[Bug] nginx error when specifying upstream

What happened?

No response

How we reproduce?

1. ...
2. ...
3. ...

Expected behavior

No response

Error log

time=2026-01-16T11:57:20.602+05:00 level=ERROR msg="exec cmd failed" error="nginx: [emerg] invalid port in upstream "172.22.222.10:8000:8080/challenge/v2/" in /etc/nginx/sites-enabled/IF_backend_11:67\nnginx: configuration file /etc/nginx/nginx.conf test failed\n: " cmd=reloadWebsite module=client source=/work/client/actions.go:126
time=2026-01-16T11:57:37.189+05:00 level=ERROR msg="test nginx config failed" error="nginx: [emerg] invalid port in upstream "172.22.222.10:8000:8080/challenge/v2/" in /etc/nginx/sites-enabled/IF_backend_12:67\nnginx: configuration file /etc/nginx/nginx.conf test failed\n: " nginx_config="log_format safeline_12 '$remote_addr | $remote_user | $time_local | "$host" | '\n '"$request" | $status | $body_bytes_sent | '\n '"$http_referer" | "$http_user_agent"';\nupstream backend_12 {\n server 172.20.20.18:443;\n keepalive 128;\n keepalive_timeout 75;\n}\nmap $scheme $hsts_header {\n https "max-age=15768000;";\n}\nserver {\n listen 0.0.0.0:80;\n listen 0.0.0.0:443 ssl;\n listen 0.0.0.0:8443;\n server_name prod-api.opencard.uz;\n ssl_certificate /etc/nginx/certs/cert_1.crt;\n ssl_certificate_key /etc/nginx/certs/cert_1.key;\n ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;\n error_page 497 =302 https://$host:$server_port$request_uri;\n error_page 502 =502 /.safeline/bad_gateway_page;\n error_page 504 =504 /.safeline/gateway_timeout_page;\n set $should_rewrite 0;\n if ($host !* ^(prod-api\.opencard\.uz)$) { set $should_rewrite 1; }\n if ($should_rewrite) { rewrite ^ /.safeline/not_found_page last; }\n include /etc/nginx/tamper-enabled/site_12/tamper_*;\n gzip on;\n brotli on;\n location = /.safeline/not_found_page {\n internal;\n proxy_pass http://unix:/app/sock/tcd_error.sock;\n t1k_intercept off;\n tx_intercept off;\n }\n location = /.safeline/forbidden_page {\n internal;\n proxy_pass http://unix:/app/sock/tcd_error.sock;\n t1k_intercept off;\n tx_intercept off;\n }\n location = /.safeline/acl_page {\n internal;\n proxy_pass http://unix:/app/sock/tcd_error.sock;\n t1k_intercept off;\n tx_intercept off;\n }\n location = /.safeline/bad_gateway_page {\n internal;\n proxy_pass http://unix:/app/sock/tcd_error.sock;\n t1k_intercept off;\n tx_intercept off;\n }\n location = /.safeline/gateway_timeout_page {\n internal;\n proxy_pass http://unix:/app/sock/tcd_error.sock;\n t1k_intercept off;\n tx_intercept off;\n }\n location ^ /.safeline/offline_page {\n internal;\n add_header cache-control no-cache;\n proxy_pass http://unix:/app/sock/tcd_error.sock;\n t1k_intercept off;\n tx_intercept off;\n }\n location ^~ /.safeline/challenge/v2/ {\n proxy_pass http://172.22.222.10:8000:8080/challenge/v2/;\n t1k_intercept off;\n tx_intercept off;\n }\n location ^~ /.safeline/static {\n charset utf-8;\n alias /etc/nginx/safeline-static;\n t1k_intercept off;\n tx_intercept off;\n }\n location ^~ / {\n proxy_pass https://backend_12;\n include proxy_params;\n proxy_set_header Host $http_host;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n include /etc/nginx/custom_params/backend_12;\n t1k_add_user_data "12";\n tx_add_user_data "12";\n t1k_body_size 1024k;\n tx_body_size 4k;\n t1k_error_page 403 /.safeline/forbidden_page;\n t1k_error_page 429 /.safeline/acl_page;\n t1k_error_page 466 /.safeline/offline_page;\n tx_error_page 403 /.safeline/forbidden_page;\n t1k_error_page 465 /.safeline/waiting_room_page;\n }\n}\n" module=service source=/work/service/nginx.go:270
time=2026-01-16T11:57:37.190+05:00 level=ERROR msg="generate website config failed" error="nginx: [emerg] invalid port in upstream "172.22.222.10:8000:8080/challenge/v2/" in /etc/nginx/sites-enabled/IF_backend_12:67\nnginx: configuration file /etc/nginx/nginx.conf test failed\n: " site_id=12 module=client source=/work/client/actions.go:390
time=2026-01-16T11:57:37.190+05:00 level=ERROR msg="exec cmd failed" error="nginx: [emerg] invalid port in upstream "172.22.222.10:8000:8080/challenge/v2/" in /etc/nginx/sites-enabled/IF_backend_12:67\nnginx: configuration file /etc/nginx/nginx.conf test failed\n: " cmd=reloadWebsite module=client source=/work/client/actions.go:126
client_loop: send disconnect: Connection reset

Start in /work/service/nginx.go around line 270 and inspect how the challenge location builds its proxy_pass directive; /work/client/actions.go lines 126 and 390 show the configuration test and generation failures. Reproduce the generated configuration and run nginx -t. Done means the challenge upstream has a valid address and the generated site configuration passes validation.