Deploying a Production Telegram Bot on VPS

Configuration

Now that all components are installed, let's proceed with their configuration.

1. Telegram Bot Code

Let's create a simple bot.py file in the ~/my_telegram_bot directory. This file will contain our bot's logic.

nano ~/my_telegram_bot/bot.py

Contents of bot.py:

import os
from dotenv import load_dotenv
from aiogram import Bot, Dispatcher, types
from aiogram.enums import ParseMode
from aiogram.webhook.aiohttp_server import Simple
from aiohttp import web

# Load environment variables from the .env file
load_dotenv()

# Get bot token from environment variables
BOT_TOKEN = os.getenv("BOT_TOKEN")
WEBHOOK_HOST = os.getenv("WEBHOOK_HOST")
WEBHOOK_PATH = os.getenv("WEBHOOK_PATH")
WEB_SERVER_HOST = os.getenv("WEB_SERVER_HOST", "127.0.0.1")
WEB_SERVER_PORT = int(os.getenv("WEB_SERVER_PORT", 8000))

if not BOT_TOKEN:
    raise ValueError("BOT_TOKEN environment variable not set.")
if not WEBHOOK_HOST:
    raise ValueError("WEBHOOK_HOST environment variable not set.")
if not WEBHOOK_PATH:
    raise ValueError("WEBHOOK_PATH environment variable not set.")

WEBHOOK_URL = f"https://{WEBHOOK_HOST}{WEBHOOK_PATH}"

# Initialize bot and dispatcher
bot = Bot(token=BOT_TOKEN, parse_mode=ParseMode.HTML)
dp = Dispatcher()

# Handler for the /start command
@dp.message(commands=["start"])
async def handle_start(message: types.Message):
    await message.reply(f"Hello, {message.from_user.full_name}! I am your new bot.")

# Handler for text messages
@dp.message()
async def handle_message(message: types.Message):
    await message.reply(f"You said: {message.text}")

async def on_startup(dispatcher: Dispatcher, bot: Bot):
    # Set webhook on startup
    await bot.set_webhook(WEBHOOK_URL)
    print(f"Webhook set to: {WEBHOOK_URL}")

async def on_shutdown(dispatcher: Dispatcher, bot: Bot):
    # Delete webhook on shutdown
    await bot.delete_webhook()
    print("Webhook deleted.")

def main():
    # Create an AioHTTP web application for webhooks
    app = web.Application()
    webhook_requests_handler = Simple(dispatcher=dp, bot=bot, path=WEBHOOK_PATH)
    webhook_requests_handler.register(app, path=WEBHOOK_PATH)

    # Register startup and shutdown functions
    app.on_startup.append(lambda app: on_startup(dp, bot))
    app.on_shutdown.append(lambda app: on_shutdown(dp, bot))

    # Start the web server
    web.run_app(app, host=WEB_SERVER_HOST, port=WEB_SERVER_PORT)

if __name__ == "__main__":
    main()

2. Configuring Environment Variables (.env)

Never store sensitive data (tokens, passwords) directly in your code. Use environment variables. Create a .env file in the project's root directory.

nano ~/my_telegram_bot/.env

Contents of .env:

BOT_TOKEN="YOUR_BOT_TOKEN" # Get it from @BotFather
WEBHOOK_HOST="YOUR_DOMAIN_OR_IP" # For example, example.com
WEBHOOK_PATH="/webhook/bot" # Unique path for the webhook
WEB_SERVER_HOST="127.0.0.1" # Gunicorn will listen only locally
WEB_SERVER_PORT=8000 # Port on which Gunicorn will run

Replace ВАШ_ТОКЕН_БОТА with the actual token obtained from @BotFather, and ВАШ_ДОМЕН_ИЛИ_IP with your domain or public VPS IP address.

3. Configuring a Systemd Service for the Bot

Systemd will allow us to run the bot as a system service, automatically restart it in case of failures, and manage it.

sudo nano /etc/systemd/system/telegram-bot.service

Contents of telegram-bot.service:

[Unit]
Description=Telegram Bot Service
After=network.target

[Service]
User=botuser # User under which the bot will run
Group=www-data # Group, if needed for Nginx file access
WorkingDirectory=/home/botuser/my_telegram_bot # Project working directory
EnvironmentFile=/home/botuser/my_telegram_bot/.env # Path to the environment variables file
ExecStart=/home/botuser/my_telegram_bot/.venv/bin/gunicorn --workers 1 --bind 127.0.0.1:8000 bot:app # Start Gunicorn
Restart=always
RestartSec=5 # Restart after 5 seconds in case of failure
StandardOutput=journal
StandardError=journal
SyslogIdentifier=telegram-bot

[Install]
WantedBy=multi-user.target

Important note: In aiogram 3.x, webhooks are configured via aiohttp.web.Application. Gunicorn can run aiohttp applications. The ExecStart line tells Gunicorn to run the app application from the bot module. In our bot.py, we run web.run_app inside main(). For Gunicorn, we need to export app from bot.py. Let's modify bot.py so that app is available to Gunicorn:

# ... (beginning of bot.py file) ...

# Create an AioHTTP web application for webhooks
app = web.Application()
webhook_requests_handler = Simple(dispatcher=dp, bot=bot, path=WEBHOOK_PATH)
webhook_requests_handler.register(app, path=WEBHOOK_PATH)

# Register startup and shutdown functions
app.on_startup.append(lambda app_instance: on_startup(dp, bot))
app.on_shutdown.append(lambda app_instance: on_shutdown(dp, bot))

# ... (end of bot.py file) ...

# Remove or comment out the if __name__ == "__main__": block
# if __name__ == "__main__":
#     main()

Now Gunicorn will be able to find and run app. After editing the service file, reload systemd and start the bot:

sudo systemctl daemon-reload # Reload systemd to recognize the new service
sudo systemctl enable telegram-bot # Enable bot autostart on boot
sudo systemctl start telegram-bot # Start the bot service
sudo systemctl status telegram-bot # Check bot status

Make sure the service is running and has no errors. Logs can be viewed with the command: sudo journalctl -u telegram-bot -f.

4. Configuring Nginx as a Reverse Proxy

Let's create an Nginx configuration file for our bot. Replace example.com with your domain.

sudo nano /etc/nginx/sites-available/telegram-bot

Contents of telegram-bot:

server {
    listen 80;
    server_name YOUR_DOMAIN_OR_IP; # For example, example.com

    location / {
        return 301 https://$host$request_uri; # Redirect all HTTP traffic to HTTPS
    }
}

server {
    listen 443 ssl;
    server_name YOUR_DOMAIN_OR_IP; # For example, example.com

    ssl_certificate /etc/letsencrypt/live/YOUR_DOMAIN_OR_IP/fullchain.pem; # Will be created by Certbot
    ssl_certificate_key /etc/letsencrypt/live/YOUR_DOMAIN_OR_IP/privkey.pem; # Will be created by Certbot
    ssl_protocols TLSv1.2 TLSv1.3; # Recommended protocols
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location /webhook/bot { # Must match WEBHOOK_PATH in .env
        proxy_pass http://127.0.0.1:8000; # Proxy requests to Gunicorn
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;
        proxy_buffering off; # Disable buffering for webhooks
    }

    # If the bot will serve static files or have other HTTP endpoints
    # location / {
    #    root /var/www/html;
    #    index index.html;
    # }
}

Create a symbolic link to this file from sites-enabled and check the Nginx configuration:

sudo ln -s /etc/nginx/sites-available/telegram-bot /etc/nginx/sites-enabled/ # Create symlink
sudo nginx -t # Check Nginx configuration syntax
sudo systemctl restart nginx # Restart Nginx

5. Obtaining an SSL Certificate with Certbot

Now that Nginx is configured, let's obtain an SSL certificate. Make sure your domain already points to your VPS's IP address.

sudo certbot --nginx -d YOUR_DOMAIN_OR_IP # Run Certbot, replacing with your domain

Certbot will ask a few questions (email, agreement to terms). It will automatically modify the Nginx configuration, adding ssl_certificate and ssl_certificate_key. After successfully obtaining the certificate, Nginx will automatically restart.

Check that Certbot has configured automatic certificate renewal:

sudo systemctl status certbot.timer # Check the status of the timer for auto-renewal

Certbot usually creates a cron job or systemd timer for automatic certificate renewal. This happens twice a day, and the certificate is renewed if its expiration date is within 30 days.

6. Checking Functionality

After all configurations, make sure the bot is working and accessible:

• Nginx Check: Open https://YOUR_DOMAIN_OR_IP/ in your browser. If you see the Nginx welcome page or a redirect, Nginx is working.
• Webhook Check: Try sending a message to your bot in Telegram. It should respond.
• Systemd Service Check:

  
  sudo systemctl status telegram-bot
  sudo journalctl -u telegram-bot -f # View bot logs in real-time
              

  You should see messages about the bot starting and the webhook being set.

• Gunicorn Port Check: From the server, you can check if Gunicorn is listening on the local port:

  
  ss -ltn | grep 8000
              

  You should see a line indicating that 127.0.0.1:8000 is in the LISTEN state.