Sigantara Route Planner

Personal, browser-local flight simulation planning app for B77F_BDK. The starting library preserves the nine draft cycles from the planning conversation.

Serve dist/ with any static web server. No build or installed application dependencies are required. Run node --test tests/*.test.mjs for core checks.

naspad-server deployment

Source repository: https://repo.naspadstudio.id/mzmznasipadang/sigantaracargo.git

The server runs the pinned Nginx image in deploy/compose.yaml, with read-only content and a loopback listener on port 3111. Cloudflare Tunnel publishes https://cargo.naspadstudio.id with origin http://127.0.0.1:3111. The planner’s Tailscale route has been removed.

Releases live in /srv/sigantaracargo-releases/<commit>; /srv/sigantaracargo points to the active release. To deploy a checked-out release, first create /srv/sigantaracargo-private/auth/planner.htpasswd (an empty file intentionally denies everyone), run docker compose -f deploy/compose.yaml up -d, then verify /healthz and ensure the homepage, scripts, airport data and /api/simbrief return 401 without credentials. Previous releases remain available for rollback. Never roll back to an unprotected release after enabling this gate.

Browser-local data is scoped to each web address. To move edits from the previous ChatGPT Site, download a backup there and restore it at the new address.

Set or rotate your password

The host needs apache2-utils (installed on naspad-server). The deployed helper is /usr/local/sbin/sigantaracargo-password. Run this from your terminal:

ssh -t root@naspad-server /usr/local/sbin/sigantaracargo-password

Sign in to the app as admin using the password you enter at the hidden prompts. Only a bcrypt hash is stored, outside Git and the website root. The hash directory is mounted read-only into Nginx. The site is closed until the owner sets a password. The browser uses its native HTTP authentication dialog. Use HTTPS through Cloudflare. Public signup and first-visitor setup are not enabled. Nginx also applies a request rate limit and a delay to rejected authentication attempts. /healthz is intentionally public and returns only ok.

SimBrief

Leg buttons use the official dispatch redirect. The pilot generates the plan on SimBrief, then clicks Import latest flight plan using their Navigraph alias or Pilot ID. The app calls its protected /api/simbrief endpoint, which forwards to the official JSON v2 endpoint only on that action. The proxy verifies the upstream TLS certificate and explicitly strips the app’s Authorization and Cookie headers. XML/JSON file import remains available.

The connection panel says Live SimBrief import verified only after a real API response passes aircraft, airports and timing validation. Apply that plan to a matching leg; its table source becomes SimBrief API. Importing a local file is labeled OFP file and does not verify the live connection. A real personal import needs the owner’s identifier and generated plan; no fake success is shown. Embedded automatic generation still requires a developer key and is not implemented.

OpenStreetMap

The interactive map uses locally vendored Leaflet 1.9.4 (JavaScript and CSS checked against official SHA-256 integrity values) and standard https://tile.openstreetmap.org/{z}/{x}/{y}.png tiles. Attribution remains visible. Browser caching and referrers follow the OSM tile policy; no bulk downloading, prefetch or offline tile export is included. Great-circle previews remain distinct from imported waypoint tracks. Pacific routes unwrap at the date line. Country restriction geometry remains a separate coarse screening input.

Data

Airport Codes / OurAirports airport and runway snapshots: 27 October 2026. Natural Earth country polygons at 1:110m. download-data.py refreshes airport positions/map; enrich-runways.py adds runway screening values. Airport source coordinates are latitude, longitude; the core test validates CGK and geographic bounds.

Restrictions follow the supplied Sigantara manual v1.1 Appendix A. Country intersections are coarse review flags, not FIR or subnational clearance. B777F airport performance, cargo handling, NOTAMs, slot/curfew compliance, ETOPS and fuel planning require actual dispatch review. Draft ETEs are explicitly estimates; ETD/ETA arithmetic uses ETE and excludes taxi. Package colors are provisional pending the BDL International color key.

Persistence and export

Packages are saved to localStorage on the current device/browser. Download JSON backups to move between devices. Restore validates the file, asks before replacing the current library and downloads a safety backup first. Unreadable stored data is protected from writes until its raw recovery copy is downloaded and the user confirms replacement. CSV exports exactly 12 columns. XLSX exports include package color fills and a separate notes sheet retaining source and review status.