Teams running OpenClaw v2026.5.x on vpshalo Mac builders often outgrow Traefik cookie stickiness or frp STCP visitor graphs. nginx stream performs SNI preread on 443/tcp and forwards raw TCP toward loopback listeners so OpenClaw still terminates TLS on the gateway process. This article is the minimal reproducible path: topology, stream fragments, certificates and tokens, merged status and doctor probes, and a cross-region digest, explicitly different from Traefik and HAProxy, frp STCP, and Cloudflare Tunnel.

Mirror OpenClaw flags across JP, KR, HK, SG, US West; push TLS to hardened Linux edges. Sections: topology, stream, certs and tokens, merged health, FAQ, six steps, quotables. Gateway and doctor stay on 127.0.0.1.

1) Traefik favors HTTP and invites double TLS unless TCP mode stays tight. 2) frp fixes outbound-only hosts but adds token and STCP sprawl. 3) Split status and doctor views page when SSH tunnels flap alone.

Pattern Best when Trade-off
Traefik L7 You need cookie-based affinity for HTTP control APIs More routers unless you simplify to TCP-only listeners
frp STCP Builders cannot accept inbound TCP from the Internet frps auth token plus per-proxy secret keys to rotate
nginx stream SNI You already operate nginx on the edge and want passthrough maps You own reload discipline and ACME lifecycle on that VM
Cloudflare Tunnel You prefer SaaS-managed ingress without exposing inbound 443 Another control plane and latency profile to budget

Topology: Mac builders, Linux edge, loopback OpenClaw

Each vpshalo Mac mini M4 runs OpenClaw v2026.5.x with --gateway-bind 127.0.0.1:18080 and --doctor-bind 127.0.0.1:18081. Forward loopback to a Linux edge on 443/tcp. Clients use gw.example and doctor.example; nginx reads SNI in the ClientHello only.

Align DNS Geo with CI latency metros. Digest must show whether edge, tunnel, or OpenClaw failed first. Log the security group that allows nginx to reach the builder hop.

nginx stream snippets for SNI routing

Load a dedicated stream { } context beside your existing http { } block. Enable ssl_preread on the public listener, map each hostname to an upstream IP and port tuple, and set generous proxy_timeout values because control sessions stay open for hours. Always execute nginx -t inside CI before promoting generated configs to production edges.

# /etc/nginx/stream.d/openclaw-sni.conf — replace names and upstreams
map $ssl_preread_server_name $openclaw_upstream {
    gw.example     10.42.1.17:18080;
    doctor.example 10.42.1.17:18081;
    default "";
}
server {
    listen 443 reuseport;
    proxy_pass $openclaw_upstream;
    ssl_preread on;
    proxy_connect_timeout 5s;
    proxy_timeout 24h;
}
Guardrails: empty default drops unknown SNI. Never commit tokens. Add JumpHost per Traefik HowTo when VPC access is indirect.

Certificates, tokens, OpenClaw v2026.5.x binds

Most teams let OpenClaw terminate TLS on the gateway while nginx simply forwards ciphertext in passthrough mode. If you instead terminate at nginx, you must wire fullchain.pem renewals, private key permissions, and reload hooks yourself. Prefer ACME DNS-01 on the edge when corporate filters block HTTP-01 challenges.

Load control-plane tokens from a secrets manager into systemd drop-ins rather than plain files in /etc. Pin v2026.5.x container images or tarball hashes per vpshalo region so upgrades roll in lockstep. Rotate tokens during published maintenance windows and immediately re-run merged probes against both hostnames after each rotation.

Merged status and doctor plus cross-region digest

A bastion worker curls https://gw.example/healthz and https://doctor.example/v1/status on the same SNI path. Merge JSON with region, gw_ok, doctor_ok, tls_days_left, epoch. Page only if both lanes fail inside five minutes.

Emit a minute-level digest: sort regions, float worst severity, attach git SHA or image tag so JP versus US West triage stays one pane without three dashboards.

FAQ: stream versus other OpenClaw ingress

Does stream replace JumpHost SSH? No. Stream handles the TLS front door while operators still reach builders through bastions described in companion articles.

Can gateway and doctor share one SNI hostname? Avoid it—distinct names keep map entries obvious and let probes target each lane before merging results.

What about QUIC or HTTP/3? This pattern is intentionally TCP-only; evaluate UDP-capable stacks separately when latency experiments demand it.

Six-step rollout checklist

  • 1 Freeze OpenClaw v2026.5.x hashes per region and document rollback tarballs.
  • 2 Enforce loopback binds on every vpshalo builder; verify with lsof -nP -iTCP that nothing listens on public interfaces.
  • 3 Issue TLS material for gw and doctor hostnames; automate reload through systemd path units.
  • 4 Deploy the map $ssl_preread_server_name stanza; require green nginx -t in CI before promotion.
  • 5 Tighten security groups so only the edge VM may forward toward builder loopback hops.
  • 6 Enable merged probes plus the cross-region digest before granting wider operator access.

Paste into runbooks

  • SNI preread with nginx stream keeps OpenClaw TLS ownership on loopback while the edge only steers TCP.
  • Merge gateway status JSON and doctor JSON before paging; emit cross-region digests only after a five-minute quiet window.
  • Pick stream when nginx already runs your perimeter; keep Traefik or frp when their feature set matches the risk profile.
  • Pair every certificate rotation with automated reload tests and immediate merged probe validation.
Disclaimer: Samples omit secrets. Confirm stream and ssl_preread modules. Respect Apple and Linux vendor guidance.

Match remote Mac metros to RTT data; vpshalo pricing tracks the same regions as your digest.

Help, home, related OpenClaw

Choose ingress your team can operate

Help · Home · Blog. Related: frp STCP, Traefik JumpHost, Cloudflare Tunnel, Tailscale.

Pricing · Purchase · Tokyo · Seoul

Rent a regional Mac builder Help Home OpenClaw articles