evm: the admin API is off unless a node is told to serve it

admin_importChain rewrites the chain from a file on disk. It defaulted to
enabled, with a comment saying it was on so that importChain would work, so
every node carried the ability to have its history replaced by anything that
could reach its RPC port -- to spare an operator one line of config during a
restore that happens rarely and is supervised when it does.

A node that is restoring sets admin-api-enabled in its chain config for as long
as the restore takes. Nothing else needs it, and nothing else should offer it.

The tests set the field explicitly and are unaffected.

Co-authored-by: Hanzo Dev <[email protected]>

plugin/evm/config/config.go

@@ -60,7 +60,14 @@ const (
 	defaultStateSyncRequestSize = 1024 // the number of key/values to ask peers for per request
 	defaultDBType               = "badgerdb"
 	defaultValidatorAPIEnabled  = true
-	defaultAdminAPIEnabled      = true
+
+	// The admin API is off unless a node is told to serve it. admin_importChain
+	// rewrites the chain from a file on disk, so anything that can reach the RPC
+	// port can replace history; that is a capability a node should hold only while
+	// someone is using it, not one it carries because an import was once
+	// convenient. A node doing a restore sets admin-api-enabled in its chain
+	// config for as long as the restore takes.
+	defaultAdminAPIEnabled = false
 
 	// RPC batch limits
 	defaultBatchRequestLimit    = 1000

plugin/evm/config/default_config.go

@@ -20,7 +20,7 @@ const (
 
 func NewDefaultConfig() Config {
 	return Config{
-		AdminAPIEnabled: true, // Enable admin API by default for importChain
+		AdminAPIEnabled: defaultAdminAPIEnabled,
 		AllowUnprotectedTxHashes: []common.Hash{
 			common.HexToHash("0xfefb2da535e927b85fe68eb81cb2e4a5827c905f78381a01ef2322aa9b0aee8e"), // EIP-1820: https://eips.ethereum.org/EIPS/eip-1820
 		},