From 1a328864f544f909e0ae3760ac9a67e86bb61130 Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Fri, 7 Aug 2026 13:36:06 +0800
Subject: [PATCH] fix(nginx,mongodb): quote heredocs to prevent bash $VAR
 expansion under set -u

Two distinct bugs, same root cause: the rendered scripts run with
'set -euo pipefail', but the generator used unquoted heredoc delimiters
(<<CONF_EOF) for config files. Bash expands $vars inside unquoted heredocs;
with 'set -u' any undefined variable aborts the heredoc, and because the
heredoc sits inside 'cat > FILE <<TAG ... TAG', the file gets opened
(truncated to zero bytes) but never written.

1) nginx generator (generators/middleware.py)
   - The HTTPS server block ended with '}}\n' instead of '}\n', causing
     'nginx -t' to fail with 'unexpected "}"'.
   - Both server confs (HTTP + HTTPS) wrote $uri / $host / $scheme /
     $request_uri / $proxy_add_x_forwarded_for / $remote_addr into
     unquoted heredocs. With set -u the heredoc for harbor.yunwei.blog.conf
     aborted on $scheme (and similar), leaving the file empty.

   Fix: change both heredoc delimiters to <<'CONF_EOF' (quoted), and
   remove the trailing extra '}'. Also strip the unnecessary Python
   f-string '{{' / '}}' escapes that produced '}' in the output.

2) mongodb repo (generators/runtimes.py)
   - The yum repo file used <<REPO_EOF (unquoted) with a body containing
     '$releasever'. $releasever is yum's own variable, not bash's;
     bash expanded it to '' under set -u and left the URL broken.
     Wireguard/openvpn heredocs DO use $(...) command substitution
     intentionally (to inline keys), so those stay unquoted.

   Fix: change delimiter to <<'REPO_EOF'.

Verified:
  - Rendered nginx.sh for harbor.yunwei.blog (proxy + SSL on port 78/443)
    produces conf files with correct nginx syntax. Real 'nginx -t' on a
    minimal test config passes (configuration syntax is ok / test is
    successful).
  - Audit of all 50 generators with default params shows zero $VAR
    references inside unquoted heredocs (only intentional $(...) cmds).
  - All 50 generators still pass 'bash -n'.
---
 generators/middleware.py | 18 +++++++++++-------
 generators/runtimes.py   |  2 +-
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/generators/middleware.py b/generators/middleware.py
index 3e34e46..e99c7b1 100644
--- a/generators/middleware.py
+++ b/generators/middleware.py
@@ -431,7 +431,11 @@ class Nginx(Generator):
                    '</body></html>\n'
                    'HTML_EOF')
         out.append('')
-        # Server block
+        # Server block. NOTE: heredoc is quoted ('CONF_EOF') so nginx vars
+        # like $uri / $host / $scheme / $request_uri / $proxy_add_x_forwarded_for
+        # are NOT expanded by bash. With 'set -u' an unquoted heredoc + an
+        # undefined nginx var would crash the entire script and leave a
+        # truncated (often empty) conf file behind.
         server_block = []
         server_block.append(f'    listen {port};\n    listen [::]:{port};\n'
                             f'    server_name {sn};\n    root {root};\n'
@@ -453,9 +457,9 @@ class Nginx(Generator):
                                 '    }\n')
         if ssl:
             server_block.append('\n    # Redirect all plain HTTP to HTTPS\n'
-                                f'    if ($scheme != "https") {{ return 301 https://$host$request_uri; }}\n')
+                                '    if ($scheme != "https") { return 301 https://$host$request_uri; }\n')
         siteconf = f"server {{\n{''.join(server_block)}}}\n"
-        out.append(f'cat > /etc/nginx/conf.d/{sn}.conf <<CONF_EOF\n{siteconf}CONF_EOF')
+        out.append(f"cat > /etc/nginx/conf.d/{sn}.conf <<'CONF_EOF'\n{siteconf}CONF_EOF")
         out.append('rm -f /etc/nginx/sites-enabled/default')
         if ssl:
             out.append('log "Generating self-signed certificate..."')
@@ -463,8 +467,8 @@ class Nginx(Generator):
                        f'  -keyout /etc/nginx/ssl/{sn}.key \\\n'
                        f'  -out /etc/nginx/ssl/{sn}.crt \\\n'
                        f'  -subj "/CN={sn}" 2>/dev/null')
-            out.append(f'cat > /etc/nginx/conf.d/{sn}-ssl.conf <<CONF_EOF\n'
-                       f'server {{\n'
+            out.append(f"cat > /etc/nginx/conf.d/{sn}-ssl.conf <<'CONF_EOF'\n"
+                       'server {\n'
                        f'    listen {ssl_port} ssl;\n'
                        f'    listen [::]:{ssl_port} ssl;\n'
                        f'    server_name {sn};\n'
@@ -472,7 +476,7 @@ class Nginx(Generator):
                        f'    ssl_certificate_key /etc/nginx/ssl/{sn}.key;\n'
                        f'    root {root};\n'
                        f'    client_max_body_size {cmbs};\n'
-                       f'    index index.html;\n'
+                       '    index index.html;\n'
                        f'    access_log /var/log/nginx/{sn}-ssl.access.log;\n'
                        f'    error_log  /var/log/nginx/{sn}-ssl.error.log;\n'
                        + ('    location / {\n'
@@ -485,7 +489,7 @@ class Nginx(Generator):
                           '    location / {\n'
                           '        try_files $uri $uri/ =404;\n'
                           '    }\n')
-                       + '}}\n'
+                       + '}\n'
                        'CONF_EOF')
         out.append('log "Testing nginx config..."')
         out.append('nginx -t')
diff --git a/generators/runtimes.py b/generators/runtimes.py
index 6a367ac..969dae8 100644
--- a/generators/runtimes.py
+++ b/generators/runtimes.py
@@ -689,7 +689,7 @@ class MongoDB(Generator):
                    '        PKG_INSTALL mongodb-org\n'
                    '        ;;\n'
                    '    yum|dnf)\n'
-                   '        cat > /etc/yum.repos.d/mongodb-org-' + ver + '.repo <<REPO_EOF\n'
+                   '        cat > /etc/yum.repos.d/mongodb-org-' + ver + '.repo <<\'REPO_EOF\'\n'
                    '[mongodb-org-' + ver + ']\n'
                    'name=MongoDB Repository\n'
                    'baseurl=https://repo.mongodb.org/yum/redhat/$releasever/mongodb-org/' + ver + '/x86_64/\n'