fix(consul-postgres-ha): drop spurious 's' suffix from gateway URLs to plain-HTTP backends

The dstack gateway uses two different URL conventions:
  <app-id>-<port>.<gw>   gateway terminates TLS, forwards plain HTTP
  <app-id>-<port>s.<gw>  gateway TLS pass-through, backend speaks TLS

Consul's HTTP API binds plain HTTP on 127.0.0.1, so the consul_ui
output and rollout.sh's CONSUL_BASE need the no-'s' form. The 's'
form silently fails permanently — early errors look like 'gateway
not yet routing,' which trivially mistakes a config bug for a
provisioning delay (this is what made us think the gateway took 6+
minutes to come up; it never would have, with the wrong suffix).

Also adds a 'dstack gateway URL convention' note to README.md so
future readers don't fall into the same trap.

Empirically confirmed via a minimal reproducer (separate worktree):
trivial nginx CVMs reach 200 in 84-112s end-to-end with the correct
suffix; the wrong suffix never reaches 200.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: h4x3rotab

consul-postgres-ha/README.md

@@ -59,6 +59,21 @@ Once apply finishes, the cluster is HA Postgres on
 through any worker's `127.0.0.1:18703+ordinal` (forwarded by mesh-conn
 to whichever CVM Patroni elected leader).
 
+### dstack gateway URL convention
+
+Two forms, easy to confuse:
+
+| Form | Behavior | Use when |
+|---|---|---|
+| `<app-id>-<port>.<gateway-domain>` | Gateway terminates TLS using a pre-issued wildcard cert and forwards plain HTTP to `<port>` on the CVM. | The backend speaks plain HTTP (Consul HTTP API, Patroni REST, webdemo, etc.). |
+| `<app-id>-<port>s.<gateway-domain>` | Gateway does TLS pass-through — encrypted bytes go straight to `<port>`. | The backend speaks TLS itself (Envoy public mTLS listener on `:21000`). |
+
+Picking the wrong form fails permanently. Plain-HTTP backend with the
+`s` form yields `SSL_ERROR_SYSCALL` early and `wrong version number`
+once routing is live; trivially mistakable for a transient gateway
+provisioning delay. If the URL doesn't work after ~2 min from CVM
+ready, suspect the suffix.
+
 ## What's in this directory
 
 ```

consul-postgres-ha/cluster-example/cluster.tf

@@ -270,5 +270,10 @@ output "coordinator_app_ids" { value = { for k, c in phala_app.coordinator : k =
 output "worker_app_ids" { value = { for k, w in phala_app.worker : k => w.app_id } }
 output "consul_ui" {
   # Any coordinator's HTTP port serves the UI. Pick coord-0 by convention.
-  value = "https://${phala_app.coordinator["0"].app_id}-${local.coordinator_http_port_first}s.${var.gateway_domain}/ui"
+  # `<port>` (no trailing 's') = gateway terminates TLS using the wildcard
+  # cert and forwards plain HTTP to the backend. Consul HTTP binds plain
+  # HTTP on 127.0.0.1, so this is the right convention. The `<port>s`
+  # form is for TLS pass-through where the backend speaks TLS itself
+  # (e.g. Envoy public mTLS on :21000).
+  value = "https://${phala_app.coordinator["0"].app_id}-${local.coordinator_http_port_first}.${var.gateway_domain}/ui"
 }

consul-postgres-ha/cluster-example/rollout.sh

@@ -52,7 +52,10 @@ resolve_consul_base() {
     echo "ERROR: terraform output coordinator_app_id failed; run terraform apply at least once" >&2
     exit 1
   fi
-  CONSUL_BASE="https://${coord_id}-${COORDINATOR_HTTP_PORT}s.${GATEWAY_DOMAIN}"
+  # `<port>` (no trailing 's') — gateway terminates TLS, backend is
+  # plain HTTP. The `<port>s` pass-through form is for backends that
+  # speak TLS themselves; Consul's HTTP API does not.
+  CONSUL_BASE="https://${coord_id}-${COORDINATOR_HTTP_PORT}.${GATEWAY_DOMAIN}"
 }
 
 consul_members_alive() {