From e3ec24f58ff9127527f059d25bd22d8ce89937c5 Mon Sep 17 00:00:00 2001 From: Renn F Date: Sat, 18 Jul 2026 05:21:22 +0200 Subject: [PATCH] fix(deploy): arm the Telegram trio by default in the NAS compose per the arm-new-flags convention --- .env.example | 15 +++++++++------ docker-compose.yaml | 18 ++++++++++-------- docker-compose.yml | 18 ++++++++++-------- 3 files changed, 29 insertions(+), 22 deletions(-) diff --git a/.env.example b/.env.example index e363b9d7..f3878a49 100644 --- a/.env.example +++ b/.env.example @@ -203,17 +203,20 @@ ROBOCO_DB_NETWORK_ISOLATED=true # ============================================================================= # Telegram notifications bridge — V1 (outbound DMs) / V2 (inbound commands) / -# V3 (Mini App sign-in) — all default OFF; inert without stored bot-token + -# chat-id credentials (set via the panel, not env) regardless of these flags. +# V3 (Mini App sign-in). The NAS compose (docker-compose.yml) arms all three +# by DEFAULT per the arm-new-flags convention; set false here to opt out. +# Inert without stored bot-token + chat-id credentials (set via the panel, +# not env) regardless of these flags. Config-code default (no compose) is OFF. # ============================================================================= -# ROBOCO_TELEGRAM_ENABLED=false +# ROBOCO_TELEGRAM_ENABLED=true # V2: inbound commands + actionable approve/reject buttons. Sub-switch on top # of ROBOCO_TELEGRAM_ENABLED above — arming this alone does nothing. -# ROBOCO_TELEGRAM_INBOUND_ENABLED=false +# ROBOCO_TELEGRAM_INBOUND_ENABLED=true # V3: Telegram Mini App sign-in — mints a cloud-auth session cookie for the # CEO's phone. Requires ROBOCO_CLOUD_AUTH_ENABLED=true (startup fails loud -# otherwise) AND a public HTTPS origin (Mini Apps only open over https). -# ROBOCO_TELEGRAM_MINIAPP_ENABLED=false +# otherwise — a cloud-auth-off .env must set this false too) AND a public +# HTTPS origin (Mini Apps only open over https). +# ROBOCO_TELEGRAM_MINIAPP_ENABLED=true # ============================================================================= # Model routing strictness diff --git a/docker-compose.yaml b/docker-compose.yaml index e9a42c40..abcb18dd 100644 --- a/docker-compose.yaml +++ b/docker-compose.yaml @@ -530,12 +530,13 @@ services: ROBOCO_ORG_MEMORY_ENABLED: ${ROBOCO_ORG_MEMORY_ENABLED:-true} ROBOCO_X_ENGINE_ENABLED: ${ROBOCO_X_ENGINE_ENABLED:-true} # Telegram notifications bridge: best-effort DMs to the CEO on escalation - # + completion. Config default is OFF; not yet armed here (needs stored - # bot-token + chat-id credentials regardless of this flag). - ROBOCO_TELEGRAM_ENABLED: ${ROBOCO_TELEGRAM_ENABLED:-false} + # + completion. Armed by default here per the NAS-compose convention + # (new flags ship ON unless the CEO opts out); inert without stored + # bot-token + chat-id credentials regardless of this flag. + ROBOCO_TELEGRAM_ENABLED: ${ROBOCO_TELEGRAM_ENABLED:-true} # Telegram V2 — inbound commands + actionable approve/reject buttons. - # Armed here (sub-switch on top of the still-off ROBOCO_TELEGRAM_ENABLED - # above); the whole bridge stays inert until that flag AND credentials + # Armed here (sub-switch of ROBOCO_TELEGRAM_ENABLED above); the whole + # bridge stays inert until that flag AND credentials # are both set, so arming this alone does nothing yet. ROBOCO_TELEGRAM_INBOUND_ENABLED: ${ROBOCO_TELEGRAM_INBOUND_ENABLED:-true} # Telegram Mini App sign-in: validates Telegram's signed WebApp initData @@ -543,9 +544,10 @@ services: # so the CEO's phone becomes an authenticated panel client. Requires # ROBOCO_CLOUD_AUTH_ENABLED=true (startup fails loud otherwise) AND a # public HTTPS origin (the cookie is secure-only, and Telegram itself - # only opens Mini Apps over https). Default OFF; not armed here — the - # operator flips it on once TLS + cloud-auth creds are both live. - ROBOCO_TELEGRAM_MINIAPP_ENABLED: ${ROBOCO_TELEGRAM_MINIAPP_ENABLED:-false} + # only opens Mini Apps over https). Armed by default per the NAS-compose + # convention — NOTE: boot fails loud if cloud auth is disabled/unseeded, + # so a cloud-auth-off .env must also set this false. + ROBOCO_TELEGRAM_MINIAPP_ENABLED: ${ROBOCO_TELEGRAM_MINIAPP_ENABLED:-true} ROBOCO_OBSIDIAN_VAULT_ENABLED: ${ROBOCO_OBSIDIAN_VAULT_ENABLED:-true} ROBOCO_VAULT_PATH: ${ROBOCO_VAULT_PATH:-/app/vault} ROBOCO_VAULT_INTAKE_ENABLED: ${ROBOCO_VAULT_INTAKE_ENABLED:-true} diff --git a/docker-compose.yml b/docker-compose.yml index e9a42c40..abcb18dd 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -530,12 +530,13 @@ services: ROBOCO_ORG_MEMORY_ENABLED: ${ROBOCO_ORG_MEMORY_ENABLED:-true} ROBOCO_X_ENGINE_ENABLED: ${ROBOCO_X_ENGINE_ENABLED:-true} # Telegram notifications bridge: best-effort DMs to the CEO on escalation - # + completion. Config default is OFF; not yet armed here (needs stored - # bot-token + chat-id credentials regardless of this flag). - ROBOCO_TELEGRAM_ENABLED: ${ROBOCO_TELEGRAM_ENABLED:-false} + # + completion. Armed by default here per the NAS-compose convention + # (new flags ship ON unless the CEO opts out); inert without stored + # bot-token + chat-id credentials regardless of this flag. + ROBOCO_TELEGRAM_ENABLED: ${ROBOCO_TELEGRAM_ENABLED:-true} # Telegram V2 — inbound commands + actionable approve/reject buttons. - # Armed here (sub-switch on top of the still-off ROBOCO_TELEGRAM_ENABLED - # above); the whole bridge stays inert until that flag AND credentials + # Armed here (sub-switch of ROBOCO_TELEGRAM_ENABLED above); the whole + # bridge stays inert until that flag AND credentials # are both set, so arming this alone does nothing yet. ROBOCO_TELEGRAM_INBOUND_ENABLED: ${ROBOCO_TELEGRAM_INBOUND_ENABLED:-true} # Telegram Mini App sign-in: validates Telegram's signed WebApp initData @@ -543,9 +544,10 @@ services: # so the CEO's phone becomes an authenticated panel client. Requires # ROBOCO_CLOUD_AUTH_ENABLED=true (startup fails loud otherwise) AND a # public HTTPS origin (the cookie is secure-only, and Telegram itself - # only opens Mini Apps over https). Default OFF; not armed here — the - # operator flips it on once TLS + cloud-auth creds are both live. - ROBOCO_TELEGRAM_MINIAPP_ENABLED: ${ROBOCO_TELEGRAM_MINIAPP_ENABLED:-false} + # only opens Mini Apps over https). Armed by default per the NAS-compose + # convention — NOTE: boot fails loud if cloud auth is disabled/unseeded, + # so a cloud-auth-off .env must also set this false. + ROBOCO_TELEGRAM_MINIAPP_ENABLED: ${ROBOCO_TELEGRAM_MINIAPP_ENABLED:-true} ROBOCO_OBSIDIAN_VAULT_ENABLED: ${ROBOCO_OBSIDIAN_VAULT_ENABLED:-true} ROBOCO_VAULT_PATH: ${ROBOCO_VAULT_PATH:-/app/vault} ROBOCO_VAULT_INTAKE_ENABLED: ${ROBOCO_VAULT_INTAKE_ENABLED:-true}