test bugs fixed

Dockerfile

@@ -54,7 +54,7 @@ COPY nginx.conf.template /etc/nginx/templates/default.conf.template
 # and friends. Nginx's own `$uri`, `$remote_addr` and `$proxy_add_x_forwarded_for`
 # would survive that today, but only by luck, and a config silently rewritten at
 # boot is a bad thing to leave to luck.
-ENV NGINX_ENVSUBST_FILTER=INGEST_TOKEN
+ENV NGINX_ENVSUBST_FILTER="(INGEST_TOKEN|INGEST_UPSTREAM)"
 
 # Empty by default — and this line is LOAD-BEARING. Do not delete it.
 #
@@ -78,6 +78,18 @@ ENV NGINX_ENVSUBST_FILTER=INGEST_TOKEN
 # unset token is a real empty string and the guard can catch it.
 ENV INGEST_TOKEN=""
 
+# Where the ingest service is. Declared here for the same reason as the line
+# above: envsubst only substitutes names that are DEFINED, so an undeclared
+# INGEST_UPSTREAM would leave the literal text `${INGEST_UPSTREAM}` in the
+# config as the proxy target, and nginx would fail to start with an error that
+# names the variable rather than the omission.
+#
+# Defaults to the public host so an existing deployment behaves exactly as it
+# did. Set it to the sibling container's internal address — e.g.
+# `http://mcp-backend:8000` — to take the private path and drop the credential
+# entirely.
+ENV INGEST_UPSTREAM="https://mcp.nearle.ai.in"
+
 COPY --from=builder /app/dist/ /usr/share/nginx/html/
 
 EXPOSE 80 3000