We are going to deploy our service, it's drupal based with some additional REST APIs.
The drupal servers will be (loadbalanced) put in the DMZ. We think to deploy the REST APIs on an app server in the DMZ as well, including authentication/authorization. We'll have an additional firewall, behind which the database server with storage is running.
- What is state of the art architecture for the APIs in terms of security, would I have the APIs running as a facade in the DMZ and delegate to some app server in the secure zone? Or is it ok to have the processes running in the DMZ.
- There are a couple of infrastructure APIs (logging, management:start/stop services), which logically don't belong to the DMZ. We were thinking of putting them on the same server (to save hosting costs). Is there some security risk with this? Should that be in the secure zone as well? (Those services will not be used from the Internet)