Enforce Telegram relay and DNS resolvers

start.sh

@@ -9,8 +9,26 @@ export OPENCLAW_HOST="0.0.0.0"
 export OPENCLAW_PORT
 export SYNC_INTERVAL="${SYNC_INTERVAL:-300}"
 export PLAYWRIGHT_BROWSERS_PATH="${PLAYWRIGHT_BROWSERS_PATH:-/ms-playwright}"
+export TELEGRAM_API_ROOT="${TELEGRAM_API_ROOT:-https://tg-relay.markdevil11.workers.dev}"
+export OPENCLAW_TELEGRAM_API_ROOT="${OPENCLAW_TELEGRAM_API_ROOT:-${TELEGRAM_API_ROOT}}"
+
+configure_dns() {
+  if [ -w /etc/resolv.conf ]; then
+    cat > /etc/resolv.conf <<'EOF'
+nameserver 1.1.1.1
+nameserver 1.0.0.1
+nameserver 8.8.8.8
+nameserver 8.8.4.4
+options timeout:2 attempts:3 rotate
+EOF
+    echo "DNS configured with Cloudflare and Google resolvers."
+  else
+    echo "WARN: /etc/resolv.conf is not writable; keeping existing DNS."
+  fi
+}
 
 mkdir -p /root/workspace
+configure_dns
 
 /app/sync-root-data.sh restore
 mkdir -p /root/.openclaw
@@ -80,7 +98,7 @@ generate_openclaw_config() {
       "botToken": "${TELEGRAM_BOT_TOKEN:-}",
       "dmPolicy": "allowlist",
       "allowFrom": [${allow_id}],
-      "apiRoot": "https://tg-relay.markdevil11.workers.dev",
+      "apiRoot": "${TELEGRAM_API_ROOT}",
       "webhookUrl": "https://elysiadev11-openclaw.hf.space/tg-webhook",
       "webhookSecret": "${OPENCLAW_GATEWAY_PASSWORD:-}",
       "webhookPath": "/tg-webhook",
@@ -120,6 +138,33 @@ else
   echo "Existing /root/.openclaw/openclaw.json found; keeping it."
 fi
 
+python3 - <<'PY'
+import json
+import os
+from pathlib import Path
+
+path = Path('/root/.openclaw/openclaw.json')
+api_root = os.environ.get('TELEGRAM_API_ROOT', 'https://tg-relay.markdevil11.workers.dev')
+if not path.exists():
+    raise SystemExit(0)
+
+try:
+    data = json.loads(path.read_text())
+except Exception as exc:
+    print(f'WARN: cannot update Telegram apiRoot in openclaw.json: {exc}')
+    raise SystemExit(0)
+
+channels = data.setdefault('channels', {})
+telegram = channels.setdefault('telegram', {})
+old = telegram.get('apiRoot')
+if old != api_root:
+    telegram['apiRoot'] = api_root
+    path.write_text(json.dumps(data, indent=2) + '\n')
+    print(f'Updated Telegram apiRoot: {old!r} -> {api_root!r}')
+else:
+    print(f'Telegram apiRoot already set to {api_root}')
+PY
+
 /app/sync-root-data.sh loop &
 
 run_openclaw() {