diff --git a/core/config.py b/core/config.py index f8fc384..0c5f872 100644 --- a/core/config.py +++ b/core/config.py @@ -49,9 +49,9 @@ WEB_UI_OPTIONS["recaptcha_site_key"] = RECAPTCHA_SITE_KEY if PROTECT_SPOT_SUBMIS WEB_UI_OPTIONS["allow_upstream_spotting"] = ALLOW_SPOTTING and ALLOW_UPSTREAM_SPOTTING -if ALLOW_SPOTTING and PROTECT_SPOT_SUBMISSION and not (RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY): +if ALLOW_SPOTTING and PROTECT_SPOT_SUBMISSION and (not API_KEYS or not (RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY)): logger.warning( - "Spot submission is protected but reCAPTCHA keys are not set, so only clients with an API key will be able to submit spots. Users of the web interface will not be able to add spots." + "Spot submission is enabled and protected but reCAPTCHA keys are not set and there are no API keys registered for third-party clients, so it will be impossible to add spots. This is a configuration problem you should fix." ) diff --git a/static/apidocs/openapi.yml b/static/apidocs/openapi.yml index f716afc..a1b0fe4 100644 --- a/static/apidocs/openapi.yml +++ b/static/apidocs/openapi.yml @@ -7,9 +7,9 @@ info: You can find out more information about Spothole at https://spothole.app/help, and specifically about creating a client to this API at https://spothole.app/help/usage/clients. - While I provide this API for free, there are some conditions of use that you must adhere to. These are not onerous, but ensure the API can remain available to everyone. These apply even if you are getting an AI to write your client software for you. See https://spothole.app/help/usage/clients#terms for details. + The main Spothole server at `spothole.app` provides this API for free, subject to some conditions of use that you must adhere to. These are not onerous, but ensure the API can remain available to everyone. These apply even if you are getting an AI to write your client software for you. See https://spothole.app/help/usage/clients#terms for details. Owners of other Spothole servers may adopt the same conditions or set their own, so if you are using a different server, check with its owner. - If you want to submit spots from your client, an API key is required. Please contact the server owner for a key if you want to use this functionality. + If you want to submit spots from your client, some Spothole servers require an API key. API keys are issued by the owner of each Spothole server, not by the Spothole developer, so contact the owner of the server you want to use. ## Changelog @@ -34,14 +34,14 @@ info: If your client submits spots via POST `/spot` and uses upstream submission, replace `submit_upstream` and `upstream_provider` in the `handling` object with an `upstream_providers` list, and turn `upstream_credentials` into a map where the key is the provider name, and the value is another map of credential name to value. - Some Spothole servers, including `spothole.app`, require a CAPTCHA to submit spots via the web interface, which third-party clients can't solve. If you want your client to submit spots to such a server, ask the server operator for an API key, and send it in the `X-API-Key` request header with each add spot request. + Some Spothole servers, including `spothole.app`, require a CAPTCHA to submit spots via the web interface, which third-party clients can't solve. If you want your client to submit spots to such a server, ask the server owner for an API key, and send it in the `X-API-Key` request header with each add spot request. You are encouraged to move to the `v3` API endpoints as soon as possible. To upgrade, replace `v2` with `v3` in the URLs your code calls, then rename any use of the fields, query parameters and values listed above, and handle `activities` being a list rather than a single `sig` value. If you use the activity reference lookup, call `/lookup/activityref?activity=...&id=...` instead of `/lookup/sigref?sig=...&id=...`. ### 2.2 * Renamed AMSAT SIG to "Satellite" as AMSAT is a specific organisation not just a general term for satellite QSOs - * Removed `alert_type` from alert data. Contest, DXpedition and Satellite alerts now give those values in `sig` instead, alongside the existing outdoor activity programmes. Teeeeechnically a breaking change but AlertType is so new I doubt anyone is using it yet, so slipped this one in anyway. Sorry :) + * Removed `alert_type` from alert data. Contest, DXpedition and Satellite alerts now give those values in `sig` instead, alongside the existing outdoor activity programmes. Teeeeechnically a breaking change but AlertType is so new that it's unlikely anyone is using it yet, so this one slipped in anyway. Sorry :) * Added QRP, RaDAR Rally, /AM and /MM activities * Added `has_refs` and `alerts_possible` to Activity data * Added `dx_grid`, `dx_latitude` and `dx_longitude` to alert data @@ -74,7 +74,7 @@ info: #### Upgrading a client from v1 to v2 API endpoints - In v2.0 of Spothole, the `v1` API endpoints will be maintained for backwards compatibility, so I don't break everyone's + In v2.0 of Spothole, the `v1` API endpoints will be maintained for backwards compatibility, so as not to break everyone's clients on day one. So if you have written a client against the `v1` API, you shouldn't notice anything breaking. However, you are strongly encouraged to move to `v2` API endpoints as soon as possible. @@ -88,9 +88,9 @@ info: top-level `handling` object which in later versions will allow you to control sending spots upstream to cluster and xOTA sites. - I don't think anyone was sending me QRZ/HamQTH credentials from their clients, or querying the `/options` call, so - updating clients for changes there should be confined to Spothole's own web interface. If you were doing that and - I haven't noticed, please carefully note the breaking changes listed above. + It's unlikely that any third-party clients were sending QRZ/HamQTH credentials to Spothole, or querying the + `/options` call, so updating clients for changes there should be confined to Spothole's own web interface. If you + were doing that, please carefully note the breaking changes listed above. ### 1.5 @@ -121,6 +121,7 @@ info: * Removed band colour and icon information from spots. * Moved activation_score from top-level in Spot and Alert to be part of the SIGRef contact: + name: Ian Renton, M0TRT (Spothole developer) email: ian@ianrenton.com license: name: The Unlicense @@ -128,7 +129,10 @@ info: version: 3.0 servers: + - url: /api/v3 + description: This Spothole server - url: https://spothole.app/api/v3 + description: The main Spothole server tags: - name: Spots @@ -547,7 +551,7 @@ components: name: X-API-Key in: header description: > - An API key issued by the server operator. On servers that protect spot submission, a valid API key allows + An API key issued by the server owner. On servers that protect spot submission, a valid API key allows the spot to be submitted without a CAPTCHA token. Not required on servers that don't protect spot submission. schema: type: string diff --git a/templates/add-spot.html b/templates/add-spot.html index 87864f5..78701b9 100644 --- a/templates/add-spot.html +++ b/templates/add-spot.html @@ -130,7 +130,7 @@ const ALLOW_UPSTREAM_SPOTTING = {% raw safe_json_dumps(web_ui_options["allow_upstream_spotting"]) %}; - + diff --git a/templates/alerts.html b/templates/alerts.html index cbe4a5f..f4fbfc4 100644 --- a/templates/alerts.html +++ b/templates/alerts.html @@ -87,7 +87,7 @@ - + diff --git a/templates/bands.html b/templates/bands.html index f674fbf..ba25b96 100644 --- a/templates/bands.html +++ b/templates/bands.html @@ -82,8 +82,8 @@ const BANDS = {% raw safe_json_dumps(options["bands"]) %}; - - + + diff --git a/templates/base.html b/templates/base.html index a974900..0966783 100644 --- a/templates/base.html +++ b/templates/base.html @@ -1,6 +1,6 @@ {% extends "skeleton.html" %} {% block head_extra %} - + @@ -16,10 +16,10 @@ window.fetchEventSource = fetchEventSource; - - - - + + + + {% end %} {% block body %}
@@ -69,7 +69,7 @@ - + diff --git a/templates/help.html b/templates/help.html index 226b294..5aa805a 100644 --- a/templates/help.html +++ b/templates/help.html @@ -5,8 +5,19 @@

Help and Information

Welcome to Spothole's help pages.

Spothole is a utility to aggregate spots from amateur radio DX clusters and xOTA spotting sites, and provide an - open JSON API as well as a website to browse the data. (If that sounds like nonsense to you, I recommend - starting with the FAQ!)

+ open JSON API as well as a website to browse the data. (If that sounds like nonsense to you, start with + the FAQ!)

+ {% if server_owner_callsign == "M0TRT" %} +

You're using the "main" Spothole server at spothole.app, which is run by + the software's main developer, Ian Renton, M0TRT. You can contact Ian + directly for any queries about it.

+ {% else %} +

Spothole is open-source software that anyone can run. The particular server you are using right now is run by + an amateur radio operator with callsign {{ server_owner_callsign }}, and not by the + oritinal developer of the software. This means that if you have any problems or questions about this server, + you should in the first instance contact them before contacting the Spothole developers. See + Privacy and Legal Information for details.

+ {% end %}

In the sections below, you can find more information about what Spothole is, and how to use it.

If you're fetching spot data, you're unlikely to need a sub-minute refresh time. For example, Spothole only queries the POTA API once every two minutes, so if your client is interested in POTA data there's no need to poll Spothole @@ -43,9 +44,9 @@

Remember, here at Spothole Inc. we offer an industry-standard "five nines" uptime on our server, with our own unique twist: we don't tell you which side of the decimal point the nines start! (Translation: This is a hobby project. - spothole.app runs on the same server as my blog and other stuff. It might go down without warning. By - all means base your own project on data from the main server if you like, but if you want any control over - reliability and downtime, please run your own copy instead.)

+ spothole.app runs on the same server a Minecraft server and all sorts of other stuff. It might go down + without warning. By all means base your own project on data from the main server if you like, but if you want any + control over reliability and downtime, please run your own copy instead.)

Submitting Spots

As well as reading data, clients can submit new spots to Spothole using the "add spot" API endpoint, e.g. @@ -53,45 +54,46 @@ to other services such as the DX cluster. Check the spot_allowed and spot_submit_providers fields in the "options" API response to see what the server allows.

To stop bots and spammers abusing the spotting function, a Spothole server can be configured to protect against this, - which means you will need an API key. API keys are issued by the operator of each Spothole server, - so get in touch with the server owner and let them know what your software is and how it will use the API. Once you - have a key, send it in the X-API-Key header of each add spot request. For example:

+ which means you will need an API key. API keys are issued by the owner of each Spothole server, + not by the Spothole developer. This server is run by {{ server_owner_callsign }}, so get in touch + with them and let them know what your software is and how it will use the API. Once you have a key, send it in the + X-API-Key header of each add spot request. For example:

curl --request POST \
      --header "Content-Type: application/json" \
      --header "X-API-Key: your-api-key-here" \
      --data '{"spot":{"dx_call":"M0TRT","time":1760019539,"freq":14200000,"de_call":"M0TRT"}}' \
      https://spothole.app/api/v3/spot

Your API key identifies your software, so please keep it private. Don't commit it to a public code repository, and - don't embed it in JavaScript or anywhere else your users could extract it. If a key is misused, the server operator + don't embed it in JavaScript or anywhere else your users could extract it. If a key is misused, the server owner can revoke it, and spot submission from your client will stop working. Servers that don't protect spot submission don't need an API key, and will accept spots with or without one.

Conditions of Use

-

There are some simple, hopefully not onerous terms and conditions that you should agree to before writing a client - for the Spothole API. These probably aren't legally binding, and I'm just a random guy on the internet, I'm not - going to sue you for breaching them. But having these conditions in place ensures Spothole can continue to operate - without me burning out and with no payment required. In the collaborative and respectful tradition of amateur radio, - please read and understand them.

+

The conditions are simple, and hopefully not onerous. They probably aren't legally binding, and nobody is likely to + sue you for breaching them. But having them in place ensures Spothole can continue to operate without the people + running it burning out, and with no payment required. In the collaborative and respectful tradition of amateur + radio, please read and understand them.

When creating a Spothole client, you agree that:

diff --git a/templates/help/usage/modifying.html b/templates/help/usage/modifying.html index 28b7775..72b7b20 100644 --- a/templates/help/usage/modifying.html +++ b/templates/help/usage/modifying.html @@ -8,11 +8,12 @@

The source code can be found at https://git.ianrenton.com/ian/spothole.

-

I'm sorry this isn't on GitHub. There's too much noise on there now it's been given over to Copilot agents. If you - want to contribute code changes, that unfortunately means you'll have to sign up for an account on my Forgejo - server (linked above), or email me patch files the old-fashioned way. I'd hoped that Forgejo federation would be - working soon, so that at least you could use a Codeberg account rather than a new login specifically for my - instance, but unfortunately we're still waiting on that one!

+

Sorry this isn't on GitHub. There's too much noise on there now it's been given over to Copilot agents. If you + want to contribute code changes, that unfortunately means you'll have to sign up for an account on the developer's + Forgejo server (linked above), or email patch files to Ian, M0TRT the + old-fashioned way. The hope was that Forgejo federation would be working soon, so that at least you could use a + Codeberg account rather than a new login specifically for that instance, but unfortunately we're still waiting on + that one!

Code structure

To navigate your way around the source code, this list may help.

@@ -99,7 +100,7 @@

Finally, simply add the appropriate config to the spot_providers section of config.yml, and your provider should be instantiated on startup.

-

The same approach as above is also used for alerts, and other types of providers. Give me a shout if you need any - advice.

+

The same approach as above is also used for alerts, and other types of providers. Give Spothole's developers a shout + if you need any advice.

{% end %} diff --git a/templates/help/usage/nginx.html b/templates/help/usage/nginx.html index 77ab36a..9f3d02a 100644 --- a/templates/help/usage/nginx.html +++ b/templates/help/usage/nginx.html @@ -85,8 +85,8 @@ }

One further change you might want to make to the file above is the add_header - Access-Control-Allow-Origin statements. These are what's used on my own Spothole server to make sure that - other third-party web-based software can get the data from my instance, and applies to any endpoint underneath + Access-Control-Allow-Origin statements. These are what's used on the main spothole.app server to make + sure that other third-party web-based software can get the data from that instance, and applies to any endpoint underneath /api. If you want your Spothole instance to be set up the same way, so that others can write software in JavaScript that can access it, leave this intact. But if you want your Spothole instance to only be usable by scripts running on the web server you write, you can remove these lines. (Note that this doesn't stop diff --git a/templates/help/usage/running.html b/templates/help/usage/running.html index 07aa147..50a415e 100644 --- a/templates/help/usage/running.html +++ b/templates/help/usage/running.html @@ -27,9 +27,9 @@ cp config-example.yml config.yml

config.yml has an entry for a Clublog API key. If provided, this will allow Spothole to retrieve some more information about DX spots. The software will work just fine without it, but you may find a few country flags etc. are less accurate or missing. Clublog API keys are free, but you'll need to get your own by submitting a - helpdesk ticket and explaining what you'll use it for. The admin team are happy with the rate of requests made by my - Spothole server, so unless you change the source code of yours to radically increase the rate of querying Clublog, - I'm sure they will be fine with your server too.

+ helpdesk ticket and explaining what you'll use it for. The admin team are happy with the rate of requests made by the + main spothole.app server, so unless you change the source code of yours to radically increase the rate + of querying Clublog, they should be fine with your server too.

If your server is public and allows spots to be submitted, you may want to protect it from bots and spammers by setting protect_spot_submission to true and setting the reCAPTCHA keys in config.yml. Users of the web interface will then need to solve a CAPTCHA to submit a spot. Third-party diff --git a/templates/help/usage/telnet.html b/templates/help/usage/telnet.html index 07b7fc8..3cf5462 100644 --- a/templates/help/usage/telnet.html +++ b/templates/help/usage/telnet.html @@ -6,7 +6,7 @@

As well as a web interface and an HTTP API, Spothole offers a telnet server. This can be used to integrate Spothole's data into a traditional desktop logging program. The data Spothole produces is compatible with DXSpider, and therefore many loggers should accept it with no problems.

-

This is a relatively new feature however, so if you run into problems, please do let me know.

+

This is a relatively new feature however, so if you run into problems, please let Spothole's developers know.

The one caveat with the Spothole telnet server is that it does not support any commands, other than exit or bye. You cannot therefore issue commands to retrieve past entries, set up filters, etc. If you need to filter the data, diff --git a/templates/map.html b/templates/map.html index e57ff7a..ea03bb1 100644 --- a/templates/map.html +++ b/templates/map.html @@ -115,8 +115,8 @@ const CARTODB_API_KEY = "{{ web_ui_options.get('cartodb_api_key', '') }}"; - - + + diff --git a/templates/spots.html b/templates/spots.html index 964b4a4..6b68827 100644 --- a/templates/spots.html +++ b/templates/spots.html @@ -127,8 +127,8 @@

- - + + diff --git a/templates/status.html b/templates/status.html index fc2e030..e425492 100644 --- a/templates/status.html +++ b/templates/status.html @@ -96,7 +96,7 @@ - +