mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-11-07 19:31:07 +00:00
Satoshi Qazi Muhammed
0ab6cf198f
The vps3 gateway has no opaque sb_secret keys and honours the service_role JWT only as a bearer token; sent on apikey alone it reads as anon, the limiter's count fails, and every question is refused as rate-limited.
38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
# The bots runtime on vps3. Root installs this file at /opt/pezkuwi-bots/ and
|
|
# owns /opt/pezkuwi-bots/.env (600); CI only replaces the function code under
|
|
# /opt/pezkuwi-bots/functions/ (see ops/host/miniapp-functions-deploy).
|
|
#
|
|
# .env holds only what the two functions read:
|
|
# TELEGRAM_BOT_TOKEN_MAIN, TELEGRAM_BOT_TOKEN_KRD, TELEGRAM_BOT_TOKEN_DKS,
|
|
# TELEGRAM_WEBHOOK_SECRET, GEMINI_API_KEY, GROQ_API_KEY, ANTHROPIC_API_KEY,
|
|
# ASK_PROXY_KEY, SUPABASE_SECRET_KEYS ({"default":"<self-hosted service_role JWT>"})
|
|
services:
|
|
bots:
|
|
container_name: pezkuwi-bots
|
|
image: supabase/edge-runtime:v1.71.2
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
# ask's per-IP limit writes to ai_chat_log through the local gateway.
|
|
SUPABASE_URL: http://kong:8000
|
|
# Telegram cannot send a JWT; each function checks its own callers.
|
|
VERIFY_JWT: 'false'
|
|
volumes:
|
|
- ./functions:/home/deno/functions:ro
|
|
- deno-cache:/root/.cache/deno
|
|
# nginx (supabase.pezkuwichain.io) proxies /functions/v1/{telegram-bot,ask} here.
|
|
ports:
|
|
- '127.0.0.1:9060:9000'
|
|
mem_limit: 1g
|
|
networks:
|
|
- supabase
|
|
command: ['start', '--main-service', '/home/deno/functions/main']
|
|
|
|
networks:
|
|
supabase:
|
|
name: supabase_default
|
|
external: true
|
|
|
|
volumes:
|
|
deno-cache:
|