Dify 1.0.x upgrade breaks current architecture

[saendu]

Since the 1.0.0 release the current architecture seams not to work anymore. Did anybody make this work with the new release, especially with the plugin store?

[nikawang]

I will address this in following days, and weclome to contribute.

[saendu]

Any success yet? I was not entirely. I could make most of the containers run but the config did not work. In other words; i could not make them work together properly.

[nikawang]

sorry, a bunch of backlogs in my working queue.. I would complete it by the end June, hopefully..

[mwakayama]

Tried This Task with Dify v1.2.0 — It Was Tough

I tried tackling this task using Dify v1.2.0, and it turned out to be quite a tough job.
Since the code I created includes sensitive information, I cannot share the full code, but I will outline the key points below.

---

🔧 Complex Environment Variable Setup

The way environment variables are structured has become more complicated, and the number of variables has significantly increased. We needed to handle this carefully.

If you look at docker-compose.yaml, you’ll notice that common environment variables are grouped under a YAML alias named shared-api-worker-env, likely for .env consolidation purposes. These variables are then transformed and reused under different names.

We had to track down how each variable was being used to some extent.

Also, due to the sheer volume of variables, those with fixed values were grouped into per-service .env.{service_name} files. These were loaded using dynamic env.

Values that can only be known after Azure resources are provisioned (e.g., PostgreSQL Flexible Server connection info) had to be set individually. Here's an example:

📄 locals block for reading env vars from file

locals {
  env_api = tomap({
    for line in split("\n", file("./env-vars/.env.api")) :
    split("=", line)[0] => join("=", slice(split("=", line), 1, length(split("=", line))))
    if length(split("=", line)) >= 2 && !startswith(line, "#")
  })
}

📄 azurerm_container_app "api"

resource "azurerm_container_app" "api" {
  name                         = "api"
  container_app_environment_id = azurerm_container_app_environment.dify.id
  resource_group_name          = azurerm_resource_group.rg.name
  revision_mode                = "Single"
  workload_profile_name        = "Consumption"

  depends_on = [azurerm_container_app.nginx]

  template {
    tcp_scale_rule {
      name                = "api"
      concurrent_requests = "10"
    }
    max_replicas = 10
    min_replicas = 1

    container {
      name   = "langgenius"
      image  = var.dify-api-image
      cpu    = 2
      memory = "4Gi"

      volume_mounts {
        name = "api-storage"
        path = "/app/api/storage"
      }

      dynamic "env" {
        for_each = local.env_shared
        content {
          name  = env.key
          value = env.value
        }
      }

      dynamic "env" {
        for_each = local.env_api
        content {
          name  = env.key
          value = env.value
        }
      }

      env {
        name  = "CONSOLE_API_URL"
        value = "https://${azurerm_container_app.nginx.latest_revision_fqdn}"
      }
      env {
        name  = "CONSOLE_WEB_URL"
        value = "https://${azurerm_container_app.nginx.latest_revision_fqdn}"
      }
      env {
        name  = "SERVICE_API_URL"
        value = "https://${azurerm_container_app.nginx.latest_revision_fqdn}"
      }
      env {
        name  = "APP_WEB_URL"
        value = "https://${azurerm_container_app.nginx.latest_revision_fqdn}"
      }
      env {
        name  = "FILES_URL"
        value = "https://${azurerm_container_app.nginx.latest_revision_fqdn}"
      }
      env {
        name  = "DB_USERNAME"
        value = azurerm_postgresql_flexible_server.postgres.administrator_login
      }
      env {
        name  = "DB_PASSWORD"
        value = azurerm_postgresql_flexible_server.postgres.administrator_password
      }
      env {
        name  = "DB_HOST"
        value = azurerm_postgresql_flexible_server.postgres.fqdn
      }
      env {
        name  = "DB_DATABASE"
        value = azurerm_postgresql_flexible_server_database.dify.name
      }
      env {
        name  = "PGUSER"
        value = azurerm_postgresql_flexible_server.postgres.administrator_login
      }
      env {
        name  = "POSTGRES_PASSWORD"
        value = azurerm_postgresql_flexible_server.postgres.administrator_password
      }
      env {
        name  = "POSTGRES_DB"
        value = azurerm_postgresql_flexible_server_database.dify.name
      }
      env {
        name  = "REDIS_HOST"
        value = azurerm_redis_cache.redis.hostname
      }
      env {
        name  = "REDIS_PASSWORD"
        value = azurerm_redis_cache.redis.primary_access_key
      }
      env {
        name  = "CELERY_BROKER_URL"
        value = "redis://:${azurerm_redis_cache.redis.primary_access_key}@${azurerm_redis_cache.redis.hostname}:6379/1"
      }
      env {
        name  = "AZURE_BLOB_ACCOUNT_NAME"
        value = azurerm_storage_account.aca_storage.name
      }
      env {
        name  = "AZURE_BLOB_ACCOUNT_KEY"
        value = azurerm_storage_account.aca_storage.primary_access_key
      }
      env {
        name  = "AZURE_BLOB_ACCOUNT_URL"
        value = azurerm_storage_account.aca_storage.primary_blob_endpoint
      }
      env {
        name  = "AZURE_BLOB_CONTAINER_NAME"
        value = azurerm_storage_container.dify_data.name
      }
      env {
        name  = "PGVECTOR_HOST"
        value = azurerm_postgresql_flexible_server.postgres.fqdn
      }
      env {
        name  = "PGVECTOR_USER"
        value = azurerm_postgresql_flexible_server.postgres.administrator_login
      }
      env {
        name  = "PGVECTOR_PASSWORD"
        value = azurerm_postgresql_flexible_server.postgres.administrator_password
      }
      env {
        name  = "PGVECTOR_DATABASE"
        value = azurerm_postgresql_flexible_server_database.pgvector.name
      }
    }

    volume {
      name         = "api-storage"
      storage_type = "AzureFile"
      storage_name = azurerm_container_app_environment_storage.api_storage.name
    }
  }

  ingress {
    target_port  = 5001
    exposed_port = 5001
    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
    transport = "tcp"
  }
}

---

🧩 New plugin_daemon Service

A new service named plugin_daemon was added.
Since Azure Database for PostgreSQL requires SSL, the DB_SSL_MODE environment variable had to be set to "require".
This requirement was not apparent from the original docker-compose.yaml or related files.

Reference:
https://dev.to/tyrannosauralex/guide-to-dify-113-on-aws-using-docker-compose-connected-to-postgres-rds-with-tls-through-an-aws-2aa0

📄 azurerm_container_app "plugindaemon"

resource "azurerm_container_app" "plugindaemon" {
  name                         = "plugindaemon"
  container_app_environment_id = azurerm_container_app_environment.dify.id
  resource_group_name          = azurerm_resource_group.rg.name
  revision_mode                = "Single"
  workload_profile_name        = "Consumption"

  template {
    tcp_scale_rule {
      name                = "plugindaemon"
      concurrent_requests = "10"
    }
    max_replicas = 10
    min_replicas = 1

    container {
      name   = "langgenius"
      image  = var.dify-plugindaemon-image
      cpu    = 0.5
      memory = "1Gi"

      volume_mounts {
        name = "plugindaemon-storage"
        path = "/app/storage"
      }

      dynamic "env" {
        for_each = local.env_shared
        content {
          name  = env.key
          value = env.value
        }
      }

      dynamic "env" {
        for_each = local.env_plugindaemon
        content {
          name  = env.key
          value = env.value
        }
      }

      env {
        name  = "DB_SSL_MODE"
        value = "require"
      }
      env {
        name  = "DB_USERNAME"
        value = azurerm_postgresql_flexible_server.postgres.administrator_login
      }
      env {
        name  = "DB_PASSWORD"
        value = azurerm_postgresql_flexible_server.postgres.administrator_password
      }
      env {
        name  = "DB_HOST"
        value = azurerm_postgresql_flexible_server.postgres.fqdn
      }
      env {
        name  = "DB_DATABASE"
        value = azurerm_postgresql_flexible_server_database.dify_plugin.name
      }
      env {
        name  = "PGUSER"
        value = azurerm_postgresql_flexible_server.postgres.administrator_login
      }
      env {
        name  = "POSTGRES_PASSWORD"
        value = azurerm_postgresql_flexible_server.postgres.administrator_password
      }
      env {
        name  = "POSTGRES_DB"
        value = azurerm_postgresql_flexible_server_database.dify_plugin.name
      }
      env {
        name  = "REDIS_HOST"
        value = azurerm_redis_cache.redis.hostname
      }
      env {
        name  = "REDIS_PASSWORD"
        value = azurerm_redis_cache.redis.primary_access_key
      }
      env {
        name  = "CELERY_BROKER_URL"
        value = "redis://:${azurerm_redis_cache.redis.primary_access_key}@${azurerm_redis_cache.redis.hostname}:6379/1"
      }
      env {
        name  = "AZURE_BLOB_ACCOUNT_NAME"
        value = azurerm_storage_account.aca_storage.name
      }
      env {
        name  = "AZURE_BLOB_ACCOUNT_KEY"
        value = azurerm_storage_account.aca_storage.primary_access_key
      }
      env {
        name  = "AZURE_BLOB_ACCOUNT_URL"
        value = azurerm_storage_account.aca_storage.primary_blob_endpoint
      }
      env {
        name  = "AZURE_BLOB_CONTAINER_NAME"
        value = azurerm_storage_container.dify_data.name
      }
    }

    volume {
      name         = "plugindaemon-storage"
      storage_type = "AzureFile"
      storage_name = azurerm_container_app_environment_storage.plugindaemon_storage.name
    }
  }

  ingress {
    target_port  = 5002
    exposed_port = 5002
    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
    transport = "tcp"
  }
}

---

📂 entrypoint.sh and FileShare Usage

The entrypoint.sh script injects environment variables into template config files and copies them to /etc/{service_name}.
It’s preferable to mount a file share to /mnt/{something} and then use command to copy the file into /etc/{service_name}.

📄 azurerm_container_app "ssrfproxy" Example using the command attribute

resource "azurerm_container_app" "ssrfproxy" {
  name                         = "ssrfproxy"
  container_app_environment_id = azurerm_container_app_environment.dify.id
  resource_group_name          = azurerm_resource_group.rg.name
  revision_mode                = "Single"
  workload_profile_name        = "Consumption"

  template {
    tcp_scale_rule {
      name                = "ssrfproxy"
      concurrent_requests = "10"
    }

    max_replicas = 10
    min_replicas = 1

    container {
      name   = "ssrfproxy"
      image  = "ubuntu/squid:latest"
      cpu    = 0.5
      memory = "1Gi"

      command = [
        "sh",
        "-c",
        "cp -r /mnt/squid/* /etc/squid && chmod +x /mnt/entrypoint/docker-entrypoint.sh && /mnt/entrypoint/docker-entrypoint.sh"
      ]

      # Mounting directly to /etc/squid will cause the default configuration to disappear, so mount to a different location first and then copy the files using cp.
      volume_mounts {
        name = "ssrfproxy-conf"
        path = "/mnt/squid"
      }

      volume_mounts {
        name = "ssrfproxy-entrypoint"
        path = "/mnt/entrypoint"
      }

      dynamic "env" {
        for_each = local.env_ssrfproxy
        content {
          name  = env.key
          value = env.value
        }
      }
    }

    volume {
      name         = "ssrfproxy-conf"
      storage_type = "AzureFile"
      storage_name = azurerm_container_app_environment_storage.ssrfproxy_conf.name
    }

    volume {
      name         = "ssrfproxy-entrypoint"
      storage_type = "AzureFile"
      storage_name = azurerm_container_app_environment_storage.ssrfproxy_entrypoint.name
    }
  }

  ingress {
    target_port = 3128
    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
    transport = "tcp"
  }
}

In some cases, multiple file shares were needed.

---

❌ Remove Underscores from Hostnames

Hostnames like plugin_daemon and ssrf_proxy must have underscores removed — this is a limitation of Azure Container Apps.

Also, be sure to double-check .env.example and related files for placeholder values containing underscores, and correct them as needed.

[saendu]

Thanks @mwakayama for your post and examples. I am still struggling to understand what I need to change that I get a working system. Any change to share a complete terraform project without sharing any sensitive information?

[mwakayama]

@saendu Here is my code https://github.com/mwakayama/dify-azure-terraform-example-v1_2

There’s no time to explain the details.
Read through the code to get the gist, and experiment with it in your own environment.

• I manually modified the code to mask secrets and for other reasons, so I can’t guarantee that it will work.
• For email delivery, I used Resend. You’ll need to create a Resend account and set the API key as an environment variable.
• Both the data database and vector database assume PostgreSQL, so I commented out unrelated environment variables.
• Some comments remain in Japanese—either translate them or ignore them.
• Many changes from the original code were made not to adapt to v1.x but simply due to my personal preferences:
  • I changed various Azure resource names, resource group names, and Terraform variable names from the original code.
  • I minimized the number of Terraform variables. As a result, some passwords (such as the PostgreSQL password) are hardcoded directly into the resource definitions.
  • The fileshare module has been modified to handle paths in a way that works on Windows environments.

[mwakayama]

Rather than anything else, it’s more important to understand what https://github.com/langgenius/dify/blob/main/docker/docker-compose.yaml is doing.

[saendu]

Thank you very much for sharing your code @mwakayama!
I had issues with the plugindaemon container.

I could fix it by upgrading to the latest versions:
api: 1.4.1
web: 1.4.1
plugindaemon: 0.1.1-local
sandbox: 0.2.12

And also add this env variables to aca.tf

...
      env {
        name  = "UV_COPY"
        value = "1"
      }
      env {
        name  = "UV_LINK_MODE"
        value = "copy"
      }
      env {
        name  = "PYTHON_INTERPRETER_PATH"
        value = "/usr/bin/python3.12"
      }
      env {
        name  = "PLUGIN_WORKING_PATH"
        value = "/tmp/plugin_workdir"
      }
      env {
        name  = "PLUGIN_INSTALLED_PATH"
        value = "/tmp/plugin_installed"
      }
      env {
        name  = "PLUGIN_PACKAGE_CACHE_PATH"
        value = "/app/storage/plugin_packages"
      }
      env {
        name  = "UV_NO_SYMLINKS"
        value = "1"
      }
      env {
        name  = "VIRTUAL_ENV_DISABLE_PROMPT"
        value = "1"
      }
      env {
        name  = "PYTHONPATH"
        value = "/tmp/plugin_workdir"
      }
...

[picoman420]

Thanks a lot @saendu for the correct plugindaemon image tag, I was stuck on it for the whole day.

[saendu]

Any updates on this? Did somebody manage ot to have a stable running version above 1.x.x?

[saendu]

Anybody made this work. Update highly appreciated!