{"id":5299,"date":"2026-08-30T14:10:37","date_gmt":"2026-08-30T05:10:37","guid":{"rendered":"https:\/\/donguri3.net\/server-tech\/oci-nginx-local-ols-ssl-pull-sync-2\/"},"modified":"2026-08-30T14:10:39","modified_gmt":"2026-08-30T05:10:39","slug":"oci-nginx-local-ols-ssl-pull-sync","status":"publish","type":"post","link":"https:\/\/donguri3.net\/en\/server-tech\/linux-server-network\/oci-nginx-local-ols-ssl-pull-sync\/","title":{"rendered":"Solving the Home Server SSL Problem: How to Avoid Certificate Conflicts Between OCI Nginx and Local OLS"},"content":{"rendered":"

The server architecture of our blog, “Nando Kobo,” has evolved into its current form after overcoming several technical hurdles.<\/p>\n

It started as a simple setup: WireGuard(OCI) -> OLS(local) -> WordPress. However, we hit our first roadblock right away. WireGuard’s iptables forwarding did not properly append the X-Forwarded-For header, which prevented QUIC.cloud integration\u2014essential for WordPress speed optimization\u2014from working correctly.<\/p>\n

\"Exposing<\/a><\/p>\n

To solve this issue, we introduced Nginx as a reverse proxy on the OCI side, evolving the architecture to Nginx(OCI) — WireGuard -> OLS(local).<\/p>\n

\"Exposing<\/a><\/p>\n

However, the next challenge was “SSL termination.” Initially, we tried to handle SSL termination on the OLS side, but we couldn’t route traffic smoothly through Nginx. Ultimately, we decided to handle SSL termination on Nginx. While this solved the communication issue, it created a new side effect: “OLS could no longer automatically renew its certificates using acme tools.”<\/p>\n

The Backend Server Stripped of SSL Renewal “Authority”<\/h2>\n

Currently, the SSL certificate for public exposure is managed by Nginx on OCI. However, to maintain consistency for local access within the home network and inter-server communication, the exact same valid certificate must also be deployed on the backend OLS.<\/p>\n

Since Nginx occupies port 80, OLS cannot reach out to renew its own certificates. On the other hand, manually copy-pasting certificates every three months goes against the aesthetics of Nando Kobo.<\/p>\n

Automating “Doing Nothing”: Reducing Manual Annual Updates to “0”<\/h2>\n

Our target goal is clear.<\/p>\n

    \n
  • Reduce manual time spent on SSL renewals to “0 minutes per year.”<\/li>\n
  • Bypass network constraints (no pushing from OCI to the home network) and synchronize certificates securely.<\/li>\n<\/ul>\n

    Rather than giving up with the excuse that “the architecture is too complex, so manual work is inevitable,” we will complete the automation while keeping the complex architecture intact.<\/p>\n

    The Barrier of Permissions and “One-Way” Network Traffic<\/h2>\n

    When automating this, we faced two major challenges.<\/p>\n

      \n
    1. Permission Denied: Let’s Encrypt certificates (\/etc\/letsencrypt\/) are protected by root privileges. Regular SSH users cannot read them, and any attempts to use rsync will be rejected.<\/li>\n
    2. Constraint of a Pull-Only Architecture: Even though they are connected via WireGuard, containerized operations and security considerations make it difficult to “push” updates from OCI to the home network. A mechanism where the home side “pulls” the certificates was essential.<\/li>\n<\/ol>\n

      Deploy Hook \u2715 Pull-Type Synchronization \u2715 Graceful Restart<\/h2>\n

      We solved this challenge in three steps.<\/p>\n

      1. Preparing the “Share” on the OCI Side
      \nWe configure a “deploy hook” that leaves the main certificate (owned by root) untouched and creates a copy in a location readable by a regular user only when an update occurs.<\/p>\n

      # Example Certbot renewal hook configuration on OCI\ncp -L \/etc\/letsencrypt\/live\/your-domain\/fullchain.pem \/home\/ubuntu\/certs\/\nchown ubuntu:ubuntu \/home\/ubuntu\/certs\/*.pem<\/pre>\n
      2. Pull-Type Synchronization Script on the Home Side (copy_ssl_sync.sh)
      \nWe specify the private key (id_rsa) and fetch the files using rsync while following symbolic links (-L). Additionally, we incorporated logic to compare file hash values to avoid unnecessary restarts.<\/p>\n
      #!\/bin\/bash\n# Configuration Area\nSSH_KEY=".\/id_rsa"\nSSH_USER="ubuntu"\nSSH_HOST="&amp;lt;OCI_IP&amp;gt;"\nREMOTE_PATH="\/home\/ubuntu\/certs\/"\nLOCAL_PATH="\/home\/root\/servers\/ols-docker-env\/"\nOLS_CONTAINER="openlitespeed"\n\n# 1. Hash value comparison\nPRE_HASH=$(md5sum ${LOCAL_PATH}fullchain.pem 2&amp;gt;\/dev\/null | awk '{print $1}')\n\n# 2. Execute synchronization (rsync must also be installed on the remote side)\nrsync -avL -e "ssh -i ${SSH_KEY} -o StrictHostKeyChecking=no" \\\n${SSH_USER}@${SSH_HOST}:${REMOTE_PATH}fullchain.pem ${LOCAL_PATH}\nrsync -avL -e "ssh -i ${SSH_KEY} -o StrictHostKeyChecking=no" \\\n${SSH_USER}@${SSH_HOST}:${REMOTE_PATH}privkey.pem ${LOCAL_PATH}\n\n# 3. Reload OLS only if updates occurred\nPOST_HASH=$(md5sum ${LOCAL_PATH}fullchain.pem | awk '{print $1}')\nif [ "$PRE_HASH" != "$POST_HASH" ]; then\ndocker exec $OLS_CONTAINER \/usr\/local\/lsws\/bin\/lswsctrl restart\nfi<\/pre>\n
      3. Automating via cron.d with an Emphasis on Reproducibility
      \nConsidering ease of management and reproducibility, we placed the configuration file in \/etc\/cron.d\/ rather than using crontab -e.<\/p>\n
      # \/etc\/cron.d\/ssl-sync\n00 03 * * * root cd \/home\/root\/servers\/ols-docker-env &amp;amp;&amp;amp; \/bin\/bash copy_ssl_sync.sh &amp;gt;&amp;gt; \/var\/log\/ssl_sync.log 2&amp;gt;&amp;amp;1<\/pre>\n
       <\/p>\n
      [Conclusion] Enjoying Constraints and Taming Systems<\/h2>\n
      By completing this automated SSL renewal setup, we successfully overcame the “constraint” of a complex network architecture using the “wisdom” of scripting.<\/p>\n
        \n
      • The X-Forwarded-For issue was resolved by introducing Nginx.<\/li>\n
      • The SSL renewal issue was resolved with a pull-type synchronization script.<\/li>\n
      • Operations and management were resolved through file-based management using cron.d.<\/li>\n<\/ul>\n
        At first glance, it might look like a roundabout architecture, but facing each challenge head-on and deriving solutions with one’s own hands is the very embodiment of the rich imagination and inquisitive spirit that “Nando Kobo” holds dear.<\/p>\n
        Now, we can finally dive back into our next DIY project or technical verification with peace of mind.<\/p>\n","protected":false},"excerpt":{"rendered":"
        The server architecture of our blog, “Nando Kobo,” has evolved into its current form after overcom […]<\/p>\n","protected":false},"author":4,"featured_media":2500,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_locale":"en_US","_original_post":"https:\/\/donguri3.net\/?p=2498","footnotes":""},"categories":[1170],"tags":[9,18,16,15,63,20,13,14,92,10,659,1040,131],"class_list":["post-5299","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-server-network","tag-diy","tag-docker","tag-lets-encrypt","tag-litespeed","tag-nginx","tag-oci","tag-ols","tag-openlitespeed","tag-wireguard","tag-server","tag-659","tag-1040","tag-131","en-US"],"_links":{"self":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/comments?post=5299"}],"version-history":[{"count":1,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5299\/revisions"}],"predecessor-version":[{"id":5302,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/posts\/5299\/revisions\/5302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media\/2500"}],"wp:attachment":[{"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/media?parent=5299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/categories?post=5299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/donguri3.net\/wp-json\/wp\/v2\/tags?post=5299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}