82 lines
3 KiB
YAML
82 lines
3 KiB
YAML
# Telegram bot adapter — run on a separate server.
|
|
#
|
|
# The bot is deliberately stateless: it talks to Telegram and the central
|
|
# API over HTTP(S). It needs NO DB/MQ/S3 credentials, only BOT_TOKEN,
|
|
# BOT_SERVICE_TOKEN and API_URL. Keep this server lean and firewall-hardened.
|
|
#
|
|
# Update mode: polling by default; set BOT_UPDATE_MODE=webhook to serve
|
|
# updates at a secret-derived path (+ GET /healthz) on the webhook port.
|
|
# The port is published on loopback only — route it through your TLS edge
|
|
# (or a VPN interface via BOT_WEBHOOK_BIND_HOST), never the public internet.
|
|
# See docs/DEPLOY.md §14.4.
|
|
#
|
|
# Usage on the bot server:
|
|
# cp .env.bot.example .env # minimal bot-only environment
|
|
# docker compose -f docker-compose.bot.yml up -d --build
|
|
#
|
|
# See docs/DEPLOY.md §14 for the full separate-server guide.
|
|
|
|
services:
|
|
bot:
|
|
build:
|
|
context: .
|
|
dockerfile: srv/bot/Dockerfile
|
|
container_name: contract_check-bot
|
|
restart: unless-stopped
|
|
env_file:
|
|
- path: .env
|
|
required: false
|
|
environment:
|
|
ENV: ${ENV:-prod}
|
|
LOG_LEVEL: ${LOG_LEVEL:-INFO}
|
|
LOG_FORMAT: ${LOG_FORMAT:-json}
|
|
BOT_TOKEN: ${BOT_TOKEN}
|
|
API_URL: ${API_URL}
|
|
BOT_SERVICE_TOKEN: ${BOT_SERVICE_TOKEN}
|
|
# Update delivery mode + webhook settings (BOT_UPDATE_MODE=polling|webhook).
|
|
BOT_UPDATE_MODE: ${BOT_UPDATE_MODE:-polling}
|
|
BOT_WEBHOOK_PUBLIC_BASE_URL: ${BOT_WEBHOOK_PUBLIC_BASE_URL:-}
|
|
BOT_WEBHOOK_SECRET_TOKEN: ${BOT_WEBHOOK_SECRET_TOKEN:-}
|
|
# Local Redis for rate-limit state. Set to empty to use the in-memory
|
|
# backend (fine for a single bot instance). The Redis container below is
|
|
# not exposed outside the host; only the bot container can reach it.
|
|
REDIS_URL: ${REDIS_URL:-redis://redis:6379/0}
|
|
ports:
|
|
# Webhook/healthz server, only meaningful in webhook mode. Published on
|
|
# loopback by default so only a local TLS edge / tunnel can reach it;
|
|
# use BOT_WEBHOOK_BIND_HOST to point it at a private interface instead.
|
|
- "${BOT_WEBHOOK_BIND_HOST:-127.0.0.1}:${BOT_WEBHOOK_PORT:-8080}:8080"
|
|
depends_on:
|
|
redis:
|
|
condition: service_healthy
|
|
healthcheck:
|
|
# Webhook mode: probe the bot's own /healthz (the process under
|
|
# supervision). Polling mode: keep probing the central API as before.
|
|
test:
|
|
- CMD-SHELL
|
|
- >-
|
|
if [ "$$BOT_UPDATE_MODE" = "webhook" ]; then
|
|
python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=5)";
|
|
else
|
|
python -c "import urllib.request, os; urllib.request.urlopen(os.environ['API_URL'] + '/healthz', timeout=5)";
|
|
fi
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
|
|
redis:
|
|
image: redis:8-alpine
|
|
container_name: contract_check-redis
|
|
restart: unless-stopped
|
|
command: ["redis-server", "--appendonly", "yes"]
|
|
volumes:
|
|
- redisdata:/data
|
|
healthcheck:
|
|
test: ["CMD", "redis-cli", "ping"]
|
|
interval: 5s
|
|
timeout: 3s
|
|
retries: 10
|
|
|
|
volumes:
|
|
redisdata:
|