v4: fix prisma crash (ignore stale DATABASE_URL) + telegram relay support

.env.example

@@ -3,7 +3,8 @@
 TELEGRAM_BOT_TOKEN=123456:replace-me-from-botfather
 TELEGRAM_ALLOW_FROM=123456789
 LITELLM_MASTER_KEY=sk-replace-me-random
-DEFAULT_TIER=fast
+# DEFAULT_TIER=fast
+# TELEGRAM_RELAY_URL=https://your-worker.workers.dev   (Telegram relay, see SETUP §6b)
 
 GEMINI_API_KEY_1=AIza...key1
 GEMINI_API_KEY_2=AIza...key2

SETUP.md

@@ -59,6 +59,10 @@ Optional BotFather polish: `/setdescription`, `/setuserpic`, `/setcommands`, and
 | `NVIDIA_API_KEY_1` … `_N` | recommended | your NVIDIA keys |
 | `GROQ_API_KEY`, `CEREBRAS_API_KEY`, `MISTRAL_API_KEY`, `OPENROUTER_API_KEY`, `GITHUB_MODELS_TOKEN`, `MODELSCOPE_API_KEY`, `SAMBANOVA_API_KEY`, `COHERE_API_KEY`, `ZAI_API_KEY` | optional | each adds runway; Groq also unlocks voice-memo transcription |
 | `DEFAULT_TIER` | optional | `fast` (default) or `smart` |
+| `TELEGRAM_RELAY_URL` | ✅ **required on HF** | your Cloudflare Worker URL — see §5b |
+
+⚠️ If you have an old **`DATABASE_URL`** secret from another project: delete it
+(or leave it — the router now ignores it on purpose; §7).
 
 Boot logs show `[ ok ]` per provider detected, then `fast deployments: N | smart deployments: N`.
 
@@ -70,6 +74,26 @@ Boot logs show `[ ok ]` per provider detected, then `fast deployments: N | smart
 4. **Big-brain mode:** `/model custom:router:smart` → ask something hard → `/model custom:router:fast`
 5. Useful Hermes commands: `/new` (fresh session), `/sethome` (cron deliveries land here), `/status`, `/commands`
 
+## §5b — Telegram relay (REQUIRED — HF blocks api.telegram.org)
+
+HF Spaces' outbound network times out on `api.telegram.org` (anti-abuse policy;
+measured & confirmed). The clean fix is your **own free Cloudflare Worker relay**:
+
+1. [cloudflare.com](https://cloudflare.com) → free sign-up (no card)
+2. Dashboard → **Compute (Workers)** → **Create** → **Create Worker** → name it
+   e.g. `tg-relay` → **Deploy**
+3. **Edit code** → delete the template → paste **the entire content of
+   `cloudflare-worker/telegram-relay-worker.js`** from this repo → **Deploy**
+4. Copy the worker URL it shows: `https://tg-relay.<you>.workers.dev`
+5. Space → **Settings → Variables and secrets** → new secret:
+   `TELEGRAM_RELAY_URL` = that URL (no trailing slash)
+6. **Restart Space**. Boot logs should print `==> Telegram relay enabled via ...`
+   and the gateway should connect on attempt 1.
+
+The worker only relays Bot API calls to your own bot (token never stored in the
+worker — it travels inside the request path, same as normal Bot API usage).
+Delete the worker anytime to cut the cord.
+
 ## §6 — 24/7 keep-alive (3 free layers)
 
 1. **UptimeRobot:** free account → HTTP(s) monitor → `https://<YOU>-<SPACE>.hf.space/healthz` → 5-min interval
@@ -80,7 +104,9 @@ Boot logs show `[ ok ]` per provider detected, then `fast deployments: N | smart
 
 | Symptom | Fix |
 |---|---|
-| Bot silent in DMs | `TELEGRAM_ALLOW_FROM` must be your **numeric** ID; commas between IDs, no spaces issue handled — but no `@usernames` |
+| Bot silent in DMs | ① `TELEGRAM_ALLOW_FROM` must be your **numeric** ID ② logs show `telegram connect timed out` → set up the relay, §5b |
+| Logs: `telegram connect timed out after 45s` | **HF blocks api.telegram.org.** Not your token. Do §5b (Cloudflare relay) |
+| Logs: `prisma` / `database connection` in router step | Stale `DATABASE_URL` secret — already neutralized in entrypoint (deleting the secret is cosmetic) |
 | Status page says router "starting" forever | Check Space logs for `[skip]/[ ok ]` lines — no valid keys? Add secrets → Restart |
 | Replies fail with auth errors | `LITELLM_MASTER_KEY` must be set and non-empty |
 | Answers suddenly dumber | Some keys cooling down; normal. More keys → less of this |

cloudflare-worker/telegram-relay-worker.js

@@ -0,0 +1,44 @@
+// ─────────────────────────────────────────────────────────────
+// Telegram Bot API relay — Cloudflare Worker (free tier, no card)
+// Deploy this, then set Space secret:
+//     TELEGRAM_RELAY_URL = https://<your-subdomain>.workers.dev
+// (no trailing slash). Hermes will then call the Bot API THROUGH
+// this worker — because api.telegram.org is unreachable from HF Spaces.
+//
+// Handles:  POST/GET /bot<token>/<method>
+//           GET      /file/bot<token>/<path>   (file downloads)
+// Long-polling (getUpdates) works on the free plan.
+// ─────────────────────────────────────────────────────────────
+export default {
+  async fetch(request) {
+    const url = new URL(request.url);
+
+    // health check for your browser / UptimeRobot
+    if (url.pathname === "/" || url.pathname === "/healthz") {
+      return new Response("telegram-relay alive\n", { status: 200 });
+    }
+
+    // only Bot API shapes are relayed — everything else gets a 404
+    if (!url.pathname.startsWith("/bot") && !url.pathname.startsWith("/file/bot")) {
+      return new Response("not found\n", { status: 404 });
+    }
+
+    const target = "https://api.telegram.org" + url.pathname + url.search;
+    const isBodyless = request.method === "GET" || request.method === "HEAD";
+
+    const resp = await fetch(target, {
+      method: request.method,
+      headers: request.headers,
+      body: isBodyless ? undefined : request.body,
+      redirect: "follow",
+    });
+
+    return new Response(resp.body, {
+      status: resp.status,
+      headers: {
+        "content-type": resp.headers.get("content-type") || "application/json",
+        "access-control-allow-origin": "*",
+      },
+    });
+  },
+};

entrypoint.sh

@@ -15,6 +15,12 @@ echo "==> [3/5] Starting status/health page on 0.0.0.0:7860 ..."
 python3 health_server.py &
 
 echo "==> [4/5] Starting LiteLLM router on 127.0.0.1:4000 ..."
+# A stale DATABASE_URL (from other projects) makes LiteLLM attempt a Prisma DB
+# connect at boot and DIE. We run config-only, so drop it unless opted in.
+if [ "${LITELLM_USE_DB:-0}" != "1" ] && [ -n "${DATABASE_URL:-}" ]; then
+  echo "    (ignoring env DATABASE_URL — router runs without a database)"
+  unset DATABASE_URL
+fi
 litellm --config "${LITELLM_CONFIG_OUT:-litellm.generated.yaml}" \
         --host 127.0.0.1 --port 4000 > /tmp/litellm.log 2>&1 &
 

gen_hermes_config.py

@@ -50,8 +50,22 @@ stt:
   enabled: true        # local faster-whisper by default; set GROQ_API_KEY for groq whisper
 """
 
+relay = os.environ.get("TELEGRAM_RELAY_URL", "").strip().rstrip("/")
+relay_block = ""
+if relay:
+    # api.telegram.org is blocked from HF Spaces egress -> route the Bot API
+    # through the user's own free Cloudflare Worker relay instead.
+    relay_block = f"""
+platforms:
+  telegram:
+    extra:
+      base_url: "{relay}/bot"
+      base_file_url: "{relay}/file/bot"
+"""
+    print(f"==> Telegram relay enabled via {relay}", file=sys.stderr)
+
 with open(os.path.join(HERMES_HOME, "config.yaml"), "w") as f:
-    f.write(config_yaml)
+    f.write(config_yaml + relay_block)
 
 # .env — Hermes' documented manual Telegram configuration
 env_lines = [