Ilia Denisov
6aeb529f13
CI / changes (pull_request) Successful in 2s
CI / unit (pull_request) Successful in 10s
CI / integration (pull_request) Successful in 15s
CI / ui (pull_request) Successful in 53s
CI / gate (pull_request) Successful in 1s
CI / deploy (pull_request) Failing after 2m6s
Move all Telegram egress off the main host. The single connector held the bot token, long-polled Telegram and answered the gateway/backend over the trusted internal network, so the whole component (including login validation) shared fate with its VPN sidecar. Split it into two binaries that share the token: - cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only, never calls the Bot API. The gateway dials it for Telegram auth, so game login is now independent of Telegram reachability. - cmd/bot (remote): Bot API long-poll + sendMessage, the only component reaching Telegram. It holds no inbound port — it dials the gateway over a new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send commands the gateway pushes. The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget (at-most-once, dropped if no bot is connected); the backend admin broadcasts reach a gateway-served relay that forwards them and awaits the bot's ack (SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one inter-service link that leaves the trusted segment; validator<->gateway and the relay stay plaintext internal. The bot is Telegram-rate-limited. One bot now; the gateway bot registry, an owns_updates flag and per-command ids leave seams for N later. Webhook rejected (one URL per token, adds inbound + a static address). The unified test contour runs the split (the bot keeps its VPN sidecar and dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh, generated in CI). The prod wiring — the bot on a separate host (no VPN), the gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX, Stage 18). Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway + backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.
pkg
Shared wire contracts for the Scrabble platform (module scrabble/pkg),
imported by both backend and gateway. It carries no logic — only the
generated message types and the schemas they come from.
Layout
proto/push/v1/ # backend -> gateway live-event gRPC channel (Push.Subscribe)
# committed generated Go (*.pb.go, *_grpc.pb.go)
fbs/scrabble.fbs # FlatBuffers edge payloads (one `scrabblefb` namespace)
fbs/scrabblefb/ # committed generated Go for the schema
proto/push/v1is the single gRPC server-stream the backend exposes and the gateway subscribes to (Event{user_id, kind, payload, event_id}); thepayloadis an opaque FlatBuffers body the gateway forwards verbatim.proto/telegram/v1is the Telegram connector's RPC contract (includingValidateLoginWidgetfor the web Login Widget sign-in).fbsholds the client↔gateway request/response and event payloads as FlatBuffers tables. The backend encodes the push payloads from these types; the gateway transcodes the rest to and from the backend's JSON; the UI generates TypeScript from the same.fbs.
Generated code
Committed (CI only builds it); regenerate dev-time after editing the schemas:
make -C pkg tools # go install protoc-gen-go + protoc-gen-go-grpc
make -C pkg gen # buf generate (proto) + flatc (fbs)
flatc is pinned to 23.5.26 to match the github.com/google/flatbuffers
Go runtime in go.mod; generating with another version is refused.
Workspace wiring
scrabble/pkg is a bare-path module (no dot), so — like scrabble-solver — it
cannot be fetched as a versioned dependency. go.work carries use ./pkg and
replace scrabble/pkg v0.0.0 => ./pkg; consumers require scrabble/pkg v0.0.0.