Ilia Denisov
6aeb529f13
CI / changes (pull_request) Successful in 2s
CI / unit (pull_request) Successful in 10s
CI / integration (pull_request) Successful in 15s
CI / ui (pull_request) Successful in 53s
CI / gate (pull_request) Successful in 1s
CI / deploy (pull_request) Failing after 2m6s
Move all Telegram egress off the main host. The single connector held the bot token, long-polled Telegram and answered the gateway/backend over the trusted internal network, so the whole component (including login validation) shared fate with its VPN sidecar. Split it into two binaries that share the token: - cmd/validator (home, no VPN): Mini App initData + Login Widget HMAC only, never calls the Bot API. The gateway dials it for Telegram auth, so game login is now independent of Telegram reachability. - cmd/bot (remote): Bot API long-poll + sendMessage, the only component reaching Telegram. It holds no inbound port — it dials the gateway over a new reverse mTLS bot-link (pkg/proto/botlink/v1) and executes the send commands the gateway pushes. The gateway funnels sends to the bot-link: out-of-app push is fire-and-forget (at-most-once, dropped if no bot is connected); the backend admin broadcasts reach a gateway-served relay that forwards them and awaits the bot's ack (SendToUser/SendToGameChannel contract preserved). mTLS (pkg/mtls) is the one inter-service link that leaves the trusted segment; validator<->gateway and the relay stay plaintext internal. The bot is Telegram-rate-limited. One bot now; the gateway bot registry, an owns_updates flag and per-command ids leave seams for N later. Webhook rejected (one URL per token, adds inbound + a static address). The unified test contour runs the split (the bot keeps its VPN sidecar and dials the gateway by its internal name; bot-link certs from deploy/gen-certs.sh, generated in CI). The prod wiring — the bot on a separate host (no VPN), the gateway bot-link port published, PROD_ certs with scheduled rotation, an SSH deploy of both hosts together — is the deferred final stage (PRERELEASE.md TX, Stage 18). Docs: ARCHITECTURE, PRERELEASE (phase TX), platform/telegram + gateway + backend + deploy READMEs, FUNCTIONAL(+ru), CLAUDE.md, .env.example.
34 lines
1.8 KiB
Docker
34 lines
1.8 KiB
Docker
# Telegram platform images: the home validator (HMAC of Mini App / Login Widget
|
|
# data, no Bot API, no VPN) and the remote bot (Bot API long-poll + sendMessage,
|
|
# dialing the gateway over the reverse mTLS bot-link). One build stage compiles both
|
|
# binaries; the `validator` and `bot` targets each ship one on distroless nonroot.
|
|
#
|
|
# The platform imports only the shared scrabble/pkg module, so the build drops the
|
|
# other workspace modules (backend, gateway, loadtest), the loadtest-only
|
|
# scrabble/gateway replace and the scrabble-solver replace from a copy of go.work: it
|
|
# needs neither their sources nor the solver sibling checkout.
|
|
# Build from the repository ROOT so go.work, pkg/ and platform/telegram/ are all in
|
|
# the context (see deploy/docker-compose.yml, which sets context: ..).
|
|
FROM golang:1.26.3-alpine AS build
|
|
WORKDIR /src
|
|
|
|
COPY go.work go.work.sum ./
|
|
COPY pkg ./pkg
|
|
COPY platform/telegram ./platform/telegram
|
|
|
|
# Reduce the workspace to what the platform needs: only pkg + platform/telegram.
|
|
RUN go work edit -dropuse=./backend -dropuse=./gateway -dropuse=./loadtest -dropreplace=scrabble/gateway@v0.0.0 -dropreplace=scrabble-solver
|
|
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/validator ./platform/telegram/cmd/validator
|
|
RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -o /out/bot ./platform/telegram/cmd/bot
|
|
|
|
# --- validator (home) --------------------------------------------------------
|
|
FROM gcr.io/distroless/static-debian12:nonroot AS validator
|
|
COPY --from=build /out/validator /usr/local/bin/validator
|
|
ENTRYPOINT ["/usr/local/bin/validator"]
|
|
|
|
# --- bot (remote) ------------------------------------------------------------
|
|
FROM gcr.io/distroless/static-debian12:nonroot AS bot
|
|
COPY --from=build /out/bot /usr/local/bin/bot
|
|
ENTRYPOINT ["/usr/local/bin/bot"]
|