Skip to Content
Telegram MCPPlan & Phases0 — Preflight

Phase 0 — Pre-flight (accounts + infra)

Goal

External setup that has to happen before code matters. Cheap to do up front — accounts, infrastructure, secrets, and DNS — so Phase 1 can start with everything it needs.

Scope / Deliverables

  • BotFather: create bot, capture TELEGRAM_BOT_TOKEN
  • Inngest Cloud: create account + app, capture INNGEST_EVENT_KEY + INNGEST_SIGNING_KEY
  • Rent Ubuntu 24.04 VPS; SSH access via key only, root login disabled
  • DNS: A record bot.<domain> → VPS public IP
  • On VPS: install nginx + certbot, Postgres, Node LTS; create telegram-mcp service user; create empty /etc/telegram-mcp/env (mode 600)
  • Generate MCP_AUTH_TOKEN + TELEGRAM_WEBHOOK_SECRET (32 random bytes each), store in env file

Deviation from original plan: The plan originally specified Caddy as the reverse proxy. We installed nginx + certbot instead and updated design-overview.md and operations-and-strategy.md to match. nginx + certbot needs a few extras Caddy gave us for free (explicit MCP-friendly proxy_buffering off and bumped proxy_read_timeout for streamable HTTP) — these are recorded in the nginx server block in operations-and-strategy.md. Also: Postgres 18 from PGDG repo rather than the archive default 16.

Automated Unit Testing

No application code exists in this phase, so there are no unit tests yet. This section serves as a checklist for what to install in Phase 1 so the test harness is ready the moment the first module lands:

  • Install vitest and @vitest/coverage-v8 as dev dependencies in Phase 1.
  • Configure vitest.config.ts with the test/unit/ and test/integration/ directories (per the planned repo layout).
  • Add npm test and npm run test:watch scripts.
  • Confirm CI runs npm test on every push (per operations-and-strategy.md).

Manual verification only for Phase 0: confirm credentials work by issuing test API calls from a workstation (e.g. curl https://api.telegram.org/bot<TOKEN>/getMe).

Definition of Done

  • All six deliverable checkboxes above are checked.
  • /etc/telegram-mcp/env exists with mode 600, owned by the telegram-mcp service user, and contains all five secrets (TELEGRAM_BOT_TOKEN, INNGEST_EVENT_KEY, INNGEST_SIGNING_KEY, MCP_AUTH_TOKEN, TELEGRAM_WEBHOOK_SECRET).
  • DNS resolution for bot.<domain> returns the VPS IP from at least one external resolver.
  • nginx, Postgres, and Node LTS are installed on the VPS (nginx -v, psql --version, node --version all succeed).
Deneva MCP — Documentation1 — Minimal Telegram Bridge