mirror of
https://github.com/langgenius/dify.git
synced 2026-11-12 06:11:12 +08:00
Yunlu WenandDevin
8fb0e23773
Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
136 lines
8.1 KiB
Plaintext
136 lines
8.1 KiB
Plaintext
# Defaults for agent_backend. Copy this file to dify-agent.env to customize it.
|
|
# Edit the settings below in the copy; docker/.env takes precedence.
|
|
# Optional application settings are commented to retain their application defaults.
|
|
|
|
# AGENT_BACKEND_BASE_URL=http://agent_backend:5050
|
|
# Set this in docker/.env to share the same control-plane token with API and workers.
|
|
# Replace the development default in production.
|
|
# Generate one with: python -c 'import secrets; print(secrets.token_urlsafe(32))'
|
|
DIFY_AGENT_API_TOKEN=${DIFY_AGENT_API_TOKEN:-dify-agent-run-token-for-dev-only}
|
|
|
|
# Leave empty to derive from REDIS_PASSWORD in Docker Compose.
|
|
DIFY_AGENT_REDIS_URL=${DIFY_AGENT_REDIS_URL:-redis://:${REDIS_PASSWORD:-difyai123456}@redis:6379/2}
|
|
# DIFY_AGENT_REDIS_PREFIX=dify-agent
|
|
# DIFY_AGENT_SHUTDOWN_GRACE_SECONDS=30
|
|
# DIFY_AGENT_RUN_RETENTION_SECONDS=7200
|
|
# DIFY_AGENT_RUN_EVENT_STREAM_MAX_LENGTH=5000
|
|
# DIFY_AGENT_STREAM_TEXT_DELTA_COALESCING_ENABLED=true
|
|
# DIFY_AGENT_STREAM_TEXT_DELTA_FLUSH_INTERVAL_MS=100
|
|
# DIFY_AGENT_STREAM_TEXT_DELTA_MAX_CHARS=4096
|
|
# Internal deadline for the Agent Backend model/tool loop. The effective run
|
|
# limit is whichever expires first: this value or the relevant API/Workflow
|
|
# outer execution limit. To allow every path to run for one hour, also set
|
|
# APP_MAX_EXECUTION_TIME and WORKFLOW_MAX_EXECUTION_TIME to at least 3600.
|
|
# DIFY_AGENT_RUN_TIMEOUT_SECONDS=3600
|
|
# DIFY_AGENT_BINDING_FILE_DOWNLOAD_COMMAND_TIMEOUT_SECONDS=210
|
|
|
|
# Shared outbound HTTP client timeouts and connection limits.
|
|
# DIFY_AGENT_OUTBOUND_HTTP_CONNECT_TIMEOUT=10
|
|
# DIFY_AGENT_OUTBOUND_HTTP_READ_TIMEOUT=600
|
|
# DIFY_AGENT_OUTBOUND_HTTP_WRITE_TIMEOUT=30
|
|
# DIFY_AGENT_OUTBOUND_HTTP_POOL_TIMEOUT=10
|
|
# DIFY_AGENT_OUTBOUND_HTTP_MAX_CONNECTIONS=100
|
|
# DIFY_AGENT_OUTBOUND_HTTP_MAX_KEEPALIVE_CONNECTIONS=20
|
|
# DIFY_AGENT_OUTBOUND_HTTP_KEEPALIVE_EXPIRY=30
|
|
|
|
# DIFY_AGENT_TRAJECTORY_ENABLED=false
|
|
# Collect API-issued application traces into the Dify inner API inbox.
|
|
# DIFY_AGENT_APPLICATION_TRACING_ENABLED=false
|
|
# DIFY_AGENT_TRAJECTORY_OTLP_TRACES_ENDPOINT=
|
|
# DIFY_AGENT_TRAJECTORY_OTLP_HEADERS={}
|
|
# DIFY_AGENT_TRAJECTORY_SERVICE_NAME=dify-agent-trajectory
|
|
# DIFY_AGENT_TRAJECTORY_INCLUDE_CONTENT=false
|
|
# DIFY_AGENT_TRAJECTORY_TRACE_CONTEXT_MODE=isolated
|
|
# DIFY_AGENT_TRAJECTORY_MAX_QUEUE_SIZE=2048
|
|
# DIFY_AGENT_TRAJECTORY_MAX_EXPORT_BATCH_SIZE=512
|
|
# DIFY_AGENT_TRAJECTORY_SCHEDULE_DELAY_MS=5000
|
|
# DIFY_AGENT_TRAJECTORY_EXPORT_TIMEOUT_MS=5000
|
|
|
|
# LOGFIRE_CONSOLE=false
|
|
|
|
# Leave empty to derive from PLUGIN_DAEMON_URL and PLUGIN_DAEMON_KEY in Docker Compose.
|
|
# Set PLUGIN_DAEMON_KEY in docker/.env when using the bundled daemon; keep the key expression below unchanged.
|
|
DIFY_AGENT_PLUGIN_DAEMON_URL=${DIFY_AGENT_PLUGIN_DAEMON_URL:-${PLUGIN_DAEMON_URL:-http://plugin_daemon:5002}}
|
|
DIFY_AGENT_PLUGIN_DAEMON_API_KEY=${DIFY_AGENT_PLUGIN_DAEMON_API_KEY:-${PLUGIN_DAEMON_KEY:-lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi}}
|
|
|
|
# Leave empty to derive from PLUGIN_DIFY_INNER_API_URL and PLUGIN_DIFY_INNER_API_KEY in Docker Compose.
|
|
# DIFY_AGENT_INNER_API_KEY must match API/worker INNER_API_KEY_FOR_PLUGIN, not INNER_API_KEY.
|
|
# Set PLUGIN_DIFY_INNER_API_KEY in docker/.env; keep the key expression below unchanged for the bundled API.
|
|
DIFY_AGENT_INNER_API_URL=${DIFY_AGENT_INNER_API_URL:-${PLUGIN_DIFY_INNER_API_URL:-http://api:5001}}
|
|
DIFY_AGENT_INNER_API_KEY=${DIFY_AGENT_INNER_API_KEY:-${PLUGIN_DIFY_INNER_API_KEY:-QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1}}
|
|
|
|
# Select exactly one coherent Home Snapshot + Sandbox backend.
|
|
DIFY_AGENT_RUNTIME_BACKEND=${DIFY_AGENT_RUNTIME_BACKEND:-local}
|
|
DIFY_AGENT_LOCAL_SANDBOX_ENDPOINT=${DIFY_AGENT_LOCAL_SANDBOX_ENDPOINT:-${DIFY_AGENT_SHELLCTL_ENTRYPOINT:-http://local_sandbox:5004}}
|
|
# Set DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN only in docker/.env; Compose supplies it to both services.
|
|
# E2B_API_KEY and E2B_API_TOKEN remain accepted as deployment-level fallbacks.
|
|
DIFY_AGENT_E2B_API_KEY=${DIFY_AGENT_E2B_API_KEY:-${E2B_API_KEY:-${E2B_API_TOKEN:-}}}
|
|
DIFY_AGENT_E2B_TEMPLATE=${DIFY_AGENT_E2B_TEMPLATE:-difys-default-team/dify-agent-local-sandbox}
|
|
# RuntimeLease active limit; its default matches the independently configurable Agent run deadline.
|
|
# DIFY_AGENT_E2B_ACTIVE_TIMEOUT_SECONDS=3600
|
|
# DIFY_AGENT_E2B_SHELLCTL_PORT=5004
|
|
|
|
# Independent sandbox usage ledger. API owns fixed activation time T0; no backfill.
|
|
# Enable only with matching API metering project settings and events API access.
|
|
# Celery Beat in the API triggers a protected one-shot collection endpoint.
|
|
# No operation logging, Agent polling loop, or collector Redis leader.
|
|
# Collection requires the existing DIFY_AGENT_API_TOKEN to be configured.
|
|
# DIFY_AGENT_SANDBOX_METERING_ENABLED=false
|
|
# DIFY_AGENT_E2B_PROJECT_ID=
|
|
# DIFY_AGENT_SANDBOX_METERING_OVERLAP_SECONDS=900
|
|
# DIFY_AGENT_SANDBOX_METERING_FULL_SCAN_INTERVAL_SECONDS=3600
|
|
# DIFY_AGENT_SANDBOX_METERING_MAX_PAGES=1000
|
|
|
|
# OpenShell backend (DIFY_AGENT_RUNTIME_BACKEND=openshell): sandboxes run on a
|
|
# self-hosted NVIDIA OpenShell gateway. Setup and validation:
|
|
# dify-agent/docs/dify-agent/guide/openshell.md
|
|
# gRPC endpoint as host:port (no scheme), e.g. localhost:17670.
|
|
# Requires an OpenShell gateway >= 0.1.3; upgrade the gateway and the bundled
|
|
# openshell SDK together.
|
|
# DIFY_AGENT_OPENSHELL_GATEWAY_ENDPOINT=
|
|
# DIFY_AGENT_OPENSHELL_WORKSPACE=default
|
|
# Auth: an OIDC bearer token, or mTLS bundle paths mounted into agent_backend.
|
|
# DIFY_AGENT_OPENSHELL_BEARER_TOKEN=
|
|
# DIFY_AGENT_OPENSHELL_TLS_CA_PATH=
|
|
# DIFY_AGENT_OPENSHELL_TLS_CLIENT_CERT_PATH=
|
|
# DIFY_AGENT_OPENSHELL_TLS_CLIENT_KEY_PATH=
|
|
# Set true only for plaintext local-dev gateways.
|
|
# DIFY_AGENT_OPENSHELL_INSECURE=false
|
|
# Required: build the runtime image yourself from this checkout; do not rely on a published latest tag.
|
|
# From the repository root (the directory containing dify-agent-runtime/):
|
|
# docker build -f dify-agent-runtime/docker/Dockerfile -t dify-agent-runtime:latest dify-agent-runtime
|
|
# The image must include shellctl and iproute2. This value must match the built image tag.
|
|
# Build into the gateway's Docker daemon, or push to a registry it can pull from and use that image reference.
|
|
# DIFY_AGENT_OPENSHELL_SANDBOX_IMAGE=docker.io/library/dify-agent-runtime:latest
|
|
# Optional JSON driver_config as a driver-keyed envelope (e.g.
|
|
# {"docker":{"mounts":[...]}}) for driver-specific mounts/options; empty
|
|
# sends no driver config. Home Snapshots are unsupported on this backend —
|
|
# new Bindings are always materialized image-fresh.
|
|
# DIFY_AGENT_OPENSHELL_DRIVER_CONFIG=
|
|
# Optional comma-separated host:port egress allowlist (no scheme or path).
|
|
# Empty sends no network policy (gateway/driver default egress); when set,
|
|
# sandbox egress is enforced to exactly these endpoints — include the Agent
|
|
# Stub and files endpoints, e.g. agent.example.com:443,dify.example.com:443.
|
|
# DIFY_AGENT_OPENSHELL_EGRESS_ALLOW=
|
|
# Required. shellctl path isolation stays off (sandbox Landlock is authoritative).
|
|
# Sent as the Authorization bearer through the gateway's bearer-passthrough
|
|
# service endpoint; the gateway credential stays on the gRPC control plane.
|
|
# DIFY_AGENT_OPENSHELL_SHELLCTL_AUTH_TOKEN=
|
|
# DIFY_AGENT_OPENSHELL_SHELLCTL_PORT=5004
|
|
# DIFY_AGENT_OPENSHELL_READY_TIMEOUT_SECONDS=300
|
|
# DIFY_AGENT_OPENSHELL_EXEC_TIMEOUT_SECONDS=120
|
|
# Sandbox-reachable Dify API base for signed /files/* transfers.
|
|
DIFY_AGENT_SANDBOX_FILES_BASE_URL=${DIFY_AGENT_SANDBOX_FILES_BASE_URL:-http://api:5001}
|
|
# Maximum Agent Stub upload size in MiB; forwarded to Dify API as a signed byte limit.
|
|
# DIFY_AGENT_STUB_UPLOAD_FILE_SIZE_LIMIT=50
|
|
DIFY_AGENT_STUB_API_BASE_URL=${DIFY_AGENT_STUB_API_BASE_URL:-http://agent_backend:5050/agent-stub}
|
|
# This is security-sensitive: it derives the JWE encryption key for Agent Stub bearer tokens.
|
|
# Replace this development default in production.
|
|
# Generate one with: python -c 'import secrets; print(secrets.token_urlsafe(32))'
|
|
DIFY_AGENT_SERVER_SECRET_KEY=${DIFY_AGENT_SERVER_SECRET_KEY:-MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY}
|
|
|
|
# JSON array of regex patterns to redact from shell output shown to the agent.
|
|
# The JWE token value is always redacted regardless of this setting.
|
|
# Example: DIFY_AGENT_SHELL_REDACT_PATTERNS=["sk-[A-Za-z0-9]+","ghp_[A-Za-z0-9]{36}"]
|
|
# DIFY_AGENT_SHELL_REDACT_PATTERNS=
|