1

First of all, I‘m not sure if this is the right place for this question, but since it was marked as off-topic on server fault I thought I should try it here.

I'm going to start with the current development setup: I have a local apache webserver managed with XAMPP and no SSL/Certification set up, running on my personal computer. I have a small MySQL database in the background.

The website is supposed to provide a simple form for the employees to enter their shift details (start time, end time, numbers of boxes processed etc.) into. These details are then send and stored inside the MySQL database.

I believe that the environment is relatively low risk. I don't believe that anybody working with the site is going to try to tamper with the security in any serious way, so basic security required by European law (GDPR) should be enough. I know that my current setup is not for production but I'm also extremely new to this kind of project and that's why I want to get some ideas form you guys about how to set things up.

My questions are but are not limited to:

  • Should the server and database be running locally (at home) or in the cloud (with azure or something like that)?
  • If it runs locally how can the employees in the company connect to the local server (via a VPN maybe?)?
  • How can I guarantee availability when I run it locally?
  • What alternatives are there to XAMPP (that are for production and not development)?
  • What else should I take into consideration?

Thank you very much in advance!!

closed as too broad by bertieb, DavidPostill Oct 8 '18 at 20:05

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • This is off-topic here too, as it's simply too broad. Questions on here should be about specific problems. – confetti Oct 7 '18 at 21:48
  • Is there any place I can ask this question? – CVE-2017-5754 Oct 7 '18 at 21:50
  • You potentially have a bunch of different question(s) that might need to be asked in different areas. Server@home? Best if it runs locally inside the company to avoid access issues, otherwise cloud so it can be running 24x7. You should probably use a PHP framework to deals with some issues for you. The structure and coding is stackoverflow , security is Information security. There is also Database Administrators for mysql/database questions. – cybernard Oct 8 '18 at 0:53
  • How can I guarantee availability when I run it locally? Define how strict your uptime must be? Most cases a decent UPS with cable modem,computer, and network switch plugged if you got a separate router/switch. Complete loss of power, install a generator. You maybe need 2 or more ISP to guarantee your internet stays up. How about earthquake,flood,fire, or etc protection it gets more and more complicate and expensive. This is why cloud computing makes more sense, they got those handled for you. – cybernard Oct 8 '18 at 1:00
  • Thank you very much for your extensive answers. The problem is that multiple geographical locations have to be covered. That’s why I want to run it at home. It’s not really a professional thing, I’m just doing this for my dad as a hobby project. I’m going to try to split up my question and search for the right communities – CVE-2017-5754 Oct 8 '18 at 7:11
0

Should the server and database be running locally (at home) or in the cloud (with azure or something like that)?

Both are possible, each with its advantages and disadvantages. The most important consideration is availability.

If it runs locally how can the employees in the company connect to the local server (via a VPN maybe?)?

You will need to port-forward some port on your router (better not 80) to port 80 of the server. You will also need a DNS name for your company. if you don't have one see 5 Best Dynamic DNS Providers You Can Lookup for Free Today . Employees will accede via https://yourDNS:yourPort. You don't need VPN.

How can I guarantee availability when I run it locally?

You can't. There is no guarantee either when running on the cloud, although the percentages are better.

What alternatives are there to XAMPP (that are for production and not development)?

There are other web servers, on Linux and Windows. On Windows mostly IIS is used. Search for them.

What else should I take into consideration?

A lot. Pay special attention to security and to avoiding SQL injection vulnerabilities.

  • Thank you very much for the answer. Does it make sense to not open the server up to the internet and keep it in a local network for the employees to connect to it via a vpn? I was wondering if it improves security since not anybody on the internet can interact with the server this way? – CVE-2017-5754 Oct 8 '18 at 10:58
  • Security-wise, it makes a lot of sense. Why would you need VPN inside your local network? – harrymc Oct 8 '18 at 11:28
  • The server is at home inside my local network but the employees somehow need to connect to that network to be able to use the form and to do that without just using the internet I thought you need a vpn connection to the network. They are not in the same place as the server. – CVE-2017-5754 Oct 8 '18 at 11:36
  • VPN is not really necessary - HTTPS is enough. – harrymc Oct 8 '18 at 13:05
  • Even HTTP is all right in an internal network. – harrymc Oct 8 '18 at 13:25
0

In terms of infrastructure, I would advise not to run and maintain any infrastructure like a LAMP - locally or in the cloud - for a task like that, rather go with a sandboxed approach.

It has a bit of a learning curve at the beginning, but we have been successfully using Google App Engine with PHP - see https://cloud.google.com/appengine/docs/php/ - for smaller tools like yours appears to be

For low traffic applications (and yours looks to be one) it is basically free and you can easily add a MySQL database with Google Cloud SQL.

Also takes away a lot of infrastructure related security considerations from your table, however application related security like SQL injections still need to be taken care of

Not the answer you're looking for? Browse other questions tagged or ask your own question.