mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-11-01 16:31:09 +00:00
SatoshiQaziMuhammed
07cd642051
* ops: run the Telegram bots and the assistant on vps3
telegram-bot and ask ran on the free cloud project, which paused itself
after a quiet week; every bot went silent and the deploy job failed against
the paused project. They now run in their own edge-runtime container on vps3
(bots/), from /opt/pezkuwi-bots.
Separate from the shared functions runtime because that one verifies a JWT
on every request, which Telegram cannot send, and holds the platform's wallet
keys, which a public bot feeding user text to a language model should not
sit next to. The new runtime holds only the keys the two functions read.
- telegram-bot refuses updates without Telegram's secret-token header
(TELEGRAM_WEBHOOK_SECRET); the main slot reads TELEGRAM_BOT_TOKEN_MAIN,
since TELEGRAM_BOT_TOKEN on vps3 is the miniapp's sign-in check.
- nginx keeps the public URL shape:
supabase.pezkuwichain.io/functions/v1/{telegram-bot,ask}.
- deploy.yml ships them with a new bots-deploy verb on the existing deploy
key; the host script accepts exactly main, telegram-bot and ask, restarts
the container and fails unless the bot comes back refusing unsigned updates.
- Registry: _cloud_hosted becomes _hosted_elsewhere; the gate refuses those
names in the shared volume and reports any copy there as stale.
* ask: send the legacy service key as a bearer token on vps3
The vps3 gateway has no opaque sb_secret keys and honours the service_role JWT
only as a bearer token; sent on apikey alone it reads as anon, the limiter's
count fails, and every question is refused as rate-limited.
40 lines
1.5 KiB
TypeScript
40 lines
1.5 KiB
TypeScript
// Router for the bots runtime on vps3 (container pezkuwi-bots, /opt/pezkuwi-bots).
|
|
//
|
|
// It serves exactly two functions: telegram-bot (the webhook of all three
|
|
// Telegram bots) and ask (the assistant behind news.pex.mom and ick.pezkiwi.app).
|
|
// They live apart from the shared Supabase functions runtime for two reasons:
|
|
// that runtime verifies a JWT on every request and Telegram cannot send one, and
|
|
// it holds the platform's wallet keys, which a public bot that feeds user text
|
|
// to a language model has no business sitting next to. Each function
|
|
// authenticates its own callers: telegram-bot by Telegram's secret-token header,
|
|
// ask by its per-IP limit and proxy key.
|
|
|
|
const SERVED = new Set(['telegram-bot', 'ask']);
|
|
|
|
const json = (body: unknown, status: number) =>
|
|
new Response(JSON.stringify(body), {
|
|
status,
|
|
headers: { 'Content-Type': 'application/json' },
|
|
});
|
|
|
|
Deno.serve(async (req: Request) => {
|
|
const name = new URL(req.url).pathname.split('/')[1] || '';
|
|
if (!SERVED.has(name)) return json({ msg: 'not found' }, 404);
|
|
|
|
const env = Deno.env.toObject();
|
|
try {
|
|
const worker = await EdgeRuntime.userWorkers.create({
|
|
servicePath: `/home/deno/functions/${name}`,
|
|
memoryLimitMb: 150,
|
|
workerTimeoutMs: 60_000,
|
|
noModuleCache: false,
|
|
importMapPath: null,
|
|
envVars: Object.keys(env).map((k) => [k, env[k]]),
|
|
});
|
|
return await worker.fetch(req);
|
|
} catch (e) {
|
|
console.error(`[bots] ${name} failed to start:`, e);
|
|
return json({ msg: 'internal error' }, 500);
|
|
}
|
|
});
|