Host a Telegram Bot on a VPS

One core and 1 GB of RAM runs a text bot for thousands of daily users — buy memory for the work the bot does, not for the number of people who might message it.

Size the disk at 20 GB or more if you keep logs and media, and check current tiers on the pricing page before choosing. Avoid 512 MB for the build step even if the bot would fit afterwards: installing Python packages with a C extension on 512 MB regularly runs out of memory, and the failure looks like a broken requirement rather than a small server.

Run the bot under a systemd unit with Restart=always so it survives crashes and reboots — the restart line is the point of the exercise.

# /etc/systemd/system/tgbot.service
[Unit]
Description=Telegram bot
After=network-online.target

[Service]
User=botuser
WorkingDirectory=/home/botuser/bot
EnvironmentFile=/home/botuser/bot/.env
ExecStart=/home/botuser/bot/venv/bin/python bot.py
Restart=always
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target

1. Run sudo systemctl daemon-reload, then sudo systemctl enable --now tgbot.
2. Check state with systemctl status tgbot and follow output with journalctl -u tgbot -f.
3. Kill the process deliberately with sudo systemctl kill tgbot; it should be back within five seconds, proving the restart policy works.

It worked when status shows active (running), the journal shows your startup line, and a message to the bot is answered after a reboot with no one logged in. A screen or tmux session survives a disconnect but not a reboot, and it will not restart the bot after a crash.

A webhook needs three things in order: a DNS record, a TLS certificate, and a proxy that forwards Telegram's POST to your bot's local port.

1. Point a subdomain such as bot.yourdomain.com at the server's IP with an A record, and wait for it to resolve.
2. Run sudo apt install -y nginx certbot python3-certbot-nginx, then sudo certbot --nginx -d bot.yourdomain.com.
3. In the nginx site config, add a location block that proxies to 127.0.0.1:8443 with proxy_pass, passing the Host and X-Forwarded-For headers.
4. Set the webhook: curl "https://api.telegram.org/bot$BOT_TOKEN/setWebhook?url=https://bot.yourdomain.com/$BOT_TOKEN"
5. Check it with curl "https://api.telegram.org/bot$BOT_TOKEN/getWebhookInfo" — the URL should match and last_error_message should be empty.

Put the token in the webhook path as well as the URL you publish: a bare /webhook endpoint collects junk requests from scanners within hours. Better still, setWebhook accepts a secret_token that Telegram delivers in the X-Telegram-Bot-Api-Secret-Token header on every update, which your bot can verify and reject everything else.

Most bot outages are one of four things — the process died, the token is wrong, two instances are polling, or the server ran out of memory — and all four are visible in the journal within a minute.

• Nothing in the chat: journalctl -u tgbot -n 50 and look for a startup exception, usually a missing environment variable.
• 409 Conflict: a second copy is running. Stop the duplicate, or clear the webhook if you switched back to polling.
• OOM killer: a large file or model exceeded RAM. Resize the VPS rather than adding swap, which only postpones it.
• Silent stop after weeks: check that Restart=always is set and the service is enabled, not just started.

Schedule a monthly update: activate the venv, run pip list --outdated, upgrade one package at a time, and restart the service. A bot that has not been updated in a year is a bot running a library with known bugs.