eric-o

Thank you so much….that was enough of a hint to help me figure out what was wrong. For anyone else that might encounter this, you need to see if that links-page.css is loading. In my case, it was not, due to an .htaccess file in wp-content/plugins/. I don’t know why that .htaccess file was there but it was forcing any thing with “links” in it’s title to be interpreted by php, which somehow didn’t break everything, only some things.

Just knowing which file to check was a big help. Thank you!!

-erico

I did end up figuring out a very nice solution, though it was not simple. It involved creating two separate plugins that I have not made public, but would be willing to share if you message me privately.

The essence of the approach I used was this:

1) I created a faceless always-on plugin that directed ssl traffic to one site and non-ssl traffic to a server pool. The basic framework of that plugin was from the stack exchange post I noted above: http://wordpress.stackexchange.com/questions/38902/use-a-different-domain-for-ssl

2) I created a second plugin to replace several commands in pluggable.php that deal with the login cookies as described in http://www.seriouslyproductions.com/512/securing-wordpress-admin-via-ssl-using-a-separate-admin-subdomain/

3) I created a set of rsync scripts to synchronize the important directories that need to be updated at a local level.

These things together allow one to separate out the admin and server functions of wordpress and run it successfully on several (virtual) machines. It is not for the fright-of-heart, but it is really nice to not have one’s admin panel exposed to the internet.

I am afraid I can’t do a step-by-step guide, but that should get you started. If you have experience writing plugins, I’d be happy to share my crude code for doing this if you had interest in making an official plugin.

cheers,
Eric

I think the technology discussion here is very interesting, thank you!

But I thought I’d just note here that the question of using a separate admin server is not impossible. I’ve so far managed to get it working pretty well. The short version is that I this trick outlined on stackexchange to get SSL onto a separate domain.

I then added an .htaccess rule to fix previews on the ssl box:

RewriteCond %{HTTP_HOST} ^public.domain.com$ [NC]
RewriteCond %{QUERY_STRING} .*(/?preview=true.*) [OR]
RewriteCond %{QUERY_STRING} (.*&preview=true.*) [NC]
RewriteRule ^(.*)$ http://secure.domain.com/$1$2  [L,R=301]

Both machines are pointing to the same database. You do need to disable cron on the slave machines so they don’t duplicate tasks.

I have yet to lock down the file system on the apache app server so that it is read only and copied over with rsync. But it is getting close to working. I’d be curious, still, if anyone had any warnings as to why this might be a bad idea or why this isn’t often done. It seems like a nice system…and hey, i can get into my panel even when things are pretty busy on the public site.

-eric

Pothi,

Thanks for your thoughts. Sigh, yes, part of the reason I am asking the question is because I would like to avoid putting another layer in front of everything. But basically what you are suggesting is to put nginx in front of varnish in order to accept and proxy the incoming SSL connections aimed at the underlying box. Do you have experience running nginx as a load balancer/proxy in front of varnish? And can it be done profitably on the same box? That’s a lot of layers, and starts to make me wonder if one just doesn’t get rid of varnish at that point, and use nginx in front of apache. I’d lose grace mode though, which is not desirable.

right now I have

user–> [varnish / apache app server /https ] —> mysql server
[ square brackets = all on the same box]

I can’t tell if you are recommending
user—>[ nginx / varnish] —> apache app servers [1-x] —> mysql servers
or
user—> [nginx] —>[varnish] —>apache app servers [1-x] —> mysql servers
https user [nginx] —> apache app servers [1-x] —> mysql servers

As far as I know, one would not be required to use the second one of these, but I don’t know.

my idea was to not have to have apache server x have a public ip address that one could just https directly into, perhaps with a php directive that forced an https connection to override the wp_home / wp_siteurl settings in the mysql databases.

But it sounds like no one has ever tried that…and that’s probably because there’s some reason it won’t work.

Just to clarify, when you say use nginx here to separate out ssl from non-ssl traffic, you are just using nginx as a proxy server, right? Does wordpress have the ability to purge its cache in that situation? Or do you turn of caching in nginx and essentially use it instead of, say, haproxy?

So any thoughts about putting nginx and varnish on the same box? Or does nginx just end up caching varnish’s cache to disk and slow everything down?

best,
Eric

Do you think this is an “advanced” topic? Or does it belong somewhere else? I wasn’t sure which forum to post it in.

I’m happy to post it to another forum or write it up as a feature request. It seems like a pretty straightforward thing that would be very useful. Just being able to get into the panel when the outbound server is under heavy load has got to be an issue.

I do understand it’s a little bit like trying to move /wp-admin out of the path…but I’m willing to learn a fair amount about WP internals to make it work. At the very least I need to show I’ve tried.

thanks,
Eric

Dear Esmi,

Thanks for your suggestion.

I am not using hyperdb right now, but probably will when switching to a load-balancing situation where I need to have multiple databases (largely for geographic diversity of data centers).

But I guess I’m missing how adding multiple database servers (which is hyperdb’s main function) would help with the problem of moving the admin functions to separate web server. I can see that hypderdb would allow one to make one DB a master for all writes, while all other DBs would be read only–and that is useful–but what I’m trying to do is duplicate (and separate out the functions) of the servers running apache. Or is there a function of hyperdb that I’m not seeing?

best,
Eric