add this snippet to your page to show a random ad:
<iframe src="{{ base_url }}/embed" style="display:block;margin-left:auto;margin-right:auto;max-width:{{ config.width }}px;width:100%;aspect-ratio:{{ config.width }}/{{ config.height }};border:none;"></iframe>
if you don't want to show up on the leaderboard, add referrerpolicy="no-referrer".
place your banner ({{ config.width }}x{{ config.height }}, {{ exts }}, max {{ config.max_size // (1024 * 1024) }} MB) in ~/public/ads/ with a matching .url file:
~/public/ads - myad.png - myad.png.url # contains: https://example.com{%- if impressions %}
| site | impressions |
|---|---|
| {{ site }} | {{ count }} |
data collected when an ad is displayed:
Referer headerdata stored:
{{ message }} :(
\ """, } jinja = Environment(loader=DictLoader(TEMPLATES), autoescape=True) USERNAME_RE = re.compile(r"^[a-z][a-z0-9_-]{0,31}$") class Ad(TypedDict): username: str url: str image: str key: str def respond( status: int, headers: dict[str, str] = {}, body: str | bytes = b"", ) -> None: s = HTTPStatus(status) out = f"Status: {s.value} {s.phrase}\nX-Content-Type-Options: nosniff\n" for k, v in headers.items(): out += f"{k}: {v}\n" out += "\n" if isinstance(body, str): body = body.encode() sys.stdout.buffer.write(out.encode()) sys.stdout.buffer.write(body) def render(template: str, **kwargs: object) -> str: return jinja.get_template(template).render( config=CONFIG, base_url=BASE_URL, host=HOST, **kwargs ) def _parse_impressions(s: str) -> dict[str, int]: try: raw: object = json.loads(s or "{}") # pyright: ignore[reportAny] return cast(dict[str, int], raw) if isinstance(raw, dict) else {} except json.JSONDecodeError: return {} def load_impressions() -> dict[str, int]: try: with open(IMPRESSIONS_FILE) as f: return _parse_impressions(f.read()) except OSError: return {} def record_impression() -> None: referer = os.environ.get("HTTP_REFERER") if not referer: return try: site = urllib.parse.urlparse(referer).hostname or "" except ValueError: return if not site or site == HOST: return ip = os.environ.get("REMOTE_ADDR") if not ip: return bloom_fd = os.open(BLOOM_FILE, os.O_CREAT | os.O_RDWR, 0o644) with os.fdopen(bloom_fd, "r+b") as bf: fcntl.flock(bf, fcntl.LOCK_EX) raw = bf.read() now = int(time.time()) stored_ts = struct.unpack(">Q", raw[:8])[0] if len(raw) >= 8 else 0 if now - stored_ts < CONFIG["bloom_interval"]: bloom = Bloom.load_bytes(raw[8:], _bloom_hash) else: bloom = Bloom(CONFIG["bloom_size"], 0.01, _bloom_hash) if (ip, site) in bloom: return bloom.add((ip, site)) bf.seek(0) bf.truncate() bf.write(struct.pack(">Q", now) + bloom.save_bytes()) impression_fd = os.open(IMPRESSIONS_FILE, os.O_CREAT | os.O_RDWR, 0o644) with os.fdopen(impression_fd, "r+") as f: fcntl.flock(f, fcntl.LOCK_EX) data = _parse_impressions(f.read()) data[site] = data.get(site, 0) + 1 f.seek(0) f.truncate() f.write(json.dumps(data)) def _bloom_hash(obj: object) -> int: h = sha256(dumps(obj)).digest() return int.from_bytes(h[:16], "big", signed=True) def scan_ads() -> list[Ad]: ads: list[Ad] = [] for user_dir in sorted(Path("/home").iterdir()): username = user_dir.name if not USERNAME_RE.match(username): continue ads_dir = user_dir / "public" / "ads" try: entries = sorted(ads_dir.iterdir()) except OSError: continue for url_file in entries: if url_file.suffix != ".url": continue img = url_file.stem if not img: continue try: with url_file.open() as f: url = f.read(512).splitlines()[0].strip() if urllib.parse.urlparse(url).scheme not in ("http", "https"): continue if (ads_dir / img).is_file(): ads.append( { "username": username, "url": url, "image": img, "key": f"{username}:{img}", } ) except (OSError, IndexError): continue return ads def serve_index() -> None: ads = scan_ads() users = sorted({a["username"] for a in ads}) impressions = load_impressions() respond( 200, INDEX_HEADERS, render( "index.html", users=users, ad_count=len(ads), impressions=impressions, exts="/".join( sorted( mimetypes.guess_extension(m) or "" for m in CONFIG["allowed_mime"] ) ), ), ) def serve_embed() -> None: ads = scan_ads() if not ads: return respond(200, EMBED_HEADERS, render("error.html", message="no ads")) by_user: dict[str, list[Ad]] = {} for a in ads: by_user.setdefault(a["username"], []).append(a) ad = random.choice(random.choice(list(by_user.values()))) record_impression() image_url = BASE_URL + "/image?k=" + urllib.parse.quote(ad["key"], safe=":") respond(200, EMBED_HEADERS, render("embed.html", ad=ad, image_url=image_url)) def serve_image() -> None: key = PARAMS.get("k") if key is None: return respond(418) parts = key.split(":", 1) if len(parts) != 2: return respond(404) username, img = parts if not USERNAME_RE.match(username) or not img: return respond(404) mime, _ = mimetypes.guess_type(img) if not mime or mime not in CONFIG["allowed_mime"]: return respond(403) ads_dir = (Path("/home") / username / "public" / "ads").resolve() try: real = (ads_dir / img).resolve(strict=True) except OSError: return respond(404) if not real.is_relative_to(ads_dir): return respond(403) if not (ads_dir / (img + ".url")).is_file(): return respond(404) if real.stat().st_size > CONFIG["max_size"]: return respond(413) data = real.read_bytes() respond( 200, { "Content-Type": mime, "Content-Length": str(len(data)), "Cache-Control": "public, max-age=3600", }, data, ) def main() -> None: route = REQUEST_URI.removeprefix(SCRIPT_WEB_PATH).rstrip("/") or "/" if route == "/": serve_index() elif route == "/embed": serve_embed() elif route == "/image": serve_image() else: respond(404) try: main() except Exception: respond(500)