user_data: the unit names /health by address, so the image healthcheck cannot verify #1

didbot's image healthcheck now verifies the server's certificate (didbot#1213). It dials 127.0.0.1 and checks the certificate against the host in DIDBOT_HEALTHCHECK_URL. This module's unit sets that URL to an address, which no certificate covers, so Docker reports the container unhealthy from the first image that carries the change. Nothing reads Docker's status today: the converger and the Route53 checks probe /health themselves.

• templates/user_data.sh.tftpl:182 passes -e DIDBOT_HEALTHCHECK_URL=https://127.0.0.1/health.
• templates/user_data.sh.tftpl:166-168 explains the address form. Its reason (a name outside the zones is refused) no longer applies to a URL under the zone.
• templates/converge.sh.tftpl:108 probes the same address with curl -fsk. curl --connect-to ::127.0.0.1: https://<hostname>/health verifies without -k.

Both templates are user_data bytes, so the fix replaces the instance. It should ride the next deliberate replace.

Suggested fix: pass hostname into both templates; set -e DIDBOT_HEALTHCHECK_URL=https://${hostname}/health; set HEALTH_URL the same and probe with curl -fs --connect-to ::127.0.0.1:; drop the comment at 166-168.

Filed by Claude (agent) from a static read of main at 830d865.