mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-11-07 19:31:07 +00:00
SatoshiQaziMuhammed
07cd642051
* ops: run the Telegram bots and the assistant on vps3
telegram-bot and ask ran on the free cloud project, which paused itself
after a quiet week; every bot went silent and the deploy job failed against
the paused project. They now run in their own edge-runtime container on vps3
(bots/), from /opt/pezkuwi-bots.
Separate from the shared functions runtime because that one verifies a JWT
on every request, which Telegram cannot send, and holds the platform's wallet
keys, which a public bot feeding user text to a language model should not
sit next to. The new runtime holds only the keys the two functions read.
- telegram-bot refuses updates without Telegram's secret-token header
(TELEGRAM_WEBHOOK_SECRET); the main slot reads TELEGRAM_BOT_TOKEN_MAIN,
since TELEGRAM_BOT_TOKEN on vps3 is the miniapp's sign-in check.
- nginx keeps the public URL shape:
supabase.pezkuwichain.io/functions/v1/{telegram-bot,ask}.
- deploy.yml ships them with a new bots-deploy verb on the existing deploy
key; the host script accepts exactly main, telegram-bot and ask, restarts
the container and fails unless the bot comes back refusing unsigned updates.
- Registry: _cloud_hosted becomes _hosted_elsewhere; the gate refuses those
names in the shared volume and reports any copy there as stale.
* ask: send the legacy service key as a bearer token on vps3
The vps3 gateway has no opaque sb_secret keys and honours the service_role JWT
only as a bearer token; sent on apikey alone it reads as anon, the limiter's
count fails, and every question is refused as rate-limited.
16 lines
721 B
Plaintext
16 lines
721 B
Plaintext
# Included inside the supabase.pezkuwichain.io server block, before `location /`,
|
|
# as /etc/nginx/snippets/pezkuwi-bots.conf. Keeps the public URLs the bots and
|
|
# callers already use, but sends these two names to the bots runtime instead of
|
|
# the shared functions gateway.
|
|
location ~ ^/functions/v1/(telegram-bot|ask)$ {
|
|
proxy_pass http://127.0.0.1:9060/$1$is_args$args;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
# Set, not appended: ask rate-limits on the first address in this header,
|
|
# so a client must not be able to choose it.
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_read_timeout 90s;
|
|
client_max_body_size 1m;
|
|
}
|