Admin app - how

[peterH]

What's the best way to set up a separate admin app? Preferably, I would like for the app to run in the same domain as the main app (a sub domain would be ok) and to be secured by a LE cert. Are there options other than using the host.exe?

TIA
Peter

[Wolfgang Orth]

Peter,
you want that admin-program being a webserver also? Both regular and admin webserver sitting on the same machine?

[peterH]

Hi Wolfgang,

Yeah, that's what I had in mind.

Peter

[Niels Larsen]

Hi Peter

I have done that by creating a separately indexpage (webpage) + login form and then handling the logged in status by a session var.
Works perfect!

Regards Niels

[peterH]

Hi Niels,

So you've basically added an 'admin login' on the main page, is that how it works?

Peter

[Niels Larsen]

You can do that if you want to show this option for the rest of the users. I don't.
I have only 1 app for 4 different "sites". One uses the default NTSW security option, one uses my own security (using a session var), one admin site my own security and one fore public use.
For browses and forms in my owne security zone i just add a small bit of code in the top of each procedure:
Browse:
if p_web.GSV('AdminLoggedIn') <> 1
  RETURN
END

Forms:
if p_web.GSV('AdminLoggedIn') <> 1
  RETURN -1
END

I have absolutely no idea this is the best approach, but it works fine for me and really easy to maintain.

Regards Niels

[Wolfgang Orth]

Peter,
it is in general easy to have several different webserver running on the same machine under the same IP-Address.

One way would be to use Nettalks Host.EXE, where each webserver is compiled as a DLL for this Host.EXE. Downside: each webserver-DLL has to be updated, if you update just one. (when a new major release comes out)

Another way is to run either an Apache or the IIS as a reverse proxy or "gateway server".

Lets say, your domain is www.peter.dk and it is at a hosting provider somewhere. If this hosted domain is running on Linux, then you have no other chance rather then running your NTWS somewhere else. (I mention this just for completeness). Lets assume, you have a static IP-Address at your office lieke 123.123.123.123, so you can run this proxy / gateway on one of your office machine, listening to port 80, while your own NTWS listen to 20.080, 20.081, 20082, etc.

At your website www.peter.dk you configure the subdomains to point to 123.123.123.123. 

You tell the Apache (or IIS) somewhere in its configuration to act as a proxy / gateway server. In the configuration you also tell this proxy "If a request comes in for admin.peter.dk, then direct this request to 192.168.2.100"

This is such a .conf from the Apache 2.

<VirtualHost *:80>
        # The ServerName directive sets the request scheme, hostname and port t$
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.
        #ServerName www.example.com

        ServerAdmin webmaster@localhost
#        DocumentRoot /var/www/html

        ServerName admin.peter.dk
        ServerAlias admin.peter.dk

        ProxyRequests Off
        ProxyPreserveHost On

        ProxyPass / http://192.168.2.100:22080/
        ProxyPassReverse / http://192.168.2.100:22080/

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf
</VirtualHost>

I run this Apache 2 on a Raspeberry pi in my office.

If you have rented a virtual Windows webserver (starts at 10 Euro per month, 100 GB / 2 GB, Win Server 2012), then you could have all in one place.

Downside: while all insecure webserver are all reachable via port 80, the secure webserver need to be addressed with the port in the URL. At least I do not know to overcome this. Perhaps there is a solution, which would make it looking nicer.

Lets say, you have a subdomain like secure.peter.dk. Same as described above: you point the requests to 123.123.123.123. Here you have your NTWS-Server with LE-certificate running on your local computer 192.168.2.100, next to all the others. You have set this NTWS to insecure port 21.080 and secure port 21.443.

For LE your address secure.peter.dk points to 123.123.123.123:80, when it wants to contact and request the challenge. Because of the gateway server, 192.168.2.100:21.080 looks and behaves like 123.123.123.123:80. Once you got the certificate granted, your NTWS will receive the request from the outside via Apache, pointing to 192.168.2.100:21.080 and instantly swap you over to the secure connection. And here the browser will now display https://secure.peter.dk:21.443. (Addendum: while port 80 should be open by default, you have to allow this port 21.443 in your firewall)

The benefit of a gateway servr is, that you can hoard several NTWS from different versions, no need to recompile all DLL, and you can have more than one machine on your LAN to host webserver. The Apache redirects to wherever you want, what it finds in the .conf-file.

I hope my lengthy explanation was somehow understandable. Probably Lars' suggestion would be more suitable.


This guy runs vhosts on the Raspberry itself, but its just a matter of configuration, to point to a NTWS.
https://www.stewright.me/2013/08/add-virtual-hosts-and-subdomains-to-your-raspberry-pi-apache2-server/

There are tons of other description. CAVEAT: In the recent Apache version the the configuration files have to have the extension .conf. All How-Tos I found on the web were refering to the older standard withoput extension. Took me a week t find out....


And, of course, you can run the Apache on a Windows machine too! Not to speak of IIS, of which I have no experience.

HTH
Wolfgang

[Richard I]

Hi Peter,
It doesn't have to be hard...
I have  three different NT apps all running out of the one folder, sharing the same tps data files but with different PORT addresses.
Each has its own sub-domain
Alternatively, have one big app with all options on Forms, that are filtered by levels  at login.
HTH
Richard NT 11.04

[Bruce]

Hi Peter,

Wolfgang uses this approach
>> Another way is to run either an Apache or the IIS as a reverse proxy or "gateway server".

but as he has noted it's complicated to set up, ideally requires more hardware, and (unless you are an Apache expert) is difficult to maintain. Yes it _can_ be done this way, but in my opinion there's no need to do it this way, and it makes a simple task really complicated. (I've never been a fan, but if you ike it, then of course you are welcome to do it.) Frankly in this age of "all apps should be secure" the Apache approach serves no purpose at all.

The easiest approach is, as Richard say, just run the Admin server on a different port. Since it's an Admin server it's likely not even for public consumption anyway so you can run it on any port you like (just, of course, make it a secure port.)

>> One way would be to use Nettalks Host.EXE, where each webserver is compiled as a DLL for this Host.EXE. Downside: each webserver-DLL has to be updated, if you update just one. (when a new major release comes out)

If you have to share the port number then you can run it under the Host. But I should point out that the host, and all DLL's need to be in sync - at the BUILD number level, not the major version number. In other words it's not ok to just "all be on NetTalk 11" - they all have to be on the same build in NetTalk 11.

To me it sounds like just running them as separate ports would be fine.

cheers
Bruce

[peterH]

Thank you all for your suggestions!

I think I'll go with the separate ports solution, looks like it'll serve the purpose. I might have an additional question or two regarding security/certificates but I will play a little first. If there's a webinar tomorrow that might be a good place to ask further.

Thank you
Peter

[Richard I]

Hi Peter,

See how you get on.....If you get into strife, send me an email, and I will send you  a very simple flow chart  that I created, on setting up a certificate, and subdomain
I put this together as a reference! ( It refers to Webinar 205)
My email is logtimer@yahoo.com

Cheers
Richard

[Sibuya]

Hi Peter,

I'm using SecWin to manage all access.

Best regards,

Marcos Sibuya