mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-11-01 16:31:09 +00:00
SatoshiQaziMuhammed
07cd642051
* ops: run the Telegram bots and the assistant on vps3
telegram-bot and ask ran on the free cloud project, which paused itself
after a quiet week; every bot went silent and the deploy job failed against
the paused project. They now run in their own edge-runtime container on vps3
(bots/), from /opt/pezkuwi-bots.
Separate from the shared functions runtime because that one verifies a JWT
on every request, which Telegram cannot send, and holds the platform's wallet
keys, which a public bot feeding user text to a language model should not
sit next to. The new runtime holds only the keys the two functions read.
- telegram-bot refuses updates without Telegram's secret-token header
(TELEGRAM_WEBHOOK_SECRET); the main slot reads TELEGRAM_BOT_TOKEN_MAIN,
since TELEGRAM_BOT_TOKEN on vps3 is the miniapp's sign-in check.
- nginx keeps the public URL shape:
supabase.pezkuwichain.io/functions/v1/{telegram-bot,ask}.
- deploy.yml ships them with a new bots-deploy verb on the existing deploy
key; the host script accepts exactly main, telegram-bot and ask, restarts
the container and fails unless the bot comes back refusing unsigned updates.
- Registry: _cloud_hosted becomes _hosted_elsewhere; the gate refuses those
names in the shared volume and reports any copy there as stale.
* ask: send the legacy service key as a bearer token on vps3
The vps3 gateway has no opaque sb_secret keys and honours the service_role JWT
only as a bearer token; sent on apikey alone it reads as anon, the limiter's
count fails, and every question is refused as rate-limited.
38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
# The bots runtime on vps3. Root installs this file at /opt/pezkuwi-bots/ and
|
|
# owns /opt/pezkuwi-bots/.env (600); CI only replaces the function code under
|
|
# /opt/pezkuwi-bots/functions/ (see ops/host/miniapp-functions-deploy).
|
|
#
|
|
# .env holds only what the two functions read:
|
|
# TELEGRAM_BOT_TOKEN_MAIN, TELEGRAM_BOT_TOKEN_KRD, TELEGRAM_BOT_TOKEN_DKS,
|
|
# TELEGRAM_WEBHOOK_SECRET, GEMINI_API_KEY, GROQ_API_KEY, ANTHROPIC_API_KEY,
|
|
# ASK_PROXY_KEY, SUPABASE_SECRET_KEYS ({"default":"<self-hosted service_role JWT>"})
|
|
services:
|
|
bots:
|
|
container_name: pezkuwi-bots
|
|
image: supabase/edge-runtime:v1.71.2
|
|
restart: unless-stopped
|
|
env_file: .env
|
|
environment:
|
|
# ask's per-IP limit writes to ai_chat_log through the local gateway.
|
|
SUPABASE_URL: http://kong:8000
|
|
# Telegram cannot send a JWT; each function checks its own callers.
|
|
VERIFY_JWT: 'false'
|
|
volumes:
|
|
- ./functions:/home/deno/functions:ro
|
|
- deno-cache:/root/.cache/deno
|
|
# nginx (supabase.pezkuwichain.io) proxies /functions/v1/{telegram-bot,ask} here.
|
|
ports:
|
|
- '127.0.0.1:9060:9000'
|
|
mem_limit: 1g
|
|
networks:
|
|
- supabase
|
|
command: ['start', '--main-service', '/home/deno/functions/main']
|
|
|
|
networks:
|
|
supabase:
|
|
name: supabase_default
|
|
external: true
|
|
|
|
volumes:
|
|
deno-cache:
|