RAG · Telegram · Access control
Campus Saathi Bot
A Telegram bot that answers campus questions from official documents — a RAG pipeline with role-based access restricted to @iiitdwd.ac.in accounts.
Demo
Watch it in action
The walkthrough video will live here — script, output, and runtime demo in one take.
Recording in progress
Project details
What it does, end to end
- Two bots on one FastAPI server: a student bot (ask questions) and an admin bot (upload official PDFs and manage the knowledge base).
- Document uploads are parsed (pypdf), chunked and embedded through LlamaIndex, and stored in an Astra DB vector store.
- Access control: Firebase OTP verification restricts the student bot to @iiitdwd.ac.in emails — domain-restricted, role-based access.
- Deployed on Render via webhooks (Procfile: python main.py) with startup health checks and non-PDF uploads rejected.
2025 — 2026
Tech stack
Built with
Architecture
How it works
Problem & solution
Why it exists
Problem
Campus questions (fees, hostel, exams, admissions) get asked in a hundred group chats every semester, and the answers live in PDFs nobody reads. Students repeat questions; admins repeat answers.
Solution
Put the official documents behind a RAG bot: admins upload PDFs once, students verify their institute email with a one-time code, and the bot answers from the document store — domain-restricted and role-aware.
Technical details
Under the hood
- FastAPI app hosting both Telegram webhook apps in one lifespan, with /student-webhook and /admin-webhook endpoints.
- LlamaIndex + Aguastastra vector store integration for retrieval; firebase-admin for OTP auth; pypdf for parsing.
- RAG answer path: verified student → query → top-k retrieval from Astra DB → synthesized answer in Telegram.
- Keep-alive web server (required by Render's free tier) for long-running bots.
Impacts
What changed
- One bot answers the questions new students ask every semester — admissions, fees, hostel, and exam info — from official documents.
- Access control keeps answers trustworthy: only verified students of the institute can use it.
- First RAG + Telegram integration deployed with real auth on the campus stack.
Learnings
Lessons that stuck
- 01Auth-then-retrieve beats retrieve-then-auth: verifying the user first keeps the knowledge base private and the bot in bounds.
- 02Telegram webhooks + a long-lived server process need deliberate design — lifespan hooks and health endpoints are the backbone.
- 03Vector store choice (Astra DB) unlocked a free-tier serverless deployment — infra decisions can be product decisions.
- 04Rejecting bad input loudly (non-PDF files) is better than silently degrading the knowledge base.
Challenges & mistakes
What broke, and what it taught me
Mistake 01
Free-tier hosting kills long-polling bots when the process idles out.
Lesson learned
Run a keep-alive FastAPI server and Telegram webhooks instead — the state lives on Telegram's side, not yours.
Mistake 02
Anyone with the bot link could ask anything before OTP verification existed.
Lesson learned
Domain-restricted Firebase OTP (iiitdwd.ac.in) closed it — put access control at the door, not deep in the code.
Mistake 03
Non-PDF uploads polluted the knowledge base with noise.
Lesson learned
Validate at the boundary: reject unparseable files with a clear message before they touch the vector store.