Deploying an OPC UA Gateway to the Cloud

The lighting dashboard talks to its controller over a message broker, on the same network as the hardware. That works, but it doesn’t give me anything I can query later: no history, no collector, no place to run a historian.

So I built a second path — an OPC UA gateway that lives on the cloud box, reaches the PLC over a private link, and stores what it sees.

The shape

Browser → cloud gateway → private link → the controller → the gear.

The PLC’s job doesn’t change. It keeps running its logic, keeps its interlock, keeps its heartbeat priority. The gateway is a listener, and later a writer through the same narrow mailbox the controller exposes. Nothing about the physical system gets restructured to accommodate the collector.

Where it went wrong

Two machines, one name. The cloud box and the controller both answered to a short hostname that looked like it belonged to the controller. Resolving that name landed on the cloud box itself, every time, silently. The connection “worked” — to the wrong computer. The fix was to stop using names at all and pin an address, so the failure mode becomes impossible rather than merely unlikely.

The certificate wasn’t trusted yet. The secure channel negotiated, the handshake started, and then the controller refused our identity. That is the correct behaviour of a correctly-configured device, and the wrong thing to work around. No fallback to anonymous, no disabled validation, no weakened policy. The certificate goes into the controller’s trust list, properly, by hand.

The session identity is separate from the certificate. The certificate proves who we are. The application URI says what we are, and the controller compares it. If they disagree the session dies in a way that looks like a network fault rather than a configuration one.

A prompt waiting on a terminal that will never come. A credential prompt inside a service that has no terminal hangs the service forever instead of failing loudly. It has to fail at startup.

Where it stands

Staged, not deployed. The plumbing, the certificate, the service definition, the backup job and the reverse proxy are in place; the controller still needs to trust the certificate before the session completes. I’d rather leave it visibly staged than have it half-working and quietly writing to a database that doesn’t contain the truth.

The through-line

Every one of these failures was a case of the system telling me something was fine when it wasn’t fine. A name that resolved, a handshake that got far enough to look like a connection, a service that started and then waited.

The gateway can report every one of those as success. Only a check that compares the far end’s own view against mine catches it.