How to keep Admin panel on subdomain while frontend is to be on subdirectory?

[ivineet9]

Hi,

My client has a specific need where they need the website to be hosted in a subdirectory in the root domain; but need the admin panel to be accessible only via subdomain.

They say this is for the security purpose.

Frontend: https://example.com/app/

Backend: https://appadmin.example.com

Anyway I can quickly achieve this?

 

Thanks a lot.

 

 

[kongondo]

Hello @ivineet9,

Welcome to the forums ?.

3 hours ago, ivineet9 said:

Anyway I can quickly achieve this?

Most likely using a RESTFUL API or multi-instance ProcessWire if both sites are on the same file system. Mind, these will only get you as far as the data. If you want to 'see' the admin of the other site in the backend site, you will need to develop a Process Module.

3 hours ago, ivineet9 said:

but need the admin panel to be accessible only via subdomain

There are a couple of threads in the forums that discuss how the admin panel can be locked down to 'mimick' not accessible (redirects after login, hard-to-guess-admin-url, ProcessWire outside webroot, etc) but you cannot fully get away from an admin (unless I have missed new a trick or two).

Edited August 9, 2020 by kongondo
clarification

[bernhard]

I think that should be a lot easier. You can setup any vhost you want on your server to access your website, eg website.com, website2.com, or as subdomain admin.example.com.

So you setup 2 vhosts, one that points to the root dir with the folder containing your pw installation, so that you can access the frontend (example.com/app) and one that points directly to the app folder (eg admin.example.com)

In admin.php you add some PHP to check for $config->httpHost and block access to the admin if the request comes from example.com or www.example.com.

In ready.php you add some PHP that redirects requests coming from admin.example.com to admin.example.com/yourpwadminurl

--> if anybody visits admin.example.com he/she will be redirected to admin.example.com/yourpwadmin

--> users visiting example.com/app/yourpwadmin will be redirected to example.com/app (or blocked via 404, as you like)