

2025年9月30日,Dify迎来了一个重要的里程碑——第1000位贡献者的加入。伴随着这个里程碑,Dify发布了1.9.1版本,为开发者、运维人员和社区用户带来了多项功能升级、性能优化以及问题修复。本次更新不仅涉及基础设施与构建工具的升级,还针对流水线、引擎、搜索解析、工作流、文件处理、性能网络、UI/UX及代码结构进行了全面优化。下面我们对本次更新的具体内容进行详细梳理。
.
###############################################################################
# Author: Winson Li
# Email: mail@winson.dev
# Github: @Winson-030
###############################################################################
# Namespace
apiVersion: v1
kind: Namespace
metadata:
name: dify
# Dify Credentials
# apiVersion: v1
# kind: Secret
# metadata:
# name: dify-credentials
# namespace: dify
# data:
# # Base64 encoded postgres username, default is postgres
# pg-username: cG9zdGdyZXM=
# # Base64 encoded postgres password, default is difyai123456
# pg-password: ZGlmeWFpMTIzNDU2
# # Base64 encoded postgres host, default is dify-postgres
# pg-host: ZGlmeS1wb3N0Z3Jlcw==
# # Base64 encoded postgres port 5432
# pg-port: NTQzMg==
# # Base64 encoded redis username, default is empty
# redis-username: ""
# # Base64 encoded redis password, default is difyai123456
# redis-password: ZGlmeWFpMTIzNDU2
# # Base64 encoded redis host, default is dify-redis
# redis-host: ZGlmeS1yZWRpcw==
# # Base64 encoded redis port 6379
# redis-port: NjM3OQ==
# # Base64 encoded weaviate host, default is dify-weaviate
# weaviate-host: ZGlmeS13ZWF2aWF0ZQ==
# # Base64 encoded weaviate port 8080
# weaviate-port: ODA4MA==
# type: Opaque
# Postgres Server Start
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/instance: dify-postgres
name: dify-postgres
namespace: dify
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/instance: dify-postgres
name: dify-postgres
namespace: dify
rules:
- apiGroups:
- "*"
resources:
- "*"
verbs:
- "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/instance: dify-postgres
name: dify-postgres
namespace: dify
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: dify-postgres
subjects:
- kind: ServiceAccount
name: dify-postgres
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: dify-postgres
namespace: dify
spec:
selector:
matchLabels:
app: dify-postgres
serviceName: "dify-postgres"
replicas: 1
template:
metadata:
labels:
app: dify-postgres
spec:
serviceAccountName: dify-postgres
terminationGracePeriodSeconds: 10
nodeSelector:
kubernetes.io/os: linux
containers:
- name: dify-postgres
image: postgres:15-alpine
imagePullPolicy: IfNotPresent
env:
- name: PGUSER
value: postgres
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-username
- name: POSTGRES_PASSWORD
value: difyai123456
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-password
- name: POSTGRES_DB
value: dify
- name: PGDATA
value: /var/lib/postgresql/data
# command:
# - "postgres"
# - "-c"
# - "max_connections=100"
# - "-c"
# - "shared_buffers=128MB"
# - "-c"
# - "work_mem=4MB"
# - "-c"
# - "maintenance_work_mem=64MB"
# - "-c"
# - "effective_cache_size=4096MB"
livenessProbe:
exec:
command:
- "pg_isready"
- "-U"
- "$(PGUSER)"
- "-d"
- "$(POSTGRES_DB)"
initialDelaySeconds: 5
periodSeconds: 5
timeoutSeconds: 2
successThreshold: 1
failureThreshold: 10
resources:
limits:
cpu: 500m
memory: 1Gi
requests:
cpu: 100m
memory: 128Mi
ports:
- containerPort: 5432
name: postgres-port
volumeMounts:
- name: postgres-data
mountPath: /var/lib/postgresql/data
volumes:
- name: postgres-data
hostPath:
path: /root/k8s/dify/db/postgres/data
type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
name: dify-postgres
namespace: dify
spec:
selector:
app: dify-postgres
type: ClusterIP
clusterIP: None
ports:
- name: postgres
protocol: TCP
port: 5432
targetPort: 5432
# Postgres Server End
# Redis Server Start
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/instance: dify-redis
name: dify-redis
namespace: dify
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/instance: dify-redis
name: dify-redis
namespace: dify
rules:
- apiGroups:
- "*"
resources:
- "*"
verbs:
- "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/instance: dify-redis
name: dify-redis
namespace: dify
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: dify-redis
subjects:
- kind: ServiceAccount
name: dify-redis
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: dify-redis
namespace: dify
spec:
selector:
matchLabels:
app: dify-redis
serviceName: "dify-redis"
replicas: 1
template:
metadata:
labels:
app: dify-redis
spec:
terminationGracePeriodSeconds: 10
nodeSelector:
kubernetes.io/os: linux
serviceAccountName: dify-redis
containers:
- name: dify-redis
image: redis:6-alpine
imagePullPolicy: IfNotPresent
ports:
- containerPort: 6379
name: redis-p
command: ["redis-server", "--save", "20", "1", "--loglevel", "warning", "--requirepass", "$(REDIS_PASSWORD)"]
resources:
limits:
cpu: 500m
memory: 1024Mi
requests:
cpu: 100m
memory: 102Mi
env:
- name: REDIS_PASSWORD
value: difyai123456
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-password
livenessProbe:
exec:
command:
- redis-cli
- ping
volumeMounts:
- name: redis-data
mountPath: /data
volumes:
- name: redis-data
hostPath:
path: /root/k8s/dify/db/redis/data
type: DirectoryOrCreate
---
apiVersion: v1
kind: Service
metadata:
name: dify-redis
namespace: dify
spec:
selector:
app: dify-redis
type: ClusterIP
clusterIP: None
ports:
- name: redis
protocol: TCP
port: 6379
targetPort: 6379
# Redis Server End
# Weaviate Server Start
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/instance: dify-weaviate
name: dify-weaviate
namespace: dify
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/instance: dify-weaviate
name: dify-weaviate
namespace: dify
rules:
- apiGroups:
- "*"
resources:
- "*"
verbs:
- "*"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/instance: dify-weaviate
name: dify-weaviate
namespace: dify
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: dify-weaviate
subjects:
- kind: ServiceAccount
name: dify-weaviate
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: dify-weaviate
namespace: dify
spec:
selector:
matchLabels:
app: dify-weaviate
serviceName: "dify-weaviate"
replicas: 1
template:
metadata:
labels:
app: dify-weaviate
spec:
terminationGracePeriodSeconds: 10
nodeSelector:
kubernetes.io/os: linux
serviceAccountName: dify-weaviate
volumes:
- name: weaviate-data
hostPath:
path: /root/k8s/dify/db/weaviate/data
type: DirectoryOrCreate
containers:
- name: dify-weaviate
image: semitechnologies/weaviate:1.19.0
imagePullPolicy: IfNotPresent
ports:
- containerPort: 8080
name: weaviate-p
resources:
limits:
cpu: 500m
memory: 1024Mi
requests:
cpu: 100m
memory: 102Mi
env:
- name: QUERY_DEFAULTS_LIMIT
value: "25"
- name: AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED
value: "false"
- name: PERSISTENCE_DATA_PATH
value: "/var/lib/weaviate"
- name: "DEFAULT_VECTORIZER_MODULE"
value: "none"
- name: "AUTHENTICATION_APIKEY_ENABLED"
value: "true"
- name: "AUTHENTICATION_APIKEY_ALLOWED_KEYS"
value: "WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih"
- name: "AUTHENTICATION_APIKEY_USERS"
value: "hello@dify.ai"
- name: "AUTHORIZATION_ADMINLIST_ENABLED"
value: "true"
- name: "AUTHORIZATION_ADMINLIST_USERS"
value: "hello@dify.ai"
volumeMounts:
- name: weaviate-data
mountPath: /var/lib/weaviate
---
apiVersion: v1
kind: Service
metadata:
name: dify-weaviate
namespace: dify
spec:
selector:
app: dify-weaviate
type: ClusterIP
clusterIP: None
ports:
- name: weaviate
protocol: TCP
port: 8080
targetPort: 8080
# Weaviate Server End
# Dify Sandbox Server Start
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: dify-sandbox
namespace: dify
labels:
app: dify-sandbox
spec:
replicas: 1
revisionHistoryLimit: 1
selector:
matchLabels:
app: dify-sandbox
template:
metadata:
labels:
app: dify-sandbox
spec:
automountServiceAccountToken: false
nodeSelector:
kubernetes.io/os: linux
containers:
- name: dify-sandbox
image: langgenius/dify-sandbox:0.2.12
imagePullPolicy: IfNotPresent
env:
- name: API_KEY
value: "dify-sandbox"
- name: GIN_MODE
value: "release"
- name: WORKER_TIMEOUT
value: "15"
- name: ENABLE_NETWORK
value: "true"
- name: SANDBOX_PORT
value: "8194"
# uncomment if you want to use proxy
- name: HTTP_PROXY
value: 'http://dify-ssrf:3128'
- name: HTTPS_PROXY
value: 'http://dify-ssrf:3128'
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 1Gi
livenessProbe:
exec:
command:
- "curl"
- "-f"
- "http://localhost:8194/health"
ports:
- containerPort: 8194
---
apiVersion: v1
kind: Service
metadata:
name: dify-sandbox
namespace: dify
spec:
ports:
- port: 8194
targetPort: 8194
protocol: TCP
name: dify-sandbox
type: ClusterIP
clusterIP: None
selector:
app: dify-sandbox
# Dify Sandbox Server End
# Dify SSRF Proxy Start
---
apiVersion: v1
kind: ConfigMap
metadata:
name: ssrf-proxy-config
namespace: dify
data:
squid.conf: |
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122"this" network (LAN)
acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)
acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN)
acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines
acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN)
acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN)
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
# acl SSL_ports port 1025-65535 # Enable the configuration to resolve this issue: https://github.com/langgenius/dify/issues/12792
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localhost manager
http_access deny manager
http_access allow localhost
http_access allow localnet
http_access deny all
################################## Proxy Server ################################
http_port 3128
coredump_dir /var/spool/squid
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 00% 0 refresh-ims
refresh_pattern \/Release(|\.gpg)$ 00% 0 refresh-ims
refresh_pattern \/InRelease$ 00% 0 refresh-ims
refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 00% 0 refresh-ims
refresh_pattern . 0 20% 4320
# upstream proxy, set to your own upstream proxy IP to avoid SSRF attacks
# cache_peer 172.1.1.1 parent 31280 no-query no-digest no-netdb-exchange default
################################## Reverse Proxy To Sandbox ################################
http_port 8194 accel vhost
# Notice:
# default is 'sandbox' in dify's github repo, here is 'dify-sandbox' because the service name of sandbox is 'dify-sandbox'
# you can change it to your own service name
cache_peer dify-sandbox parent 8194 0 no-query originserver
acl src_all src all
http_access allow src_all
---
apiVersion: v1
kind: ConfigMap
metadata:
name: ssrf-proxy-entrypoint
namespace: dify
data:
docker-entrypoint-mount.sh: |
#!/bin/bash
# Modified based on Squid OCI image entrypoint
# This entrypoint aims to forward the squid logs to stdout to assist users of
# common container related tooling (e.g., kubernetes, docker-compose, etc) to
# access the service logs.
# Moreover, it invokes the squid binary, leaving all the desired parameters to
# be provided by the "command" passed to the spawned container. If no command
# is provided by the user, the default behavior (as per the CMD statement in
# the Dockerfile) will be to use Ubuntu's default configuration [1] and run
# squid with the "-NYC" options to mimic the behavior of the Ubuntu provided
# systemd unit.
# [1] The default configuration is changed in the Dockerfile to allow local
# network connections. See the Dockerfile for further information.
echo "[ENTRYPOINT] re-create snakeoil self-signed certificate removed in the build process"
if [ ! -f /etc/ssl/private/ssl-cert-snakeoil.key ]; then
/usr/sbin/make-ssl-cert generate-default-snakeoil --force-overwrite > /dev/null 2>&1
fi
tail -F /var/log/squid/access.log 2>/dev/null &
tail -F /var/log/squid/error.log 2>/dev/null &
tail -F /var/log/squid/store.log 2>/dev/null &
tail -F /var/log/squid/cache.log 2>/dev/null &
# Replace environment variables in the template and output to the squid.conf
echo "[ENTRYPOINT] replacing environment variables in the template"
awk '{
while(match($0, /\${[A-Za-z_][A-Za-z_0-9]*}/)) {
var = substr($0, RSTART+2, RLENGTH-3)
val = ENVIRON[var]
$0 = substr($0, 1, RSTART-1) val substr($0, RSTART+RLENGTH)
}
print
}' /etc/squid/squid.conf.template > /etc/squid/squid.conf
/usr/sbin/squid -Nz
echo "[ENTRYPOINT] starting squid"
/usr/sbin/squid -f /etc/squid/squid.conf -NYC 1
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: dify-ssrf
namespace: dify
labels:
app: dify-ssrf
spec:
selector:
matchLabels:
app: dify-ssrf
replicas: 1
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
labels:
app: dify-ssrf
spec:
nodeSelector:
kubernetes.io/os: linux
containers:
- name: dify-ssrf
image: ubuntu/squid:latest
imagePullPolicy: IfNotPresent
env:
- name: HTTP_PORT
value: "3128"
- name: COREDUMP_DIR
value: "/var/spool/squid"
- name: REVERSE_PROXY_PORT
value: "8194"
- name: SANDBOX_HOST
value: "dify-sandbox"
- name: SANDBOX_PORT
value: "8194"
resources:
requests:
cpu: 100m
memory: 100Mi
limits:
cpu: 300m
memory: 300Mi
ports:
- containerPort: 3128
name: dify-ssrf
volumeMounts:
- name: ssrf-proxy-config
mountPath: /etc/squid/
- name: ssrf-proxy-entrypoint
mountPath: /tmp/
command: [ "sh", "-c", "cp /tmp/docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh" ]
volumes:
- name: ssrf-proxy-config
configMap:
name: ssrf-proxy-config
- name: ssrf-proxy-entrypoint
configMap:
name: ssrf-proxy-entrypoint
---
apiVersion: v1
kind: Service
metadata:
name: dify-ssrf
namespace: dify
spec:
selector:
app: dify-ssrf
ports:
- protocol: TCP
port: 3128
targetPort: 3128
# Dify SSRF Proxy End
# Dify API Server End
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: dify-api
labels:
app.kubernetes.io/instance: dify-api
app: dify-api
namespace: dify
spec:
replicas: 1
revisionHistoryLimit: 1
minReadySeconds: 10
serviceName: dify-api
selector:
matchLabels:
app: dify-api
template:
metadata:
labels:
app: dify-api
spec:
nodeSelector:
kubernetes.io/os: linux
volumes:
- name: dify-api-storage
hostPath:
path: /root/k8s/dify/app/api/storage
type: DirectoryOrCreate
containers:
- name: dify-api
image: langgenius/dify-api:1.9.1
imagePullPolicy: IfNotPresent
env:
- name: MODE
value: api
- name: LOG_LEVEL
value: DEBUG
- name: SECRET_KEY
value: "sk-9f73s3ljTXVcMT3Blb3ljTqtsKiGHXVcMT3BlbkFJLK7U"
- name: CONSOLE_WEB_URL
value: ""
- name: INIT_PASSWORD
value: password
- name: CONSOLE_API_URL
value: ""
- name: SERVICE_API_URL
value: ""
- name: APP_WEB_URL
value: ""
- name: FILES_URL
value: ""
- name: MIGRATION_ENABLED
value: "true"
- name: DB_USERNAME
value: postgres
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-username
- name: DB_PASSWORD
value: difyai123456
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-password
- name: DB_HOST
value: dify-postgres
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-host
- name: DB_PORT
value: '5432'
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-port
- name: DB_DATABASE
value: dify
- name: REDIS_HOST
value: dify-redis
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-host
- name: REDIS_PORT
value: '6379'
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-port
# default redis username is empty
- name: REDIS_USERNAME
value: ''
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-username
- name: REDIS_PASSWORD
value: difyai123456
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-password
- name: REDIS_USE_SSL
value: "false"
- name: REDIS_DB
value: "0"
- name: CELERY_BROKER_URL
value: >-
redis://$(REDIS_USERNAME):$(REDIS_PASSWORD)@$(REDIS_HOST):$(REDIS_PORT)/1
- name: WEB_API_CORS_ALLOW_ORIGINS
value: "*"
- name: CONSOLE_CORS_ALLOW_ORIGINS
value: "*"
- name: STORAGE_TYPE
value: opendal
- name: OPENDAL_SCHEME
value: fs
- name: OPENDAL_FS_ROOT
value: storage
- name: STORAGE_LOCAL_PATH
value: /app/api/storage
- name: VECTOR_STORE
value: weaviate
- name: WEAVIATE_HOST
value: dify-weaviate
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: weaviate-host
- name: WEAVIATE_PORT
value: '8080'
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: weaviate-port
- name: WEAVIATE_ENDPOINT
value: http://$(WEAVIATE_HOST):$(WEAVIATE_PORT)
- name: WEAVIATE_API_KEY
value: "WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih"
- name: CODE_EXECUTION_ENDPOINT
value: http://dify-sandbox:8194
- name: CODE_EXECUTION_API_KEY
value: dify-sandbox
- name: CODE_MAX_NUMBER
value: "9223372036854775807"
- name: CODE_MIN_NUMBER
value: "-9223372036854775808"
- name: CODE_MAX_STRING_LENGTH
value: "80000"
- name: TEMPLATE_TRANSFORM_MAX_LENGTH
value: "80000"
- name: CODE_MAX_STRING_ARRAY_LENGTH
value: "30"
- name: CODE_MAX_OBJECT_ARRAY_LENGTH
value: "30"
- name: CODE_MAX_NUMBER_ARRAY_LENGTH
value: "1000"
- name: INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH
value: "1000"
# uncommect to enable SSRF
- name: SSRF_PROXY_HTTP_URL
value: 'http://dify-ssrf:3128'
- name: SSRF_PROXY_HTTPS_URL
value: 'http://dify-ssrf:3128'
- name: SENTRY_DSN
value: ''
- name: SENTRY_TRACES_SAMPLE_RATE
value: '1.0'
- name: SENTRY_PROFILES_SAMPLE_RATE
value: '1.0'
# plugin settings
- name: 'PLUGIN_MAX_PACKAGE_SIZE'
value: '52428800'
- name: 'INNER_API_KEY_FOR_PLUGIN'
value: 'QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1'
- name: 'PLUGIN_DAEMON_KEY'
value: 'lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi'
- name: 'PLUGIN_DAEMON_URL'
value: 'http://dify-plugin-daemon:5002'
- name: 'MARKETPLACE_ENABLED'
value: 'true'
- name: 'MARKETPLACE_API_URL'
value: 'https://marketplace.dify.ai'
resources:
requests:
cpu: 200m
memory: 256Mi
limits:
cpu: 1000m
memory: 2Gi
ports:
- containerPort: 5001
volumeMounts:
- name: dify-api-storage
mountPath: /app/api/storage
---
apiVersion: v1
kind: Service
metadata:
name: dify-api
namespace: dify
spec:
ports:
- port: 5001
targetPort: 5001
protocol: TCP
name: dify-api
type: ClusterIP
selector:
app: dify-api
# Dify API Server End
# Dify Worker Server Start
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: dify-worker
namespace: dify
labels:
app: dify-worker
app.kubernetes.io/instance: dify-worker
spec:
serviceName: "dify-worker"
replicas: 1
selector:
matchLabels:
app: dify-worker
template:
metadata:
labels:
app: dify-worker
spec:
nodeSelector:
kubernetes.io/os: linux
volumes:
- name: dify-api-storage
hostPath:
path: /root/k8s/dify/app/api/storage
type: DirectoryOrCreate
containers:
- name: dify-worker
image: langgenius/dify-api:1.9.1
imagePullPolicy: IfNotPresent
ports:
- containerPort: 5001
protocol: TCP
env:
- name: CONSOLE_WEB_URL
value: ""
- name: MODE
value: worker
- name: LOG_LEVEL
value: INFO
- name: SECRET_KEY
value: "sk-9f73s3ljTXVcMT3Blb3ljTqtsKiGHXVcMT3BlbkFJLK7U"
- name: DB_USERNAME
value: postgres
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-username
- name: DB_PASSWORD
value: difyai123456
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-password
- name: DB_HOST
value: dify-postgres
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-host
- name: DB_PORT
value: '5432'
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: pg-port
- name: DB_DATABASE
value: dify
- name: REDIS_HOST
value: dify-redis
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-host
- name: REDIS_PORT
value: '6379'
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-port
# default redis username is empty
- name: REDIS_USERNAME
value: ''
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-username
- name: REDIS_PASSWORD
value: difyai123456
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: redis-password
- name: REDIS_USE_SSL
value: "false"
- name: REDIS_DB
value: "0"
- name: CELERY_BROKER_URL
value: >-
redis://$(REDIS_USERNAME):$(REDIS_PASSWORD)@$(REDIS_HOST):$(REDIS_PORT)/1
- name: WEB_API_CORS_ALLOW_ORIGINS
value: "*"
- name: CONSOLE_CORS_ALLOW_ORIGINS
value: "*"
- name: STORAGE_TYPE
value: opendal
- name: OPENDAL_SCHEME
value: fs
- name: OPENDAL_FS_ROOT
value: storage
- name: STORAGE_LOCAL_PATH
value: /app/api/storage
- name: VECTOR_STORE
value: weaviate
- name: WEAVIATE_HOST
value: dify-weaviate
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: weaviate-host
- name: WEAVIATE_PORT
value: '8080'
# valueFrom:
# secretKeyRef:
# name: dify-credentials
# key: weaviate-port
- name: WEAVIATE_ENDPOINT
value: http://$(WEAVIATE_HOST):$(WEAVIATE_PORT)
- name: WEAVIATE_API_KEY
value: "WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih"
- name: SSRF_PROXY_HTTP_URL
value: 'http://dify-ssrf:3128'
- name: SSRF_PROXY_HTTPS_URL
value: 'http://dify-ssrf:3128'
- name: SENTRY_DSN
value: ''
- name: SENTRY_TRACES_SAMPLE_RATE
value: '1.0'
- name: SENTRY_PROFILES_SAMPLE_RATE
value: '1.0'
# plugin settings
- name: 'PLUGIN_MAX_PACKAGE_SIZE'
value: '52428800'
- name: 'PLUGIN_DAEMON_URL'
value: 'http://dify-plugin-daemon:5002'
- name: 'PLUGIN_DAEMON_KEY'
value: 'lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi'
- name: 'INNER_API_KEY_FOR_PLUGIN'
value: 'QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1'
- name: 'MARKETPLACE_ENABLED'
value: 'true'
- name: 'MARKETPLACE_API_URL'
value: 'https://marketplace.dify.ai'
resources:
requests:
cpu: 200m
memory: 256Mi
limits:
cpu: 1000m
memory: 2Gi
volumeMounts:
- name: dify-api-storage
mountPath: /app/api/storage
restartPolicy: Always
---
apiVersion: v1
kind: Service
metadata:
name: dify-worker
namespace: dify
spec:
ports:
- protocol: TCP
port: 5001
targetPort: 5001
selector:
app: dify-worker
type: ClusterIP
# Dify Worker Server End
# Dify Web Server Start
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: dify-web
namespace: dify
labels:
app: dify-web
spec:
replicas: 1
revisionHistoryLimit: 1
selector:
matchLabels:
app: dify-web
template:
metadata:
labels:
app: dify-web
spec:
nodeSelector:
kubernetes.io/os: linux
automountServiceAccountToken: false
containers:
- name: dify-web
image: langgenius/dify-web:1.9.1
imagePullPolicy: IfNotPresent
env:
- name: EDITION
value: SELF_HOSTED
- name: CONSOLE_API_URL
value: ""
- name: APP_API_URL
value: ""
- name: SENTRY_DSN
value: ""
- name: NEXT_TELEMETRY_DISABLED
value: "0"
- name: TEXT_GENERATION_TIMEOUT_MS
value: "60000"
- name: CSP_WHITELIST
value: ""
# dify marketplace
- name: 'MARKETPLACE_API_URL'
value: 'https://marketplace.dify.ai'
- name: 'MARKETPLACE_URL'
value: 'https://marketplace.dify.ai'
- name: 'TOP_K_MAX_VALUE'
value: ''
- name: 'INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH'
value: ''
- name: 'PM2_INSTANCES'
value: '2'
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 1Gi
ports:
- containerPort: 3000
---
apiVersion: v1
kind: Service
metadata:
name: dify-web
namespace: dify
spec:
ports:
- port: 3000
targetPort: 3000
protocol: TCP
name: dify-web
type: ClusterIP
selector:
app: dify-web
# Dify Web Server End
# Dify Nginx Server Start
---
apiVersion: v1
kind: ConfigMap
metadata:
name: dify-nginx
namespace: dify
data:
nginx.conf: |-
user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log notice;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
client_max_body_size 15M;
server {
listen 80;
server_name _;
location /console/api {
proxy_pass http://dify-api:5001;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location /api {
proxy_pass http://dify-api:5001;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location /v1 {
proxy_pass http://dify-api:5001;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location /files {
proxy_pass http://dify-api:5001;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location /explore {
proxy_pass http://dify-web:3000;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location /e/ {
proxy_pass http://dify-plugin-daemon:5002;
proxy_set_header Dify-Hook-Url ://;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
location / {
proxy_pass http://dify-web:3000;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;
proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
}
# If you want to support HTTPS, please uncomment the code snippet below
#listen 443 ssl;
#ssl_certificate ./../ssl/your_cert_file.cer;
#ssl_certificate_key ./../ssl/your_cert_key.key;
#ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;
#ssl_prefer_server_ciphers on;
#ssl_session_cache shared:SSL:10m;
#ssl_session_timeout 10m;
}
}
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: dify-nginx
namespace: dify
labels:
app: dify-nginx
spec:
replicas: 1
revisionHistoryLimit: 1
selector:
matchLabels:
app: dify-nginx
template:
metadata:
labels:
app: dify-nginx
spec:
nodeSelector:
kubernetes.io/os: linux
automountServiceAccountToken: false
containers:
- name: dify-nginx
image: nginx:stable
imagePullPolicy: IfNotPresent
resources:
requests:
cpu: 50m
memory: 128Mi
limits:
cpu: 500m
memory: 1Gi
ports:
- containerPort: 80
volumeMounts:
- name: dify-nginx
mountPath: /etc/nginx/nginx.conf
subPath: nginx.conf
- name: dify-nginx-config
mountPath: /etc/nginx/conf.d
imagePullPolicy: IfNotPresent
volumes:
- name: dify-nginx
configMap:
name: dify-nginx
# Persistent volume could be better
- name: dify-nginx-config
emptyDir: {}
---
kind: Service
apiVersion: v1
metadata:
name: dify-nginx
namespace: dify
spec:
selector:
app: dify-nginx
type: ClusterIP
ports:
- name: dify-nginx
port: 80
targetPort: 80
# ---
kind: Service
apiVersion: v1
metadata:
name: dify-nginx-nodeport
namespace: dify
spec:
selector:
app: dify-nginx
type: NodePort
ports:
- name: dify-nginx
port: 80
targetPort: 80
nodePort: 30000
# Dify Nginx Server End
# Dify plugin daemon Start
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: dify-plugin-daemon
namespace: dify
labels:
app: dify-plugin-daemon
spec:
replicas: 1
revisionHistoryLimit: 1
selector:
matchLabels:
app: dify-plugin-daemon
template:
metadata:
labels:
app: dify-plugin-daemon
spec:
nodeSelector:
kubernetes.io/os: linux
automountServiceAccountToken: false
volumes:
- name: dify-plugin-daemon-storage
hostPath:
path: /root/k8s/dify/app/plugin/storage
type: DirectoryOrCreate
containers:
- name: dify-plugin-daemon
image: langgenius/dify-plugin-daemon:0.3.0-local
imagePullPolicy: IfNotPresent
resources:
limits:
memory: "1024Mi"
cpu: "2000m"
requests:
memory: "256Mi"
cpu: "500m"
ports:
- containerPort: 5003
protocol: TCP
name: debug-port
- containerPort: 5002
protocol: TCP
name: service-port
env:
- name: DB_USERNAME
value: postgres
- name: DB_PASSWORD
value: difyai123456
- name: DB_HOST
value: dify-postgres
- name: DB_PORT
value: '5432'
- name: REDIS_HOST
value: dify-redis
- name: REDIS_PORT
value: '6379'
- name: REDIS_USERNAME
value: ''
- name: REDIS_PASSWORD
value: difyai123456
- name: REDIS_USE_SSL
value: "false"
- name: REDIS_DB
value: "0"
- name: CELERY_BROKER_URL
value: >-
redis://$(REDIS_USERNAME):$(REDIS_PASSWORD)@$(REDIS_HOST):$(REDIS_PORT)/1
- name: 'DB_DATABASE'
value: 'dify_plugin'
- name: 'SERVER_PORT'
value: '5002'
- name: 'EXPOSE_PLUGIN_DAEMON_PORT'
value: '5002'
- name: 'SERVER_KEY'
value: 'lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi'
- name: 'MAX_PLUGIN_PACKAGE_SIZE'
value: '52428800'
- name: 'PPROF_ENABLED'
value: 'false'
- name: 'DIFY_INNER_API_URL'
value: 'http://dify-api:5001'
- name: 'DIFY_INNER_API_KEY'
value: 'QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1'
- name: 'PLUGIN_REMOTE_INSTALLING_HOST'
value: '0.0.0.0'
- name: 'PLUGIN_REMOTE_INSTALLING_PORT'
value: '5003'
- name: 'PLUGIN_WORKING_PATH'
value: '/app/storage/cwd'
- name: 'FORCE_VERIFYING_SIGNATURE'
value: 'true'
- name: 'EXPOSE_PLUGIN_DEBUGGING_HOST'
value: 'localhost'
- name: 'EXPOSE_PLUGIN_DEBUGGING_PORT'
value: '5003'
# - name: 'ENDPOINT_URL_TEMPLATE'
# value: 'http://localhost/e/{hook_id}'
volumeMounts:
- name: dify-plugin-daemon-storage
mountPath: /app/storage
---
apiVersion: v1
kind: Service
metadata:
name: dify-plugin-daemon
namespace: dify
spec:
type: ClusterIP
selector:
app: dify-plugin-daemon
ports:
- port: 5003
targetPort: 5003
protocol: TCP
name: debug-port
- port: 5002
targetPort: 5002
protocol: TCP
name: service-port
# Dify Plugin Daemon End
在这里插入图片描述
cd docker
cp docker-compose.yaml docker-compose.yaml.$(date +%s).bakgit checkout main
git pull origin maindocker compose downtar -cvf volumes-$(date +%s).tgz volumesdocker compose up -dgit checkout 1.9.1cd api
uv syncuv run flask db upgradeDify 1.9.1不仅是一个功能改进版本,更是一个值得铭记的里程碑版本。在保持性能优化和用户体验提升的同时,它为多语言部署、插件管理、文件处理和工作流等核心功能提供了更稳定和可扩展的支持。
我们相信人工智能为普通人提供了一种“增强工具”,并致力于分享全方位的AI知识。在这里,您可以找到最新的AI科普文章、工具评测、提升效率的秘籍以及行业洞察。 欢迎关注“福大大架构师每日一题”,发消息可获得面试资料,让AI助力您的未来发展。