# Minimal environment for running the Telegram bot on a separate server.
# Copy to `.env` on the bot host and fill in the secrets.
#
# The bot is stateless: it polls Telegram and calls the central API over HTTP(S).
# It does NOT need DB/RabbitMQ/MinIO/LLM credentials. Keep this file minimal.

ENV=prod
LOG_LEVEL=INFO
LOG_FORMAT=json

# Telegram bot token from @BotFather.
BOT_TOKEN=

# Bearer token the bot uses to authenticate against the API on
# POST /api/v1/auth/telegram/bot. Must match the hash stored in
# service_tokens.name='bot-prod' on the central API server.
BOT_SERVICE_TOKEN=

# Public URL of the central API, without trailing slash.
# Example: https://contract-check.example.com
API_URL=

# Redis URL for rate-limit state.
# Default in docker-compose.bot.yml is the local Redis container (redis://redis:6379/0).
# Set to empty to use the in-memory backend (fine for a single bot instance).
# If you point this at an external Redis, it must be reachable over a private
# network/VPN; never expose Redis to the public internet.
REDIS_URL=redis://redis:6379/0

# ── Update delivery mode ─────────────────────────────────────────────────────
# polling (default) or webhook. In webhook mode the bot receives Telegram
# updates at a secret-derived path on the webhook port and serves GET /healthz.
# See docs/DEPLOY.md §14.4 for the full setup (edge routing, path derivation).
BOT_UPDATE_MODE=polling

# Required when BOT_UPDATE_MODE=webhook:
#   BOT_WEBHOOK_PUBLIC_BASE_URL — public https base URL of the TLS edge that
#       routes /tg-webhook/<secret-derived-path> to this server, no trailing
#       slash (e.g. https://contract-check.example.com).
#   BOT_WEBHOOK_SECRET_TOKEN — random string Telegram echoes back in the
#       X-Telegram-Bot-Api-Secret-Token header (chars: A-Z a-z 0-9 _ -, max
#       256). Generate with: openssl rand -hex 32
#       It also keys the secret-derived webhook path (`make bot-webhook-path`).
BOT_WEBHOOK_PUBLIC_BASE_URL=
BOT_WEBHOOK_SECRET_TOKEN=

# Host port publishing for the webhook server (webhook mode only).
# The compose file binds it to 127.0.0.1 by default — route it through your
# TLS edge on the same host, or set BOT_WEBHOOK_BIND_HOST to a private/VPN
# interface. Never expose the webhook port to the public internet directly.
BOT_WEBHOOK_BIND_HOST=127.0.0.1
BOT_WEBHOOK_PORT=8080