I am currently looking into hosting an Ethereum node on my web server in order to allow my users to interact with my dApps without needing Metamask (although it could be used). How could I have the client side Web3.js code interact with my server as the hook instead of whatever would normally be injected by Metamask. If I were to include the web3.js code on my server and link it in the header, could I simply construct the Web3 object with my node as the provider and Metamask would no longer be necessary?
If Metamask is necessary for normal browsers no matter what, an explanation of why would be greatly appreciated. If what I've stated could work, how could I use my server hosted node as a provider (what port would I use and could I use my normal domain) as well as what could I do to improve security. My biggest worry is that if everything works as simply as I've suggested here, that someone could create a website of their own that connects to my node and everyone will start using my node for all of their websites.
My server is setup as a LAMP server and I use named virtual hosts in order to redirect/control traffic as I need it (could this be used to secure my node from others using it). I would prefer to stick with my current setup instead of switching to node.js but if it is absolutely necessary in order to get a site that works without Metamask, I would definitely look into it.