Telegram Webhook Setup Prompt for Hermes on Oracle VM

Prompt

Set up Telegram webhook receiving for Hermes.
Site: nginx with a TLS cert is already serving https://<your-domain>

Placeholders to substitute first:
  DOMAIN       = <your-domain>                       e.g. www.m3ktab.com
  WEBHOOK_PATH = <path>                              e.g. api/telegram
  BOT_TOKEN    = <bot token>                          e.g. 8517064643:xxxx

Steps:
1. Verify the site answers over TLS:
   curl -I https://<DOMAIN>/  → expect HTTP 200, nginx.
2. Add the telegram webhook settings to the ACTIVE profile's secret store
   (~/.hermes/.env, or $HERMES_HOME if a profile). Do NOT put these in
   config.yaml — the Telegram adapter reads them from secret scope only:
     TELEGRAM_WEBHOOK_URL=https://<DOMAIN>/<WEBHOOK_PATH>
     TELEGRAM_WEBHOOK_SECRET=<generate a 64-char hex, e.g. secrets.token_hex(32)>
   Strip/replace any existing TELEGRAM_WEBHOOK_* lines first. Never print secrets.
3. Register the webhook with Telegram, passing the secret as secret_token so
   updates are signed (verify Telegram returns {"ok":true}):
   POST https://api.telegram.org/bot<BOT_TOKEN>/setWebhook
        url=https://<DOMAIN>/<WEBHOOK_PATH>
        secret_token=<TELEGRAM_WEBHOOK_SECRET>
4. Point nginx's <WEBHOOK_PATH> location to Hermes's webhook listener (default
   port 8443, host 0.0.0.0): proxy_pass http://127.0.0.1:8443; then reload
   nginx. Warn me if an existing service already owns that path (e.g. an old
   receiver script on port 8080) so it doesn't fight Hermes for updates.
5. Tell me to run hermes gateway setup, enable the Telegram platform, and
   enter the bot token. The gateway reads TELEGRAM_WEBHOOK_URL + TELEGRAM_WEBHOOK_SECRET
   from .env, starts the 8443 listener, and pulls updates.
6. Verify: curl https://api.telegram.org/bot<BOT_TOKEN>/getWebhookInfo and
   confirm url matches and pending_update_count is low after a test message.

Note: webhook mode disables long-polling (getUpdates) for this bot — intentional.