52 lines
2.4 KiB
Text
52 lines
2.4 KiB
Text
# Minimal environment for running the Telegram bot on a separate server.
|
|
# Copy to `.env` on the bot host and fill in the secrets.
|
|
#
|
|
# The bot is stateless: it polls Telegram and calls the central API over HTTP(S).
|
|
# It does NOT need DB/RabbitMQ/MinIO/LLM credentials. Keep this file minimal.
|
|
|
|
ENV=prod
|
|
LOG_LEVEL=INFO
|
|
LOG_FORMAT=json
|
|
|
|
# Telegram bot token from @BotFather.
|
|
BOT_TOKEN=
|
|
|
|
# Bearer token the bot uses to authenticate against the API on
|
|
# POST /api/v1/auth/telegram/bot. Must match the hash stored in
|
|
# service_tokens.name='bot-prod' on the central API server.
|
|
BOT_SERVICE_TOKEN=
|
|
|
|
# Public URL of the central API, without trailing slash.
|
|
# Example: https://contract-check.example.com
|
|
API_URL=
|
|
|
|
# Redis URL for rate-limit state.
|
|
# Default in docker-compose.bot.yml is the local Redis container (redis://redis:6379/0).
|
|
# Set to empty to use the in-memory backend (fine for a single bot instance).
|
|
# If you point this at an external Redis, it must be reachable over a private
|
|
# network/VPN; never expose Redis to the public internet.
|
|
REDIS_URL=redis://redis:6379/0
|
|
|
|
# ── Update delivery mode ─────────────────────────────────────────────────────
|
|
# polling (default) or webhook. In webhook mode the bot receives Telegram
|
|
# updates at a secret-derived path on the webhook port and serves GET /healthz.
|
|
# See docs/DEPLOY.md §14.4 for the full setup (edge routing, path derivation).
|
|
BOT_UPDATE_MODE=polling
|
|
|
|
# Required when BOT_UPDATE_MODE=webhook:
|
|
# BOT_WEBHOOK_PUBLIC_BASE_URL — public https base URL of the TLS edge that
|
|
# routes /tg-webhook/<secret-derived-path> to this server, no trailing
|
|
# slash (e.g. https://contract-check.example.com).
|
|
# BOT_WEBHOOK_SECRET_TOKEN — random string Telegram echoes back in the
|
|
# X-Telegram-Bot-Api-Secret-Token header (chars: A-Z a-z 0-9 _ -, max
|
|
# 256). Generate with: openssl rand -hex 32
|
|
# It also keys the secret-derived webhook path (`make bot-webhook-path`).
|
|
BOT_WEBHOOK_PUBLIC_BASE_URL=
|
|
BOT_WEBHOOK_SECRET_TOKEN=
|
|
|
|
# Host port publishing for the webhook server (webhook mode only).
|
|
# The compose file binds it to 127.0.0.1 by default — route it through your
|
|
# TLS edge on the same host, or set BOT_WEBHOOK_BIND_HOST to a private/VPN
|
|
# interface. Never expose the webhook port to the public internet directly.
|
|
BOT_WEBHOOK_BIND_HOST=127.0.0.1
|
|
BOT_WEBHOOK_PORT=8080
|