langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-20 19:50:06 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

In an intranet environment, how to access the Internet through an Internet proxy? #13604

New Issue
Closed
opened 2026-02-21 19:12:57 -05:00 by yindo · 3 comments
yindo commented 2026-02-21 19:12:57 -05:00
Owner
Copy Link
Copy Source

Originally created by @smart68668 on GitHub (May 2, 2025).

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
  • Please do not modify this template :) and fill in all the required fields.

Dify version

1.3.0

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

In an intranet environment, how to access the Internet through an Internet proxy?
My server doesn't have access to the Internet and needs to use the proxy address (http://192.168.20.25:122/) to access it. However, it seems that dify requests are defaulting to the ssrf_proxy. Even after adding http_proxy and https_proxy to all containers in docker_compose.yml, I still can't access *.dify.ai.
How should I do it?

✔️ Expected Behavior

dify -> http://192.168.20.25:122 -> *.dify.ai

❌ Actual Behavior

It is unable to download any plugins, and a 503 network error is prompted.

Originally created by @smart68668 on GitHub (May 2, 2025). ### Self Checks - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [x] [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:) - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version 1.3.0 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce In an intranet environment, how to access the Internet through an Internet proxy? My server doesn't have access to the Internet and needs to use the proxy address (http://192.168.20.25:122/) to access it. However, it seems that dify requests are defaulting to the ssrf_proxy. Even after adding http_proxy and https_proxy to all containers in docker_compose.yml, I still can't access *.dify.ai. How should I do it? ### ✔️ Expected Behavior dify -> http://192.168.20.25:122 -> *.dify.ai ### ❌ Actual Behavior It is unable to download any plugins, and a 503 network error is prompted.
yindo added the 🙋‍♂️ question label 2026-02-21 19:12:57 -05:00
yindo closed this issue 2026-02-21 19:12:57 -05:00
yindo commented 2026-02-21 19:12:58 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (May 2, 2025):

I found a similar solved discussion that might be helpful: Host using proxy and use docker deploy Dify. In this discussion, the user configured the proxy in their host as 127.0.0.1, which was taken into service by the API and plugin daemon from Dify. They resolved the issue by setting the following environment variables in the containers that needed them:

  • HTTP_PROXY: http://your host local ip:port/
  • HTTPS_PROXY: http://your host local ip:port/
  • http_proxy: http://your host local ip:port/
  • https_proxy: http://your host local ip:port/
  • NO_PROXY: localhost,127.0.0.0/8,::1,*ollama*,172.*,your host local ip:port

This configuration allowed the Dify requests to bypass the proxy first, ensuring proper access to external networks [1].

Additionally, the ssrf_proxy in Dify's network configuration is designed to prevent SSRF attacks by setting SSRF_PROXY and HTTP_PROXY environment variables for certain services. You might need to customize the squid configuration file located at docker/volumes/ssrf_proxy/squid.conf to ensure that your proxy settings are correctly applied [2].

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other

@dosubot[bot] commented on GitHub (May 2, 2025): <!-- Answer --> I found a similar solved discussion that might be helpful: [Host using proxy and use docker deploy Dify](https://github.com/langgenius/dify/discussions/18575#discussioncomment-12923924). In this discussion, the user configured the proxy in their host as `127.0.0.1`, which was taken into service by the API and plugin daemon from Dify. They resolved the issue by setting the following environment variables in the containers that needed them: - `HTTP_PROXY`: `http://your host local ip:port/` - `HTTPS_PROXY`: `http://your host local ip:port/` - `http_proxy`: `http://your host local ip:port/` - `https_proxy`: `http://your host local ip:port/` - `NO_PROXY`: `localhost,127.0.0.0/8,::1,*ollama*,172.*,your host local ip:port` This configuration allowed the Dify requests to bypass the proxy first, ensuring proper access to external networks <sup>[[1]](https://github.com/langgenius/dify/discussions/18575)</sup>. Additionally, the `ssrf_proxy` in Dify's network configuration is designed to prevent SSRF attacks by setting `SSRF_PROXY` and `HTTP_PROXY` environment variables for certain services. You might need to customize the `squid` configuration file located at `docker/volumes/ssrf_proxy/squid.conf` to ensure that your proxy settings are correctly applied <sup>[[2]](https://github.com/crazywoola/dify-docs-mintlify/blob/main/ja-jp/learn-more/faq/install-faq.mdx.bak)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=other)</sup>
yindo commented 2026-02-21 19:12:58 -05:00
Author
Owner
Copy Link
Copy Source

@smart68668 commented on GitHub (May 2, 2025):

我找到了一个类似的已解决的讨论，可能会有所帮助：使用代理托管并使用 docker deploy Dify。在本次讨论中，用户将其主机中的代理配置为 ，该代理由 Dify 的 API 和插件守护程序引入服务。他们通过在需要它们的容器中设置以下环境变量来解决此问题：127.0.0.1

  • HTTP_PROXY:http://your host local ip:port/
  • HTTPS_PROXY:http://your host local ip:port/
  • http_proxy:http://your host local ip:port/
  • https_proxy:http://your host local ip:port/
  • NO_PROXY:localhost,127.0.0.0/8,::1,*ollama*,172.*,your host local ip:port

此配置允许 Dify 请求首先绕过代理，从而确保对外部网络的正确访问[1].

此外，In Dify 的网络配置旨在通过为某些服务设置环境变量来防止 SSRF 攻击。您可能需要自定义位于 的配置文件，以确保您的代理设置得到正确应用ssrf_proxy``SSRF_PROXY``HTTP_PROXY``squid``docker/volumes/ssrf_proxy/squid.conf[2].

要继续与 Dosu 交谈，请提及 。

帮助 Dosu 学习！给它反馈：伟大的回应 |无关紧要的答案 |不正确的来源 |太冗长 |幻觉 |Bug 报告 |其他

I've used the http_proxy solution. After configuration, curl can access within the ssrf_proxy container, but when installing plugins in dify, it still shows a 503 error. What could be the reason? @Dosu

@smart68668 commented on GitHub (May 2, 2025): > 我找到了一个类似的已解决的讨论，可能会有所帮助：[使用代理托管并使用 docker deploy Dify](https://github.com/langgenius/dify/discussions/18575#discussioncomment-12923924)。在本次讨论中，用户将其主机中的代理配置为 ，该代理由 Dify 的 API 和插件守护程序引入服务。他们通过在需要它们的容器中设置以下环境变量来解决此问题：`127.0.0.1` > > * `HTTP_PROXY`:`http://your host local ip:port/` > * `HTTPS_PROXY`:`http://your host local ip:port/` > * `http_proxy`:`http://your host local ip:port/` > * `https_proxy`:`http://your host local ip:port/` > * `NO_PROXY`:`localhost,127.0.0.0/8,::1,*ollama*,172.*,your host local ip:port` > > 此配置允许 Dify 请求首先绕过代理，从而确保对外部网络的正确访问[[1]](https://github.com/langgenius/dify/discussions/18575). > > 此外，In Dify 的网络配置旨在通过为某些服务设置环境变量来防止 SSRF 攻击。您可能需要自定义位于 的配置文件，以确保您的代理设置得到正确应用`ssrf_proxy``SSRF_PROXY``HTTP_PROXY``squid``docker/volumes/ssrf_proxy/squid.conf`[[2]](https://github.com/crazywoola/dify-docs-mintlify/blob/main/ja-jp/learn-more/faq/install-faq.mdx.bak). > > _要继续与 [Dosu](https://dosu.dev) 交谈，请提及 。_ > > 帮助 Dosu 学习！给它反馈：[伟大的回应](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=great_response) |[无关紧要的答案](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=irrelevant_answer) |[不正确的来源](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=incorrect_sources) |[太冗长](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=too_verbose) |[幻觉](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=hallucination) |[Bug 报告](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=bug_report) |[其他](https://app.dosu.dev/response-feedback/920546c7-0760-4afe-8715-d8fa3a0f3e08?feedback_type=other) I've used the http_proxy solution. After configuration, curl can access within the ssrf_proxy container, but when installing plugins in dify, it still shows a 503 error. What could be the reason? @Dosu
yindo commented 2026-02-21 19:12:58 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (May 2, 2025):

A 503 error during plugin installation in Dify could be due to several reasons, even if curl works within the ssrf_proxy container. Here are some potential causes and solutions:

  1. Proxy Configuration: Ensure that the HTTP_PROXY and HTTPS_PROXY environment variables are correctly set for all relevant containers, including the plugin_daemon. Double-check that these variables are in uppercase, as lowercase might not be recognized by all services [1].

  2. NO_PROXY Settings: Verify that the NO_PROXY environment variable includes all necessary internal services and IP ranges, such as localhost, 127.0.0.0/8, and any other internal addresses that should bypass the proxy [2].

  3. Squid Configuration: Check the squid.conf file in the ssrf_proxy to ensure that it allows connections to the necessary external services. You might need to whitelist specific domains or IPs that the plugin installation process requires [3].

  4. Firewall and Network: Ensure there are no firewall rules or network policies blocking outbound connections from the containers to the internet, especially on port 443, which is used for HTTPS connections [4].

  5. Service Dependencies: Make sure all dependent services are running correctly and that there are no issues with the internal network setup that could affect communication between containers [5].

  6. Retry Mechanism: If the error persists, consider increasing the retry timeout for network requests by setting the PYTHON_ENV_INIT_TIMEOUT environment variable in the plugin_daemon service to a higher value, such as 320 seconds [4].

By addressing these areas, you should be able to resolve the 503 error during plugin installation.

To continue talking to Dosu, mention @dosu.

Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other

@dosubot[bot] commented on GitHub (May 2, 2025): <!-- Answer --> A 503 error during plugin installation in Dify could be due to several reasons, even if `curl` works within the `ssrf_proxy` container. Here are some potential causes and solutions: 1. **Proxy Configuration**: Ensure that the `HTTP_PROXY` and `HTTPS_PROXY` environment variables are correctly set for all relevant containers, including the `plugin_daemon`. Double-check that these variables are in uppercase, as lowercase might not be recognized by all services <sup>[[1]](https://github.com/langgenius/dify/issues/16548)</sup>. 2. **NO_PROXY Settings**: Verify that the `NO_PROXY` environment variable includes all necessary internal services and IP ranges, such as `localhost`, `127.0.0.0/8`, and any other internal addresses that should bypass the proxy <sup>[[2]](https://github.com/langgenius/dify/issues/14608)</sup>. 3. **Squid Configuration**: Check the `squid.conf` file in the `ssrf_proxy` to ensure that it allows connections to the necessary external services. You might need to whitelist specific domains or IPs that the plugin installation process requires <sup>[[3]](https://github.com/crazywoola/dify-docs-mintlify/blob/main/en/getting-started/install-self-hosted/install-faq.mdx)</sup>. 4. **Firewall and Network**: Ensure there are no firewall rules or network policies blocking outbound connections from the containers to the internet, especially on port 443, which is used for HTTPS connections <sup>[[4]](https://github.com/langgenius/dify/issues/16198)</sup>. 5. **Service Dependencies**: Make sure all dependent services are running correctly and that there are no issues with the internal network setup that could affect communication between containers <sup>[[5]](https://github.com/langgenius/dify/blob/main/api/services/plugin/plugin_service.py)</sup>. 6. **Retry Mechanism**: If the error persists, consider increasing the retry timeout for network requests by setting the `PYTHON_ENV_INIT_TIMEOUT` environment variable in the `plugin_daemon` service to a higher value, such as 320 seconds <sup>[[4]](https://github.com/langgenius/dify/issues/16198)</sup>. By addressing these areas, you should be able to resolve the 503 error during plugin installation. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.* --- <sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/941b34b2-9a80-4a03-98e4-158622cd0da5?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/941b34b2-9a80-4a03-98e4-158622cd0da5?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/941b34b2-9a80-4a03-98e4-158622cd0da5?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/941b34b2-9a80-4a03-98e4-158622cd0da5?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/941b34b2-9a80-4a03-98e4-158622cd0da5?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/941b34b2-9a80-4a03-98e4-158622cd0da5?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/941b34b2-9a80-4a03-98e4-158622cd0da5?feedback_type=other)</sup>
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🙋‍♂️ question
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#13604
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?