Updated Dify & Appwrite

2025-12-30 20:30:42 +05:00
parent 6f07307229
commit 128651d310
14 changed files with 1617 additions and 255 deletions
@@ -24,6 +24,11 @@ CONSOLE_WEB_URL=
 # Example: https://api.dify.ai
 SERVICE_API_URL=

+# Trigger external URL
+# used to display trigger endpoint API Base URL to the front-end.
+# Example: https://api.dify.ai
+TRIGGER_URL=http://localhost
+
 # WebApp API backend Url,
 # used to declare the back-end URL for the front-end API.
 # If empty, it is the same domain.
@@ -128,6 +133,8 @@ ACCESS_TOKEN_EXPIRE_MINUTES=60
 # Refresh token expiration time in days
 REFRESH_TOKEN_EXPIRE_DAYS=30

+# The default number of active requests for the application, where 0 means unlimited, should be a non-negative integer.
+APP_DEFAULT_ACTIVE_REQUESTS=0
 # The maximum number of active requests for the application, where 0 means unlimited, should be a non-negative integer.
 APP_MAX_ACTIVE_REQUESTS=0
 APP_MAX_EXECUTION_TIME=1200
@@ -149,6 +156,12 @@ DIFY_PORT=5001
 SERVER_WORKER_AMOUNT=1

 # Defaults to gevent. If using windows, it can be switched to sync or solo.
+#
+# Warning: Changing this parameter requires disabling patching for
+# psycopg2 and gRPC (see `gunicorn.conf.py` and `celery_entrypoint.py`).
+# Modifying it may also decrease throughput.
+#
+# It is strongly discouraged to change this parameter.
 SERVER_WORKER_CLASS=gevent

 # Default number of worker connections, the default is 10.
@@ -156,6 +169,12 @@ SERVER_WORKER_CONNECTIONS=10

 # Similar to SERVER_WORKER_CLASS.
 # If using windows, it can be switched to sync or solo.
+#
+# Warning: Changing this parameter requires disabling patching for
+# psycopg2 and gRPC (see `gunicorn_conf.py` and `celery_entrypoint.py`).
+# Modifying it may also decrease throughput.
+#
+# It is strongly discouraged to change this parameter.
 CELERY_WORKER_CLASS=

 # Request handling timeout. The default is 200,
@@ -201,17 +220,26 @@ ENABLE_WEBSITE_JINAREADER=true
 ENABLE_WEBSITE_FIRECRAWL=true
 ENABLE_WEBSITE_WATERCRAWL=true

+# Enable inline LaTeX rendering with single dollar signs ($...$) in the web frontend
+# Default is false for security reasons to prevent conflicts with regular text
+NEXT_PUBLIC_ENABLE_SINGLE_DOLLAR_LATEX=false
+
 # ------------------------------
 # Database Configuration
-# The database uses PostgreSQL. Please use the public schema.
-# It is consistent with the configuration in the 'db' service below.
+# The database uses PostgreSQL or MySQL. OceanBase and seekdb are also supported. Please use the public schema.
+# It is consistent with the configuration in the database service below.
+# You can adjust the database configuration according to your needs.
 # ------------------------------

+# Database type, supported values are `postgresql` and `mysql`
+DB_TYPE=postgresql
+# For MySQL, only `root` user is supported for now
 DB_USERNAME=postgres
 DB_PASSWORD=difyai123456
-DB_HOST=db
+DB_HOST=db_postgres
 DB_PORT=5432
 DB_DATABASE=dify
+
 # The size of the database connection pool.
 # The default is 30 connections, which can be appropriately increased.
 SQLALCHEMY_POOL_SIZE=30
@@ -225,6 +253,9 @@ SQLALCHEMY_ECHO=false
 SQLALCHEMY_POOL_PRE_PING=false
 # Whether to enable the Last in first out option or use default FIFO queue if is false
 SQLALCHEMY_POOL_USE_LIFO=false
+# Number of seconds to wait for a connection from the pool before raising a timeout error.
+# Default is 30
+SQLALCHEMY_POOL_TIMEOUT=30

 # Maximum number of connections to the database
 # Default is 100
@@ -256,6 +287,43 @@ POSTGRES_MAINTENANCE_WORK_MEM=64MB
 # Reference: https://www.postgresql.org/docs/current/runtime-config-query.html#GUC-EFFECTIVE-CACHE-SIZE
 POSTGRES_EFFECTIVE_CACHE_SIZE=4096MB

+# Sets the maximum allowed duration of any statement before termination.
+# Default is 0 (no timeout).
+#
+# Reference: https://www.postgresql.org/docs/current/runtime-config-client.html#GUC-STATEMENT-TIMEOUT
+# A value of 0 prevents the server from timing out statements.
+POSTGRES_STATEMENT_TIMEOUT=0
+
+# Sets the maximum allowed duration of any idle in-transaction session before termination.
+# Default is 0 (no timeout).
+#
+# Reference: https://www.postgresql.org/docs/current/runtime-config-client.html#GUC-IDLE-IN-TRANSACTION-SESSION-TIMEOUT
+# A value of 0 prevents the server from terminating idle sessions.
+POSTGRES_IDLE_IN_TRANSACTION_SESSION_TIMEOUT=0
+
+# MySQL Performance Configuration
+# Maximum number of connections to MySQL
+#
+# Default is 1000
+MYSQL_MAX_CONNECTIONS=1000
+
+# InnoDB buffer pool size
+# Default is 512M
+# Recommended value: 70-80% of available memory for dedicated MySQL server
+# Reference: https://dev.mysql.com/doc/refman/8.0/en/innodb-parameters.html#sysvar_innodb_buffer_pool_size
+MYSQL_INNODB_BUFFER_POOL_SIZE=512M
+
+# InnoDB log file size
+# Default is 128M
+# Reference: https://dev.mysql.com/doc/refman/8.0/en/innodb-parameters.html#sysvar_innodb_log_file_size
+MYSQL_INNODB_LOG_FILE_SIZE=128M
+
+# InnoDB flush log at transaction commit
+# Default is 2 (flush to OS cache, sync every second)
+# Options: 0 (no flush), 1 (flush and sync), 2 (flush to OS cache)
+# Reference: https://dev.mysql.com/doc/refman/8.0/en/innodb-parameters.html#sysvar_innodb_flush_log_at_trx_commit
+MYSQL_INNODB_FLUSH_LOG_AT_TRX_COMMIT=2
+
 # ------------------------------
 # Redis Configuration
 # This Redis configuration is used for caching and for pub/sub during conversation.
@@ -299,7 +367,7 @@ REDIS_CLUSTERS_PASSWORD=
 # Celery Configuration
 # ------------------------------

-# Use standalone redis as the broker, and redis db 1 for celery broker. (redis_username is usually set by defualt as empty)
+# Use standalone redis as the broker, and redis db 1 for celery broker. (redis_username is usually set by default as empty)
 # Format as follows: `redis://<redis_username>:<redis_password>@<redis_host>:<redis_port>/<redis_database>`.
 # Example: redis://:difyai123456@redis:6379/1
 # If use Redis Sentinel, format as follows: `sentinel://<redis_username>:<redis_password>@<sentinel_host1>:<sentinel_port>/<redis_database>`
@@ -327,6 +395,11 @@ WEB_API_CORS_ALLOW_ORIGINS=*
 # Specifies the allowed origins for cross-origin requests to the console API,
 # e.g. https://cloud.dify.ai or * for all origins.
 CONSOLE_CORS_ALLOW_ORIGINS=*
+# When the frontend and backend run on different subdomains, set COOKIE_DOMAIN to the site’s top-level domain (e.g., `example.com`). Leading dots are optional.
+COOKIE_DOMAIN=
+# When the frontend and backend run on different subdomains, set NEXT_PUBLIC_COOKIE_DOMAIN=1.
+NEXT_PUBLIC_COOKIE_DOMAIN=
+NEXT_PUBLIC_BATCH_CONCURRENCY=5

 # ------------------------------
 # File Storage Configuration
@@ -396,6 +469,7 @@ ALIYUN_OSS_REGION=ap-southeast-1
 ALIYUN_OSS_AUTH_VERSION=v4
 # Don't start with '/'. OSS doesn't support leading slash in object names.
 ALIYUN_OSS_PATH=your-path
+ALIYUN_CLOUDBOX_ID=your-cloudbox-id

 # Tencent COS Configuration
 #
@@ -404,6 +478,7 @@ TENCENT_COS_SECRET_KEY=your-secret-key
 TENCENT_COS_SECRET_ID=your-secret-id
 TENCENT_COS_REGION=your-region
 TENCENT_COS_SCHEME=your-scheme
+TENCENT_COS_CUSTOM_DOMAIN=your-custom-domain

 # Oracle Storage Configuration
 #
@@ -419,6 +494,7 @@ HUAWEI_OBS_BUCKET_NAME=your-bucket-name
 HUAWEI_OBS_SECRET_KEY=your-secret-key
 HUAWEI_OBS_ACCESS_KEY=your-access-key
 HUAWEI_OBS_SERVER=your-server-url
+HUAWEI_OBS_PATH_STYLE=false

 # Volcengine TOS Configuration
 #
@@ -446,7 +522,7 @@ SUPABASE_URL=your-server-url
 # ------------------------------

 # The type of vector store to use.
-# Supported values are `weaviate`, `qdrant`, `milvus`, `myscale`, `relyt`, `pgvector`, `pgvecto-rs`, `chroma`, `opensearch`, `oracle`, `tencent`, `elasticsearch`, `elasticsearch-ja`, `analyticdb`, `couchbase`, `vikingdb`, `oceanbase`, `opengauss`, `tablestore`,`vastbase`,`tidb`,`tidb_on_qdrant`,`baidu`,`lindorm`,`huawei_cloud`,`upstash`, `matrixone`, `clickzetta`.
+# Supported values are `weaviate`, `oceanbase`, `qdrant`, `milvus`, `myscale`, `relyt`, `pgvector`, `pgvecto-rs`, `chroma`, `opensearch`, `oracle`, `tencent`, `elasticsearch`, `elasticsearch-ja`, `analyticdb`, `couchbase`, `vikingdb`, `opengauss`, `tablestore`,`vastbase`,`tidb`,`tidb_on_qdrant`,`baidu`,`lindorm`,`huawei_cloud`,`upstash`, `matrixone`, `clickzetta`, `alibabacloud_mysql`, `iris`.
 VECTOR_STORE=weaviate
 # Prefix used to create collection name in vector database
 VECTOR_INDEX_NAME_PREFIX=Vector_index
@@ -454,6 +530,25 @@ VECTOR_INDEX_NAME_PREFIX=Vector_index
 # The Weaviate endpoint URL. Only available when VECTOR_STORE is `weaviate`.
 WEAVIATE_ENDPOINT=http://weaviate:8080
 WEAVIATE_API_KEY=WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih
+WEAVIATE_GRPC_ENDPOINT=grpc://weaviate:50051
+WEAVIATE_TOKENIZATION=word
+
+# For OceanBase metadata database configuration, available when `DB_TYPE` is `mysql` and `COMPOSE_PROFILES` includes `oceanbase`.
+# For OceanBase vector database configuration, available when `VECTOR_STORE` is `oceanbase`
+# If you want to use OceanBase as both vector database and metadata database, you need to set `DB_TYPE` to `mysql`, `COMPOSE_PROFILES` is `oceanbase`, and set Database Configuration is the same as the vector database.
+# seekdb is the lite version of OceanBase and shares the connection configuration with OceanBase.
+OCEANBASE_VECTOR_HOST=oceanbase
+OCEANBASE_VECTOR_PORT=2881
+OCEANBASE_VECTOR_USER=root@test
+OCEANBASE_VECTOR_PASSWORD=difyai123456
+OCEANBASE_VECTOR_DATABASE=test
+OCEANBASE_CLUSTER_NAME=difyai
+OCEANBASE_MEMORY_LIMIT=6G
+OCEANBASE_ENABLE_HYBRID_SEARCH=false
+# For OceanBase vector database, built-in fulltext parsers are `ngram`, `beng`, `space`, `ngram2`, `ik`
+# For OceanBase vector database, external fulltext parsers (require plugin installation) are `japanese_ftparser`, `thai_ftparser`
+OCEANBASE_FULLTEXT_PARSER=ik
+SEEKDB_MEMORY_LIMIT=2G

 # The Qdrant endpoint URL. Only available when VECTOR_STORE is `qdrant`.
 QDRANT_URL=http://qdrant:6333
@@ -577,6 +672,15 @@ ORACLE_WALLET_LOCATION=/app/api/storage/wallet
 ORACLE_WALLET_PASSWORD=dify
 ORACLE_IS_AUTONOMOUS=false

+# AlibabaCloud MySQL configuration, only available when VECTOR_STORE is `alibabcloud_mysql`
+ALIBABACLOUD_MYSQL_HOST=127.0.0.1
+ALIBABACLOUD_MYSQL_PORT=3306
+ALIBABACLOUD_MYSQL_USER=root
+ALIBABACLOUD_MYSQL_PASSWORD=difyai123456
+ALIBABACLOUD_MYSQL_DATABASE=dify
+ALIBABACLOUD_MYSQL_MAX_CONNECTION=5
+ALIBABACLOUD_MYSQL_HNSW_M=6
+
 # relyt configurations, only available when VECTOR_STORE is `relyt`
 RELYT_HOST=db
 RELYT_PORT=5432
@@ -632,6 +736,8 @@ BAIDU_VECTOR_DB_API_KEY=dify
 BAIDU_VECTOR_DB_DATABASE=dify
 BAIDU_VECTOR_DB_SHARD=1
 BAIDU_VECTOR_DB_REPLICAS=3
+BAIDU_VECTOR_DB_INVERTED_INDEX_ANALYZER=DEFAULT_ANALYZER
+BAIDU_VECTOR_DB_INVERTED_INDEX_PARSER_MODE=COARSE_MODE

 # VikingDB configurations, only available when VECTOR_STORE is `vikingdb`
 VIKINGDB_ACCESS_KEY=your-ak
@@ -643,21 +749,12 @@ VIKINGDB_CONNECTION_TIMEOUT=30
 VIKINGDB_SOCKET_TIMEOUT=30

 # Lindorm configuration, only available when VECTOR_STORE is `lindorm`
-LINDORM_URL=http://lindorm:30070
-LINDORM_USERNAME=lindorm
-LINDORM_PASSWORD=lindorm
+LINDORM_URL=http://localhost:30070
+LINDORM_USERNAME=admin
+LINDORM_PASSWORD=admin
+LINDORM_USING_UGC=True
 LINDORM_QUERY_TIMEOUT=1

-# OceanBase Vector configuration, only available when VECTOR_STORE is `oceanbase`
-OCEANBASE_VECTOR_HOST=oceanbase
-OCEANBASE_VECTOR_PORT=2881
-OCEANBASE_VECTOR_USER=root@test
-OCEANBASE_VECTOR_PASSWORD=difyai123456
-OCEANBASE_VECTOR_DATABASE=test
-OCEANBASE_CLUSTER_NAME=difyai
-OCEANBASE_MEMORY_LIMIT=6G
-OCEANBASE_ENABLE_HYBRID_SEARCH=false
-
 # opengauss configurations, only available when VECTOR_STORE is `opengauss`
 OPENGAUSS_HOST=opengauss
 OPENGAUSS_PORT=6600
@@ -699,6 +796,21 @@ CLICKZETTA_ANALYZER_TYPE=chinese
 CLICKZETTA_ANALYZER_MODE=smart
 CLICKZETTA_VECTOR_DISTANCE_FUNCTION=cosine_distance

+# InterSystems IRIS configuration, only available when VECTOR_STORE is `iris`
+IRIS_HOST=iris
+IRIS_SUPER_SERVER_PORT=1972
+IRIS_WEB_SERVER_PORT=52773
+IRIS_USER=_SYSTEM
+IRIS_PASSWORD=Dify@1234
+IRIS_DATABASE=USER
+IRIS_SCHEMA=dify
+IRIS_CONNECTION_URL=
+IRIS_MIN_CONNECTION=1
+IRIS_MAX_CONNECTION=3
+IRIS_TEXT_INDEX=true
+IRIS_TEXT_INDEX_LANGUAGE=en
+IRIS_TIMEZONE=UTC
+
 # ------------------------------
 # Knowledge Configuration
 # ------------------------------
@@ -709,6 +821,25 @@ UPLOAD_FILE_SIZE_LIMIT=15
 # The maximum number of files that can be uploaded at a time, default 5.
 UPLOAD_FILE_BATCH_LIMIT=5

+# Comma-separated list of file extensions blocked from upload for security reasons.
+# Extensions should be lowercase without dots (e.g., exe,bat,sh,dll).
+# Empty by default to allow all file types.
+# Recommended: exe,bat,cmd,com,scr,vbs,ps1,msi,dll
+UPLOAD_FILE_EXTENSION_BLACKLIST=
+
+# Maximum number of files allowed in a single chunk attachment, default 10.
+SINGLE_CHUNK_ATTACHMENT_LIMIT=10
+
+# Maximum number of files allowed in a image batch upload operation
+IMAGE_FILE_BATCH_LIMIT=10
+
+# Maximum allowed image file size for attachments in megabytes, default 2.
+ATTACHMENT_IMAGE_FILE_SIZE_LIMIT=2
+
+# Timeout for downloading image attachments in seconds, default 60.
+ATTACHMENT_IMAGE_DOWNLOAD_TIMEOUT=60
+
+
 # ETL type, support: `dify`, `Unstructured`
 # `dify` Dify's proprietary file extraction scheme
 # `Unstructured` Unstructured.io file extraction scheme
@@ -843,33 +974,47 @@ INVITE_EXPIRY_HOURS=72

 # Reset password token valid time (minutes),
 RESET_PASSWORD_TOKEN_EXPIRY_MINUTES=5
+EMAIL_REGISTER_TOKEN_EXPIRY_MINUTES=5
 CHANGE_EMAIL_TOKEN_EXPIRY_MINUTES=5
 OWNER_TRANSFER_TOKEN_EXPIRY_MINUTES=5

 # The sandbox service endpoint.
 CODE_EXECUTION_ENDPOINT=http://sandbox:8194
 CODE_EXECUTION_API_KEY=dify-sandbox
+CODE_EXECUTION_SSL_VERIFY=True
+CODE_EXECUTION_POOL_MAX_CONNECTIONS=100
+CODE_EXECUTION_POOL_MAX_KEEPALIVE_CONNECTIONS=20
+CODE_EXECUTION_POOL_KEEPALIVE_EXPIRY=5.0
 CODE_MAX_NUMBER=9223372036854775807
 CODE_MIN_NUMBER=-9223372036854775808
 CODE_MAX_DEPTH=5
 CODE_MAX_PRECISION=20
-CODE_MAX_STRING_LENGTH=80000
+CODE_MAX_STRING_LENGTH=400000
 CODE_MAX_STRING_ARRAY_LENGTH=30
 CODE_MAX_OBJECT_ARRAY_LENGTH=30
 CODE_MAX_NUMBER_ARRAY_LENGTH=1000
 CODE_EXECUTION_CONNECT_TIMEOUT=10
 CODE_EXECUTION_READ_TIMEOUT=60
 CODE_EXECUTION_WRITE_TIMEOUT=10
-TEMPLATE_TRANSFORM_MAX_LENGTH=80000
+TEMPLATE_TRANSFORM_MAX_LENGTH=400000

 # Workflow runtime configuration
 WORKFLOW_MAX_EXECUTION_STEPS=500
 WORKFLOW_MAX_EXECUTION_TIME=1200
 WORKFLOW_CALL_MAX_DEPTH=5
 MAX_VARIABLE_SIZE=204800
-WORKFLOW_PARALLEL_DEPTH_LIMIT=3
 WORKFLOW_FILE_UPLOAD_LIMIT=10

+# GraphEngine Worker Pool Configuration
+# Minimum number of workers per GraphEngine instance (default: 1)
+GRAPH_ENGINE_MIN_WORKERS=1
+# Maximum number of workers per GraphEngine instance (default: 10)
+GRAPH_ENGINE_MAX_WORKERS=10
+# Queue depth threshold that triggers worker scale up (default: 3)
+GRAPH_ENGINE_SCALE_UP_THRESHOLD=3
+# Seconds of idle time before scaling down workers (default: 5.0)
+GRAPH_ENGINE_SCALE_DOWN_IDLE_TIME=5.0
+
 # Workflow storage configuration
 # Options: rdbms, hybrid
 # rdbms: Use only the relational database (default)
@@ -903,11 +1048,49 @@ WORKFLOW_LOG_RETENTION_DAYS=30
 # Batch size for workflow log cleanup operations (default: 100)
 WORKFLOW_LOG_CLEANUP_BATCH_SIZE=100

+# Aliyun SLS Logstore Configuration
+# Aliyun Access Key ID
+ALIYUN_SLS_ACCESS_KEY_ID=
+# Aliyun Access Key Secret
+ALIYUN_SLS_ACCESS_KEY_SECRET=
+# Aliyun SLS Endpoint (e.g., cn-hangzhou.log.aliyuncs.com)
+ALIYUN_SLS_ENDPOINT=
+# Aliyun SLS Region (e.g., cn-hangzhou)
+ALIYUN_SLS_REGION=
+# Aliyun SLS Project Name
+ALIYUN_SLS_PROJECT_NAME=
+# Number of days to retain workflow run logs (default: 365 days， 3650 for permanent storage)
+ALIYUN_SLS_LOGSTORE_TTL=365
+# Enable dual-write to both SLS LogStore and SQL database (default: false)
+LOGSTORE_DUAL_WRITE_ENABLED=false
+# Enable dual-read fallback to SQL database when LogStore returns no results (default: true)
+# Useful for migration scenarios where historical data exists only in SQL database
+LOGSTORE_DUAL_READ_ENABLED=true
+
 # HTTP request node in workflow configuration
 HTTP_REQUEST_NODE_MAX_BINARY_SIZE=10485760
 HTTP_REQUEST_NODE_MAX_TEXT_SIZE=1048576
 HTTP_REQUEST_NODE_SSL_VERIFY=True

+# HTTP request node timeout configuration
+# Maximum timeout values (in seconds) that users can set in HTTP request nodes
+# - Connect timeout: Time to wait for establishing connection (default: 10s)
+# - Read timeout: Time to wait for receiving response data (default: 600s, 10 minutes)
+# - Write timeout: Time to wait for sending request data (default: 600s, 10 minutes)
+HTTP_REQUEST_MAX_CONNECT_TIMEOUT=10
+HTTP_REQUEST_MAX_READ_TIMEOUT=600
+HTTP_REQUEST_MAX_WRITE_TIMEOUT=600
+
+# Base64 encoded CA certificate data for custom certificate verification (PEM format, optional)
+# HTTP_REQUEST_NODE_SSL_CERT_DATA=LS0tLS1CRUdJTi...
+# Base64 encoded client certificate data for mutual TLS authentication (PEM format, optional)
+# HTTP_REQUEST_NODE_SSL_CLIENT_CERT_DATA=LS0tLS1CRUdJTi...
+# Base64 encoded client private key data for mutual TLS authentication (PEM format, optional)
+# HTTP_REQUEST_NODE_SSL_CLIENT_KEY_DATA=LS0tLS1CRUdJTi...
+
+# Webhook request configuration
+WEBHOOK_REQUEST_BODY_MAX_SIZE=10485760
+
 # Respect X-* headers to redirect clients
 RESPECT_XFORWARD_HEADERS_ENABLED=false

@@ -942,18 +1125,14 @@ ALLOW_UNSAFE_DATA_SCHEME=false
 MAX_TREE_DEPTH=50

 # ------------------------------
-# Environment Variables for db Service
+# Environment Variables for database Service
 # ------------------------------
-
-# The name of the default postgres user.
-POSTGRES_USER=${DB_USERNAME}
-# The password for the default postgres user.
-POSTGRES_PASSWORD=${DB_PASSWORD}
-# The name of the default postgres database.
-POSTGRES_DB=${DB_DATABASE}
-# postgres data directory
+# Postgres data directory
 PGDATA=/var/lib/postgresql/data/pgdata

+# MySQL Default Configuration
+MYSQL_HOST_VOLUME=./volumes/mysql/data
+
 # ------------------------------
 # Environment Variables for sandbox Service
 # ------------------------------
@@ -987,6 +1166,10 @@ WEAVIATE_AUTHENTICATION_APIKEY_ALLOWED_KEYS=WVF5YThaHlkYwhGUSmCRgsX3tD5ngdN8pkih
 WEAVIATE_AUTHENTICATION_APIKEY_USERS=hello@dify.ai
 WEAVIATE_AUTHORIZATION_ADMINLIST_ENABLED=true
 WEAVIATE_AUTHORIZATION_ADMINLIST_USERS=hello@dify.ai
+WEAVIATE_DISABLE_TELEMETRY=false
+WEAVIATE_ENABLE_TOKENIZER_GSE=false
+WEAVIATE_ENABLE_TOKENIZER_KAGOME_JA=false
+WEAVIATE_ENABLE_TOKENIZER_KAGOME_KR=false

 # ------------------------------
 # Environment Variables for Chroma
@@ -1069,7 +1252,7 @@ NGINX_SSL_PORT=443
 # and modify the env vars below accordingly.
 NGINX_SSL_CERT_FILENAME=dify.crt
 NGINX_SSL_CERT_KEY_FILENAME=dify.key
-NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3
+NGINX_SSL_PROTOCOLS=TLSv1.2 TLSv1.3

 # Nginx performance tuning
 NGINX_WORKER_PROCESSES=auto
@@ -1108,14 +1291,17 @@ SSRF_DEFAULT_TIME_OUT=5
 SSRF_DEFAULT_CONNECT_TIME_OUT=5
 SSRF_DEFAULT_READ_TIME_OUT=5
 SSRF_DEFAULT_WRITE_TIME_OUT=5
+SSRF_POOL_MAX_CONNECTIONS=100
+SSRF_POOL_MAX_KEEPALIVE_CONNECTIONS=20
+SSRF_POOL_KEEPALIVE_EXPIRY=5.0

 # ------------------------------
-# docker env var for specifying vector db type at startup
-# (based on the vector db type, the corresponding docker
+# docker env var for specifying vector db and metadata db type at startup
+# (based on the vector db and metadata db type, the corresponding docker
 # compose profile will be used)
 # if you want to use unstructured, add ',unstructured' to the end
 # ------------------------------
-COMPOSE_PROFILES=${VECTOR_STORE:-weaviate}
+COMPOSE_PROFILES=${VECTOR_STORE:-weaviate},${DB_TYPE:-postgresql}

 # ------------------------------
 # Docker Compose Service Expose Host Port Configurations
@@ -1181,12 +1367,16 @@ MARKETPLACE_ENABLED=true
 MARKETPLACE_API_URL=https://marketplace.dify.ai

 FORCE_VERIFYING_SIGNATURE=true
+ENFORCE_LANGGENIUS_PLUGIN_SIGNATURES=true

 PLUGIN_STDIO_BUFFER_SIZE=1024
 PLUGIN_STDIO_MAX_BUFFER_SIZE=5242880

 PLUGIN_PYTHON_ENV_INIT_TIMEOUT=120
+# Plugin Daemon side timeout (configure to match the API side below) 
 PLUGIN_MAX_EXECUTION_TIMEOUT=600
+# API side timeout (configure to match the Plugin Daemon side above) 
+PLUGIN_DAEMON_TIMEOUT=600.0
 # PIP_MIRROR_URL=https://pypi.tuna.tsinghua.edu.cn/simple
 PIP_MIRROR_URL=

@@ -1257,9 +1447,16 @@ QUEUE_MONITOR_ALERT_EMAILS=
 QUEUE_MONITOR_INTERVAL=30

 # Swagger UI configuration
-SWAGGER_UI_ENABLED=true
+SWAGGER_UI_ENABLED=false
 SWAGGER_UI_PATH=/swagger-ui.html

+# Whether to encrypt dataset IDs when exporting DSL files (default: true)
+# Set to false to export dataset IDs as plain text for easier cross-environment import
+DSL_EXPORT_ENCRYPT_DATASET_ID=true
+
+# Maximum number of segments for dataset segments API (0 for unlimited)
+DATASET_MAX_SEGMENTS_PER_REQUEST=0
+
 # Celery schedule tasks configuration
 ENABLE_CLEAN_EMBEDDING_CACHE_TASK=false
 ENABLE_CLEAN_UNUSED_DATASETS_TASK=false
@@ -1269,3 +1466,29 @@ ENABLE_CLEAN_MESSAGES=false
 ENABLE_MAIL_CLEAN_DOCUMENT_NOTIFY_TASK=false
 ENABLE_DATASETS_QUEUE_MONITOR=false
 ENABLE_CHECK_UPGRADABLE_PLUGIN_TASK=true
+ENABLE_WORKFLOW_SCHEDULE_POLLER_TASK=true
+WORKFLOW_SCHEDULE_POLLER_INTERVAL=1
+WORKFLOW_SCHEDULE_POLLER_BATCH_SIZE=100
+WORKFLOW_SCHEDULE_MAX_DISPATCH_PER_TICK=0
+
+# Tenant isolated task queue configuration
+TENANT_ISOLATED_TASK_CONCURRENCY=1
+
+# Maximum allowed CSV file size for annotation import in megabytes
+ANNOTATION_IMPORT_FILE_SIZE_LIMIT=2
+#Maximum number of annotation records allowed in a single import
+ANNOTATION_IMPORT_MAX_RECORDS=10000
+# Minimum number of annotation records required in a single import
+ANNOTATION_IMPORT_MIN_RECORDS=1
+ANNOTATION_IMPORT_RATE_LIMIT_PER_MINUTE=5
+ANNOTATION_IMPORT_RATE_LIMIT_PER_HOUR=20
+# Maximum number of concurrent annotation import tasks per tenant
+ANNOTATION_IMPORT_MAX_CONCURRENT=5
+
+# The API key of amplitude
+AMPLITUDE_API_KEY=
+
+# Sandbox expired records clean configuration
+SANDBOX_EXPIRED_RECORDS_CLEAN_GRACEFUL_PERIOD=21
+SANDBOX_EXPIRED_RECORDS_CLEAN_BATCH_SIZE=1000
+SANDBOX_EXPIRED_RECORDS_RETENTION_DAYS=30