Dont use the $host variable in NGINX, it's user supplied data (HOST header)