Add an authenticated free-tier Telegram relay instead of paid hosting

.dockerignore

@@ -6,3 +6,8 @@ __pycache__
 .env.*
 *.sqlite3
 *.sqlite3-*
+.local-*
+.wrangler
+node_modules
+.dev.vars
+.dev.vars.*

.gitignore

@@ -5,3 +5,8 @@ __pycache__/
 .env.*
 *.sqlite3
 *.sqlite3-*
+.local-*
+.wrangler/
+node_modules/
+.dev.vars
+.dev.vars.*

Dockerfile

@@ -1,7 +1,6 @@
 FROM python:3.12-slim
 RUN useradd --create-home --uid 1000 appuser
 WORKDIR /app
-RUN mkdir -p /app/data && chown appuser:appuser /app/data
 COPY requirements-monitor.txt /app/requirements-monitor.txt
 RUN pip install --no-cache-dir -r /app/requirements-monitor.txt
 COPY --chown=appuser:appuser receiver.py /app/receiver.py

README.md

@@ -53,28 +53,21 @@ is available. `ALERT_MENTIONS` is optional. Valid authenticated webhooks are sto
 even while downstream configuration is incomplete, and workers resume delivery
 after configuration is corrected and the service restarted with the same database.
 
-## Continuous hosting on Render
+## Optional free Telegram relay
 
-The included `render.yaml` describes one paid Docker web service with a 1 GB
-persistent disk at `/app/data`. Check the actual compute and disk prices before
-creating the service. Free services are unsuitable for continuous monitoring.
-Keep exactly one instance. The existing Dockerfile runs as an unprivileged user.
+The `telegram-relay/` directory contains a Cloudflare Worker for installations
+where the Space cannot reach Telegram directly. It supports the Workers Free
+plan within its quotas. Configure `TELEGRAM_RELAY_URL` and
+`TELEGRAM_RELAY_SECRET` together to use it. Otherwise requests go directly to
+Telegram as before. The Worker holds its own bot token and allows only this
+monitor's five Bot API methods for one numeric chat ID. Both normal delivery and
+authenticated diagnostics use the configured transport.
 
-Deploy this directory as the repository root. Enter the existing values for
-`WEBHOOK_SECRET`, `TELEGRAM_BOT_TOKEN`, `TELEGRAM_CHAT_ID` and `DEEPSEEK_API_KEY`
-as secret environment variables. Hugging Face does not return stored secret
-values through its API; copy them from your original secure source. Preserve
-`DEEPSEEK_MODEL`, `CLASSIFIER_PROMPT`, `ALERT_MENTIONS` and `TELEGRAM_THREAD_ID`
-if customized. Do not put secrets in source control or Blueprint YAML.
+See `telegram-relay/README.md` for deployment and secret configuration. Verify
+the relay's read-only getMe, getChat and getChatMember checks before rebuilding
+the Space, then verify an actual publication arrives after deployment. Neither
+the bot token nor the shared secret belongs in source control.
 
-Before switching Medialogia, run the authenticated `/diagnostics/WEBHOOK_SECRET`
-checks on the new service and confirm bot membership and chat permissions. Then
-send a test publication through Medialogia and verify its arrival in Telegram.
-The diagnostic itself sends no messages. Update Medialogia to the new HTTPS
-`/medialogia/WEBHOOK_SECRET` URL only when ready to switch. Do not run two active
-webhook destinations for the same monitoring feed unless duplicates are desired.
-
-The old Hugging Face queue is in temporary storage and is not automatically
-migrated. Do not rebuild or delete that Space until any required pending
-publications have been recovered or replayed from Medialogia. A persistent disk
-retains the new service's queue across deploys; maintain separate backups.
+The Worker does not fix HF sleeping or the temporary queue. Do not rebuild the
+running Space until pending publications have been recovered or their loss and
+replay from Medialogia have been explicitly handled. Keep only one app instance.

diagnose_telegram.py

@@ -0,0 +1,65 @@
+import getpass
+import json
+import os
+from pathlib import Path
+import re
+import urllib.error
+import urllib.request
+
+from receiver import Clients, Config, network_error_category
+
+
+def summarize(report):
+    fields = {"method", "ok", "error", "seconds", "chat_type", "permissions",
+              "membership", "is_member", "can_send_messages", "can_post_messages"}
+    return {"status": report.get("status"),
+            "checks": [{key: value for key, value in check.items() if key in fields}
+                       for check in report.get("checks", [])]}
+
+
+def compare(token, chat_id, webhook_secret):
+    config = Config(secret=webhook_secret or "a" * 32,
+                    telegram_token=token, chat_id=chat_id)
+    report = {"mac": summarize(Clients(config).diagnose_telegram())}
+    if webhook_secret:
+        try:
+            request = urllib.request.Request(
+                "https://pranalytics-prtooltest.hf.space/diagnostics/" + webhook_secret)
+            with urllib.request.urlopen(request, timeout=40) as response:
+                report["space"] = summarize(json.loads(response.read(65536)))
+        except urllib.error.HTTPError as exc:
+            report["space"] = {"error": "diagnostics_http_" + str(exc.code)}
+            exc.close()
+        except OSError as exc:
+            report["space"] = {"error": "diagnostics_" + network_error_category(exc)}
+        except (ValueError, TypeError, AttributeError):
+            report["space"] = {"error": "diagnostics_invalid_response"}
+    return report
+
+
+def main():
+    print("Проверка только читает настройки. Сообщения не отправляются.")
+    print("Значения вводятся скрыто и не сохраняются. Используйте значения, заданные при настройке HF.")
+    token = getpass.getpass("TELEGRAM_BOT_TOKEN: ").strip()
+    chat_id = getpass.getpass("TELEGRAM_CHAT_ID: ").strip()
+    webhook_secret = getpass.getpass("WEBHOOK_SECRET (Enter — пропустить проверку Space): ").strip()
+    if not re.fullmatch(r"\d+:[A-Za-z0-9_-]+", token):
+        raise SystemExit("Неверный формат TELEGRAM_BOT_TOKEN.")
+    if not re.fullmatch(r"-?\d+|@[A-Za-z0-9_]+", chat_id):
+        raise SystemExit("Неверный формат TELEGRAM_CHAT_ID.")
+    if webhook_secret and not re.fullmatch(r"[A-Za-z0-9_-]{24,}", webhook_secret):
+        raise SystemExit("Неверный формат WEBHOOK_SECRET.")
+    result = json.dumps(compare(token, chat_id, webhook_secret), ensure_ascii=False, indent=2)
+    destination = Path(__file__).with_name(".local-diagnostics.json")
+    descriptor = os.open(destination, os.O_WRONLY | os.O_CREAT | os.O_TRUNC | os.O_NOFOLLOW, 0o600)
+    with os.fdopen(descriptor, "w") as report_file:
+        report_file.write(result + "\n")
+    print(result)
+    print("Обезличенный отчёт сохранён. Вернитесь в чат и напишите: готово.")
+
+
+if __name__ == "__main__":
+    try:
+        main()
+    except (KeyboardInterrupt, EOFError):
+        raise SystemExit("Проверка отменена.") from None

receiver.py

@@ -156,6 +156,8 @@ class Config:
     database_url: str = ""
     db_path: str = "/tmp/medialogia-monitor/queue.sqlite3"
     thread_id: str = ""
+    telegram_relay_url: str = ""
+    telegram_relay_secret: str = ""
 
     @classmethod
     def from_env(cls):
@@ -168,9 +170,21 @@ class Config:
                    model=os.getenv("DEEPSEEK_MODEL", "deepseek-flash").strip(),
                    database_url=os.getenv("DATABASE_URL", "").strip(),
                    db_path=os.getenv("MONITOR_DB_PATH", "/tmp/medialogia-monitor/queue.sqlite3"),
-                   thread_id=os.getenv("TELEGRAM_THREAD_ID", "").strip())
+                   thread_id=os.getenv("TELEGRAM_THREAD_ID", "").strip(),
+                   telegram_relay_url=os.getenv("TELEGRAM_RELAY_URL", "").strip(),
+                   telegram_relay_secret=os.getenv("TELEGRAM_RELAY_SECRET", "").strip())
 
     def validate(self):
+        if bool(self.telegram_relay_url) != bool(self.telegram_relay_secret):
+            raise ValueError("TELEGRAM_RELAY_URL and TELEGRAM_RELAY_SECRET must be set together")
+        if self.telegram_relay_url:
+            relay = urlsplit(self.telegram_relay_url)
+            if (relay.scheme != "https" or not relay.hostname or relay.username or relay.password
+                    or relay.query or relay.fragment or relay.path != "/telegram"
+                    or any(ord(char) < 33 for char in self.telegram_relay_url)):
+                raise ValueError("TELEGRAM_RELAY_URL: expected an HTTPS /telegram endpoint")
+            if not re.fullmatch(r"[A-Za-z0-9_-]{32,}", self.telegram_relay_secret):
+                raise ValueError("TELEGRAM_RELAY_SECRET: use at least 32 ASCII letters/digits/-/_")
         if not re.fullmatch(r"[A-Za-z0-9_-]{24,}", self.secret):
             raise ValueError("WEBHOOK_SECRET: use at least 24 ASCII letters/digits/-/_")
         if self.chat_id and not re.fullmatch(r"-?\d+|@[A-Za-z0-9_]+", self.chat_id):
@@ -354,6 +368,15 @@ class Clients:
         self.diagnostics_lock = threading.Lock()
         self.telegram_health = {"status": "not_checked"}
 
+    def telegram_request(self, method, payload, timeout):
+        if self.config.telegram_relay_url:
+            return request_json(self.config.telegram_relay_url,
+                                {"method": method, "payload": payload},
+                                {"Authorization": "Bearer " + self.config.telegram_relay_secret},
+                                service="telegram", timeout=timeout)
+        return request_json("https://api.telegram.org/bot" + self.config.telegram_token + "/" + method,
+                            payload, service="telegram", timeout=timeout)
+
     def diagnose_telegram(self):
         """Read-only Bot API checks; no publication, queue changes or AI calls."""
         if not self.diagnostics_lock.acquire(blocking=False):
@@ -369,9 +392,7 @@ class Clients:
                     payload["user_id"] = bot_id
                 started = time.monotonic()
                 try:
-                    result = request_json(
-                        "https://api.telegram.org/bot" + self.config.telegram_token + "/" + method,
-                        payload, service="telegram", timeout=10)
+                    result = self.telegram_request(method, payload, timeout=10)
                     if not result.get("ok") or not isinstance(result.get("result"), dict):
                         raise ServiceError("telegram_invalid_response")
                     data = result["result"]
@@ -424,8 +445,7 @@ class Clients:
         if method == "sendMessage" and self.config.thread_id:
             data["message_thread_id"] = int(self.config.thread_id)
         try:
-            result = request_json("https://api.telegram.org/bot" + self.config.telegram_token + "/" + method,
-                                  data, service="telegram", timeout=35)
+            result = self.telegram_request(method, data, timeout=35)
             if not isinstance(result, dict) or not result.get("ok"):
                 raise ServiceError("telegram_invalid_response")
         except ServiceError as exc:

render.yaml

@@ -1,25 +0,0 @@
-services:
-  - type: web
-    name: medialogia-monitor
-    runtime: docker
-    plan: starter
-    numInstances: 1
-    healthCheckPath: /live
-    maxShutdownDelaySeconds: 90
-    disk:
-      name: monitor-queue
-      mountPath: /app/data
-      sizeGB: 1
-    envVars:
-      - key: MONITOR_DB_PATH
-        value: /app/data/queue.sqlite3
-      - key: WEBHOOK_SECRET
-        sync: false
-      - key: TELEGRAM_BOT_TOKEN
-        sync: false
-      - key: TELEGRAM_CHAT_ID
-        sync: false
-      - key: DEEPSEEK_API_KEY
-        sync: false
-      - key: DEEPSEEK_MODEL
-        value: deepseek-flash

telegram-relay/README.md

@@ -0,0 +1,32 @@
+# Telegram delivery relay
+
+This optional Worker forwards the monitor's five Bot API methods to Telegram.
+It requires its own shared secret and accepts chat operations only for one
+numeric chat ID. It does not accept arbitrary destination URLs or bot tokens.
+Request logging is disabled. Do not enable logging of headers or request bodies.
+
+Use the Cloudflare Workers Free plan. Its quotas apply; this is not a guarantee
+of continuous delivery or permanent availability from Hugging Face. HF sleeping
+and temporary SQLite storage remain separate limitations.
+
+After signing into a free Cloudflare account:
+
+```
+npx wrangler login
+npx wrangler deploy
+npx wrangler secret put TELEGRAM_BOT_TOKEN
+npx wrangler secret put TELEGRAM_CHAT_ID
+npx wrangler secret put RELAY_SECRET
+```
+
+Run these commands from this directory. Enter values interactively, never as
+command-line arguments. Use the same bot token and numeric chat ID as the
+monitor. Generate a random shared secret with at least 32 URL-safe characters.
+Store the same secret in HF as `TELEGRAM_RELAY_SECRET` and the deployed HTTPS
+Worker URL ending in `/telegram` as `TELEGRAM_RELAY_URL`. Existing Telegram
+settings remain present in the Space. Never use an anonymous third-party proxy.
+
+Before changing the running Space, verify getMe, getChat and getChatMember via
+the deployed Worker. Preserve or explicitly handle the pending temporary queue
+before rebuilding HF. After updating, rerun the Space's authenticated diagnostics
+and confirm an actual publication arrives in Telegram.

telegram-relay/worker.mjs

@@ -0,0 +1,101 @@
+const allowedMethods = new Set(["getMe", "getChat", "getChatMember", "sendMessage", "editMessageText"]);
+const maxBytes = 65536;
+
+function reply(status, description) {
+  return Response.json({ ok: false, description }, {
+    status,
+    headers: { "Cache-Control": "no-store" },
+  });
+}
+
+async function authorized(actual, expected) {
+  const encoder = new TextEncoder();
+  const [actualHash, expectedHash] = await Promise.all([
+    crypto.subtle.digest("SHA-256", encoder.encode(actual)),
+    crypto.subtle.digest("SHA-256", encoder.encode(expected)),
+  ]);
+  const actualBytes = new Uint8Array(actualHash);
+  const expectedBytes = new Uint8Array(expectedHash);
+  let difference = 0;
+  for (let index = 0; index < actualBytes.length; index += 1) {
+    difference |= actualBytes[index] ^ expectedBytes[index];
+  }
+  return difference === 0;
+}
+
+async function readBody(request) {
+  if (!request.body) throw new Error("empty_body");
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > maxBytes) {
+      await reader.cancel();
+      throw new Error("payload_too_large");
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body));
+}
+
+export default {
+  async fetch(request, environment) {
+    const url = new URL(request.url);
+    if (url.pathname !== "/telegram" || url.search || request.method !== "POST") {
+      return reply(404, "not_found");
+    }
+    if (!/^\d+:[A-Za-z0-9_-]+$/.test(environment.TELEGRAM_BOT_TOKEN || "")
+        || !/^[A-Za-z0-9_-]{32,}$/.test(environment.RELAY_SECRET || "")
+        || !/^-?\d+$/.test(environment.TELEGRAM_CHAT_ID || "")) {
+      return reply(503, "configuration_required");
+    }
+    if (!await authorized(request.headers.get("Authorization") || "", "Bearer " + environment.RELAY_SECRET)) {
+      return reply(401, "unauthorized");
+    }
+    let input;
+    try {
+      input = await readBody(request);
+    } catch (error) {
+      return reply(error.message === "payload_too_large" ? 413 : 400, "invalid_payload");
+    }
+    if (!input || typeof input !== "object" || !allowedMethods.has(input.method)
+        || !input.payload || typeof input.payload !== "object" || Array.isArray(input.payload)) {
+      return reply(400, "invalid_method_or_payload");
+    }
+    if (input.method === "getMe") {
+      input.payload = {};
+    } else if (String(input.payload.chat_id) !== environment.TELEGRAM_CHAT_ID) {
+      return reply(403, "chat_not_allowed");
+    }
+    try {
+      const response = await fetch(
+        "https://api.telegram.org/bot" + environment.TELEGRAM_BOT_TOKEN + "/" + input.method,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(input.payload),
+          redirect: "error",
+          signal: AbortSignal.timeout(8000),
+        },
+      );
+      const body = await response.text();
+      const data = JSON.parse(body);
+      if (!data || typeof data.ok !== "boolean") return reply(502, "telegram_invalid_response");
+      return new Response(body, {
+        status: response.status,
+        headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
+      });
+    } catch {
+      return reply(502, "telegram_upstream_unavailable");
+    }
+  },
+};

telegram-relay/wrangler.toml

@@ -0,0 +1,8 @@
+name = "pranalytics-telegram-relay"
+main = "worker.mjs"
+compatibility_date = "2026-10-23"
+workers_dev = true
+preview_urls = false
+
+[observability]
+enabled = false