mirror of
https://github.com/langgenius/dify.git
synced 2026-05-27 04:16:16 +08:00
96622faffa
Block private, loopback, link-local, multicast, reserved, and metadata target networks in the Docker Compose SSRF proxy while preserving public egress and sandbox reverse proxy access. Add explicit private IP and domain allowlist environment variables for deployments that need trusted private-network access.
246 lines
8.5 KiB
Plaintext
246 lines
8.5 KiB
Plaintext
# ------------------------------
|
||
# Environment Variables for db Service
|
||
# ------------------------------
|
||
# Database Configuration
|
||
# Database type, supported values are `postgresql` and `mysql`
|
||
DB_TYPE=postgresql
|
||
# For MySQL, only `root` user is supported for now
|
||
DB_USERNAME=postgres
|
||
DB_PASSWORD=difyai123456
|
||
DB_HOST=db_postgres
|
||
DB_PORT=5432
|
||
DB_DATABASE=dify
|
||
|
||
# PostgreSQL Configuration
|
||
# postgres data directory
|
||
PGDATA=/var/lib/postgresql/data/pgdata
|
||
PGDATA_HOST_VOLUME=./volumes/db/data
|
||
|
||
# Maximum number of connections to the database
|
||
# Default is 100
|
||
#
|
||
# Reference: https://www.postgresql.org/docs/current/runtime-config-connection.html#GUC-MAX-CONNECTIONS
|
||
POSTGRES_MAX_CONNECTIONS=100
|
||
|
||
# Sets the amount of shared memory used for postgres's shared buffers.
|
||
# Default is 128MB
|
||
# Recommended value: 25% of available memory
|
||
# Reference: https://www.postgresql.org/docs/current/runtime-config-resource.html#GUC-SHARED-BUFFERS
|
||
POSTGRES_SHARED_BUFFERS=128MB
|
||
|
||
# Sets the amount of memory used by each database worker for working space.
|
||
# Default is 4MB
|
||
#
|
||
# Reference: https://www.postgresql.org/docs/current/runtime-config-resource.html#GUC-WORK-MEM
|
||
POSTGRES_WORK_MEM=4MB
|
||
|
||
# Sets the amount of memory reserved for maintenance activities.
|
||
# Default is 64MB
|
||
#
|
||
# Reference: https://www.postgresql.org/docs/current/runtime-config-resource.html#GUC-MAINTENANCE-WORK-MEM
|
||
POSTGRES_MAINTENANCE_WORK_MEM=64MB
|
||
|
||
# Sets the planner's assumption about the effective cache size.
|
||
# Default is 4096MB
|
||
#
|
||
# Reference: https://www.postgresql.org/docs/current/runtime-config-query.html#GUC-EFFECTIVE-CACHE-SIZE
|
||
POSTGRES_EFFECTIVE_CACHE_SIZE=4096MB
|
||
|
||
# Sets the maximum allowed duration of any statement before termination.
|
||
# Default is 0 (no timeout).
|
||
#
|
||
# Reference: https://www.postgresql.org/docs/current/runtime-config-client.html#GUC-STATEMENT-TIMEOUT
|
||
# A value of 0 prevents the server from timing out statements.
|
||
POSTGRES_STATEMENT_TIMEOUT=0
|
||
|
||
# Sets the maximum allowed duration of any idle in-transaction session before termination.
|
||
# Default is 0 (no timeout).
|
||
#
|
||
# Reference: https://www.postgresql.org/docs/current/runtime-config-client.html#GUC-IDLE-IN-TRANSACTION-SESSION-TIMEOUT
|
||
# A value of 0 prevents the server from terminating idle sessions.
|
||
POSTGRES_IDLE_IN_TRANSACTION_SESSION_TIMEOUT=0
|
||
|
||
# MySQL Configuration
|
||
# MySQL data directory host volume
|
||
MYSQL_HOST_VOLUME=./volumes/mysql/data
|
||
|
||
# MySQL Performance Configuration
|
||
# Maximum number of connections to MySQL
|
||
# Default is 1000
|
||
MYSQL_MAX_CONNECTIONS=1000
|
||
|
||
# InnoDB buffer pool size
|
||
# Default is 512M
|
||
# Recommended value: 70-80% of available memory for dedicated MySQL server
|
||
# Reference: https://dev.mysql.com/doc/refman/8.0/en/innodb-parameters.html#sysvar_innodb_buffer_pool_size
|
||
MYSQL_INNODB_BUFFER_POOL_SIZE=512M
|
||
|
||
# InnoDB log file size
|
||
# Default is 128M
|
||
# Reference: https://dev.mysql.com/doc/refman/8.0/en/innodb-parameters.html#sysvar_innodb_log_file_size
|
||
MYSQL_INNODB_LOG_FILE_SIZE=128M
|
||
|
||
# InnoDB flush log at transaction commit
|
||
# Default is 2 (flush to OS cache, sync every second)
|
||
# Options: 0 (no flush), 1 (flush and sync), 2 (flush to OS cache)
|
||
# Reference: https://dev.mysql.com/doc/refman/8.0/en/innodb-parameters.html#sysvar_innodb_flush_log_at_trx_commit
|
||
MYSQL_INNODB_FLUSH_LOG_AT_TRX_COMMIT=2
|
||
|
||
# -----------------------------
|
||
# Environment Variables for redis Service
|
||
# -----------------------------
|
||
REDIS_HOST_VOLUME=./volumes/redis/data
|
||
REDIS_PASSWORD=difyai123456
|
||
# Optional: limit total Redis connections used by API/Worker (unset for default)
|
||
# Align with API's REDIS_MAX_CONNECTIONS in configs
|
||
REDIS_MAX_CONNECTIONS=
|
||
|
||
# ------------------------------
|
||
# Environment Variables for sandbox Service
|
||
# ------------------------------
|
||
SANDBOX_API_KEY=dify-sandbox
|
||
SANDBOX_GIN_MODE=release
|
||
SANDBOX_WORKER_TIMEOUT=15
|
||
SANDBOX_ENABLE_NETWORK=true
|
||
SANDBOX_HTTP_PROXY=http://ssrf_proxy:3128
|
||
SANDBOX_HTTPS_PROXY=http://ssrf_proxy:3128
|
||
SANDBOX_PORT=8194
|
||
|
||
# ------------------------------
|
||
# Environment Variables for ssrf_proxy Service
|
||
# ------------------------------
|
||
SSRF_HTTP_PORT=3128
|
||
SSRF_COREDUMP_DIR=/var/spool/squid
|
||
SSRF_REVERSE_PROXY_PORT=8194
|
||
SSRF_SANDBOX_HOST=sandbox
|
||
SSRF_PROXY_ALLOW_PRIVATE_IPS=
|
||
SSRF_PROXY_ALLOW_PRIVATE_DOMAINS=
|
||
|
||
# ------------------------------
|
||
# Environment Variables for weaviate Service
|
||
# ------------------------------
|
||
WEAVIATE_QUERY_DEFAULTS_LIMIT=25
|
||
WEAVIATE_AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED=true
|
||
WEAVIATE_DEFAULT_VECTORIZER_MODULE=none
|
||
WEAVIATE_CLUSTER_HOSTNAME=node1
|
||
WEAVIATE_AUTHENTICATION_APIKEY_ENABLED=true
|
||
WEAVIATE_AUTHENTICATION_APIKEY_ALLOWED_KEYS=WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih
|
||
WEAVIATE_AUTHENTICATION_APIKEY_USERS=hello@dify.ai
|
||
WEAVIATE_AUTHORIZATION_ADMINLIST_ENABLED=true
|
||
WEAVIATE_AUTHORIZATION_ADMINLIST_USERS=hello@dify.ai
|
||
WEAVIATE_DISABLE_TELEMETRY=false
|
||
WEAVIATE_HOST_VOLUME=./volumes/weaviate
|
||
|
||
# ------------------------------
|
||
# Docker Compose profile configuration
|
||
# ------------------------------
|
||
# Loaded automatically when running `docker compose --env-file middleware.env ...`.
|
||
# Controls which DB/vector services start, so no extra `--profile` flag is needed.
|
||
COMPOSE_PROFILES=${DB_TYPE:-postgresql},weaviate
|
||
|
||
# ------------------------------
|
||
# Docker Compose Service Expose Host Port Configurations
|
||
# ------------------------------
|
||
EXPOSE_POSTGRES_PORT=5432
|
||
EXPOSE_MYSQL_PORT=3306
|
||
EXPOSE_REDIS_PORT=6379
|
||
EXPOSE_SANDBOX_PORT=8194
|
||
EXPOSE_SSRF_PROXY_PORT=3128
|
||
EXPOSE_WEAVIATE_PORT=8080
|
||
|
||
# ------------------------------
|
||
# Plugin Daemon Configuration
|
||
# ------------------------------
|
||
|
||
DB_PLUGIN_DATABASE=dify_plugin
|
||
EXPOSE_PLUGIN_DAEMON_PORT=5002
|
||
PLUGIN_DAEMON_PORT=5002
|
||
PLUGIN_DAEMON_KEY=lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi
|
||
PLUGIN_DAEMON_URL=http://host.docker.internal:5002
|
||
PLUGIN_MAX_PACKAGE_SIZE=52428800
|
||
PLUGIN_PPROF_ENABLED=false
|
||
PLUGIN_WORKING_PATH=/app/storage/cwd
|
||
|
||
ENDPOINT_URL_TEMPLATE=http://localhost:5002/e/{hook_id}
|
||
|
||
PLUGIN_DEBUGGING_PORT=5003
|
||
PLUGIN_DEBUGGING_HOST=0.0.0.0
|
||
EXPOSE_PLUGIN_DEBUGGING_HOST=localhost
|
||
EXPOSE_PLUGIN_DEBUGGING_PORT=5003
|
||
|
||
PLUGIN_DIFY_INNER_API_KEY=QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1
|
||
PLUGIN_DIFY_INNER_API_URL=http://host.docker.internal:5001
|
||
|
||
MARKETPLACE_ENABLED=true
|
||
MARKETPLACE_API_URL=https://marketplace.dify.ai
|
||
|
||
FORCE_VERIFYING_SIGNATURE=true
|
||
|
||
PLUGIN_PYTHON_ENV_INIT_TIMEOUT=120
|
||
PLUGIN_MAX_EXECUTION_TIMEOUT=600
|
||
# PIP_MIRROR_URL=https://pypi.tuna.tsinghua.edu.cn/simple
|
||
PIP_MIRROR_URL=
|
||
|
||
# https://github.com/langgenius/dify-plugin-daemon/blob/main/.env.example
|
||
# Plugin storage type, local aws_s3 tencent_cos azure_blob
|
||
PLUGIN_STORAGE_TYPE=local
|
||
PLUGIN_STORAGE_LOCAL_ROOT=/app/storage
|
||
PLUGIN_WORKING_PATH=/app/storage/cwd
|
||
PLUGIN_INSTALLED_PATH=plugin
|
||
PLUGIN_PACKAGE_CACHE_PATH=plugin_packages
|
||
PLUGIN_MEDIA_CACHE_PATH=assets
|
||
# Plugin oss bucket
|
||
PLUGIN_STORAGE_OSS_BUCKET=
|
||
# Plugin oss s3 credentials
|
||
PLUGIN_S3_USE_AWS_MANAGED_IAM=false
|
||
PLUGIN_S3_USE_AWS=false
|
||
PLUGIN_S3_ENDPOINT=
|
||
PLUGIN_S3_USE_PATH_STYLE=false
|
||
PLUGIN_AWS_ACCESS_KEY=
|
||
PLUGIN_AWS_SECRET_KEY=
|
||
PLUGIN_AWS_REGION=
|
||
# Plugin oss azure blob
|
||
PLUGIN_AZURE_BLOB_STORAGE_CONTAINER_NAME=
|
||
PLUGIN_AZURE_BLOB_STORAGE_CONNECTION_STRING=
|
||
# Plugin oss tencent cos
|
||
PLUGIN_TENCENT_COS_SECRET_KEY=
|
||
PLUGIN_TENCENT_COS_SECRET_ID=
|
||
PLUGIN_TENCENT_COS_REGION=
|
||
# Plugin oss aliyun oss
|
||
PLUGIN_ALIYUN_OSS_REGION=
|
||
PLUGIN_ALIYUN_OSS_ENDPOINT=
|
||
PLUGIN_ALIYUN_OSS_ACCESS_KEY_ID=
|
||
PLUGIN_ALIYUN_OSS_ACCESS_KEY_SECRET=
|
||
PLUGIN_ALIYUN_OSS_AUTH_VERSION=v4
|
||
PLUGIN_ALIYUN_OSS_PATH=
|
||
# Plugin oss volcengine tos
|
||
PLUGIN_VOLCENGINE_TOS_ENDPOINT=
|
||
PLUGIN_VOLCENGINE_TOS_ACCESS_KEY=
|
||
PLUGIN_VOLCENGINE_TOS_SECRET_KEY=
|
||
PLUGIN_VOLCENGINE_TOS_REGION=
|
||
|
||
# ------------------------------
|
||
# Environment Variables for Aliyun SLS (Simple Log Service)
|
||
# ------------------------------
|
||
# Aliyun SLS Access Key ID
|
||
ALIYUN_SLS_ACCESS_KEY_ID=
|
||
# Aliyun SLS Access Key Secret
|
||
ALIYUN_SLS_ACCESS_KEY_SECRET=
|
||
# Aliyun SLS Endpoint (e.g., cn-hangzhou.log.aliyuncs.com)
|
||
ALIYUN_SLS_ENDPOINT=
|
||
# Aliyun SLS Region (e.g., cn-hangzhou)
|
||
ALIYUN_SLS_REGION=
|
||
# Aliyun SLS Project Name
|
||
ALIYUN_SLS_PROJECT_NAME=
|
||
# Aliyun SLS Logstore TTL (default: 365 days， 3650 for permanent storage)
|
||
ALIYUN_SLS_LOGSTORE_TTL=365
|
||
# Enable dual-write to both LogStore and SQL database (default: true)
|
||
LOGSTORE_DUAL_WRITE_ENABLED=true
|
||
# Enable dual-read fallback to SQL database when LogStore returns no results (default: true)
|
||
# Useful for migration scenarios where historical data exists only in SQL database
|
||
LOGSTORE_DUAL_READ_ENABLED=true
|
||
# Control flag for whether to write the `graph` field to LogStore.
|
||
# If LOGSTORE_ENABLE_PUT_GRAPH_FIELD is "true", write the full `graph` field;
|
||
# otherwise write an empty {} instead. Defaults to writing the `graph` field.
|
||
LOGSTORE_ENABLE_PUT_GRAPH_FIELD=true
|