fix(consul-postgres-ha): wire SERVICES_JSON to coordinator env

Found during live verification on 2026-05-14: coord-0's config-entry
writer only emitted `proxy-defaults/global` and quit, leaving the
cluster with no per-service `service-resolver` entries or
intentions. Replicas downstream saw "server closed the connection
unexpectedly" on every pg_basebackup attempt — Envoy's
postgres-master upstream had no resolver, so EDS returned empty,
and the listener closed connections on accept.

Root cause: `local.services_json` was only set in `phala_app.worker`
env, not `phala_app.coordinator`. Coord-0's
`mesh-sidecar/entrypoint.sh` reads `SERVICES_JSON` to drive the
service-resolver + intentions writer (entrypoint.sh:384, 409, 424),
and an empty/unset value made every jq pipeline iterate over no
rows. Symptom verified by counting emitted "Config entry written:"
lines: 1 (only proxy-defaults) BEFORE the fix, 6 (proxy-defaults +
service-resolver/{demo,postgres-master,postgres-replica} +
service-intentions/{demo,webdemo}) AFTER applying it.

Two-file change: add `SERVICES_JSON = local.services_json` to
`phala_app.coordinator`'s env block, and the matching
`SERVICES_JSON=${SERVICES_JSON}` env line in
`compose/coordinator.yaml`.

A residual issue remains downstream (the standalone connect-proxies
that the platform sidecar registers fail their service-http-checks
watch with "service '' not in agent state", and replicas still
can't pg_basebackup with this fix alone — probably needs
DestinationServiceID set on the Pattern-B connect-proxy
registration); filing as a separate punch-list item.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: h4x3rotab

consul-postgres-ha/cluster-example/cluster.tf

@@ -274,8 +274,11 @@ resource "phala_app" "coordinator" {
   docker_compose = file("${path.module}/../compose/coordinator.yaml")
 
   env = {
-    CLUSTER_NAME        = var.cluster_name
-    PEERS_JSON          = local.peers_json
+    CLUSTER_NAME = var.cluster_name
+    PEERS_JSON   = local.peers_json
+    # Coord-0's config-entry writer needs SERVICES_JSON to emit the
+    # per-service service-resolver + intentions entries on bringup.
+    SERVICES_JSON       = local.services_json
     COORDINATOR_ORDINAL = tostring(each.value)
     BOOTSTRAP_EXPECT    = tostring(var.coordinator_replicas)
     COORDINATOR_VIPS    = local.coordinator_vips

consul-postgres-ha/compose/coordinator.yaml

@@ -41,6 +41,16 @@ services:
       - ROLE=coordinator
       - CLUSTER_NAME=${CLUSTER_NAME}
       - PEERS_JSON=${PEERS_JSON}
+      # SERVICES_JSON is the same content workers see — same shape, same
+      # source-of-truth (local.services in cluster.tf). Coordinators
+      # don't run Envoy sidecars, but coord-0 needs the service list so
+      # its config-entry writer can emit per-service service-resolver
+      # entries + intentions on cluster bringup. Without this, the
+      # config-entry writer only writes proxy-defaults/global and the
+      # whole Connect routing layer ends up with no resolvers, which
+      # manifests downstream as replicas' pg_basebackup connections
+      # closing on accept (empty EDS endpoint set).
+      - SERVICES_JSON=${SERVICES_JSON}
       # COORDINATOR_ORDINAL is per-CVM (0..N-1); makes bootstrap-secrets
       # write the right /run/instance/info.json without needing Consul
       # KV (which itself runs on the coordinators — chicken-and-egg).