Implement Admin API

.env.sample

@@ -3,6 +3,10 @@ ELASTICSEARCH_URL=http://localhost:62222
 
 # API server port
 PORT=5000
+ADM_PORT=5500
+
+# For Admin API, we use Cloudflare Access to protect it
+CLOUDFLARE_ACCESS_TEAM_DOMAIN=https://cofacts.cloudflareaccess.com
 
 # Rollbar setup
 ROLLBAR_TOKEN=YOUR_ROLLBAR_TOKEN
@@ -121,12 +125,6 @@ OPENAI_API_KEY=
 # When LOG_REQUESTS exists, it also shows incoming GraphQL operation, variables, and resolved user info
 LOG_REQUESTS=
 
-# If given, API server will link to Google Pub/Sub using Application Default Credentials,
-# to receive and execute administrative commands.
-# It will create the topic, subscription and schema if not exists.
-#
-ADMIN_PUBSUB_TOPIC=
-
 # Internet Archive S30Like API key and secret from https://archive.org/account/s3.php
 # They are used to call Save Page Now 2 Public API
 #

Dockerfile

@@ -21,7 +21,7 @@ FROM node:18-alpine3.18
 RUN apk update && apk add ffmpeg
 
 WORKDIR /srv/www
-EXPOSE 5000
+EXPOSE 5000 5500
 ENTRYPOINT NODE_ENV=production npm start
 
 COPY --from=builder /srv/www/node_modules ./node_modules

README.md

@@ -54,6 +54,7 @@ $ docker-compose up
 This will:
 
 * rumors-api server on `http://localhost:5000`. It will be re-started when you update anyfile.
+* rumors-admin-api server on `http://localhost:5500`. It will be re-started when you update anyfile.
 * rumors-site on `http://localhost:3000`. You can populate session cookie by "logging-in" using the site
   (when credentials are in-place in `.env`).
   However, it cannot do server-side rendering properly because rumors-site container cannot access
@@ -164,9 +165,16 @@ Run the docker image on local machine, then visit `http://localhost:5000`.
 (To test functions involving DB, ElasticSearch DB must work as `.env` specified.)
 
 ```
-$ docker run --rm -it -p 5000:5000 --env-file .env cofacts/rumors-api
+$ docker run --rm -it -p 5000:5000 -p 5500:5500 --env-file .env cofacts/rumors-api
 ```
 
+## Admin API
+
+The Admin API running on `http://localhost:5500` is used for managing the data in the database.
+
+On production environments, the Admin APIs are protected by Cloudflare Zero Trust.
+Only users and service tokens specified in Cloudflare Access can access the Admin API.
+
 ## Cronjob / management scripts
 
 ### Clean up old `urls` entries that are not referenced by any article & reply
@@ -205,10 +213,6 @@ $ node_modules/.bin/babel-node src/scripts/fetchStatsFromGA.js
 
 -  For more options, run the above script with `--help` or see the file level comments.
 
-### Pulling administrative commands from Google Pub/Sub
-
-When API server starts up, it will link to Google Pub/Sub topic if and only if env var `ADMIN_PUBSUB_TOPIC` is set, using [Application Default Credentials](https://cloud.google.com/docs/authentication/application-default-credentials).
-
 ### Removing article-reply from database
 -  To set an article-reply to deleted state on production, run:
 ```

docker-compose.yml

@@ -40,6 +40,7 @@ services:
       URL_RESOLVER_URL: "url-resolver:4000"
     ports:
       - "5000:5000"
+      - "5500:5500"
 
   site:
     image: cofacts/rumors-site:latest-en

ecosystem.config.js

@@ -12,8 +12,11 @@ module.exports = {
       error_file: '/dev/null',
     },
     {
-      name: 'command-listener',
-      script: 'build/commandListener.js',
+      name: 'rumors-admin-api',
+      script: 'build/adm/index.js',
+      env_production: {
+        NODE_ENV: 'production',
+      },
       instances: 1,
       exec_mode: 'cluster',
       out_file: '/dev/null',