# ------------------------------
# Dify Agent Backend Configuration
# ------------------------------

AGENT_BACKEND_BASE_URL=http://agent_backend:5050

# Leave empty to derive from REDIS_PASSWORD in Docker Compose.
DIFY_AGENT_REDIS_URL=
DIFY_AGENT_REDIS_PREFIX=dify-agent
DIFY_AGENT_SHUTDOWN_GRACE_SECONDS=30
DIFY_AGENT_RUN_RETENTION_SECONDS=259200

# Leave empty to derive from PLUGIN_DAEMON_URL and PLUGIN_DAEMON_KEY in Docker Compose.
DIFY_AGENT_PLUGIN_DAEMON_URL=
DIFY_AGENT_PLUGIN_DAEMON_API_KEY=

# Leave empty to derive from PLUGIN_DIFY_INNER_API_URL and PLUGIN_DIFY_INNER_API_KEY in Docker Compose.
# DIFY_AGENT_INNER_API_KEY must match API/worker INNER_API_KEY_FOR_PLUGIN, not INNER_API_KEY.
DIFY_AGENT_INNER_API_URL=
DIFY_AGENT_INNER_API_KEY=

DIFY_AGENT_SHELLCTL_ENTRYPOINT=http://local_sandbox:5004
DIFY_AGENT_SHELLCTL_AUTH_TOKEN=
DIFY_AGENT_STUB_API_BASE_URL=http://agent_backend:5050/agent-stub
# This is security-sensitive: it derives the JWE encryption key for Agent Stub bearer tokens.
# Replace this development default in production.
# Generate one with: python -c 'import secrets; print(secrets.token_urlsafe(32))'
DIFY_AGENT_SERVER_SECRET_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY

# --- Agent sandbox path isolation (Landlock) ---
# Applied by the runtime inside the local_sandbox container.
# Set SHELLCTL_ENABLE_PATH_ISOLATION=false to disable Landlock entirely (default: true).
SHELLCTL_ENABLE_PATH_ISOLATION=true
# The paths below override the built-in defaults when set (even to an empty value).
# Leave them commented out to keep the defaults; setting SHELLCTL_LANDLOCK_RO_PATHS or
# SHELLCTL_LANDLOCK_RW_DEV_PATHS to an empty string removes all default paths and can break exec.
# Comma-separated additional read-write directories (default: none beyond $HOME).
# SHELLCTL_LANDLOCK_RW_PATHS=
# Comma-separated read-only + execute directories (default: /usr,/bin,/sbin,/lib,/lib64,/etc,/proc,/opt/dify-agent-tools,/opt/homebrew,/snap).
# SHELLCTL_LANDLOCK_RO_PATHS=
# Comma-separated read-write device files (default: /dev/null,/dev/zero,/dev/urandom,/dev/random,/dev/tty).
# SHELLCTL_LANDLOCK_RW_DEV_PATHS=