---
# Telegram bot host: holds no inbound port beyond SSH (the bot dials out to the
# Bot API and into the main host's bot-link). We only verify direct Bot API
# egress here, since the "no VPN" decision depends on it.

- name: Verify direct Telegram Bot API egress (no VPN on this host)
  ansible.builtin.uri:
    url: https://api.telegram.org/
    method: GET
    status_code: [200, 301, 302, 401, 404]   # any HTTP reply proves reachability
    timeout: 10
  register: tg_egress
  failed_when: false

- name: Report Telegram reachability
  ansible.builtin.debug:
    msg: >-
      api.telegram.org reachable:
      {{ (tg_egress.status | default(0) | int) > 0 }} (status {{ tg_egress.status | default('none') }})