mirror of
https://github.com/pezkuwichain/pezkuwi-telegram-miniapp.git
synced 2026-11-01 16:31:09 +00:00
SatoshiQaziMuhammed
07cd642051
* ops: run the Telegram bots and the assistant on vps3
telegram-bot and ask ran on the free cloud project, which paused itself
after a quiet week; every bot went silent and the deploy job failed against
the paused project. They now run in their own edge-runtime container on vps3
(bots/), from /opt/pezkuwi-bots.
Separate from the shared functions runtime because that one verifies a JWT
on every request, which Telegram cannot send, and holds the platform's wallet
keys, which a public bot feeding user text to a language model should not
sit next to. The new runtime holds only the keys the two functions read.
- telegram-bot refuses updates without Telegram's secret-token header
(TELEGRAM_WEBHOOK_SECRET); the main slot reads TELEGRAM_BOT_TOKEN_MAIN,
since TELEGRAM_BOT_TOKEN on vps3 is the miniapp's sign-in check.
- nginx keeps the public URL shape:
supabase.pezkuwichain.io/functions/v1/{telegram-bot,ask}.
- deploy.yml ships them with a new bots-deploy verb on the existing deploy
key; the host script accepts exactly main, telegram-bot and ask, restarts
the container and fails unless the bot comes back refusing unsigned updates.
- Registry: _cloud_hosted becomes _hosted_elsewhere; the gate refuses those
names in the shared volume and reports any copy there as stale.
* ask: send the legacy service key as a bearer token on vps3
The vps3 gateway has no opaque sb_secret keys and honours the service_role JWT
only as a bearer token; sent on apikey alone it reads as anon, the limiter's
count fails, and every question is refused as rate-limited.
19 lines
896 B
Bash
Executable File
19 lines
896 B
Bash
Executable File
#!/bin/bash
|
|
# Forced command for the miniapp functions deploy key. Installed root-owned
|
|
# at /usr/local/sbin/miniapp-functions-ssh:
|
|
#
|
|
# restrict,command="/usr/local/sbin/miniapp-functions-ssh" ssh-ed25519 ...
|
|
#
|
|
# ssh miniapp-deploy@<host> gate-sha # sha256 of the installed gate and registry
|
|
# ssh miniapp-deploy@<host> deploy < functions.tgz
|
|
# ssh miniapp-deploy@<host> bots-deploy < bots.tgz # telegram-bot + ask, own runtime
|
|
#
|
|
# miniapp-functions-deploy, which sudo lets this user run with exactly those
|
|
# arguments and nothing else, does the work.
|
|
set -euo pipefail
|
|
|
|
case "${SSH_ORIGINAL_COMMAND:-}" in
|
|
deploy|gate-sha|bots-deploy) exec sudo -n /usr/local/sbin/miniapp-functions-deploy "$SSH_ORIGINAL_COMMAND" ;;
|
|
*) echo "miniapp-functions-ssh: the commands are 'gate-sha', 'deploy' (functions.tgz on stdin) and 'bots-deploy' (bots.tgz on stdin)" >&2; exit 2 ;;
|
|
esac
|