A loose nginx proxy_pass in front of a Ruby Sinatra app leaked the upstream hostname, which was the flag.