I have following script to change the firewall rules of one of my cloud servers.

The variables API_TOKEN and FIREWALL_ID are converted, but PUBLIC_IP doesn’t get converted – it stays PUBLIC_IP, not 1.1.1.1 for example.

PUBLIC_IP=$(dig +short txt ch whoami.cloudflare @1.0.0.1)
API_TOKEN="XXX"
FIREWALL_ID="YYY"

curl 
        -X POST 
        -H "Authorization: Bearer $API_TOKEN" 
        -H "Content-Type: application/json" 
        -d '{"rules":[{"direction":"in","port":"80","protocol":"tcp","source_ips":[$PUBLIC_IP/32]},{"direction":"in","port":"443","protocol":"tcp","source_ips":["$PUBLIC_IP/32"]},{"direction":"in","port":"22","protocol":"tcp","source_ips":["$PUBLIC_IP/32"]},{"direction":"in","protocol":"icmp","source_ips":["$PUBLIC_IP/32"]}]}' 
        "https://api.hetzner.cloud/v1/firewalls/$FIREWALL_ID/actions/set_rules"

Any clue?
Thanks Chris