mirror of
https://github.com/langgenius/dify-plugin-daemon.git
synced 2026-07-22 17:56:00 -04:00
Yeuoly
b85253f773
* feat(plugin): implement unauthorized Langgenius plugin blocking - Added configuration option to disable installation of plugins falsely claiming Langgenius authorship. - Introduced new error handling for unauthorized Langgenius claims during plugin installation. - Implemented tests to validate unauthorized Langgenius detection logic. - Updated environment configuration and service files to support the new feature. * fix: typo * refactor(plugin): update Langgenius plugin signature enforcement - Renamed configuration option from DISABLE_UNAUTHORIZED_LANGGENIUS_PACKAGE to ENFORCE_LANGGENIUS_PLUGIN_SIGNATURES for clarity. - Updated error messages and logic in the plugin installation process to reflect the new configuration. - Enhanced tests to validate the behavior of unauthorized Langgenius plugin detection with the new enforcement setting.
160 lines
4.8 KiB
Bash
160 lines
4.8 KiB
Bash
SERVER_PORT=5002
|
|
SERVER_KEY=lYkiYYT6owG+71oLerGzA7GXCgOT++6ovaezWAjpCjf+Sjc3ZtU+qUEi
|
|
GIN_MODE=release
|
|
PLATFORM=local
|
|
|
|
DIFY_INNER_API_KEY="QaHbTe77CtuXmsfyhR7+vRjI/+XbV1AaFy691iy+kGDv2Jvy0/eAh8Y1"
|
|
DIFY_INNER_API_URL=http://127.0.0.1:5001
|
|
|
|
PLUGIN_REMOTE_INSTALLING_ENABLED=true
|
|
PLUGIN_REMOTE_INSTALLING_HOST=127.0.0.1
|
|
PLUGIN_REMOTE_INSTALLING_PORT=5003
|
|
|
|
# s3 credentials
|
|
S3_USE_AWS=true
|
|
S3_USE_AWS_MANAGED_IAM=false
|
|
S3_ENDPOINT=
|
|
S3_USE_PATH_STYLE=true
|
|
AWS_ACCESS_KEY=
|
|
AWS_SECRET_KEY=
|
|
AWS_REGION=
|
|
|
|
# tencent cos credentials
|
|
TENCENT_COS_SECRET_KEY=
|
|
TENCENT_COS_SECRET_ID=
|
|
TENCENT_COS_REGION=
|
|
|
|
# aliyun oss credentials
|
|
ALIYUN_OSS_REGION=
|
|
ALIYUN_OSS_ENDPOINT=
|
|
ALIYUN_OSS_ACCESS_KEY_ID=
|
|
ALIYUN_OSS_ACCESS_KEY_SECRET=
|
|
ALIYUN_OSS_AUTH_VERSION=v4
|
|
ALIYUN_OSS_PATH=
|
|
|
|
# azure blob storage credentials
|
|
AZURE_BLOB_STORAGE_CONTAINER_NAME=
|
|
AZURE_BLOB_STORAGE_CONNECTION_STRING=
|
|
|
|
# volcengine tos
|
|
VOLCENGINE_TOS_ENDPOINT=
|
|
VOLCENGINE_TOS_ACCESS_KEY=
|
|
VOLCENGINE_TOS_SECRET_KEY=
|
|
VOLCENGINE_TOS_REGION=
|
|
|
|
# gcs storage credentials base64 string
|
|
GCS_CREDENTIALS=
|
|
|
|
# huawei obs credentials
|
|
HUAWEI_OBS_ACCESS_KEY=
|
|
HUAWEI_OBS_SECRET_KEY=
|
|
HUAWEI_OBS_SERVER=
|
|
|
|
|
|
# services storage
|
|
# https://github.com/langgenius/dify-cloud-kit/blob/main/oss/factory/factory.go
|
|
PLUGIN_STORAGE_TYPE=local
|
|
PLUGIN_STORAGE_OSS_BUCKET=
|
|
PLUGIN_STORAGE_LOCAL_ROOT=./storage
|
|
|
|
# where the plugin finally installed
|
|
PLUGIN_INSTALLED_PATH=plugin
|
|
|
|
# where the plugin finally running and working
|
|
PLUGIN_WORKING_PATH=cwd
|
|
|
|
# persistence storage
|
|
PERSISTENCE_STORAGE_PATH=persistence
|
|
PERSISTENCE_STORAGE_MAX_SIZE=104857600
|
|
|
|
# plugin webhook
|
|
PLUGIN_WEBHOOK_ENABLED=true
|
|
|
|
# routine pool
|
|
ROUTINE_POOL_SIZE=1024
|
|
|
|
# redis
|
|
REDIS_HOST=127.0.0.1
|
|
REDIS_PORT=6379
|
|
REDIS_PASSWORD=difyai123456
|
|
REDIS_DB=0
|
|
|
|
# Whether to use Redis Sentinel mode.
|
|
# If set to true, the application will automatically discover and connect to the master node through Sentinel.
|
|
REDIS_USE_SENTINEL=false
|
|
|
|
# List of Redis Sentinel nodes. If Sentinel mode is enabled, provide at least one Sentinel IP and port.
|
|
# Format: `<sentinel1_ip>:<sentinel1_port>,<sentinel2_ip>:<sentinel2_port>,<sentinel3_ip>:<sentinel3_port>`
|
|
REDIS_SENTINELS=
|
|
REDIS_SENTINEL_SERVICE_NAME=
|
|
REDIS_SENTINEL_USERNAME=
|
|
REDIS_SENTINEL_PASSWORD=
|
|
REDIS_SENTINEL_SOCKET_TIMEOUT=0.1
|
|
|
|
DB_USERNAME=postgres
|
|
DB_PASSWORD=difyai123456
|
|
DB_HOST=localhost
|
|
DB_PORT=5432
|
|
DB_DATABASE=dify_plugin
|
|
# Specifies the SSL mode for the database connection.
|
|
# Possible values include 'disable', 'require', 'verify-ca', and 'verify-full'.
|
|
# 'disable' means SSL is not used for the connection.
|
|
DB_SSL_MODE=disable
|
|
# database connection pool settings
|
|
DB_MAX_IDLE_CONNS=10
|
|
DB_MAX_OPEN_CONNS=30
|
|
DB_CONN_MAX_LIFETIME=3600
|
|
# DB_EXTRAS in GORM format
|
|
DB_EXTRAS=
|
|
DB_CHARSET=
|
|
|
|
DIFY_INVOCATION_CONNECTION_IDLE_TIMEOUT=120
|
|
|
|
MAX_PLUGIN_PACKAGE_SIZE=52428800
|
|
|
|
# dify serverless connector
|
|
DIFY_PLUGIN_SERVERLESS_CONNECTOR_URL=http://127.0.0.1:5004
|
|
DIFY_PLUGIN_SERVERLESS_CONNECTOR_API_KEY=HeRFb6yrzAy5vUSlJWK2lUl36mpkaRycv4witbQpucXacgXg7G9a8gVL
|
|
|
|
# python interpreter, if you are using local runtime, you should set this path to your python interpreter path
|
|
# otherwise, it should be /usr/bin/python3
|
|
# PYTHON_INTERPRETER_PATH=/usr/bin/python3
|
|
|
|
# uv path, if you are using local runtime, you should set this path to your local uv path
|
|
# otherwise, it will use `from uv._find_uv import find_uv_bin; print(find_uv_bin())`
|
|
# UV_PATH=
|
|
|
|
# python environment init timeout, if the python environment init process is not finished within this time, it will be killed
|
|
PYTHON_ENV_INIT_TIMEOUT=120
|
|
|
|
# pprof enabled, for debugging
|
|
PPROF_ENABLED=false
|
|
|
|
# FORCE_VERIFYING_SIGNATURE, for security, you should set this to true, pls be sure you know what you are doing
|
|
# if want to install plugin without verifying signature, set this to false
|
|
FORCE_VERIFYING_SIGNATURE=true
|
|
|
|
# Enable or disable third-party signature verification for plugins
|
|
# Set to "true" to allow verification using additional public keys specified in THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS
|
|
THIRD_PARTY_SIGNATURE_VERIFICATION_ENABLED=false
|
|
# A comma-separated list of file paths to public keys in addition to the official public key for signature verification
|
|
THIRD_PARTY_SIGNATURE_VERIFICATION_PUBLIC_KEYS=
|
|
|
|
# Enforce signature verification for plugins claiming Langgenius authorship
|
|
# Set to "false" to allow installation of unsigned plugins claiming to be from Langgenius (security risk)
|
|
# Community and partner plugins that don't claim Langgenius authorship are not affected
|
|
ENFORCE_LANGGENIUS_PLUGIN_SIGNATURES=true
|
|
|
|
# proxy settings, example: HTTP_PROXY=http://host.docker.internal:7890
|
|
HTTP_PROXY=
|
|
HTTPS_PROXY=
|
|
|
|
# plugin stdio buffer size
|
|
PLUGIN_STDIO_BUFFER_SIZE=1024
|
|
PLUGIN_STDIO_MAX_BUFFER_SIZE=5242880
|
|
|
|
# dify backwards invocation write timeout in milliseconds
|
|
DIFY_BACKWARDS_INVOCATION_WRITE_TIMEOUT=5000
|
|
# dify backwards invocation read timeout in milliseconds
|
|
DIFY_BACKWARDS_INVOCATION_READ_TIMEOUT=240000
|