BTC Map June Recap

Note: this only reflects my personal work this month. Visit the BTC Map Blog for consolidated monthly reports.

My previous monthly recap

Dashboard

I started a new internal project this month: BTC Map Dashboard. It is a small static site that talks to the BTC Map API and renders the analytics snapshot from the new dashboard RPC. I kept it deliberately tiny: no bundler, no framework, no build step, just plain HTML, CSS, and a few ES modules. The goal is to give admins a quick health check without having to SSH into our servers.

API

The biggest chunk of my month went into the API.

Auth

I finally stabilized RPC auth flow for third party integrations:

• signup is the new registration endpoint
• signin issues an access token
• signout revokes the current token
• get_api_keys and revoke_api_key let users inspect and invalidate their active sessions
• whoami returns the linked account

All non-auth RPCs now require an authenticated session. Anon access is limited to signin and signup. I also added support for scoped tokens, so the dashboard can be issued a token that can only call dashboard and nothing else.

Area Images

This is the feature I am most excited about, after the dashboard. Up to now, area icons and banners were scattered between the main DB, the filesystem, and a few half-broken scripts. I introduced a dedicated image.db table for area images, plus a new v4/area-image REST endpoint with type and dimensions hints.

Place Import Stats

Place import origins used to be hardcoded in a few Rust constants, which made it painful to onboard new wallets and merchant sources. I moved them into a dedicated DB table and exposed stats on the dashboard endpoint, including per-origin success/failure counts. A few long-dead endpoints and startup checks were deleted along the way.

Observability

The dashboard RPC now also returns log volume and counts of logged requests over the 1/7/30-day windows. A new top_rest_api_calls block lists the ten busiest REST endpoints in the last 24 hours, which is useful for spotting abuse and unintentional hot paths. I also added LND and storage stats to the same response, refactored the log queries, and started logging HTTP methods on every request.

Maintenance

I bumped geojson to 1.0, unpegged the Rust toolchain, refreshed dependencies, and added native CORS handling so we can stop relying on the reverse proxy for it. The old btcmap.db and images.db files were renamed to main.db and image.db to match the rest of the naming.

CLI

The CLI now speaks the new auth API. signin returns the token under the api_key field, signout revokes the current token. I added two area image commands (generate-area-icons and set-area-image) and a simple install script, and reorganized the command tree now that there are quite a few subcommands.

Website

The tagging-issues and leaderboard pages were still hitting now authorized-only JSON-RPC endpoints. I migrated them to the public REST API, so our website is now finally RPC-free.

Android

Local activity feed got filter support, so users can scope it to a specific area and period. I also optimized area image loading and added a dedicated activity feed icon. MapLibre and a few other key dependencies were bumped.

Ansible

Image database backups were not actually happening. I added image.db to the backup playbook, updated the snapshot script, and pruned a couple of dead helper files.

Future Plans

No exact plans, but I’ll probably be improving dashboard and working towards a new Android app release.