Merge branch '95-send-spots-to-xota' into 2.0-pre

# Conflicts:
#	README.md
#	core/config.py
#	server/handlers/api/addspot.py
#	server/handlers/api/lookups.py
#	server/handlers/api/options.py
#	server/webserver.py
#	spothole.py
#	static/apidocs/openapi.yml

config-example.yml

@@ -167,7 +167,7 @@ alert-providers:
 
 
 # Solar condition providers to use. These poll external APIs for solar propagation data (SFI, A/K indices, band
-# conditions, etc.) and make it available via the /api/v1/solar endpoint.
+# conditions, etc.) and make it available via the /api/v2/solar endpoint.
 solar-condition-providers:
   - class: "HamQSL"
     enabled: true
@@ -299,6 +299,20 @@ max-alert-age-sec: 604800
 # Allow submitting spots to the Spothole API?
 allow-spotting: true
 
+# Allow upstream submission of spots to external providers (POTA, SOTA, etc.) via the API?
+# Requires allow-spotting to also be true. Set to false to only accept spots into the local
+# Spothole database, without forwarding them to any external service.
+allow-upstream-spotting: true
+
+# Google reCAPTCHA v2 keys for CAPTCHA protection on upstream spot submission. Both keys must be set to enable CAPTCHA.
+# Leave both empty to disable CAPTCHA (e.g. for a private/trusted server) or if allow-spotting is false, in which case
+# they will do nothing. Note that with CAPTCHA enabled, this will prevent third-party clients submitting spots through
+# Spothole unless the clients are web-based, use the same site key, have their domains enabled in your reCAPTCHA config,
+# and of course their user solves the CAPTCHA.
+# You can sign up for reCAPTCHA at https://www.google.com/recaptcha/
+recaptcha-site-key: ""
+recaptcha-secret-key: ""
+
 # Log web requests? Useful to see what your users are requesting in terms of pages and API endpoints, but will fill up
 # your log quickly on a popular server.
 log-web-requests: false