# yaml-language-server: $schema=https://schema.zeabur.app/template.json
apiVersion: zeabur.com/v1
kind: Template
metadata:
    name: openab-telegram
spec:
    description: OpenAB Telegram Bot with Kiro CLI Agent
    icon: https://cdn-console.zeabur.com/f/0Ewi6/openab-icon.webp
    readme: ""
    services:
        - name: openab
          icon: https://cdn-console.zeabur.com/f/0Ewi6/openab-icon.webp
          template: PREBUILT_V2
          spec:
            id: openab
            source:
                image: ghcr.io/openabdev/openab:beta-kiro
                command:
                    - /bin/sh
                    - -c
                    - /opt/start-openab.sh
                runAsUserID: 1000
            ports:
                - id: web
                  port: 8080
                  type: HTTP
            volumes:
                - id: agent-home
                  dir: /home/agent
            instructions:
                - title: Re-register Telegram Webhook
                  content: curl "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/setWebhook?url=https://${ZEABUR_WEB_DOMAIN}/webhook/telegram&secret_token=${TELEGRAM_SECRET_TOKEN}"
                - title: Unregister Telegram Webhook
                  content: curl "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/deleteWebhook"
            env:
                BOT_USERNAME:
                    default: Zeaburkiro_bot
                    expose: false
                OPENAB_AGENT_COMMAND:
                    default: kiro-cli
                    expose: false
                OPENAB_CONFIG_URL:
                    default: ""
                    expose: false
                OPENAB_MAX_SESSIONS:
                    default: ""
                    expose: false
                PUBLIC_DOMAIN:
                    default: "10866009"
                    expose: false
                TELEGRAM_ALLOW_ALL_USERS:
                    default: "true"
                    expose: false
                TELEGRAM_ALLOWED_USERS:
                    default: ""
                    expose: false
                TELEGRAM_BOT_TOKEN:
                    default: ""
                    expose: false
                TELEGRAM_BOT_USERNAME:
                    default: ${BOT_USERNAME}
                    expose: false
                TELEGRAM_SECRET_TOKEN:
                    default: ${PASSWORD}
                    expose: false
            init:
                - id: register-telegram-webhook
                  image: curlimages/curl:8.5.0
                  command:
                    - sh
                    - -c
                    - |
                      for i in 1 2 3 4 5; do
                        if curl -fsS -m 10 \
                             "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/setWebhook" \
                             --data-urlencode "url=https://${ZEABUR_WEB_DOMAIN}/webhook/telegram" \
                             --data-urlencode "secret_token=${TELEGRAM_SECRET_TOKEN}"; then
                          echo
                          echo "openab: telegram webhook registered → https://${ZEABUR_WEB_DOMAIN}/webhook/telegram"
                          exit 0
                        fi
                        echo "openab: webhook register attempt $i failed, retrying in 3s"
                        sleep 3
                      done
                      echo "openab: all webhook register attempts failed – service will still start"
                      exit 0
                  volumes: null
            configs:
                - path: /opt/start-openab.sh
                  template: |
                    #!/bin/sh
                    set -e

                    # Initialize shell dotfiles and fix ownership for persistent volume
                    if [ ! -f /home/agent/.bashrc ]; then
                      cp /etc/skel/.bashrc /etc/skel/.profile /etc/skel/.bash_logout /home/agent/ 2>/dev/null || true
                    fi

                    if [ "$(id -u)" = "0" ]; then
                      chown -R agent:agent /home/agent
                      chmod 755 /home/agent/.config 2>/dev/null || true
                    fi

                    CONFIG_DIR=/home/agent/.config/openab
                    CONFIG_FILE=$CONFIG_DIR/config.toml
                    mkdir -p "$CONFIG_DIR"

                    # Telegram is enabled by TELEGRAM_* env vars (unified mode)
                    if [ ! -f "$CONFIG_FILE" ]; then
                      cp /opt/config.toml.template "$CONFIG_FILE"

                      if [ -n "$OPENAB_MAX_SESSIONS" ]; then
                        printf '\n[pool]\nmax_sessions = %s\n' "$OPENAB_MAX_SESSIONS" >> "$CONFIG_FILE"
                      fi

                      echo "openab: config.toml generated"
                    else
                      echo "openab: using existing config.toml (delete to regenerate)"
                    fi

                    if [ "$(id -u)" = "0" ]; then
                      chown -R agent:agent "$CONFIG_DIR"
                      exec runuser -u agent --preserve-environment -- openab run --config "${OPENAB_CONFIG_URL:-$CONFIG_FILE}"
                    fi

                    exec openab run --config "${OPENAB_CONFIG_URL:-$CONFIG_FILE}"
                  permission: 493
                  envsubst: null
                - path: /opt/config.toml.template
                  template: |
                    [agent]
                    args = ["acp", "--trust-all-tools"]
                  permission: 420
                  envsubst: null
            healthCheck:
                type: TCP
                port: web