mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-11-01 16:31:09 +00:00
SatoshiQaziMuhammed
07cd642051
* ops: run the Telegram bots and the assistant on vps3
telegram-bot and ask ran on the free cloud project, which paused itself
after a quiet week; every bot went silent and the deploy job failed against
the paused project. They now run in their own edge-runtime container on vps3
(bots/), from /opt/pezkuwi-bots.
Separate from the shared functions runtime because that one verifies a JWT
on every request, which Telegram cannot send, and holds the platform's wallet
keys, which a public bot feeding user text to a language model should not
sit next to. The new runtime holds only the keys the two functions read.
- telegram-bot refuses updates without Telegram's secret-token header
(TELEGRAM_WEBHOOK_SECRET); the main slot reads TELEGRAM_BOT_TOKEN_MAIN,
since TELEGRAM_BOT_TOKEN on vps3 is the miniapp's sign-in check.
- nginx keeps the public URL shape:
supabase.pezkuwichain.io/functions/v1/{telegram-bot,ask}.
- deploy.yml ships them with a new bots-deploy verb on the existing deploy
key; the host script accepts exactly main, telegram-bot and ask, restarts
the container and fails unless the bot comes back refusing unsigned updates.
- Registry: _cloud_hosted becomes _hosted_elsewhere; the gate refuses those
names in the shared volume and reports any copy there as stale.
* ask: send the legacy service key as a bearer token on vps3
The vps3 gateway has no opaque sb_secret keys and honours the service_role JWT
only as a bearer token; sent on apikey alone it reads as anon, the limiter's
count fails, and every question is refused as rate-limited.
65 lines
2.8 KiB
Bash
Executable File
65 lines
2.8 KiB
Bash
Executable File
#!/bin/bash
|
|
# Deploys this project's edge functions into the shared Supabase volume,
|
|
# through the ownership gate (supabase-deploy-functions), from a functions.tgz
|
|
# on stdin. Installed root-owned at /usr/local/sbin/miniapp-functions-deploy;
|
|
# reached only through miniapp-functions-ssh.
|
|
#
|
|
# The gate and its registry guard every project's functions in that volume,
|
|
# so CI does not install them: root does, from ops/ in this repository, and
|
|
# CI checks with `gate-sha` that the host runs what the repository says.
|
|
set -euo pipefail
|
|
|
|
GATE=/usr/local/bin/supabase-deploy-functions
|
|
REGISTRY=/opt/supabase-self-hosted/functions-registry.json
|
|
|
|
case "${1:-}" in
|
|
gate-sha)
|
|
sha256sum "$GATE" "$REGISTRY" | awk '{print $1}'
|
|
;;
|
|
deploy)
|
|
BASE=$(mktemp -d /opt/miniapp-deploy-staging.XXXXXX)
|
|
trap 'rm -rf "$BASE"' EXIT
|
|
tar -xzf - -C "$BASE" --no-same-owner
|
|
[ -d "$BASE/functions" ] || { echo "miniapp-functions-deploy: the bundle has no functions/" >&2; exit 1; }
|
|
"$GATE" --project pezkuwi-telegram-miniapp --src "$BASE/functions" --restart
|
|
;;
|
|
bots-deploy)
|
|
# telegram-bot and ask run in their own runtime (bots/ in the repository),
|
|
# not in the shared volume, so the ownership gate does not apply; this
|
|
# accepts exactly the three directories that runtime serves and nothing else.
|
|
# The runtime's compose file and .env are root's and never come from CI.
|
|
BOTS=/opt/pezkuwi-bots/functions
|
|
BASE=$(mktemp -d /opt/pezkuwi-bots/staging.XXXXXX)
|
|
trap 'rm -rf "$BASE"' EXIT
|
|
tar -xzf - -C "$BASE" --no-same-owner
|
|
got=$(find "$BASE" -mindepth 1 -maxdepth 1 -printf '%f\n' | sort | tr '\n' ' ')
|
|
[ "$got" = "ask main telegram-bot " ] || {
|
|
echo "miniapp-functions-deploy: bots bundle must hold exactly ask, main, telegram-bot (got: $got)" >&2
|
|
exit 1
|
|
}
|
|
for d in ask main telegram-bot; do
|
|
[ -f "$BASE/$d/index.ts" ] || { echo "miniapp-functions-deploy: $d/index.ts missing" >&2; exit 1; }
|
|
done
|
|
chmod -R a+rX "$BASE"
|
|
for d in ask main telegram-bot; do
|
|
rm -rf "$BOTS/.$d.old"
|
|
[ -d "$BOTS/$d" ] && mv "$BOTS/$d" "$BOTS/.$d.old"
|
|
mv "$BASE/$d" "$BOTS/$d"
|
|
done
|
|
docker restart pezkuwi-bots >/dev/null
|
|
# Up means the router answers and telegram-bot loads far enough to refuse an
|
|
# update that lacks Telegram's secret header.
|
|
for _ in $(seq 1 30); do
|
|
code=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:9060/telegram-bot || true)
|
|
[ "$code" = 401 ] && { for d in ask main telegram-bot; do rm -rf "$BOTS/.$d.old"; done; echo "bots runtime up"; exit 0; }
|
|
sleep 2
|
|
done
|
|
echo "miniapp-functions-deploy: bots runtime did not come up (last answer: $code); previous code kept in $BOTS/.<name>.old" >&2
|
|
exit 1
|
|
;;
|
|
*)
|
|
echo "usage: miniapp-functions-deploy gate-sha|deploy|bots-deploy" >&2
|
|
exit 2
|
|
;;
|
|
esac
|