Host Web services on a second server

Question

Hello everyone, maybe it's a silly question.. but I don't know how to do that.
I've 2 server on a single network, one Xserve (with leopard server) and one Mac Mini (with Snow Leopard server). The xserve is connected to the router and offers DNS, NAT and dhcp services; Mac Mini is connected to the internal network created by Xserve, and I'd like to host the web services (like site, wiki and blog) on the mac mini. How can I do that?
I've a public IP but I think that points directly to the Xserve. How do I ensure that web services are accessible from outside using a browser?
thanks in advance for your advice, any help is welcome!
-a.

Answer 1

External domains are a prerequisite here, and a minimum of one public static IP address.
You can set that up with a reverse proxy (Apache reverse proxy) through the Xserve box, allowing connections from outside to reach the Xserve and the Xserve communicating with the Mac Mini box. This is basically a web pass-through, were Apache running on your Xserve can hand off to your Mac Mini. This involves reading the [web manual|http://www.apple.com/server/macosx/resources/documentation.html] and using Server Admin to establish the reverse proxy.
You can also set up a mid-level server-grade external firewall (using an external firewall and not a Mac is locally preferred for various reasons) to have it port-forward connections based on IP address, for instance. This is a more traditional set-up for a web server, and is covered in various IP network configuration discussions around the Internet. This involves setting up your network with a reasonable mid-range commercial or open-source firewall, and establishing port-forwarding on the firewall.
You must expect your servers to be attacked, and you will be attacked. The servers I administer are attacked many times a day, with XSS and SQL injection attempts and probes for various other known vulnerabilities, dictionary attacks against passwords, and attempts to post spam on the web sites are also very common. This involves monitoring your logs, watching for attacks, and staying current on all your software and keeping your archives current; your (trusted) backups are the path back from a server breach.
You may want to consider a DMZ for your public-facing services, which is another feature of a typical server-grade firewall, as a web breach can get hairy for the rest of your LAN. Using a properly-configured DMZ usually isolates a breach.
Here's an old [write-up on the various network pieces|http://labs.hoffmanlabs.com/node/275] that can be involved in a small server-oriented network configuration.