背景

项目A开发同学需要部署一套dify来测试某些功能

使用docker compose方式部署
从github中clone仓库，推到私有gitlab
下载其中的镜像到云上私仓
替换镜像
启动

部署

docker配置 略

# clone dify仓库
git clone --single-branch https://github.com/langgenius/dify.git
cd dify
git remote -v
git remote remove origin
# 配置远程仓库为私有镜像仓库 后期做一些二次开发
git remote add origing xxxx

取出镜像

(base) root@dev:/tmp/dify# grep -i image ./docker/docker-compose.yaml 
  UPLOAD_IMAGE_FILE_SIZE_LIMIT: ${UPLOAD_IMAGE_FILE_SIZE_LIMIT:-10}
    image: langgenius/dify-api:1.9.2
    image: langgenius/dify-api:1.9.2
    image: langgenius/dify-api:1.9.2
    image: langgenius/dify-web:1.9.2
    image: postgres:15-alpine
    image: redis:6-alpine
    image: langgenius/dify-sandbox:0.2.12
    image: langgenius/dify-plugin-daemon:0.3.3-local
    image: ubuntu/squid:latest
    image: certbot/certbot
    image: nginx:latest
    image: semitechnologies/weaviate:1.27.0
    image: langgenius/qdrant:v1.7.3
    image: pgvector/pgvector:pg16
  # get image from https://www.vastdata.com.cn/
    image: vastdata/vastbase-vector
    image: tensorchord/pgvecto-rs:pg16-v0.3.0
    image: ghcr.io/chroma-core/chroma:0.5.20
    image: oceanbase/oceanbase-ce:4.3.5-lts
    image: container-registry.oracle.com/database/free:latest
    image: quay.io/coreos/etcd:v3.5.5
    image: minio/minio:RELEASE.2023-03-20T20-16-18Z
    image: milvusdb/milvus:v2.5.15
    image: opensearchproject/opensearch:latest
    image: opensearchproject/opensearch-dashboards:latest
    image: opengauss/opengauss:7.0.0-RC1
    image: myscale/myscaledb:1.6.4
    image: matrixorigin/matrixone:2.1.1
    image: docker.elastic.co/elasticsearch/elasticsearch:8.14.3
    image: docker.elastic.co/kibana/kibana:8.14.3
    image: downloads.unstructured.io/unstructured-io/unstructured-api:latest

将这些镜像转入私仓

for i in `grep image: ./docker/docker-compose.yaml | awk -F ': ' '{print $2}'`;do docker pull $i && docker tag $i xxx/dify/$i; docker push xxx/dify/$i ;done

#!/bin/bash

# Define your repository URL
REPO_URL="x.com/xx/dify"

# Process the docker-compose.yaml to get the image names
grep image: docker-compose.yaml | uniq -c | awk -F ': ' '{print $2}' | while read image; do
    # Extract the image name after the last '/' (if any)
    image_name=$(echo $image | awk -F'/' '{print $NF}')
    
    # Tag the image with the desired repository and tag format
    docker tag $image $REPO_URL/$image_name
    docker push $image $REPO_URL/$image_name
done

cd dify/docker/
cp .env.example .env
docker compose up
docker compose ps

.env中需要配置的变量

FILES_URL=http://xxxx.com
INTERNAL_FILES_URL=http://api:5001
# ------------------------------
# Environment Variables for Nginx reverse proxy
# ------------------------------
NGINX_SERVER_NAME=xxx
NGINX_HTTPS_ENABLED=false
# HTTP port
NGINX_PORT=80
# SSL settings are only applied when HTTPS_ENABLED is true
NGINX_SSL_PORT=443
# if HTTPS_ENABLED is true, you're required to add your own SSL certificates/keys to the `./nginx/ssl` directory
# and modify the env vars below accordingly.
NGINX_SSL_CERT_FILENAME=_x
NGINX_SSL_CERT_KEY_FILENAME=_.x
NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3

# Nginx performance tuning
NGINX_WORKER_PROCESSES=auto
NGINX_CLIENT_MAX_BODY_SIZE=100M
NGINX_KEEPALIVE_TIMEOUT=65

# Proxy settings
NGINX_PROXY_READ_TIMEOUT=3600s
NGINX_PROXY_SEND_TIMEOUT=3600s

# Set true to accept requests for /.well-known/acme-challenge/
NGINX_ENABLE_CERTBOT_CHALLENGE=false

# ------------------------------
# Certbot Configuration
# ------------------------------

# Email address (required to get certificates from Let's Encrypt)
CERTBOT_EMAIL=your_email@example.com

# Domain name
CERTBOT_DOMAIN=your_domain.com

# certbot command options
# i.e: --force-renewal --dry-run --test-cert --debug
CERTBOT_OPTIONS=

certbot实现SSL自签名

1. 使用http方式将nginx运行；允许访问.well-known/acme-challenge/

vim .env
NGINX_ENABLE_CERTBOT_CHALLENGE=true

2. 使用certbot容器来申请ssl证书

# ------------------------------
# Environment Variables for Nginx reverse proxy
# ------------------------------
NGINX_SERVER_NAME=aa.bb.com
NGINX_HTTPS_ENABLED=false
# HTTP port
NGINX_PORT=80
# SSL settings are only applied when HTTPS_ENABLED is true
NGINX_SSL_PORT=443
# if HTTPS_ENABLED is true, you're required to add your own SSL certificates/keys to the `./nginx/ssl` directory
# and modify the env vars below accordingly.
NGINX_SSL_CERT_FILENAME=dify.crt
NGINX_SSL_CERT_KEY_FILENAME=dify.key
NGINX_SSL_PROTOCOLS=TLSv1.1 TLSv1.2 TLSv1.3

# Nginx performance tuning
NGINX_WORKER_PROCESSES=auto
NGINX_CLIENT_MAX_BODY_SIZE=100M
NGINX_KEEPALIVE_TIMEOUT=65

# Proxy settings
NGINX_PROXY_READ_TIMEOUT=3600s
NGINX_PROXY_SEND_TIMEOUT=3600s

# Set true to accept requests for /.well-known/acme-challenge/
NGINX_ENABLE_CERTBOT_CHALLENGE=true

# ------------------------------
# Certbot Configuration
# ------------------------------

# Email address (required to get certificates from Let's Encrypt)
CERTBOT_EMAIL=your123@qq.com

# Domain name
CERTBOT_DOMAIN=aa.bb.com

# certbot command options
# i.e: --force-renewal --dry-run --test-cert --debug
CERTBOT_OPTIONS=--force-renewal

3. 复制SSL证书到nginx指定路径下

# nginx证书存放路径
/data/dify/docker/nginx/ssl

4. 配置.env变量文件

NGINX_HTTPS_ENABLED=true

5. 重启nginx加载证书及域名

# 进入nginx容器中
nginx -s reload
# docker compose重启
docker-compose restart nginx
# 删除容器重新创建

跨域配置

root@xx-xx-dify:/data/dify/docker/nginx/conf.d# cat 00-redirect.conf 
server {

  location / {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' "GET, POST, PUT, DELETE, OPTIONS";
    add_header 'Access-Control-Allow-Headers' "Origin, X-Requested-With, Content-Type, Accept";

    if ($request_method = 'OPTIONS') {
        add_header 'Access-Control-Allow-Methods' "GET, OPTIONS";
        add_header 'Access-Control-Allow-Headers' "Origin, X-Requested-With, Content-Type, Accept";
        return 204;
    }
    return 301 https://$host$request_uri;
  }
}

references
官方中文文档
https://docs.dify.ai/zh-hans/introduction
github源码仓库
https://github.com/langgenius/dify