Two distinct bugs, same root cause: the rendered scripts run with
'set -euo pipefail', but the generator used unquoted heredoc delimiters
(<<CONF_EOF) for config files. Bash expands $vars inside unquoted heredocs;
with 'set -u' any undefined variable aborts the heredoc, and because the
heredoc sits inside 'cat > FILE <<TAG ... TAG', the file gets opened
(truncated to zero bytes) but never written.
1) nginx generator (generators/middleware.py)
- The HTTPS server block ended with '}}\n' instead of '}\n', causing
'nginx -t' to fail with 'unexpected "}"'.
- Both server confs (HTTP + HTTPS) wrote $uri / $host / $scheme /
$request_uri / $proxy_add_x_forwarded_for / $remote_addr into
unquoted heredocs. With set -u the heredoc for harbor.yunwei.blog.conf
aborted on $scheme (and similar), leaving the file empty.
Fix: change both heredoc delimiters to <<'CONF_EOF' (quoted), and
remove the trailing extra '}'. Also strip the unnecessary Python
f-string '{{' / '}}' escapes that produced '}' in the output.
2) mongodb repo (generators/runtimes.py)
- The yum repo file used <<REPO_EOF (unquoted) with a body containing
'$releasever'. $releasever is yum's own variable, not bash's;
bash expanded it to '' under set -u and left the URL broken.
Wireguard/openvpn heredocs DO use $(...) command substitution
intentionally (to inline keys), so those stay unquoted.
Fix: change delimiter to <<'REPO_EOF'.
Verified:
- Rendered nginx.sh for harbor.yunwei.blog (proxy + SSL on port 78/443)
produces conf files with correct nginx syntax. Real 'nginx -t' on a
minimal test config passes (configuration syntax is ok / test is
successful).
- Audit of all 50 generators with default params shows zero $VAR
references inside unquoted heredocs (only intentional $(...) cmds).
- All 50 generators still pass 'bash -n'.
Your Name
1a328864f5