Deploy a Telegram Bot Webhook with Node.js, TypeScript, grammY, Nginx, SSL, and systemd

mkdir -p ~/apps/telegram-bot-webhook
cd ~/apps/telegram-bot-webhook

npm init -y
npm pkg set scripts.build="tsc -p tsconfig.json"
npm pkg set scripts.start="node dist/server.js"

npm install grammy express dotenv
npm install -D typescript @types/node @types/express

mkdir -p src
touch tsconfig.json
touch .env.example
touch src/bot.ts
touch src/server.ts

{
  "compilerOptions": {
    "target": "ES2022",
    "module": "CommonJS",
    "moduleResolution": "Node",
    "rootDir": "src",
    "outDir": "dist",
    "strict": true,
    "esModuleInterop": true,
    "forceConsistentCasingInFileNames": true,
    "skipLibCheck": true
  },
  "include": ["src/**/*.ts"]
}

HOST=127.0.0.1
PORT=3000
BOT_TOKEN=replace_with_your_bot_token
WEBHOOK_SECRET=replace_with_a_long_random_secret
WEBHOOK_PATH=/telegram/webhook

import { Bot } from "grammy";

const botToken = process.env.BOT_TOKEN;

if (!botToken) {
  throw new Error("BOT_TOKEN is required");
}

export const bot = new Bot(botToken);

bot.command("start", async (ctx) => {
  await ctx.reply("Webhook is live. Your TypeScript bot is running.");
});

bot.command("ping", async (ctx) => {
  await ctx.reply("pong");
});

bot.on("message:text", async (ctx) => {
  if (ctx.message.text.startsWith("/")) {
    return;
  }

  await ctx.reply("You said: " + ctx.message.text);
});

import "dotenv/config";
import express, { type NextFunction, type Request, type Response } from "express";
import { webhookCallback } from "grammy";
import { bot } from "./bot";

const host = process.env.HOST || "127.0.0.1";
const port = Number(process.env.PORT || 3000);
const webhookPath = process.env.WEBHOOK_PATH || "/telegram/webhook";
const webhookSecret = process.env.WEBHOOK_SECRET;

if (!webhookSecret) {
  throw new Error("WEBHOOK_SECRET is required");
}

const app = express();

app.disable("x-powered-by");
app.use(express.json({ limit: "1mb" }));

app.get("/healthz", (_req: Request, res: Response) => {
  res.status(200).json({ ok: true });
});

function verifyTelegramSecret(req: Request, res: Response, next: NextFunction): void {
  const secret = req.header("x-telegram-bot-api-secret-token");

  if (secret !== webhookSecret) {
    res.status(403).json({ ok: false });
    return;
  }

  next();
}

app.post(
  webhookPath,
  verifyTelegramSecret,
  webhookCallback(bot, "express")
);

app.use((_req: Request, res: Response) => {
  res.status(404).json({ ok: false });
});

async function start(): Promise<void> {
  await bot.init();

  app.listen(port, host, () => {
    console.log("Telegram webhook app listening on http://" + host + ":" + port + webhookPath);
  });
}

start().catch((error) => {
  console.error("Failed to start bot:", error);
  process.exit(1);
});

[Unit]
Description=Telegram Bot Webhook
After=network.target
Wants=network.target

[Service]
Type=simple
User=ubuntu
WorkingDirectory=/home/ubuntu/apps/telegram-bot-webhook
Environment=NODE_ENV=production
EnvironmentFile=/home/ubuntu/apps/telegram-bot-webhook/.env
ExecStart=/usr/bin/node /home/ubuntu/apps/telegram-bot-webhook/dist/server.js
Restart=always
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target

sudo cp telegram-bot-webhook.service /etc/systemd/system/telegram-bot-webhook.service
sudo systemctl daemon-reload
sudo systemctl enable --now telegram-bot-webhook
sudo systemctl status telegram-bot-webhook

journalctl -u telegram-bot-webhook -f

server {
    listen 80;
    listen [::]:80;
    server_name bot.example.com;

    location = /healthz {
        proxy_pass http://127.0.0.1:3000/healthz;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location = /telegram/webhook {
        proxy_pass http://127.0.0.1:3000/telegram/webhook;
        proxy_http_version 1.1;
        proxy_connect_timeout 5s;
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        return 404;
    }
}

sudo ln -s /etc/nginx/sites-available/bot.example.com /etc/nginx/sites-enabled/bot.example.com
sudo nginx -t
sudo systemctl reload nginx

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot

sudo certbot --nginx -d bot.example.com

sudo certbot renew --dry-run

curl https://bot.example.com/healthz

export BOT_TOKEN=replace_with_your_bot_token

curl -X POST "https://api.telegram.org/bot$BOT_TOKEN/setWebhook" \
  -d "url=https://bot.example.com/telegram/webhook" \
  -d "secret_token=replace_with_a_long_random_secret" \
  -d 'allowed_updates=["message"]'

curl "https://api.telegram.org/bot$BOT_TOKEN/getWebhookInfo"