Since #1213 (d8798b488) the image's healthcheck verifies the certificate, and expects DIDBOT_HEALTHCHECK_URL to be the server's public /health URL: curl reaches 127.0.0.1 through --connect-to and checks the certificate against the URL's host. terraform-aws-didbot-pds v0.1.0's templates/user_data.sh.tftpl (line 182) still passes -e DIDBOT_HEALTHCHECK_URL=https://127.0.0.1/health, from before #1213. On pds.did.bot after the 2026-10-17 release of bc4f5dea70fe, every check fails with curl: (60) SSL: no alternative certificate subject name matches target host name '127.0.0.1', and Docker marks the container unhealthy (12 failures in a row by 17:44Z).
Nothing acts on Docker's health state. The converger's own check passed (healthy after 7s), and the Route53 and CloudWatch checks poll the public /health, which is ok. The fix is the module's unit passing https://${root_zone}/health. That line is in user_data, so adopting it replaces the instance once.
🤖 Generated with Claude Code