Update docker/docker-compose.yaml

docker/docker-compose.yaml

@@ -4,30 +4,29 @@
 # or docker-compose-template.yaml and regenerate this file.
 # ==================================================================
 
-# Shared configuration using YAML anchors and env_file
 x-shared-api-worker-config: &shared-api-worker-config
   env_file:
-    - path: ./docker/envs/core-services/shared.env
+    - path: ./envs/core-services/shared.env
       required: false
-    - path: ./docker/envs/core-services/api.env
+    - path: ./envs/core-services/api.env
       required: false
-    - path: ./docker/envs/security.env
+    - path: ./envs/security.env
       required: false
-    - path: ./docker/envs/databases/db-postgres.env
+    - path: ./envs/databases/db-postgres.env
       required: false
-    - path: ./docker/envs/databases/db-mysql.env
+    - path: ./envs/databases/db-mysql.env
       required: false
-    - path: ./docker/envs/databases/redis.env
+    - path: ./envs/databases/redis.env
       required: false
-    - path: ./docker/envs/vectorstores/weaviate.env
+    - path: ./envs/vectorstores/weaviate.env
       required: false
-    - path: ./docker/envs/infrastructure/nginx.env
+    - path: ./envs/infrastructure/nginx.env
       required: false
-    - path: ./docker/envs/infrastructure/certbot.env
+    - path: ./envs/infrastructure/certbot.env
       required: false
-    - path: ./docker/envs/infrastructure/ssrf-proxy.env
+    - path: ./envs/infrastructure/ssrf-proxy.env
       required: false
-    - ./docker/.env
+    - ./.env
   networks:
     - ssrf_proxy_network
     - default
@@ -35,27 +34,27 @@ x-shared-api-worker-config: &shared-api-worker-config
 
 x-shared-worker-config: &shared-worker-config
   env_file:
-    - path: ./docker/envs/core-services/shared.env
+    - path: ./envs/core-services/shared.env
       required: false
-    - path: ./docker/envs/core-services/worker.env
+    - path: ./envs/core-services/worker.env
       required: false
-    - path: ./docker/envs/security.env
+    - path: ./envs/security.env
       required: false
-    - path: ./docker/envs/databases/db-postgres.env
+    - path: ./envs/databases/db-postgres.env
       required: false
-    - path: ./docker/envs/databases/db-mysql.env
+    - path: ./envs/databases/db-mysql.env
       required: false
-    - path: ./docker/envs/databases/redis.env
+    - path: ./envs/databases/redis.env
       required: false
-    - path: ./docker/envs/vectorstores/weaviate.env
+    - path: ./envs/vectorstores/weaviate.env
       required: false
-    - path: ./docker/envs/infrastructure/nginx.env
+    - path: ./envs/infrastructure/nginx.env
       required: false
-    - path: ./docker/envs/infrastructure/certbot.env
+    - path: ./envs/infrastructure/certbot.env
       required: false
-    - path: ./docker/envs/infrastructure/ssrf-proxy.env
+    - path: ./envs/infrastructure/ssrf-proxy.env
       required: false
-    - ./docker/.env
+    - ./.env
   networks:
     - ssrf_proxy_network
     - default
@@ -63,34 +62,33 @@ x-shared-worker-config: &shared-worker-config
 
 x-shared-worker-beat-config: &shared-worker-beat-config
   env_file:
-    - path: ./docker/envs/core-services/shared.env
+    - path: ./envs/core-services/shared.env
       required: false
-    - path: ./docker/envs/core-services/worker-beat.env
+    - path: ./envs/core-services/worker-beat.env
       required: false
-    - path: ./docker/envs/security.env
+    - path: ./envs/security.env
       required: false
-    - path: ./docker/envs/databases/db-postgres.env
+    - path: ./envs/databases/db-postgres.env
       required: false
-    - path: ./docker/envs/databases/db-mysql.env
+    - path: ./envs/databases/db-mysql.env
       required: false
-    - path: ./docker/envs/databases/redis.env
+    - path: ./envs/databases/redis.env
       required: false
-    - path: ./docker/envs/vectorstores/weaviate.env
+    - path: ./envs/vectorstores/weaviate.env
       required: false
-    - path: ./docker/envs/infrastructure/nginx.env
+    - path: ./envs/infrastructure/nginx.env
       required: false
-    - path: ./docker/envs/infrastructure/certbot.env
+    - path: ./envs/infrastructure/certbot.env
       required: false
-    - path: ./docker/envs/infrastructure/ssrf-proxy.env
+    - path: ./envs/infrastructure/ssrf-proxy.env
       required: false
-    - ./docker/.env
+    - ./.env
   networks:
     - ssrf_proxy_network
     - default
   restart: always
 
 services:
-  # Init container to fix permissions
   init_permissions:
     image: busybox:latest
     command:
@@ -106,43 +104,24 @@ services:
         chown -R 1001:1001 /app/api/storage && touch "$${FLAG_FILE}"
         echo "Permissions initialized. Exiting."
     volumes:
-      - ./docker/volumes/app/storage:/app/api/storage
+      - ./volumes/app/storage:/app/api/storage
     restart: "no"
 
-  # API service
   api:
     <<: *shared-api-worker-config
     image: langgenius/dify-api:1.16.1
     environment:
       MODE: api
-      SENTRY_DSN: ${API_SENTRY_DSN:-}
-      SENTRY_TRACES_SAMPLE_RATE: ${API_SENTRY_TRACES_SAMPLE_RATE:-1.0}
-      SENTRY_PROFILES_SAMPLE_RATE: ${API_SENTRY_PROFILES_SAMPLE_RATE:-1.0}
-      PLUGIN_REMOTE_INSTALL_HOST: ${EXPOSE_PLUGIN_DEBUGGING_HOST:-localhost}
-      PLUGIN_REMOTE_INSTALL_PORT: ${EXPOSE_PLUGIN_DEBUGGING_PORT:-5003}
-      PLUGIN_MAX_PACKAGE_SIZE: ${PLUGIN_MAX_PACKAGE_SIZE:-52428800}
-      PLUGIN_DAEMON_TIMEOUT: ${PLUGIN_DAEMON_TIMEOUT:-600.0}
-      INNER_API_KEY_FOR_PLUGIN: ${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1}
-      AGENT_BACKEND_BASE_URL: ${AGENT_BACKEND_BASE_URL:-http://agent_backend:5050}
-      AGENT_BACKEND_API_TOKEN: ${DIFY_AGENT_API_TOKEN:-dify-agent-run-token-for-dev-only}
-      AGENT_BACKEND_STREAM_READ_TIMEOUT_SECONDS: ${AGENT_BACKEND_STREAM_READ_TIMEOUT_SECONDS:-30}
-      AGENT_BACKEND_STREAM_MAX_RECONNECTS: ${AGENT_BACKEND_STREAM_MAX_RECONNECTS:-3}
-      AGENT_BACKEND_RUN_TIMEOUT_SECONDS: ${AGENT_BACKEND_RUN_TIMEOUT_SECONDS:-1200}
     depends_on:
       init_permissions:
         condition: service_completed_successfully
       db_postgres:
         condition: service_healthy
         required: false
-      db_mysql:
-        condition: service_healthy
-        required: false
       redis:
         condition: service_started
-      agent_backend:
-        condition: service_started
     volumes:
-      - ./docker/volumes/app/storage:/app/api/storage
+      - ./volumes/app/storage:/app/api/storage
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:5001/health"]
       interval: 30s
@@ -150,7 +129,6 @@ services:
       retries: 3
       start_period: 30s
 
-  # WebSocket service for workflow collaboration.
   api_websocket:
     <<: *shared-api-worker-config
     image: langgenius/dify-api:1.16.1
@@ -158,60 +136,35 @@ services:
       - collaboration
     environment:
       MODE: api
-      SERVER_WORKER_AMOUNT: ${API_WEBSOCKET_WORKER_AMOUNT:-1}
-      SERVER_WORKER_CLASS: ${API_WEBSOCKET_WORKER_CLASS:-geventwebsocket.gunicorn.workers.GeventWebSocketWorker}
-      SERVER_WORKER_CONNECTIONS: ${API_WEBSOCKET_WORKER_CONNECTIONS:-1000}
-      GUNICORN_TIMEOUT: ${API_WEBSOCKET_GUNICORN_TIMEOUT:-360}
     depends_on:
       db_postgres:
         condition: service_healthy
         required: false
-      db_mysql:
-        condition: service_healthy
-        required: false
       redis:
         condition: service_started
 
-  # worker service
   worker:
     <<: *shared-worker-config
     image: langgenius/dify-api:1.16.1
     environment:
       MODE: worker
-      SENTRY_DSN: ${API_SENTRY_DSN:-}
-      SENTRY_TRACES_SAMPLE_RATE: ${API_SENTRY_TRACES_SAMPLE_RATE:-1.0}
-      SENTRY_PROFILES_SAMPLE_RATE: ${API_SENTRY_PROFILES_SAMPLE_RATE:-1.0}
-      PLUGIN_MAX_PACKAGE_SIZE: ${PLUGIN_MAX_PACKAGE_SIZE:-52428800}
-      INNER_API_KEY_FOR_PLUGIN: ${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1}
-      AGENT_BACKEND_BASE_URL: ${AGENT_BACKEND_BASE_URL:-http://agent_backend:5050}
-      AGENT_BACKEND_API_TOKEN: ${DIFY_AGENT_API_TOKEN:-dify-agent-run-token-for-dev-only}
-      AGENT_BACKEND_STREAM_READ_TIMEOUT_SECONDS: ${AGENT_BACKEND_STREAM_READ_TIMEOUT_SECONDS:-30}
-      AGENT_BACKEND_STREAM_MAX_RECONNECTS: ${AGENT_BACKEND_STREAM_MAX_RECONNECTS:-3}
-      AGENT_BACKEND_RUN_TIMEOUT_SECONDS: ${AGENT_BACKEND_RUN_TIMEOUT_SECONDS:-1200}
     depends_on:
       init_permissions:
         condition: service_completed_successfully
       db_postgres:
         condition: service_healthy
         required: false
-      db_mysql:
-        condition: service_healthy
-        required: false
       redis:
         condition: service_started
-      agent_backend:
-        condition: service_started
     volumes:
-      - ./docker/volumes/app/storage:/app/api/storage
+      - ./volumes/app/storage:/app/api/storage
     healthcheck:
       test: ["CMD-SHELL", "celery -A celery_healthcheck.celery inspect ping"]
-      interval: ${COMPOSE_WORKER_HEALTHCHECK_INTERVAL:-30s}
-      timeout: ${COMPOSE_WORKER_HEALTHCHECK_TIMEOUT:-30s}
+      interval: 30s
+      timeout: 30s
       retries: 3
       start_period: 60s
-      disable: ${COMPOSE_WORKER_HEALTHCHECK_DISABLED:-true}
 
-  # worker_beat service
   worker_beat:
     <<: *shared-worker-beat-config
     image: langgenius/dify-api:1.16.1
@@ -223,59 +176,25 @@ services:
       db_postgres:
         condition: service_healthy
         required: false
-      db_mysql:
-        condition: service_healthy
-        required: false
       redis:
         condition: service_started
     healthcheck:
       test: ["CMD-SHELL", "celery -A celery_healthcheck.celery inspect ping"]
-      interval: ${COMPOSE_WORKER_HEALTHCHECK_INTERVAL:-30s}
-      timeout: ${COMPOSE_WORKER_HEALTHCHECK_TIMEOUT:-30s}
+      interval: 30s
+      timeout: 30s
       retries: 3
       start_period: 60s
-      disable: ${COMPOSE_WORKER_HEALTHCHECK_DISABLED:-true}
 
-  # Frontend web application.
   web:
     image: langgenius/dify-web:1.16.1
     restart: always
     env_file:
-      - path: ./docker/envs/core-services/web.env
+      - path: ./envs/core-services/web.env
         required: false
-      - path: ./docker/envs/security.env
+      - path: ./envs/security.env
         required: false
-      - ./docker/.env
-    environment:
-      CONSOLE_API_URL: ${CONSOLE_API_URL:-}
-      SERVER_CONSOLE_API_URL: ${SERVER_CONSOLE_API_URL:-http://api:5001}
-      APP_API_URL: ${APP_API_URL:-}
-      AMPLITUDE_API_KEY: ${AMPLITUDE_API_KEY:-}
-      COOKIEYES_SITE_KEY: ${COOKIEYES_SITE_KEY:-}
-      NEXT_PUBLIC_COOKIE_DOMAIN: ${NEXT_PUBLIC_COOKIE_DOMAIN:-}
-      NEXT_PUBLIC_SOCKET_URL: ${NEXT_PUBLIC_SOCKET_URL:-ws://localhost}
-      SENTRY_DSN: ${WEB_SENTRY_DSN:-}
-      NEXT_TELEMETRY_DISABLED: ${NEXT_TELEMETRY_DISABLED:-0}
-      EXPERIMENTAL_ENABLE_VINEXT: ${EXPERIMENTAL_ENABLE_VINEXT:-false}
-      TEXT_GENERATION_TIMEOUT_MS: ${TEXT_GENERATION_TIMEOUT_MS:-60000}
-      WORKFLOW_GENERATION_TIMEOUT_MS: ${WORKFLOW_GENERATION_TIMEOUT_MS:-180000}
-      CSP_WHITELIST: ${CSP_WHITELIST:-}
-      ALLOW_EMBED: ${ALLOW_EMBED:-false}
-      ALLOW_UNSAFE_DATA_SCHEME: ${ALLOW_UNSAFE_DATA_SCHEME:-false}
-      MARKETPLACE_API_URL: ${MARKETPLACE_API_URL:-https://marketplace.dify.ai}
-      MARKETPLACE_URL: ${MARKETPLACE_URL:-https://marketplace.dify.ai}
-      TOP_K_MAX_VALUE: ${TOP_K_MAX_VALUE:-10}
-      INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH: ${INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH:-4000}
-      LOOP_NODE_MAX_COUNT: ${LOOP_NODE_MAX_COUNT:-100}
-      MAX_TOOLS_NUM: ${MAX_TOOLS_NUM:-10}
-      MAX_PARALLEL_LIMIT: ${MAX_PARALLEL_LIMIT:-10}
-      MAX_ITERATIONS_NUM: ${MAX_ITERATIONS_NUM:-99}
-      MAX_TREE_DEPTH: ${MAX_TREE_DEPTH:-50}
-      ENABLE_WEBSITE_JINAREADER: ${ENABLE_WEBSITE_JINAREADER:-true}
-      ENABLE_WEBSITE_FIRECRAWL: ${ENABLE_WEBSITE_FIRECRAWL:-true}
-      ENABLE_WEBSITE_WATERCRAWL: ${ENABLE_WEBSITE_WATERCRAWL:-true}
+      - ./.env
 
-  # The PostgreSQL database.
   db_postgres:
     image: postgres:15-alpine
     profiles:
@@ -286,241 +205,90 @@ services:
       POSTGRES_PASSWORD: ${DB_PASSWORD:-difyai123456}
       POSTGRES_DB: ${DB_DATABASE:-dify}
       PGDATA: ${PGDATA:-/var/lib/postgresql/data/pgdata}
-    command: >
-      postgres -c 'max_connections=${POSTGRES_MAX_CONNECTIONS:-100}'
-               -c 'shared_buffers=${POSTGRES_SHARED_BUFFERS:-128MB}'
-               -c 'work_mem=${POSTGRES_WORK_MEM:-4MB}'
-               -c 'maintenance_work_mem=${POSTGRES_MAINTENANCE_WORK_MEM:-64MB}'
-               -c 'effective_cache_size=${POSTGRES_EFFECTIVE_CACHE_SIZE:-4096MB}'
-               -c 'statement_timeout=${POSTGRES_STATEMENT_TIMEOUT:-0}'
-               -c 'idle_in_transaction_session_timeout=${POSTGRES_IDLE_IN_TRANSACTION_SESSION_TIMEOUT:-0}'
     volumes:
-      - ./docker/volumes/db/data:/var/lib/postgresql/data
+      - ./volumes/db/data:/var/lib/postgresql/data
     healthcheck:
-      test:
-        [
-          "CMD",
-          "pg_isready",
-          "-h",
-          "db_postgres",
-          "-U",
-          "${DB_USERNAME:-postgres}",
-          "-d",
-          "${DB_DATABASE:-dify}",
-        ]
+      test: ["CMD", "pg_isready", "-h", "db_postgres", "-U", "${DB_USERNAME:-postgres}", "-d", "${DB_DATABASE:-dify}"]
       interval: 1s
       timeout: 3s
       retries: 60
 
-  # The mysql database.
-  db_mysql:
-    image: mysql:8.0
-    profiles:
-      - mysql
-    restart: always
-    environment:
-      MYSQL_ROOT_PASSWORD: ${DB_PASSWORD:-difyai123456}
-      MYSQL_DATABASE: ${DB_DATABASE:-dify}
-    command: >
-      --max_connections=${MYSQL_MAX_CONNECTIONS:-1000}
-      --innodb_buffer_pool_size=${MYSQL_INNODB_BUFFER_POOL_SIZE:-512M}
-      --innodb_log_file_size=${MYSQL_INNODB_LOG_FILE_SIZE:-128M}
-      --innodb_flush_log_at_trx_commit=${MYSQL_INNODB_FLUSH_LOG_AT_TRX_COMMIT:-2}
-    volumes:
-      - ${MYSQL_HOST_VOLUME:-./docker/volumes/mysql/data}:/var/lib/mysql
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "mysqladmin",
-          "ping",
-          "-u",
-          "root",
-          "-p${DB_PASSWORD:-difyai123456}",
-        ]
-      interval: 1s
-      timeout: 3s
-      retries: 30
-
-  # The redis cache.
   redis:
     image: redis:6-alpine
     restart: always
     environment:
       REDISCLI_AUTH: ${REDIS_PASSWORD:-difyai123456}
     volumes:
-      - ./docker/volumes/redis/data:/data
+      - ./volumes/redis/data:/data
     command: redis-server --requirepass ${REDIS_PASSWORD:-difyai123456}
     healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "redis-cli -a ${REDIS_PASSWORD:-difyai123456} ping | grep -q PONG",
-        ]
+      test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD:-difyai123456} ping | grep -q PONG"]
 
-  # The DifySandbox
   sandbox:
     image: langgenius/dify-sandbox:0.2.15
     restart: always
     env_file:
-      - path: ./docker/envs/core-services/sandbox.env
+      - path: ./envs/core-services/sandbox.env
         required: false
-      - path: ./docker/envs/security.env
+      - path: ./envs/security.env
         required: false
-      - ./docker/.env
-    environment:
-      API_KEY: ${SANDBOX_API_KEY:-dify-sandbox}
-      GIN_MODE: ${SANDBOX_GIN_MODE:-release}
-      WORKER_TIMEOUT: ${SANDBOX_WORKER_TIMEOUT:-15}
-      ENABLE_NETWORK: ${SANDBOX_ENABLE_NETWORK:-true}
-      HTTP_PROXY: ${SANDBOX_HTTP_PROXY:-http://ssrf_proxy:3128}
-      HTTPS_PROXY: ${SANDBOX_HTTPS_PROXY:-http://ssrf_proxy:3128}
-      SANDBOX_PORT: ${SANDBOX_PORT:-8194}
-      PIP_MIRROR_URL: ${PIP_MIRROR_URL:-}
+      - ./.env
     volumes:
-      - ./docker/volumes/sandbox/dependencies:/dependencies
-      - ./docker/volumes/sandbox/conf:/conf
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:8194/health"]
+      - ./volumes/sandbox/dependencies:/dependencies
+      - ./volumes/sandbox/conf:/conf
     networks:
       - ssrf_proxy_network
 
-  # Local sandbox for Dify Agent shell workspaces.
   local_sandbox:
     image: langgenius/dify-agent-local-sandbox:1.16.1
     restart: always
     env_file:
-      - path: ./docker/envs/core-services/local-sandbox.env
+      - path: ./envs/core-services/local-sandbox.env
         required: false
     environment:
-      - SHELLCTL_AUTH_TOKEN=${DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN:-${DIFY_AGENT_SHELLCTL_AUTH_TOKEN:-}}
       - HTTP_PROXY=http://agent_ssrf_proxy:3128
       - HTTPS_PROXY=http://agent_ssrf_proxy:3128
       - NO_PROXY=localhost,127.0.0.1
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:5004/healthz"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-      start_period: 10s
     networks:
       - agent_sandbox_network
       - local_sandbox_proxy_network
 
-  # plugin daemon
   plugin_daemon:
     image: langgenius/dify-plugin-daemon:0.6.3-local
     restart: always
     env_file:
-      - path: ./docker/envs/core-services/shared.env
+      - path: ./envs/core-services/shared.env
         required: false
-      - path: ./docker/envs/core-services/plugin-daemon.env
+      - path: ./envs/core-services/plugin-daemon.env
         required: false
-      - path: ./docker/envs/security.env
+      - path: ./envs/security.env
         required: false
-      - path: ./docker/envs/databases/db-postgres.env
+      - path: ./envs/databases/db-postgres.env
         required: false
-      - path: ./docker/envs/databases/db-mysql.env
+      - path: ./envs/databases/redis.env
         required: false
-      - path: ./docker/envs/databases/redis.env
-        required: false
-      - ./docker/.env
+      - ./.env
     networks:
       - ssrf_proxy_network
       - default
-    environment:
-      DB_DATABASE: ${DB_PLUGIN_DATABASE:-dify_plugin}
-      DB_SSL_MODE: ${DB_SSL_MODE:-disable}
-      SERVER_PORT: ${PLUGIN_DAEMON_PORT:-5002}
-      SERVER_KEY: ${PLUGIN_DAEMON_KEY:-lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi}
-      MAX_PLUGIN_PACKAGE_SIZE: ${PLUGIN_MAX_PACKAGE_SIZE:-52428800}
-      PPROF_ENABLED: ${PLUGIN_PPROF_ENABLED:-false}
-      DIFY_INNER_API_URL: ${PLUGIN_DIFY_INNER_API_URL:-http://api:5001}
-      DIFY_INNER_API_KEY: ${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1}
-      PLUGIN_REMOTE_INSTALLING_HOST: ${PLUGIN_DEBUGGING_HOST:-0.0.0.0}
-      PLUGIN_REMOTE_INSTALLING_PORT: ${PLUGIN_DEBUGGING_PORT:-5003}
-      PLUGIN_WORKING_PATH: ${PLUGIN_WORKING_PATH:-/app/storage/cwd}
-      FORCE_VERIFYING_SIGNATURE: ${FORCE_VERIFYING_SIGNATURE:-true}
-      PYTHON_ENV_INIT_TIMEOUT: ${PLUGIN_PYTHON_ENV_INIT_TIMEOUT:-120}
-      PLUGIN_MAX_EXECUTION_TIMEOUT: ${PLUGIN_MAX_EXECUTION_TIMEOUT:-600}
-      PLUGIN_STDIO_BUFFER_SIZE: ${PLUGIN_STDIO_BUFFER_SIZE:-1024}
-      PLUGIN_STDIO_MAX_BUFFER_SIZE: ${PLUGIN_STDIO_MAX_BUFFER_SIZE:-5242880}
-      PIP_MIRROR_URL: ${PIP_MIRROR_URL:-}
-      PLUGIN_STORAGE_TYPE: ${PLUGIN_STORAGE_TYPE:-local}
-      PLUGIN_STORAGE_LOCAL_ROOT: ${PLUGIN_STORAGE_LOCAL_ROOT:-/app/storage}
-      PLUGIN_INSTALLED_PATH: ${PLUGIN_INSTALLED_PATH:-plugin}
-      PLUGIN_PACKAGE_CACHE_PATH: ${PLUGIN_PACKAGE_CACHE_PATH:-plugin_packages}
-      PLUGIN_MEDIA_CACHE_PATH: ${PLUGIN_MEDIA_CACHE_PATH:-assets}
-      PLUGIN_STORAGE_OSS_BUCKET: ${PLUGIN_STORAGE_OSS_BUCKET:-}
-      S3_USE_AWS_MANAGED_IAM: ${PLUGIN_S3_USE_AWS_MANAGED_IAM:-false}
-      S3_USE_AWS: ${PLUGIN_S3_USE_AWS:-false}
-      S3_ENDPOINT: ${PLUGIN_S3_ENDPOINT:-}
-      S3_USE_PATH_STYLE: ${PLUGIN_S3_USE_PATH_STYLE:-false}
-      AWS_ACCESS_KEY: ${PLUGIN_AWS_ACCESS_KEY:-}
-      AWS_SECRET_KEY: ${PLUGIN_AWS_SECRET_KEY:-}
-      AWS_REGION: ${PLUGIN_AWS_REGION:-}
-      AZURE_BLOB_STORAGE_CONNECTION_STRING: ${PLUGIN_AZURE_BLOB_STORAGE_CONNECTION_STRING:-}
-      AZURE_BLOB_STORAGE_CONTAINER_NAME: ${PLUGIN_AZURE_BLOB_STORAGE_CONTAINER_NAME:-}
-      TENCENT_COS_SECRET_KEY: ${PLUGIN_TENCENT_COS_SECRET_KEY:-}
-      TENCENT_COS_SECRET_ID: ${PLUGIN_TENCENT_COS_SECRET_ID:-}
-      TENCENT_COS_REGION: ${PLUGIN_TENCENT_COS_REGION:-}
-      ALIYUN_OSS_REGION: ${PLUGIN_ALIYUN_OSS_REGION:-}
-      ALIYUN_OSS_ENDPOINT: ${PLUGIN_ALIYUN_OSS_ENDPOINT:-}
-      ALIYUN_OSS_ACCESS_KEY_ID: ${PLUGIN_ALIYUN_OSS_ACCESS_KEY_ID:-}
-      ALIYUN_OSS_ACCESS_KEY_SECRET: ${PLUGIN_ALIYUN_OSS_ACCESS_KEY_SECRET:-}
-      ALIYUN_OSS_AUTH_VERSION: ${PLUGIN_ALIYUN_OSS_AUTH_VERSION:-v4}
-      ALIYUN_OSS_PATH: ${PLUGIN_ALIYUN_OSS_PATH:-}
-      VOLCENGINE_TOS_ENDPOINT: ${PLUGIN_VOLCENGINE_TOS_ENDPOINT:-}
-      VOLCENGINE_TOS_ACCESS_KEY: ${PLUGIN_VOLCENGINE_TOS_ACCESS_KEY:-}
-      VOLCENGINE_TOS_SECRET_KEY: ${PLUGIN_VOLCENGINE_TOS_SECRET_KEY:-}
-      VOLCENGINE_TOS_REGION: ${PLUGIN_VOLCENGINE_TOS_REGION:-}
-      SENTRY_ENABLED: ${PLUGIN_SENTRY_ENABLED:-false}
-      SENTRY_DSN: ${PLUGIN_SENTRY_DSN:-}
-    ports:
-      - "${EXPOSE_PLUGIN_DEBUGGING_PORT:-5003}:${PLUGIN_DEBUGGING_PORT:-5003}"
     volumes:
-      - ./docker/volumes/plugin_daemon:/app/storage
+      - ./volumes/plugin_daemon:/app/storage
     depends_on:
       db_postgres:
         condition: service_healthy
         required: false
-      db_mysql:
-        condition: service_healthy
-        required: false
 
-  # Dify Agent backend service.
   agent_backend:
     image: langgenius/dify-agent-backend:1.16.1
     restart: always
     env_file:
-      - path: ./docker/envs/core-services/dify-agent.env
+      - path: ./envs/core-services/dify-agent.env
         required: false
-      - path: ./docker/envs/security.env
+      - path: ./envs/security.env
         required: false
-      - path: ./docker/envs/databases/redis.env
+      - path: ./envs/databases/redis.env
         required: false
-      - ./docker/.env
-    environment:
-      DIFY_AGENT_REDIS_URL: ${DIFY_AGENT_REDIS_URL:-redis://:${REDIS_PASSWORD:-difyai123456}@redis:6379/2}
-      DIFY_AGENT_REDIS_PREFIX: ${DIFY_AGENT_REDIS_PREFIX:-dify-agent}
-      DIFY_AGENT_PLUGIN_DAEMON_URL: ${DIFY_AGENT_PLUGIN_DAEMON_URL:-${PLUGIN_DAEMON_URL:-http://plugin_daemon:5002}}
-      DIFY_AGENT_PLUGIN_DAEMON_API_KEY: ${DIFY_AGENT_PLUGIN_DAEMON_API_KEY:-${PLUGIN_DAEMON_KEY:-lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi}}
-      DIFY_AGENT_INNER_API_URL: ${DIFY_AGENT_INNER_API_URL:-${PLUGIN_DIFY_INNER_API_URL:-http://api:5001}}
-      DIFY_AGENT_INNER_API_KEY: ${DIFY_AGENT_INNER_API_KEY:-${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1}}
-      DIFY_AGENT_RUNTIME_BACKEND: ${DIFY_AGENT_RUNTIME_BACKEND:-local}
-      DIFY_AGENT_LOCAL_SANDBOX_ENDPOINT: ${DIFY_AGENT_LOCAL_SANDBOX_ENDPOINT:-${DIFY_AGENT_SHELLCTL_ENTRYPOINT:-http://local_sandbox:5004}}
-      DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN: ${DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN:-${DIFY_AGENT_SHELLCTL_AUTH_TOKEN:-}}
-      DIFY_AGENT_E2B_API_KEY: ${DIFY_AGENT_E2B_API_KEY:-${E2B_API_KEY:-${E2B_API_TOKEN:-}}}
-      DIFY_AGENT_E2B_TEMPLATE: ${DIFY_AGENT_E2B_TEMPLATE:-difys-default-team/dify-agent-local-sandbox}
-      DIFY_AGENT_E2B_ACTIVE_TIMEOUT_SECONDS: ${DIFY_AGENT_E2B_ACTIVE_TIMEOUT_SECONDS:-3600}
-      DIFY_AGENT_E2B_SHELLCTL_AUTH_TOKEN: ${DIFY_AGENT_E2B_SHELLCTL_AUTH_TOKEN:-}
-      DIFY_AGENT_E2B_SHELLCTL_PORT: ${DIFY_AGENT_E2B_SHELLCTL_PORT:-5004}
-      DIFY_AGENT_SANDBOX_FILE_UPLOAD_MAX_BYTES: ${PLUGIN_MAX_FILE_SIZE:-52428800}
-      DIFY_AGENT_STUB_API_BASE_URL: ${DIFY_AGENT_STUB_API_BASE_URL:-http://agent_backend:5050/agent-stub}
-      DIFY_AGENT_SERVER_SECRET_KEY: ${DIFY_AGENT_SERVER_SECRET_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY}
-      DIFY_AGENT_API_TOKEN: ${DIFY_AGENT_API_TOKEN:-dify-agent-run-token-for-dev-only}
-      DIFY_AGENT_SHUTDOWN_GRACE_SECONDS: ${DIFY_AGENT_SHUTDOWN_GRACE_SECONDS:-30}
-      DIFY_AGENT_RUN_RETENTION_SECONDS: ${DIFY_AGENT_RUN_RETENTION_SECONDS:-259200}
+      - ./.env
     depends_on:
       redis:
         condition: service_started
@@ -530,135 +298,52 @@ services:
       - default
       - agent_sandbox_network
 
-  # Dedicated SSRF proxy for the dify-agent local_sandbox.
   agent_ssrf_proxy:
     image: ubuntu/squid:latest
     restart: always
     volumes:
-      - ./docker/ssrf_proxy/squid-agent.conf.template:/etc/squid/squid.conf.template
-      - ./docker/ssrf_proxy/squid-common.conf.template:/etc/squid/dify_common.conf.template
-      - ./docker/ssrf_proxy/docker-agent-entrypoint.sh:/docker-entrypoint-mount.sh
-    entrypoint:
-      [
-        "sh",
-        "-c",
-        "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh",
-      ]
-    environment:
-      HTTP_PORT: ${SSRF_HTTP_PORT:-3128}
-      COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid}
+      - ./ssrf_proxy/squid-agent.conf.template:/etc/squid/squid.conf.template
+      - ./ssrf_proxy/squid-common.conf.template:/etc/squid/dify_common.conf.template
+      - ./ssrf_proxy/docker-agent-entrypoint.sh:/docker-entrypoint-mount.sh
+    entrypoint: ["sh", "-c", "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh"]
     networks:
       - default
       - local_sandbox_proxy_network
 
-  # ssrf_proxy server
   ssrf_proxy:
     image: ubuntu/squid:latest
     restart: always
     volumes:
-      - ./docker/ssrf_proxy/squid.conf.template:/etc/squid/squid.conf.template
-      - ./docker/ssrf_proxy/squid-common.conf.template:/etc/squid/dify_common.conf.template
-      - ./docker/ssrf_proxy/docker-entrypoint.sh:/docker-entrypoint-mount.sh
-    entrypoint:
-      [
-        "sh",
-        "-c",
-        "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh",
-      ]
-    environment:
-      HTTP_PORT: ${SSRF_HTTP_PORT:-3128}
-      COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid}
-      SSRF_PROXY_ALLOW_PRIVATE_IPS: ${SSRF_PROXY_ALLOW_PRIVATE_IPS:-}
-      SSRF_PROXY_ALLOW_PRIVATE_DOMAINS: ${SSRF_PROXY_ALLOW_PRIVATE_DOMAINS:-}
+      - ./ssrf_proxy/squid.conf.template:/etc/squid/squid.conf.template
+      - ./ssrf_proxy/squid-common.conf.template:/etc/squid/dify_common.conf.template
+      - ./ssrf_proxy/docker-entrypoint.sh:/docker-entrypoint-mount.sh
+    entrypoint: ["sh", "-c", "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh"]
     networks:
       - ssrf_proxy_network
       - default
 
-  # Certbot service
-  certbot:
-    image: certbot/certbot
-    profiles:
-      - certbot
-    volumes:
-      - ./docker/volumes/certbot/conf:/etc/letsencrypt
-      - ./docker/volumes/certbot/www:/var/www/html
-      - ./docker/volumes/certbot/logs:/var/log/letsencrypt
-      - ./docker/volumes/certbot/conf/live:/etc/letsencrypt/live
-      - ./docker/certbot/update-cert.template.txt:/update-cert.template.txt
-      - ./docker/certbot/docker-entrypoint.sh:/docker-entrypoint.sh
-    environment:
-      - CERTBOT_EMAIL=${CERTBOT_EMAIL:-}
-      - CERTBOT_DOMAIN=${CERTBOT_DOMAIN:-}
-      - CERTBOT_OPTIONS=${CERTBOT_OPTIONS:-}
-    entrypoint: ["/docker-entrypoint.sh"]
-    command: ["tail", "-f", "/dev/null"]
-
-  # The nginx reverse proxy.
   nginx:
     image: nginx:latest
     restart: always
     volumes:
-      - ./docker/nginx/nginx.conf.template:/etc/nginx/nginx.conf.template
-      - ./docker/nginx/proxy.conf.template:/etc/nginx/proxy.conf.template
-      - ./docker/nginx/https.conf.template:/etc/nginx/https.conf.template
-      - ./docker/nginx/conf.d:/etc/nginx/conf.d
-      - ./docker/nginx/docker-entrypoint.sh:/docker-entrypoint-mount.sh
-      - ./docker/nginx/ssl:/etc/ssl
-      - ./docker/volumes/certbot/conf/live:/etc/letsencrypt/live
-      - ./docker/volumes/certbot/conf:/etc/letsencrypt
-      - ./docker/volumes/certbot/www:/var/www/html
-    entrypoint:
-      [
-        "sh",
-        "-c",
-        "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh",
-      ]
-    environment:
-      NGINX_SERVER_NAME: ${NGINX_SERVER_NAME:-_}
-      NGINX_HTTPS_ENABLED: ${NGINX_HTTPS_ENABLED:-false}
-      NGINX_SSL_PORT: ${NGINX_SSL_PORT:-443}
-      NGINX_PORT: ${NGINX_PORT:-80}
-      NGINX_SSL_CERT_FILENAME: ${NGINX_SSL_CERT_FILENAME:-dify.crt}
-      NGINX_SSL_CERT_KEY_FILENAME: ${NGINX_SSL_CERT_KEY_FILENAME:-dify.key}
-      NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.2 TLSv1.3}
-      NGINX_WORKER_PROCESSES: ${NGINX_WORKER_PROCESSES:-auto}
-      NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-100M}
-      NGINX_KEEPALIVE_TIMEOUT: ${NGINX_KEEPALIVE_TIMEOUT:-65}
-      NGINX_PROXY_READ_TIMEOUT: ${NGINX_PROXY_READ_TIMEOUT:-3600s}
-      NGINX_PROXY_SEND_TIMEOUT: ${NGINX_PROXY_SEND_TIMEOUT:-3600s}
-      NGINX_ENABLE_CERTBOT_CHALLENGE: ${NGINX_ENABLE_CERTBOT_CHALLENGE:-false}
-      NGINX_SOCKET_IO_UPSTREAM: ${NGINX_SOCKET_IO_UPSTREAM:-api_websocket:5001}
-      CERTBOT_DOMAIN: ${CERTBOT_DOMAIN:-}
+      - ./nginx/nginx.conf.template:/etc/nginx/nginx.conf.template
+      - ./nginx/proxy.conf.template:/etc/nginx/proxy.conf.template
+      - ./nginx/https.conf.template:/etc/nginx/https.conf.template
+      - ./nginx/conf.d:/etc/nginx/conf.d
+      - ./nginx/docker-entrypoint.sh:/docker-entrypoint-mount.sh
+      - ./nginx/ssl:/etc/ssl
+    entrypoint: ["sh", "-c", "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh"]
     depends_on:
       - api
       - web
- #   ports:
- #     - "${EXPOSE_NGINX_PORT:-80}:${NGINX_PORT:-80}"
- #     - "${EXPOSE_NGINX_SSL_PORT:-443}:${NGINX_SSL_PORT:-443}"
 
-  # The Weaviate vector store.
   weaviate:
     image: semitechnologies/weaviate:1.27.0
     profiles:
       - weaviate
     restart: always
     volumes:
-      - ./docker/volumes/weaviate:/var/lib/weaviate
-    environment:
-      PERSISTENCE_DATA_PATH: ${WEAVIATE_PERSISTENCE_DATA_PATH:-/var/lib/weaviate}
-      QUERY_DEFAULTS_LIMIT: ${WEAVIATE_QUERY_DEFAULTS_LIMIT:-25}
-      AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: ${WEAVIATE_AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED:-false}
-      DEFAULT_VECTORIZER_MODULE: ${WEAVIATE_DEFAULT_VECTORIZER_MODULE:-none}
-      CLUSTER_HOSTNAME: ${WEAVIATE_CLUSTER_HOSTNAME:-node1}
-      AUTHENTICATION_APIKEY_ENABLED: ${WEAVIATE_AUTHENTICATION_APIKEY_ENABLED:-true}
-      AUTHENTICATION_APIKEY_ALLOWED_KEYS: ${WEAVIATE_AUTHENTICATION_APIKEY_ALLOWED_KEYS:-WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih}
-      AUTHENTICATION_APIKEY_USERS: ${WEAVIATE_AUTHENTICATION_APIKEY_USERS:-hello@dify.ai}
-      AUTHORIZATION_ADMINLIST_ENABLED: ${WEAVIATE_AUTHORIZATION_ADMINLIST_ENABLED:-true}
-      AUTHORIZATION_ADMINLIST_USERS: ${WEAVIATE_AUTHORIZATION_ADMINLIST_USERS:-hello@dify.ai}
-      DISABLE_TELEMETRY: ${WEAVIATE_DISABLE_TELEMETRY:-false}
-      ENABLE_TOKENIZER_GSE: ${WEAVIATE_ENABLE_TOKENIZER_GSE:-false}
-      ENABLE_TOKENIZER_KAGOME_JA: ${WEAVIATE_ENABLE_TOKENIZER_KAGOME_JA:-false}
-      ENABLE_TOKENIZER_KAGOME_KR: ${WEAVIATE_ENABLE_TOKENIZER_KAGOME_KR:-false}
+      - ./volumes/weaviate:/var/lib/weaviate
 
 networks:
   ssrf_proxy_network: