title: Nginx proxy_pass changes behavior when defining the target in a variable
body: <p>I'm reverse proxying an AWS API Gateway stage using nginx. This is pretty straightforward:</p>
  <pre><code>location /api {
      proxy_pass https://xxxxxxxxxx.execute-api.eu-central-1.amazonaws.com:443/production;
      proxy_ssl_server_name on;
  }
  </code></pre>
  <p>However, this approach will make nginx serve a stale upstream when the DNS entry for <code>xxxxxxxxxx.execute-api.eu-central-1.amazonaws.com</code> changes as it's resolving the entry once on startup.</p>
  <p>Following this article: <a href="https://www.nginx.com/blog/dns-service-discovery-nginx-plus/" rel="nofollow noreferrer">https://www.nginx.com/blog/dns-service-discovery-nginx-plus/</a> I am now trying to define my proxy target in a variable like this:</p>
  <pre><code>location /api {
      set $apigateway xxxxxxxxxx.execute-api.eu-central-1.amazonaws.com/production;
      proxy_pass https://$apigateway:443/;
      proxy_ssl_server_name on;
  }
  </code></pre>
  <p>This will make API Gateway respond with a <code>ForbiddenException: Forbidden</code> to requests that would pass the previous setup without using a variable. Reading this document: <a href="https://aws.amazon.com/de/premiumsupport/knowledge-center/api-gateway-troubleshoot-403-forbidden/" rel="nofollow noreferrer">https://aws.amazon.com/de/premiumsupport/knowledge-center/api-gateway-troubleshoot-403-forbidden/</a> it tells me this could be either WAF filtering my request (when WAF is not enabled for that API) or it could be a missing host header for a private API (when the API is public).</p>
  <p>I think I might be doing one these things wrong:</p>
  <ol>
  <li>The syntax used for setting the variable is wrong</li>
  <li>Using the variable will make nginx send different headers to API Gateway and I need to intervene manually. I did try setting a <code>Host</code> header already, but it did not make any difference though.</li>
  </ol>
  <p>The nginx version in use is 1.17.3</p>