diff --git a/docker/docker-compose.yaml b/docker/docker-compose.yaml index 00b04be1e9c..966b30c5879 100644 --- a/docker/docker-compose.yaml +++ b/docker/docker-compose.yaml @@ -4,30 +4,29 @@ # or docker-compose-template.yaml and regenerate this file. # ================================================================== -# Shared configuration using YAML anchors and env_file x-shared-api-worker-config: &shared-api-worker-config env_file: - - path: ./docker/envs/core-services/shared.env + - path: ./envs/core-services/shared.env required: false - - path: ./docker/envs/core-services/api.env + - path: ./envs/core-services/api.env required: false - - path: ./docker/envs/security.env + - path: ./envs/security.env required: false - - path: ./docker/envs/databases/db-postgres.env + - path: ./envs/databases/db-postgres.env required: false - - path: ./docker/envs/databases/db-mysql.env + - path: ./envs/databases/db-mysql.env required: false - - path: ./docker/envs/databases/redis.env + - path: ./envs/databases/redis.env required: false - - path: ./docker/envs/vectorstores/weaviate.env + - path: ./envs/vectorstores/weaviate.env required: false - - path: ./docker/envs/infrastructure/nginx.env + - path: ./envs/infrastructure/nginx.env required: false - - path: ./docker/envs/infrastructure/certbot.env + - path: ./envs/infrastructure/certbot.env required: false - - path: ./docker/envs/infrastructure/ssrf-proxy.env + - path: ./envs/infrastructure/ssrf-proxy.env required: false - - ./docker/.env + - ./.env networks: - ssrf_proxy_network - default @@ -35,27 +34,27 @@ x-shared-api-worker-config: &shared-api-worker-config x-shared-worker-config: &shared-worker-config env_file: - - path: ./docker/envs/core-services/shared.env + - path: ./envs/core-services/shared.env required: false - - path: ./docker/envs/core-services/worker.env + - path: ./envs/core-services/worker.env required: false - - path: ./docker/envs/security.env + - path: ./envs/security.env required: false - - path: ./docker/envs/databases/db-postgres.env + - path: ./envs/databases/db-postgres.env required: false - - path: ./docker/envs/databases/db-mysql.env + - path: ./envs/databases/db-mysql.env required: false - - path: ./docker/envs/databases/redis.env + - path: ./envs/databases/redis.env required: false - - path: ./docker/envs/vectorstores/weaviate.env + - path: ./envs/vectorstores/weaviate.env required: false - - path: ./docker/envs/infrastructure/nginx.env + - path: ./envs/infrastructure/nginx.env required: false - - path: ./docker/envs/infrastructure/certbot.env + - path: ./envs/infrastructure/certbot.env required: false - - path: ./docker/envs/infrastructure/ssrf-proxy.env + - path: ./envs/infrastructure/ssrf-proxy.env required: false - - ./docker/.env + - ./.env networks: - ssrf_proxy_network - default @@ -63,34 +62,33 @@ x-shared-worker-config: &shared-worker-config x-shared-worker-beat-config: &shared-worker-beat-config env_file: - - path: ./docker/envs/core-services/shared.env + - path: ./envs/core-services/shared.env required: false - - path: ./docker/envs/core-services/worker-beat.env + - path: ./envs/core-services/worker-beat.env required: false - - path: ./docker/envs/security.env + - path: ./envs/security.env required: false - - path: ./docker/envs/databases/db-postgres.env + - path: ./envs/databases/db-postgres.env required: false - - path: ./docker/envs/databases/db-mysql.env + - path: ./envs/databases/db-mysql.env required: false - - path: ./docker/envs/databases/redis.env + - path: ./envs/databases/redis.env required: false - - path: ./docker/envs/vectorstores/weaviate.env + - path: ./envs/vectorstores/weaviate.env required: false - - path: ./docker/envs/infrastructure/nginx.env + - path: ./envs/infrastructure/nginx.env required: false - - path: ./docker/envs/infrastructure/certbot.env + - path: ./envs/infrastructure/certbot.env required: false - - path: ./docker/envs/infrastructure/ssrf-proxy.env + - path: ./envs/infrastructure/ssrf-proxy.env required: false - - ./docker/.env + - ./.env networks: - ssrf_proxy_network - default restart: always services: - # Init container to fix permissions init_permissions: image: busybox:latest command: @@ -106,43 +104,24 @@ services: chown -R 1001:1001 /app/api/storage && touch "$${FLAG_FILE}" echo "Permissions initialized. Exiting." volumes: - - ./docker/volumes/app/storage:/app/api/storage + - ./volumes/app/storage:/app/api/storage restart: "no" - # API service api: <<: *shared-api-worker-config image: langgenius/dify-api:1.16.1 environment: MODE: api - SENTRY_DSN: ${API_SENTRY_DSN:-} - SENTRY_TRACES_SAMPLE_RATE: ${API_SENTRY_TRACES_SAMPLE_RATE:-1.0} - SENTRY_PROFILES_SAMPLE_RATE: ${API_SENTRY_PROFILES_SAMPLE_RATE:-1.0} - PLUGIN_REMOTE_INSTALL_HOST: ${EXPOSE_PLUGIN_DEBUGGING_HOST:-localhost} - PLUGIN_REMOTE_INSTALL_PORT: ${EXPOSE_PLUGIN_DEBUGGING_PORT:-5003} - PLUGIN_MAX_PACKAGE_SIZE: ${PLUGIN_MAX_PACKAGE_SIZE:-52428800} - PLUGIN_DAEMON_TIMEOUT: ${PLUGIN_DAEMON_TIMEOUT:-600.0} - INNER_API_KEY_FOR_PLUGIN: ${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1} - AGENT_BACKEND_BASE_URL: ${AGENT_BACKEND_BASE_URL:-http://agent_backend:5050} - AGENT_BACKEND_API_TOKEN: ${DIFY_AGENT_API_TOKEN:-dify-agent-run-token-for-dev-only} - AGENT_BACKEND_STREAM_READ_TIMEOUT_SECONDS: ${AGENT_BACKEND_STREAM_READ_TIMEOUT_SECONDS:-30} - AGENT_BACKEND_STREAM_MAX_RECONNECTS: ${AGENT_BACKEND_STREAM_MAX_RECONNECTS:-3} - AGENT_BACKEND_RUN_TIMEOUT_SECONDS: ${AGENT_BACKEND_RUN_TIMEOUT_SECONDS:-1200} depends_on: init_permissions: condition: service_completed_successfully db_postgres: condition: service_healthy required: false - db_mysql: - condition: service_healthy - required: false redis: condition: service_started - agent_backend: - condition: service_started volumes: - - ./docker/volumes/app/storage:/app/api/storage + - ./volumes/app/storage:/app/api/storage healthcheck: test: ["CMD", "curl", "-f", "http://localhost:5001/health"] interval: 30s @@ -150,7 +129,6 @@ services: retries: 3 start_period: 30s - # WebSocket service for workflow collaboration. api_websocket: <<: *shared-api-worker-config image: langgenius/dify-api:1.16.1 @@ -158,60 +136,35 @@ services: - collaboration environment: MODE: api - SERVER_WORKER_AMOUNT: ${API_WEBSOCKET_WORKER_AMOUNT:-1} - SERVER_WORKER_CLASS: ${API_WEBSOCKET_WORKER_CLASS:-geventwebsocket.gunicorn.workers.GeventWebSocketWorker} - SERVER_WORKER_CONNECTIONS: ${API_WEBSOCKET_WORKER_CONNECTIONS:-1000} - GUNICORN_TIMEOUT: ${API_WEBSOCKET_GUNICORN_TIMEOUT:-360} depends_on: db_postgres: condition: service_healthy required: false - db_mysql: - condition: service_healthy - required: false redis: condition: service_started - # worker service worker: <<: *shared-worker-config image: langgenius/dify-api:1.16.1 environment: MODE: worker - SENTRY_DSN: ${API_SENTRY_DSN:-} - SENTRY_TRACES_SAMPLE_RATE: ${API_SENTRY_TRACES_SAMPLE_RATE:-1.0} - SENTRY_PROFILES_SAMPLE_RATE: ${API_SENTRY_PROFILES_SAMPLE_RATE:-1.0} - PLUGIN_MAX_PACKAGE_SIZE: ${PLUGIN_MAX_PACKAGE_SIZE:-52428800} - INNER_API_KEY_FOR_PLUGIN: ${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1} - AGENT_BACKEND_BASE_URL: ${AGENT_BACKEND_BASE_URL:-http://agent_backend:5050} - AGENT_BACKEND_API_TOKEN: ${DIFY_AGENT_API_TOKEN:-dify-agent-run-token-for-dev-only} - AGENT_BACKEND_STREAM_READ_TIMEOUT_SECONDS: ${AGENT_BACKEND_STREAM_READ_TIMEOUT_SECONDS:-30} - AGENT_BACKEND_STREAM_MAX_RECONNECTS: ${AGENT_BACKEND_STREAM_MAX_RECONNECTS:-3} - AGENT_BACKEND_RUN_TIMEOUT_SECONDS: ${AGENT_BACKEND_RUN_TIMEOUT_SECONDS:-1200} depends_on: init_permissions: condition: service_completed_successfully db_postgres: condition: service_healthy required: false - db_mysql: - condition: service_healthy - required: false redis: condition: service_started - agent_backend: - condition: service_started volumes: - - ./docker/volumes/app/storage:/app/api/storage + - ./volumes/app/storage:/app/api/storage healthcheck: test: ["CMD-SHELL", "celery -A celery_healthcheck.celery inspect ping"] - interval: ${COMPOSE_WORKER_HEALTHCHECK_INTERVAL:-30s} - timeout: ${COMPOSE_WORKER_HEALTHCHECK_TIMEOUT:-30s} + interval: 30s + timeout: 30s retries: 3 start_period: 60s - disable: ${COMPOSE_WORKER_HEALTHCHECK_DISABLED:-true} - # worker_beat service worker_beat: <<: *shared-worker-beat-config image: langgenius/dify-api:1.16.1 @@ -223,59 +176,25 @@ services: db_postgres: condition: service_healthy required: false - db_mysql: - condition: service_healthy - required: false redis: condition: service_started healthcheck: test: ["CMD-SHELL", "celery -A celery_healthcheck.celery inspect ping"] - interval: ${COMPOSE_WORKER_HEALTHCHECK_INTERVAL:-30s} - timeout: ${COMPOSE_WORKER_HEALTHCHECK_TIMEOUT:-30s} + interval: 30s + timeout: 30s retries: 3 start_period: 60s - disable: ${COMPOSE_WORKER_HEALTHCHECK_DISABLED:-true} - # Frontend web application. web: image: langgenius/dify-web:1.16.1 restart: always env_file: - - path: ./docker/envs/core-services/web.env + - path: ./envs/core-services/web.env required: false - - path: ./docker/envs/security.env + - path: ./envs/security.env required: false - - ./docker/.env - environment: - CONSOLE_API_URL: ${CONSOLE_API_URL:-} - SERVER_CONSOLE_API_URL: ${SERVER_CONSOLE_API_URL:-http://api:5001} - APP_API_URL: ${APP_API_URL:-} - AMPLITUDE_API_KEY: ${AMPLITUDE_API_KEY:-} - COOKIEYES_SITE_KEY: ${COOKIEYES_SITE_KEY:-} - NEXT_PUBLIC_COOKIE_DOMAIN: ${NEXT_PUBLIC_COOKIE_DOMAIN:-} - NEXT_PUBLIC_SOCKET_URL: ${NEXT_PUBLIC_SOCKET_URL:-ws://localhost} - SENTRY_DSN: ${WEB_SENTRY_DSN:-} - NEXT_TELEMETRY_DISABLED: ${NEXT_TELEMETRY_DISABLED:-0} - EXPERIMENTAL_ENABLE_VINEXT: ${EXPERIMENTAL_ENABLE_VINEXT:-false} - TEXT_GENERATION_TIMEOUT_MS: ${TEXT_GENERATION_TIMEOUT_MS:-60000} - WORKFLOW_GENERATION_TIMEOUT_MS: ${WORKFLOW_GENERATION_TIMEOUT_MS:-180000} - CSP_WHITELIST: ${CSP_WHITELIST:-} - ALLOW_EMBED: ${ALLOW_EMBED:-false} - ALLOW_UNSAFE_DATA_SCHEME: ${ALLOW_UNSAFE_DATA_SCHEME:-false} - MARKETPLACE_API_URL: ${MARKETPLACE_API_URL:-https://marketplace.dify.ai} - MARKETPLACE_URL: ${MARKETPLACE_URL:-https://marketplace.dify.ai} - TOP_K_MAX_VALUE: ${TOP_K_MAX_VALUE:-10} - INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH: ${INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH:-4000} - LOOP_NODE_MAX_COUNT: ${LOOP_NODE_MAX_COUNT:-100} - MAX_TOOLS_NUM: ${MAX_TOOLS_NUM:-10} - MAX_PARALLEL_LIMIT: ${MAX_PARALLEL_LIMIT:-10} - MAX_ITERATIONS_NUM: ${MAX_ITERATIONS_NUM:-99} - MAX_TREE_DEPTH: ${MAX_TREE_DEPTH:-50} - ENABLE_WEBSITE_JINAREADER: ${ENABLE_WEBSITE_JINAREADER:-true} - ENABLE_WEBSITE_FIRECRAWL: ${ENABLE_WEBSITE_FIRECRAWL:-true} - ENABLE_WEBSITE_WATERCRAWL: ${ENABLE_WEBSITE_WATERCRAWL:-true} + - ./.env - # The PostgreSQL database. db_postgres: image: postgres:15-alpine profiles: @@ -286,241 +205,90 @@ services: POSTGRES_PASSWORD: ${DB_PASSWORD:-difyai123456} POSTGRES_DB: ${DB_DATABASE:-dify} PGDATA: ${PGDATA:-/var/lib/postgresql/data/pgdata} - command: > - postgres -c 'max_connections=${POSTGRES_MAX_CONNECTIONS:-100}' - -c 'shared_buffers=${POSTGRES_SHARED_BUFFERS:-128MB}' - -c 'work_mem=${POSTGRES_WORK_MEM:-4MB}' - -c 'maintenance_work_mem=${POSTGRES_MAINTENANCE_WORK_MEM:-64MB}' - -c 'effective_cache_size=${POSTGRES_EFFECTIVE_CACHE_SIZE:-4096MB}' - -c 'statement_timeout=${POSTGRES_STATEMENT_TIMEOUT:-0}' - -c 'idle_in_transaction_session_timeout=${POSTGRES_IDLE_IN_TRANSACTION_SESSION_TIMEOUT:-0}' volumes: - - ./docker/volumes/db/data:/var/lib/postgresql/data + - ./volumes/db/data:/var/lib/postgresql/data healthcheck: - test: - [ - "CMD", - "pg_isready", - "-h", - "db_postgres", - "-U", - "${DB_USERNAME:-postgres}", - "-d", - "${DB_DATABASE:-dify}", - ] + test: ["CMD", "pg_isready", "-h", "db_postgres", "-U", "${DB_USERNAME:-postgres}", "-d", "${DB_DATABASE:-dify}"] interval: 1s timeout: 3s retries: 60 - # The mysql database. - db_mysql: - image: mysql:8.0 - profiles: - - mysql - restart: always - environment: - MYSQL_ROOT_PASSWORD: ${DB_PASSWORD:-difyai123456} - MYSQL_DATABASE: ${DB_DATABASE:-dify} - command: > - --max_connections=${MYSQL_MAX_CONNECTIONS:-1000} - --innodb_buffer_pool_size=${MYSQL_INNODB_BUFFER_POOL_SIZE:-512M} - --innodb_log_file_size=${MYSQL_INNODB_LOG_FILE_SIZE:-128M} - --innodb_flush_log_at_trx_commit=${MYSQL_INNODB_FLUSH_LOG_AT_TRX_COMMIT:-2} - volumes: - - ${MYSQL_HOST_VOLUME:-./docker/volumes/mysql/data}:/var/lib/mysql - healthcheck: - test: - [ - "CMD", - "mysqladmin", - "ping", - "-u", - "root", - "-p${DB_PASSWORD:-difyai123456}", - ] - interval: 1s - timeout: 3s - retries: 30 - - # The redis cache. redis: image: redis:6-alpine restart: always environment: REDISCLI_AUTH: ${REDIS_PASSWORD:-difyai123456} volumes: - - ./docker/volumes/redis/data:/data + - ./volumes/redis/data:/data command: redis-server --requirepass ${REDIS_PASSWORD:-difyai123456} healthcheck: - test: - [ - "CMD-SHELL", - "redis-cli -a ${REDIS_PASSWORD:-difyai123456} ping | grep -q PONG", - ] + test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD:-difyai123456} ping | grep -q PONG"] - # The DifySandbox sandbox: image: langgenius/dify-sandbox:0.2.15 restart: always env_file: - - path: ./docker/envs/core-services/sandbox.env + - path: ./envs/core-services/sandbox.env required: false - - path: ./docker/envs/security.env + - path: ./envs/security.env required: false - - ./docker/.env - environment: - API_KEY: ${SANDBOX_API_KEY:-dify-sandbox} - GIN_MODE: ${SANDBOX_GIN_MODE:-release} - WORKER_TIMEOUT: ${SANDBOX_WORKER_TIMEOUT:-15} - ENABLE_NETWORK: ${SANDBOX_ENABLE_NETWORK:-true} - HTTP_PROXY: ${SANDBOX_HTTP_PROXY:-http://ssrf_proxy:3128} - HTTPS_PROXY: ${SANDBOX_HTTPS_PROXY:-http://ssrf_proxy:3128} - SANDBOX_PORT: ${SANDBOX_PORT:-8194} - PIP_MIRROR_URL: ${PIP_MIRROR_URL:-} + - ./.env volumes: - - ./docker/volumes/sandbox/dependencies:/dependencies - - ./docker/volumes/sandbox/conf:/conf - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:8194/health"] + - ./volumes/sandbox/dependencies:/dependencies + - ./volumes/sandbox/conf:/conf networks: - ssrf_proxy_network - # Local sandbox for Dify Agent shell workspaces. local_sandbox: image: langgenius/dify-agent-local-sandbox:1.16.1 restart: always env_file: - - path: ./docker/envs/core-services/local-sandbox.env + - path: ./envs/core-services/local-sandbox.env required: false environment: - - SHELLCTL_AUTH_TOKEN=${DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN:-${DIFY_AGENT_SHELLCTL_AUTH_TOKEN:-}} - HTTP_PROXY=http://agent_ssrf_proxy:3128 - HTTPS_PROXY=http://agent_ssrf_proxy:3128 - NO_PROXY=localhost,127.0.0.1 - healthcheck: - test: ["CMD", "curl", "-f", "http://localhost:5004/healthz"] - interval: 30s - timeout: 5s - retries: 3 - start_period: 10s networks: - agent_sandbox_network - local_sandbox_proxy_network - # plugin daemon plugin_daemon: image: langgenius/dify-plugin-daemon:0.6.3-local restart: always env_file: - - path: ./docker/envs/core-services/shared.env + - path: ./envs/core-services/shared.env required: false - - path: ./docker/envs/core-services/plugin-daemon.env + - path: ./envs/core-services/plugin-daemon.env required: false - - path: ./docker/envs/security.env + - path: ./envs/security.env required: false - - path: ./docker/envs/databases/db-postgres.env + - path: ./envs/databases/db-postgres.env required: false - - path: ./docker/envs/databases/db-mysql.env + - path: ./envs/databases/redis.env required: false - - path: ./docker/envs/databases/redis.env - required: false - - ./docker/.env + - ./.env networks: - ssrf_proxy_network - default - environment: - DB_DATABASE: ${DB_PLUGIN_DATABASE:-dify_plugin} - DB_SSL_MODE: ${DB_SSL_MODE:-disable} - SERVER_PORT: ${PLUGIN_DAEMON_PORT:-5002} - SERVER_KEY: ${PLUGIN_DAEMON_KEY:-lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi} - MAX_PLUGIN_PACKAGE_SIZE: ${PLUGIN_MAX_PACKAGE_SIZE:-52428800} - PPROF_ENABLED: ${PLUGIN_PPROF_ENABLED:-false} - DIFY_INNER_API_URL: ${PLUGIN_DIFY_INNER_API_URL:-http://api:5001} - DIFY_INNER_API_KEY: ${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1} - PLUGIN_REMOTE_INSTALLING_HOST: ${PLUGIN_DEBUGGING_HOST:-0.0.0.0} - PLUGIN_REMOTE_INSTALLING_PORT: ${PLUGIN_DEBUGGING_PORT:-5003} - PLUGIN_WORKING_PATH: ${PLUGIN_WORKING_PATH:-/app/storage/cwd} - FORCE_VERIFYING_SIGNATURE: ${FORCE_VERIFYING_SIGNATURE:-true} - PYTHON_ENV_INIT_TIMEOUT: ${PLUGIN_PYTHON_ENV_INIT_TIMEOUT:-120} - PLUGIN_MAX_EXECUTION_TIMEOUT: ${PLUGIN_MAX_EXECUTION_TIMEOUT:-600} - PLUGIN_STDIO_BUFFER_SIZE: ${PLUGIN_STDIO_BUFFER_SIZE:-1024} - PLUGIN_STDIO_MAX_BUFFER_SIZE: ${PLUGIN_STDIO_MAX_BUFFER_SIZE:-5242880} - PIP_MIRROR_URL: ${PIP_MIRROR_URL:-} - PLUGIN_STORAGE_TYPE: ${PLUGIN_STORAGE_TYPE:-local} - PLUGIN_STORAGE_LOCAL_ROOT: ${PLUGIN_STORAGE_LOCAL_ROOT:-/app/storage} - PLUGIN_INSTALLED_PATH: ${PLUGIN_INSTALLED_PATH:-plugin} - PLUGIN_PACKAGE_CACHE_PATH: ${PLUGIN_PACKAGE_CACHE_PATH:-plugin_packages} - PLUGIN_MEDIA_CACHE_PATH: ${PLUGIN_MEDIA_CACHE_PATH:-assets} - PLUGIN_STORAGE_OSS_BUCKET: ${PLUGIN_STORAGE_OSS_BUCKET:-} - S3_USE_AWS_MANAGED_IAM: ${PLUGIN_S3_USE_AWS_MANAGED_IAM:-false} - S3_USE_AWS: ${PLUGIN_S3_USE_AWS:-false} - S3_ENDPOINT: ${PLUGIN_S3_ENDPOINT:-} - S3_USE_PATH_STYLE: ${PLUGIN_S3_USE_PATH_STYLE:-false} - AWS_ACCESS_KEY: ${PLUGIN_AWS_ACCESS_KEY:-} - AWS_SECRET_KEY: ${PLUGIN_AWS_SECRET_KEY:-} - AWS_REGION: ${PLUGIN_AWS_REGION:-} - AZURE_BLOB_STORAGE_CONNECTION_STRING: ${PLUGIN_AZURE_BLOB_STORAGE_CONNECTION_STRING:-} - AZURE_BLOB_STORAGE_CONTAINER_NAME: ${PLUGIN_AZURE_BLOB_STORAGE_CONTAINER_NAME:-} - TENCENT_COS_SECRET_KEY: ${PLUGIN_TENCENT_COS_SECRET_KEY:-} - TENCENT_COS_SECRET_ID: ${PLUGIN_TENCENT_COS_SECRET_ID:-} - TENCENT_COS_REGION: ${PLUGIN_TENCENT_COS_REGION:-} - ALIYUN_OSS_REGION: ${PLUGIN_ALIYUN_OSS_REGION:-} - ALIYUN_OSS_ENDPOINT: ${PLUGIN_ALIYUN_OSS_ENDPOINT:-} - ALIYUN_OSS_ACCESS_KEY_ID: ${PLUGIN_ALIYUN_OSS_ACCESS_KEY_ID:-} - ALIYUN_OSS_ACCESS_KEY_SECRET: ${PLUGIN_ALIYUN_OSS_ACCESS_KEY_SECRET:-} - ALIYUN_OSS_AUTH_VERSION: ${PLUGIN_ALIYUN_OSS_AUTH_VERSION:-v4} - ALIYUN_OSS_PATH: ${PLUGIN_ALIYUN_OSS_PATH:-} - VOLCENGINE_TOS_ENDPOINT: ${PLUGIN_VOLCENGINE_TOS_ENDPOINT:-} - VOLCENGINE_TOS_ACCESS_KEY: ${PLUGIN_VOLCENGINE_TOS_ACCESS_KEY:-} - VOLCENGINE_TOS_SECRET_KEY: ${PLUGIN_VOLCENGINE_TOS_SECRET_KEY:-} - VOLCENGINE_TOS_REGION: ${PLUGIN_VOLCENGINE_TOS_REGION:-} - SENTRY_ENABLED: ${PLUGIN_SENTRY_ENABLED:-false} - SENTRY_DSN: ${PLUGIN_SENTRY_DSN:-} - ports: - - "${EXPOSE_PLUGIN_DEBUGGING_PORT:-5003}:${PLUGIN_DEBUGGING_PORT:-5003}" volumes: - - ./docker/volumes/plugin_daemon:/app/storage + - ./volumes/plugin_daemon:/app/storage depends_on: db_postgres: condition: service_healthy required: false - db_mysql: - condition: service_healthy - required: false - # Dify Agent backend service. agent_backend: image: langgenius/dify-agent-backend:1.16.1 restart: always env_file: - - path: ./docker/envs/core-services/dify-agent.env + - path: ./envs/core-services/dify-agent.env required: false - - path: ./docker/envs/security.env + - path: ./envs/security.env required: false - - path: ./docker/envs/databases/redis.env + - path: ./envs/databases/redis.env required: false - - ./docker/.env - environment: - DIFY_AGENT_REDIS_URL: ${DIFY_AGENT_REDIS_URL:-redis://:${REDIS_PASSWORD:-difyai123456}@redis:6379/2} - DIFY_AGENT_REDIS_PREFIX: ${DIFY_AGENT_REDIS_PREFIX:-dify-agent} - DIFY_AGENT_PLUGIN_DAEMON_URL: ${DIFY_AGENT_PLUGIN_DAEMON_URL:-${PLUGIN_DAEMON_URL:-http://plugin_daemon:5002}} - DIFY_AGENT_PLUGIN_DAEMON_API_KEY: ${DIFY_AGENT_PLUGIN_DAEMON_API_KEY:-${PLUGIN_DAEMON_KEY:-lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi}} - DIFY_AGENT_INNER_API_URL: ${DIFY_AGENT_INNER_API_URL:-${PLUGIN_DIFY_INNER_API_URL:-http://api:5001}} - DIFY_AGENT_INNER_API_KEY: ${DIFY_AGENT_INNER_API_KEY:-${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1}} - DIFY_AGENT_RUNTIME_BACKEND: ${DIFY_AGENT_RUNTIME_BACKEND:-local} - DIFY_AGENT_LOCAL_SANDBOX_ENDPOINT: ${DIFY_AGENT_LOCAL_SANDBOX_ENDPOINT:-${DIFY_AGENT_SHELLCTL_ENTRYPOINT:-http://local_sandbox:5004}} - DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN: ${DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN:-${DIFY_AGENT_SHELLCTL_AUTH_TOKEN:-}} - DIFY_AGENT_E2B_API_KEY: ${DIFY_AGENT_E2B_API_KEY:-${E2B_API_KEY:-${E2B_API_TOKEN:-}}} - DIFY_AGENT_E2B_TEMPLATE: ${DIFY_AGENT_E2B_TEMPLATE:-difys-default-team/dify-agent-local-sandbox} - DIFY_AGENT_E2B_ACTIVE_TIMEOUT_SECONDS: ${DIFY_AGENT_E2B_ACTIVE_TIMEOUT_SECONDS:-3600} - DIFY_AGENT_E2B_SHELLCTL_AUTH_TOKEN: ${DIFY_AGENT_E2B_SHELLCTL_AUTH_TOKEN:-} - DIFY_AGENT_E2B_SHELLCTL_PORT: ${DIFY_AGENT_E2B_SHELLCTL_PORT:-5004} - DIFY_AGENT_SANDBOX_FILE_UPLOAD_MAX_BYTES: ${PLUGIN_MAX_FILE_SIZE:-52428800} - DIFY_AGENT_STUB_API_BASE_URL: ${DIFY_AGENT_STUB_API_BASE_URL:-http://agent_backend:5050/agent-stub} - DIFY_AGENT_SERVER_SECRET_KEY: ${DIFY_AGENT_SERVER_SECRET_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY} - DIFY_AGENT_API_TOKEN: ${DIFY_AGENT_API_TOKEN:-dify-agent-run-token-for-dev-only} - DIFY_AGENT_SHUTDOWN_GRACE_SECONDS: ${DIFY_AGENT_SHUTDOWN_GRACE_SECONDS:-30} - DIFY_AGENT_RUN_RETENTION_SECONDS: ${DIFY_AGENT_RUN_RETENTION_SECONDS:-259200} + - ./.env depends_on: redis: condition: service_started @@ -530,135 +298,52 @@ services: - default - agent_sandbox_network - # Dedicated SSRF proxy for the dify-agent local_sandbox. agent_ssrf_proxy: image: ubuntu/squid:latest restart: always volumes: - - ./docker/ssrf_proxy/squid-agent.conf.template:/etc/squid/squid.conf.template - - ./docker/ssrf_proxy/squid-common.conf.template:/etc/squid/dify_common.conf.template - - ./docker/ssrf_proxy/docker-agent-entrypoint.sh:/docker-entrypoint-mount.sh - entrypoint: - [ - "sh", - "-c", - "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh", - ] - environment: - HTTP_PORT: ${SSRF_HTTP_PORT:-3128} - COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid} + - ./ssrf_proxy/squid-agent.conf.template:/etc/squid/squid.conf.template + - ./ssrf_proxy/squid-common.conf.template:/etc/squid/dify_common.conf.template + - ./ssrf_proxy/docker-agent-entrypoint.sh:/docker-entrypoint-mount.sh + entrypoint: ["sh", "-c", "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh"] networks: - default - local_sandbox_proxy_network - # ssrf_proxy server ssrf_proxy: image: ubuntu/squid:latest restart: always volumes: - - ./docker/ssrf_proxy/squid.conf.template:/etc/squid/squid.conf.template - - ./docker/ssrf_proxy/squid-common.conf.template:/etc/squid/dify_common.conf.template - - ./docker/ssrf_proxy/docker-entrypoint.sh:/docker-entrypoint-mount.sh - entrypoint: - [ - "sh", - "-c", - "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh", - ] - environment: - HTTP_PORT: ${SSRF_HTTP_PORT:-3128} - COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid} - SSRF_PROXY_ALLOW_PRIVATE_IPS: ${SSRF_PROXY_ALLOW_PRIVATE_IPS:-} - SSRF_PROXY_ALLOW_PRIVATE_DOMAINS: ${SSRF_PROXY_ALLOW_PRIVATE_DOMAINS:-} + - ./ssrf_proxy/squid.conf.template:/etc/squid/squid.conf.template + - ./ssrf_proxy/squid-common.conf.template:/etc/squid/dify_common.conf.template + - ./ssrf_proxy/docker-entrypoint.sh:/docker-entrypoint-mount.sh + entrypoint: ["sh", "-c", "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh"] networks: - ssrf_proxy_network - default - # Certbot service - certbot: - image: certbot/certbot - profiles: - - certbot - volumes: - - ./docker/volumes/certbot/conf:/etc/letsencrypt - - ./docker/volumes/certbot/www:/var/www/html - - ./docker/volumes/certbot/logs:/var/log/letsencrypt - - ./docker/volumes/certbot/conf/live:/etc/letsencrypt/live - - ./docker/certbot/update-cert.template.txt:/update-cert.template.txt - - ./docker/certbot/docker-entrypoint.sh:/docker-entrypoint.sh - environment: - - CERTBOT_EMAIL=${CERTBOT_EMAIL:-} - - CERTBOT_DOMAIN=${CERTBOT_DOMAIN:-} - - CERTBOT_OPTIONS=${CERTBOT_OPTIONS:-} - entrypoint: ["/docker-entrypoint.sh"] - command: ["tail", "-f", "/dev/null"] - - # The nginx reverse proxy. nginx: image: nginx:latest restart: always volumes: - - ./docker/nginx/nginx.conf.template:/etc/nginx/nginx.conf.template - - ./docker/nginx/proxy.conf.template:/etc/nginx/proxy.conf.template - - ./docker/nginx/https.conf.template:/etc/nginx/https.conf.template - - ./docker/nginx/conf.d:/etc/nginx/conf.d - - ./docker/nginx/docker-entrypoint.sh:/docker-entrypoint-mount.sh - - ./docker/nginx/ssl:/etc/ssl - - ./docker/volumes/certbot/conf/live:/etc/letsencrypt/live - - ./docker/volumes/certbot/conf:/etc/letsencrypt - - ./docker/volumes/certbot/www:/var/www/html - entrypoint: - [ - "sh", - "-c", - "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh", - ] - environment: - NGINX_SERVER_NAME: ${NGINX_SERVER_NAME:-_} - NGINX_HTTPS_ENABLED: ${NGINX_HTTPS_ENABLED:-false} - NGINX_SSL_PORT: ${NGINX_SSL_PORT:-443} - NGINX_PORT: ${NGINX_PORT:-80} - NGINX_SSL_CERT_FILENAME: ${NGINX_SSL_CERT_FILENAME:-dify.crt} - NGINX_SSL_CERT_KEY_FILENAME: ${NGINX_SSL_CERT_KEY_FILENAME:-dify.key} - NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.2 TLSv1.3} - NGINX_WORKER_PROCESSES: ${NGINX_WORKER_PROCESSES:-auto} - NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-100M} - NGINX_KEEPALIVE_TIMEOUT: ${NGINX_KEEPALIVE_TIMEOUT:-65} - NGINX_PROXY_READ_TIMEOUT: ${NGINX_PROXY_READ_TIMEOUT:-3600s} - NGINX_PROXY_SEND_TIMEOUT: ${NGINX_PROXY_SEND_TIMEOUT:-3600s} - NGINX_ENABLE_CERTBOT_CHALLENGE: ${NGINX_ENABLE_CERTBOT_CHALLENGE:-false} - NGINX_SOCKET_IO_UPSTREAM: ${NGINX_SOCKET_IO_UPSTREAM:-api_websocket:5001} - CERTBOT_DOMAIN: ${CERTBOT_DOMAIN:-} + - ./nginx/nginx.conf.template:/etc/nginx/nginx.conf.template + - ./nginx/proxy.conf.template:/etc/nginx/proxy.conf.template + - ./nginx/https.conf.template:/etc/nginx/https.conf.template + - ./nginx/conf.d:/etc/nginx/conf.d + - ./nginx/docker-entrypoint.sh:/docker-entrypoint-mount.sh + - ./nginx/ssl:/etc/ssl + entrypoint: ["sh", "-c", "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh"] depends_on: - api - web - # ports: - # - "${EXPOSE_NGINX_PORT:-80}:${NGINX_PORT:-80}" - # - "${EXPOSE_NGINX_SSL_PORT:-443}:${NGINX_SSL_PORT:-443}" - # The Weaviate vector store. weaviate: image: semitechnologies/weaviate:1.27.0 profiles: - weaviate restart: always volumes: - - ./docker/volumes/weaviate:/var/lib/weaviate - environment: - PERSISTENCE_DATA_PATH: ${WEAVIATE_PERSISTENCE_DATA_PATH:-/var/lib/weaviate} - QUERY_DEFAULTS_LIMIT: ${WEAVIATE_QUERY_DEFAULTS_LIMIT:-25} - AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: ${WEAVIATE_AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED:-false} - DEFAULT_VECTORIZER_MODULE: ${WEAVIATE_DEFAULT_VECTORIZER_MODULE:-none} - CLUSTER_HOSTNAME: ${WEAVIATE_CLUSTER_HOSTNAME:-node1} - AUTHENTICATION_APIKEY_ENABLED: ${WEAVIATE_AUTHENTICATION_APIKEY_ENABLED:-true} - AUTHENTICATION_APIKEY_ALLOWED_KEYS: ${WEAVIATE_AUTHENTICATION_APIKEY_ALLOWED_KEYS:-WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih} - AUTHENTICATION_APIKEY_USERS: ${WEAVIATE_AUTHENTICATION_APIKEY_USERS:-hello@dify.ai} - AUTHORIZATION_ADMINLIST_ENABLED: ${WEAVIATE_AUTHORIZATION_ADMINLIST_ENABLED:-true} - AUTHORIZATION_ADMINLIST_USERS: ${WEAVIATE_AUTHORIZATION_ADMINLIST_USERS:-hello@dify.ai} - DISABLE_TELEMETRY: ${WEAVIATE_DISABLE_TELEMETRY:-false} - ENABLE_TOKENIZER_GSE: ${WEAVIATE_ENABLE_TOKENIZER_GSE:-false} - ENABLE_TOKENIZER_KAGOME_JA: ${WEAVIATE_ENABLE_TOKENIZER_KAGOME_JA:-false} - ENABLE_TOKENIZER_KAGOME_KR: ${WEAVIATE_ENABLE_TOKENIZER_KAGOME_KR:-false} + - ./volumes/weaviate:/var/lib/weaviate networks: ssrf_proxy_network: