Best practices for secure server-to-server communication while maintaining performance

Backend
1

I have a system with two separate servers and I’m wondering if my approach will cause performance problems as I scale up. Let me explain my setup:

My Current Setup

I run two servers:

  1. Public Server - Users can access this to browse products and make purchases. It’s visible to everyone on the internet.

  2. Data Server - This holds all the database information and stays hidden from public access.

How They Talk to Each Other

Right now, the public server only contacts the data server when users want to download products with their license keys. The public server runs a script that sends JSON data using curl to the data server. The data server responds with instructions on how to handle the download.

Why I Built It This Way

I wanted to keep the data server completely hidden from users. Even if someone breaks into the public server, they can’t easily access the database without knowing the exact API calls to make.

The Issue I’m Facing

Currently, server communication only happens during downloads, so traffic is low. But I want to add a user dashboard where people can log in, see their licenses, check order history, and manage their accounts. This means the public server will need to make many more requests to the data server for every page load and user action.

I’m concerned this will create a bottleneck and make the user interface slow since every request has to go through this extra step.

Has anyone dealt with similar challenges? What’s the best way to handle this kind of architecture without sacrificing performance?

2

hmm, a caching layer could be a game changer! how often do you plan to update your data? also, what’s your user growth projection? these might help in scaling effectively!

3

I built something similar three years back and hit the exact same performance issues once I moved past basic downloads. Here’s what actually worked: ditch individual curl requests and use connection pooling with request batching instead. Don’t make separate API calls for every dashboard piece - bundle them up. When someone loads their dashboard, grab licenses, order history, and account details in one shot. Also, keep HTTP connections alive between your servers instead of opening new ones each time. That alone cut my response times by about 60%. Throw Redis or similar caching on your public server for stuff users access a lot - just set proper TTLs. Your security setup looks good, but you’ve got to fix the communication bottleneck before you can scale this thing.

4

connection pooling helps, but add async requests to your public server too. fire off multiple API calls at once instead of waiting for each one to finish. handle responses as they roll in so users arent stuck waiting while your servers talk. fixed the same bottleneck issue for me.