I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration of the same. Now, I'm aware that there are third party tools that can make a lot of things easier but some management functionality and information is app specific, and my admin dashboard aims to cover those.
Since I have only vague ideas about how to develop and where to hide such a dashboard, I'm wondering how large sites — Twitter, Instagram — do it. I have a hunch that they hide their admin dashboards from the public inside either a Virtual Private Network or a Virtual Private Cloud with private IP addresses.
Is this assumption correct?
If so, how is the source code for the admin site handled in relation to the source code for the web app itself — is the source code for the two sites handled separately or together, and does it get special treatment?
Another approach I'm familiar with is hosting the admin dashboard and the web app together at the same domain. Something like
mydomain.com/admin This is however undesirable to me, as it'll require
robots.txt entries that pinpoint exactly where the admin site can be found. I'd like the location of the admin site to not be known at all.
So what other options are available that I'm unaware of?
UPDATE: That I want to hide the admin site does not mean that I intend to be lax with auth. Strong passwords and MFA will be required on the admin site, whether it's hidden or not.