{#  Configure CORS headers dynamically based on role variables.
    If no variable is defined, defaults are applied (e.g. same-origin). #}
{% if aca_origin is defined %}
add_header 'Access-Control-Allow-Origin' {{ aca_origin }};
{% endif %}
{% if aca_credentials is defined %}
add_header 'Access-Control-Allow-Credentials' {{ aca_credentials }};
{% endif %}
{% if aca_methods is defined %}
add_header 'Access-Control-Allow-Methods' {{ aca_methods }};
{% endif %}
{% if aca_headers is defined %}
add_header 'Access-Control-Allow-Headers' {{ aca_headers }};
{% endif %}