅ Serve Laravel storage directly (NO symlink needed)
    handle_path /media/* {
        root * /app/storage/app/public/media
        file_server
    }

    # ✅ Serve Laravel storage directly (NO symlink needed)
    handle_path /images/* {
        root * /app/storage/app/public/images
        file_server
    }

    file_server

    # Logging
    log {
        output file /var/log/caddy/access.log
        format json
    }
}