For Reasons, I want to create a second site, at a ...
# cfml-general
d
For Reasons, I want to create a second site, at a different URL, but pointing to the exact same code as an existing one. Not a copy, the same root directory. The only difference would be that code will check the host name and use a different database for the two hosts. This is on IIS running ACF 2021. Is this legit, or am I going to break the world if I try to set this up? You'd think I'd know this, but I've never actually done it.
t
I do this in testing, and have the same source code set up on 3 different sites, using different versions of coldfusion, and it works fine.
so I expect it would be fine for your use-case too.
m
That's a standard multi-tenant scenario. It isn't difficult to do, we use a single db, which just means you have to check tenant during queries. Switching datasource is fine though too. We have a few thousand tenants, so having a db per isn't really feasible.
d
Thanks folks. The thing here is that a subset of users will be made read-only as of a future date, and they won't be able to see any data entered after that date. Problem is, the app isn't built to partition the data like that, and it's really big and complicated, so updating every query and report is a non-starter. Separate frozen db seems like the best way.
@Tim you're not saying that the same physical copy of the code is running under multiple cfml engines at once, are you?
t
yes i am.
i've got 3 sites pointing at the same source directories, and each site is using a different version of coldfusion via the handler mappings.
d
So cf keeps template caching etc separate for the 3 versions? Interesting. I don't need to do that for this project, but good to know.
I'm wondering about the security implications of my scenario above, two domains hitting the same actual code, choosing datasource based on host name. The original site has been secured and vetted, firewall etc locked down appropriately. We have a new ssl cert for the new domain. I haven't thought of anything else we'd need to do to secure it when it'll be accessed at an additional domain. Is there anything I'm not thinking of here?
f
Just reading through old threads, wondering what you decided. I did something similar decades ago for a retail new car dealer chain. The owner was constantly buying and selling dealerships. I just added the new domain to table, what type of dealership, etc. It worked great, but security wasn't as big of a pain back then. I would not see any security problems caused by this.