Frontend service

Rafiki’s frontend service provides an optional internal admin interface, called the Rafiki Admin application, for you to manage your Rafiki instance through a Remix web app. This service communicates with the Backend Admin API to facilitate administrative tasks within Rafiki.

Requirements

The following are required when using the frontend service:

• A Rafiki backend service up and running to access the Backend Admin API.
• An identity provider for authentication and user management. Out of the box, the Rafiki Admin application uses Ory Kratos, a secure and fully open-source identity management solution.

Disabling authentication

Rafiki Admin provides access to sensitive data like peering relationships and wallet addresses. Authentication is enabled by default to restrict access to authorized users only.

In the Local Playground, authentication is disabled by default to simplify local development and testing. To disable it in other environments, set the environment variable AUTH_ENABLED to false. This should be done with extreme caution and only in specific scenarios:

• Secure, non-production environments like the Local Playground for local development and testing.
• Internal systems where Rafiki Admin is not exposed externally and other access controls (firewalls, local-only access) ensure that the system is secured.

You must also set the environment variables for the frontend service.

Rafiki Admin settings

While the frontend service is not required to run a Rafiki instance, it is highly recommended. A number of administrative tasks could be performed programmatically via the Backend Admin API, but the frontend service makes these functions available through a user-friendly interface.

Environment variables

Variable	Helm Value Name	Default	Description
GRAPHQL_URL	frontend.serviceUrls.GRAPHQL_URL	undefined	URL for the GraphQL Admin API and it’s required
OPEN_PAYMENTS_URL	frontend.serviceUrls.OPEN_PAYMENTS_URL	undefined	Open Payments API Endpoint and it’s required
PORT	frontend.port	3005	Port from which to host the Remix app
ENABLE_INSECURE_MESSAGE_COOKIE		true	Values of true, t, 1 will not use a secure message cookie which is required for flash messages to work over http. When not set, the secure flag is set to true.