From 5d7966925b62cb1e51fd51f315afb0c5947a86e2 Mon Sep 17 00:00:00 2001
From: surafel fikru <surafelfikru76@gmail.com>
Date: Tue, 15 Sep 2026 17:55:30 +0300
Subject: [PATCH 1/2] feat: route Telegram file downloads through the gateway
 proxy

Telegram serves API methods from /bot<token>/ but uploaded files from
/file/bot<token>/, and the proxy only routed the first, so every media download
404'd behind the gateway while text messages kept working, which reads as broken
media handling rather than a missing route. This adds the file route next to the
existing one, so photos, documents and voice notes resolve:

    location /telegram-file/ {
        rewrite ^/telegram-file/(.*)$ /file/bot${TG_BOT_TOKEN}/$1 break;
        proxy_pass https://api.telegram.org;
    }

nginx.sh needs no change; it builds its envsubst list by grepping ${VAR} out of
the template, so TG_BOT_TOKEN is already picked up from the existing route.
---
 proxy/nginx.conf.template | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/proxy/nginx.conf.template b/proxy/nginx.conf.template
index f569ea97..e6c28719 100644
--- a/proxy/nginx.conf.template
+++ b/proxy/nginx.conf.template
@@ -111,6 +111,17 @@ http {
             proxy_http_version 1.1;
         }
 
+        # Telegram file downloads: Telegram serves uploaded files from
+        # /file/bot<TOKEN>/<path>, not /bot<TOKEN>/<path>, so media needs its own.
+        location /telegram-file/ {
+            rewrite ^/telegram-file/(.*)$ /file/bot${TG_BOT_TOKEN}/$1 break;
+            proxy_pass https://api.telegram.org;
+            proxy_set_header Host api.telegram.org;
+            proxy_ssl_server_name on;
+            proxy_ssl_protocols TLSv1.2 TLSv1.3;
+            proxy_http_version 1.1;
+        }
+
         # Mattermost: inject Bearer token header (HTTP + WebSocket).
         # Origin is rewritten to the upstream URL so Mattermost's CORS check
         # on the WebSocket upgrade matches its SiteURL / AllowCorsFrom — the

From 81a28823128b3bac4ff9025e336e897e032944dd Mon Sep 17 00:00:00 2001
From: surafel fikru <surafelfikru76@gmail.com>
Date: Fri, 25 Sep 2026 12:32:01 +0300
Subject: [PATCH 2/2] fix(proxy): stream Telegram file downloads instead of
 buffering to disk

When a download was larger than nginx's memory buffers, nginx wrote it
to /tmp/proxy and logged a warning with the upstream URL. The rewrite
puts the bot token in that URL, so the token ended up in docker logs.
Parallel large downloads also filled the container's 64 MB /tmp.

With proxy_max_temp_file_size 0, nginx passes the response straight to
the client, so nothing is written to /tmp and nothing is logged.
---
 proxy/nginx.conf.template | 1 +
 1 file changed, 1 insertion(+)

diff --git a/proxy/nginx.conf.template b/proxy/nginx.conf.template
index e6c28719..9f079886 100644
--- a/proxy/nginx.conf.template
+++ b/proxy/nginx.conf.template
@@ -120,6 +120,7 @@ http {
             proxy_ssl_server_name on;
             proxy_ssl_protocols TLSv1.2 TLSv1.3;
             proxy_http_version 1.1;
+            proxy_max_temp_file_size 0;
         }
 
         # Mattermost: inject Bearer token header (HTTP + WebSocket).