fix(startup): generate nginx api-proxy fragment safely (preserve nginx variables, placeholder replace)

Author: mbertelsen

startup.sh

@@ -83,25 +83,37 @@ echo "✅ Runtime configuration setup complete!"
 # to the real backend. This writes only a `location` block so the fragment can be
 # included inside the main server block defined in nginx.conf.
 echo "📡 Creating API proxy location fragment (/etc/nginx/conf.d/api-proxy.conf)"
-cat > /etc/nginx/conf.d/api-proxy.conf << EOF
+
+# Use a single-quoted heredoc so shell variables like $host are not expanded into the file.
+# We include a placeholder __BACKEND_BASE_URL__ which we safely replace below with the
+# actual runtime value (trimmed of a trailing slash).
+cat > /etc/nginx/conf.d/api-proxy.conf << 'EOF'
 # Dynamically generated by startup.sh - proxies /api/* to the backend provided by VITE_BACKEND_BASE_URL
 location /api/ {
   # Forward to the backend base url. Note: using a full URL here lets nginx
   # perform an external proxy pass to the backend host configured at runtime.
-  proxy_pass ${VITE_BACKEND_BASE_URL}/api/;
-  proxy_set_header Host \$host;
-  proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-  proxy_set_header X-Forwarded-Proto \$scheme;
+  proxy_pass __BACKEND_BASE_URL__/api/;
+  proxy_set_header Host $host;
+  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  proxy_set_header X-Forwarded-Proto $scheme;
   proxy_http_version 1.1;
   proxy_set_header Connection '';
   proxy_buffering off; # important for SSE
   chunked_transfer_encoding off;
-  proxy_cache_bypass \$http_upgrade;
+  proxy_cache_bypass $http_upgrade;
   proxy_read_timeout 3600s;
   proxy_send_timeout 3600s;
 }
 EOF
-echo "✅ Wrote /etc/nginx/conf.d/api-proxy.conf"
+
+# Safely replace placeholder with the configured backend URL. Trim any trailing slash so
+# resulting proxy_pass has a single /api/ suffix.
+BACKEND=${VITE_BACKEND_BASE_URL:-http://127.0.0.1:4000}
+# remove trailing slash if present
+BACKEND=${BACKEND%/}
+sed -i "s|__BACKEND_BASE_URL__|${BACKEND}|g" /etc/nginx/conf.d/api-proxy.conf
+
+echo "✅ Wrote /etc/nginx/conf.d/api-proxy.conf (proxy -> ${BACKEND}/api/)"
 
 # Start nginx
 echo "🌐 Starting nginx..."