mirror of
https://github.com/langgenius/dify.git
synced 2026-07-22 03:08:33 +08:00
43 lines
2.1 KiB
Plaintext
43 lines
2.1 KiB
Plaintext
# ------------------------------
|
|
# Dify Agent Backend Configuration
|
|
# ------------------------------
|
|
|
|
AGENT_BACKEND_BASE_URL=http://agent_backend:5050
|
|
|
|
# Leave empty to derive from REDIS_PASSWORD in Docker Compose.
|
|
DIFY_AGENT_REDIS_URL=
|
|
DIFY_AGENT_REDIS_PREFIX=dify-agent
|
|
DIFY_AGENT_SHUTDOWN_GRACE_SECONDS=30
|
|
DIFY_AGENT_RUN_RETENTION_SECONDS=259200
|
|
|
|
# Leave empty to derive from PLUGIN_DAEMON_URL and PLUGIN_DAEMON_KEY in Docker Compose.
|
|
DIFY_AGENT_PLUGIN_DAEMON_URL=
|
|
DIFY_AGENT_PLUGIN_DAEMON_API_KEY=
|
|
|
|
# Leave empty to derive from PLUGIN_DIFY_INNER_API_URL and PLUGIN_DIFY_INNER_API_KEY in Docker Compose.
|
|
# DIFY_AGENT_INNER_API_KEY must match API/worker INNER_API_KEY_FOR_PLUGIN, not INNER_API_KEY.
|
|
DIFY_AGENT_INNER_API_URL=
|
|
DIFY_AGENT_INNER_API_KEY=
|
|
|
|
DIFY_AGENT_SHELLCTL_ENTRYPOINT=http://local_sandbox:5004
|
|
DIFY_AGENT_SHELLCTL_AUTH_TOKEN=
|
|
DIFY_AGENT_STUB_API_BASE_URL=http://agent_backend:5050/agent-stub
|
|
# This is security-sensitive: it derives the JWE encryption key for Agent Stub bearer tokens.
|
|
# Replace this development default in production.
|
|
# Generate one with: python -c 'import secrets; print(secrets.token_urlsafe(32))'
|
|
DIFY_AGENT_SERVER_SECRET_KEY=MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY
|
|
|
|
# --- Agent sandbox path isolation (Landlock) ---
|
|
# Applied by the runtime inside the local_sandbox container.
|
|
# Set SHELLCTL_ENABLE_PATH_ISOLATION=false to disable Landlock entirely (default: true).
|
|
SHELLCTL_ENABLE_PATH_ISOLATION=true
|
|
# The paths below override the built-in defaults when set (even to an empty value).
|
|
# Leave them commented out to keep the defaults; setting SHELLCTL_LANDLOCK_RO_PATHS or
|
|
# SHELLCTL_LANDLOCK_RW_DEV_PATHS to an empty string removes all default paths and can break exec.
|
|
# Comma-separated additional read-write directories (default: none beyond $HOME).
|
|
# SHELLCTL_LANDLOCK_RW_PATHS=
|
|
# Comma-separated read-only + execute directories (default: /usr,/bin,/sbin,/lib,/lib64,/etc,/proc,/opt/dify-agent-tools,/opt/homebrew,/snap).
|
|
# SHELLCTL_LANDLOCK_RO_PATHS=
|
|
# Comma-separated read-write device files (default: /dev/null,/dev/zero,/dev/urandom,/dev/random,/dev/tty).
|
|
# SHELLCTL_LANDLOCK_RW_DEV_PATHS=
|