diff --git a/core/config.py b/core/config.py index f8fc384..0c5f872 100644 --- a/core/config.py +++ b/core/config.py @@ -49,9 +49,9 @@ WEB_UI_OPTIONS["recaptcha_site_key"] = RECAPTCHA_SITE_KEY if PROTECT_SPOT_SUBMIS WEB_UI_OPTIONS["allow_upstream_spotting"] = ALLOW_SPOTTING and ALLOW_UPSTREAM_SPOTTING -if ALLOW_SPOTTING and PROTECT_SPOT_SUBMISSION and not (RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY): +if ALLOW_SPOTTING and PROTECT_SPOT_SUBMISSION and (not API_KEYS or not (RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY)): logger.warning( - "Spot submission is protected but reCAPTCHA keys are not set, so only clients with an API key will be able to submit spots. Users of the web interface will not be able to add spots." + "Spot submission is enabled and protected but reCAPTCHA keys are not set and there are no API keys registered for third-party clients, so it will be impossible to add spots. This is a configuration problem you should fix." ) diff --git a/static/apidocs/openapi.yml b/static/apidocs/openapi.yml index f716afc..a1b0fe4 100644 --- a/static/apidocs/openapi.yml +++ b/static/apidocs/openapi.yml @@ -7,9 +7,9 @@ info: You can find out more information about Spothole at https://spothole.app/help, and specifically about creating a client to this API at https://spothole.app/help/usage/clients. - While I provide this API for free, there are some conditions of use that you must adhere to. These are not onerous, but ensure the API can remain available to everyone. These apply even if you are getting an AI to write your client software for you. See https://spothole.app/help/usage/clients#terms for details. + The main Spothole server at `spothole.app` provides this API for free, subject to some conditions of use that you must adhere to. These are not onerous, but ensure the API can remain available to everyone. These apply even if you are getting an AI to write your client software for you. See https://spothole.app/help/usage/clients#terms for details. Owners of other Spothole servers may adopt the same conditions or set their own, so if you are using a different server, check with its owner. - If you want to submit spots from your client, an API key is required. Please contact the server owner for a key if you want to use this functionality. + If you want to submit spots from your client, some Spothole servers require an API key. API keys are issued by the owner of each Spothole server, not by the Spothole developer, so contact the owner of the server you want to use. ## Changelog @@ -34,14 +34,14 @@ info: If your client submits spots via POST `/spot` and uses upstream submission, replace `submit_upstream` and `upstream_provider` in the `handling` object with an `upstream_providers` list, and turn `upstream_credentials` into a map where the key is the provider name, and the value is another map of credential name to value. - Some Spothole servers, including `spothole.app`, require a CAPTCHA to submit spots via the web interface, which third-party clients can't solve. If you want your client to submit spots to such a server, ask the server operator for an API key, and send it in the `X-API-Key` request header with each add spot request. + Some Spothole servers, including `spothole.app`, require a CAPTCHA to submit spots via the web interface, which third-party clients can't solve. If you want your client to submit spots to such a server, ask the server owner for an API key, and send it in the `X-API-Key` request header with each add spot request. You are encouraged to move to the `v3` API endpoints as soon as possible. To upgrade, replace `v2` with `v3` in the URLs your code calls, then rename any use of the fields, query parameters and values listed above, and handle `activities` being a list rather than a single `sig` value. If you use the activity reference lookup, call `/lookup/activityref?activity=...&id=...` instead of `/lookup/sigref?sig=...&id=...`. ### 2.2 * Renamed AMSAT SIG to "Satellite" as AMSAT is a specific organisation not just a general term for satellite QSOs - * Removed `alert_type` from alert data. Contest, DXpedition and Satellite alerts now give those values in `sig` instead, alongside the existing outdoor activity programmes. Teeeeechnically a breaking change but AlertType is so new I doubt anyone is using it yet, so slipped this one in anyway. Sorry :) + * Removed `alert_type` from alert data. Contest, DXpedition and Satellite alerts now give those values in `sig` instead, alongside the existing outdoor activity programmes. Teeeeechnically a breaking change but AlertType is so new that it's unlikely anyone is using it yet, so this one slipped in anyway. Sorry :) * Added QRP, RaDAR Rally, /AM and /MM activities * Added `has_refs` and `alerts_possible` to Activity data * Added `dx_grid`, `dx_latitude` and `dx_longitude` to alert data @@ -74,7 +74,7 @@ info: #### Upgrading a client from v1 to v2 API endpoints - In v2.0 of Spothole, the `v1` API endpoints will be maintained for backwards compatibility, so I don't break everyone's + In v2.0 of Spothole, the `v1` API endpoints will be maintained for backwards compatibility, so as not to break everyone's clients on day one. So if you have written a client against the `v1` API, you shouldn't notice anything breaking. However, you are strongly encouraged to move to `v2` API endpoints as soon as possible. @@ -88,9 +88,9 @@ info: top-level `handling` object which in later versions will allow you to control sending spots upstream to cluster and xOTA sites. - I don't think anyone was sending me QRZ/HamQTH credentials from their clients, or querying the `/options` call, so - updating clients for changes there should be confined to Spothole's own web interface. If you were doing that and - I haven't noticed, please carefully note the breaking changes listed above. + It's unlikely that any third-party clients were sending QRZ/HamQTH credentials to Spothole, or querying the + `/options` call, so updating clients for changes there should be confined to Spothole's own web interface. If you + were doing that, please carefully note the breaking changes listed above. ### 1.5 @@ -121,6 +121,7 @@ info: * Removed band colour and icon information from spots. * Moved activation_score from top-level in Spot and Alert to be part of the SIGRef contact: + name: Ian Renton, M0TRT (Spothole developer) email: ian@ianrenton.com license: name: The Unlicense @@ -128,7 +129,10 @@ info: version: 3.0 servers: + - url: /api/v3 + description: This Spothole server - url: https://spothole.app/api/v3 + description: The main Spothole server tags: - name: Spots @@ -547,7 +551,7 @@ components: name: X-API-Key in: header description: > - An API key issued by the server operator. On servers that protect spot submission, a valid API key allows + An API key issued by the server owner. On servers that protect spot submission, a valid API key allows the spot to be submitted without a CAPTCHA token. Not required on servers that don't protect spot submission. schema: type: string diff --git a/templates/add-spot.html b/templates/add-spot.html index 87864f5..78701b9 100644 --- a/templates/add-spot.html +++ b/templates/add-spot.html @@ -130,7 +130,7 @@ const ALLOW_UPSTREAM_SPOTTING = {% raw safe_json_dumps(web_ui_options["allow_upstream_spotting"]) %}; - + diff --git a/templates/alerts.html b/templates/alerts.html index cbe4a5f..f4fbfc4 100644 --- a/templates/alerts.html +++ b/templates/alerts.html @@ -87,7 +87,7 @@ - + diff --git a/templates/bands.html b/templates/bands.html index f674fbf..ba25b96 100644 --- a/templates/bands.html +++ b/templates/bands.html @@ -82,8 +82,8 @@ const BANDS = {% raw safe_json_dumps(options["bands"]) %}; - - + + diff --git a/templates/base.html b/templates/base.html index a974900..0966783 100644 --- a/templates/base.html +++ b/templates/base.html @@ -1,6 +1,6 @@ {% extends "skeleton.html" %} {% block head_extra %} - + @@ -16,10 +16,10 @@ window.fetchEventSource = fetchEventSource; - - - - + + + + {% end %} {% block body %}
Welcome to Spothole's help pages.
Spothole is a utility to aggregate spots from amateur radio DX clusters and xOTA spotting sites, and provide an - open JSON API as well as a website to browse the data. (If that sounds like nonsense to you, I recommend - starting with the FAQ!)
+ open JSON API as well as a website to browse the data. (If that sounds like nonsense to you, start with + the FAQ!) + {% if server_owner_callsign == "M0TRT" %} +You're using the "main" Spothole server at spothole.app, which is run by + the software's main developer, Ian Renton, M0TRT. You can contact Ian + directly for any queries about it.
+ {% else %} +Spothole is open-source software that anyone can run. The particular server you are using right now is run by + an amateur radio operator with callsign {{ server_owner_callsign }}, and not by the + oritinal developer of the software. This means that if you have any problems or questions about this server, + you should in the first instance contact them before contacting the Spothole developers. See + Privacy and Legal Information for details.
+ {% end %}In the sections below, you can find more information about what Spothole is, and how to use it.
Spothole's web interface exists not just for the end user, but also as a reference implementation for the API, so - I have chosen to demonstrate both methods of filtering.
+ it demonstrates both methods of filtering.It's probably not? But it's nice to have choice.
I think it's got three key advantages over those sites:
Spothole's source code is licenced under the Public Domain. You can write a Spothole client, run your own server, - modify it however you like, you can claim you wrote it and charge people £1000 for a copy, I don't really mind. - (Please don't do the last one. But if you're using my code for something cool, it would be nice to hear from - you!)
+ modify it however you like, you can claim you wrote it and charge people £1000 for a copy, it really doesn't + matter. (Please don't do the last one. But if you're using Spothole's code for something cool, its developer, + Ian, M0TRT, would love to hear from you!)Currently, exit, and nothing else. Support for some DXSpider-like commands may be added to Spothole
in due course, but at the moment if you want to add Spothole as a telnet cluster data source to your desktop
diff --git a/templates/help/privacy.html b/templates/help/privacy.html
index 3b982b0..e3c3ea8 100644
--- a/templates/help/privacy.html
+++ b/templates/help/privacy.html
@@ -27,16 +27,20 @@
like.
This server is run by an amateur radio operator with callsign {{ server_owner_callsign }}. You should contact them if - you have any issues with the website.
-Spothole exists as an aggregator of data from many other sources. To the best of my knowledge, all these sources - either:
+This server is run by an amateur radio operator with callsign {{ server_owner_callsign }}. You should contact them + with any questions about privacy or legal matters relating to this server, or if you have any issues with the + website.
+Spothole exists as an aggregator of data from many other sources. To the best of the Spothole developers' knowledge, + all these sources either:
If you represent one of these data sources and would like it removed from Spothole, please let me know.
+If you represent one of these data sources and would like it removed, there are two options. The owner of this + server, {{ server_owner_callsign }}, can disable it on this server straight away. To have it removed from the + Spothole software itself, so that future versions of Spothole no longer support it on any server, please contact + Spothole's developer, Ian Renton, M0TRT.
Spothole does not produce any real data of its own. Information such as spots and alerts that Spothole displays are entered by users, often of other websites. The data may be the property of the user or the other website, depending on their terms and conditions.
diff --git a/templates/help/sources.html b/templates/help/sources.html index a20b5b8..b2847d2 100644 --- a/templates/help/sources.html +++ b/templates/help/sources.html @@ -40,8 +40,8 @@ Vestigios de España (DMVE), Diploma Estaciones de Ferrocarril de España (DEFE), Diploma Teatri Musei e Belle Arti (DTMBA), British Inland Waterways on the Air (BIWOTA), Castles on the Air (COTA), Polish Gmina Award (PGA), Diplôme des Moulins de France (DMF), RaDAR Rally, and Toilets on the Air. -As of the time of writing in August 2026, I think Spothole captures most radio programmes that have a - defined, downloadable reference list, and almost certainly those that have a spotting/alerting API. If you know - of one I've missed, please let me know!
+As of the time of writing in August 2026, Spothole should capture most radio programmes that have a defined, + downloadable reference list, and almost certainly those that have a spotting/alerting API. If you know of one + that's missing, please let Spothole's developers know!
{% end %} diff --git a/templates/help/thanks.html b/templates/help/thanks.html index 069d2f7..399f666 100644 --- a/templates/help/thanks.html +++ b/templates/help/thanks.html @@ -2,7 +2,7 @@ {% block help_content %}The software was written by Ian Renton, MØTRT with code contributions by +
The software was written by Ian Renton, M0TRT with code contributions by Steven, M1SDH.
This project would not have been possible without those volunteers who have taken it upon themselves to run DX clusters, xOTA programmes, DXpedition lists, callsign lookup databases, solar conditions and propagation @@ -14,7 +14,7 @@ Norby LX1NO, Andrew VK3ARR, Mario DL4MFM, Mark M5TEA, Michael G7VJR, Rob G7LAS, Ed DD5LP, Raph F4LUB, Luc ON7KEC, Richard GD4OFB, Daniel PY2TDB, Alan VK1AO, Andrew WK1AD, Ullrich DF5WC, Wayne N3CDF, Jonathan G4IVV, Erik N2EPE, Sorin YO9TSN, Matt HB9HWI, Priit ES1TEB, Leigh KG7WED, Jouni OH3CUF, Onno VK6FLAB, Bruce WA7BNM, and - Larry F5PYI. (If I've forgotten you, let me know!)
+ Larry F5PYI. (If you've been forgotten, please let Ian know!)Spothole is also dependent on a number of Python libraries, such as pyhamtools, and many JavaScript libraries, as well as the Font Awesome icon set and flag icons from the Noto Color Emoji set, and MIT-licenced GeoJSON files for CQ and ITU zones from HA8TKS.
diff --git a/templates/help/usage.html b/templates/help/usage.html index a146bf4..4dd6d57 100644 --- a/templates/help/usage.html +++ b/templates/help/usage.html @@ -25,16 +25,16 @@ it from a terminal withtelnet {{ telnet_server_address }} {{ telnet_server_port }}.
If you're fetching spot data, you're unlikely to need a sub-minute refresh time. For example, Spothole only queries the POTA API once every two minutes, so if your client is interested in POTA data there's no need to poll Spothole @@ -43,9 +44,9 @@
Remember, here at Spothole Inc. we offer an industry-standard "five nines" uptime on our server, with our own unique
twist: we don't tell you which side of the decimal point the nines start! (Translation: This is a hobby project.
- spothole.app runs on the same server as my blog and other stuff. It might go down without warning. By
- all means base your own project on data from the main server if you like, but if you want any control over
- reliability and downtime, please run your own copy instead.)
spothole.app runs on the same server a Minecraft server and all sorts of other stuff. It might go down
+ without warning. By all means base your own project on data from the main server if you like, but if you want any
+ control over reliability and downtime, please run your own copy instead.)
As well as reading data, clients can submit new spots to Spothole using the "add spot" API endpoint, e.g.
@@ -53,45 +54,46 @@
to other services such as the DX cluster. Check the spot_allowed and
spot_submit_providers fields in the "options" API response to see what the server allows.
To stop bots and spammers abusing the spotting function, a Spothole server can be configured to protect against this,
- which means you will need an API key. API keys are issued by the operator of each Spothole server,
- so get in touch with the server owner and let them know what your software is and how it will use the API. Once you
- have a key, send it in the X-API-Key header of each add spot request. For example:
X-API-Key header of each add spot request. For example:
curl --request POST \
--header "Content-Type: application/json" \
--header "X-API-Key: your-api-key-here" \
--data '{"spot":{"dx_call":"M0TRT","time":1760019539,"freq":14200000,"de_call":"M0TRT"}}' \
https://spothole.app/api/v3/spot
Your API key identifies your software, so please keep it private. Don't commit it to a public code repository, and - don't embed it in JavaScript or anywhere else your users could extract it. If a key is misused, the server operator + don't embed it in JavaScript or anywhere else your users could extract it. If a key is misused, the server owner can revoke it, and spot submission from your client will stop working. Servers that don't protect spot submission don't need an API key, and will accept spots with or without one.
There are some simple, hopefully not onerous terms and conditions that you should agree to before writing a client - for the Spothole API. These probably aren't legally binding, and I'm just a random guy on the internet, I'm not - going to sue you for breaching them. But having these conditions in place ensures Spothole can continue to operate - without me burning out and with no payment required. In the collaborative and respectful tradition of amateur radio, - please read and understand them.
+The conditions are simple, and hopefully not onerous. They probably aren't legally binding, and nobody is likely to + sue you for breaching them. But having them in place ensures Spothole can continue to operate without the people + running it burning out, and with no payment required. In the collaborative and respectful tradition of amateur + radio, please read and understand them.
When creating a Spothole client, you agree that:
The source code can be found at https://git.ianrenton.com/ian/spothole.
-I'm sorry this isn't on GitHub. There's too much noise on there now it's been given over to Copilot agents. If you - want to contribute code changes, that unfortunately means you'll have to sign up for an account on my Forgejo - server (linked above), or email me patch files the old-fashioned way. I'd hoped that Forgejo federation would be - working soon, so that at least you could use a Codeberg account rather than a new login specifically for my - instance, but unfortunately we're still waiting on that one!
+Sorry this isn't on GitHub. There's too much noise on there now it's been given over to Copilot agents. If you + want to contribute code changes, that unfortunately means you'll have to sign up for an account on the developer's + Forgejo server (linked above), or email patch files to Ian, M0TRT the + old-fashioned way. The hope was that Forgejo federation would be working soon, so that at least you could use a + Codeberg account rather than a new login specifically for that instance, but unfortunately we're still waiting on + that one!
To navigate your way around the source code, this list may help.
@@ -99,7 +100,7 @@Finally, simply add the appropriate config to the spot_providers section of config.yml, and
your provider should be
instantiated on startup.
The same approach as above is also used for alerts, and other types of providers. Give me a shout if you need any - advice.
+The same approach as above is also used for alerts, and other types of providers. Give Spothole's developers a shout + if you need any advice.
{% end %} diff --git a/templates/help/usage/nginx.html b/templates/help/usage/nginx.html index 77ab36a..9f3d02a 100644 --- a/templates/help/usage/nginx.html +++ b/templates/help/usage/nginx.html @@ -85,8 +85,8 @@ }One further change you might want to make to the file above is the add_header
- Access-Control-Allow-Origin statements. These are what's used on my own Spothole server to make sure that
- other third-party web-based software can get the data from my instance, and applies to any endpoint underneath
+ Access-Control-Allow-Origin statements. These are what's used on the main spothole.app server to make
+ sure that other third-party web-based software can get the data from that instance, and applies to any endpoint underneath
/api. If you want your Spothole instance to be set up the same way, so that others can write
software in JavaScript that can access it, leave this intact. But if you want your Spothole instance to only be
usable by scripts running on the web server you write, you can remove these lines. (Note that this doesn't stop
diff --git a/templates/help/usage/running.html b/templates/help/usage/running.html
index 07aa147..50a415e 100644
--- a/templates/help/usage/running.html
+++ b/templates/help/usage/running.html
@@ -27,9 +27,9 @@ cp config-example.yml config.yml
config.yml has an entry for a Clublog API key. If provided, this will allow Spothole to retrieve some
more information about DX spots. The software will work just fine without it, but you may find a few country flags
etc. are less accurate or missing. Clublog API keys are free, but you'll need to get your own by submitting a
- helpdesk ticket and explaining what you'll use it for. The admin team are happy with the rate of requests made by my
- Spothole server, so unless you change the source code of yours to radically increase the rate of querying Clublog,
- I'm sure they will be fine with your server too.
spothole.app server, so unless you change the source code of yours to radically increase the rate
+ of querying Clublog, they should be fine with your server too.
If your server is public and allows spots to be submitted, you may want to protect it from bots and spammers by
setting protect_spot_submission to true and setting the reCAPTCHA keys in
config.yml. Users of the web interface will then need to solve a CAPTCHA to submit a spot. Third-party
diff --git a/templates/help/usage/telnet.html b/templates/help/usage/telnet.html
index 07b7fc8..3cf5462 100644
--- a/templates/help/usage/telnet.html
+++ b/templates/help/usage/telnet.html
@@ -6,7 +6,7 @@
As well as a web interface and an HTTP API, Spothole offers a telnet server. This can be used to integrate Spothole's data into a traditional desktop logging program. The data Spothole produces is compatible with DXSpider, and therefore many loggers should accept it with no problems.
-This is a relatively new feature however, so if you run into problems, please do let me know.
+This is a relatively new feature however, so if you run into problems, please let Spothole's developers know.
The one caveat with the Spothole telnet server is that it does not support any commands, other than
exit or bye.
You cannot therefore issue commands to retrieve past entries, set up filters, etc. If you need to filter the data,
diff --git a/templates/map.html b/templates/map.html
index e57ff7a..ea03bb1 100644
--- a/templates/map.html
+++ b/templates/map.html
@@ -115,8 +115,8 @@
const CARTODB_API_KEY = "{{ web_ui_options.get('cartodb_api_key', '') }}";
-
-
+
+
diff --git a/templates/spots.html b/templates/spots.html
index 964b4a4..6b68827 100644
--- a/templates/spots.html
+++ b/templates/spots.html
@@ -127,8 +127,8 @@