Telegram Claude Bot - Session 2 Notes

Date: 2026-02-28

What We Worked On

Locked down bot access control to Eric's Telegram user ID (8630998612)
Full security hardening of the DigitalOcean Droplet
Saved all three credentials to 1Password (Claude Bot vault) and deleted the Desktop file
Updated session notes and scrubbed raw credentials from memory files

Access control: Bot locked to Eric's Telegram ID only — all other users get rejected
Security hardening: Applied all standard best practices for a VPS running a bot
1Password vault: All cloudbot credentials stored in the "Claude Bot" vault
Future enhancements deferred: GitHub integration, web search, and doctl CLI setup noted but not built yet

Added ALLOWED_USERS=8630998612 to /opt/claude-bot/.env
Enabled UFW firewall (SSH only)
Disabled SSH password authentication in /etc/ssh/sshd_config
Installed and enabled fail2ban
Created claude-bot system user — bot service now runs as this user instead of root
Updated /etc/systemd/system/claude-bot.service to User=claude-bot
Changed ownership of /opt/claude-bot/ to claude-bot:claude-bot

Updated /Users/edowns/.claude/project-notes/telegram-claude-bot/session-2026-02-28.md — marked all tasks complete
Updated /Users/edowns/.claude/projects/-Users-edowns-Projects/memory/telegram-bot-project.md — status set to complete, raw credentials removed, useful commands added
Deleted /Users/edowns/Desktop/CLAUDE-BOT-CREDENTIALS.md after saving to 1Password

Created: DigitalOcean Droplet (claude-telegram-bot) — root password, SSH details
Created: Anthropic API Key (telegram-bot) — API key, workspace info
Created: Telegram Bot Token (@heyroyalbot) — bot token, user ID

[ ] Add credit card to Anthropic account ($4.68 free credits expire Apr 1, 2026)
[ ] GitHub integration (search repos from the bot) — future enhancement
[ ] Web search capability — future enhancement
[ ] doctl CLI setup for Droplet management — future enhancement

Bot uses polling (outbound only) — no inbound ports needed beyond SSH
systemctl restart claude-bot to restart after code changes
journalctl -u claude-bot -f to tail logs
SSH password login is disabled — if locked out, use DO console with root password from 1Password
Ubuntu service name is ssh not sshd (restart failed with wrong name during hardening)
Telegram getUpdates API returns empty when bot is polling — use /whoami command or sendMessage API to test instead
Bot uses ~45MB RAM on 512MB Droplet — plenty of headroom

Session saved 2026-02-28 ~5:15 PM