.env.example

SERVER_HOST=0.0.0.0
SERVER_PORT=5002
SERVER_KEY=lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi
# default server tz UTC
SERVER_TZ=
GIN_MODE=release
PLATFORM=local

DIFY_INNER_API_KEY="QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1"
DIFY_INNER_API_URL=http://127.0.0.1:5001

PLUGIN_REMOTE_INSTALLING_ENABLED=true
PLUGIN_REMOTE_INSTALLING_HOST=127.0.0.1
PLUGIN_REMOTE_INSTALLING_PORT=5003

# s3 credentials
S3_USE_AWS=true
S3_USE_AWS_MANAGED_IAM=false
S3_ENDPOINT=
S3_USE_PATH_STYLE=true
AWS_ACCESS_KEY=
AWS_SECRET_KEY=
AWS_REGION=

# tencent cos credentials
TENCENT_COS_SECRET_KEY=
TENCENT_COS_SECRET_ID=
TENCENT_COS_REGION=

# aliyun oss credentials
ALIYUN_OSS_REGION=
ALIYUN_OSS_ENDPOINT=
ALIYUN_OSS_ACCESS_KEY_ID=
ALIYUN_OSS_ACCESS_KEY_SECRET=
ALIYUN_OSS_AUTH_VERSION=v4
ALIYUN_OSS_PATH=
ALIYUN_OSS_CLOUDBOX_ID=

# azure blob storage credentials
AZURE_BLOB_STORAGE_CONTAINER_NAME=
AZURE_BLOB_STORAGE_CONNECTION_STRING=

# volcengine tos
VOLCENGINE_TOS_ENDPOINT=
VOLCENGINE_TOS_ACCESS_KEY=
VOLCENGINE_TOS_SECRET_KEY=
VOLCENGINE_TOS_REGION=

# gcs storage credentials base64 string
GCS_CREDENTIALS=

# huawei obs credentials
HUAWEI_OBS_ACCESS_KEY=
HUAWEI_OBS_SECRET_KEY=
HUAWEI_OBS_SERVER=
HUAWEI_OBS_PATH_STYLE=false

# baidu bos credentials
BAIDU_BOS_ENDPOINT=
BAIDU_BOS_ACCESS_KEY=
BAIDU_BOS_SECRET_KEY=
BAIDU_BOS_REGION=

# services storage
# https://github.com/langgenius/dify-cloud-kit/blob/main/oss/factory/factory.go
PLUGIN_STORAGE_TYPE=local
PLUGIN_STORAGE_OSS_BUCKET=
PLUGIN_STORAGE_LOCAL_ROOT=./storage

# where the plugin finally installed
PLUGIN_INSTALLED_PATH=plugin

# where the plugin finally running and working
PLUGIN_WORKING_PATH=cwd

PLUGIN_ASSET_CACHE_SIZE=256

# persistence storage
PERSISTENCE_STORAGE_PATH=persistence
PERSISTENCE_STORAGE_MAX_SIZE=104857600

# plugin webhook
PLUGIN_WEBHOOK_ENABLED=true

# routine pool
ROUTINE_POOL_SIZE=1024

# redis
REDIS_HOST=127.0.0.1
REDIS_PORT=6379
REDIS_PASSWORD=difyai123456
REDIS_DB=0
REDIS_USE_SSL=false
# SSL configuration for Redis (when REDIS_USE_SSL=true)
REDIS_SSL_CERT_REQS=CERT_NONE
# REDIS_SSL_CERT_REQS controls how server certificates are verified:
#   - CERT_NONE: Skips all certificate verification (insecure, sets InsecureSkipVerify=true)
#                Use only in development/testing environments. This is the default in this example file.
#   - CERT_OPTIONAL: Requires valid certificate verification (same as CERT_REQUIRED for client-side TLS)
#                    CERT_OPTIONAL is treated as CERT_REQUIRED because servers almost always present
#                    certificates, and the client's choice is whether to validate them or not
#                    Uses system's default CA certificates if REDIS_SSL_CA_CERTS is not provided
#   - CERT_REQUIRED: Requires valid certificate verification (most secure, sets InsecureSkipVerify=false)
#                    Recommended for production environments
#                    IMPORTANT: REDIS_SSL_CA_CERTS must be provided, otherwise the application will fail to start
#   - Empty string: Behaves like CERT_OPTIONAL (secure, enables verification, but allows system CA certificates)
#                   This is the default when REDIS_SSL_CERT_REQS is not set
REDIS_SSL_CA_CERTS=
# Path to the CA certificate file for SSL verification, e.g. /path/to/ca.crt
# REQUIRED when REDIS_SSL_CERT_REQS=CERT_REQUIRED
# Optional for CERT_OPTIONAL (uses system's default CA certificates if not provided)
# Ignored when REDIS_SSL_CERT_REQS=CERT_NONE

# Whether to use Redis Sentinel mode.
# If set to true, the application will automatically discover and connect to the master node through Sentinel.
REDIS_USE_SENTINEL=false

# List of Redis Sentinel nodes. If Sentinel mode is enabled, provide at least one Sentinel IP and port.
# Format: `<sentinel1_ip>:<sentinel1_port>,<sentinel2_ip>:<sentinel2_port>,<sentinel3_ip>:<sentinel3_port>`
REDIS_SENTINELS=
REDIS_SENTINEL_SERVICE_NAME=
REDIS_SENTINEL_USERNAME=
REDIS_SENTINEL_PASSWORD=
REDIS_SENTINEL_SOCKET_TIMEOUT=0.1

# Azure Managed Identity (Entra ID) for Redis authentication.
# When enabled, static REDIS_PASSWORD/REDIS_USERNAME are ignored and
# a streaming token provider is used instead. Requires REDIS_DB=0.
REDIS_USE_AZURE_MANAGED_IDENTITY=false

DB_TYPE=postgresql
DB_USERNAME=postgres
DB_PASSWORD=difyai123456
DB_HOST=localhost
DB_PORT=5432
DB_DATABASE=dify_plugin
# Specifies the SSL mode for the database connection.
# Possible values include 'disable', 'require', 'verify-ca', and 'verify-full'.
# 'disable' means SSL is not used for the connection.
DB_SSL_MODE=disable
# database connection pool settings
DB_MAX_IDLE_CONNS=10
DB_MAX_OPEN_CONNS=30
DB_CONN_MAX_LIFETIME=3600
# DB_EXTRAS in GORM format
DB_EXTRAS=
DB_CHARSET=
# The DB_GORM_LOG_LEVEL environment variable controls the logging verbosity of GORM
# with a default value of empty string. 
# Possible values are "info", "warn", "error", and "silent".
# "warn" is the default level, showing only error and warning logs
# "info" level displays SQL statements
# Refer to gorm.io/gorm/logger#LogLevel for detailed information.
DB_GORM_LOG_LEVEL=
# database connection timeout, default 5s
DB_CONNECT_TIMEOUT=5s
# database read timeout, default 30s
DB_READ_TIMEOUT=30s
# database write timeout, default 30s
DB_WRITE_TIMEOUT=30s

DIFY_INVOCATION_CONNECTION_IDLE_TIMEOUT=120

MAX_PLUGIN_PACKAGE_SIZE=52428800

# dify serverless connector
DIFY_PLUGIN_SERVERLESS_CONNECTOR_URL=http://127.0.0.1:5004
DIFY_PLUGIN_SERVERLESS_CONNECTOR_API_KEY=HeRFb6yrzAy5vUSlJWK2lUl36mpkaRycv4witbQpucXacgXg7G9a8gVL
# maximum serialized request payload sent to a serverless plugin runtime
MAX_SERVERLESS_REQUEST_BYTES=5242880
# activation preflight: wake a scaled-to-zero plugin via the connector before invoking it
DIFY_PLUGIN_SERVERLESS_CONNECTOR_ACTIVATION_ENABLED=false
# seconds to wait for the plugin to become ready during the activation preflight;
# if it is not woken up in time the invocation is treated as failed
DIFY_PLUGIN_SERVERLESS_CONNECTOR_ACTIVATION_TIMEOUT=60

# python interpreter, if you are using local runtime, you should set this path to your python interpreter path
# otherwise, it should be /usr/bin/python3
# PYTHON_INTERPRETER_PATH=/usr/bin/python3

# uv path, if you are using local runtime, you should set this path to your local uv path
# otherwise, it will use `from uv._find_uv import find_uv_bin; print(find_uv_bin())`
# UV_PATH=

# python environment init timeout, if the python environment init process is not finished within this time, it will be killed
PYTHON_ENV_INIT_TIMEOUT=120

# Optional uv package cache override. Default: $PLUGIN_WORKING_PATH/.uv-cache
# Use a container-local path on Docker/WSL bind mounts with permission errors, e.g.:
# UV_CACHE_DIR=/tmp/.uv-cache

# log settings
# LOG_OUTPUT_FORMAT: text or json
LOG_OUTPUT_FORMAT=text
LOG_FILE=

# pprof enabled, for debugging
PPROF_ENABLED=false

# OpenTelemetry
ENABLE_OTEL=false
OTLP_TRACE_ENDPOINT=
OTLP_METRIC_ENDPOINT=
OTLP_BASE_ENDPOINT=http://localhost:4318
OTEL_API_KEY=
OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
OTEL_EXPORTER_TYPE=otlp
OTEL_SAMPLING_RATE=1.0
OTEL_BATCH_EXPORT_SCHEDULE_DELAY=5000
OTEL_MAX_QUEUE_SIZE=2048
OTEL_MAX_EXPORT_BATCH_SIZE=512
OTEL_METRIC_EXPORT_INTERVAL=60000
OTEL_BATCH_EXPORT_TIMEOUT=10000
OTEL_METRIC_EXPORT_TIMEOUT=30000

# prometheus metrics enabled
PROMETHEUS_ENABLED=true

# FORCE_VERIFYING_SIGNATURE, for security, you should set this to true, pls be sure you know what you are doing
# if want to install plugin without verifying signature, set this to false
FORCE_VERIFYING_SIGNATURE=true

# Enable or disable third-party signature verification for plugins
# Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS
THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED=false
# A comma-separated list of file paths to public keys in addition to the official public key for signature verification
THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS=

# Enforce signature verification for plugins claiming Langgenius authorship
# Set to "false" to allow installation of unsigned plugins claiming to be from Langgenius (security risk)
# Community and partner plugins that don't claim Langgenius authorship are not affected
ENFORCE_LANGGENIUS_PLUGIN_SIGNATURES=true

# proxy settings, example: HTTP_PROXY=http://host.docker.internal:7890
HTTP_PROXY=
HTTPS_PROXY=

# plugin stdio buffer size(local runtime, will be deprecated in future version)
PLUGIN_STDIO_BUFFER_SIZE=1024
PLUGIN_STDIO_MAX_BUFFER_SIZE=5242880

# plugin runtime buffer size(serverless & local runtime)
PLUGIN_RUNTIME_BUFFER_SIZE=1024
PLUGIN_RUNTIME_MAX_BUFFER_SIZE=5242880

# plugin install/upgrade timeout in minutes
PLUGIN_INSTALL_TIMEOUT=15

# cache the tenant's model installation list in redis. Turn it on only where dify runs with
# PLUGIN_MODEL_PROVIDERS_CACHE_ENABLED=false, otherwise both sides hold the same payload
# and the redis footprint doubles.
PLUGIN_MODEL_INSTALLATIONS_CACHE_ENABLED=false

# how long a tenant's cached model installation list survives without an explicit invalidation, in minutes
PLUGIN_MODEL_INSTALLATIONS_CACHE_TTL=1440

# dify backwards invocation write timeout in milliseconds
DIFY_BACKWARDS_INVOCATION_WRITE_TIMEOUT=5000
# dify backwards invocation read timeout in milliseconds
DIFY_BACKWARDS_INVOCATION_READ_TIMEOUT=240000

# LLM-only reverse-call budgets, all in milliseconds. These do not alter tools,
# embeddings, storage, or other reverse calls. Zero means inherit, not unlimited.
# Total includes connection setup/headers/body and is also bounded by caller cancellation.
# Total defaults to DIFY_BACKWARDS_INVOCATION_READ_TIMEOUT.
DIFY_BACKWARDS_INVOCATION_LLM_TOTAL_TIMEOUT=0
# First decoded response frame (not first output token); defaults to the LLM total.
# Also bounds a blocking LLM call waiting for its one final response.
DIFY_BACKWARDS_INVOCATION_LLM_FIRST_RESPONSE_TIMEOUT=0
# Read-idle timer starts after the first frame and resets on received bytes/frames.
# Defaults to DIFY_BACKWARDS_INVOCATION_READ_TIMEOUT.
DIFY_BACKWARDS_INVOCATION_LLM_IDLE_TIMEOUT=0
# Example for longer LLM calls: TOTAL=600000, FIRST_RESPONSE=600000, IDLE=240000.
# Keep outer plugin/SDK/serverless execution budgets longer than the single-call budget.
PLUGIN_IGNORE_UV_LOCK=false
# auto-detect pip mirror at daemon startup by measuring latency to official PyPI and each candidate
# a candidate is selected only if it is faster than official PyPI by defined amount; if no candidate meets
# this threshold, no mirror is used
# explicit PIP_MIRROR_URL takes precedence and disables auto-detection
PIP_MIRROR_AUTO_DETECT=true
PIP_MIRROR_URL=
# timeout in seconds for each mirror probe request (default: 5; increase on high-latency networks)
PIP_MIRROR_AUTO_DETECT_TIMEOUT=5
# comma-separated list of PyPI mirror URLs to probe; overrides the built-in default candidates
# example: PIP_MIRROR_CANDIDATES=https://mirrors.aliyun.com/pypi/simple/,https://pypi.tuna.tsinghua.edu.cn/simple/
PIP_MIRROR_CANDIDATES=
PYTHON_COMPILE_ALL_EXTRA_ARGS=