Update webassets/js/add-spot.js

README.md

@@ -22,9 +22,11 @@ You can access the public version's web interface at [https://spothole.app](http
 
 This is a Progressive Web App, so you can also "install" it to your Android or iOS device by accessing it in Chrome or Safari respectively, and following the menu-driven process for installing PWAs.
 
+You are more than welcome to use the data and the API that Spothole provides to power your own software. There are many ways to do this; see below. 
+
 ## Embedding Spothole in another website
 
-You can embed Spothole in another website, e.g. for use as part of a ham radio custom dashboard.
+You can embed Spothole's web interface in another website, e.g. for use as part of a ham radio custom dashboard.
 
 URL parameters can be used to trigger an "embedded" mode which hides the headers, footers and settings. In this mode, you provide configuration for the various filter and display options via additional URL parameters. Any settings that the user has set for Spothole are ignored. This is so that the embedding site can select, for example, their choice of dark mode or SIG filters, which will not impact how Spothole appears when the user accesses it directly. Effectively, it becomes separate to their normal Spothole settings.
 
@@ -90,11 +92,9 @@ Then edit `config.yml` in your text editor of choice to set up the software as y
 
 By default, all outdoor programme providers are enabled, as is one cluster node and the NG3K DXpedition data. The RBN spot providers are turned off by default due to the volume of traffic from CW/RTTY/FT8 skimmers, and the APRS and Packet spot providers are off by default on the assumption that Spothole users want a spot with a human at the other end of it, but all can be easily re-enabled.
 
-`config.yml` has some entries for QRZ.com username & password, and Clublog API keys. If provided, these allow Spothole to retrieve more information about DX spots, such as the country their callsign corresponds to. The software will work just fine without them, but you may find a few country flags etc. are less accurate or missing.
+Other parameters you will want to update include the base URL to your instance, and whether you want to serve a full web-based DX cluster interface or just the API endpoints for client software to use.
 
-Clublog API keys are free, but you'll need to get your own by submitting a helpdesk ticket and explaining what you'll use it for. The admin team are happy with the rate of requests made by my Spothole server, so unless you change the source code of yours to radically increase the rate of querying Clublog, I'm sure they will be fine with your server too.
+`config.yml` has an entry for a Clublog API key. If provided, this will allow Spothole to retrieve some more information about DX spots. The software will work just fine without it, but you may find a few country flags etc. are less accurate or missing. Clublog API keys are free, but you'll need to get your own by submitting a helpdesk ticket and explaining what you'll use it for. The admin team are happy with the rate of requests made by my Spothole server, so unless you change the source code of yours to radically increase the rate of querying Clublog, I'm sure they will be fine with your server too.
-
-Free QRZ.com accounts offer only limited access to the site's data via their API. You'll have to sign up for one of their "XML Data Subscriber" plans to gain access to the full data, but if you're on a free account then the software will get what information it can.
 
 Once you're happy with the content of `config.yml`, you can proceed to running the software.
 
@@ -246,10 +246,6 @@ To set up nginx as a reverse proxy that sits in front of Spothole, first ensure
 Create a file at `/etc/nginx/sites-available/` called `spothole`. Give it the following contents, replacing `spothole.app` with the domain name on which you want to run Spothole. If you changed the port on which Spothole runs, update that on the "proxy_pass" line too.
 
 ```nginx
-map $request_uri $xssorigin {
-    ~^/api   *;
-}
-
 server {
     server_name spothole.app;
 
@@ -258,21 +254,55 @@ server {
         alias /var/www/html/.well-known/;
     }
     
+    # SSE endpoints
+    location ~ ^/api/v1/(spots|alerts)/stream {
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_pass http://127.0.0.1:8080;
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_read_timeout 24h;
+        proxy_connect_timeout 10s;
+        proxy_send_timeout 24h;
+        proxy_set_header X-Accel-Buffering no;
+        proxy_hide_header Access-Control-Allow-Origin;
+        add_header Access-Control-Allow-Origin * always;
+        add_header Cache-Control no-store always;
+        add_header Content-Type text/event-stream always;
+    }
+
+    # Other API endpoints
+    location /api/ {
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+        proxy_pass http://127.0.0.1:8080;
+        proxy_buffering on;
+        proxy_cache off;
+        proxy_read_timeout 30s;
+        proxy_connect_timeout 10s;
+        proxy_hide_header Access-Control-Allow-Origin;
+        add_header Access-Control-Allow-Origin * always;
+        add_header Cache-Control no-store always;
+    }
+
+    # Static assets
     location / {
         proxy_http_version 1.1;
         proxy_set_header Connection "";
         proxy_pass http://127.0.0.1:8080;
-        proxy_hide_header Access-Control-Allow-Origin;
+        proxy_buffering on;
-        add_header Access-Control-Allow-Origin $xssorigin;
+        proxy_read_timeout 30s;
+        proxy_connect_timeout 10s;
+        add_header Cache-Control "public, max-age=3600, must-revalidate" always;
     }
 }
 ```
 
-One further change you might want to make to the file above is the `add_header Access-Control-Allow-Origin` statement. This is what's used on
+One further change you might want to make to the file above is the `add_header Access-Control-Allow-Origin` statements. These are what's used on
 my own Spothole server to make sure that other third-party web-based software can get the data from my instance, and applies to any endpoint underneath `/api`. If you want
 *your* Spothole instance to be set up the same way, so that others can write software in JavaScript that can access it,
 leave this intact. But if you want your Spothole instance to only be usable by scripts running on the web server you write,
-you can remove this line. (Note that this doesn't stop other people writing *non-web-based* software that accesses your
+you can remove these lines. (Note that this doesn't stop other people writing *non-web-based* software that accesses your
 Spothole API—the enforcement of cross-origin headers only happens within the user's browser. If you need to lock your
 instance down so that no-one else can access it with *any* software, that's an aspect of nginx or firewall config that you will need
 to find help with elsewhere.)

config-example.yml

@@ -6,6 +6,14 @@
 # this as "N0CALL" and it shouldn't do any harm, as we're not sending anything to the various networks, only receiving.
 server-owner-callsign: "N0CALL"
 
+# Port to open the local web server on
+web-server-port: 8080
+
+# Run in API-only mode? When enabled, the web UI is not served, only the API endpoints and the OpenAPI documentation
+# page. If you are running your own Spothole instance purely to serve client software, and not wanting visitors to
+# discover a full web-based cluster UI, enable this flag.
+api-only-mode: false
+
 # The base URL at which the software runs.
 base-url: "http://localhost:8080"
 
@@ -187,9 +195,10 @@ solar-condition-providers:
     class: "GIROIonosonde"
     name: "GIRO Ionosonde Data"
     enabled: true
-
+  -
-# Port to open the local web server on
+    class: "KC2GProp"
-web-server-port: 8080
+    name: "KC2G Propagation Data"
+    enabled: true
 
 # Maximum time to keep spots and alerts in the system before deleting them. By default, one hour for spots and one week
 # for alerts.
@@ -203,6 +212,20 @@ clublog-api-key: ""
 # Allow submitting spots to the Spothole API?
 allow-spotting: true
 
+# Allow upstream submission of spots to external providers (POTA, SOTA, etc.) via the API?
+# Requires allow-spotting to also be true. Set to false to only accept spots into the local
+# Spothole database, without forwarding them to any external service.
+allow-upstream-spotting: true
+
+# Google reCAPTCHA v2 keys for CAPTCHA protection on upstream spot submission. Both keys must be set to enable CAPTCHA.
+# Leave both empty to disable CAPTCHA (e.g. for a private/trusted server) or if allow-spotting is false, in which case
+# they will do nothing. Note that with CAPTCHA enabled, this will prevent third-party clients submitting spots through
+# Spothole unless the clients are web-based, use the same site key, have their domains enabled in your reCAPTCHA config,
+# and of course their user solves the CAPTCHA.
+# You can sign up for reCAPTCHA at https://www.google.com/recaptcha/
+recaptcha-site-key: ""
+recaptcha-secret-key: ""
+
 # Options for the web UI.
 web-ui-options:
   spot-count: [10, 25, 50, 100]

core/config.py

@@ -14,19 +14,27 @@ with open("config.yml") as f:
     config = yaml.safe_load(f)
 logging.info("Loaded config.")
 
+# TODO load other keys with config.get(key, default) instead of config[key]
 BASE_URL = config["base-url"]
 MAX_SPOT_AGE = config["max-spot-age-sec"]
 MAX_ALERT_AGE = config["max-alert-age-sec"]
 SERVER_OWNER_CALLSIGN = config["server-owner-callsign"]
 WEB_SERVER_PORT = config["web-server-port"]
 ALLOW_SPOTTING = config["allow-spotting"]
+ALLOW_UPSTREAM_SPOTTING = config.get("allow-upstream-spotting", True)
 WEB_UI_OPTIONS = config["web-ui-options"]
+API_ONLY_MODE = config.get("api-only-mode", False)
+RECAPTCHA_SECRET_KEY = config.get("recaptcha-secret-key", "")
+RECAPTCHA_SITE_KEY = config.get("recaptcha-site-key", "")
 
 # For ease of config, each spot provider owns its own config about whether it should be enabled by default in the web UI
 # but for consistency we provide this to the front-end in web-ui-options because it has no impact outside of the web UI.
 WEB_UI_OPTIONS["spot-providers-enabled-by-default"] = [p["name"] for p in config["spot-providers"] if p["enabled"] and (
         "enabled-by-default-in-web-ui" not in p or p["enabled-by-default-in-web-ui"])]
 # If spotting to this server is enabled, "API" is another valid spot source even though it does not come from
-# one of our proviers. We set that to also be enabled by default.
+# one of our proviers. We set that to also be enabled by default. We can also include the reCaptcha site key so the UI
+# can access it.
 if ALLOW_SPOTTING:
     WEB_UI_OPTIONS["spot-providers-enabled-by-default"].append("API")
+    WEB_UI_OPTIONS["recaptcha-site-key"] = RECAPTCHA_SITE_KEY
+WEB_UI_OPTIONS["allow-upstream-spotting"] = ALLOW_SPOTTING and ALLOW_UPSTREAM_SPOTTING

core/constants.py

@@ -3,16 +3,15 @@ from data.band import Band
 from data.sig import SIG
 
 # General software
-SOFTWARE_NAME = "Spothole by M0TRT"
+SOFTWARE_VERSION = "1.4-pre"
-SOFTWARE_VERSION = "1.3"
 
 # HTTP headers used for spot providers that use HTTP
-HTTP_HEADERS = {"User-Agent": SOFTWARE_NAME + ", v" + SOFTWARE_VERSION + " (operated by " + SERVER_OWNER_CALLSIGN + ")"}
+HTTP_HEADERS = {"User-Agent": "Spothole v" + SOFTWARE_VERSION + " (operated by " + SERVER_OWNER_CALLSIGN + ")"}
-HAMQTH_PRG = (SOFTWARE_NAME + " v" + SOFTWARE_VERSION + " operated by " + SERVER_OWNER_CALLSIGN).replace(" ", "_")
+HAMQTH_PRG = ("Spothole v" + SOFTWARE_VERSION + " operated by " + SERVER_OWNER_CALLSIGN).replace(" ", "_")
 
 # Special Interest Groups
 SIGS = [
-    SIG(name="POTA", description="Parks on the Air", ref_regex=r"[A-Z]{2}\-\d{4,5}"),
+    SIG(name="POTA", description="Parks on the Air", ref_regex=r"([A-Z]{2}\-\d{4,5}|K\-TEST)"),
     SIG(name="SOTA", description="Summits on the Air", ref_regex=r"[A-Z0-9]{1,3}\/[A-Z]{2}\-\d{3}"),
     SIG(name="WWFF", description="World Wide Flora & Fauna", ref_regex=r"[A-Z0-9]{1,3}FF\-\d{4}"),
     SIG(name="GMA", description="Global Mountain Activity", ref_regex=r"[A-Z0-9]{1,3}\/[A-Z]{2}\-\d{3}"),
@@ -38,10 +37,12 @@ SIGS = [
 
 # Modes. Note "DIGI" and "DIGITAL" are also supported but are normalised into "DATA".
 CW_MODES = ["CW"]
-PHONE_MODES = ["PHONE", "SSB", "USB", "LSB", "AM", "FM", "DV", "DMR", "DSTAR", "C4FM", "M17"]
+PHONE_MODES = ["PHONE", "SSB", "USB", "LSB", "AM", "FM", "DV", "DMR", "DSTAR", "C4FM", "FUSION", "M17"]
 DATA_MODES = ["DATA", "FT8", "FT4", "RTTY", "SSTV", "JS8", "HELL", "PSK", "OLIVIA", "PKT", "MSK144"]
 ALL_MODES = CW_MODES + PHONE_MODES + DATA_MODES
 MODE_TYPES = ["CW", "PHONE", "DATA"]
+SSB_SUB_MODES = ["USB", "LSB"]
+DV_SUB_MODES = ["DMR", "DSTAR", "C4FM", "FUSION", "M17"]
 
 # Mode aliases. Sometimes we get spots with a mode described in a different way that is effectively the same as a mode
 # we already know, or we want to normalise things for consistency. The lookup table for this is here. Incoming spots

core/lookup_helper.py

@@ -363,8 +363,12 @@ class LookupHelper:
         """Infer an operator name from a callsign (requires QRZ.com/HamQTH)"""
 
         data = self._get_qrz_data_for_callsign(call, credentials)
+        if data and "name_fmt" in data:
+            return data["name_fmt"]
         if data and "fname" in data:
             name = data["fname"]
+            if "nick" in data:
+                name = name + " \"" + data["nick"] + "\""
             if "name" in data:
                 name = name + " " + data["name"]
             return name

data/solar_conditions.py

@@ -161,8 +161,8 @@ class SolarConditions:
     blackout_forecast_r1r2: dict = None
     # NOAA Radio Blackout (R3 or greater) probability forecast, keyed by UNIX timestamp of start of day UTC
     blackout_forecast_r3_or_greater: dict = None
-    # Ionosonde measurements from LGDC, dict keyed by URSI code, values are dicts with keys: ursi, name, fof2, muf, luf,
+    # Ionosonde measurements, dict keyed by URSI code, values are dicts with keys: ursi, name, fof2, muf, luf,
-    # band_states
+    # band_states. Populated by GIROIonosonde or KC2GProp providers.
     ionosonde_data: dict = None
 
     # Derived values (populated by infer_descriptions())

data/spot.py

@@ -14,7 +14,6 @@ from core.constants import MODE_ALIASES
 from core.geo_utils import lat_lon_to_cq_zone, lat_lon_to_itu_zone
 from core.lookup_helper import lookup_helper, infer_band_from_freq, infer_mode_from_comment, \
     infer_mode_from_frequency, infer_mode_type_from_mode
-from data.lookup_credentials import LookupCredentials
 from core.sig_utils import populate_sig_ref_info, ANY_SIG_REGEX, get_ref_regex_for_sig
 from data.sig_ref import SIGRef
 
@@ -252,9 +251,16 @@ class Spot:
         if self.comment:
             sig_matches = re.finditer(r"(^|\W)" + ANY_SIG_REGEX + r"($|\W)", self.comment, re.IGNORECASE)
             for sig_match in sig_matches:
-                # First of all, if we haven't got a SIG for this spot set yet, now we have. This covers things like cluster
+                # See what SIG we think this is
-                # spots where the comment is just "POTA".
                 found_sig = sig_match.group(2).upper()
+
+                # "TOTA" is now ambiguous, with Toilets and Towers both using it. If we have found "TOTA" in a comment,
+                # ignore it as we can't tell what it is.
+                if found_sig != "TOTA":
+                    continue
+
+                # Now, if we haven't got a SIG for this spot set yet, now we have. This covers things like cluster
+                # spots where the comment is just "POTA".
                 if not self.sig:
                     self.sig = found_sig
 

server/handlers/api/addspot.py

@@ -1,12 +1,14 @@
 import json
 import logging
 import re
+import threading
 from datetime import datetime
 
 import pytz
+import requests
 import tornado
 
-from core.config import ALLOW_SPOTTING, MAX_SPOT_AGE
+from core.config import ALLOW_SPOTTING, ALLOW_UPSTREAM_SPOTTING, MAX_SPOT_AGE, RECAPTCHA_SECRET_KEY
 from core.constants import UNKNOWN_BAND
 from core.lookup_helper import infer_band_from_freq
 from core.prometheus_metrics_handler import api_requests_counter
@@ -15,13 +17,16 @@ from core.utils import serialize_everything
 from data.sig_ref import SIGRef
 from data.spot import Spot
 
+RECAPTCHA_VERIFY_URL = "https://www.google.com/recaptcha/api/siteverify"
+
 
 class APISpotHandler(tornado.web.RequestHandler):
     """API request handler for /api/v1/spot (POST)"""
 
-    def initialize(self, spots, web_server_metrics):
+    def initialize(self, spots, web_server_metrics, spot_providers=None):
         self._spots = spots
         self._web_server_metrics = web_server_metrics
+        self._spot_providers = spot_providers or []
 
     def post(self):
         try:
@@ -58,15 +63,43 @@ class APISpotHandler(tornado.web.RequestHandler):
                 self.set_header("Content-Type", "application/json")
                 return
 
-            # Read in the request body as JSON then convert to a Spot object
+            # Read in the request body as JSON
-            json_spot = tornado.escape.json_decode(post_data)
+            json_body = tornado.escape.json_decode(post_data)
-            spot = Spot(**json_spot)
+
+            # Extract fields relating to how we handle the spot, such as CAPTCHA and upstream submission. Remove these
+            # from the data so they don't accidentally end up in the spot object itself.
+            # todo: Better way of separating these out. Possible without API change or not?
+            submit_upstream = json_body.pop("submit_upstream", False)
+            upstream_provider_name = json_body.pop("upstream_provider", None)
+            upstream_credentials = json_body.pop("upstream_credentials", {})
+            captcha_token = json_body.pop("captcha_token", None)
+
+            # Verify CAPTCHA if required
+            if RECAPTCHA_SECRET_KEY:
+                if not captcha_token:
+                    self.set_status(422)
+                    self.write(json.dumps("Error - CAPTCHA token is required for spot submission.",
+                                          default=serialize_everything))
+                    self.set_header("Cache-Control", "no-store")
+                    self.set_header("Content-Type", "application/json")
+                    return
+                if not self._verify_recaptcha(captcha_token):
+                    self.set_status(422)
+                    self.write(json.dumps("Error - CAPTCHA verification failed.",
+                                          default=serialize_everything))
+                    self.set_header("Cache-Control", "no-store")
+                    self.set_header("Content-Type", "application/json")
+                    return
+
+            # Convert remaining fields to a Spot object
+            spot = Spot(**json_body)
 
             # Converting to a spot object this way won't have coped with sig_ref objects, so fix that. (Would be nice to
             # redo this in a functional style)
-            if spot.sig_refs:
+            if spot.sig and spot.sig_refs:
                 real_sig_refs = []
                 for dict_obj in spot.sig_refs:
+                    dict_obj = {**dict_obj, "sig": spot.sig}
                     real_sig_refs.append(json.loads(json.dumps(dict_obj), object_hook=lambda d: SIGRef(**d)))
                 spot.sig_refs = real_sig_refs
 
@@ -126,11 +159,45 @@ class APISpotHandler(tornado.web.RequestHandler):
                 self.set_header("Content-Type", "application/json")
                 return
 
-            # infer missing data, and add it to our database.
+            # Reject upstream submission if not permitted
-            spot.source = "API"
+            if submit_upstream and not ALLOW_UPSTREAM_SPOTTING:
+                self.set_status(403)
+                self.write(json.dumps("Error - this server does not allow upstream spot submission.",
+                                      default=serialize_everything))
+                self.set_header("Cache-Control", "no-store")
+                self.set_header("Content-Type", "application/json")
+                return
+
+            # Submit upstream if requested
+            upstream_warning = None
+            if submit_upstream and upstream_provider_name and spot.sig:
+                provider = self._find_provider(upstream_provider_name, spot.sig)
+                if provider:
+                    try:
+                        # Submit spot to the upstream provider
+                        provider.submit_spot(spot, upstream_credentials)
+                        # Trigger a re-poll after 1 second so the spot appears quickly
+                        threading.Timer(1.0, lambda: provider.force_poll()).start()
+                    except NotImplementedError as e:
+                        upstream_warning = str(e)
+                    except Exception as e:
+                        logging.warning("Failed to submit spot upstream to " + upstream_provider_name + ": " + str(e))
+                        upstream_warning = "Spot was saved locally but upstream submission to " + upstream_provider_name + " failed: " + str(
+                            e)
+                else:
+                    upstream_warning = "No enabled provider named '" + upstream_provider_name + "' supports upstream submission for " + spot.sig + " spots."
+
+            # If we successfully submitted the spot upstream, don't add it direct to Spothole, otherwise it will be a
+            # duplicate with what immediately comes back from the API. But if we weren't asked to send it upstream, or
+            # we were but it failed, we should still add it to our database anyway.
+            if not submit_upstream or upstream_warning:
                 spot.infer_missing()
                 self._spots.add(spot.id, spot, expire=MAX_SPOT_AGE)
 
+            if upstream_warning:
+                self.write(json.dumps("Warning - " + upstream_warning, default=serialize_everything))
+                self.set_status(201)
+            else:
                 self.write(json.dumps("OK", default=serialize_everything))
                 self.set_status(201)
             self.set_header("Cache-Control", "no-store")
@@ -142,3 +209,23 @@ class APISpotHandler(tornado.web.RequestHandler):
             self.set_status(500)
             self.set_header("Cache-Control", "no-store")
             self.set_header("Content-Type", "application/json")
+
+    def _find_provider(self, provider_name, sig):
+        """Find an enabled provider by name that can submit spots for the given SIG."""
+
+        for p in self._spot_providers:
+            if p.enabled and p.name == provider_name and p.can_submit_spot(sig):
+                return p
+        return None
+
+    def _verify_recaptcha(self, token):
+        """Verify a Google reCAPTCHA v2 token. Returns True if valid."""
+
+        try:
+            response = requests.post(RECAPTCHA_VERIFY_URL,
+                                     data={"secret": RECAPTCHA_SECRET_KEY, "response": token},
+                                     timeout=(5, 10))
+            return response.ok and response.json().get("success", False)
+        except Exception as e:
+            logging.warning("reCAPTCHA verification request failed: " + str(e))
+            return False

server/handlers/api/alerts.py

@@ -98,8 +98,12 @@ class APIAlertsStreamHandler(tornado_eventsource.handler.EventSourceHandler):
             self._heartbeat = tornado.ioloop.PeriodicCallback(self._callback, SSE_HANDLER_QUEUE_CHECK_INTERVAL)
             self._heartbeat.start()
 
+            # Flush headers immediately so nginx doesn't time out waiting for a response
+            self.write_message("keepalive", "")
+
         except Exception as e:
-            logging.warning("Exception when serving SSE socket", e)
+            logging.warning("Exception when serving SSE socket: %s", e, exc_info=True)
+            self.close()
 
     def close(self):
         """When the user closes the socket, empty our queue and remove it from the list so the server no longer fills it"""
@@ -122,6 +126,7 @@ class APIAlertsStreamHandler(tornado_eventsource.handler.EventSourceHandler):
 
         try:
             if self._alert_queue:
+                if not self._alert_queue.empty():
                     while not self._alert_queue.empty():
                         alert = self._alert_queue.get()
                         # If the new alert matches our param filters, send it to the client. If not, ignore it.
@@ -131,11 +136,15 @@ class APIAlertsStreamHandler(tornado_eventsource.handler.EventSourceHandler):
                                 alert.infer_missing(self._credentials)
                             self.write_message(msg=json.dumps(alert, default=serialize_everything))
 
+                else:
+                    # Send a keepalive comment if the queue was empty
+                    self.write_message("keepalive", "")
+
                 if self._alert_queue not in self._sse_alert_queues:
                     logging.error("Web server cleared up a queue of an active connection!")
                     self.close()
         except:
-            logging.warning("Exception in SSE callback, connection will be closed.")
+            logging.warning("Exception in SSE callback, connection will be closed: %s", e, exc_info=True)
             self.close()
 
 

server/handlers/api/options.py

@@ -13,9 +13,10 @@ from core.utils import serialize_everything
 class APIOptionsHandler(tornado.web.RequestHandler):
     """API request handler for /api/v1/options"""
 
-    def initialize(self, status_data, web_server_metrics):
+    def initialize(self, status_data, web_server_metrics, spot_providers=None):
         self._status_data = status_data
         self._web_server_metrics = web_server_metrics
+        self._spot_providers = spot_providers or []
 
     def get(self):
         # Metrics
@@ -24,6 +25,15 @@ class APIOptionsHandler(tornado.web.RequestHandler):
         self._web_server_metrics["status"] = "OK"
         api_requests_counter.inc()
 
+        # Build a map of SIG name -> list of provider names that can submit spots for that SIG
+        spot_submit_providers = {}
+        for provider in self._spot_providers:
+            if not provider.enabled:
+                continue
+            for sig in SIGS:
+                if provider.can_submit_spot(sig.name):
+                    spot_submit_providers.setdefault(sig.name, []).append(provider.name)
+
         options = {"bands": BANDS,
                    "modes": ALL_MODES,
                    "mode_types": MODE_TYPES,
@@ -35,7 +45,8 @@ class APIOptionsHandler(tornado.web.RequestHandler):
                        map(lambda p: p["name"], filter(lambda p: p["enabled"], self._status_data["alert_providers"]))),
                    "continents": CONTINENTS,
                    "max_spot_age": MAX_SPOT_AGE,
-                   "spot_allowed": ALLOW_SPOTTING}
+                   "spot_allowed": ALLOW_SPOTTING,
+                   "spot_submit_providers": spot_submit_providers}
         # If spotting to this server is enabled, "API" is another valid spot source even though it does not come from
         # one of our proviers.
         if ALLOW_SPOTTING:

server/handlers/api/spots.py

@@ -100,8 +100,12 @@ class APISpotsStreamHandler(tornado_eventsource.handler.EventSourceHandler):
             self._heartbeat = tornado.ioloop.PeriodicCallback(self._callback, SSE_HANDLER_QUEUE_CHECK_INTERVAL)
             self._heartbeat.start()
 
+            # Flush headers immediately so nginx doesn't time out waiting for a response
+            self.write_message("keepalive", "")
+
         except Exception as e:
-            logging.warning("Exception when serving SSE socket", e)
+            logging.warning("Exception when serving SSE socket: %s", e, exc_info=True)
+            self.close()
 
     def close(self):
         """When the user closes the socket, empty our queue and remove it from the list so the server no longer fills it"""
@@ -124,6 +128,7 @@ class APISpotsStreamHandler(tornado_eventsource.handler.EventSourceHandler):
 
         try:
             if self._spot_queue:
+                if not self._spot_queue.empty():
                     while not self._spot_queue.empty():
                         spot = self._spot_queue.get()
                         # If the new spot matches our param filters, send it to the client. If not, ignore it.
@@ -133,11 +138,15 @@ class APISpotsStreamHandler(tornado_eventsource.handler.EventSourceHandler):
                                 spot.infer_missing(self._credentials)
                             self.write_message(msg=json.dumps(spot, default=serialize_everything))
 
+                else:
+                    # Send a keepalive comment if the queue was empty
+                    self.write_message("keepalive", "")
+
                 if self._spot_queue not in self._sse_spot_queues:
                     logging.error("Web server cleared up a queue of an active connection!")
                     self.close()
         except:
-            logging.warning("Exception in SSE callback, connection will be closed.")
+            logging.warning("Exception in SSE callback, connection will be closed: %s", e, exc_info=True)
             self.close()
 
 

server/handlers/pagetemplate.py

@@ -3,7 +3,7 @@ from datetime import datetime
 import pytz
 import tornado
 
-from core.config import ALLOW_SPOTTING, WEB_UI_OPTIONS, BASE_URL
+from core.config import ALLOW_SPOTTING, WEB_UI_OPTIONS, BASE_URL, SERVER_OWNER_CALLSIGN
 from core.constants import SOFTWARE_VERSION
 from core.prometheus_metrics_handler import page_requests_counter
 
@@ -11,12 +11,9 @@ from core.prometheus_metrics_handler import page_requests_counter
 class PageTemplateHandler(tornado.web.RequestHandler):
     """Handler for all HTML pages generated from templates"""
 
-    def initialize(self, template_name, web_server_metrics, has_hamqsl=False, has_noaa_forecast=False, has_giro_ionosonde=False):
+    def initialize(self, template_name, web_server_metrics):
         self._template_name = template_name
         self._web_server_metrics = web_server_metrics
-        self._has_hamqsl = has_hamqsl
-        self._has_noaa_forecast = has_noaa_forecast
-        self._has_giro_ionosonde = has_giro_ionosonde
 
     def get(self):
         # Metrics
@@ -26,7 +23,6 @@ class PageTemplateHandler(tornado.web.RequestHandler):
         page_requests_counter.inc()
 
         # Load named template, and provide variables used in templates
-        self.render(self._template_name + ".html", software_version=SOFTWARE_VERSION, allow_spotting=ALLOW_SPOTTING,
+        self.render(self._template_name + ".html", software_version=SOFTWARE_VERSION,
-                    web_ui_options=WEB_UI_OPTIONS, baseurl=BASE_URL, current_path=self.request.path,
+                    server_owner_callsign=SERVER_OWNER_CALLSIGN, allow_spotting=ALLOW_SPOTTING,
-                    has_hamqsl=self._has_hamqsl, has_noaa_forecast=self._has_noaa_forecast,
+                    web_ui_options=WEB_UI_OPTIONS, baseurl=BASE_URL, current_path=self.request.path)
-                    has_giro_ionosonde=self._has_giro_ionosonde)

server/webserver.py

@@ -5,10 +5,11 @@ import os
 import tornado
 from tornado.web import StaticFileHandler
 
+from core.config import ALLOW_SPOTTING, WEB_SERVER_PORT, API_ONLY_MODE
 from core.utils import empty_queue
 from server.handlers.api.addspot import APISpotHandler
-from server.handlers.api.dxstats import APIDxStatsHandler
 from server.handlers.api.alerts import APIAlertsHandler, APIAlertsStreamHandler
+from server.handlers.api.dxstats import APIDxStatsHandler
 from server.handlers.api.lookups import APILookupCallHandler, APILookupSIGRefHandler, APILookupGridHandler
 from server.handlers.api.options import APIOptionsHandler
 from server.handlers.api.solar_conditions import APISolarConditionsHandler
@@ -21,7 +22,7 @@ from server.handlers.pagetemplate import PageTemplateHandler
 class WebServer:
     """Provides the public-facing web server."""
 
-    def __init__(self, spots, alerts, solar_conditions, status_data, solar_condition_providers, port):
+    def __init__(self, spots, alerts, solar_conditions, status_data, spot_providers=None):
         """Constructor"""
 
         self._spots = spots
@@ -30,8 +31,9 @@ class WebServer:
         self._sse_spot_queues = []
         self._sse_alert_queues = []
         self._status_data = status_data
-        self._solar_condition_providers = solar_condition_providers
+        self._spot_providers = spot_providers or []
-        self._port = port
+        self._port = WEB_SERVER_PORT
+        self._api_only_mode = API_ONLY_MODE
         self._shutdown_event = asyncio.Event()
         self.web_server_metrics = {
             "last_page_access_time": None,
@@ -54,51 +56,60 @@ class WebServer:
     async def _start_inner(self):
         """Start method (async). Sets up the Tornado application."""
 
-        provider_classes = [type(p).__name__ for p in self._solar_condition_providers if p.enabled]
+        # Prepare a list of common arguments that are passed in to every API & page handler. This is just a basic thing
-        has_hamqsl = "HamQSL" in provider_classes
+        # to avoid copy-pasting the same thing to every route declaration below.
-        has_noaa_forecast = "NOAA3dayForecast" in provider_classes
+        handler_opts = {"web_server_metrics": self.web_server_metrics}
-        has_giro_ionosonde = "GIROIonosonde" in provider_classes
-        page_opts = {"web_server_metrics": self.web_server_metrics, "has_hamqsl": has_hamqsl,
-                     "has_noaa_forecast": has_noaa_forecast, "has_giro_ionosonde": has_giro_ionosonde}
 
-        app = tornado.web.Application([
+        # API endpoints are always enabled
-            # Routes for API calls
+        api_routes = [
-            (r"/api/v1/spots", APISpotsHandler, {"spots": self._spots, "web_server_metrics": self.web_server_metrics}),
+            (r"/api/v1/spots", APISpotsHandler, {"spots": self._spots, **handler_opts}),
-            (r"/api/v1/alerts", APIAlertsHandler,
+            (r"/api/v1/alerts", APIAlertsHandler, {"alerts": self._alerts, **handler_opts}),
-             {"alerts": self._alerts, "web_server_metrics": self.web_server_metrics}),
             (r"/api/v1/spots/stream", APISpotsStreamHandler,
-             {"sse_spot_queues": self._sse_spot_queues, "web_server_metrics": self.web_server_metrics}),
+             {"sse_spot_queues": self._sse_spot_queues, **handler_opts}),
             (r"/api/v1/alerts/stream", APIAlertsStreamHandler,
-             {"sse_alert_queues": self._sse_alert_queues, "web_server_metrics": self.web_server_metrics}),
+             {"sse_alert_queues": self._sse_alert_queues, **handler_opts}),
-            (r"/api/v1/solar", APISolarConditionsHandler,
+            (r"/api/v1/solar", APISolarConditionsHandler, {"solar_conditions": self._solar_conditions, **handler_opts}),
-             {"solar_conditions": self._solar_conditions, "web_server_metrics": self.web_server_metrics}),
+            (r"/api/v1/dxstats", APIDxStatsHandler, {"spots": self._spots, **handler_opts}),
-            (r"/api/v1/dxstats", APIDxStatsHandler, {"spots": self._spots, "web_server_metrics": self.web_server_metrics}),
+            (r"/api/v1/options", APIOptionsHandler, {"status_data": self._status_data, "spot_providers": self._spot_providers, **handler_opts}),
-            (r"/api/v1/options", APIOptionsHandler,
+            (r"/api/v1/status", APIStatusHandler, {"status_data": self._status_data, **handler_opts}),
-             {"status_data": self._status_data, "web_server_metrics": self.web_server_metrics}),
+            (r"/api/v1/lookup/call", APILookupCallHandler, {**handler_opts}),
-            (r"/api/v1/status", APIStatusHandler,
+            (r"/api/v1/lookup/sigref", APILookupSIGRefHandler, {**handler_opts}),
-             {"status_data": self._status_data, "web_server_metrics": self.web_server_metrics}),
+            (r"/api/v1/lookup/grid", APILookupGridHandler, {**handler_opts}),
-            (r"/api/v1/lookup/call", APILookupCallHandler, {"web_server_metrics": self.web_server_metrics}),
+            (r"/api/v1/spot", APISpotHandler, {"spots": self._spots, "spot_providers": self._spot_providers, **handler_opts}),
-            (r"/api/v1/lookup/sigref", APILookupSIGRefHandler, {"web_server_metrics": self.web_server_metrics}),
+        ]
-            (r"/api/v1/lookup/grid", APILookupGridHandler, {"web_server_metrics": self.web_server_metrics}),
+
-            (r"/api/v1/spot", APISpotHandler, {"spots": self._spots, "web_server_metrics": self.web_server_metrics}),
+        # If in API-only mode, serve a basic homepage; in normal mode, serve the usual UI routes
-            # Routes for templated pages
+        if self._api_only_mode:
-            (r"/", PageTemplateHandler, {"template_name": "spots", **page_opts}),
+            logging.info("API-only mode is enabled. Web UI will not be served.")
-            (r"/map", PageTemplateHandler, {"template_name": "map", **page_opts}),
+            ui_routes = [
-            (r"/bands", PageTemplateHandler, {"template_name": "bands", **page_opts}),
+                (r"/", PageTemplateHandler, {"template_name": "api_only_home", **handler_opts})
-            (r"/alerts", PageTemplateHandler, {"template_name": "alerts", **page_opts}),
+            ]
-            (r"/add-spot", PageTemplateHandler, {"template_name": "add_spot", **page_opts}),
+        else:
-            (r"/conditions", PageTemplateHandler, {"template_name": "conditions", **page_opts}),
+            ui_routes = [
-            (r"/status", PageTemplateHandler, {"template_name": "status", **page_opts}),
+                (r"/", PageTemplateHandler, {"template_name": "spots", **handler_opts}),
-            (r"/about", PageTemplateHandler, {"template_name": "about", **page_opts}),
+                (r"/map", PageTemplateHandler, {"template_name": "map", **handler_opts}),
-            (r"/apidocs", PageTemplateHandler, {"template_name": "apidocs", **page_opts}),
+                (r"/bands", PageTemplateHandler, {"template_name": "bands", **handler_opts}),
-            # Route for Prometheus metrics
+                (r"/alerts", PageTemplateHandler, {"template_name": "alerts", **handler_opts}),
+                (r"/conditions", PageTemplateHandler, {"template_name": "conditions", **handler_opts}),
+                (r"/status", PageTemplateHandler, {"template_name": "status", **handler_opts}),
+                (r"/about", PageTemplateHandler, {"template_name": "about", **handler_opts})
+            ]
+            # Only allow the Add Spot page if spotting is allowed
+            if ALLOW_SPOTTING:
+                ui_routes += [(r"/add-spot", PageTemplateHandler, {"template_name": "add_spot", **handler_opts})]
+
+        # API docs, Prometheus metrics, and finally static assets are always available regardless of API-only mode.
+        misc_routes = [
+            (r"/apidocs", PageTemplateHandler, {"template_name": "apidocs", **handler_opts}),
             (r"/metrics", PrometheusMetricsHandler),
-            # Default route to serve from "webassets"
+            (r"/(.*)", StaticFileHandler, {"path": os.path.join(os.path.dirname(__file__), "../webassets")})
-            (r"/(.*)", StaticFileHandler, {"path": os.path.join(os.path.dirname(__file__), "../webassets")}),
+        ]
-        ],
+
+        app = tornado.web.Application(api_routes + ui_routes + misc_routes,
                                       template_path=os.path.join(os.path.dirname(__file__), "../templates"),
                                       debug=False)
         app.listen(self._port)
+        logging.info("Web server running on port " + str(WEB_SERVER_PORT))
         await self._shutdown_event.wait()
 
     def notify_new_spot(self, spot):

solarconditionsproviders/giroionosonde.py

@@ -6,19 +6,21 @@ from threading import Thread, Event
 import pytz
 import requests
 
-from core.constants import HTTP_HEADERS, BANDS
+from core.constants import HTTP_HEADERS
+from solarconditionsproviders.ionosonde_utils import compute_band_states
 from solarconditionsproviders.solar_conditions_provider import SolarConditionsProvider
 
 POLL_INTERVAL = 3600  # 1 hour
 STATIONS_INDEX = "datafiles/didbase-stations.csv"
 LGDC_URL = "https://lgdc.uml.edu/common/DIDBGetValues"
 HISTORY_HOURS = 24
-HF_BANDS = [b for b in BANDS if b.is_ham_hf]
 
 
 class GIROIonosonde(SolarConditionsProvider):
     """Solar conditions provider using ionosonde data from the GIRO Data Center.
-    Queries foF2, MUF, and LUF measurements for all stations in datafiles/didbase-stations.csv."""
+    Queries foF2, MUF, and LUF measurements for all stations in datafiles/didbase-stations.csv.
+    Can run alongside KC2GProp: GIRO supplements KC2G's foF2/MUF data with LUF readings, and
+    stations from each source that the other does not cover are preserved."""
 
     def __init__(self, provider_config):
         super().__init__(provider_config)
@@ -27,8 +29,6 @@ class GIROIonosonde(SolarConditionsProvider):
         self._stop_event = Event()
 
     def _load_stations(self):
-        """Load the CSV file containing the list of URSIs and Station Names for currently active ionosondes."""
-
         stations = []
         with open(STATIONS_INDEX, newline='') as f:
             for row in csv.reader(f):
@@ -37,15 +37,19 @@ class GIROIonosonde(SolarConditionsProvider):
         return stations
 
     def setup(self, solar_conditions, solar_conditions_cache):
-        """Prepopulate the ionosonde_data map with known URSI and station names, so that the API exposes this structure
+        """Pre-populate ionosonde_data with known station names for stations not already present,
-        even before we actually have any data in it."""
+        so the station dropdown is available before the first poll. Does not overwrite existing
+        entries so KC2G cache data is preserved."""
 
         super().setup(solar_conditions, solar_conditions_cache)
-        self.update_data({"ionosonde_data": {
+        existing = solar_conditions.ionosonde_data or {}
-            s["ursi"]: {"ursi": s["ursi"], "name": s["name"], "fof2": None, "muf": None, "luf": None,
+        new_entries = {
-                        "band_states": None}
+            s["ursi"]: {"ursi": s["ursi"], "name": s["name"], "fof2": None, "muf": None,
-            for s in self._stations
+                        "luf": None, "band_states": None}
-        }})
+            for s in self._stations if s["ursi"] not in existing
+        }
+        if new_entries:
+            self.update_data({"ionosonde_data": {**existing, **new_entries}})
 
     def start(self):
         logging.info(f"Set up query of GIRO ionosonde data API every {POLL_INTERVAL} seconds.")
@@ -63,9 +67,13 @@ class GIROIonosonde(SolarConditionsProvider):
 
     def _poll(self):
         try:
-            logging.debug(f"Polling GIRO ionosonde data...")
+            logging.debug("Polling GIRO ionosonde data...")
             now = datetime.now(timezone.utc)
             from_time = now - timedelta(hours=HISTORY_HOURS)
+            cutoff_ts = from_time.timestamp()
+
+            # Start from the existing ionosonde_data so stations provided by other providers
+            # (e.g. KC2GProp) are preserved for stations GIRO does not cover.
             ionosonde_data = dict(self._solar_conditions.ionosonde_data or {})
             updated_count = 0
 
@@ -76,10 +84,27 @@ class GIROIonosonde(SolarConditionsProvider):
                 name = station["name"]
                 try:
                     fof2, muf, luf = self._fetch_station_data(ursi, from_time, now)
-                    if fof2 and muf:
+                    if not fof2 or not muf:
-                        band_states = self._compute_band_statess(fof2, muf, luf or {})
+                        continue
-                        ionosonde_data[ursi] = {"ursi": ursi, "name": name, "fof2": fof2, "muf": muf,
+
-                                                "luf": luf or None, "band_states": band_states}
+                    # Merge GIRO's readings into any existing data for this station.
+                    existing = ionosonde_data.get(ursi, {})
+                    merged_fof2 = {**{float(t): v for t, v in (existing.get("fof2") or {}).items()}, **fof2}
+                    merged_muf = {**{float(t): v for t, v in (existing.get("muf") or {}).items()}, **muf}
+                    merged_luf = dict(luf) if luf else {}
+
+                    merged_fof2 = {t: v for t, v in merged_fof2.items() if t >= cutoff_ts}
+                    merged_muf = {t: v for t, v in merged_muf.items() if t >= cutoff_ts}
+                    merged_luf = {t: v for t, v in merged_luf.items() if t >= cutoff_ts}
+
+                    band_states = compute_band_states(merged_fof2, merged_muf, merged_luf)
+                    ionosonde_data[ursi] = {
+                        "ursi": ursi, "name": name,
+                        "fof2": merged_fof2 or None,
+                        "muf": merged_muf or None,
+                        "luf": merged_luf or None,
+                        "band_states": band_states,
+                    }
                     updated_count += 1
                 except Exception:
                     logging.warning(f"Could not fetch ionosonde data for {ursi} ({name})")
@@ -91,7 +116,7 @@ class GIROIonosonde(SolarConditionsProvider):
 
         except Exception:
             self.status = "Error"
-            logging.exception(f"Exception in GIRO Ionosonde data provider")
+            logging.exception("Exception in GIRO Ionosonde data provider")
             self._stop_event.wait(timeout=1)
 
     def _fetch_station_data(self, ursi, from_time, to_time):
@@ -105,40 +130,6 @@ class GIROIonosonde(SolarConditionsProvider):
             return None, None, None
         return self._parse_all(response.text)
 
-    @staticmethod
-    def _latest(d):
-        """Return the value with the highest timestamp key, or None if the dict is empty."""
-        return d[max(d.keys())] if d else None
-
-    @staticmethod
-    def _compute_band_statess(fof2_dict, muf_dict, luf_dict):
-        """Compute HF band states from the latest foF2, MUF and LUF values.
-
-        States:
-          Closed if band frequency is below LUF (if known) or above MUF
-          Short if band frequency is >= LUF and < foF2 (good for NVIS)
-          Long if band frequency is >= foF2 and < MUF (good for DX)
-        """
-
-        # We have a list of timestamped data for each value, but for this we only want the latest value
-        fof2 = GIROIonosonde._latest(fof2_dict)
-        muf = GIROIonosonde._latest(muf_dict)
-        luf = GIROIonosonde._latest(luf_dict)
-        if fof2 is None or muf is None:
-            return {}
-        band_states = {}
-
-        # Iterate over all ham HF bands, we don't care about the others at this point
-        for band in HF_BANDS:
-            freq = band.start_freq / 1000000
-            if freq > muf or (luf is not None and freq < luf):
-                band_states[band.name] = "Closed"
-            elif freq < fof2:
-                band_states[band.name] = "Short"
-            else:
-                band_states[band.name] = "Long"
-        return band_states
-
     @staticmethod
     def _parse_all(text):
         """Parse web server response and return (fof2_dict, muf_dict, luf_dict) keyed by UNIX timestamp."""

solarconditionsproviders/ionosonde_utils.py

@@ -0,0 +1,33 @@
+from core.constants import BANDS
+
+HF_BANDS = [b for b in BANDS if b.is_ham_hf]
+
+
+def _latest(d):
+    return d[max(d.keys())] if d else None
+
+
+def compute_band_states(fof2_dict, muf_dict, luf_dict):
+    """Compute HF band states from the latest foF2, MUF and LUF values.
+
+    States:
+      Closed if band frequency is above MUF or below LUF (if known)
+      Short  if band frequency is >= LUF and < foF2 (good for NVIS)
+      Long   if band frequency is >= foF2 and < MUF (good for DX)
+    """
+
+    fof2 = _latest(fof2_dict)
+    muf = _latest(muf_dict)
+    luf = _latest(luf_dict) if luf_dict else None
+    if fof2 is None or muf is None:
+        return {}
+    band_states = {}
+    for band in HF_BANDS:
+        freq = band.start_freq / 1_000_000
+        if freq > muf or (luf is not None and freq < luf):
+            band_states[band.name] = "Closed"
+        elif freq < fof2:
+            band_states[band.name] = "Short"
+        else:
+            band_states[band.name] = "Long"
+    return band_states

solarconditionsproviders/kc2gprop.py

@@ -0,0 +1,121 @@
+import logging
+from datetime import datetime, timezone, timedelta
+from threading import Thread, Event
+
+import pytz
+import requests
+
+from core.constants import HTTP_HEADERS
+from solarconditionsproviders.ionosonde_utils import compute_band_states
+from solarconditionsproviders.solar_conditions_provider import SolarConditionsProvider
+
+POLL_INTERVAL = 900  # 15 minutes
+KC2G_URL = "https://prop.kc2g.com/api/stations.json"
+HISTORY_HOURS = 24
+
+
+class KC2GProp(SolarConditionsProvider):
+    """Solar conditions provider using ionosonde data from prop.kc2g.com. The API returns only the latest reading per
+     station, so this provider polls every 15 minutes and accumulates a 24-hour time series by merging each new reading
+     into the persisted ionosonde_data, producing the same data structure as GIROIonosonde.
+
+     Can run alongside GIROIonosonde: KC2G provides foF2/MUF with good reliability, while GIRO supplements with LUF
+     readings. Stations from each source that the other does not cover are preserved."""
+
+    def __init__(self, provider_config):
+        super().__init__(provider_config)
+        self._thread = None
+        self._stop_event = Event()
+
+    def start(self):
+        logging.info(f"Set up query of KC2G ionosonde data API every {POLL_INTERVAL} seconds.")
+        self._thread = Thread(target=self._run, daemon=True)
+        self._thread.start()
+
+    def stop(self):
+        self._stop_event.set()
+
+    def _run(self):
+        while True:
+            self._poll()
+            if self._stop_event.wait(timeout=POLL_INTERVAL):
+                break
+
+    def _poll(self):
+        try:
+            logging.debug("Polling KC2G ionosonde data...")
+            response = requests.get(KC2G_URL, headers=HTTP_HEADERS, timeout=(5, 30))
+            if response.status_code != 200:
+                logging.warning(f"KC2G ionosonde API returned HTTP {response.status_code}")
+                return
+
+            now = datetime.now(timezone.utc)
+            cutoff_ts = (now - timedelta(hours=HISTORY_HOURS)).timestamp()
+
+            # Start from existing ionosonde_data so the accumulated time series survives across polls and restarts and
+            # stations provided only by GIROIonosonde are not discarded
+            ionosonde_data = dict(self._solar_conditions.ionosonde_data or {})
+            updated_count = 0
+
+            for reading in response.json():
+                station = reading.get("station", {})
+                ursi = station.get("code")
+                name = station.get("name")
+                if not ursi or not name:
+                    continue
+
+                time_str = reading.get("time")
+                if not time_str:
+                    continue
+                try:
+                    ts = datetime.fromisoformat(time_str)
+                    if ts.tzinfo is None:
+                        ts = ts.replace(tzinfo=timezone.utc)
+                    ts_float = ts.timestamp()
+                except ValueError:
+                    continue
+
+                # Skip readings outside our history window (some stations have months-old data)
+                if ts_float < cutoff_ts:
+                    continue
+
+                fof2_val = reading.get("fof2")
+                muf_val = reading.get("mufd")
+                if fof2_val is None and muf_val is None:
+                    continue
+
+                # Merge this reading into the existing time series for the station.
+                existing = ionosonde_data.get(ursi, {})
+                fof2_dict = dict(existing.get("fof2") or {})
+                muf_dict = dict(existing.get("muf") or {})
+                # LUF is not available from KC2G; carry forward whatever GIRO has written.
+                luf_dict = {float(t): v for t, v in (existing.get("luf") or {}).items()}
+
+                fof2_dict[ts_float] = fof2_val
+                muf_dict[ts_float] = muf_val
+
+                # Trim all series to the 24-hour window.
+                fof2_dict = {t: v for t, v in fof2_dict.items() if t >= cutoff_ts}
+                muf_dict = {t: v for t, v in muf_dict.items() if t >= cutoff_ts}
+                luf_dict = {t: v for t, v in luf_dict.items() if t >= cutoff_ts}
+
+                band_states = compute_band_states(fof2_dict, muf_dict, luf_dict)
+                ionosonde_data[ursi] = {
+                    "ursi": ursi,
+                    "name": name,
+                    "fof2": fof2_dict or None,
+                    "muf": muf_dict or None,
+                    "luf": luf_dict or None,
+                    "band_states": band_states,
+                }
+                updated_count += 1
+
+            self.update_data({"ionosonde_data": ionosonde_data})
+            self.status = "OK"
+            self.last_update_time = datetime.now(pytz.UTC)
+            logging.debug(f"Updated KC2G ionosonde data for {updated_count} stations.")
+
+        except Exception:
+            self.status = "Error"
+            logging.exception("Exception in KC2G ionosonde data provider")
+            self._stop_event.wait(timeout=1)

spothole.py

@@ -9,8 +9,8 @@ from diskcache import Cache
 
 from core.cleanup import CleanupTimer
 from data.solar_conditions import SolarConditions
-from core.config import config, WEB_SERVER_PORT, SERVER_OWNER_CALLSIGN
+from core.config import config, SERVER_OWNER_CALLSIGN
-from core.constants import SOFTWARE_NAME, SOFTWARE_VERSION
+from core.constants import SOFTWARE_VERSION
 from core.lookup_helper import lookup_helper
 from core.status_reporter import StatusReporter
 from server.webserver import WebServer
@@ -90,7 +90,7 @@ if __name__ == '__main__':
 
     logging.info("Starting...")
     logging.info(
-        "This is " + SOFTWARE_NAME + " version " + SOFTWARE_VERSION + ". This instance is run by " + SERVER_OWNER_CALLSIGN + ".")
+        "This is Spothole version " + SOFTWARE_VERSION + ". This instance is run by " + SERVER_OWNER_CALLSIGN + ".")
 
     # Shut down gracefully on SIGINT
     signal.signal(signal.SIGINT, shutdown)
@@ -98,19 +98,21 @@ if __name__ == '__main__':
     # Set up lookup helper
     lookup_helper.start()
 
-    # Set up web server
+    # Create spot providers
-    web_server = WebServer(spots=spots, alerts=alerts, solar_conditions=solar_conditions, status_data=status_data,
-                           solar_condition_providers=solar_condition_providers, port=WEB_SERVER_PORT)
-
-    # Fetch, set up and start spot providers
     for entry in config["spot-providers"]:
         spot_providers.append(get_spot_provider_from_config(entry))
+
+    # Set up web server
+    web_server = WebServer(spots=spots, alerts=alerts, solar_conditions=solar_conditions, status_data=status_data,
+                           spot_providers=spot_providers)
+
+    # Set up and start spot providers
     for p in spot_providers:
         p.setup(spots=spots, web_server=web_server)
         if p.enabled:
             p.start()
 
-    # Fetch, set up and start alert providers
+    # Create, set up and start alert providers
     for entry in config["alert-providers"]:
         alert_providers.append(get_alert_provider_from_config(entry))
     for p in alert_providers:
@@ -118,7 +120,7 @@ if __name__ == '__main__':
         if p.enabled:
             p.start()
 
-    # Fetch, set up and start solar conditions providers
+    # Create, set up and start solar conditions providers
     for entry in config.get("solar-condition-providers", []):
         solar_condition_providers.append(get_solar_conditions_provider_from_config(entry))
     for p in solar_condition_providers:

spotproviders/gma.py

@@ -89,3 +89,11 @@ class GMA(HTTPSpotProvider):
                     logging.warning("Exception when looking up " + self.REF_INFO_URL_ROOT + source_spot[
                         "REF"] + ", ignoring this spot for now")
         return new_spots
+
+    def can_submit_spot(self, sig):
+        return sig == "GMA"
+
+    def submit_spot(self, spot, credentials):
+        # TODO: Implement.
+        # Spotting to GMA is documented: https://www.cqgma.org/api/doc/apigma_spot.pdf We (or the user) need a GMA account, and to send the password in plaintext(!!)
+        raise NotImplementedError("GMA upstream spot submission is not yet implemented")

spotproviders/hema.py

@@ -64,3 +64,10 @@ class HEMA(HTTPSpotProvider):
                     # that for us.
                     new_spots.append(spot)
         return new_spots
+
+    def can_submit_spot(self, sig):
+        return sig == "HEMA"
+
+    def submit_spot(self, spot, credentials):
+        # TODO: Implement. Spotting to HEMA is covered in the original email from the team.
+        raise NotImplementedError("HEMA upstream spot submission is not yet implemented")

spotproviders/http_spot_provider.py

@@ -19,6 +19,7 @@ class HTTPSpotProvider(SpotProvider):
         self._poll_interval = poll_interval
         self._thread = None
         self._stop_event = Event()
+        self._wakeup_event = Event()
 
     def start(self):
         # Fire off the polling thread. It will poll immediately on startup, then sleep for poll_interval between
@@ -29,11 +30,19 @@ class HTTPSpotProvider(SpotProvider):
 
     def stop(self):
         self._stop_event.set()
+        self._wakeup_event.set()
+
+    def force_poll(self):
+        """Trigger an immediate poll without waiting for the normal interval."""
+
+        self._wakeup_event.set()
 
     def _run(self):
         while True:
+            self._wakeup_event.clear()
             self._poll()
-            if self._stop_event.wait(timeout=self._poll_interval):
+            self._wakeup_event.wait(timeout=self._poll_interval)
+            if self._stop_event.is_set():
                 break
 
     def _poll(self):

spotproviders/parksnpeaks.py

@@ -3,7 +3,9 @@ import re
 from datetime import datetime
 
 import pytz
+import requests
 
+from core.constants import HTTP_HEADERS
 from data.sig_ref import SIGRef
 from data.spot import Spot
 from spotproviders.http_spot_provider import HTTPSpotProvider
@@ -14,7 +16,9 @@ class ParksNPeaks(HTTPSpotProvider):
 
     POLL_INTERVAL_SEC = 120
     SPOTS_URL = "https://www.parksnpeaks.org/api/ALL"
+    SUBMIT_URL = "https://www.parksnpeaks.org/api/SPOT/"
     SIOTA_LIST_URL = "https://www.silosontheair.com/data/silos.csv"
+    SUBMITTABLE_SIGS = ["POTA", "SOTA", "WWFF", "HEMA", "WOTA", "ZLOTA", "SIOTA", "KRMNPA"]
 
     def __init__(self, provider_config):
         super().__init__(provider_config, self.SPOTS_URL, self.POLL_INTERVAL_SEC)
@@ -62,3 +66,27 @@ class ParksNPeaks(HTTPSpotProvider):
                 # Add new spot to the list
                 new_spots.append(spot)
         return new_spots
+
+    def can_submit_spot(self, sig):
+        return sig in self.SUBMITTABLE_SIGS
+
+    def submit_spot(self, spot, credentials):
+        # TODO test this works
+        user_id = credentials.get("user_id", "")
+        api_key = credentials.get("api_key", "")
+        if not user_id or not api_key:
+            raise ValueError("Parks N Peaks user ID and API key are required. Get yours from your Parks N Peaks account.")
+        sig_ref = spot.sig_refs[0].id if spot.sig_refs else ""
+        body = {
+            "actClass": spot.sig or "",
+            "actCallsign": spot.dx_call,
+            "actSite": sig_ref,
+            "mode": spot.mode or "",
+            "freq": str(spot.freq / 1000000.0),
+            "comments": spot.comment or "",
+            "userID": user_id,
+            "APIKey": api_key,
+        }
+        response = requests.post(self.SUBMIT_URL, json=body, headers=HTTP_HEADERS, timeout=(5, 30))
+        if not response.ok:
+            raise RuntimeError("Parks N Peaks API returned " + str(response.status_code) + ": " + response.text)

spotproviders/pota.py

@@ -1,7 +1,9 @@
 from datetime import datetime
 
 import pytz
+import requests
 
+from core.constants import HTTP_HEADERS
 from data.sig_ref import SIGRef
 from data.spot import Spot
 from spotproviders.http_spot_provider import HTTPSpotProvider
@@ -12,6 +14,7 @@ class POTA(HTTPSpotProvider):
 
     POLL_INTERVAL_SEC = 120
     SPOTS_URL = "https://api.pota.app/spot/activator"
+    SUBMIT_URL = "https://api.pota.app/spot"
 
     def __init__(self, provider_config):
         super().__init__(provider_config, self.SPOTS_URL, self.POLL_INTERVAL_SEC)
@@ -40,3 +43,25 @@ class POTA(HTTPSpotProvider):
             # that for us.
             new_spots.append(spot)
         return new_spots
+
+    def can_submit_spot(self, sig):
+        return sig == "POTA"
+
+    def submit_spot(self, spot, credentials):
+        sig_ref = spot.sig_refs[0].id if spot.sig_refs else None
+        if sig_ref:
+            body = {
+                "activator": spot.dx_call,
+                "spotter": spot.de_call,
+                "frequency": str(spot.freq / 1000.0),
+                "mode": spot.mode or "",
+                "reference": sig_ref,
+                "comments": spot.comment or "",
+                "source": "Spothole",
+            }
+            headers = {**HTTP_HEADERS, "Content-Type": "application/json"}
+            response = requests.post(self.SUBMIT_URL, json=body, headers=headers, timeout=(5, 30))
+            if not response.ok:
+                raise RuntimeError("POTA API returned " + str(response.status_code) + ": " + response.text)
+        else:
+            raise RuntimeError("Park reference is required for submitting POTA spots.")

spotproviders/sota.py

@@ -2,7 +2,7 @@ from datetime import datetime
 
 import requests
 
-from core.constants import HTTP_HEADERS
+from core.constants import HTTP_HEADERS, SSB_SUB_MODES, DV_SUB_MODES
 from data.sig_ref import SIGRef
 from data.spot import Spot
 from spotproviders.http_spot_provider import HTTPSpotProvider
@@ -20,6 +20,9 @@ class SOTA(HTTPSpotProvider):
     # SOTA spots don't contain lat/lon, we need a separate lookup for that
     SUMMIT_URL_ROOT = "https://api-db2.sota.org.uk/api/summits/"
 
+    SUBMIT_URL = "https://api-db2.sota.org.uk/api/spots"
+    VALID_MODES = ["AM", "CW", "Data", "DV", "FM", "SSB"]
+
     def __init__(self, provider_config):
         super().__init__(provider_config, self.EPOCH_URL, self.POLL_INTERVAL_SEC)
         self._api_epoch = ""
@@ -56,3 +59,45 @@ class SOTA(HTTPSpotProvider):
                 # that for us.
                 new_spots.append(spot)
         return new_spots
+
+    def can_submit_spot(self, sig):
+        return sig == "SOTA"
+
+    def submit_spot(self, spot, credentials):
+        # TODO test this method works
+        access_token = credentials.get("access_token", "")
+        id_token = credentials.get("id_token", "")
+        if not access_token or not id_token:
+            raise ValueError("SOTA API tokens are required. Please log into SOTA in order to spot to it.")
+        sig_ref = spot.sig_refs[0].id if spot.sig_refs else ""
+        if sig_ref:
+            # Split reference into association and summit codes
+            ref_split = sig_ref.split("/")
+
+            # Figure out a valid mode. Borrowed this from PoLo :)
+            # https://github.com/ham2k/app-polo/blob/main/src/extensions/activities/sota/SOTAPostSelfSpot.js
+            mode = spot.mode
+            if mode and mode not in self.VALID_MODES:
+                if mode in SSB_SUB_MODES:
+                    mode = "SSB"
+                elif mode in DV_SUB_MODES:
+                    mode = "DV"
+                else:
+                    mode = "Data"
+
+            body = {
+                "activatorCallsign": spot.dx_call,
+                "associationCode": ref_split[0],
+                "summitCode": ref_split[1],
+                "frequency": spot.freq / 1000000.0,
+                "mode": mode or "",
+                "callsign": spot.de_call,
+                "comments": spot.comment or "",
+                "type": "TEST" # todo replatce with NORMAL/QRT once testing complete
+            }
+            headers = {**HTTP_HEADERS, "Authorization": "bearer " + access_token, "id_token": id_token, "Content-Type": "application/json"}
+            response = requests.post(self.SUBMIT_URL, json=body, headers=headers, timeout=(5, 30))
+            if not response.ok:
+                raise RuntimeError("SOTA API returned " + str(response.status_code) + ": " + response.text)
+        else:
+            raise RuntimeError("Summit reference is required for submitting SOTA spots.")

spotproviders/spot_provider.py

@@ -68,3 +68,20 @@ class SpotProvider:
         """Stop any threads and prepare for application shutdown"""
 
         raise NotImplementedError("Subclasses must implement this method")
+
+    def can_submit_spot(self, sig):
+        """Return True if this provider supports submitting spots upstream for the given SIG."""
+
+        return False
+
+    def submit_spot(self, spot, credentials):
+        """Submit a spot upstream to this provider's API. credentials is a dict with provider-specific keys.
+        Raises an exception with a descriptive message on failure."""
+
+        raise NotImplementedError("This provider does not support spot submission")
+
+    def force_poll(self):
+        """Trigger an immediate poll without waiting for the normal interval. Default implementation here does nothing
+        because not all spot providers have a polling mechanism. Providers that do should override this method."""
+
+        return

spotproviders/tiles.py

@@ -1,5 +1,8 @@
 from datetime import datetime
 
+import requests
+
+from core.constants import HTTP_HEADERS, SSB_SUB_MODES
 from data.sig_ref import SIGRef
 from data.spot import Spot
 from spotproviders.http_spot_provider import HTTPSpotProvider
@@ -10,6 +13,8 @@ class Tiles(HTTPSpotProvider):
 
     POLL_INTERVAL_SEC = 120
     SPOTS_URL = "https://icneuzxitdqtofutxbla.supabase.co/functions/v1/spots?active_hours=24"
+    SUBMIT_URL = "https://icneuzxitdqtofutxbla.supabase.co/functions/v1/self-spot"
+    VALID_MODES = ["SSB", "CW", "FT8", "FT4", "FM", "DMR", "D-STAR", "M17", "AX.25", "JS8Call", "PSK31", "Olivia", "VarAC", "Other"]
 
     def __init__(self, provider_config):
         super().__init__(provider_config, self.SPOTS_URL, self.POLL_INTERVAL_SEC)
@@ -41,6 +46,48 @@ class Tiles(HTTPSpotProvider):
             new_spots.append(spot)
         return new_spots
 
+    def can_submit_spot(self, sig):
+        return sig == "Tiles"
+
+    def submit_spot(self, spot, credentials):
+        # Tiles on the air currently only supports *self* spots
+        if spot.dx_call == spot.de_call:
+
+            # Figure out a valid mode. Borrowed this from PoLo :)
+            # https://github.com/ham2k/app-polo/blob/main/src/extensions/activities/sota/SOTAPostSelfSpot.js
+            if spot.mode:
+                mode = spot.mode
+                if mode not in self.VALID_MODES:
+                    if mode in SSB_SUB_MODES:
+                        mode = "SSB"
+                    elif mode == "OLIVIA":
+                        mode = "Olivia"
+                    elif mode == "JS8":
+                        mode = "JS8Call"
+                    else:
+                        mode = "Other"
+
+                body = {
+                    "call_sign": spot.dx_call,
+                    "frequency": str(spot.freq / 1000000.0),
+                    "mode": mode or "",
+                    "grid": spot.dx_grid or "",
+                    "comment": spot.comment or "",
+                    "lat": spot.dx_latitude or None,
+                    "lon": spot.dx_longitude or None,
+                    "qrt": spot.qrt or False,
+                    "pin": credentials.get("offline_spot_gateway_pin", "")
+                }
+                headers = {**HTTP_HEADERS, "Content-Type": "application/json"}
+                response = requests.post(self.SUBMIT_URL, json=body, headers=headers, timeout=(5, 30))
+                if not response.ok:
+                    raise RuntimeError("Tiles on the Air API returned " + str(response.status_code) + ": " + response.text)
+            else:
+                raise RuntimeError("The Tiles on the Air API requires a mode to be set.")
+        else:
+            raise RuntimeError("The Tiles on the Air API only supports self-spots, the DX call and spotter call must match.")
+
+
 # Utility function to keep the first decimal point in a given string but remove any others. Used to parse Tiles'
 # strange frequency format where we can sometimes have e.g. "14.123.5".
 def strip_extra_decimal_points(s):

spotproviders/wota.py

@@ -77,3 +77,10 @@ class WOTA(HTTPSpotProvider):
             except Exception as e:
                 logging.error("Exception parsing WOTA spot", e)
         return new_spots
+
+    def can_submit_spot(self, sig):
+        return sig == "WOTA"
+
+    def submit_spot(self, spot, credentials):
+        # TODO Ask M5TEA if he's happy to share how this is done from his app
+        raise NotImplementedError("WOTA upstream spot submission is not yet implemented")

spotproviders/wwbota.py

@@ -41,3 +41,10 @@ class WWBOTA(SSESpotProvider):
 
         # WWBOTA does support a special "Test" spot type, we need to avoid adding that.
         return spot if source_spot["type"] != "Test" else None
+
+    def can_submit_spot(self, sig):
+        return sig == "WWBOTA"
+
+    def submit_spot(self, spot, credentials):
+        # TODO: Implement. WWBOTA API docs cover this: https://api.wwbota.org/#tag/Spots/operation/create_spot_spots__post
+        raise NotImplementedError("WWBOTA upstream spot submission is not yet implemented")

spotproviders/wwff.py

@@ -38,3 +38,10 @@ class WWFF(HTTPSpotProvider):
             # that for us.
             new_spots.append(spot)
         return new_spots
+
+    def can_submit_spot(self, sig):
+        return sig == "WWFF"
+
+    def submit_spot(self, spot, credentials):
+        # TODO: Implement. Spotting to WWFF should be possible, need to look up the Spotline docs or copy approach from PoLo. Either way I think we need an API key for the app (but maybe not for the user?)
+        raise NotImplementedError("WWFF upstream spot submission is not yet implemented")

spotproviders/zlota.py

@@ -41,3 +41,10 @@ class ZLOTA(HTTPSpotProvider):
 
             new_spots.append(spot)
         return new_spots
+
+    def can_submit_spot(self, sig):
+        return sig == "ZLOTA"
+
+    def submit_spot(self, spot, credentials):
+        # TODO: Implement. Spotting to ZLOTA is supported via POST, see https://ontheair.nz/api
+        raise NotImplementedError("ZLOTA upstream spot submission is not yet implemented")

templates/about.html

@@ -27,7 +27,7 @@
     <h4 class="mt-4">What data sources are supported?</h4>
     <p>Spothole can retrieve spots from: <a href="https://www.dxcluster.info/telnet/">Telnet-based DX clusters</a>, the <a href="https://www.reversebeacon.net/">Reverse Beacon Network (RBN)</a>, the <a href="https://www.aprs-is.net/">APRS Internet Service (APRS-IS)</a>, <a href="https://pota.app">POTA</a>, <a href="https://www.sota.org.uk/">SOTA</a>, <a href="https://wwff.co/">WWFF</a>, <a href="https://www.cqgma.org/">GMA</a>, <a href="https://wwbota.net/">WWBOTA</a>, <a href="http://www.hema.org.uk/">HEMA</a>, <a href="https://www.parksnpeaks.org/">Parks 'n' Peaks</a>, <a href="https://ontheair.nz">ZLOTA</a>, <a href="https://www.wota.org.uk/">WOTA</a>, <a href="https://llota.app">LLOTA</a>, <a href="https://wwtota.com">WWTOTA</a>, <a href="https://tilesontheair.com/">Tiles on the Air</a>, the <a href="https://ukpacketradio.network/">UK Packet Repeater Network</a>, and any site based on the <a href="https://github.com/nischu/xOTA">xOTA software by nischu</a>.</p>
     <p>Spothole can retrieve alerts from: <a href="https://www.ng3k.com/">NG3K</a>, <a href="https://pota.app">POTA</a>, <a href="https://www.sota.org.uk/">SOTA</a>, <a href="https://wwff.co/">WWFF</a>, <a href="https://www.parksnpeaks.org/">Parks 'n' Peaks</a>, <a href="https://www.wota.org.uk/">WOTA</a> and <a href="https://www.beachesontheair.com/">BOTA</a>.</p>
-    <p>Spothole can retrieve solar and propagation condition data from <a href="https://www.hamqsl.com">HamQSL</a>, the <a href="https://www.swpc.noaa.gov/">NOAA Space Weather Prediction Center</a> and the <a href="https://giro.uml.edu/">Lowell GIRO Data Center</a>.</p>
+    <p>Spothole can retrieve solar and propagation condition data from <a href="https://www.hamqsl.com">HamQSL</a>, the <a href="https://www.swpc.noaa.gov/">NOAA Space Weather Prediction Center</a>, the <a href="https://giro.uml.edu/">Lowell GIRO Data Center</a> and <a href="https://prop.kc2g.com/">prop.kc2g.com</a> by KC2G.</p>
     <p>Spothole can also perform lookups for callsign data on behalf of the user from <a href="https://qrz.com">QRZ.com</a> and <a href="https://hamqth.com">HamQTH</a>.</p>
     <p>Note that the server owner has not necessarily enabled all these data sources. In particular it is common to disable RBN, to avoid the server being swamped with FT8 traffic, and to disable APRS-IS and UK Packet Net so that the server only displays stations where there is likely to be an operator physically present for a QSO.</p>
     <p>Between the various data sources, the following Special Interest Groups (SIGs) are supported: Parks on the Air (POTA), Summits on the Air (SOTA), Worldwide Flora & Fauna (WWFF), Global Mountain Activity (GMA), Worldwide Bunkers on the Air (WWBOTA), HuMPs Excluding Marilyns Award (HEMA), Islands on the Air (IOTA), Mills on the Air (MOTA), the Amateur Radio Lighthouse Socirty (ARLHS), International Lighthouse Lightship Weekend (ILLW), Silos on the Air (SIOTA), World Castles Award (WCA), New Zealand on the Air (ZLOTA), Keith Roget Memorial National Parks Award (KRMNPA), Wainwrights on the Air (WOTA), Beaches on the Air (BOTA), Lagos y Lagunas On the Air (LLOTA), Towers on the Air (WWTOTA), Tiles on the Air, Worked All Britain (WAB), Worked All Ireland (WAI), and Toilets on the Air (TOTA).</p>
@@ -69,7 +69,7 @@
     <p>This software is dedicated to the memory of Tom G1PJB, SK, a friend and colleague who sadly passed away around the time I started writing it in Autumn 2025. I was looking forward to showing it to you when it was done.</p>
 </div>
 
-<script src="/js/common.js?v=1780424170"></script>
+<script src="/js/common.js?v=1781335058"></script>
 <script>$(document).ready(function() { $("#nav-link-about").addClass("active"); }); <!-- highlight active page in nav --></script>
 
 {% end %}

templates/add_spot.html

@@ -1,13 +1,6 @@
 {% extends "base.html" %}
 {% block content %}
 
-<div id="add-spot-intro-box" class="permanently-dismissible-box mt-3">
-<div class="alert alert-primary alert-dismissible fade show" role="alert">
-  <i class="fa-solid fa-circle-info"></i> <strong>Adding spots to Spothole</strong><br/>This page is implemented as a proof of concept for adding spots to the Spothole system. Currently, spots added in this way are only visible within Spothole and are not sent "upstream" to DX clusters or xOTA spotting sites. The functionality might be extended to include this in future if there is demand for it. If you'd like this to be added, please give a thumbs-up on <a href="https://git.ianrenton.com/ian/spothole/issues/39" target="_new" class="alert-link">issue #39</a> or get in touch via email.
-  <button type="button" id="add-spot-intro-box-dismiss" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
-</div>
-</div>
-
 <div class="mt-3">
     <div id="add-spot-area" class="card mb-3">
         <div class="card-header">
@@ -60,6 +53,31 @@
                 </div>
             </form>
 
+            <div id="upstream-area" class="mt-3" style="display:none;">
+                <div class="row g-2 align-items-center">
+                    <div class="col-auto">
+                        <div class="form-check">
+                            <input class="form-check-input" type="checkbox" id="submit-upstream">
+                            <label class="form-check-label" for="submit-upstream">
+                                Send spot to <span id="upstream-provider-label"></span>
+                            </label>
+                        </div>
+                    </div>
+                    <div class="col-auto" id="upstream-provider-select-col" style="display:none;">
+                        <select id="upstream-provider-select" class="form-select form-select-sm"></select>
+                    </div>
+                    <div class="col-auto">
+                        <button type="button" class="btn btn-sm btn-outline-secondary" id="upstream-credentials-btn" onclick="showCredentialsModal();" style="display:none;">
+                            <i class="fa-solid fa-key"></i> Credentials
+                        </button>
+                    </div>
+                </div>
+            </div>
+
+            <div id="recaptcha-area" class="mt-3" style="display:none;">
+                <div id="recaptcha-widget"></div>
+            </div>
+
             <div id="result-good"></div>
             <div id="result-bad"></div>
 
@@ -69,8 +87,30 @@
 
 </div>
 
-<script src="/js/common.js?v=1780424170"></script>
+<!-- Credentials modal -->
-<script src="/js/add-spot.js?v=1780424170"></script>
+<div class="modal fade" id="credentials-modal" tabindex="-1" aria-labelledby="credentials-modal-label" aria-hidden="true">
+  <div class="modal-dialog">
+    <div class="modal-content">
+      <div class="modal-header">
+        <h5 class="modal-title" id="credentials-modal-label">Credentials for <span id="credentials-provider-name"></span></h5>
+        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+      </div>
+      <div class="modal-body">
+        <p class="small text-muted">Credentials are stored only in your browser and are never saved on the server.</p>
+        <div id="credentials-fields"></div>
+      </div>
+      <div class="modal-footer">
+        <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+        <button type="button" class="btn btn-primary" onclick="saveCredentials();">Save</button>
+      </div>
+    </div>
+  </div>
+</div>
+
+<script>window._recaptchaSiteKey = {% raw json_encode(web_ui_options.get('recaptcha-site-key', '')) %};
+window._allowUpstreamSpotting = {% raw json_encode(web_ui_options.get('allow-upstream-spotting', True)) %};</script>
+<script src="/js/common.js?v=1781335058"></script>
+<script src="/js/add-spot.js?v=1781335058"></script>
 <script>$(document).ready(function() { $("#nav-link-add-spot").addClass("active"); }); <!-- highlight active page in nav --></script>
 
 {% end %}

templates/alerts.html

@@ -70,8 +70,8 @@
 
 </div>
 
-<script src="/js/common.js?v=1780424170"></script>
+<script src="/js/common.js?v=1781335058"></script>
-<script src="/js/alerts.js?v=1780424170"></script>
+<script src="/js/alerts.js?v=1781335058"></script>
 <script>$(document).ready(function() { $("#nav-link-alerts").addClass("active"); }); <!-- highlight active page in nav --></script>
 
 {% end %}

templates/api_only_home.html

@@ -0,0 +1,23 @@
+{% extends "skeleton.html" %}
+{% block head_extra %}
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css" rel="stylesheet"
+          integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB" crossorigin="anonymous">
+{% end %}
+{% block body %}
+<div class="container mt-5">
+    <div class="row justify-content-center">
+        <div class="col-md-8">
+            <div class="text-center mb-4">
+                <img src="/img/logo.png" width="192" height="60" alt="Spothole">
+            </div>
+            <div class="card">
+                <div class="card-body">
+                    <p class="card-text">This server is running <strong>Spothole v{{software_version}}</strong>, and is operated by <strong>{{server_owner_callsign}}</strong>.</p>
+                    <p class="card-text">The web UI is not available on this instance because the server is running in API-only mode, intended for use by client software rather than visitors to the website. See the <a href="/apidocs">API documentation</a> for details of how client software can interact with the server.</p>
+                    <p class="card-text">Please see the <a href="https://git.ianrenton.com/ian/spothole#readme">README</a> for details of what Spothole is and how you can run it for yourself.</p>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>
+{% end %}

templates/bands.html

@@ -76,9 +76,9 @@
 <script>
     let spotProvidersEnabledByDefault = {% raw json_encode(web_ui_options["spot-providers-enabled-by-default"]) %};
 </script>
-<script src="/js/common.js?v=1780424170"></script>
+<script src="/js/common.js?v=1781335058"></script>
-<script src="/js/spotsbandsandmap.js?v=1780424170"></script>
+<script src="/js/spotsbandsandmap.js?v=1781335058"></script>
-<script src="/js/bands.js?v=1780424170"></script>
+<script src="/js/bands.js?v=1781335058"></script>
 <script>$(document).ready(function() { $("#nav-link-bands").addClass("active"); }); <!-- highlight active page in nav --></script>
 
 {% end %}

templates/base.html

@@ -1,6 +1,6 @@
 {% extends "skeleton.html" %}
 {% block head_extra %}
-    <link rel="stylesheet" href="/css/style.css?v=1780424170" type="text/css">
+    <link rel="stylesheet" href="/css/style.css?v=1781335058" type="text/css">
     <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootstrap.min.css" rel="stylesheet"
           integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZqJLB" crossorigin="anonymous">
     <link href="/fa/css/fontawesome.min.css" rel="stylesheet" />
@@ -19,9 +19,9 @@
             integrity="sha384-L1eE4eD41kpBIWe2I0eHy+GnEUC4RIpcvibVW2JCminuPlTl+2Bc528iPdVMg5Dn"
             crossorigin="anonymous"></script>
 
-    <script src="https://misc.ianrenton.com/jsutils/utils.js?v=1780424170"></script>
+    <script src="https://misc.ianrenton.com/jsutils/utils.js?v=1781335058"></script>
-    <script src="https://misc.ianrenton.com/jsutils/ui-ham.js?v=1780424170"></script>
+    <script src="https://misc.ianrenton.com/jsutils/ui-ham.js?v=1781335058"></script>
-    <script src="https://misc.ianrenton.com/jsutils/geo.js?v=1780424170"></script>
+    <script src="https://misc.ianrenton.com/jsutils/geo.js?v=1781335058"></script>
 {% end %}
 {% block body %}
 <div class="container">
@@ -42,9 +42,7 @@
                   {% if allow_spotting %}
                     <li class="nav-item ms-4"><a href="/add-spot" class="nav-link" id="nav-link-add-spot"><i class="fa-solid fa-comment"></i> Add&nbsp;Spot</a></li>
                   {% end %}
-                  {% if has_hamqsl or has_noaa_forecast %}
                     <li class="nav-item ms-4"><a href="/conditions" class="nav-link" id="nav-link-conditions"><i class="fa-solid fa-sun"></i> Conditions</a></li>
-                  {% end %}
                     <li class="nav-item ms-4"><a href="/status" class="nav-link" id="nav-link-status"><i class="fa-solid fa-chart-simple"></i> Status</a></li>
                     <li class="nav-item ms-4"><a href="/about" class="nav-link" id="nav-link-about"><i class="fa-solid fa-circle-info"></i> About</a></li>
                     <li class="nav-item ms-4"><a href="/apidocs" class="nav-link" id="nav-link-api"><i class="fa-solid fa-gear"></i> API</a></li>

templates/conditions.html

@@ -1,8 +1,8 @@
 {% extends "base.html" %}
 {% block content %}
 
-{% if has_hamqsl %}
+<div id="hamqsl-section" style="display:none">
-<div class="card mt-5">
+    <div class="card mt-5">
         <div class="card-header">
             Propagation Conditions
         </div>
@@ -82,9 +82,9 @@
             </div>
             <div class="form-text mt-3">Data from <a href="https://hamqsl.com">HamQSL.com</a>.</div>
         </div>
-</div>
+    </div>
 
-<div class="card mt-5">
+    <div class="card mt-5">
         <div class="card-header">
             Solar Weather
         </div>
@@ -126,16 +126,17 @@
             </div>
             <div class="row border-bottom align-items-start me-0">
                 <div class="col-12 col-md-2 fw-bold py-2">Electron Flux</div>
-            <div id="sw-electron-vals" class="col-12 col-md-3 py-2"><strong id="sw-electron-flux"></strong> efu</div>
+                <div id="sw-electron-vals" class="col-12 col-md-3 py-2"><strong id="sw-electron-flux"></strong> efu
+                </div>
                 <div id="sw-electron-desc" class="col-12 col-md-7 py-2"></div>
             </div>
             <div class="form-text mt-3">Data from <a href="https://hamqsl.com">HamQSL.com</a>.</div>
         </div>
+    </div>
 </div>
-{% end %}
 
-{% if has_noaa_forecast %}
+<div id="noaa-section" style="display:none">
-<div class="card mt-5">
+    <div class="card mt-5">
         <div class="card-header">
             Solar Weather Forecast
         </div>
@@ -170,11 +171,11 @@
                 Center</a>.
             </div>
         </div>
+    </div>
 </div>
-{% end %}
 
-{% if has_giro_ionosonde %}
+<div id="ionosonde-section" style="display:none">
-<div class="card mt-5">
+    <div class="card mt-5">
         <div class="card-header">
             Ionosonde Data
         </div>
@@ -186,33 +187,45 @@
                 </select>
             </div>
             <div id="ionosonde-latest" class="mb-3">
-            <div id="ionosonde-no-data" class="alert alert-warning mt-2 mb-0 py-2 js-hidden">No data available for this station.</div>
+                <div id="ionosonde-no-data" class="alert alert-warning mt-2 mb-0 py-2 js-hidden">No data available for
+                    this station.
+                </div>
                 <div id="ionosonde-data-rows" class="js-hidden">
                     <div class="row align-items-center me-0">
-                    <div class="col-12 py-2 text-muted">Latest values as of <span id="ionosonde-latest-time"></span></div>
+                        <div class="col-12 py-2 text-muted">Latest values as of <span id="ionosonde-latest-time"></span>
+                        </div>
                     </div>
                     <div class="row align-items-center me-0">
                         <div class="col-12 col-md-4 py-2">LUF: <strong id="ionosonde-latest-luf"></strong></div>
                         <div class="col-12 col-md-4 py-2">foF2: <strong id="ionosonde-latest-fof2"></strong></div>
-                    <div class="col-12 col-md-4 py-2">MUF (3000 km): <strong id="ionosonde-latest-muf"></strong></div>
+                        <div class="col-12 col-md-4 py-2">MUF (3000 km): <strong id="ionosonde-latest-muf"></strong>
+                        </div>
+                    </div>
+                    <div id="ionosonde-stale-warning" class="alert alert-warning mt-2 mb-0 py-2 js-hidden">Data is more
+                        than 12 hours old!
                     </div>
-                <div id="ionosonde-stale-warning" class="alert alert-warning mt-2 mb-0 py-2 js-hidden">Data is more than 12 hours old!</div>
                 </div>
             </div>
             <div id="ionosonde-band-state" class="mb-3 js-hidden">
                 <table class="table table-sm table-bordered mb-0 d-none d-md-table table-fixed-on-desktop">
-                <thead><tr id="ionosonde-band-state-head"></tr></thead>
+                    <thead>
-                <tbody><tr id="ionosonde-band-state-row"></tr></tbody>
+                    <tr id="ionosonde-band-state-head"></tr>
+                    </thead>
+                    <tbody>
+                    <tr id="ionosonde-band-state-row"></tr>
+                    </tbody>
                 </table>
                 <table class="table table-sm table-bordered mb-0 d-md-none">
                     <tbody id="ionosonde-band-state-body"></tbody>
                 </table>
             </div>
             <canvas id="ionosonde-chart" class="mt-3 mb-3 hideonmobile"></canvas>
-        <div class="form-text mt-2">Data from the <a href="https://lgdc.uml.edu/">Lowell GIRO Data Center</a>.</div>
+            <div class="form-text mt-2">Data from the <a href="https://lgdc.uml.edu/">Lowell GIRO Data Center</a> and/or
+                <a href="https://prop.kc2g.com/">KC2G</a>.
+            </div>
+        </div>
     </div>
 </div>
-{% end %}
 
 <div class="card mt-5">
     <div class="card-header">
@@ -271,8 +284,8 @@
 </div>
 
 <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.9/dist/chart.umd.min.js"></script>
-<script src="/js/common.js?v=1780424170"></script>
+<script src="/js/common.js?v=1781335058"></script>
-<script src="/js/conditions.js?v=1780424170"></script>
+<script src="/js/conditions.js?v=1781335058"></script>
 <script>$(document).ready(function () {
     $("#nav-link-conditions").addClass("active");
 }); <!-- highlight active page in nav --></script>

templates/map.html

@@ -94,9 +94,9 @@
 <script>
     let spotProvidersEnabledByDefault = {% raw json_encode(web_ui_options["spot-providers-enabled-by-default"]) %};
 </script>
-<script src="/js/common.js?v=1780424170"></script>
+<script src="/js/common.js?v=1781335058"></script>
-<script src="/js/spotsbandsandmap.js?v=1780424170"></script>
+<script src="/js/spotsbandsandmap.js?v=1781335058"></script>
-<script src="/js/map.js?v=1780424170"></script>
+<script src="/js/map.js?v=1781335058"></script>
 <script>$(document).ready(function() { $("#nav-link-map").addClass("active"); }); <!-- highlight active page in nav --></script>
 
 {% end %}

templates/spots.html

@@ -104,9 +104,9 @@
 <script>
     let spotProvidersEnabledByDefault = {% raw json_encode(web_ui_options["spot-providers-enabled-by-default"]) %};
 </script>
-<script src="/js/common.js?v=1780424170"></script>
+<script src="/js/common.js?v=1781335058"></script>
-<script src="/js/spotsbandsandmap.js?v=1780424170"></script>
+<script src="/js/spotsbandsandmap.js?v=1781335058"></script>
-<script src="/js/spots.js?v=1780424170"></script>
+<script src="/js/spots.js?v=1781335058"></script>
 <script>$(document).ready(function() { $("#nav-link-spots").addClass("active"); }); <!-- highlight active page in nav --></script>
 
 {% end %}

templates/status.html

@@ -59,8 +59,8 @@
     </div>
 </div>
 
-<script src="/js/common.js?v=1780424170"></script>
+<script src="/js/common.js?v=1781335058"></script>
-<script src="/js/status.js?v=1780424170"></script>
+<script src="/js/status.js?v=1781335058"></script>
 <script>
     $(document).ready(function() { $("#nav-link-status").addClass("active"); }); <!-- highlight active page in nav -->
 </script>

webassets/apidocs/openapi.yml

@@ -11,8 +11,16 @@ info:
     
     Please note that the data coming out of Spothole is only as good as the data going in. People mis-hear and make typos when spotting callsigns all the time, and there are plenty of areas where Spothole's location data may be inaccurate. If you are doing something where accuracy is important, such as contesting, you should not rely on Spothole's data to fill in any gaps in your log.
     
+    Spothole's source code is located at https://git.ianrenton.com/ian/spothole and the README there provides setup instructions if you would like to run your own copy. A demonstration server of Spothole is located at https://spothole.app.
+    
     ## Changelog
     
+    ### 1.4
+
+    * POST `/spot` now supports upstream submission to external providers such as POTA and SOTA via new `submit_upstream`, `upstream_provider`, and `upstream_credentials` request body fields.
+    * POST `/spot` now supports Google reCaptcha and (if the site owner has set it up) now requires `captcha_token` in order to successfully submit. (This is used to lock down the submit function and prevent submission via Spothole by bots or third-party clients.)
+    * GET `/options` now returns `spot_submit_providers`, a map of SIG names to the names of providers that support upstream spot submission for that SIG.
+
     ### 1.3
     
     * `/solar` response now includes `ionosonde_data`, which contains ionosonde station measurements (LUF, foF2 and MUF) sourced from the GIRO Data Center as well as implied band states.
@@ -34,7 +42,7 @@ info:
   license:
     name: The Unlicense
     url: https://unlicense.org/#the-unlicense
-  version: v1.3
+  version: 1.4
 
 servers:
   - url: https://spothole.app/api/v1
@@ -286,7 +294,8 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                type: string
+                example: "Failed"
 
 
   /lookup/sigref:
@@ -311,7 +320,8 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                type: string
+                example: "Failed"
 
 
 
@@ -337,7 +347,8 @@ paths:
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                type: string
+                example: "Failed"
 
 
   /spot:
@@ -345,40 +356,44 @@ paths:
       tags:
         - Spots
       summary: Add a spot
-      description: "Supply a new spot object, which will be added to the system. Currently, this will not be reported up the chain to a cluster, POTA, SOTA etc. This may be introduced in a future version. cURL example: `curl --request POST --header \"Content-Type: application/json\" --data '{\"dx_call\":\"M0TRT\",\"time\":1760019539, \"freq\":14200000, \"comment\":\"Test spot please ignore\", \"de_call\":\"M0TRT\"}' https://spothole.app/api/v1/spot`"
+      description: "Supply a new spot object, which will be added to the system. Optionally, set `submit_upstream` to true to forward the spot to an external provider such as POTA or SOTA. Check `spot_submit_providers` in the `/options` response to see which SIGs and providers support this. cURL example (local-only): `curl --request POST --header \"Content-Type: application/json\" --data '{\"dx_call\":\"M0TRT\",\"time\":1760019539, \"freq\":14200000, \"comment\":\"Test spot please ignore\", \"de_call\":\"M0TRT\"}' https://spothole.app/api/v1/spot`"
       operationId: spot
       requestBody:
-        description: The JSON spot object
+        description: The JSON spot object, plus optional upstream submission control fields
         required: true
         content:
           application/json:
             schema:
-              $ref: '#/components/schemas/Spot'
+              $ref: '#/components/schemas/SpotSubmission'
       responses:
-        '200':
+        '201':
           description: Success
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/OkResponse'
+                type: string
+                example: "OK"
         '415':
           description: Incorrect Content-Type
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                type: string
+                example: "Failed"
         '422':
           description: Validation error
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                type: string
+                example: "Failed"
         '500':
           description: Internal server error
           content:
             application/json:
               schema:
-                $ref: '#/components/schemas/ErrorResponse'
+                type: string
+                example: "Failed"
 
 components:
   parameters:
@@ -980,6 +995,48 @@ components:
           example: "GUID-123456"
 
 
+    SpotSubmission:
+      description: >
+        Request body for POST /spot. Contains all the fields of a Spot, plus optional
+        upstream submission control fields that are consumed by the server and never stored in the spot.
+      allOf:
+        - $ref: '#/components/schemas/Spot'
+        - type: object
+          properties:
+            submit_upstream:
+              type: boolean
+              description: >
+                If true, forward the spot to an external upstream provider (e.g. POTA, SOTA) rather
+                than only adding it to this Spothole server. Requires `sig`, at least one `sig_refs`
+                entry, and `upstream_provider` to be set. Check `spot_submit_providers` in the
+                /options response to see which SIGs and providers support this.
+              default: false
+            upstream_provider:
+              type: string
+              description: >
+                Name of the upstream provider to submit the spot to, e.g. "POTA" or "SOTA". Must
+                match one of the provider names returned in `spot_submit_providers` for the chosen SIG.
+              example: POTA
+            upstream_credentials:
+              type: object
+              description: >
+                Provider-specific credentials required to authenticate the upstream submission.
+                The required keys depend on the provider . Credentials are used only for the upstream
+                call and are never stored by Spothole.
+              additionalProperties:
+                type: string
+              example:
+                user_id: "12345"
+                api_key: "abc123"
+            captcha_token:
+              type: string
+              description: >
+                A Google reCAPTCHA v2 response token. Required when submitting upstream if the
+                server has reCAPTCHA configured (i.e. `submit_upstream` is true and the server
+                operator has set up reCAPTCHA keys). Obtain the token by completing the reCAPTCHA
+                widget rendered on the Add Spot page.
+              example: "03AFY_a8Xq..."
+
     SpotStream:
       type: object
       description: A server-sent event containing a spot
@@ -1292,7 +1349,7 @@ components:
         solar_storm_forecast:
           type: object
           description: >
-            NOAA Solar Radiation Storm forecast — probability (%) of S1 or greater events per day.
+            NOAA Solar Radiation Storm forecast containing probability (%) of S1 or greater events per day.
             Keys are UNIX timestamps (UTC seconds since epoch) for the start of each forecast day.
             Values are integer percentages (0–100).
           additionalProperties:
@@ -1306,7 +1363,7 @@ components:
         blackout_forecast_r1r2:
           type: object
           description: >
-            NOAA Radio Blackout forecast — probability (%) of R1–R2 (Minor–Moderate) blackout events
+            NOAA Radio Blackout forecast containing probability (%) of R1–R2 (Minor–Moderate) blackout events
             per day. Keys are UNIX timestamps (UTC seconds since epoch) for the start of each
             forecast day. Values are integer percentages (0–100).
           additionalProperties:
@@ -1320,7 +1377,7 @@ components:
         blackout_forecast_r3_or_greater:
           type: object
           description: >
-            NOAA Radio Blackout forecast — probability (%) of R3 or greater (Strong–Extreme) blackout
+            NOAA Radio Blackout forecast containing probability (%) of R3 or greater (Strong–Extreme) blackout
             events per day. Keys are UNIX timestamps (UTC seconds since epoch) for the start of each
             forecast day. Values are integer percentages (0–100).
           additionalProperties:
@@ -1377,6 +1434,32 @@ components:
             included, but not all of them may contain data.
           additionalProperties:
             $ref: '#/components/schemas/IonosondeStation'
+          example:
+            DB049:
+              ursi: DB049
+              name: Dourbes
+              fof2:
+                "1747267201.0": 7.45
+                "1747267501.0": 7.50
+              muf:
+                "1747267201.0": 21.66
+                "1747267501.0": 21.80
+              luf:
+                "1747267201.0": 2.10
+                "1747267501.0": 2.05
+              band_states:
+                "160m": Closed
+                "80m": Short
+                "40m": Long
+                "20m": Long
+                "10m": Closed
+            EA036:
+              ursi: EA036
+              name: Chilton
+              fof2: null
+              muf: null
+              luf: null
+              band_states: null
 
     IonosondeStation:
       type: object
@@ -1465,14 +1548,6 @@ components:
       items:
         $ref: '#/components/schemas/Alert'
 
-    OkResponse:
-      type: string
-      example: "OK"
-
-    ErrorResponse:
-      type: string
-      example: "Failed"
-
     DxStats:
       type: object
       description: Spot counts keyed by DE continent
@@ -1609,6 +1684,20 @@ components:
           type: boolean
           description: Whether the POST /spot call, to add spots to the server directly via its API, is permitted on this server.
           example: true
+        spot_submit_providers:
+          type: object
+          description: >
+            A map of SIG name to a list of provider names that support upstream spot submission for that SIG.
+            If a SIG appears as a key here, the POST /spot endpoint accepts `submit_upstream: true` for
+            spots with that SIG, and will forward the spot to one of the listed providers. Omitted if no
+            providers support upstream submission.
+          additionalProperties:
+            type: array
+            items:
+              type: string
+          example:
+            POTA: [POTA]
+            SOTA: [SOTA]
 
     CallLookup:
       type: object

webassets/js/add-spot.js

@@ -1,3 +1,27 @@
+// Credentials schema per provider name. Defines the fields to collect and how to label them.
+var PROVIDER_CREDENTIAL_SCHEMAS = {
+    // todo Figure out SOTA authentication
+    // see e.g. https://github.com/ham2k/app-polo/blob/main/src/extensions/activities/sota/SOTAAccount.jsx
+    //          https://github.com/ham2k/app-polo/blob/main/src/store/apis/apiSOTA/apiSOTA.js
+    // Refresh token? Way to show user that they need to log in again because cached credentials aren't valid?
+    // todo type: text/password distinction on text boxes so API keys can be obscured
+    "SOTA": [
+        { key: "access_token", label: "SOTA Access Token", help: "" },
+        { key: "id_token", label: "SOTA ID Token", help: "TODO SOTA authentication to provide this..." }
+    ],
+    "ParksNPeaks": [
+        { key: "user_id", label: "Parks N Peaks User ID", help: "" },
+        { key: "api_key", label: "Parks N Peaks API Key", help: "Get your API key from your Parks N Peaks account." }
+    ],
+    "ZLOTA": [
+        { key: "user_id", label: "ZLOTA User ID", help: "" },
+        { key: "api_key", label: "ZLOTA User PIN", help: "Get your PIN from your ZLOTA account." }
+    ],
+    "Tiles": [
+        { key: "offline_spot_gateway_pin", label: "Offline Spot Gateway PIN", help: "Get your PIN from your Tiles on the Air account profile." }
+    ]
+};
+
 // Load server options. Once a successful callback is made from this, we can populate the choice boxes in the form and load
 // any saved values from local storage.
 function loadOptions() {
@@ -21,11 +45,144 @@ function loadOptions() {
             }));
         });
 
+        // Load reCAPTCHA if a site key is configured (key is inlined into page by server)
+        if (window._recaptchaSiteKey) {
+            loadRecaptcha(window._recaptchaSiteKey);
+        }
+
         // Load settings from settings storage now all the controls are available
         loadSettings();
+
+        // Update the upstream area for any pre-selected SIG
+        updateUpstreamArea();
     });
 }
 
+// Load and inject the reCAPTCHA script
+function loadRecaptcha(siteKey) {
+    window._recaptchaSiteKey = siteKey;
+    if (!document.getElementById('recaptcha-script')) {
+        var script = document.createElement('script');
+        script.id = 'recaptcha-script';
+        script.src = 'https://www.google.com/recaptcha/api.js?render=explicit&onload=renderRecaptcha';
+        script.async = true;
+        script.defer = true;
+        document.head.appendChild(script);
+    }
+    $("#recaptcha-area").show();
+}
+
+// Called by reCAPTCHA after its script loads
+function renderRecaptcha() {
+    window._recaptchaWidgetId = grecaptcha.render('recaptcha-widget', {
+        sitekey: window._recaptchaSiteKey,
+        size: 'normal'
+    });
+}
+
+// Update the "Send spot to..." area based on the currently selected SIG
+function updateUpstreamArea() {
+    if (!window._allowUpstreamSpotting || !options || !options["spot_submit_providers"]) {
+        $("#upstream-area").hide();
+        return;
+    }
+
+    var sig = $("#sig").val();
+    var providers = (sig && options["spot_submit_providers"][sig]) ? options["spot_submit_providers"][sig] : [];
+
+    if (providers.length === 0) {
+        $("#upstream-area").hide();
+        return;
+    }
+
+    $("#upstream-area").show();
+
+    // Update the provider selector
+    $("#upstream-provider-select").empty();
+    $.each(providers, function(i, name) {
+        $("#upstream-provider-select").append($('<option>', { value: name, text: name }));
+    });
+
+    if (providers.length > 1) {
+        $("#upstream-provider-label").text("upstream spot sources:");
+        $("#upstream-provider-select-col").show();
+    } else {
+        $("#upstream-provider-label").text(providers[0]);
+        $("#upstream-provider-select-col").hide();
+    }
+
+    // Show the credentials button if this provider has an authentication mechanism and we need input from the user
+    updateCredentialsButton();
+}
+
+// Update the credentials button visibility based on selected provider
+function updateCredentialsButton() {
+    var providerName = getSelectedUpstreamProvider();
+    if (providerName && PROVIDER_CREDENTIAL_SCHEMAS[providerName]) {
+        $("#upstream-credentials-btn").show();
+    } else {
+        $("#upstream-credentials-btn").hide();
+    }
+}
+
+// Get the currently selected upstream provider name
+function getSelectedUpstreamProvider() {
+    var providers = (options && options["spot_submit_providers"] && $("#sig").val())
+        ? (options["spot_submit_providers"][$("#sig").val()] || [])
+        : [];
+    if (providers.length === 0) return null;
+    if (providers.length === 1) return providers[0];
+    return $("#upstream-provider-select").val();
+}
+
+// Show the credentials modal for the currently selected upstream provider
+function showCredentialsModal() {
+    var providerName = getSelectedUpstreamProvider();
+    if (!providerName || !PROVIDER_CREDENTIAL_SCHEMAS[providerName]) return;
+
+    var schema = PROVIDER_CREDENTIAL_SCHEMAS[providerName];
+    var stored = loadCredentials(providerName);
+
+    $("#credentials-provider-name").text(providerName);
+    $("#credentials-fields").empty();
+
+    $.each(schema, function(i, field) {
+        var val = stored[field.key] || "";
+        var html = '<div class="mb-3">';
+        html += '<label for="cred-' + field.key + '" class="form-label">' + field.label + '</label>';
+        html += '<input type="text" class="form-control" id="cred-' + field.key + '" value="' + $('<div>').text(val).html() + '">';
+        if (field.help) {
+            html += '<div class="form-text">' + field.help + '</div>';
+        }
+        html += '</div>';
+        $("#credentials-fields").append(html);
+    });
+
+    // Store provider name for saveCredentials()
+    $("#credentials-modal").data("provider", providerName);
+    new bootstrap.Modal(document.getElementById('credentials-modal')).show();
+}
+
+// Save credentials from the modal to local storage
+function saveCredentials() {
+    var providerName = $("#credentials-modal").data("provider");
+    if (!providerName || !PROVIDER_CREDENTIAL_SCHEMAS[providerName]) return;
+
+    var schema = PROVIDER_CREDENTIAL_SCHEMAS[providerName];
+    var creds = {};
+    $.each(schema, function(i, field) {
+        creds[field.key] = $("#cred-" + field.key).val();
+    });
+    localStorage.setItem("upstream-credentials-" + providerName, JSON.stringify(creds));
+    bootstrap.Modal.getInstance(document.getElementById('credentials-modal')).hide();
+}
+
+// Load credentials for a provider from local storage
+function loadCredentials(providerName) {
+    var stored = localStorage.getItem("upstream-credentials-" + providerName);
+    return stored ? JSON.parse(stored) : {};
+}
+
 // Method called to add a spot to the server
 function addSpot() {
     try {
@@ -46,6 +203,7 @@ function addSpot() {
         if (dx != "") {
             spot["dx_call"] = dx;
         } else {
+            // todo maybe for neatness just make all these error/rejections server side rather than having logic in two places
             showAddSpotError("A DX callsign is required in order to spot.");
             return;
         }
@@ -78,21 +236,73 @@ function addSpot() {
         }
         spot["time"] = moment.utc().valueOf() / 1000.0;
 
+        // Upstream submission
+        var submitUpstream = $("#submit-upstream").is(":checked");
+        var upstreamProviderName = getSelectedUpstreamProvider();
+        if (submitUpstream && upstreamProviderName) {
+            if (!sig) {
+                showAddSpotError("A SIG must be selected to submit upstream.");
+                return;
+            }
+            if (!sigRef && upstreamProviderName !== "Tiles") {
+                showAddSpotError("A SIG reference is required to submit upstream.");
+                return;
+            }
+            if (!dxGrid && upstreamProviderName === "Tiles") {
+                showAddSpotError("A grid reference is required to submit upstream to Tiles on the Air.");
+                return;
+            }
+            if (!mode && upstreamProviderName === "Tiles") {
+                showAddSpotError("A mode is required to submit upstream to Tiles on the Air.");
+                return;
+            }
+
+            var creds = loadCredentials(upstreamProviderName);
+            spot["submit_upstream"] = true;
+            spot["upstream_provider"] = upstreamProviderName;
+            spot["upstream_credentials"] = creds;
+
+            // Add CAPTCHA token if reCAPTCHA is loaded
+            if (window._recaptchaWidgetId !== undefined) {
+                var token = grecaptcha.getResponse(window._recaptchaWidgetId);
+                if (!token) {
+                    showAddSpotError("Please complete the CAPTCHA to submit upstream.");
+                    return;
+                }
+                spot["captcha_token"] = token;
+            }
+        }
+
         $.ajax("/api/v1/spot", {
             data : JSON.stringify(spot),
             contentType : 'application/json',
             type : 'POST',
             timeout: 10000,
             success: async function (result) {
+                // Reset CAPTCHA for next use
+                if (window._recaptchaWidgetId !== undefined) {
+                    grecaptcha.reset(window._recaptchaWidgetId);
+                }
+                if (result && result.startsWith && result.startsWith("Warning")) {
+                    $("#result-good").html("<div class='alert alert-warning fade show mb-0 mt-4' role='alert'><i class='fa-solid fa-triangle-exclamation'></i> " + result + " Returning you to the spots list...</div>");
+                } else {
                     $("#result-good").html("<div class='alert alert-success fade show mb-0 mt-4' role='alert'><i class='fa-solid fa-check'></i> Spot submitted. Returning you to the spots list...</div>");
+                }
                 $("#result-bad").html("");
                 setTimeout(() => {
                     $("#result-good").hide();
                     window.location.replace("/");
-                }, 1000);
+                }, 2000);
             },
             error: function (result) {
-                showAddSpotError(result.responseText.slice(1,-1));
+                if (window._recaptchaWidgetId !== undefined) {
+                    grecaptcha.reset(window._recaptchaWidgetId);
+                }
+                if (result.responseText) {
+                    showAddSpotError(result.responseText.slice(1, -1));
+                } else {
+                    showAddSpotError("The server did not return a response.");
+                }
             }
         });
     } catch (error) {
@@ -121,20 +331,18 @@ $("#mode").change(function () {
     $(this).val($(this).val().trim().toUpperCase());
 });
 
-// Display the intro box, unless the user has already dismissed it once.
+// Update upstream area and credentials button when SIG changes
-function displayIntroBox() {
+$("#sig").change(function () {
-    if (localStorage.getItem("add-spot-intro-box-dismissed") == null) {
+    updateUpstreamArea();
-        $("#add-spot-intro-box").show();
+});
-    }
+
-    $("#add-spot-intro-box-dismiss").click(function() {
+// Update credentials button when provider selector changes
-        localStorage.setItem("add-spot-intro-box-dismissed", true);
+$("#upstream-provider-select").change(function () {
-    });
+    updateCredentialsButton();
-}
+});
 
 // Startup
 $(document).ready(function() {
     // Load options
     loadOptions();
-    // Display intro box
-    displayIntroBox();
 });

webassets/js/conditions.js

@@ -17,6 +17,7 @@ function loadSolarConditions() {
         const hfConditionClass = {'Good': 'bg-success-subtle', 'Fair': 'bg-warning-subtle', 'Poor': 'bg-danger-subtle'};
 
         if (jsonData.hf_conditions) {
+            $('#hamqsl-section').show();
             Object.entries(jsonData.hf_conditions).forEach(function ([key, condition]) {
                 const cell = $('#hf-conditions-' + key);
                 cell.text(condition);
@@ -116,6 +117,7 @@ function loadSolarConditions() {
         // Ionosonde
 
         if (jsonData.ionosonde_data && Object.keys(jsonData.ionosonde_data).length > 0) {
+            $('#ionosonde-section').show();
             ionosondeData = jsonData.ionosonde_data;
             populateIonosondeDropdown(ionosondeData);
             renderIonosondeData();
@@ -123,6 +125,9 @@ function loadSolarConditions() {
 
         // Forecast
 
+        if (jsonData.k_index_forecast) {
+            $('#noaa-section').show();
+        }
         renderKIndexForecast(jsonData.k_index_forecast);
         renderSolarStormForecast(jsonData.solar_storm_forecast);
         renderBlackoutForecast(jsonData.blackout_forecast_r1r2, jsonData.blackout_forecast_r3_or_greater);
@@ -431,9 +436,9 @@ function renderIonosondeData() {
         const latestDate = moment.utc(maxTs * 1000);
         $('#ionosonde-latest-time').text(latestDate.format('DD MMM YYYY HH:mm [UTC]') + ' (' + latestDate.fromNow() + ')');
     }
-    $('#ionosonde-latest-luf').text(latestLuf !== null ? latestLuf.toFixed(2) + ' MHz' : 'N/A');
+    $('#ionosonde-latest-luf').text(latestLuf !== null ? latestLuf.toFixed(2) + ' MHz' : 'Unknown');
-    $('#ionosonde-latest-fof2').text(latestFof2 !== null ? latestFof2.toFixed(2) + ' MHz' : 'N/A');
+    $('#ionosonde-latest-fof2').text(latestFof2 !== null ? latestFof2.toFixed(2) + ' MHz' : 'Unknown');
-    $('#ionosonde-latest-muf').text(latestMuf !== null ? latestMuf.toFixed(2) + ' MHz' : 'N/A');
+    $('#ionosonde-latest-muf').text(latestMuf !== null ? latestMuf.toFixed(2) + ' MHz' : 'Unknown');
     $('#ionosonde-stale-warning').toggle(maxTs !== null && (Date.now() / 1000 - maxTs) > 12 * 3600);
 
     // Populate band state tables. There are actually two tables to populate, which is pretty janky, but allows us to

webassets/js/spots.js

@@ -4,6 +4,14 @@ let restartSSEOnErrorTimeoutId;
 // Table row count, to alternate shading
 let rowCount = 0;
 
+// Set up a listener to close the SSE connection nicely when we navigate away from the page, to prevent console errors
+// and keep things nice and tidy for the server.
+window.addEventListener('beforeunload', function() {
+    if (evtSource != null) {
+        evtSource.close();
+    }
+});
+
 // Load spots and populate the table.
 function loadSpots() {
     // If we have an ongoing SSE connection, stop it so it doesn't interfere with our reload