AutoTelegramForward v2.2.4

AutoTelegramForward v2.2.4 — True Single-File Cross-Platform Release

One Single Executable, All 4 Microservices.
AutoTelegramForward is a high-performance Telegram MTProto forwarding and routing suite engineered with clean microservice boundaries. Every platform release is a self-contained, native single executable that embeds and orchestrates all four decoupled services with zero external dependencies (no Python, Go, Rust, Node.js, or compiler toolchains required on host systems):

1. Python Core Engine (:6001) — Telegram MTProto client pool, rule engine, smart routing, link sanitization, and multi-provider AI text transformations.
2. Rust Logger Engine (:6002) — High-throughput gRPC log ingestion with secret redaction, queryable structured logs, and a dedicated SQLite archive.
3. Go REST API (:8080) — Production control-plane, OpenAPI REST endpoints for rules, sessions, and telemetry.
4. Rust Axum Web Gateway & React Dashboard (:8088) — Zero-dependency web server embedding the React Single Page App, providing security headers, high-throughput reverse proxying to the Go API, and health metrics.

---

Quick Start Guide (Linux / macOS / WSL)

1. Download the single-file binary:

   curl -fsSL https://github.com/Opselon/AutoTelegramForward/releases/latest/download/atf-linux-x64 -o atf && chmod +x atf

   (For Apple Silicon macOS, use atf-macos-arm64; for macOS Intel, use atf-macos-x64)

2. Interactive Onboarding & Setup Wizard:

   ./atf setup

   Only asks for your Telegram Bot Token from @BotFather and optional Admin User ID.
   To run non-interactively (CI/CD):

   ./atf setup --token "123456:ABC-DEF..." --admin 123456789 --lang en --start

3. Start All Services with One Command:

   ./atf start

4. Verify Live Status & Health:

   ./atf status
   ./atf health

5. Open Web Dashboard:
   Open http://localhost:8088 in your browser to access the live React Management Dashboard.

---

Windows (PowerShell)

curl.exe -fsSL https://github.com/Opselon/AutoTelegramForward/releases/latest/download/atf-windows-x64.exe -o atf.exe
.\atf.exe setup
.\atf.exe start
.\atf.exe status

---

Production OS Background Service (Auto-Start on Boot)

Run all services continuously in the background managed by your operating system:

# Linux (systemd user unit)
./atf service install

# Check service status
./atf status

# Tail live service logs
./atf logs

---

Docker & Kubernetes Deployments

Docker Compose (All 4 Microservices):

curl -fsSL https://raw.githubusercontent.com/Opselon/AutoTelegramForward/master/docker-compose.yml -o docker-compose.yml
docker compose up -d
# or via CLI:
./atf docker up

Kubernetes (Production Cluster Manifests):

./atf k8s apply
# or kubectl:
kubectl apply -f https://raw.githubusercontent.com/Opselon/AutoTelegramForward/master/k8s/all-in-one.yaml

---

Official Single-File Artifacts

Binary	Platform	Architecture	Verification
atf-linux-x64	Linux	x86_64	Self-contained single-file executable
atf-linux-arm64	Linux	ARM64 / aarch64	Raspberry Pi 4/5, ARM VPS, Graviton
atf-macos-x64	macOS	Intel x86_64	Self-contained single-file executable
atf-macos-arm64	macOS	Apple Silicon (M1/M2/M3/M4)	Self-contained single-file executable
atf-windows-x64.exe	Windows	x64	Windows native standalone executable
atf-*-portable.tar.gz	Cross-platform	Portable directory	One-directory portable bundle
	Android	ARM64	Flutter release APK (per-ABI)
	Android	ARMv7	Flutter release APK (per-ABI)
	Android	x86_64	Flutter release APK (per-ABI)
	Android	Universal	Play Store App Bundle
	Any POSIX	Source bundle	Source distribution

SHA-256 Checksums Verification

Download SHA256SUMS.txt from the release assets and verify integrity:

sha256sum -c SHA256SUMS.txt

What's Changed

• Dead-letter queue: one owner-scoped contract, honest replay, bot + CLI + web recovery by @Opselon in #148
• Let a refused action say so on the wire (proto3 omitempty) and hold every client to it by @Opselon in #149
• Keep --json a promise: a refused dead-letter action still emits its body by @Opselon in #150
• Dashboard login: a single-use code, never a Telegram user id by @Opselon in #151
• Sessions were signed with a key anyone can compute (db path) by @Opselon in #152
• A tenant can set its own endpoint and key, and test them (web + bot + Android) by @Opselon in #153
• A refused endpoint reads as a refusal, and a private peer stays usable by @Opselon in #154
• Version 2.2.3 by @Opselon in #155
• Version 2.2.4: a task can only use its own tenant's bot, and the bot panel fails closed by @Opselon in #156
• A rule that names a session that does not exist is a refusal, not a 500 by @Opselon in #157

Full Changelog: v2.2.2...v2.2.4