# Nginx Webhook Configuration

## Overview

The Telegram bots use webhooks for instant message delivery and payment processing. Nginx proxies HTTPS webhook requests from Telegram to local bot instances.

**Architecture:**
```
Telegram → HTTPS → your-server.example.com/webhook/prod
                          ↓
                    Nginx (port 80/443)
                          ↓
                    localhost:8444 (prod bot)
```

## Update Nginx Configuration

### 1. Copy Updated Config

```bash
sudo cp /home/videobot/prod/systemd/nginx-videobot.conf /etc/nginx/sites-available/videobot
```

### 2. Verify Configuration

```bash
sudo nginx -t
```

**Expected output:**
```
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
```

### 3. Reload Nginx

```bash
sudo systemctl reload nginx
```

### 4. Verify Webhook Endpoints

```bash
# Dev webhook (should return 401 Unauthorized from Telegram)
curl -X POST https://your-server.example.com/webhook/dev
# {"ok":false,"error_code":401,"description":"Unauthorized"}

# Prod webhook (should return 401 Unauthorized from Telegram)
curl -X POST https://your-server.example.com/webhook/prod
# {"ok":false,"error_code":401,"description":"Unauthorized"}
```

**Note**: 401 error is expected - it means nginx is proxying correctly, but Telegram rejects requests without proper auth.

## Configuration Details

The config includes two webhook endpoints:

### Dev Bot Webhook
- **URL**: `https://your-server.example.com/webhook/dev`
- **Proxy to**: `http://127.0.0.1:8443`
- **Bot service**: `videobot-dev` (user service)

### Prod Bot Webhook
- **URL**: `https://your-server.example.com/webhook/prod`
- **Proxy to**: `http://127.0.0.1:8444`
- **Bot service**: `videobot-prod` (system service)

## Path Rewriting

The bots listen on root path (`url_path=""`), so nginx strips the `/webhook/dev` and `/webhook/prod` prefixes:

```nginx
location /webhook/prod {
    rewrite ^/webhook/prod(.*)$ $1 break;
    proxy_pass http://127.0.0.1:8444;
    ...
}
```

**Example:**
- Client sends: `POST https://your-server.example.com/webhook/prod/anything`
- Nginx proxies to: `POST http://127.0.0.1:8444/anything`

## Troubleshooting

### Webhook not working

**1. Check nginx is running:**
```bash
sudo systemctl status nginx
```

**2. Check bot is listening on webhook port:**
```bash
# Dev bot
netstat -tlnp | grep 8443
# Prod bot
netstat -tlnp | grep 8444
```

**3. Check nginx error logs:**
```bash
sudo tail -f /var/log/nginx/videobot_error.log
```

**4. Check bot logs:**
```bash
# Dev bot
journalctl --user -u videobot-dev -f

# Prod bot
sudo journalctl -u videobot-prod -f
```

### 502 Bad Gateway

This means nginx can't connect to the bot. Likely causes:

1. **Bot not running**: Start with `systemctl restart videobot-prod`
2. **Wrong port**: Verify `WEBHOOK_PORT` in .env matches nginx proxy_pass
3. **Bot crashed**: Check bot logs

### 404 Not Found

This means the nginx location block isn't matching. Check:

1. **Config syntax**: Run `sudo nginx -t`
2. **Sites enabled**: Verify `/etc/nginx/sites-enabled/videobot` exists
3. **Nginx reloaded**: Run `sudo systemctl reload nginx`

### Webhook URL mismatch

If bot logs show webhook registration errors:

```bash
# Check bot logs for webhook URL
journalctl -u videobot-prod | grep webhook

# Verify WEBHOOK_URL in .env
grep WEBHOOK_URL /home/videobot/prod/.env
```

## Security Notes

1. **Local only**: Bots listen on `127.0.0.1` (localhost), not accessible from outside
2. **Nginx proxy**: Only nginx can reach the bot ports
3. **Telegram auth**: Telegram validates webhook requests using secret tokens
4. **HTTPS required**: Telegram only sends webhooks to HTTPS endpoints

## See Also

- [production-deployment-guide.md](production-deployment-guide.md) - Full deployment guide
- [CLAUDE.md](../CLAUDE.md) - Project overview
