bluesclues9 Posted October 26, 2012 Share Posted October 26, 2012 Hi I am lost here. We need to deploy our first CakePHP application using 3-tier architecture as follows. My CakePHP appl. already works on my localhost however, we need to place CakePHP appl. inside firewall and have a separate webserver outside firewall that actually processes user requests. How can we deploy something like this?. This is needed to protect all code written in CakePHP (Controllers, Models, Views). The desired deployment is like this.. 1. Web Server - Just receives requests/sends responses back to the user. This is outside firewall. 2. App Server - This is where we have CakePHP code. Receives Requests 'Only' from webserver and processes requests using CakePHP M-V-C and responds to WebServer. 3. Database Server - This is where we have Database engine running. This server receives requests from AppServer. CakePHP AppServer simply connects to this Database Server. As of now, my localhost has Web/AppServer running. I don't like this architecture as my localhost has CakePHP code developed by us. Any ideas...I thought this is no brainer but now, I am perplexed as how I can split WebServer and AppServer(CakePHP). Thanks Blues Clues Quote Link to comment Share on other sites More sharing options...
requinix Posted October 26, 2012 Share Posted October 26, 2012 Sounds like #1 is just a reverse proxy. Quote Link to comment Share on other sites More sharing options...
ManiacDan Posted October 26, 2012 Share Posted October 26, 2012 What is the purpose of this separate server? Does it work as a firewall? Why is it there? If all it does is forward requests to your php server, you already have a machine that does that: Your router. Quote Link to comment Share on other sites More sharing options...
bluesclues9 Posted October 26, 2012 Author Share Posted October 26, 2012 Web Server tier is simply for hiding my CakePHP codebase behind a firewall...CakePHP tier (so called app server in my architecture above, #2) has a lot of business logic code writtenw which if hacked would be a disaster. So we need to keep this behind a powerful firewall and allow only our front-end webserver make requests through a specific port (say, 7000). period. In this way, we can be fairly confident that the codebase is secured. I am really puzzled about this whole M-V-C framework not providing ways to seperate business logic tier onto a seperate server. I can't imagine noone has ever needed this security (that I am looking for right now). Am I missing something?. None of M-V-C frameworks (PHP) offer this seperation. Quote Link to comment Share on other sites More sharing options...
bluesclues9 Posted October 26, 2012 Author Share Posted October 26, 2012 requinix: Thanks for your input. Certainly looks promising. I am going to look further into this. Quote Link to comment Share on other sites More sharing options...
ManiacDan Posted October 26, 2012 Share Posted October 26, 2012 What I'm saying is: What purpose does this entire server serve if it does nothing but forward all requests to a second server? if I try to hack your server, this "proxy" will just forward my hack attempts along. You've never seen this before because the thing you're trying to do doesn't make any sense. I've worked with systems where business and display logic were on separate servers. They used an internal API. But your system is already designed, and you have just now thought about this problem. It's too late to separate your logic into different servers. Quote Link to comment Share on other sites More sharing options...
raghava Posted October 31, 2012 Share Posted October 31, 2012 I built an application using drupal7 and I want to separate the app server (for database access, dynamic processing of PHP scripts) from Apache web service. Is it possible? came to know that In CakePHP like frameworks it is possible by modifying the app server configuration and expecting a solution in case of Drupal also soon, please. Quote Link to comment Share on other sites More sharing options...
ManiacDan Posted October 31, 2012 Share Posted October 31, 2012 Did you not read this entire thread? Quote Link to comment Share on other sites More sharing options...
txmedic03 Posted November 24, 2012 Share Posted November 24, 2012 What it sounded like the OP was looking for was to have the first server receive requests then process those requests and send new requests based on those requests through the firewall on a particular port. Once the intermediate server receives the response from the second server it packages it up all nice and pretty and returns it to the user. It seemed like just a plain proxy was not their intention. Now for the problem. Even if server #1 doesn't just forward all requests straight to server #2 (which would be done with port forwarding on the router), if server #1 gets 'hacked' it is a trivial thing to use it as a proxy to attack the second server and to know which ports are open. Server #2 would think all the requests were coming from server #1 since we would be accessing it via server #1, so attempts to restrict access to only that one machine would be futile. It is a convoluted plan for security that doesn't provide any real security at all. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.