100 Days of DevOps and Cloud (AWS), Day 15: HTTPS on Nginx, and the Incremental Trick That Makes Snapshots Cheap

Test before you reload. That one habit is the whole difference between a config change and an outage, and it is baked into how you work with Nginx. Day 15 was TLS on Nginx, where a single broken line can take the site down if you skip the check, and then EBS snapshots, which are quietly one of the best deals in AWS storage.

One Linux task, one AWS task. Configure Nginx to serve HTTPS with provided certificates, then take a point-in-time snapshot of an EBS volume. The tasks come from the KodeKloud Engineer platform.

Nginx TLS: place the certs, wire them up, test before reload

Nginx on RHEL and CentOS comes from the EPEL repository:

sudo yum install epel-release -y
yum install -y nginx
systemctl enable nginx
systemctl start nginx

Then put the certificate and key where the system keeps them:

# Public certificate goes with the certs
mv cert.pem /etc/pki/tls/certs/
# Private key goes in the private directory, root-only
mv key.pem  /etc/pki/tls/private/
sudo chmod 600 /etc/pki/tls/private/key.pem

A word on placement, because it matters. The public certificate belongs in /etc/pki/tls/certs/. The private key should go in /etc/pki/tls/private/, readable only by root. My lab notes dropped both into the certs directory to keep it simple, but in practice the private key gets stricter treatment than the certificate, because it is the secret half of the pair. Keep them separate. Then point Nginx at both:

vi /etc/nginx/nginx.conf
# In the TLS server block:
# ssl_certificate     /etc/pki/tls/certs/cert.pem;
# ssl_certificate_key /etc/pki/tls/private/key.pem;

Now the habit worth burning in:

# ALWAYS validate the config before applying it
nginx -t

# Only if the test passes
systemctl restart nginx

nginx -t parses the config and tells you if anything is wrong without touching the running server. Restart on a broken config, and Nginx can fail to come back up, taking the site with it. Test first, every single time, then restart. Finally, confirm HTTPS is answering:

# -k skips cert verification, fine for a self-signed test cert
curl -Ik https://hostname

The -k flag skips certificate verification, which is fine for a self-signed cert in a lab. In production you want the real chain to validate, so treat skipping the check as a test-only shortcut.

EBS snapshots: full backups at incremental cost

The AWS task was a point-in-time snapshot of an EBS volume, the standard way to back up a cloud disk:

# Snapshot a volume, with a description and a tag
aws ec2 create-snapshot \
  --volume-id vol-0e9bbb3943d871f56 \
  --description "Nautilus Snapshot" \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=purpose,Value=nautilus-vol-ss}]'

# Watch it move from pending to completed
aws ec2 describe-snapshots --filters "Name=tag:purpose,Values=nautilus-vol-ss"

Here is what makes snapshots such a good deal. They are incremental. The first snapshot copies the whole volume, but every snapshot after that stores only the blocks that changed since the last one. Take a daily snapshot of a 100 GB volume where a few hundred megabytes change each day, and you pay for those few hundred megabytes, not 100 GB a day. AWS still lets you restore any single snapshot as a full volume, it tracks the block references behind the scenes, so you get full backups at incremental cost.

Two practical notes. Snapshot creation is asynchronous, the call returns immediately, and the status moves from pending to completed on its own schedule, so a script should wait on completed rather than assume. And a snapshot is more than a backup, you can build a new volume from it or copy it to another region for disaster recovery.

The through-line

Both tasks were about protecting something valuable with a cheap, repeatable action. nginx -t protects your uptime for the cost of two seconds before every reload. Snapshots protect your data for the cost of a few changed blocks. The good habits in this work are rarely expensive, they are just easy to skip until the day skipping them hurts.

So here is the Day 15 question. Would you rather build the cheap safety checks into your routine now, or explain later why the one time you skipped them was the time it mattered?

Day 15 down. Eighty-five to go.