From 5d7966925b62cb1e51fd51f315afb0c5947a86e2 Mon Sep 17 00:00:00 2001 From: surafel fikru Date: Tue, 15 Sep 2026 17:55:30 +0300 Subject: [PATCH] feat: route Telegram file downloads through the gateway proxy Telegram serves API methods from /bot/ but uploaded files from /file/bot/, and the proxy only routed the first, so every media download 404'd behind the gateway while text messages kept working, which reads as broken media handling rather than a missing route. This adds the file route next to the existing one, so photos, documents and voice notes resolve: location /telegram-file/ { rewrite ^/telegram-file/(.*)$ /file/bot${TG_BOT_TOKEN}/$1 break; proxy_pass https://api.telegram.org; } nginx.sh needs no change; it builds its envsubst list by grepping ${VAR} out of the template, so TG_BOT_TOKEN is already picked up from the existing route. --- proxy/nginx.conf.template | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/proxy/nginx.conf.template b/proxy/nginx.conf.template index f569ea97..e6c28719 100644 --- a/proxy/nginx.conf.template +++ b/proxy/nginx.conf.template @@ -111,6 +111,17 @@ http { proxy_http_version 1.1; } + # Telegram file downloads: Telegram serves uploaded files from + # /file/bot/, not /bot/, so media needs its own. + location /telegram-file/ { + rewrite ^/telegram-file/(.*)$ /file/bot${TG_BOT_TOKEN}/$1 break; + proxy_pass https://api.telegram.org; + proxy_set_header Host api.telegram.org; + proxy_ssl_server_name on; + proxy_ssl_protocols TLSv1.2 TLSv1.3; + proxy_http_version 1.1; + } + # Mattermost: inject Bearer token header (HTTP + WebSocket). # Origin is rewritten to the upstream URL so Mattermost's CORS check # on the WebSocket upgrade matches its SiteURL / AllowCorsFrom — the