twenty and dify
This commit is contained in:
serban-alexandru
@@ -0,0 +1,5 @@
|
|||||||
|
# Dify
|
||||||
|
|
||||||
|
- copied from https://github.com/langgenius/dify
|
||||||
|
- removed `container_name`
|
||||||
|
- removed `ports`
|
||||||
@@ -0,0 +1,623 @@
|
|||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for API service & worker
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Common Variables
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# The backend URL of the console API,
|
||||||
|
# used to concatenate the authorization callback.
|
||||||
|
# If empty, it is the same domain.
|
||||||
|
# Example: https://api.console.dify.ai
|
||||||
|
CONSOLE_API_URL=
|
||||||
|
|
||||||
|
# The front-end URL of the console web,
|
||||||
|
# used to concatenate some front-end addresses and for CORS configuration use.
|
||||||
|
# If empty, it is the same domain.
|
||||||
|
# Example: https://console.dify.ai
|
||||||
|
CONSOLE_WEB_URL=
|
||||||
|
|
||||||
|
# Service API Url,
|
||||||
|
# used to display Service API Base Url to the front-end.
|
||||||
|
# If empty, it is the same domain.
|
||||||
|
# Example: https://api.dify.ai
|
||||||
|
SERVICE_API_URL=
|
||||||
|
|
||||||
|
# WebApp API backend Url,
|
||||||
|
# used to declare the back-end URL for the front-end API.
|
||||||
|
# If empty, it is the same domain.
|
||||||
|
# Example: https://api.app.dify.ai
|
||||||
|
APP_API_URL=
|
||||||
|
|
||||||
|
# WebApp Url,
|
||||||
|
# used to display WebAPP API Base Url to the front-end.
|
||||||
|
# If empty, it is the same domain.
|
||||||
|
# Example: https://app.dify.ai
|
||||||
|
APP_WEB_URL=
|
||||||
|
|
||||||
|
# File preview or download Url prefix.
|
||||||
|
# used to display File preview or download Url to the front-end or as Multi-model inputs;
|
||||||
|
# Url is signed and has expiration time.
|
||||||
|
FILES_URL=
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Server Configuration
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# The log level for the application.
|
||||||
|
# Supported values are `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL`
|
||||||
|
LOG_LEVEL=INFO
|
||||||
|
|
||||||
|
# Debug mode, default is false.
|
||||||
|
# It is recommended to turn on this configuration for local development
|
||||||
|
# to prevent some problems caused by monkey patch.
|
||||||
|
DEBUG=false
|
||||||
|
|
||||||
|
# Flask debug mode, it can output trace information at the interface when turned on,
|
||||||
|
# which is convenient for debugging.
|
||||||
|
FLASK_DEBUG=false
|
||||||
|
|
||||||
|
# A secretkey that is used for securely signing the session cookie
|
||||||
|
# and encrypting sensitive information on the database.
|
||||||
|
# You can generate a strong key using `openssl rand -base64 42`.
|
||||||
|
SECRET_KEY=sk-9f73s3ljTXVcMT3Blb3ljTqtsKiGHXVcMT3BlbkFJLK7U
|
||||||
|
|
||||||
|
# Password for admin user initialization.
|
||||||
|
# If left unset, admin user will not be prompted for a password
|
||||||
|
# when creating the initial admin account.
|
||||||
|
INIT_PASSWORD=
|
||||||
|
|
||||||
|
# Deployment environment.
|
||||||
|
# Supported values are `PRODUCTION`, `TESTING`. Default is `PRODUCTION`.
|
||||||
|
# Testing environment. There will be a distinct color label on the front-end page,
|
||||||
|
# indicating that this environment is a testing environment.
|
||||||
|
DEPLOY_ENV=PRODUCTION
|
||||||
|
|
||||||
|
# Whether to enable the version check policy.
|
||||||
|
# If set to empty, https://updates.dify.ai will not be called for version check.
|
||||||
|
CHECK_UPDATE_URL=https://updates.dify.ai
|
||||||
|
|
||||||
|
# Used to change the OpenAI base address, default is https://api.openai.com/v1.
|
||||||
|
# When OpenAI cannot be accessed in China, replace it with a domestic mirror address,
|
||||||
|
# or when a local model provides OpenAI compatible API, it can be replaced.
|
||||||
|
OPENAI_API_BASE=https://api.openai.com/v1
|
||||||
|
|
||||||
|
# When enabled, migrations will be executed prior to application startup
|
||||||
|
# and the application will start after the migrations have completed.
|
||||||
|
MIGRATION_ENABLED=true
|
||||||
|
|
||||||
|
# File Access Time specifies a time interval in seconds for the file to be accessed.
|
||||||
|
# The default value is 300 seconds.
|
||||||
|
FILES_ACCESS_TIMEOUT=300
|
||||||
|
|
||||||
|
# The maximum number of active requests for the application, where 0 means unlimited, should be a non-negative integer.
|
||||||
|
APP_MAX_ACTIVE_REQUESTS=0
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Container Startup Related Configuration
|
||||||
|
# Only effective when starting with docker image or docker-compose.
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# API service binding address, default: 0.0.0.0, i.e., all addresses can be accessed.
|
||||||
|
DIFY_BIND_ADDRESS=0.0.0.0
|
||||||
|
|
||||||
|
# API service binding port number, default 5001.
|
||||||
|
DIFY_PORT=5001
|
||||||
|
|
||||||
|
# The number of API server workers, i.e., the number of gevent workers.
|
||||||
|
# Formula: number of cpu cores x 2 + 1
|
||||||
|
# Reference: https://docs.gunicorn.org/en/stable/design.html#how-many-workers
|
||||||
|
SERVER_WORKER_AMOUNT=
|
||||||
|
|
||||||
|
# Defaults to gevent. If using windows, it can be switched to sync or solo.
|
||||||
|
SERVER_WORKER_CLASS=
|
||||||
|
|
||||||
|
# Similar to SERVER_WORKER_CLASS. Default is gevent.
|
||||||
|
# If using windows, it can be switched to sync or solo.
|
||||||
|
CELERY_WORKER_CLASS=
|
||||||
|
|
||||||
|
# Request handling timeout. The default is 200,
|
||||||
|
# it is recommended to set it to 360 to support a longer sse connection time.
|
||||||
|
GUNICORN_TIMEOUT=360
|
||||||
|
|
||||||
|
# The number of Celery workers. The default is 1, and can be set as needed.
|
||||||
|
CELERY_WORKER_AMOUNT=
|
||||||
|
|
||||||
|
# API Tool configuration
|
||||||
|
API_TOOL_DEFAULT_CONNECT_TIMEOUT=10
|
||||||
|
API_TOOL_DEFAULT_READ_TIMEOUT=60
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Database Configuration
|
||||||
|
# The database uses PostgreSQL. Please use the public schema.
|
||||||
|
# It is consistent with the configuration in the 'db' service below.
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
DB_USERNAME=postgres
|
||||||
|
DB_PASSWORD=difyai123456
|
||||||
|
DB_HOST=db
|
||||||
|
DB_PORT=5432
|
||||||
|
DB_DATABASE=dify
|
||||||
|
# The size of the database connection pool.
|
||||||
|
# The default is 30 connections, which can be appropriately increased.
|
||||||
|
SQLALCHEMY_POOL_SIZE=30
|
||||||
|
# Database connection pool recycling time, the default is 3600 seconds.
|
||||||
|
SQLALCHEMY_POOL_RECYCLE=3600
|
||||||
|
# Whether to print SQL, default is false.
|
||||||
|
SQLALCHEMY_ECHO=false
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Redis Configuration
|
||||||
|
# This Redis configuration is used for caching and for pub/sub during conversation.
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
REDIS_HOST=redis
|
||||||
|
REDIS_PORT=6379
|
||||||
|
REDIS_USERNAME=
|
||||||
|
REDIS_PASSWORD=difyai123456
|
||||||
|
REDIS_USE_SSL=false
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Celery Configuration
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# Use redis as the broker, and redis db 1 for celery broker.
|
||||||
|
# Format as follows: `redis://<redis_username>:<redis_password>@<redis_host>:<redis_port>/<redis_database>`
|
||||||
|
# Example: redis://:difyai123456@redis:6379/1
|
||||||
|
CELERY_BROKER_URL=redis://:difyai123456@redis:6379/1
|
||||||
|
BROKER_USE_SSL=false
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# CORS Configuration
|
||||||
|
# Used to set the front-end cross-domain access policy.
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# Specifies the allowed origins for cross-origin requests to the Web API,
|
||||||
|
# e.g. https://dify.app or * for all origins.
|
||||||
|
WEB_API_CORS_ALLOW_ORIGINS=*
|
||||||
|
|
||||||
|
# Specifies the allowed origins for cross-origin requests to the console API,
|
||||||
|
# e.g. https://cloud.dify.ai or * for all origins.
|
||||||
|
CONSOLE_CORS_ALLOW_ORIGINS=*
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# File Storage Configuration
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# The type of storage to use for storing user files.
|
||||||
|
# Supported values are `local` and `s3` and `azure-blob` and `google-storage` and `tencent-cos`,
|
||||||
|
# Default: `local`
|
||||||
|
STORAGE_TYPE=local
|
||||||
|
|
||||||
|
# S3 Configuration
|
||||||
|
# Whether to use AWS managed IAM roles for authenticating with the S3 service.
|
||||||
|
# If set to false, the access key and secret key must be provided.
|
||||||
|
S3_USE_AWS_MANAGED_IAM=false
|
||||||
|
# The endpoint of the S3 service.
|
||||||
|
S3_ENDPOINT=
|
||||||
|
# The region of the S3 service.
|
||||||
|
S3_REGION=us-east-1
|
||||||
|
# The name of the S3 bucket to use for storing files.
|
||||||
|
S3_BUCKET_NAME=difyai
|
||||||
|
# The access key to use for authenticating with the S3 service.
|
||||||
|
S3_ACCESS_KEY=
|
||||||
|
# The secret key to use for authenticating with the S3 service.
|
||||||
|
S3_SECRET_KEY=
|
||||||
|
|
||||||
|
# Azure Blob Configuration
|
||||||
|
# The name of the Azure Blob Storage account to use for storing files.
|
||||||
|
AZURE_BLOB_ACCOUNT_NAME=difyai
|
||||||
|
# The access key to use for authenticating with the Azure Blob Storage account.
|
||||||
|
AZURE_BLOB_ACCOUNT_KEY=difyai
|
||||||
|
# The name of the Azure Blob Storage container to use for storing files.
|
||||||
|
AZURE_BLOB_CONTAINER_NAME=difyai-container
|
||||||
|
# The URL of the Azure Blob Storage account.
|
||||||
|
AZURE_BLOB_ACCOUNT_URL=https://<your_account_name>.blob.core.windows.net
|
||||||
|
|
||||||
|
# Google Storage Configuration
|
||||||
|
# The name of the Google Storage bucket to use for storing files.
|
||||||
|
GOOGLE_STORAGE_BUCKET_NAME=your-bucket-name
|
||||||
|
# The service account JSON key to use for authenticating with the Google Storage service.
|
||||||
|
GOOGLE_STORAGE_SERVICE_ACCOUNT_JSON_BASE64=your-google-service-account-json-base64-string
|
||||||
|
|
||||||
|
# The Alibaba Cloud OSS configurations,
|
||||||
|
# only available when STORAGE_TYPE is `aliyun-oss`
|
||||||
|
ALIYUN_OSS_BUCKET_NAME=your-bucket-name
|
||||||
|
ALIYUN_OSS_ACCESS_KEY=your-access-key
|
||||||
|
ALIYUN_OSS_SECRET_KEY=your-secret-key
|
||||||
|
ALIYUN_OSS_ENDPOINT=https://oss-ap-southeast-1-internal.aliyuncs.com
|
||||||
|
ALIYUN_OSS_REGION=ap-southeast-1
|
||||||
|
ALIYUN_OSS_AUTH_VERSION=v4
|
||||||
|
|
||||||
|
# Tencent COS Configuration
|
||||||
|
# The name of the Tencent COS bucket to use for storing files.
|
||||||
|
TENCENT_COS_BUCKET_NAME=your-bucket-name
|
||||||
|
# The secret key to use for authenticating with the Tencent COS service.
|
||||||
|
TENCENT_COS_SECRET_KEY=your-secret-key
|
||||||
|
# The secret id to use for authenticating with the Tencent COS service.
|
||||||
|
TENCENT_COS_SECRET_ID=your-secret-id
|
||||||
|
# The region of the Tencent COS service.
|
||||||
|
TENCENT_COS_REGION=your-region
|
||||||
|
# The scheme of the Tencent COS service.
|
||||||
|
TENCENT_COS_SCHEME=your-scheme
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Vector Database Configuration
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# The type of vector store to use.
|
||||||
|
# Supported values are `weaviate`, `qdrant`, `milvus`, `myscale`, `relyt`, `pgvector`, `chroma`, `opensearch`, `tidb_vector`, `oracle`, `tencent`.
|
||||||
|
VECTOR_STORE=weaviate
|
||||||
|
|
||||||
|
# The Weaviate endpoint URL. Only available when VECTOR_STORE is `weaviate`.
|
||||||
|
WEAVIATE_ENDPOINT=http://weaviate:8080
|
||||||
|
# The Weaviate API key.
|
||||||
|
WEAVIATE_API_KEY=WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih
|
||||||
|
|
||||||
|
# The Qdrant endpoint URL. Only available when VECTOR_STORE is `qdrant`.
|
||||||
|
QDRANT_URL=http://qdrant:6333
|
||||||
|
# The Qdrant API key.
|
||||||
|
QDRANT_API_KEY=difyai123456
|
||||||
|
# The Qdrant client timeout setting.
|
||||||
|
QDRANT_CLIENT_TIMEOUT=20
|
||||||
|
# The Qdrant client enable gRPC mode.
|
||||||
|
QDRANT_GRPC_ENABLED=false
|
||||||
|
# The Qdrant server gRPC mode PORT.
|
||||||
|
QDRANT_GRPC_PORT=6334
|
||||||
|
|
||||||
|
# Milvus configuration Only available when VECTOR_STORE is `milvus`.
|
||||||
|
# The milvus host.
|
||||||
|
MILVUS_HOST=127.0.0.1
|
||||||
|
# The milvus host.
|
||||||
|
MILVUS_PORT=19530
|
||||||
|
# The milvus username.
|
||||||
|
MILVUS_USER=root
|
||||||
|
# The milvus password.
|
||||||
|
MILVUS_PASSWORD=Milvus
|
||||||
|
# The milvus tls switch.
|
||||||
|
MILVUS_SECURE=false
|
||||||
|
|
||||||
|
# MyScale configuration, only available when VECTOR_STORE is `myscale`
|
||||||
|
# For multi-language support, please set MYSCALE_FTS_PARAMS with referring to:
|
||||||
|
# https://myscale.com/docs/en/text-search/#understanding-fts-index-parameters
|
||||||
|
MYSCALE_HOST=myscale
|
||||||
|
MYSCALE_PORT=8123
|
||||||
|
MYSCALE_USER=default
|
||||||
|
MYSCALE_PASSWORD=
|
||||||
|
MYSCALE_DATABASE=dify
|
||||||
|
MYSCALE_FTS_PARAMS=
|
||||||
|
|
||||||
|
# pgvector configurations, only available when VECTOR_STORE is `pgvecto-rs or pgvector`
|
||||||
|
PGVECTOR_HOST=pgvector
|
||||||
|
PGVECTOR_PORT=5432
|
||||||
|
PGVECTOR_USER=postgres
|
||||||
|
PGVECTOR_PASSWORD=difyai123456
|
||||||
|
PGVECTOR_DATABASE=dify
|
||||||
|
|
||||||
|
# TiDB vector configurations, only available when VECTOR_STORE is `tidb`
|
||||||
|
TIDB_VECTOR_HOST=tidb
|
||||||
|
TIDB_VECTOR_PORT=4000
|
||||||
|
TIDB_VECTOR_USER=xxx.root
|
||||||
|
TIDB_VECTOR_PASSWORD=xxxxxx
|
||||||
|
TIDB_VECTOR_DATABASE=dify
|
||||||
|
|
||||||
|
# Chroma configuration, only available when VECTOR_STORE is `chroma`
|
||||||
|
CHROMA_HOST=127.0.0.1
|
||||||
|
CHROMA_PORT=8000
|
||||||
|
CHROMA_TENANT=default_tenant
|
||||||
|
CHROMA_DATABASE=default_database
|
||||||
|
CHROMA_AUTH_PROVIDER=chromadb.auth.token_authn.TokenAuthClientProvider
|
||||||
|
CHROMA_AUTH_CREDENTIALS=xxxxxx
|
||||||
|
|
||||||
|
# Oracle configuration, only available when VECTOR_STORE is `oracle`
|
||||||
|
ORACLE_HOST=oracle
|
||||||
|
ORACLE_PORT=1521
|
||||||
|
ORACLE_USER=dify
|
||||||
|
ORACLE_PASSWORD=dify
|
||||||
|
ORACLE_DATABASE=FREEPDB1
|
||||||
|
|
||||||
|
# relyt configurations, only available when VECTOR_STORE is `relyt`
|
||||||
|
RELYT_HOST=db
|
||||||
|
RELYT_PORT=5432
|
||||||
|
RELYT_USER=postgres
|
||||||
|
RELYT_PASSWORD=difyai123456
|
||||||
|
RELYT_DATABASE=postgres
|
||||||
|
|
||||||
|
# open search configuration, only available when VECTOR_STORE is `opensearch`
|
||||||
|
OPENSEARCH_HOST=opensearch
|
||||||
|
OPENSEARCH_PORT=9200
|
||||||
|
OPENSEARCH_USER=admin
|
||||||
|
OPENSEARCH_PASSWORD=admin
|
||||||
|
OPENSEARCH_SECURE=true
|
||||||
|
|
||||||
|
# tencent vector configurations, only available when VECTOR_STORE is `tencent`
|
||||||
|
TENCENT_VECTOR_DB_URL=http://127.0.0.1
|
||||||
|
TENCENT_VECTOR_DB_API_KEY=dify
|
||||||
|
TENCENT_VECTOR_DB_TIMEOUT=30
|
||||||
|
TENCENT_VECTOR_DB_USERNAME=dify
|
||||||
|
TENCENT_VECTOR_DB_DATABASE=dify
|
||||||
|
TENCENT_VECTOR_DB_SHARD=1
|
||||||
|
TENCENT_VECTOR_DB_REPLICAS=2
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Knowledge Configuration
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# Upload file size limit, default 15M.
|
||||||
|
UPLOAD_FILE_SIZE_LIMIT=15
|
||||||
|
|
||||||
|
# The maximum number of files that can be uploaded at a time, default 5.
|
||||||
|
UPLOAD_FILE_BATCH_LIMIT=5
|
||||||
|
|
||||||
|
# ETl type, support: `dify`, `Unstructured`
|
||||||
|
# `dify` Dify's proprietary file extraction scheme
|
||||||
|
# `Unstructured` Unstructured.io file extraction scheme
|
||||||
|
ETL_TYPE=dify
|
||||||
|
|
||||||
|
# Unstructured API path, needs to be configured when ETL_TYPE is Unstructured.
|
||||||
|
# For example: http://unstructured:8000/general/v0/general
|
||||||
|
UNSTRUCTURED_API_URL=
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Multi-modal Configuration
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# The format of the image sent when the multi-modal model is input,
|
||||||
|
# the default is base64, optional url.
|
||||||
|
# The delay of the call in url mode will be lower than that in base64 mode.
|
||||||
|
# It is generally recommended to use the more compatible base64 mode.
|
||||||
|
# If configured as url, you need to configure FILES_URL as an externally accessible address so that the multi-modal model can access the image.
|
||||||
|
MULTIMODAL_SEND_IMAGE_FORMAT=base64
|
||||||
|
|
||||||
|
# Upload image file size limit, default 10M.
|
||||||
|
UPLOAD_IMAGE_FILE_SIZE_LIMIT=10
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Sentry Configuration
|
||||||
|
# Used for application monitoring and error log tracking.
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# API Service Sentry DSN address, default is empty, when empty,
|
||||||
|
# all monitoring information is not reported to Sentry.
|
||||||
|
# If not set, Sentry error reporting will be disabled.
|
||||||
|
API_SENTRY_DSN=
|
||||||
|
|
||||||
|
# API Service The reporting ratio of Sentry events, if it is 0.01, it is 1%.
|
||||||
|
API_SENTRY_TRACES_SAMPLE_RATE=1.0
|
||||||
|
|
||||||
|
# API Service The reporting ratio of Sentry profiles, if it is 0.01, it is 1%.
|
||||||
|
API_SENTRY_PROFILES_SAMPLE_RATE=1.0
|
||||||
|
|
||||||
|
# Web Service Sentry DSN address, default is empty, when empty,
|
||||||
|
# all monitoring information is not reported to Sentry.
|
||||||
|
# If not set, Sentry error reporting will be disabled.
|
||||||
|
WEB_SENTRY_DSN=
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Notion Integration Configuration
|
||||||
|
# Variables can be obtained by applying for Notion integration: https://www.notion.so/my-integrations
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# Configure as "public" or "internal".
|
||||||
|
# Since Notion's OAuth redirect URL only supports HTTPS,
|
||||||
|
# if deploying locally, please use Notion's internal integration.
|
||||||
|
NOTION_INTEGRATION_TYPE=public
|
||||||
|
# Notion OAuth client secret (used for public integration type)
|
||||||
|
NOTION_CLIENT_SECRET=
|
||||||
|
# Notion OAuth client id (used for public integration type)
|
||||||
|
NOTION_CLIENT_ID=
|
||||||
|
# Notion internal integration secret.
|
||||||
|
# If the value of NOTION_INTEGRATION_TYPE is "internal",
|
||||||
|
# you need to configure this variable.
|
||||||
|
NOTION_INTERNAL_SECRET=
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Mail related configuration
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# Mail type, support: resend, smtp
|
||||||
|
MAIL_TYPE=resend
|
||||||
|
|
||||||
|
# Default send from email address, if not specified
|
||||||
|
MAIL_DEFAULT_SEND_FROM=
|
||||||
|
|
||||||
|
# API-Key for the Resend email provider, used when MAIL_TYPE is `resend`.
|
||||||
|
RESEND_API_KEY=your-resend-api-key
|
||||||
|
|
||||||
|
# SMTP server configuration, used when MAIL_TYPE is `smtp`
|
||||||
|
SMTP_SERVER=
|
||||||
|
SMTP_PORT=465
|
||||||
|
SMTP_USERNAME=
|
||||||
|
SMTP_PASSWORD=
|
||||||
|
SMTP_USE_TLS=true
|
||||||
|
SMTP_OPPORTUNISTIC_TLS=false
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Others Configuration
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# Maximum length of segmentation tokens for indexing
|
||||||
|
INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH=1000
|
||||||
|
|
||||||
|
# Member invitation link valid time (hours),
|
||||||
|
# Default: 72.
|
||||||
|
INVITE_EXPIRY_HOURS=72
|
||||||
|
|
||||||
|
# Reset password token valid time (hours),
|
||||||
|
# Default: 24.
|
||||||
|
RESET_PASSWORD_TOKEN_EXPIRY_HOURS=24
|
||||||
|
|
||||||
|
# The sandbox service endpoint.
|
||||||
|
CODE_EXECUTION_ENDPOINT=http://sandbox:8194
|
||||||
|
CODE_MAX_NUMBER=9223372036854775807
|
||||||
|
CODE_MIN_NUMBER=-9223372036854775808
|
||||||
|
CODE_MAX_STRING_LENGTH=80000
|
||||||
|
TEMPLATE_TRANSFORM_MAX_LENGTH=80000
|
||||||
|
CODE_MAX_STRING_ARRAY_LENGTH=30
|
||||||
|
CODE_MAX_OBJECT_ARRAY_LENGTH=30
|
||||||
|
CODE_MAX_NUMBER_ARRAY_LENGTH=1000
|
||||||
|
|
||||||
|
# SSRF Proxy server HTTP URL
|
||||||
|
SSRF_PROXY_HTTP_URL=http://ssrf_proxy:3128
|
||||||
|
# SSRF Proxy server HTTPS URL
|
||||||
|
SSRF_PROXY_HTTPS_URL=http://ssrf_proxy:3128
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for db Service
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
PGUSER=${DB_USERNAME}
|
||||||
|
# The password for the default postgres user.
|
||||||
|
POSTGRES_PASSWORD=${DB_PASSWORD}
|
||||||
|
# The name of the default postgres database.
|
||||||
|
POSTGRES_DB=${DB_DATABASE}
|
||||||
|
# postgres data directory
|
||||||
|
PGDATA=/var/lib/postgresql/data/pgdata
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for sandbox Service
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# The API key for the sandbox service
|
||||||
|
SANDBOX_API_KEY=dify-sandbox
|
||||||
|
# The mode in which the Gin framework runs
|
||||||
|
SANDBOX_GIN_MODE=release
|
||||||
|
# The timeout for the worker in seconds
|
||||||
|
SANDBOX_WORKER_TIMEOUT=15
|
||||||
|
# Enable network for the sandbox service
|
||||||
|
SANDBOX_ENABLE_NETWORK=true
|
||||||
|
# HTTP proxy URL for SSRF protection
|
||||||
|
SANDBOX_HTTP_PROXY=http://ssrf_proxy:3128
|
||||||
|
# HTTPS proxy URL for SSRF protection
|
||||||
|
SANDBOX_HTTPS_PROXY=http://ssrf_proxy:3128
|
||||||
|
# The port on which the sandbox service runs
|
||||||
|
SANDBOX_PORT=8194
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for weaviate Service
|
||||||
|
# (only used when VECTOR_STORE is weaviate)
|
||||||
|
# ------------------------------
|
||||||
|
WEAVIATE_PERSISTENCE_DATA_PATH='/var/lib/weaviate'
|
||||||
|
WEAVIATE_QUERY_DEFAULTS_LIMIT=25
|
||||||
|
WEAVIATE_AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED=true
|
||||||
|
WEAVIATE_DEFAULT_VECTORIZER_MODULE=none
|
||||||
|
WEAVIATE_CLUSTER_HOSTNAME=node1
|
||||||
|
WEAVIATE_AUTHENTICATION_APIKEY_ENABLED=true
|
||||||
|
WEAVIATE_AUTHENTICATION_APIKEY_ALLOWED_KEYS=WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih
|
||||||
|
WEAVIATE_AUTHENTICATION_APIKEY_USERS=hello@dify.ai
|
||||||
|
WEAVIATE_AUTHORIZATION_ADMINLIST_ENABLED=true
|
||||||
|
WEAVIATE_AUTHORIZATION_ADMINLIST_USERS=hello@dify.ai
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for Chroma
|
||||||
|
# (only used when VECTOR_STORE is chroma)
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# Authentication credentials for Chroma server
|
||||||
|
CHROMA_SERVER_AUTHN_CREDENTIALS=difyai123456
|
||||||
|
# Authentication provider for Chroma server
|
||||||
|
CHROMA_SERVER_AUTHN_PROVIDER=chromadb.auth.token_authn.TokenAuthenticationServerProvider
|
||||||
|
# Persistence setting for Chroma server
|
||||||
|
CHROMA_IS_PERSISTENT=TRUE
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for Oracle Service
|
||||||
|
# (only used when VECTOR_STORE is Oracle)
|
||||||
|
# ------------------------------
|
||||||
|
ORACLE_PWD=Dify123456
|
||||||
|
ORACLE_CHARACTERSET=AL32UTF8
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for milvus Service
|
||||||
|
# (only used when VECTOR_STORE is milvus)
|
||||||
|
# ------------------------------
|
||||||
|
# ETCD configuration for auto compaction mode
|
||||||
|
ETCD_AUTO_COMPACTION_MODE=revision
|
||||||
|
# ETCD configuration for auto compaction retention in terms of number of revisions
|
||||||
|
ETCD_AUTO_COMPACTION_RETENTION=1000
|
||||||
|
# ETCD configuration for backend quota in bytes
|
||||||
|
ETCD_QUOTA_BACKEND_BYTES=4294967296
|
||||||
|
# ETCD configuration for the number of changes before triggering a snapshot
|
||||||
|
ETCD_SNAPSHOT_COUNT=50000
|
||||||
|
# MinIO access key for authentication
|
||||||
|
MINIO_ACCESS_KEY=minioadmin
|
||||||
|
# MinIO secret key for authentication
|
||||||
|
MINIO_SECRET_KEY=minioadmin
|
||||||
|
# ETCD service endpoints
|
||||||
|
ETCD_ENDPOINTS=etcd:2379
|
||||||
|
# MinIO service address
|
||||||
|
MINIO_ADDRESS=minio:9000
|
||||||
|
# Enable or disable security authorization
|
||||||
|
MILVUS_AUTHORIZATION_ENABLED=true
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for pgvector / pgvector-rs Service
|
||||||
|
# (only used when VECTOR_STORE is pgvector / pgvector-rs)
|
||||||
|
# ------------------------------
|
||||||
|
PGVECTOR_PGUSER=postgres
|
||||||
|
# The password for the default postgres user.
|
||||||
|
PGVECTOR_POSTGRES_PASSWORD=difyai123456
|
||||||
|
# The name of the default postgres database.
|
||||||
|
PGVECTOR_POSTGRES_DB=dify
|
||||||
|
# postgres data directory
|
||||||
|
PGVECTOR_PGDATA=/var/lib/postgresql/data/pgdata
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for opensearch
|
||||||
|
# (only used when VECTOR_STORE is opensearch)
|
||||||
|
# ------------------------------
|
||||||
|
OPENSEARCH_DISCOVERY_TYPE=single-node
|
||||||
|
OPENSEARCH_BOOTSTRAP_MEMORY_LOCK=true
|
||||||
|
OPENSEARCH_JAVA_OPTS_MIN=512m
|
||||||
|
OPENSEARCH_JAVA_OPTS_MAX=1024m
|
||||||
|
OPENSEARCH_INITIAL_ADMIN_PASSWORD=Qazwsxedc!@#123
|
||||||
|
OPENSEARCH_MEMLOCK_SOFT=-1
|
||||||
|
OPENSEARCH_MEMLOCK_HARD=-1
|
||||||
|
OPENSEARCH_NOFILE_SOFT=65536
|
||||||
|
OPENSEARCH_NOFILE_HARD=65536
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for Nginx reverse proxy
|
||||||
|
# ------------------------------
|
||||||
|
NGINX_SERVER_NAME=_
|
||||||
|
NGINX_HTTPS_ENABLED=false
|
||||||
|
# HTTP port
|
||||||
|
NGINX_PORT=80
|
||||||
|
# SSL settings are only applied when HTTPS_ENABLED is true
|
||||||
|
NGINX_SSL_PORT=443
|
||||||
|
# if HTTPS_ENABLED is true, you're required to add your own SSL certificates/keys to the `./nginx/ssl` directory
|
||||||
|
# and modify the env vars below accordingly.
|
||||||
|
NGINX_SSL_CERT_FILENAME=dify.crt
|
||||||
|
NGINX_SSL_CERT_KEY_FILENAME=dify.key
|
||||||
|
NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3
|
||||||
|
|
||||||
|
# Nginx performance tuning
|
||||||
|
NGINX_WORKER_PROCESSES=auto
|
||||||
|
NGINX_CLIENT_MAX_BODY_SIZE=15M
|
||||||
|
NGINX_KEEPALIVE_TIMEOUT=65
|
||||||
|
|
||||||
|
# Proxy settings
|
||||||
|
NGINX_PROXY_READ_TIMEOUT=3600s
|
||||||
|
NGINX_PROXY_SEND_TIMEOUT=3600s
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for SSRF Proxy
|
||||||
|
# ------------------------------
|
||||||
|
SSRF_HTTP_PORT=3128
|
||||||
|
SSRF_COREDUMP_DIR=/var/spool/squid
|
||||||
|
SSRF_REVERSE_PROXY_PORT=8194
|
||||||
|
SSRF_SANDBOX_HOST=sandbox
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# docker env var for specifying vector db type at startup
|
||||||
|
# (based on the vector db type, the corresponding docker
|
||||||
|
# compose profile will be used)
|
||||||
|
# ------------------------------
|
||||||
|
COMPOSE_PROFILES=${VECTOR_STORE:-weaviate}
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Docker Compose Service Expose Host Port Configurations
|
||||||
|
# ------------------------------
|
||||||
|
EXPOSE_NGINX_PORT=80
|
||||||
|
EXPOSE_NGINX_SSL_PORT=443
|
||||||
@@ -0,0 +1,88 @@
|
|||||||
|
## README for docker Deployment
|
||||||
|
|
||||||
|
Welcome to the new `docker` directory for deploying Dify using Docker Compose. This README outlines the updates, deployment instructions, and migration details for existing users.
|
||||||
|
|
||||||
|
### What's Updated
|
||||||
|
- **Persistent Environment Variables**: Environment variables are now managed through a `.env` file, ensuring that your configurations persist across deployments.
|
||||||
|
|
||||||
|
> What is `.env`? </br> </br>
|
||||||
|
> The `.env` file is a crucial component in Docker and Docker Compose environments, serving as a centralized configuration file where you can define environment variables that are accessible to the containers at runtime. This file simplifies the management of environment settings across different stages of development, testing, and production, providing consistency and ease of configuration to deployments.
|
||||||
|
|
||||||
|
- **Unified Vector Database Services**: All vector database services are now managed from a single Docker Compose file `docker-compose.yaml`. You can switch between different vector databases by setting the `VECTOR_STORE` environment variable in your `.env` file.
|
||||||
|
- **Mandatory .env File**: A `.env` file is now required to run `docker compose up`. This file is crucial for configuring your deployment and for any custom settings to persist through upgrades.
|
||||||
|
- **Legacy Support**: Previous deployment files are now located in the `docker-legacy` directory and will no longer be maintained.
|
||||||
|
|
||||||
|
### How to Deploy Dify with `docker-compose.yaml`
|
||||||
|
1. **Prerequisites**: Ensure Docker and Docker Compose are installed on your system.
|
||||||
|
2. **Environment Setup**:
|
||||||
|
- Navigate to the `docker` directory.
|
||||||
|
- Copy the `.env.example` file to a new file named `.env` by running `cp .env.example .env`.
|
||||||
|
- Customize the `.env` file as needed. Refer to the `.env.example` file for detailed configuration options.
|
||||||
|
3. **Running the Services**:
|
||||||
|
- Execute `docker compose up` from the `docker` directory to start the services.
|
||||||
|
- To specify a vector database, set the `VECTOR_store` variable in your `.env` file to your desired vector database service, such as `milvus`, `weaviate`, or `opensearch`.
|
||||||
|
|
||||||
|
### How to Deploy Middleware for Developing Dify
|
||||||
|
1. **Middleware Setup**:
|
||||||
|
- Use the `docker-compose.middleware.yaml` for setting up essential middleware services like databases and caches.
|
||||||
|
- Navigate to the `docker` directory.
|
||||||
|
- Ensure the `middleware.env` file is created by running `cp middleware.env.example middleware.env` (refer to the `middleware.env.example` file).
|
||||||
|
2. **Running Middleware Services**:
|
||||||
|
- Execute `docker-compose -f docker-compose.middleware.yaml up -d` to start the middleware services.
|
||||||
|
|
||||||
|
### Migration for Existing Users
|
||||||
|
For users migrating from the `docker-legacy` setup:
|
||||||
|
1. **Review Changes**: Familiarize yourself with the new `.env` configuration and Docker Compose setup.
|
||||||
|
2. **Transfer Customizations**:
|
||||||
|
- If you have customized configurations such as `docker-compose.yaml`, `ssrf_proxy/squid.conf`, or `nginx/conf.d/default.conf`, you will need to reflect these changes in the `.env` file you create.
|
||||||
|
3. **Data Migration**:
|
||||||
|
- Ensure that data from services like databases and caches is backed up and migrated appropriately to the new structure if necessary.
|
||||||
|
|
||||||
|
### Overview of `.env`
|
||||||
|
|
||||||
|
#### Key Modules and Customization
|
||||||
|
|
||||||
|
- **Vector Database Services**: Depending on the type of vector database used (`VECTOR_STORE`), users can set specific endpoints, ports, and authentication details.
|
||||||
|
- **Storage Services**: Depending on the storage type (`STORAGE_TYPE`), users can configure specific settings for S3, Azure Blob, Google Storage, etc.
|
||||||
|
- **API and Web Services**: Users can define URLs and other settings that affect how the API and web frontends operate.
|
||||||
|
|
||||||
|
#### Other notable variables
|
||||||
|
The `.env.example` file provided in the Docker setup is extensive and covers a wide range of configuration options. It is structured into several sections, each pertaining to different aspects of the application and its services. Here are some of the key sections and variables:
|
||||||
|
|
||||||
|
1. **Common Variables**:
|
||||||
|
- `CONSOLE_API_URL`, `SERVICE_API_URL`: URLs for different API services.
|
||||||
|
- `APP_WEB_URL`: Frontend application URL.
|
||||||
|
- `FILES_URL`: Base URL for file downloads and previews.
|
||||||
|
|
||||||
|
2. **Server Configuration**:
|
||||||
|
- `LOG_LEVEL`, `DEBUG`, `FLASK_DEBUG`: Logging and debug settings.
|
||||||
|
- `SECRET_KEY`: A key for encrypting session cookies and other sensitive data.
|
||||||
|
|
||||||
|
3. **Database Configuration**:
|
||||||
|
- `DB_USERNAME`, `DB_PASSWORD`, `DB_HOST`, `DB_PORT`, `DB_DATABASE`: PostgreSQL database credentials and connection details.
|
||||||
|
|
||||||
|
4. **Redis Configuration**:
|
||||||
|
- `REDIS_HOST`, `REDIS_PORT`, `REDIS_PASSWORD`: Redis server connection settings.
|
||||||
|
|
||||||
|
5. **Celery Configuration**:
|
||||||
|
- `CELERY_BROKER_URL`: Configuration for Celery message broker.
|
||||||
|
|
||||||
|
6. **Storage Configuration**:
|
||||||
|
- `STORAGE_TYPE`, `S3_BUCKET_NAME`, `AZURE_BLOB_ACCOUNT_NAME`: Settings for file storage options like local, S3, Azure Blob, etc.
|
||||||
|
|
||||||
|
7. **Vector Database Configuration**:
|
||||||
|
- `VECTOR_STORE`: Type of vector database (e.g., `weaviate`, `milvus`).
|
||||||
|
- Specific settings for each vector store like `WEAVIATE_ENDPOINT`, `MILVUS_HOST`.
|
||||||
|
|
||||||
|
8. **CORS Configuration**:
|
||||||
|
- `WEB_API_CORS_ALLOW_ORIGINS`, `CONSOLE_CORS_ALLOW_ORIGINS`: Settings for cross-origin resource sharing.
|
||||||
|
|
||||||
|
9. **Other Service-Specific Environment Variables**:
|
||||||
|
- Each service like `nginx`, `redis`, `db`, and vector databases have specific environment variables that are directly referenced in the `docker-compose.yaml`.
|
||||||
|
|
||||||
|
|
||||||
|
### Additional Information
|
||||||
|
- **Continuous Improvement Phase**: We are actively seeking feedback from the community to refine and enhance the deployment process. As more users adopt this new method, we will continue to make improvements based on your experiences and suggestions.
|
||||||
|
- **Support**: For detailed configuration options and environment variable settings, refer to the `.env.example` file and the Docker Compose configuration files in the `docker` directory.
|
||||||
|
|
||||||
|
This README aims to guide you through the deployment process using the new Docker Compose setup. For any issues or further assistance, please refer to the official documentation or contact support.
|
||||||
@@ -0,0 +1,104 @@
|
|||||||
|
services:
|
||||||
|
# The postgres database.
|
||||||
|
db:
|
||||||
|
image: postgres:15-alpine
|
||||||
|
restart: always
|
||||||
|
env_file:
|
||||||
|
- ./middleware.env
|
||||||
|
environment:
|
||||||
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-difyai123456}
|
||||||
|
POSTGRES_DB: ${POSTGRES_DB:-dify}
|
||||||
|
PGDATA: ${PGDATA:-/var/lib/postgresql/data/pgdata}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/db/data:/var/lib/postgresql/data
|
||||||
|
ports:
|
||||||
|
- "${EXPOSE_POSTGRES_PORT:-5432}:5432"
|
||||||
|
|
||||||
|
# The redis cache.
|
||||||
|
redis:
|
||||||
|
image: redis:6-alpine
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
# Mount the redis data directory to the container.
|
||||||
|
- ./volumes/redis/data:/data
|
||||||
|
# Set the redis password when startup redis server.
|
||||||
|
command: redis-server --requirepass difyai123456
|
||||||
|
ports:
|
||||||
|
- "${EXPOSE_REDIS_PORT:-6379}:6379"
|
||||||
|
|
||||||
|
# The DifySandbox
|
||||||
|
sandbox:
|
||||||
|
image: langgenius/dify-sandbox:0.2.1
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
# The DifySandbox configurations
|
||||||
|
# Make sure you are changing this key for your deployment with a strong key.
|
||||||
|
# You can generate a strong key using `openssl rand -base64 42`.
|
||||||
|
API_KEY: ${SANDBOX_API_KEY:-dify-sandbox}
|
||||||
|
GIN_MODE: ${SANDBOX_GIN_MODE:-release}
|
||||||
|
WORKER_TIMEOUT: ${SANDBOX_WORKER_TIMEOUT:-15}
|
||||||
|
ENABLE_NETWORK: ${SANDBOX_ENABLE_NETWORK:-true}
|
||||||
|
HTTP_PROXY: ${SANDBOX_HTTP_PROXY:-http://ssrf_proxy:3128}
|
||||||
|
HTTPS_PROXY: ${SANDBOX_HTTPS_PROXY:-http://ssrf_proxy:3128}
|
||||||
|
SANDBOX_PORT: ${SANDBOX_PORT:-8194}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/sandbox/dependencies:/dependencies
|
||||||
|
networks:
|
||||||
|
- ssrf_proxy_network
|
||||||
|
|
||||||
|
# ssrf_proxy server
|
||||||
|
# for more information, please refer to
|
||||||
|
# https://docs.dify.ai/learn-more/faq/self-host-faq#id-18.-why-is-ssrf_proxy-needed
|
||||||
|
ssrf_proxy:
|
||||||
|
image: ubuntu/squid:latest
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- ./ssrf_proxy/squid.conf.template:/etc/squid/squid.conf.template
|
||||||
|
- ./ssrf_proxy/docker-entrypoint.sh:/docker-entrypoint-mount.sh
|
||||||
|
entrypoint: [ "sh", "-c", "cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh" ]
|
||||||
|
environment:
|
||||||
|
# pls clearly modify the squid env vars to fit your network environment.
|
||||||
|
HTTP_PORT: ${SSRF_HTTP_PORT:-3128}
|
||||||
|
COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid}
|
||||||
|
REVERSE_PROXY_PORT: ${SSRF_REVERSE_PROXY_PORT:-8194}
|
||||||
|
SANDBOX_HOST: ${SSRF_SANDBOX_HOST:-sandbox}
|
||||||
|
SANDBOX_PORT: ${SANDBOX_PORT:-8194}
|
||||||
|
ports:
|
||||||
|
- "${EXPOSE_SSRF_PROXY_PORT:-3128}:${SSRF_HTTP_PORT:-3128}"
|
||||||
|
- "${EXPOSE_SANDBOX_PORT:-8194}:${SANDBOX_PORT:-8194}"
|
||||||
|
networks:
|
||||||
|
- ssrf_proxy_network
|
||||||
|
- default
|
||||||
|
|
||||||
|
# The Weaviate vector store.
|
||||||
|
weaviate:
|
||||||
|
image: semitechnologies/weaviate:1.19.0
|
||||||
|
profiles:
|
||||||
|
- weaviate
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
# Mount the Weaviate data directory to the container.
|
||||||
|
- ./volumes/weaviate:/var/lib/weaviate
|
||||||
|
env_file:
|
||||||
|
- ./middleware.env
|
||||||
|
environment:
|
||||||
|
# The Weaviate configurations
|
||||||
|
# You can refer to the [Weaviate](https://weaviate.io/developers/weaviate/config-refs/env-vars) documentation for more information.
|
||||||
|
PERSISTENCE_DATA_PATH: ${WEAVIATE_PERSISTENCE_DATA_PATH:-/var/lib/weaviate}
|
||||||
|
QUERY_DEFAULTS_LIMIT: ${WEAVIATE_QUERY_DEFAULTS_LIMIT:-25}
|
||||||
|
AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: ${WEAVIATE_AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED:-false}
|
||||||
|
DEFAULT_VECTORIZER_MODULE: ${WEAVIATE_DEFAULT_VECTORIZER_MODULE:-none}
|
||||||
|
CLUSTER_HOSTNAME: ${WEAVIATE_CLUSTER_HOSTNAME:-node1}
|
||||||
|
AUTHENTICATION_APIKEY_ENABLED: ${WEAVIATE_AUTHENTICATION_APIKEY_ENABLED:-true}
|
||||||
|
AUTHENTICATION_APIKEY_ALLOWED_KEYS: ${WEAVIATE_AUTHENTICATION_APIKEY_ALLOWED_KEYS:-WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih}
|
||||||
|
AUTHENTICATION_APIKEY_USERS: ${WEAVIATE_AUTHENTICATION_APIKEY_USERS:-hello@dify.ai}
|
||||||
|
AUTHORIZATION_ADMINLIST_ENABLED: ${WEAVIATE_AUTHORIZATION_ADMINLIST_ENABLED:-true}
|
||||||
|
AUTHORIZATION_ADMINLIST_USERS: ${WEAVIATE_AUTHORIZATION_ADMINLIST_USERS:-hello@dify.ai}
|
||||||
|
ports:
|
||||||
|
- "${EXPOSE_WEAVIATE_PORT:-8080}:8080"
|
||||||
|
|
||||||
|
networks:
|
||||||
|
# create a network between sandbox, api and ssrf_proxy, and can not access outside.
|
||||||
|
ssrf_proxy_network:
|
||||||
|
driver: bridge
|
||||||
|
internal: true
|
||||||
Binary file not shown.
|
After Width: | Height: | Size: 62 KiB |
@@ -0,0 +1,569 @@
|
|||||||
|
x-shared-env: &shared-api-worker-env
|
||||||
|
LOG_LEVEL: ${LOG_LEVEL:-INFO}
|
||||||
|
DEBUG: ${DEBUG:-false}
|
||||||
|
FLASK_DEBUG: ${FLASK_DEBUG:-false}
|
||||||
|
SECRET_KEY: ${SECRET_KEY:-sk-9f73s3ljTXVcMT3Blb3ljTqtsKiGHXVcMT3BlbkFJLK7U}
|
||||||
|
INIT_PASSWORD: ${INIT_PASSWORD:-}
|
||||||
|
CONSOLE_WEB_URL: ${CONSOLE_WEB_URL:-}
|
||||||
|
CONSOLE_API_URL: ${CONSOLE_API_URL:-}
|
||||||
|
SERVICE_API_URL: ${SERVICE_API_URL:-}
|
||||||
|
APP_WEB_URL: ${APP_WEB_URL:-}
|
||||||
|
CHECK_UPDATE_URL: ${CHECK_UPDATE_URL:-https://updates.dify.ai}
|
||||||
|
OPENAI_API_BASE: ${OPENAI_API_BASE:-https://api.openai.com/v1}
|
||||||
|
FILES_URL: ${FILES_URL:-}
|
||||||
|
FILES_ACCESS_TIMEOUT: ${FILES_ACCESS_TIMEOUT:-300}
|
||||||
|
APP_MAX_ACTIVE_REQUESTS: ${APP_MAX_ACTIVE_REQUESTS:-0}
|
||||||
|
MIGRATION_ENABLED: ${MIGRATION_ENABLED:-true}
|
||||||
|
DEPLOY_ENV: ${DEPLOY_ENV:-PRODUCTION}
|
||||||
|
DIFY_BIND_ADDRESS: ${DIFY_BIND_ADDRESS:-0.0.0.0}
|
||||||
|
DIFY_PORT: ${DIFY_PORT:-5001}
|
||||||
|
SERVER_WORKER_AMOUNT: ${SERVER_WORKER_AMOUNT:-}
|
||||||
|
SERVER_WORKER_CLASS: ${SERVER_WORKER_CLASS:-}
|
||||||
|
CELERY_WORKER_CLASS: ${CELERY_WORKER_CLASS:-}
|
||||||
|
GUNICORN_TIMEOUT: ${GUNICORN_TIMEOUT:-360}
|
||||||
|
CELERY_WORKER_AMOUNT: ${CELERY_WORKER_AMOUNT:-}
|
||||||
|
API_TOOL_DEFAULT_CONNECT_TIMEOUT: ${API_TOOL_DEFAULT_CONNECT_TIMEOUT:-10}
|
||||||
|
API_TOOL_DEFAULT_READ_TIMEOUT: ${API_TOOL_DEFAULT_READ_TIMEOUT:-60}
|
||||||
|
DB_USERNAME: ${DB_USERNAME:-postgres}
|
||||||
|
DB_PASSWORD: ${DB_PASSWORD:-difyai123456}
|
||||||
|
DB_HOST: ${DB_HOST:-db}
|
||||||
|
DB_PORT: ${DB_PORT:-5432}
|
||||||
|
DB_DATABASE: ${DB_DATABASE:-dify}
|
||||||
|
SQLALCHEMY_POOL_SIZE: ${SQLALCHEMY_POOL_SIZE:-30}
|
||||||
|
SQLALCHEMY_POOL_RECYCLE: ${SQLALCHEMY_POOL_RECYCLE:-3600}
|
||||||
|
SQLALCHEMY_ECHO: ${SQLALCHEMY_ECHO:-false}
|
||||||
|
REDIS_HOST: ${REDIS_HOST:-redis}
|
||||||
|
REDIS_PORT: ${REDIS_PORT:-6379}
|
||||||
|
REDIS_USERNAME: ${REDIS_USERNAME:-}
|
||||||
|
REDIS_PASSWORD: ${REDIS_PASSWORD:-difyai123456}
|
||||||
|
REDIS_USE_SSL: ${REDIS_USE_SSL:-false}
|
||||||
|
REDIS_DB: 0
|
||||||
|
CELERY_BROKER_URL: ${CELERY_BROKER_URL:-redis://:difyai123456@redis:6379/1}
|
||||||
|
BROKER_USE_SSL: ${BROKER_USE_SSL:-false}
|
||||||
|
WEB_API_CORS_ALLOW_ORIGINS: ${WEB_API_CORS_ALLOW_ORIGINS:-*}
|
||||||
|
CONSOLE_CORS_ALLOW_ORIGINS: ${CONSOLE_CORS_ALLOW_ORIGINS:-*}
|
||||||
|
STORAGE_TYPE: ${STORAGE_TYPE:-local}
|
||||||
|
STORAGE_LOCAL_PATH: storage
|
||||||
|
S3_USE_AWS_MANAGED_IAM: ${S3_USE_AWS_MANAGED_IAM:-false}
|
||||||
|
S3_ENDPOINT: ${S3_ENDPOINT:-}
|
||||||
|
S3_BUCKET_NAME: ${S3_BUCKET_NAME:-}
|
||||||
|
S3_ACCESS_KEY: ${S3_ACCESS_KEY:-}
|
||||||
|
S3_SECRET_KEY: ${S3_SECRET_KEY:-}
|
||||||
|
S3_REGION: ${S3_REGION:-us-east-1}
|
||||||
|
AZURE_BLOB_ACCOUNT_NAME: ${AZURE_BLOB_ACCOUNT_NAME:-}
|
||||||
|
AZURE_BLOB_ACCOUNT_KEY: ${AZURE_BLOB_ACCOUNT_KEY:-}
|
||||||
|
AZURE_BLOB_CONTAINER_NAME: ${AZURE_BLOB_CONTAINER_NAME:-}
|
||||||
|
AZURE_BLOB_ACCOUNT_URL: ${AZURE_BLOB_ACCOUNT_URL:-}
|
||||||
|
GOOGLE_STORAGE_BUCKET_NAME: ${GOOGLE_STORAGE_BUCKET_NAME:-}
|
||||||
|
GOOGLE_STORAGE_SERVICE_ACCOUNT_JSON_BASE64: ${GOOGLE_STORAGE_SERVICE_ACCOUNT_JSON_BASE64:-}
|
||||||
|
ALIYUN_OSS_BUCKET_NAME: ${ALIYUN_OSS_BUCKET_NAME:-}
|
||||||
|
ALIYUN_OSS_ACCESS_KEY: ${ALIYUN_OSS_ACCESS_KEY:-}
|
||||||
|
ALIYUN_OSS_SECRET_KEY: ${ALIYUN_OSS_SECRET_KEY:-}
|
||||||
|
ALIYUN_OSS_ENDPOINT: ${ALIYUN_OSS_ENDPOINT:-}
|
||||||
|
ALIYUN_OSS_REGION: ${ALIYUN_OSS_REGION:-}
|
||||||
|
ALIYUN_OSS_AUTH_VERSION: ${ALIYUN_OSS_AUTH_VERSION:-v4}
|
||||||
|
TENCENT_COS_BUCKET_NAME: ${TENCENT_COS_BUCKET_NAME:-}
|
||||||
|
TENCENT_COS_SECRET_KEY: ${TENCENT_COS_SECRET_KEY:-}
|
||||||
|
TENCENT_COS_SECRET_ID: ${TENCENT_COS_SECRET_ID:-}
|
||||||
|
TENCENT_COS_REGION: ${TENCENT_COS_REGION:-}
|
||||||
|
TENCENT_COS_SCHEME: ${TENCENT_COS_SCHEME:-}
|
||||||
|
OCI_ENDPOINT: ${OCI_ENDPOINT:-}
|
||||||
|
OCI_BUCKET_NAME: ${OCI_BUCKET_NAME:-}
|
||||||
|
OCI_ACCESS_KEY: ${OCI_ACCESS_KEY:-}
|
||||||
|
OCI_SECRET_KEY: ${OCI_SECRET_KEY:-}
|
||||||
|
OCI_REGION: ${OCI_REGION:-}
|
||||||
|
VECTOR_STORE: ${VECTOR_STORE:-weaviate}
|
||||||
|
WEAVIATE_ENDPOINT: ${WEAVIATE_ENDPOINT:-http://weaviate:8080}
|
||||||
|
WEAVIATE_API_KEY: ${WEAVIATE_API_KEY:-WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih}
|
||||||
|
QDRANT_URL: ${QDRANT_URL:-http://qdrant:6333}
|
||||||
|
QDRANT_API_KEY: ${QDRANT_API_KEY:-difyai123456}
|
||||||
|
QDRANT_CLIENT_TIMEOUT: ${QDRANT_CLIENT_TIMEOUT:-20}
|
||||||
|
QDRANT_GRPC_ENABLED: ${QDRANT_GRPC_ENABLED:-false}
|
||||||
|
QDRANT_GRPC_PORT: ${QDRANT_GRPC_PORT:-6334}
|
||||||
|
MILVUS_HOST: ${MILVUS_HOST:-127.0.0.1}
|
||||||
|
MILVUS_PORT: ${MILVUS_PORT:-19530}
|
||||||
|
MILVUS_USER: ${MILVUS_USER:-root}
|
||||||
|
MILVUS_PASSWORD: ${MILVUS_PASSWORD:-Milvus}
|
||||||
|
MILVUS_SECURE: ${MILVUS_SECURE:-false}
|
||||||
|
MYSCALE_HOST: ${MYSCALE_HOST:-myscale}
|
||||||
|
MYSCALE_PORT: ${MYSCALE_PORT:-8123}
|
||||||
|
MYSCALE_USER: ${MYSCALE_USER:-default}
|
||||||
|
MYSCALE_PASSWORD: ${MYSCALE_PASSWORD:-}
|
||||||
|
MYSCALE_DATABASE: ${MYSCALE_DATABASE:-dify}
|
||||||
|
MYSCALE_FTS_PARAMS: ${MYSCALE_FTS_PARAMS:-}
|
||||||
|
RELYT_HOST: ${RELYT_HOST:-db}
|
||||||
|
RELYT_PORT: ${RELYT_PORT:-5432}
|
||||||
|
RELYT_USER: ${RELYT_USER:-postgres}
|
||||||
|
RELYT_PASSWORD: ${RELYT_PASSWORD:-difyai123456}
|
||||||
|
RELYT_DATABASE: ${RELYT_DATABASE:-postgres}
|
||||||
|
PGVECTOR_HOST: ${PGVECTOR_HOST:-pgvector}
|
||||||
|
PGVECTOR_PORT: ${PGVECTOR_PORT:-5432}
|
||||||
|
PGVECTOR_USER: ${PGVECTOR_USER:-postgres}
|
||||||
|
PGVECTOR_PASSWORD: ${PGVECTOR_PASSWORD:-difyai123456}
|
||||||
|
PGVECTOR_DATABASE: ${PGVECTOR_DATABASE:-dify}
|
||||||
|
TIDB_VECTOR_HOST: ${TIDB_VECTOR_HOST:-tidb}
|
||||||
|
TIDB_VECTOR_PORT: ${TIDB_VECTOR_PORT:-4000}
|
||||||
|
TIDB_VECTOR_USER: ${TIDB_VECTOR_USER:-}
|
||||||
|
TIDB_VECTOR_PASSWORD: ${TIDB_VECTOR_PASSWORD:-}
|
||||||
|
TIDB_VECTOR_DATABASE: ${TIDB_VECTOR_DATABASE:-dify}
|
||||||
|
ORACLE_HOST: ${ORACLE_HOST:-oracle}
|
||||||
|
ORACLE_PORT: ${ORACLE_PORT:-1521}
|
||||||
|
ORACLE_USER: ${ORACLE_USER:-dify}
|
||||||
|
ORACLE_PASSWORD: ${ORACLE_PASSWORD:-dify}
|
||||||
|
ORACLE_DATABASE: ${ORACLE_DATABASE:-FREEPDB1}
|
||||||
|
CHROMA_HOST: ${CHROMA_HOST:-127.0.0.1}
|
||||||
|
CHROMA_PORT: ${CHROMA_PORT:-8000}
|
||||||
|
CHROMA_TENANT: ${CHROMA_TENANT:-default_tenant}
|
||||||
|
CHROMA_DATABASE: ${CHROMA_DATABASE:-default_database}
|
||||||
|
CHROMA_AUTH_PROVIDER: ${CHROMA_AUTH_PROVIDER:-chromadb.auth.token_authn.TokenAuthClientProvider}
|
||||||
|
CHROMA_AUTH_CREDENTIALS: ${CHROMA_AUTH_CREDENTIALS:-}
|
||||||
|
# AnalyticDB configuration
|
||||||
|
ANALYTICDB_KEY_ID: ${ANALYTICDB_KEY_ID:-}
|
||||||
|
ANALYTICDB_KEY_SECRET: ${ANALYTICDB_KEY_SECRET:-}
|
||||||
|
ANALYTICDB_REGION_ID: ${ANALYTICDB_REGION_ID:-}
|
||||||
|
ANALYTICDB_INSTANCE_ID: ${ANALYTICDB_INSTANCE_ID:-}
|
||||||
|
ANALYTICDB_ACCOUNT: ${ANALYTICDB_ACCOUNT:-}
|
||||||
|
ANALYTICDB_PASSWORD: ${ANALYTICDB_PASSWORD:-}
|
||||||
|
ANALYTICDB_NAMESPACE: ${ANALYTICDB_NAMESPACE:-dify}
|
||||||
|
ANALYTICDB_NAMESPACE_PASSWORD: ${ANALYTICDB_NAMESPACE_PASSWORD:-}
|
||||||
|
OPENSEARCH_HOST: ${OPENSEARCH_HOST:-opensearch}
|
||||||
|
OPENSEARCH_PORT: ${OPENSEARCH_PORT:-9200}
|
||||||
|
OPENSEARCH_USER: ${OPENSEARCH_USER:-admin}
|
||||||
|
OPENSEARCH_PASSWORD: ${OPENSEARCH_PASSWORD:-admin}
|
||||||
|
OPENSEARCH_SECURE: ${OPENSEARCH_SECURE:-true}
|
||||||
|
TENCENT_VECTOR_DB_URL: ${TENCENT_VECTOR_DB_URL:-http://127.0.0.1}
|
||||||
|
TENCENT_VECTOR_DB_API_KEY: ${TENCENT_VECTOR_DB_API_KEY:-dify}
|
||||||
|
TENCENT_VECTOR_DB_TIMEOUT: ${TENCENT_VECTOR_DB_TIMEOUT:-30}
|
||||||
|
TENCENT_VECTOR_DB_USERNAME: ${TENCENT_VECTOR_DB_USERNAME:-dify}
|
||||||
|
TENCENT_VECTOR_DB_DATABASE: ${TENCENT_VECTOR_DB_DATABASE:-dify}
|
||||||
|
TENCENT_VECTOR_DB_SHARD: ${TENCENT_VECTOR_DB_SHARD:-1}
|
||||||
|
TENCENT_VECTOR_DB_REPLICAS: ${TENCENT_VECTOR_DB_REPLICAS:-2}
|
||||||
|
UPLOAD_FILE_SIZE_LIMIT: ${UPLOAD_FILE_SIZE_LIMIT:-15}
|
||||||
|
UPLOAD_FILE_BATCH_LIMIT: ${UPLOAD_FILE_BATCH_LIMIT:-5}
|
||||||
|
ETL_TYPE: ${ETL_TYPE:-dify}
|
||||||
|
UNSTRUCTURED_API_URL: ${UNSTRUCTURED_API_URL:-}
|
||||||
|
MULTIMODAL_SEND_IMAGE_FORMAT: ${MULTIMODAL_SEND_IMAGE_FORMAT:-base64}
|
||||||
|
UPLOAD_IMAGE_FILE_SIZE_LIMIT: ${UPLOAD_IMAGE_FILE_SIZE_LIMIT:-10}
|
||||||
|
SENTRY_DSN: ${API_SENTRY_DSN:-}
|
||||||
|
SENTRY_TRACES_SAMPLE_RATE: ${API_SENTRY_TRACES_SAMPLE_RATE:-1.0}
|
||||||
|
SENTRY_PROFILES_SAMPLE_RATE: ${API_SENTRY_PROFILES_SAMPLE_RATE:-1.0}
|
||||||
|
NOTION_INTEGRATION_TYPE: ${NOTION_INTEGRATION_TYPE:-public}
|
||||||
|
NOTION_CLIENT_SECRET: ${NOTION_CLIENT_SECRET:-}
|
||||||
|
NOTION_CLIENT_ID: ${NOTION_CLIENT_ID:-}
|
||||||
|
NOTION_INTERNAL_SECRET: ${NOTION_INTERNAL_SECRET:-}
|
||||||
|
MAIL_TYPE: ${MAIL_TYPE:-resend}
|
||||||
|
MAIL_DEFAULT_SEND_FROM: ${MAIL_DEFAULT_SEND_FROM:-}
|
||||||
|
SMTP_SERVER: ${SMTP_SERVER:-}
|
||||||
|
SMTP_PORT: ${SMTP_PORT:-465}
|
||||||
|
SMTP_USERNAME: ${SMTP_USERNAME:-}
|
||||||
|
SMTP_PASSWORD: ${SMTP_PASSWORD:-}
|
||||||
|
SMTP_USE_TLS: ${SMTP_USE_TLS:-true}
|
||||||
|
SMTP_OPPORTUNISTIC_TLS: ${SMTP_OPPORTUNISTIC_TLS:-false}
|
||||||
|
RESEND_API_KEY: ${RESEND_API_KEY:-your-resend-api-key}
|
||||||
|
RESEND_API_URL: https://api.resend.com
|
||||||
|
INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH: ${INDEXING_MAX_SEGMENTATION_TOKENS_LENGTH:-1000}
|
||||||
|
INVITE_EXPIRY_HOURS: ${INVITE_EXPIRY_HOURS:-72}
|
||||||
|
RESET_PASSWORD_TOKEN_EXPIRY_HOURS: ${RESET_PASSWORD_TOKEN_EXPIRY_HOURS:-24}
|
||||||
|
CODE_EXECUTION_ENDPOINT: ${CODE_EXECUTION_ENDPOINT:-http://sandbox:8194}
|
||||||
|
CODE_EXECUTION_API_KEY: ${SANDBOX_API_KEY:-dify-sandbox}
|
||||||
|
CODE_MAX_NUMBER: ${CODE_MAX_NUMBER:-9223372036854775807}
|
||||||
|
CODE_MIN_NUMBER: ${CODE_MIN_NUMBER:--9223372036854775808}
|
||||||
|
CODE_MAX_STRING_LENGTH: ${CODE_MAX_STRING_LENGTH:-80000}
|
||||||
|
TEMPLATE_TRANSFORM_MAX_LENGTH: ${TEMPLATE_TRANSFORM_MAX_LENGTH:-80000}
|
||||||
|
CODE_MAX_STRING_ARRAY_LENGTH: ${CODE_MAX_STRING_ARRAY_LENGTH:-30}
|
||||||
|
CODE_MAX_OBJECT_ARRAY_LENGTH: ${CODE_MAX_OBJECT_ARRAY_LENGTH:-30}
|
||||||
|
CODE_MAX_NUMBER_ARRAY_LENGTH: ${CODE_MAX_NUMBER_ARRAY_LENGTH:-1000}
|
||||||
|
SSRF_PROXY_HTTP_URL: ${SSRF_PROXY_HTTP_URL:-http://ssrf_proxy:3128}
|
||||||
|
SSRF_PROXY_HTTPS_URL: ${SSRF_PROXY_HTTPS_URL:-http://ssrf_proxy:3128}
|
||||||
|
|
||||||
|
services:
|
||||||
|
# API service
|
||||||
|
api:
|
||||||
|
image: langgenius/dify-api:0.6.15
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
# Use the shared environment variables.
|
||||||
|
<<: *shared-api-worker-env
|
||||||
|
# Startup mode, 'api' starts the API server.
|
||||||
|
MODE: api
|
||||||
|
depends_on:
|
||||||
|
- db
|
||||||
|
- redis
|
||||||
|
volumes:
|
||||||
|
# Mount the storage directory to the container, for storing user files.
|
||||||
|
- ./volumes/app/storage:/app/api/storage
|
||||||
|
networks:
|
||||||
|
- ssrf_proxy_network
|
||||||
|
- default
|
||||||
|
|
||||||
|
# worker service
|
||||||
|
# The Celery worker for processing the queue.
|
||||||
|
worker:
|
||||||
|
image: langgenius/dify-api:0.6.15
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
# Use the shared environment variables.
|
||||||
|
<<: *shared-api-worker-env
|
||||||
|
# Startup mode, 'worker' starts the Celery worker for processing the queue.
|
||||||
|
MODE: worker
|
||||||
|
depends_on:
|
||||||
|
- db
|
||||||
|
- redis
|
||||||
|
volumes:
|
||||||
|
# Mount the storage directory to the container, for storing user files.
|
||||||
|
- ./volumes/app/storage:/app/api/storage
|
||||||
|
networks:
|
||||||
|
- ssrf_proxy_network
|
||||||
|
- default
|
||||||
|
|
||||||
|
# Frontend web application.
|
||||||
|
web:
|
||||||
|
image: langgenius/dify-web:0.6.15
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
CONSOLE_API_URL: ${CONSOLE_API_URL:-}
|
||||||
|
APP_API_URL: ${APP_API_URL:-}
|
||||||
|
SENTRY_DSN: ${WEB_SENTRY_DSN:-}
|
||||||
|
|
||||||
|
# The postgres database.
|
||||||
|
db:
|
||||||
|
image: postgres:15-alpine
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
PGUSER: ${PGUSER:-postgres}
|
||||||
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-difyai123456}
|
||||||
|
POSTGRES_DB: ${POSTGRES_DB:-dify}
|
||||||
|
PGDATA: ${PGDATA:-/var/lib/postgresql/data/pgdata}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/db/data:/var/lib/postgresql/data
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "pg_isready"]
|
||||||
|
interval: 1s
|
||||||
|
timeout: 3s
|
||||||
|
retries: 30
|
||||||
|
|
||||||
|
# The redis cache.
|
||||||
|
redis:
|
||||||
|
image: redis:6-alpine
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
# Mount the redis data directory to the container.
|
||||||
|
- ./volumes/redis/data:/data
|
||||||
|
# Set the redis password when startup redis server.
|
||||||
|
command: redis-server --requirepass ${REDIS_PASSWORD:-difyai123456}
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "redis-cli", "ping"]
|
||||||
|
|
||||||
|
# The DifySandbox
|
||||||
|
sandbox:
|
||||||
|
image: langgenius/dify-sandbox:0.2.1
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
# The DifySandbox configurations
|
||||||
|
# Make sure you are changing this key for your deployment with a strong key.
|
||||||
|
# You can generate a strong key using `openssl rand -base64 42`.
|
||||||
|
API_KEY: ${SANDBOX_API_KEY:-dify-sandbox}
|
||||||
|
GIN_MODE: ${SANDBOX_GIN_MODE:-release}
|
||||||
|
WORKER_TIMEOUT: ${SANDBOX_WORKER_TIMEOUT:-15}
|
||||||
|
ENABLE_NETWORK: ${SANDBOX_ENABLE_NETWORK:-true}
|
||||||
|
HTTP_PROXY: ${SANDBOX_HTTP_PROXY:-http://ssrf_proxy:3128}
|
||||||
|
HTTPS_PROXY: ${SANDBOX_HTTPS_PROXY:-http://ssrf_proxy:3128}
|
||||||
|
SANDBOX_PORT: ${SANDBOX_PORT:-8194}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/sandbox/dependencies:/dependencies
|
||||||
|
networks:
|
||||||
|
- ssrf_proxy_network
|
||||||
|
|
||||||
|
# ssrf_proxy server
|
||||||
|
# for more information, please refer to
|
||||||
|
# https://docs.dify.ai/getting-started/install-self-hosted/install-faq#id-16.-why-is-ssrf_proxy-needed
|
||||||
|
ssrf_proxy:
|
||||||
|
image: ubuntu/squid:latest
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- ./ssrf_proxy/squid.conf.template:/etc/squid/squid.conf.template
|
||||||
|
- ./ssrf_proxy/docker-entrypoint.sh:/docker-entrypoint-mount.sh
|
||||||
|
entrypoint:
|
||||||
|
[
|
||||||
|
"sh",
|
||||||
|
"-c",
|
||||||
|
"cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh",
|
||||||
|
]
|
||||||
|
environment:
|
||||||
|
# pls clearly modify the squid env vars to fit your network environment.
|
||||||
|
HTTP_PORT: ${SSRF_HTTP_PORT:-3128}
|
||||||
|
COREDUMP_DIR: ${SSRF_COREDUMP_DIR:-/var/spool/squid}
|
||||||
|
REVERSE_PROXY_PORT: ${SSRF_REVERSE_PROXY_PORT:-8194}
|
||||||
|
SANDBOX_HOST: ${SSRF_SANDBOX_HOST:-sandbox}
|
||||||
|
SANDBOX_PORT: ${SANDBOX_PORT:-8194}
|
||||||
|
networks:
|
||||||
|
- ssrf_proxy_network
|
||||||
|
- default
|
||||||
|
|
||||||
|
# The nginx reverse proxy.
|
||||||
|
# used for reverse proxying the API service and Web service.
|
||||||
|
nginx:
|
||||||
|
image: nginx:latest
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- ./nginx/nginx.conf.template:/etc/nginx/nginx.conf.template
|
||||||
|
- ./nginx/proxy.conf.template:/etc/nginx/proxy.conf.template
|
||||||
|
- ./nginx/https.conf.template:/etc/nginx/https.conf.template
|
||||||
|
- ./nginx/conf.d:/etc/nginx/conf.d
|
||||||
|
- ./nginx/docker-entrypoint.sh:/docker-entrypoint-mount.sh
|
||||||
|
- ./nginx/ssl:/etc/ssl
|
||||||
|
entrypoint:
|
||||||
|
[
|
||||||
|
"sh",
|
||||||
|
"-c",
|
||||||
|
"cp /docker-entrypoint-mount.sh /docker-entrypoint.sh && sed -i 's/\r$$//' /docker-entrypoint.sh && chmod +x /docker-entrypoint.sh && /docker-entrypoint.sh",
|
||||||
|
]
|
||||||
|
environment:
|
||||||
|
NGINX_SERVER_NAME: ${NGINX_SERVER_NAME:-_}
|
||||||
|
NGINX_HTTPS_ENABLED: ${NGINX_HTTPS_ENABLED:-false}
|
||||||
|
NGINX_SSL_PORT: ${NGINX_SSL_PORT:-443}
|
||||||
|
NGINX_PORT: ${NGINX_PORT:-80}
|
||||||
|
# You're required to add your own SSL certificates/keys to the `./nginx/ssl` directory
|
||||||
|
# and modify the env vars below in .env if HTTPS_ENABLED is true.
|
||||||
|
NGINX_SSL_CERT_FILENAME: ${NGINX_SSL_CERT_FILENAME:-dify.crt}
|
||||||
|
NGINX_SSL_CERT_KEY_FILENAME: ${NGINX_SSL_CERT_KEY_FILENAME:-dify.key}
|
||||||
|
NGINX_SSL_PROTOCOLS: ${NGINX_SSL_PROTOCOLS:-TLSv1.1 TLSv1.2 TLSv1.3}
|
||||||
|
NGINX_WORKER_PROCESSES: ${NGINX_WORKER_PROCESSES:-auto}
|
||||||
|
NGINX_CLIENT_MAX_BODY_SIZE: ${NGINX_CLIENT_MAX_BODY_SIZE:-15M}
|
||||||
|
NGINX_KEEPALIVE_TIMEOUT: ${NGINX_KEEPALIVE_TIMEOUT:-65}
|
||||||
|
NGINX_PROXY_READ_TIMEOUT: ${NGINX_PROXY_READ_TIMEOUT:-3600s}
|
||||||
|
NGINX_PROXY_SEND_TIMEOUT: ${NGINX_PROXY_SEND_TIMEOUT:-3600s}
|
||||||
|
depends_on:
|
||||||
|
- api
|
||||||
|
- web
|
||||||
|
|
||||||
|
# The Weaviate vector store.
|
||||||
|
weaviate:
|
||||||
|
image: semitechnologies/weaviate:1.19.0
|
||||||
|
profiles:
|
||||||
|
- ""
|
||||||
|
- weaviate
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
# Mount the Weaviate data directory to the con tainer.
|
||||||
|
- ./volumes/weaviate:/var/lib/weaviate
|
||||||
|
environment:
|
||||||
|
# The Weaviate configurations
|
||||||
|
# You can refer to the [Weaviate](https://weaviate.io/developers/weaviate/config-refs/env-vars) documentation for more information.
|
||||||
|
PERSISTENCE_DATA_PATH: ${WEAVIATE_PERSISTENCE_DATA_PATH:-/var/lib/weaviate}
|
||||||
|
QUERY_DEFAULTS_LIMIT: ${WEAVIATE_QUERY_DEFAULTS_LIMIT:-25}
|
||||||
|
AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED: ${WEAVIATE_AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED:-false}
|
||||||
|
DEFAULT_VECTORIZER_MODULE: ${WEAVIATE_DEFAULT_VECTORIZER_MODULE:-none}
|
||||||
|
CLUSTER_HOSTNAME: ${WEAVIATE_CLUSTER_HOSTNAME:-node1}
|
||||||
|
AUTHENTICATION_APIKEY_ENABLED: ${WEAVIATE_AUTHENTICATION_APIKEY_ENABLED:-true}
|
||||||
|
AUTHENTICATION_APIKEY_ALLOWED_KEYS: ${WEAVIATE_AUTHENTICATION_APIKEY_ALLOWED_KEYS:-WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih}
|
||||||
|
AUTHENTICATION_APIKEY_USERS: ${WEAVIATE_AUTHENTICATION_APIKEY_USERS:-hello@dify.ai}
|
||||||
|
AUTHORIZATION_ADMINLIST_ENABLED: ${WEAVIATE_AUTHORIZATION_ADMINLIST_ENABLED:-true}
|
||||||
|
AUTHORIZATION_ADMINLIST_USERS: ${WEAVIATE_AUTHORIZATION_ADMINLIST_USERS:-hello@dify.ai}
|
||||||
|
|
||||||
|
# Qdrant vector store.
|
||||||
|
# (if used, you need to set VECTOR_STORE to qdrant in the api & worker service.)
|
||||||
|
qdrant:
|
||||||
|
image: langgenius/qdrant:v1.7.3
|
||||||
|
profiles:
|
||||||
|
- qdrant
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- ./volumes/qdrant:/qdrant/storage
|
||||||
|
environment:
|
||||||
|
QDRANT_API_KEY: ${QDRANT_API_KEY:-difyai123456}
|
||||||
|
|
||||||
|
# The pgvector vector database.
|
||||||
|
pgvector:
|
||||||
|
image: pgvector/pgvector:pg16
|
||||||
|
profiles:
|
||||||
|
- pgvector
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
PGUSER: ${PGVECTOR_PGUSER:-postgres}
|
||||||
|
# The password for the default postgres user.
|
||||||
|
POSTGRES_PASSWORD: ${PGVECTOR_POSTGRES_PASSWORD:-difyai123456}
|
||||||
|
# The name of the default postgres database.
|
||||||
|
POSTGRES_DB: ${PGVECTOR_POSTGRES_DB:-dify}
|
||||||
|
# postgres data directory
|
||||||
|
PGDATA: ${PGVECTOR_PGDATA:-/var/lib/postgresql/data/pgdata}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/pgvector/data:/var/lib/postgresql/data
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "pg_isready"]
|
||||||
|
interval: 1s
|
||||||
|
timeout: 3s
|
||||||
|
retries: 30
|
||||||
|
|
||||||
|
# pgvecto-rs vector store
|
||||||
|
pgvecto-rs:
|
||||||
|
image: tensorchord/pgvecto-rs:pg16-v0.2.0
|
||||||
|
profiles:
|
||||||
|
- pgvecto-rs
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
PGUSER: ${PGVECTOR_PGUSER:-postgres}
|
||||||
|
# The password for the default postgres user.
|
||||||
|
POSTGRES_PASSWORD: ${PGVECTOR_POSTGRES_PASSWORD:-difyai123456}
|
||||||
|
# The name of the default postgres database.
|
||||||
|
POSTGRES_DB: ${PGVECTOR_POSTGRES_DB:-dify}
|
||||||
|
# postgres data directory
|
||||||
|
PGDATA: ${PGVECTOR_PGDATA:-/var/lib/postgresql/data/pgdata}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/pgvecto_rs/data:/var/lib/postgresql/data
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "pg_isready"]
|
||||||
|
interval: 1s
|
||||||
|
timeout: 3s
|
||||||
|
retries: 30
|
||||||
|
|
||||||
|
# Chroma vector database
|
||||||
|
chroma:
|
||||||
|
image: ghcr.io/chroma-core/chroma:0.5.1
|
||||||
|
profiles:
|
||||||
|
- chroma
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- ./volumes/chroma:/chroma/chroma
|
||||||
|
environment:
|
||||||
|
CHROMA_SERVER_AUTHN_CREDENTIALS: ${CHROMA_SERVER_AUTHN_CREDENTIALS:-difyai123456}
|
||||||
|
CHROMA_SERVER_AUTHN_PROVIDER: ${CHROMA_SERVER_AUTHN_PROVIDER:-chromadb.auth.token_authn.TokenAuthenticationServerProvider}
|
||||||
|
IS_PERSISTENT: ${CHROMA_IS_PERSISTENT:-TRUE}
|
||||||
|
|
||||||
|
# Oracle vector database
|
||||||
|
oracle:
|
||||||
|
image: container-registry.oracle.com/database/free:latest
|
||||||
|
profiles:
|
||||||
|
- oracle
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- type: volume
|
||||||
|
source: oradata
|
||||||
|
target: /opt/oracle/oradata
|
||||||
|
- ./startupscripts:/opt/oracle/scripts/startup
|
||||||
|
environment:
|
||||||
|
- ORACLE_PWD=${ORACLE_PWD:-Dify123456}
|
||||||
|
- ORACLE_CHARACTERSET=${ORACLE_CHARACTERSET:-AL32UTF8}
|
||||||
|
|
||||||
|
# Milvus vector database services
|
||||||
|
etcd:
|
||||||
|
image: quay.io/coreos/etcd:v3.5.5
|
||||||
|
profiles:
|
||||||
|
- milvus
|
||||||
|
environment:
|
||||||
|
- ETCD_AUTO_COMPACTION_MODE=${ETCD_AUTO_COMPACTION_MODE:-revision}
|
||||||
|
- ETCD_AUTO_COMPACTION_RETENTION=${ETCD_AUTO_COMPACTION_RETENTION:-1000}
|
||||||
|
- ETCD_QUOTA_BACKEND_BYTES=${ETCD_QUOTA_BACKEND_BYTES:-4294967296}
|
||||||
|
- ETCD_SNAPSHOT_COUNT=${ETCD_SNAPSHOT_COUNT:-50000}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/milvus/etcd:/etcd
|
||||||
|
command: etcd -advertise-client-urls=http://127.0.0.1:2379 -listen-client-urls http://0.0.0.0:2379 --data-dir /etcd
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "etcdctl", "endpoint", "health"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 20s
|
||||||
|
retries: 3
|
||||||
|
networks:
|
||||||
|
- milvus
|
||||||
|
|
||||||
|
minio:
|
||||||
|
image: minio/minio:RELEASE.2023-03-20T20-16-18Z
|
||||||
|
profiles:
|
||||||
|
- milvus
|
||||||
|
environment:
|
||||||
|
MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:-minioadmin}
|
||||||
|
MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:-minioadmin}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/milvus/minio:/minio_data
|
||||||
|
command: minio server /minio_data --console-address ":9001"
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 20s
|
||||||
|
retries: 3
|
||||||
|
networks:
|
||||||
|
- milvus
|
||||||
|
|
||||||
|
milvus-standalone:
|
||||||
|
image: milvusdb/milvus:v2.3.1
|
||||||
|
profiles:
|
||||||
|
- milvus
|
||||||
|
command: ["milvus", "run", "standalone"]
|
||||||
|
environment:
|
||||||
|
ETCD_ENDPOINTS: ${ETCD_ENDPOINTS:-etcd:2379}
|
||||||
|
MINIO_ADDRESS: ${MINIO_ADDRESS:-minio:9000}
|
||||||
|
common.security.authorizationEnabled: ${MILVUS_AUTHORIZATION_ENABLED:-true}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/milvus/milvus:/var/lib/milvus
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "curl", "-f", "http://localhost:9091/healthz"]
|
||||||
|
interval: 30s
|
||||||
|
start_period: 90s
|
||||||
|
timeout: 20s
|
||||||
|
retries: 3
|
||||||
|
depends_on:
|
||||||
|
- "etcd"
|
||||||
|
- "minio"
|
||||||
|
networks:
|
||||||
|
- milvus
|
||||||
|
|
||||||
|
# Opensearch vector database
|
||||||
|
opensearch:
|
||||||
|
image: opensearchproject/opensearch:latest
|
||||||
|
profiles:
|
||||||
|
- opensearch
|
||||||
|
environment:
|
||||||
|
- discovery.type=${OPENSEARCH_DISCOVERY_TYPE:-single-node}
|
||||||
|
- bootstrap.memory_lock=${OPENSEARCH_BOOTSTRAP_MEMORY_LOCK:-true}
|
||||||
|
- OPENSEARCH_JAVA_OPTS=-Xms${OPENSEARCH_JAVA_OPTS_MIN:-512m} -Xmx${OPENSEARCH_JAVA_OPTS_MAX:-1024m}
|
||||||
|
- OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_INITIAL_ADMIN_PASSWORD:-Qazwsxedc!@#123}
|
||||||
|
ulimits:
|
||||||
|
memlock:
|
||||||
|
soft: ${OPENSEARCH_MEMLOCK_SOFT:--1}
|
||||||
|
hard: ${OPENSEARCH_MEMLOCK_HARD:--1}
|
||||||
|
nofile:
|
||||||
|
soft: ${OPENSEARCH_NOFILE_SOFT:-65536}
|
||||||
|
hard: ${OPENSEARCH_NOFILE_HARD:-65536}
|
||||||
|
volumes:
|
||||||
|
- ./volumes/opensearch/data:/usr/share/opensearch/data
|
||||||
|
networks:
|
||||||
|
- opensearch-net
|
||||||
|
|
||||||
|
opensearch-dashboards:
|
||||||
|
image: opensearchproject/opensearch-dashboards:latest
|
||||||
|
profiles:
|
||||||
|
- opensearch
|
||||||
|
environment:
|
||||||
|
OPENSEARCH_HOSTS: '["https://opensearch:9200"]'
|
||||||
|
volumes:
|
||||||
|
- ./volumes/opensearch/opensearch_dashboards.yml:/usr/share/opensearch-dashboards/config/opensearch_dashboards.yml
|
||||||
|
networks:
|
||||||
|
- opensearch-net
|
||||||
|
depends_on:
|
||||||
|
- opensearch
|
||||||
|
|
||||||
|
# MyScale vector database
|
||||||
|
myscale:
|
||||||
|
image: myscale/myscaledb:1.6
|
||||||
|
profiles:
|
||||||
|
- myscale
|
||||||
|
restart: always
|
||||||
|
tty: true
|
||||||
|
volumes:
|
||||||
|
- ./volumes/myscale/data:/var/lib/clickhouse
|
||||||
|
- ./volumes/myscale/log:/var/log/clickhouse-server
|
||||||
|
- ./volumes/myscale/config/users.d/custom_users_config.xml:/etc/clickhouse-server/users.d/custom_users_config.xml
|
||||||
|
|
||||||
|
networks:
|
||||||
|
# create a network between sandbox, api and ssrf_proxy, and can not access outside.
|
||||||
|
ssrf_proxy_network:
|
||||||
|
driver: bridge
|
||||||
|
internal: true
|
||||||
|
milvus:
|
||||||
|
driver: bridge
|
||||||
|
opensearch-net:
|
||||||
|
driver: bridge
|
||||||
|
internal: true
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
oradata:
|
||||||
@@ -0,0 +1,52 @@
|
|||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for db Service
|
||||||
|
# ------------------------------
|
||||||
|
PGUSER=postgres
|
||||||
|
# The password for the default postgres user.
|
||||||
|
POSTGRES_PASSWORD=difyai123456
|
||||||
|
# The name of the default postgres database.
|
||||||
|
POSTGRES_DB=dify
|
||||||
|
# postgres data directory
|
||||||
|
PGDATA=/var/lib/postgresql/data/pgdata
|
||||||
|
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for sandbox Service
|
||||||
|
SANDBOX_API_KEY=dify-sandbox
|
||||||
|
SANDBOX_GIN_MODE=release
|
||||||
|
SANDBOX_WORKER_TIMEOUT=15
|
||||||
|
SANDBOX_ENABLE_NETWORK=true
|
||||||
|
SANDBOX_HTTP_PROXY=http://ssrf_proxy:3128
|
||||||
|
SANDBOX_HTTPS_PROXY=http://ssrf_proxy:3128
|
||||||
|
SANDBOX_PORT=8194
|
||||||
|
# ------------------------------
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for ssrf_proxy Service
|
||||||
|
# ------------------------------
|
||||||
|
SSRF_HTTP_PORT=3128
|
||||||
|
SSRF_COREDUMP_DIR=/var/spool/squid
|
||||||
|
SSRF_REVERSE_PROXY_PORT=8194
|
||||||
|
SSRF_SANDBOX_HOST=sandbox
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Environment Variables for weaviate Service
|
||||||
|
# ------------------------------
|
||||||
|
WEAVIATE_QUERY_DEFAULTS_LIMIT=25
|
||||||
|
WEAVIATE_AUTHENTICATION_ANONYMOUS_ACCESS_ENABLED=true
|
||||||
|
WEAVIATE_DEFAULT_VECTORIZER_MODULE=none
|
||||||
|
WEAVIATE_CLUSTER_HOSTNAME=node1
|
||||||
|
WEAVIATE_AUTHENTICATION_APIKEY_ENABLED=true
|
||||||
|
WEAVIATE_AUTHENTICATION_APIKEY_ALLOWED_KEYS=WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih
|
||||||
|
WEAVIATE_AUTHENTICATION_APIKEY_USERS=hello@dify.ai
|
||||||
|
WEAVIATE_AUTHORIZATION_ADMINLIST_ENABLED=true
|
||||||
|
WEAVIATE_AUTHORIZATION_ADMINLIST_USERS=hello@dify.ai
|
||||||
|
|
||||||
|
# ------------------------------
|
||||||
|
# Docker Compose Service Expose Host Port Configurations
|
||||||
|
# ------------------------------
|
||||||
|
EXPOSE_POSTGRES_PORT=5432
|
||||||
|
EXPOSE_REDIS_PORT=6379
|
||||||
|
EXPOSE_SANDBOX_PORT=8194
|
||||||
|
EXPOSE_SSRF_PROXY_PORT=3128
|
||||||
|
EXPOSE_WEAVIATE_PORT=8080
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
# Please do not directly edit this file. Instead, modify the .env variables related to NGINX configuration.
|
||||||
|
|
||||||
|
server {
|
||||||
|
listen ${NGINX_PORT};
|
||||||
|
server_name ${NGINX_SERVER_NAME};
|
||||||
|
|
||||||
|
location /console/api {
|
||||||
|
proxy_pass http://api:5001;
|
||||||
|
include proxy.conf;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /api {
|
||||||
|
proxy_pass http://api:5001;
|
||||||
|
include proxy.conf;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /v1 {
|
||||||
|
proxy_pass http://api:5001;
|
||||||
|
include proxy.conf;
|
||||||
|
}
|
||||||
|
|
||||||
|
location /files {
|
||||||
|
proxy_pass http://api:5001;
|
||||||
|
include proxy.conf;
|
||||||
|
}
|
||||||
|
|
||||||
|
location / {
|
||||||
|
proxy_pass http://web:3000;
|
||||||
|
include proxy.conf;
|
||||||
|
}
|
||||||
|
|
||||||
|
# placeholder for https config defined in https.conf.template
|
||||||
|
${HTTPS_CONFIG}
|
||||||
|
}
|
||||||
Executable
+19
@@ -0,0 +1,19 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ "${NGINX_HTTPS_ENABLED}" = "true" ]; then
|
||||||
|
# set the HTTPS_CONFIG environment variable to the content of the https.conf.template
|
||||||
|
HTTPS_CONFIG=$(envsubst < /etc/nginx/https.conf.template)
|
||||||
|
export HTTPS_CONFIG
|
||||||
|
# Substitute the HTTPS_CONFIG in the default.conf.template with content from https.conf.template
|
||||||
|
envsubst '${HTTPS_CONFIG}' < /etc/nginx/conf.d/default.conf.template > /etc/nginx/conf.d/default.conf
|
||||||
|
fi
|
||||||
|
|
||||||
|
env_vars=$(printenv | cut -d= -f1 | sed 's/^/$/g' | paste -sd, -)
|
||||||
|
|
||||||
|
envsubst "$env_vars" < /etc/nginx/nginx.conf.template > /etc/nginx/nginx.conf
|
||||||
|
envsubst "$env_vars" < /etc/nginx/proxy.conf.template > /etc/nginx/proxy.conf
|
||||||
|
|
||||||
|
envsubst < /etc/nginx/conf.d/default.conf.template > /etc/nginx/conf.d/default.conf
|
||||||
|
|
||||||
|
# Start Nginx using the default entrypoint
|
||||||
|
exec nginx -g 'daemon off;'
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
# Please do not directly edit this file. Instead, modify the .env variables related to NGINX configuration.
|
||||||
|
|
||||||
|
listen ${NGINX_SSL_PORT} ssl;
|
||||||
|
ssl_certificate ./../ssl/${NGINX_SSL_CERT_FILENAME};
|
||||||
|
ssl_certificate_key ./../ssl/${NGINX_SSL_CERT_KEY_FILENAME};
|
||||||
|
ssl_protocols ${NGINX_SSL_PROTOCOLS};
|
||||||
|
ssl_prefer_server_ciphers on;
|
||||||
|
ssl_session_cache shared:SSL:10m;
|
||||||
|
ssl_session_timeout 10m;
|
||||||
@@ -0,0 +1,34 @@
|
|||||||
|
# Please do not directly edit this file. Instead, modify the .env variables related to NGINX configuration.
|
||||||
|
|
||||||
|
user nginx;
|
||||||
|
worker_processes ${NGINX_WORKER_PROCESSES};
|
||||||
|
|
||||||
|
error_log /var/log/nginx/error.log notice;
|
||||||
|
pid /var/run/nginx.pid;
|
||||||
|
|
||||||
|
|
||||||
|
events {
|
||||||
|
worker_connections 1024;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
http {
|
||||||
|
include /etc/nginx/mime.types;
|
||||||
|
default_type application/octet-stream;
|
||||||
|
|
||||||
|
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
|
||||||
|
'$status $body_bytes_sent "$http_referer" '
|
||||||
|
'"$http_user_agent" "$http_x_forwarded_for"';
|
||||||
|
|
||||||
|
access_log /var/log/nginx/access.log main;
|
||||||
|
|
||||||
|
sendfile on;
|
||||||
|
#tcp_nopush on;
|
||||||
|
|
||||||
|
keepalive_timeout ${NGINX_KEEPALIVE_TIMEOUT};
|
||||||
|
|
||||||
|
#gzip on;
|
||||||
|
client_max_body_size ${NGINX_CLIENT_MAX_BODY_SIZE};
|
||||||
|
|
||||||
|
include /etc/nginx/conf.d/*.conf;
|
||||||
|
}
|
||||||
@@ -0,0 +1,10 @@
|
|||||||
|
# Please do not directly edit this file. Instead, modify the .env variables related to NGINX configuration.
|
||||||
|
|
||||||
|
proxy_set_header Host $host;
|
||||||
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||||
|
proxy_set_header X-Forwarded-Proto $scheme;
|
||||||
|
proxy_http_version 1.1;
|
||||||
|
proxy_set_header Connection "";
|
||||||
|
proxy_buffering off;
|
||||||
|
proxy_read_timeout ${NGINX_PROXY_READ_TIMEOUT};
|
||||||
|
proxy_send_timeout ${NGINX_PROXY_SEND_TIMEOUT};
|
||||||
Executable
+42
@@ -0,0 +1,42 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# Modified based on Squid OCI image entrypoint
|
||||||
|
|
||||||
|
# This entrypoint aims to forward the squid logs to stdout to assist users of
|
||||||
|
# common container related tooling (e.g., kubernetes, docker-compose, etc) to
|
||||||
|
# access the service logs.
|
||||||
|
|
||||||
|
# Moreover, it invokes the squid binary, leaving all the desired parameters to
|
||||||
|
# be provided by the "command" passed to the spawned container. If no command
|
||||||
|
# is provided by the user, the default behavior (as per the CMD statement in
|
||||||
|
# the Dockerfile) will be to use Ubuntu's default configuration [1] and run
|
||||||
|
# squid with the "-NYC" options to mimic the behavior of the Ubuntu provided
|
||||||
|
# systemd unit.
|
||||||
|
|
||||||
|
# [1] The default configuration is changed in the Dockerfile to allow local
|
||||||
|
# network connections. See the Dockerfile for further information.
|
||||||
|
|
||||||
|
echo "[ENTRYPOINT] re-create snakeoil self-signed certificate removed in the build process"
|
||||||
|
if [ ! -f /etc/ssl/private/ssl-cert-snakeoil.key ]; then
|
||||||
|
/usr/sbin/make-ssl-cert generate-default-snakeoil --force-overwrite > /dev/null 2>&1
|
||||||
|
fi
|
||||||
|
|
||||||
|
tail -F /var/log/squid/access.log 2>/dev/null &
|
||||||
|
tail -F /var/log/squid/error.log 2>/dev/null &
|
||||||
|
tail -F /var/log/squid/store.log 2>/dev/null &
|
||||||
|
tail -F /var/log/squid/cache.log 2>/dev/null &
|
||||||
|
|
||||||
|
# Replace environment variables in the template and output to the squid.conf
|
||||||
|
echo "[ENTRYPOINT] replacing environment variables in the template"
|
||||||
|
awk '{
|
||||||
|
while(match($0, /\${[A-Za-z_][A-Za-z_0-9]*}/)) {
|
||||||
|
var = substr($0, RSTART+2, RLENGTH-3)
|
||||||
|
val = ENVIRON[var]
|
||||||
|
$0 = substr($0, 1, RSTART-1) val substr($0, RSTART+RLENGTH)
|
||||||
|
}
|
||||||
|
print
|
||||||
|
}' /etc/squid/squid.conf.template > /etc/squid/squid.conf
|
||||||
|
|
||||||
|
/usr/sbin/squid -Nz
|
||||||
|
echo "[ENTRYPOINT] starting squid"
|
||||||
|
/usr/sbin/squid -f /etc/squid/squid.conf -NYC 1
|
||||||
@@ -0,0 +1,50 @@
|
|||||||
|
acl localnet src 0.0.0.1-0.255.255.255 # RFC 1122 "this" network (LAN)
|
||||||
|
acl localnet src 10.0.0.0/8 # RFC 1918 local private network (LAN)
|
||||||
|
acl localnet src 100.64.0.0/10 # RFC 6598 shared address space (CGN)
|
||||||
|
acl localnet src 169.254.0.0/16 # RFC 3927 link-local (directly plugged) machines
|
||||||
|
acl localnet src 172.16.0.0/12 # RFC 1918 local private network (LAN)
|
||||||
|
acl localnet src 192.168.0.0/16 # RFC 1918 local private network (LAN)
|
||||||
|
acl localnet src fc00::/7 # RFC 4193 local private network range
|
||||||
|
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
|
||||||
|
acl SSL_ports port 443
|
||||||
|
acl Safe_ports port 80 # http
|
||||||
|
acl Safe_ports port 21 # ftp
|
||||||
|
acl Safe_ports port 443 # https
|
||||||
|
acl Safe_ports port 70 # gopher
|
||||||
|
acl Safe_ports port 210 # wais
|
||||||
|
acl Safe_ports port 1025-65535 # unregistered ports
|
||||||
|
acl Safe_ports port 280 # http-mgmt
|
||||||
|
acl Safe_ports port 488 # gss-http
|
||||||
|
acl Safe_ports port 591 # filemaker
|
||||||
|
acl Safe_ports port 777 # multiling http
|
||||||
|
acl CONNECT method CONNECT
|
||||||
|
http_access deny !Safe_ports
|
||||||
|
http_access deny CONNECT !SSL_ports
|
||||||
|
http_access allow localhost manager
|
||||||
|
http_access deny manager
|
||||||
|
http_access allow localhost
|
||||||
|
include /etc/squid/conf.d/*.conf
|
||||||
|
http_access deny all
|
||||||
|
|
||||||
|
################################## Proxy Server ################################
|
||||||
|
http_port ${HTTP_PORT}
|
||||||
|
coredump_dir ${COREDUMP_DIR}
|
||||||
|
refresh_pattern ^ftp: 1440 20% 10080
|
||||||
|
refresh_pattern ^gopher: 1440 0% 1440
|
||||||
|
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
|
||||||
|
refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
|
||||||
|
refresh_pattern \/Release(|\.gpg)$ 0 0% 0 refresh-ims
|
||||||
|
refresh_pattern \/InRelease$ 0 0% 0 refresh-ims
|
||||||
|
refresh_pattern \/(Translation-.*)(|\.bz2|\.gz|\.xz)$ 0 0% 0 refresh-ims
|
||||||
|
refresh_pattern . 0 20% 4320
|
||||||
|
|
||||||
|
|
||||||
|
# cache_dir ufs /var/spool/squid 100 16 256
|
||||||
|
# upstream proxy, set to your own upstream proxy IP to avoid SSRF attacks
|
||||||
|
# cache_peer 172.1.1.1 parent 3128 0 no-query no-digest no-netdb-exchange default
|
||||||
|
|
||||||
|
################################## Reverse Proxy To Sandbox ################################
|
||||||
|
http_port ${REVERSE_PROXY_PORT} accel vhost
|
||||||
|
cache_peer ${SANDBOX_HOST} parent ${SANDBOX_PORT} 0 no-query originserver
|
||||||
|
acl src_all src all
|
||||||
|
http_access allow src_all
|
||||||
Executable
+13
@@ -0,0 +1,13 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
DB_INITIALISED="/opt/oracle/oradata/dbinit"
|
||||||
|
#[ -f ${DB_INITIALISED} ] && exit
|
||||||
|
#touch ${DB_INITIALISED}
|
||||||
|
if [ -f ${DB_INITIALISED} ]; then
|
||||||
|
echo 'File exists. Standards for have been Init'
|
||||||
|
exit
|
||||||
|
else
|
||||||
|
echo 'File does not exist. Standards for first time Strart up this DB'
|
||||||
|
"$ORACLE_HOME"/bin/sqlplus -s "/ as sysdba" @"/opt/oracle/scripts/startup/init_user.script";
|
||||||
|
touch ${DB_INITIALISED}
|
||||||
|
fi
|
||||||
Executable
+10
@@ -0,0 +1,10 @@
|
|||||||
|
show pdbs;
|
||||||
|
ALTER SYSTEM SET PROCESSES=500 SCOPE=SPFILE;
|
||||||
|
alter session set container= freepdb1;
|
||||||
|
create user dify identified by dify DEFAULT TABLESPACE users quota unlimited on users;
|
||||||
|
grant DB_DEVELOPER_ROLE to dify;
|
||||||
|
|
||||||
|
BEGIN
|
||||||
|
CTX_DDL.CREATE_PREFERENCE('my_chinese_vgram_lexer','CHINESE_VGRAM_LEXER');
|
||||||
|
END;
|
||||||
|
/
|
||||||
@@ -0,0 +1,17 @@
|
|||||||
|
<clickhouse>
|
||||||
|
<users>
|
||||||
|
<default>
|
||||||
|
<password></password>
|
||||||
|
<networks>
|
||||||
|
<ip>::1</ip> <!-- change to ::/0 to allow access from all addresses -->
|
||||||
|
<ip>127.0.0.1</ip>
|
||||||
|
<ip>10.0.0.0/8</ip>
|
||||||
|
<ip>172.16.0.0/12</ip>
|
||||||
|
<ip>192.168.0.0/16</ip>
|
||||||
|
</networks>
|
||||||
|
<profile>default</profile>
|
||||||
|
<quota>default</quota>
|
||||||
|
<access_management>1</access_management>
|
||||||
|
</default>
|
||||||
|
</users>
|
||||||
|
</clickhouse>
|
||||||
@@ -0,0 +1,222 @@
|
|||||||
|
---
|
||||||
|
# Copyright OpenSearch Contributors
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
|
||||||
|
# Description:
|
||||||
|
# Default configuration for OpenSearch Dashboards
|
||||||
|
|
||||||
|
# OpenSearch Dashboards is served by a back end server. This setting specifies the port to use.
|
||||||
|
# server.port: 5601
|
||||||
|
|
||||||
|
# Specifies the address to which the OpenSearch Dashboards server will bind. IP addresses and host names are both valid values.
|
||||||
|
# The default is 'localhost', which usually means remote machines will not be able to connect.
|
||||||
|
# To allow connections from remote users, set this parameter to a non-loopback address.
|
||||||
|
# server.host: "localhost"
|
||||||
|
|
||||||
|
# Enables you to specify a path to mount OpenSearch Dashboards at if you are running behind a proxy.
|
||||||
|
# Use the `server.rewriteBasePath` setting to tell OpenSearch Dashboards if it should remove the basePath
|
||||||
|
# from requests it receives, and to prevent a deprecation warning at startup.
|
||||||
|
# This setting cannot end in a slash.
|
||||||
|
# server.basePath: ""
|
||||||
|
|
||||||
|
# Specifies whether OpenSearch Dashboards should rewrite requests that are prefixed with
|
||||||
|
# `server.basePath` or require that they are rewritten by your reverse proxy.
|
||||||
|
# server.rewriteBasePath: false
|
||||||
|
|
||||||
|
# The maximum payload size in bytes for incoming server requests.
|
||||||
|
# server.maxPayloadBytes: 1048576
|
||||||
|
|
||||||
|
# The OpenSearch Dashboards server's name. This is used for display purposes.
|
||||||
|
# server.name: "your-hostname"
|
||||||
|
|
||||||
|
# The URLs of the OpenSearch instances to use for all your queries.
|
||||||
|
# opensearch.hosts: ["http://localhost:9200"]
|
||||||
|
|
||||||
|
# OpenSearch Dashboards uses an index in OpenSearch to store saved searches, visualizations and
|
||||||
|
# dashboards. OpenSearch Dashboards creates a new index if the index doesn't already exist.
|
||||||
|
# opensearchDashboards.index: ".opensearch_dashboards"
|
||||||
|
|
||||||
|
# The default application to load.
|
||||||
|
# opensearchDashboards.defaultAppId: "home"
|
||||||
|
|
||||||
|
# Setting for an optimized healthcheck that only uses the local OpenSearch node to do Dashboards healthcheck.
|
||||||
|
# This settings should be used for large clusters or for clusters with ingest heavy nodes.
|
||||||
|
# It allows Dashboards to only healthcheck using the local OpenSearch node rather than fan out requests across all nodes.
|
||||||
|
#
|
||||||
|
# It requires the user to create an OpenSearch node attribute with the same name as the value used in the setting
|
||||||
|
# This node attribute should assign all nodes of the same cluster an integer value that increments with each new cluster that is spun up
|
||||||
|
# e.g. in opensearch.yml file you would set the value to a setting using node.attr.cluster_id:
|
||||||
|
# Should only be enabled if there is a corresponding node attribute created in your OpenSearch config that matches the value here
|
||||||
|
# opensearch.optimizedHealthcheckId: "cluster_id"
|
||||||
|
|
||||||
|
# If your OpenSearch is protected with basic authentication, these settings provide
|
||||||
|
# the username and password that the OpenSearch Dashboards server uses to perform maintenance on the OpenSearch Dashboards
|
||||||
|
# index at startup. Your OpenSearch Dashboards users still need to authenticate with OpenSearch, which
|
||||||
|
# is proxied through the OpenSearch Dashboards server.
|
||||||
|
# opensearch.username: "opensearch_dashboards_system"
|
||||||
|
# opensearch.password: "pass"
|
||||||
|
|
||||||
|
# Enables SSL and paths to the PEM-format SSL certificate and SSL key files, respectively.
|
||||||
|
# These settings enable SSL for outgoing requests from the OpenSearch Dashboards server to the browser.
|
||||||
|
# server.ssl.enabled: false
|
||||||
|
# server.ssl.certificate: /path/to/your/server.crt
|
||||||
|
# server.ssl.key: /path/to/your/server.key
|
||||||
|
|
||||||
|
# Optional settings that provide the paths to the PEM-format SSL certificate and key files.
|
||||||
|
# These files are used to verify the identity of OpenSearch Dashboards to OpenSearch and are required when
|
||||||
|
# xpack.security.http.ssl.client_authentication in OpenSearch is set to required.
|
||||||
|
# opensearch.ssl.certificate: /path/to/your/client.crt
|
||||||
|
# opensearch.ssl.key: /path/to/your/client.key
|
||||||
|
|
||||||
|
# Optional setting that enables you to specify a path to the PEM file for the certificate
|
||||||
|
# authority for your OpenSearch instance.
|
||||||
|
# opensearch.ssl.certificateAuthorities: [ "/path/to/your/CA.pem" ]
|
||||||
|
|
||||||
|
# To disregard the validity of SSL certificates, change this setting's value to 'none'.
|
||||||
|
# opensearch.ssl.verificationMode: full
|
||||||
|
|
||||||
|
# Time in milliseconds to wait for OpenSearch to respond to pings. Defaults to the value of
|
||||||
|
# the opensearch.requestTimeout setting.
|
||||||
|
# opensearch.pingTimeout: 1500
|
||||||
|
|
||||||
|
# Time in milliseconds to wait for responses from the back end or OpenSearch. This value
|
||||||
|
# must be a positive integer.
|
||||||
|
# opensearch.requestTimeout: 30000
|
||||||
|
|
||||||
|
# List of OpenSearch Dashboards client-side headers to send to OpenSearch. To send *no* client-side
|
||||||
|
# headers, set this value to [] (an empty list).
|
||||||
|
# opensearch.requestHeadersWhitelist: [ authorization ]
|
||||||
|
|
||||||
|
# Header names and values that are sent to OpenSearch. Any custom headers cannot be overwritten
|
||||||
|
# by client-side headers, regardless of the opensearch.requestHeadersWhitelist configuration.
|
||||||
|
# opensearch.customHeaders: {}
|
||||||
|
|
||||||
|
# Time in milliseconds for OpenSearch to wait for responses from shards. Set to 0 to disable.
|
||||||
|
# opensearch.shardTimeout: 30000
|
||||||
|
|
||||||
|
# Logs queries sent to OpenSearch. Requires logging.verbose set to true.
|
||||||
|
# opensearch.logQueries: false
|
||||||
|
|
||||||
|
# Specifies the path where OpenSearch Dashboards creates the process ID file.
|
||||||
|
# pid.file: /var/run/opensearchDashboards.pid
|
||||||
|
|
||||||
|
# Enables you to specify a file where OpenSearch Dashboards stores log output.
|
||||||
|
# logging.dest: stdout
|
||||||
|
|
||||||
|
# Set the value of this setting to true to suppress all logging output.
|
||||||
|
# logging.silent: false
|
||||||
|
|
||||||
|
# Set the value of this setting to true to suppress all logging output other than error messages.
|
||||||
|
# logging.quiet: false
|
||||||
|
|
||||||
|
# Set the value of this setting to true to log all events, including system usage information
|
||||||
|
# and all requests.
|
||||||
|
# logging.verbose: false
|
||||||
|
|
||||||
|
# Set the interval in milliseconds to sample system and process performance
|
||||||
|
# metrics. Minimum is 100ms. Defaults to 5000.
|
||||||
|
# ops.interval: 5000
|
||||||
|
|
||||||
|
# Specifies locale to be used for all localizable strings, dates and number formats.
|
||||||
|
# Supported languages are the following: English - en , by default , Chinese - zh-CN .
|
||||||
|
# i18n.locale: "en"
|
||||||
|
|
||||||
|
# Set the allowlist to check input graphite Url. Allowlist is the default check list.
|
||||||
|
# vis_type_timeline.graphiteAllowedUrls: ['https://www.hostedgraphite.com/UID/ACCESS_KEY/graphite']
|
||||||
|
|
||||||
|
# Set the blocklist to check input graphite Url. Blocklist is an IP list.
|
||||||
|
# Below is an example for reference
|
||||||
|
# vis_type_timeline.graphiteBlockedIPs: [
|
||||||
|
# //Loopback
|
||||||
|
# '127.0.0.0/8',
|
||||||
|
# '::1/128',
|
||||||
|
# //Link-local Address for IPv6
|
||||||
|
# 'fe80::/10',
|
||||||
|
# //Private IP address for IPv4
|
||||||
|
# '10.0.0.0/8',
|
||||||
|
# '172.16.0.0/12',
|
||||||
|
# '192.168.0.0/16',
|
||||||
|
# //Unique local address (ULA)
|
||||||
|
# 'fc00::/7',
|
||||||
|
# //Reserved IP address
|
||||||
|
# '0.0.0.0/8',
|
||||||
|
# '100.64.0.0/10',
|
||||||
|
# '192.0.0.0/24',
|
||||||
|
# '192.0.2.0/24',
|
||||||
|
# '198.18.0.0/15',
|
||||||
|
# '192.88.99.0/24',
|
||||||
|
# '198.51.100.0/24',
|
||||||
|
# '203.0.113.0/24',
|
||||||
|
# '224.0.0.0/4',
|
||||||
|
# '240.0.0.0/4',
|
||||||
|
# '255.255.255.255/32',
|
||||||
|
# '::/128',
|
||||||
|
# '2001:db8::/32',
|
||||||
|
# 'ff00::/8',
|
||||||
|
# ]
|
||||||
|
# vis_type_timeline.graphiteBlockedIPs: []
|
||||||
|
|
||||||
|
# opensearchDashboards.branding:
|
||||||
|
# logo:
|
||||||
|
# defaultUrl: ""
|
||||||
|
# darkModeUrl: ""
|
||||||
|
# mark:
|
||||||
|
# defaultUrl: ""
|
||||||
|
# darkModeUrl: ""
|
||||||
|
# loadingLogo:
|
||||||
|
# defaultUrl: ""
|
||||||
|
# darkModeUrl: ""
|
||||||
|
# faviconUrl: ""
|
||||||
|
# applicationTitle: ""
|
||||||
|
|
||||||
|
# Set the value of this setting to true to capture region blocked warnings and errors
|
||||||
|
# for your map rendering services.
|
||||||
|
# map.showRegionBlockedWarning: false%
|
||||||
|
|
||||||
|
# Set the value of this setting to false to suppress search usage telemetry
|
||||||
|
# for reducing the load of OpenSearch cluster.
|
||||||
|
# data.search.usageTelemetry.enabled: false
|
||||||
|
|
||||||
|
# 2.4 renames 'wizard.enabled: false' to 'vis_builder.enabled: false'
|
||||||
|
# Set the value of this setting to false to disable VisBuilder
|
||||||
|
# functionality in Visualization.
|
||||||
|
# vis_builder.enabled: false
|
||||||
|
|
||||||
|
# 2.4 New Experimental Feature
|
||||||
|
# Set the value of this setting to true to enable the experimental multiple data source
|
||||||
|
# support feature. Use with caution.
|
||||||
|
# data_source.enabled: false
|
||||||
|
# Set the value of these settings to customize crypto materials to encryption saved credentials
|
||||||
|
# in data sources.
|
||||||
|
# data_source.encryption.wrappingKeyName: 'changeme'
|
||||||
|
# data_source.encryption.wrappingKeyNamespace: 'changeme'
|
||||||
|
# data_source.encryption.wrappingKey: [0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
|
||||||
|
|
||||||
|
# 2.6 New ML Commons Dashboards Feature
|
||||||
|
# Set the value of this setting to true to enable the ml commons dashboards
|
||||||
|
# ml_commons_dashboards.enabled: false
|
||||||
|
|
||||||
|
# 2.12 New experimental Assistant Dashboards Feature
|
||||||
|
# Set the value of this setting to true to enable the assistant dashboards
|
||||||
|
# assistant.chat.enabled: false
|
||||||
|
|
||||||
|
# 2.13 New Query Assistant Feature
|
||||||
|
# Set the value of this setting to false to disable the query assistant
|
||||||
|
# observability.query_assist.enabled: false
|
||||||
|
|
||||||
|
# 2.14 Enable Ui Metric Collectors in Usage Collector
|
||||||
|
# Set the value of this setting to true to enable UI Metric collections
|
||||||
|
# usageCollection.uiMetric.enabled: false
|
||||||
|
|
||||||
|
opensearch.hosts: [https://localhost:9200]
|
||||||
|
opensearch.ssl.verificationMode: none
|
||||||
|
opensearch.username: admin
|
||||||
|
opensearch.password: 'Qazwsxedc!@#123'
|
||||||
|
opensearch.requestHeadersWhitelist: [authorization, securitytenant]
|
||||||
|
|
||||||
|
opensearch_security.multitenancy.enabled: true
|
||||||
|
opensearch_security.multitenancy.tenants.preferred: [Private, Global]
|
||||||
|
opensearch_security.readonly_mode.roles: [kibana_read_only]
|
||||||
|
# Use this setting if you are running opensearch-dashboards without https
|
||||||
|
opensearch_security.cookie.secure: false
|
||||||
|
server.host: '0.0.0.0'
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ ! -d "./repo" ]; then
|
||||||
|
git clone --depth 1 --branch main --single-branch https://github.com/langgenius/dify.git repo
|
||||||
|
else
|
||||||
|
cd repo
|
||||||
|
git pull
|
||||||
|
cd ..
|
||||||
|
fi
|
||||||
|
|
||||||
|
cp -r ./repo/docker/. ./code
|
||||||
|
|
||||||
|
|
||||||
+1
-1
@@ -1,4 +1,4 @@
|
|||||||
# Supabase
|
# Plane
|
||||||
|
|
||||||
- copied from https://github.com/makeplane/plane
|
- copied from https://github.com/makeplane/plane
|
||||||
- removed `ports`
|
- removed `ports`
|
||||||
|
|||||||
@@ -0,0 +1,4 @@
|
|||||||
|
# Twenty
|
||||||
|
|
||||||
|
- copied from https://github.com/twentyhq/twenty
|
||||||
|
- removed `ports`
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
TAG=latest
|
||||||
|
|
||||||
|
# POSTGRES_ADMIN_PASSWORD=replace_me_with_a_strong_password
|
||||||
|
|
||||||
|
PG_DATABASE_HOST=db:5432
|
||||||
|
|
||||||
|
SERVER_URL=http://localhost:3000
|
||||||
|
# Uncoment if you are serving your front on another server than the API (eg. bucket)
|
||||||
|
# FRONT_BASE_URL=http://localhost:3000
|
||||||
|
|
||||||
|
# Use openssl rand -base64 32 for each secret
|
||||||
|
# ACCESS_TOKEN_SECRET=replace_me_with_a_random_string_access
|
||||||
|
# LOGIN_TOKEN_SECRET=replace_me_with_a_random_string_login
|
||||||
|
# REFRESH_TOKEN_SECRET=replace_me_with_a_random_string_refresh
|
||||||
|
# FILE_TOKEN_SECRET=replace_me_with_a_random_string_refresh
|
||||||
|
|
||||||
|
SIGN_IN_PREFILLED=true
|
||||||
|
|
||||||
|
STORAGE_TYPE=local
|
||||||
|
|
||||||
|
# STORAGE_S3_REGION=eu-west3
|
||||||
|
# STORAGE_S3_NAME=my-bucket
|
||||||
|
# STORAGE_S3_ENDPOINT=
|
||||||
|
|
||||||
|
MESSAGE_QUEUE_TYPE=pg-boss
|
||||||
@@ -0,0 +1,50 @@
|
|||||||
|
dev-build:
|
||||||
|
@docker compose -f dev/docker-compose.yml down -v
|
||||||
|
@docker compose -f dev/docker-compose.yml build
|
||||||
|
|
||||||
|
dev-up:
|
||||||
|
@docker compose -f dev/docker-compose.yml up -d
|
||||||
|
|
||||||
|
dev-start:
|
||||||
|
@docker compose -f dev/docker-compose.yml start
|
||||||
|
|
||||||
|
dev-stop:
|
||||||
|
@docker compose -f dev/docker-compose.yml stop
|
||||||
|
|
||||||
|
dev-down:
|
||||||
|
@docker compose -f dev/docker-compose.yml down -v
|
||||||
|
|
||||||
|
dev-sh:
|
||||||
|
@docker compose -f dev/docker-compose.yml exec twenty-dev sh
|
||||||
|
|
||||||
|
dev-postgres-build:
|
||||||
|
@docker stop twenty_postgres || true
|
||||||
|
@docker rm twenty_postgres || true
|
||||||
|
@docker volume rm twenty_db_data || true
|
||||||
|
@docker compose -f dev/docker-compose.yml up --build postgres -d
|
||||||
|
|
||||||
|
prod-build:
|
||||||
|
@cd ../.. && docker build -f ./packages/twenty-docker/twenty/Dockerfile --tag twenty . && cd -
|
||||||
|
|
||||||
|
prod-run:
|
||||||
|
@docker run -d -p 3000:3000 --name twenty twenty
|
||||||
|
|
||||||
|
prod-postgres-build:
|
||||||
|
@cd ../.. && docker build -f ./packages/twenty-docker/twenty-postgres/Dockerfile --tag twenty-postgres . && cd -
|
||||||
|
|
||||||
|
prod-postgres-run:
|
||||||
|
@docker run -d -p 5432:5432 -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD=postgres --name twenty-postgres twenty-postgres
|
||||||
|
|
||||||
|
prod-website-build:
|
||||||
|
@cd ../.. && docker build -f ./packages/twenty-docker/twenty-website/Dockerfile --tag twenty-website . && cd -
|
||||||
|
|
||||||
|
prod-website-run:
|
||||||
|
@docker run -d -p 3000:3000 --name twenty-website twenty-website
|
||||||
|
|
||||||
|
release-postgres:
|
||||||
|
@cd ../.. && docker buildx build \
|
||||||
|
--push \
|
||||||
|
--no-cache \
|
||||||
|
--platform linux/amd64,linux/arm64 \
|
||||||
|
-f ./packages/twenty-docker/twenty-postgres/Dockerfile -t twentycrm/twenty-postgres:$(version) -t twentycrm/twenty-postgres:latest . \
|
||||||
|
&& cd -
|
||||||
@@ -0,0 +1,93 @@
|
|||||||
|
version: "3.9"
|
||||||
|
name: twenty
|
||||||
|
|
||||||
|
services:
|
||||||
|
change-vol-ownership:
|
||||||
|
image: ubuntu
|
||||||
|
user: root
|
||||||
|
volumes:
|
||||||
|
- server-local-data:/tmp/server-local-data
|
||||||
|
- docker-data:/tmp/docker-data
|
||||||
|
command: >
|
||||||
|
bash -c "
|
||||||
|
chown -R 1000:1000 /tmp/server-local-data
|
||||||
|
&& chown -R 1000:1000 /tmp/docker-data"
|
||||||
|
|
||||||
|
server:
|
||||||
|
image: twentycrm/twenty:${TAG}
|
||||||
|
volumes:
|
||||||
|
- server-local-data:/app/packages/twenty-server/${STORAGE_LOCAL_PATH:-.local-storage}
|
||||||
|
- docker-data:/app/docker-data
|
||||||
|
environment:
|
||||||
|
PORT: 3000
|
||||||
|
PG_DATABASE_URL: postgres://twenty:twenty@${PG_DATABASE_HOST}/default
|
||||||
|
SERVER_URL: ${SERVER_URL}
|
||||||
|
FRONT_BASE_URL: ${FRONT_BASE_URL:-$SERVER_URL}
|
||||||
|
MESSAGE_QUEUE_TYPE: ${MESSAGE_QUEUE_TYPE}
|
||||||
|
|
||||||
|
ENABLE_DB_MIGRATIONS: "true"
|
||||||
|
|
||||||
|
SIGN_IN_PREFILLED: ${SIGN_IN_PREFILLED}
|
||||||
|
STORAGE_TYPE: ${STORAGE_TYPE}
|
||||||
|
STORAGE_S3_REGION: ${STORAGE_S3_REGION}
|
||||||
|
STORAGE_S3_NAME: ${STORAGE_S3_NAME}
|
||||||
|
STORAGE_S3_ENDPOINT: ${STORAGE_S3_ENDPOINT}
|
||||||
|
ACCESS_TOKEN_SECRET: ${ACCESS_TOKEN_SECRET}
|
||||||
|
LOGIN_TOKEN_SECRET: ${LOGIN_TOKEN_SECRET}
|
||||||
|
REFRESH_TOKEN_SECRET: ${REFRESH_TOKEN_SECRET}
|
||||||
|
FILE_TOKEN_SECRET: ${FILE_TOKEN_SECRET}
|
||||||
|
depends_on:
|
||||||
|
change-vol-ownership:
|
||||||
|
condition: service_completed_successfully
|
||||||
|
db:
|
||||||
|
condition: service_healthy
|
||||||
|
healthcheck:
|
||||||
|
test: curl --fail http://localhost:3000/healthz
|
||||||
|
interval: 5s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 10
|
||||||
|
restart: always
|
||||||
|
|
||||||
|
worker:
|
||||||
|
image: twentycrm/twenty:${TAG}
|
||||||
|
command: ["yarn", "worker:prod"]
|
||||||
|
environment:
|
||||||
|
PG_DATABASE_URL: postgres://twenty:twenty@${PG_DATABASE_HOST}/default
|
||||||
|
SERVER_URL: ${SERVER_URL}
|
||||||
|
FRONT_BASE_URL: ${FRONT_BASE_URL:-$SERVER_URL}
|
||||||
|
MESSAGE_QUEUE_TYPE: ${MESSAGE_QUEUE_TYPE}
|
||||||
|
|
||||||
|
ENABLE_DB_MIGRATIONS: "false" # it already runs on the server
|
||||||
|
|
||||||
|
STORAGE_TYPE: ${STORAGE_TYPE}
|
||||||
|
STORAGE_S3_REGION: ${STORAGE_S3_REGION}
|
||||||
|
STORAGE_S3_NAME: ${STORAGE_S3_NAME}
|
||||||
|
STORAGE_S3_ENDPOINT: ${STORAGE_S3_ENDPOINT}
|
||||||
|
ACCESS_TOKEN_SECRET: ${ACCESS_TOKEN_SECRET}
|
||||||
|
LOGIN_TOKEN_SECRET: ${LOGIN_TOKEN_SECRET}
|
||||||
|
REFRESH_TOKEN_SECRET: ${REFRESH_TOKEN_SECRET}
|
||||||
|
FILE_TOKEN_SECRET: ${FILE_TOKEN_SECRET}
|
||||||
|
depends_on:
|
||||||
|
db:
|
||||||
|
condition: service_healthy
|
||||||
|
server:
|
||||||
|
condition: service_healthy
|
||||||
|
restart: always
|
||||||
|
|
||||||
|
db:
|
||||||
|
image: twentycrm/twenty-postgres:${TAG}
|
||||||
|
volumes:
|
||||||
|
- db-data:/bitnami/postgresql
|
||||||
|
environment:
|
||||||
|
POSTGRES_PASSWORD: ${POSTGRES_ADMIN_PASSWORD}
|
||||||
|
healthcheck:
|
||||||
|
test: pg_isready -U twenty -d default
|
||||||
|
interval: 5s
|
||||||
|
timeout: 5s
|
||||||
|
retries: 10
|
||||||
|
restart: always
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
docker-data:
|
||||||
|
db-data:
|
||||||
|
server-local-data:
|
||||||
@@ -0,0 +1,113 @@
|
|||||||
|
# README
|
||||||
|
|
||||||
|
## Overview
|
||||||
|
|
||||||
|
This repository contains Kubernetes manifests and Terraform files to help you deploy and manage the TwentyCRM application. The files are located in the `packages/twenty-docker/k8s` directory.
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
Before using these files, ensure you have the following installed and configured on your system:
|
||||||
|
|
||||||
|
- Kubernetes cluster (e.g., Minikube, EKS, GKE)
|
||||||
|
- kubectl
|
||||||
|
- Terraform
|
||||||
|
- Docker
|
||||||
|
|
||||||
|
## Setup Instructions
|
||||||
|
|
||||||
|
### Step 1: Clone the Repository
|
||||||
|
|
||||||
|
Clone the repository to your local machine:
|
||||||
|
|
||||||
|
``` bash
|
||||||
|
git clone https://github.com/twentyhq/twenty.git
|
||||||
|
cd twentycrm/packages/twenty-docker/k8s
|
||||||
|
```
|
||||||
|
|
||||||
|
### Step 2: Customize the Manifests and Terraform Files
|
||||||
|
|
||||||
|
**Important:** These files require customization for your specific implementation. Update the placeholders and configurations according to your environment and requirements.
|
||||||
|
|
||||||
|
### Step 3: Deploy with Terraform
|
||||||
|
|
||||||
|
1. Navigate to the Terraform directory:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd terraform
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Initialize Terraform:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
terraform init
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Plan the deployment:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
terraform plan
|
||||||
|
```
|
||||||
|
|
||||||
|
4. Apply the deployment:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
terraform apply
|
||||||
|
```
|
||||||
|
|
||||||
|
## OR
|
||||||
|
|
||||||
|
### Step 3: Deploy with Kubernetes Manifests
|
||||||
|
|
||||||
|
1. Navigate to the Kubernetes manifests directory:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd ../k8s
|
||||||
|
```
|
||||||
|
|
||||||
|
2. Create Server Secret
|
||||||
|
|
||||||
|
``` bash
|
||||||
|
kubectl create secret generic -n twentycrm tokens --from-literal accessToken=changeme --from-literal loginToken="changeme" --from-literal refreshToken="changeme" --from-literal fileToken="changeme"
|
||||||
|
```
|
||||||
|
|
||||||
|
3. Apply the manifests:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
kubectl apply -f .
|
||||||
|
```
|
||||||
|
|
||||||
|
## Customization
|
||||||
|
|
||||||
|
### Kubernetes Manifests
|
||||||
|
|
||||||
|
- **Namespace:** Update the `namespace` in the manifests as needed.
|
||||||
|
- **Resource Limits:** Adjust the resource limits and requests according to your application's requirements.
|
||||||
|
- **Environment Variables:** Configure server tokens in the `Secret` command above.
|
||||||
|
|
||||||
|
### Terraform Files
|
||||||
|
|
||||||
|
- **Variables:** Update the variables in the `variables.tf` file to match your environment.
|
||||||
|
- **Locals:** Update the locals in the `main.tf` file to match your environment.
|
||||||
|
- **Providers:** Ensure the provider configurations (e.g., AWS, GCP) are correct for your setup.
|
||||||
|
- **Resources:** Modify the resource definitions as needed to fit your infrastructure.
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
### Common Issues
|
||||||
|
|
||||||
|
- **Connectivity:** Ensure your Kubernetes cluster is accessible and configured correctly.
|
||||||
|
- **Permissions:** Verify that you have the necessary permissions to deploy resources in your cloud provider.
|
||||||
|
- **Resource Limits:** Adjust resource limits if you encounter issues related to insufficient resources.
|
||||||
|
|
||||||
|
### Logs and Debugging
|
||||||
|
|
||||||
|
- Use `kubectl logs` to check the logs of your Kubernetes pods.
|
||||||
|
- Use `terraform show` and `terraform state` to inspect your Terraform state and configurations.
|
||||||
|
|
||||||
|
## Conclusion
|
||||||
|
|
||||||
|
This setup provides a basic structure for deploying the TwentyCRM application using Kubernetes and Terraform. Ensure you thoroughly customize the manifests and Terraform files to suit your specific needs. For any issues or questions, please refer to the official documentation of Kubernetes and Terraform or seek support from your cloud provider.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
Feel free to contribute and improve this repository by submitting pull requests or opening issues. Happy deploying!
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: twentycrm-db
|
||||||
|
name: twentycrm-db
|
||||||
|
namespace: twentycrm
|
||||||
|
spec:
|
||||||
|
progressDeadlineSeconds: 600
|
||||||
|
replicas: 1
|
||||||
|
strategy:
|
||||||
|
rollingUpdate:
|
||||||
|
maxSurge: 1
|
||||||
|
maxUnavailable: 1
|
||||||
|
type: RollingUpdate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: twentycrm-db
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: twentycrm-db
|
||||||
|
spec:
|
||||||
|
volumes:
|
||||||
|
- name: twentycrm-db-data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: twentycrm-db-pvc
|
||||||
|
containers:
|
||||||
|
- env:
|
||||||
|
- name: POSTGRES_PASSWORD
|
||||||
|
value: "twenty"
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: "true"
|
||||||
|
- image: twentycrm/twenty-postgres:latest
|
||||||
|
imagePullPolicy: Always
|
||||||
|
name: twentycrm
|
||||||
|
ports:
|
||||||
|
- containerPort: 5432
|
||||||
|
name: tcp
|
||||||
|
protocol: TCP
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "256Mi"
|
||||||
|
cpu: "250m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "1000m"
|
||||||
|
stdin: true
|
||||||
|
tty: true
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /bitnami/postgresql
|
||||||
|
name: twentycrm-db-data
|
||||||
|
dnsPolicy: ClusterFirst
|
||||||
|
restartPolicy: Always
|
||||||
@@ -0,0 +1,82 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: twentycrm-server
|
||||||
|
name: twentycrm-server
|
||||||
|
namespace: twentycrm
|
||||||
|
spec:
|
||||||
|
progressDeadlineSeconds: 600
|
||||||
|
replicas: 1
|
||||||
|
strategy:
|
||||||
|
rollingUpdate:
|
||||||
|
maxSurge: 1
|
||||||
|
maxUnavailable: 1
|
||||||
|
type: RollingUpdate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: twentycrm-server
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: twentycrm-server
|
||||||
|
spec:
|
||||||
|
volumes:
|
||||||
|
- name: twentycrm-server-data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: twentycrm-server-pvc
|
||||||
|
containers:
|
||||||
|
- env:
|
||||||
|
- name: PORT
|
||||||
|
value: 3000
|
||||||
|
- name: SERVER_URL
|
||||||
|
value: "https://crm.example.com:443"
|
||||||
|
- name: PG_DATABASE_URL
|
||||||
|
value: "postgres://twenty:twenty@twenty-db.twentycrm.svc.cluster.local/default"
|
||||||
|
- name: ENABLE_DB_MIGRATIONS
|
||||||
|
value: "true"
|
||||||
|
- name: SIGN_IN_PREFILLED
|
||||||
|
value: "true"
|
||||||
|
- name: STORAGE_TYPE
|
||||||
|
value: "local"
|
||||||
|
- name: ACCESS_TOKEN_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: tokens
|
||||||
|
key: accessToken
|
||||||
|
- name: LOGIN_TOKEN_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: tokens
|
||||||
|
key: loginToken
|
||||||
|
- name: REFRESH_TOKEN_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: tokens
|
||||||
|
key: refreshToken
|
||||||
|
- name: FILE_TOKEN_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: tokens
|
||||||
|
key: fileToken
|
||||||
|
- image: twentycrm/twenty:latest
|
||||||
|
imagePullPolicy: Always
|
||||||
|
name: twentycrm
|
||||||
|
ports:
|
||||||
|
- containerPort: 3000
|
||||||
|
name: http-tcp
|
||||||
|
protocol: TCP
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
memory: "256Mi"
|
||||||
|
cpu: "250m"
|
||||||
|
limits:
|
||||||
|
memory: "1024Mi"
|
||||||
|
cpu: "1000m"
|
||||||
|
stdin: true
|
||||||
|
tty: true
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /app/.local-storage
|
||||||
|
name: twentycrm-server-data
|
||||||
|
dnsPolicy: ClusterFirst
|
||||||
|
restartPolicy: Always
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: twentycrm
|
||||||
|
namespace: twentycrm
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/configuration-snippet: |
|
||||||
|
more_set_headers "X-Forwarded-For $http_x_forwarded_for";
|
||||||
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
|
||||||
|
kubernetes.io/ingress.class: "nginx"
|
||||||
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: crm.example.com
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: twentycrm-server
|
||||||
|
port:
|
||||||
|
name: http-tcp
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: twentycrm-db-pv
|
||||||
|
spec:
|
||||||
|
storageClassName: default
|
||||||
|
capacity:
|
||||||
|
storage: 10Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
@@ -0,0 +1,12 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: twentycrm-server-pv
|
||||||
|
namespace: twentycrm
|
||||||
|
spec:
|
||||||
|
storageClassName: default
|
||||||
|
capacity:
|
||||||
|
storage: 10Gi
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: twentycrm-db-pvc
|
||||||
|
namespace: twentycrm
|
||||||
|
spec:
|
||||||
|
storageClassName: default
|
||||||
|
volumeName: twentycrm-db-pv
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: twentycrm-server-pvc
|
||||||
|
namespace: twentycrm
|
||||||
|
spec:
|
||||||
|
storageClassName: default
|
||||||
|
volumeName: twentycrm-server-pv
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: twentycrm-db
|
||||||
|
namespace: twentycrm
|
||||||
|
spec:
|
||||||
|
internalTrafficPolicy: Cluster
|
||||||
|
ports:
|
||||||
|
- port: 5432
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: 5432
|
||||||
|
selector:
|
||||||
|
app: twentycrm-db
|
||||||
|
sessionAffinity: ClientIP
|
||||||
|
sessionAffinityConfig:
|
||||||
|
clientIP:
|
||||||
|
timeoutSeconds: 10800
|
||||||
|
type: ClusterIP
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: twentycrm-server
|
||||||
|
namespace: twentycrm
|
||||||
|
spec:
|
||||||
|
internalTrafficPolicy: Cluster
|
||||||
|
ports:
|
||||||
|
- name: http-tcp
|
||||||
|
port: 3000
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: 3000
|
||||||
|
selector:
|
||||||
|
app: twentycrm-server
|
||||||
|
sessionAffinity: ClientIP
|
||||||
|
sessionAffinityConfig:
|
||||||
|
clientIP:
|
||||||
|
timeoutSeconds: 10800
|
||||||
|
type: ClusterIP
|
||||||
@@ -0,0 +1,90 @@
|
|||||||
|
resource "kubernetes_deployment" "twentycrm_db" {
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-db"
|
||||||
|
namespace = kubernetes_namespace.twentycrm.metadata.0.name
|
||||||
|
labels = {
|
||||||
|
app = "${local.twentycrm_app_name}-db"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
spec {
|
||||||
|
replicas = 1
|
||||||
|
selector {
|
||||||
|
match_labels = {
|
||||||
|
app = "${local.twentycrm_app_name}-db"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
strategy {
|
||||||
|
type = "RollingUpdate"
|
||||||
|
rolling_update {
|
||||||
|
max_surge = "1"
|
||||||
|
max_unavailable = "1"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
template {
|
||||||
|
metadata {
|
||||||
|
labels = {
|
||||||
|
app = "${local.twentycrm_app_name}-db"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
spec {
|
||||||
|
# security_context {
|
||||||
|
# fs_group = 0
|
||||||
|
# }
|
||||||
|
container {
|
||||||
|
image = local.twentycrm_db_image
|
||||||
|
name = local.twentycrm_app_name
|
||||||
|
stdin = true
|
||||||
|
tty = true
|
||||||
|
security_context {
|
||||||
|
allow_privilege_escalation = true
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "POSTGRES_PASSWORD"
|
||||||
|
value = "twenty"
|
||||||
|
}
|
||||||
|
env {
|
||||||
|
name = "BITNAMI_DEBUG"
|
||||||
|
value = true
|
||||||
|
}
|
||||||
|
|
||||||
|
port {
|
||||||
|
container_port = 5432
|
||||||
|
protocol = "TCP"
|
||||||
|
}
|
||||||
|
|
||||||
|
resources {
|
||||||
|
requests = {
|
||||||
|
cpu = "250m"
|
||||||
|
memory = "256Mi"
|
||||||
|
}
|
||||||
|
limits = {
|
||||||
|
cpu = "1000m"
|
||||||
|
memory = "1024Mi"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
volume_mount {
|
||||||
|
name = "nfs-twentycrm-db-data"
|
||||||
|
mount_path = "/bitnami/postgresql"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
volume {
|
||||||
|
name = "nfs-twentycrm-db-data"
|
||||||
|
|
||||||
|
persistent_volume_claim {
|
||||||
|
claim_name = "nfs-twentycrm-db-data-pvc"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
dns_policy = "ClusterFirst"
|
||||||
|
restart_policy = "Always"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,169 @@
|
|||||||
|
resource "kubernetes_deployment" "twentycrm_server" {
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-server"
|
||||||
|
namespace = kubernetes_namespace.twentycrm.metadata.0.name
|
||||||
|
labels = {
|
||||||
|
app = "${local.twentycrm_app_name}-server"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
spec {
|
||||||
|
replicas = 1
|
||||||
|
selector {
|
||||||
|
match_labels = {
|
||||||
|
app = "${local.twentycrm_app_name}-server"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
strategy {
|
||||||
|
type = "RollingUpdate"
|
||||||
|
rolling_update {
|
||||||
|
max_surge = "1"
|
||||||
|
max_unavailable = "1"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
template {
|
||||||
|
metadata {
|
||||||
|
labels = {
|
||||||
|
app = "${local.twentycrm_app_name}-server"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
spec {
|
||||||
|
container {
|
||||||
|
image = local.twentycrm_server_image
|
||||||
|
name = local.twentycrm_app_name
|
||||||
|
stdin = true
|
||||||
|
tty = true
|
||||||
|
|
||||||
|
security_context {
|
||||||
|
allow_privilege_escalation = true
|
||||||
|
privileged = true
|
||||||
|
run_as_user = 1000
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "PORT"
|
||||||
|
value = "3000"
|
||||||
|
}
|
||||||
|
env {
|
||||||
|
name = "DEBUG_MODE"
|
||||||
|
value = false
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "SERVER_URL"
|
||||||
|
value = "https://crm.example.com:443"
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "FRONT_BASE_URL"
|
||||||
|
value = "https://crm.example.com:443"
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "BACKEND_SERVER_URL"
|
||||||
|
value = "https://crm.example.com:443"
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "PG_DATABASE_URL"
|
||||||
|
value = "postgres://twenty:twenty@twentycrm-db.twentycrm.svc.cluster.local/default"
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "ENABLE_DB_MIGRATIONS"
|
||||||
|
value = "true"
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "SIGN_IN_PREFILLED"
|
||||||
|
value = "true"
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "STORAGE_TYPE"
|
||||||
|
value = "local"
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "ACCESS_TOKEN_SECRET"
|
||||||
|
value_from {
|
||||||
|
secret_key_ref {
|
||||||
|
name = "tokens"
|
||||||
|
key = "accessToken"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "LOGIN_TOKEN_SECRET"
|
||||||
|
value_from {
|
||||||
|
secret_key_ref {
|
||||||
|
name = "tokens"
|
||||||
|
key = "loginToken"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "REFRESH_TOKEN_SECRET"
|
||||||
|
value_from {
|
||||||
|
secret_key_ref {
|
||||||
|
name = "tokens"
|
||||||
|
key = "refreshToken"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
env {
|
||||||
|
name = "FILE_TOKEN_SECRET"
|
||||||
|
value_from {
|
||||||
|
secret_key_ref {
|
||||||
|
name = "tokens"
|
||||||
|
key = "fileToken"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
port {
|
||||||
|
container_port = 3000
|
||||||
|
protocol = "TCP"
|
||||||
|
}
|
||||||
|
|
||||||
|
resources {
|
||||||
|
requests = {
|
||||||
|
cpu = "250m"
|
||||||
|
memory = "256Mi"
|
||||||
|
}
|
||||||
|
limits = {
|
||||||
|
cpu = "1000m"
|
||||||
|
memory = "1024Mi"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
volume_mount {
|
||||||
|
name = "nfs-twentycrm-server-data"
|
||||||
|
mount_path = "/app/.local-storage"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
volume {
|
||||||
|
name = "nfs-twentycrm-server-data"
|
||||||
|
|
||||||
|
persistent_volume_claim {
|
||||||
|
claim_name = "nfs-twentycrm-server-data-pvc"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
dns_policy = "ClusterFirst"
|
||||||
|
restart_policy = "Always"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
depends_on = [
|
||||||
|
kubernetes_deployment.twentycrm_db,
|
||||||
|
kubernetes_secret.twentycrm_tokens
|
||||||
|
]
|
||||||
|
}
|
||||||
@@ -0,0 +1,30 @@
|
|||||||
|
resource "kubernetes_ingress" "twentycrm" {
|
||||||
|
wait_for_load_balancer = true
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-ingress"
|
||||||
|
namespace = kubernetes_namespace.twentycrm.metadata.0.name
|
||||||
|
annotations = {
|
||||||
|
"kubernetes.io/ingress.class" = "nginx"
|
||||||
|
"nginx.ingress.kubernetes.io/configuration-snippet" = <<EOF
|
||||||
|
more_set_headers "X-Forwarded-For $http_x_forwarded_for";
|
||||||
|
EOF
|
||||||
|
"nginx.ingress.kubernetes.io/force-ssl-redirect" = "false"
|
||||||
|
"nginx.ingress.kubernetes.io/backend-protocol" = "HTTP"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
spec {
|
||||||
|
ingress_class_name = "nginx"
|
||||||
|
rule {
|
||||||
|
host = local.twentycrm_app_hostname
|
||||||
|
http {
|
||||||
|
path {
|
||||||
|
path = "/*"
|
||||||
|
backend {
|
||||||
|
service_name = kubernetes_service.twentycrm_server.metadata.0.name
|
||||||
|
service_port = kubernetes_service.twentycrm_server.spec.0.port.0.port
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,36 @@
|
|||||||
|
#############
|
||||||
|
# Providers #
|
||||||
|
#############
|
||||||
|
provider "kubernetes" {
|
||||||
|
config_path = "~/.kube/config"
|
||||||
|
}
|
||||||
|
|
||||||
|
#################
|
||||||
|
# Global Locals #
|
||||||
|
#################
|
||||||
|
locals {
|
||||||
|
twentycrm_app_name = "twentycrm"
|
||||||
|
twentycrm_app_hostname = "crm.example.com"
|
||||||
|
twentycrm_server_image = "twentycrm/twenty:v0.10.4"
|
||||||
|
twentycrm_db_image = "twentycrm/twenty-postgres:v0.10.4"
|
||||||
|
twentycrm_db_pv_path = "/path/to/mystorage"
|
||||||
|
twentycrm_db_pv_capacity = "10Gi"
|
||||||
|
twentycrm_db_pvc_requests = "10Gi"
|
||||||
|
twentycrm_server_pv_path = "/path/to/mystorage"
|
||||||
|
twentycrm_server_pv_capacity = "10Gi"
|
||||||
|
twentycrm_server_pvc_requests = "10Gi"
|
||||||
|
}
|
||||||
|
|
||||||
|
####################
|
||||||
|
# Terraform Config #
|
||||||
|
####################
|
||||||
|
terraform {
|
||||||
|
required_version = ">= 1.7.4"
|
||||||
|
required_providers {
|
||||||
|
kubernetes = {
|
||||||
|
source = "hashicorp/kubernetes"
|
||||||
|
version = ">= 2.23.0"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
@@ -0,0 +1,9 @@
|
|||||||
|
resource "kubernetes_namespace" "twentycrm" {
|
||||||
|
metadata {
|
||||||
|
annotations = {
|
||||||
|
name = "twentycrm"
|
||||||
|
}
|
||||||
|
|
||||||
|
name = "twentycrm"
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
resource "kubernetes_persistent_volume" "db" {
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-db-pv"
|
||||||
|
}
|
||||||
|
spec {
|
||||||
|
storage_class_name = "default"
|
||||||
|
capacity = {
|
||||||
|
storage = local.twentycrm_db_pv_capacity
|
||||||
|
}
|
||||||
|
access_modes = ["ReadWriteOnce"]
|
||||||
|
# refer to Terraform Docs for your specific implementation requirements
|
||||||
|
# https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume
|
||||||
|
persistent_volume_source {
|
||||||
|
local {
|
||||||
|
path = local.twentycrm_db_pv_path
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
resource "kubernetes_persistent_volume" "server" {
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-server-pv"
|
||||||
|
}
|
||||||
|
spec {
|
||||||
|
storage_class_name = "default"
|
||||||
|
capacity = {
|
||||||
|
storage = local.twentycrm_server_pv_capacity
|
||||||
|
}
|
||||||
|
access_modes = ["ReadWriteOnce"]
|
||||||
|
# refer to Terraform Docs for your specific implementation requirements
|
||||||
|
# https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/persistent_volume
|
||||||
|
persistent_volume_source {
|
||||||
|
local {
|
||||||
|
path = local.twentycrm_server_pv_path
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
resource "kubernetes_persistent_volume_claim" "db" {
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-db-pvc"
|
||||||
|
namespace = kubernetes_namespace.twentycrm.metadata.0.name
|
||||||
|
}
|
||||||
|
spec {
|
||||||
|
access_modes = ["ReadWriteOnce"]
|
||||||
|
resources {
|
||||||
|
requests = {
|
||||||
|
storage = local.twentycrm_db_pvc_requests
|
||||||
|
}
|
||||||
|
}
|
||||||
|
volume_name = kubernetes_persistent_volume.db.metadata.0.name
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
resource "kubernetes_persistent_volume_claim" "server" {
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-server-pvc"
|
||||||
|
namespace = kubernetes_namespace.twentycrm.metadata.0.name
|
||||||
|
}
|
||||||
|
spec {
|
||||||
|
access_modes = ["ReadWriteOnce"]
|
||||||
|
resources {
|
||||||
|
requests = {
|
||||||
|
storage = local.twentycrm_server_pvc_requests
|
||||||
|
}
|
||||||
|
}
|
||||||
|
volume_name = kubernetes_persistent_volume.server.metadata.0.name
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,15 @@
|
|||||||
|
resource "kubernetes_secret" "twentycrm_tokens" {
|
||||||
|
metadata {
|
||||||
|
name = "tokens"
|
||||||
|
namespace = kubernetes_namespace.twentycrm.metadata.0.name
|
||||||
|
}
|
||||||
|
|
||||||
|
data = {
|
||||||
|
accessToken = var.twentycrm_token_accessToken
|
||||||
|
loginToken = var.twentycrm_token_loginToken
|
||||||
|
refreshToken = var.twentycrm_token_refreshToken
|
||||||
|
fileToken = var.twentycrm_token_fileToken
|
||||||
|
}
|
||||||
|
|
||||||
|
# type = "kubernetes.io/basic-auth"
|
||||||
|
}
|
||||||
@@ -0,0 +1,18 @@
|
|||||||
|
resource "kubernetes_service" "twentycrm_db" {
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-db"
|
||||||
|
namespace = kubernetes_namespace.twentycrm.metadata.0.name
|
||||||
|
}
|
||||||
|
spec {
|
||||||
|
selector = {
|
||||||
|
app = "${local.twentycrm_app_name}-db"
|
||||||
|
}
|
||||||
|
session_affinity = "ClientIP"
|
||||||
|
port {
|
||||||
|
port = 5432
|
||||||
|
target_port = 5432
|
||||||
|
}
|
||||||
|
|
||||||
|
type = "ClusterIP"
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,19 @@
|
|||||||
|
resource "kubernetes_service" "twentycrm_server" {
|
||||||
|
metadata {
|
||||||
|
name = "${local.twentycrm_app_name}-server"
|
||||||
|
namespace = kubernetes_namespace.twentycrm.metadata.0.name
|
||||||
|
}
|
||||||
|
spec {
|
||||||
|
selector = {
|
||||||
|
app = "${local.twentycrm_app_name}-server"
|
||||||
|
}
|
||||||
|
session_affinity = "ClientIP"
|
||||||
|
port {
|
||||||
|
name = "http-tcp"
|
||||||
|
port = 3000
|
||||||
|
target_port = 3000
|
||||||
|
}
|
||||||
|
|
||||||
|
type = "ClusterIP"
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,24 @@
|
|||||||
|
variable "twentycrm_token_accessToken" {
|
||||||
|
type = string
|
||||||
|
description = "TwentyCRM access Token"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "twentycrm_token_loginToken" {
|
||||||
|
type = string
|
||||||
|
description = "TwentyCRM login Token"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "twentycrm_token_refreshToken" {
|
||||||
|
type = string
|
||||||
|
description = "TwentyCRM refresh Token"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "twentycrm_token_fileToken" {
|
||||||
|
type = string
|
||||||
|
description = "TwentyCRM file Token"
|
||||||
|
}
|
||||||
|
|
||||||
|
variable "twentycrm_pgdb_admin_password" {
|
||||||
|
type = string
|
||||||
|
description = "TwentyCRM password for postgres database"
|
||||||
|
}
|
||||||
@@ -0,0 +1,78 @@
|
|||||||
|
ARG POSTGRES_VERSION=15
|
||||||
|
ARG SPILO_VERSION=3.2-p1
|
||||||
|
ARG PG_GRAPHQL_VERSION=1.5.6
|
||||||
|
ARG WRAPPERS_VERSION=0.2.0
|
||||||
|
|
||||||
|
# Build the mysql_fdw extension
|
||||||
|
FROM debian:bookworm as build-mysql_fdw
|
||||||
|
ARG POSTGRES_VERSION
|
||||||
|
|
||||||
|
ENV DEBIAN_FRONTEND noninteractive
|
||||||
|
RUN apt update && \
|
||||||
|
apt install -y \
|
||||||
|
build-essential \
|
||||||
|
git \
|
||||||
|
postgresql-server-dev-${POSTGRES_VERSION} \
|
||||||
|
default-libmysqlclient-dev && \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
# Install mysql_fdw
|
||||||
|
RUN git clone https://github.com/EnterpriseDB/mysql_fdw.git
|
||||||
|
WORKDIR mysql_fdw
|
||||||
|
RUN make USE_PGXS=1
|
||||||
|
|
||||||
|
|
||||||
|
# Build libssl for wrappers
|
||||||
|
FROM ubuntu:22.04 as build-libssl
|
||||||
|
|
||||||
|
ENV DEBIAN_FRONTEND noninteractive
|
||||||
|
RUN apt update && \
|
||||||
|
apt install -y \
|
||||||
|
build-essential \
|
||||||
|
git && \
|
||||||
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
WORKDIR /build
|
||||||
|
RUN git clone --branch OpenSSL_1_1_1-stable https://github.com/openssl/openssl.git
|
||||||
|
WORKDIR /build/openssl
|
||||||
|
RUN ./config && make && make install
|
||||||
|
|
||||||
|
|
||||||
|
# Extend the Spilo image with the pg_graphql and mysql_fdw extensions
|
||||||
|
FROM ghcr.io/zalando/spilo-${POSTGRES_VERSION}:${SPILO_VERSION}
|
||||||
|
ARG POSTGRES_VERSION
|
||||||
|
ARG PG_GRAPHQL_VERSION
|
||||||
|
ARG WRAPPERS_VERSION
|
||||||
|
ARG TARGETARCH
|
||||||
|
|
||||||
|
# Install precompiled supabase wrappers extensions
|
||||||
|
RUN set -eux; \
|
||||||
|
ARCH="$(dpkg --print-architecture)"; \
|
||||||
|
case "${ARCH}" in \
|
||||||
|
aarch64|arm64) TARGETARCH='arm64';; \
|
||||||
|
amd64|x86_64) TARGETARCH='amd64';; \
|
||||||
|
*) echo "Unsupported arch: ${ARCH}"; exit 1;; \
|
||||||
|
esac;
|
||||||
|
|
||||||
|
RUN apt update && apt install default-libmysqlclient-dev -y && rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
|
RUN curl -L "https://github.com/supabase/wrappers/releases/download/v${WRAPPERS_VERSION}/wrappers-v${WRAPPERS_VERSION}-pg${POSTGRES_VERSION}-${TARGETARCH}-linux-gnu.deb" -o wrappers.deb && \
|
||||||
|
dpkg --install wrappers.deb && \
|
||||||
|
rm wrappers.deb
|
||||||
|
|
||||||
|
COPY --from=build-libssl /usr/local/lib/libssl* /usr/local/lib/libcrypto* /usr/lib/
|
||||||
|
COPY --from=build-libssl /usr/local/lib/engines-1.1 /usr/lib/engines-1.1
|
||||||
|
|
||||||
|
# Copy pg_graphql
|
||||||
|
COPY ./packages/twenty-postgres/linux/${TARGETARCH}/${POSTGRES_VERSION}/pg_graphql/${PG_GRAPHQL_VERSION}/pg_graphql--${PG_GRAPHQL_VERSION}.sql \
|
||||||
|
/usr/share/postgresql/${POSTGRES_VERSION}/extension
|
||||||
|
COPY ./packages/twenty-postgres/linux/${TARGETARCH}/${POSTGRES_VERSION}/pg_graphql/${PG_GRAPHQL_VERSION}/pg_graphql.control \
|
||||||
|
/usr/share/postgresql/${POSTGRES_VERSION}/extension
|
||||||
|
COPY ./packages/twenty-postgres/linux/${TARGETARCH}/${POSTGRES_VERSION}/pg_graphql/${PG_GRAPHQL_VERSION}/pg_graphql.so \
|
||||||
|
/usr/lib/postgresql/${POSTGRES_VERSION}/lib/pg_graphql.so
|
||||||
|
|
||||||
|
# Copy mysql_fdw
|
||||||
|
COPY --from=build-mysql_fdw /mysql_fdw/mysql_fdw.so \
|
||||||
|
/usr/lib/postgresql/${POSTGRES_VERSION}/lib/mysql_fdw.so
|
||||||
|
COPY --from=build-mysql_fdw /mysql_fdw/mysql_fdw*.sql /mysql_fdw/mysql_fdw.control /mysql_fdw/mysql_fdw_pushdown.config \
|
||||||
|
/usr/share/postgresql/${POSTGRES_VERSION}/extension/
|
||||||
@@ -0,0 +1,54 @@
|
|||||||
|
ARG IMAGE_TAG='15.5.0-debian-11-r15'
|
||||||
|
|
||||||
|
FROM bitnami/postgresql:${IMAGE_TAG}
|
||||||
|
|
||||||
|
ARG PG_MAIN_VERSION=15
|
||||||
|
ARG PG_GRAPHQL_VERSION=1.5.6
|
||||||
|
ARG WRAPPERS_VERSION=0.2.0
|
||||||
|
ARG TARGETARCH
|
||||||
|
|
||||||
|
USER root
|
||||||
|
|
||||||
|
RUN set -eux; \
|
||||||
|
ARCH="$(dpkg --print-architecture)"; \
|
||||||
|
case "${ARCH}" in \
|
||||||
|
aarch64|arm64) \
|
||||||
|
TARGETARCH='arm64'; \
|
||||||
|
;; \
|
||||||
|
amd64|x86_64) \
|
||||||
|
TARGETARCH='amd64'; \
|
||||||
|
;; \
|
||||||
|
*) \
|
||||||
|
echo "Unsupported arch: ${ARCH}"; \
|
||||||
|
exit 1; \
|
||||||
|
;; \
|
||||||
|
esac;
|
||||||
|
|
||||||
|
RUN apt update && apt install build-essential git curl default-libmysqlclient-dev -y
|
||||||
|
|
||||||
|
# Install precompiled pg_graphql extensions
|
||||||
|
COPY ./packages/twenty-postgres/linux/${TARGETARCH}/${PG_MAIN_VERSION}/pg_graphql/${PG_GRAPHQL_VERSION}/pg_graphql--${PG_GRAPHQL_VERSION}.sql \
|
||||||
|
/opt/bitnami/postgresql/share/extension/
|
||||||
|
COPY ./packages/twenty-postgres/linux/${TARGETARCH}/${PG_MAIN_VERSION}/pg_graphql/${PG_GRAPHQL_VERSION}/pg_graphql.control \
|
||||||
|
/opt/bitnami/postgresql/share/extension/
|
||||||
|
COPY ./packages/twenty-postgres/linux/${TARGETARCH}/${PG_MAIN_VERSION}/pg_graphql/${PG_GRAPHQL_VERSION}/pg_graphql.so \
|
||||||
|
/opt/bitnami/postgresql/lib/
|
||||||
|
|
||||||
|
# Install precompiled supabase wrappers extensions
|
||||||
|
RUN curl -L "https://github.com/supabase/wrappers/releases/download/v${WRAPPERS_VERSION}/wrappers-v${WRAPPERS_VERSION}-pg${PG_MAIN_VERSION}-${TARGETARCH}-linux-gnu.deb" -o wrappers.deb
|
||||||
|
RUN dpkg --install wrappers.deb
|
||||||
|
RUN cp /usr/share/postgresql/${PG_MAIN_VERSION}/extension/wrappers* /opt/bitnami/postgresql/share/extension/
|
||||||
|
RUN cp /usr/lib/postgresql/${PG_MAIN_VERSION}/lib/wrappers* /opt/bitnami/postgresql/lib/
|
||||||
|
|
||||||
|
RUN export PATH=/usr/local/pgsql/bin/:$PATH
|
||||||
|
RUN export PATH=/usr/local/mysql/bin/:$PATH
|
||||||
|
RUN git clone https://github.com/EnterpriseDB/mysql_fdw.git
|
||||||
|
WORKDIR mysql_fdw
|
||||||
|
RUN make USE_PGXS=1
|
||||||
|
RUN make USE_PGXS=1 install
|
||||||
|
|
||||||
|
COPY ./packages/twenty-docker/twenty-postgres/init.sql /docker-entrypoint-initdb.d/
|
||||||
|
|
||||||
|
USER 1001
|
||||||
|
ENTRYPOINT ["/opt/bitnami/scripts/postgresql/entrypoint.sh"]
|
||||||
|
CMD ["/opt/bitnami/scripts/postgresql/run.sh"]
|
||||||
@@ -0,0 +1,4 @@
|
|||||||
|
CREATE DATABASE "default";
|
||||||
|
CREATE DATABASE "test";
|
||||||
|
CREATE USER twenty PASSWORD 'twenty';
|
||||||
|
ALTER ROLE twenty superuser;
|
||||||
@@ -0,0 +1,29 @@
|
|||||||
|
FROM node:18.17.1-alpine as twenty-website-build
|
||||||
|
|
||||||
|
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
COPY ./package.json .
|
||||||
|
COPY ./yarn.lock .
|
||||||
|
COPY ./.yarnrc.yml .
|
||||||
|
COPY ./.yarn/releases /app/.yarn/releases
|
||||||
|
COPY ./tools/eslint-rules /app/tools/eslint-rules
|
||||||
|
COPY ./packages/twenty-website/package.json /app/packages/twenty-website/package.json
|
||||||
|
|
||||||
|
RUN yarn
|
||||||
|
|
||||||
|
COPY ./packages/twenty-website /app/packages/twenty-website
|
||||||
|
RUN npx nx build twenty-website
|
||||||
|
|
||||||
|
FROM node:18.17.1-alpine as twenty-website
|
||||||
|
|
||||||
|
WORKDIR /app/packages/twenty-website
|
||||||
|
|
||||||
|
COPY --from=twenty-website-build /app /app
|
||||||
|
|
||||||
|
WORKDIR /app/packages/twenty-website
|
||||||
|
|
||||||
|
LABEL org.opencontainers.image.source=https://github.com/twentyhq/twenty
|
||||||
|
LABEL org.opencontainers.image.description="This image provides a consistent and reproducible environment for the website."
|
||||||
|
|
||||||
|
CMD ["/bin/sh", "-c", "npx nx start"]
|
||||||
@@ -0,0 +1,79 @@
|
|||||||
|
# Base image for common dependencies
|
||||||
|
FROM node:18.17.1-alpine as common-deps
|
||||||
|
|
||||||
|
WORKDIR /app
|
||||||
|
|
||||||
|
# Copy only the necessary files for dependency resolution
|
||||||
|
COPY ./package.json ./yarn.lock ./.yarnrc.yml ./tsconfig.base.json ./nx.json /app/
|
||||||
|
COPY ./.yarn/releases /app/.yarn/releases
|
||||||
|
|
||||||
|
COPY ./packages/twenty-emails/package.json /app/packages/twenty-emails/
|
||||||
|
COPY ./packages/twenty-server/package.json /app/packages/twenty-server/
|
||||||
|
COPY ./packages/twenty-server/patches /app/packages/twenty-server/patches
|
||||||
|
COPY ./packages/twenty-ui/package.json /app/packages/twenty-ui/
|
||||||
|
COPY ./packages/twenty-front/package.json /app/packages/twenty-front/
|
||||||
|
|
||||||
|
# Install all dependencies
|
||||||
|
RUN yarn && yarn cache clean && npx nx reset
|
||||||
|
|
||||||
|
|
||||||
|
# Build the back
|
||||||
|
FROM common-deps as twenty-server-build
|
||||||
|
|
||||||
|
# Copy sourcecode after installing dependences to accelerate subsequents builds
|
||||||
|
COPY ./packages/twenty-emails /app/packages/twenty-emails
|
||||||
|
COPY ./packages/twenty-server /app/packages/twenty-server
|
||||||
|
|
||||||
|
RUN npx nx run twenty-server:build
|
||||||
|
RUN mv /app/packages/twenty-server/dist /app/packages/twenty-server/build
|
||||||
|
RUN npx nx run twenty-server:build:packageJson
|
||||||
|
RUN mv /app/packages/twenty-server/dist/package.json /app/packages/twenty-server/package.json
|
||||||
|
RUN rm -rf /app/packages/twenty-server/dist
|
||||||
|
RUN mv /app/packages/twenty-server/build /app/packages/twenty-server/dist
|
||||||
|
|
||||||
|
RUN yarn workspaces focus --production twenty-emails twenty-server
|
||||||
|
|
||||||
|
|
||||||
|
# Build the front
|
||||||
|
FROM common-deps as twenty-front-build
|
||||||
|
|
||||||
|
ARG REACT_APP_SERVER_BASE_URL
|
||||||
|
|
||||||
|
COPY ./packages/twenty-front /app/packages/twenty-front
|
||||||
|
COPY ./packages/twenty-ui /app/packages/twenty-ui
|
||||||
|
RUN npx nx build twenty-front
|
||||||
|
|
||||||
|
|
||||||
|
# Final stage: Run the application
|
||||||
|
FROM node:18.17.1-alpine as twenty
|
||||||
|
|
||||||
|
# Used to run healthcheck in docker
|
||||||
|
RUN apk add --no-cache curl jq
|
||||||
|
|
||||||
|
COPY ./packages/twenty-docker/twenty/entrypoint.sh /app/entrypoint.sh
|
||||||
|
RUN chmod +x /app/entrypoint.sh
|
||||||
|
|
||||||
|
WORKDIR /app/packages/twenty-server
|
||||||
|
|
||||||
|
ARG REACT_APP_SERVER_BASE_URL
|
||||||
|
ENV REACT_APP_SERVER_BASE_URL $REACT_APP_SERVER_BASE_URL
|
||||||
|
ARG SENTRY_RELEASE
|
||||||
|
ENV SENTRY_RELEASE $SENTRY_RELEASE
|
||||||
|
|
||||||
|
# Copy built applications from previous stages
|
||||||
|
COPY --chown=1000 --from=twenty-server-build /app /app
|
||||||
|
COPY --chown=1000 --from=twenty-server-build /app/packages/twenty-server /app/packages/twenty-server
|
||||||
|
COPY --chown=1000 --from=twenty-front-build /app/packages/twenty-front/build /app/packages/twenty-server/dist/front
|
||||||
|
|
||||||
|
# Set metadata and labels
|
||||||
|
LABEL org.opencontainers.image.source=https://github.com/twentyhq/twenty
|
||||||
|
LABEL org.opencontainers.image.description="This image provides a consistent and reproducible environment for the backend and frontend, ensuring it deploys faster and runs the same way regardless of the deployment environment."
|
||||||
|
|
||||||
|
RUN mkdir /app/.local-storage
|
||||||
|
RUN chown -R 1000 /app
|
||||||
|
|
||||||
|
# Use non root user with uid 1000
|
||||||
|
USER 1000
|
||||||
|
|
||||||
|
CMD ["node", "dist/src/main"]
|
||||||
|
ENTRYPOINT ["/app/entrypoint.sh"]
|
||||||
Executable
+17
@@ -0,0 +1,17 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
# Check if the initialization has already been done and that we enabled automatic migration
|
||||||
|
if [ "${ENABLE_DB_MIGRATIONS}" = "true" ] && [ ! -f /app/docker-data/db_status ]; then
|
||||||
|
echo "Running database setup and migrations..."
|
||||||
|
|
||||||
|
# Run setup and migration scripts
|
||||||
|
NODE_OPTIONS="--max-old-space-size=1500" npx ts-node ./scripts/setup-db.ts
|
||||||
|
yarn database:migrate:prod
|
||||||
|
|
||||||
|
# Mark initialization as done
|
||||||
|
echo "Successfuly migrated DB!"
|
||||||
|
touch /app/docker-data/db_status
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Continue with the original Docker command
|
||||||
|
exec "$@"
|
||||||
@@ -0,0 +1,13 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
if [ ! -d "./repo" ]; then
|
||||||
|
git clone --depth 1 --branch main --single-branch git@github.com:twentyhq/twenty.git repo
|
||||||
|
else
|
||||||
|
cd repo
|
||||||
|
git pull
|
||||||
|
cd ..
|
||||||
|
fi
|
||||||
|
|
||||||
|
cp -r ./repo/packages/twenty-docker/. ./code
|
||||||
|
|
||||||
|
|
||||||
Reference in New Issue
Block a user