langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-23 21:15:32 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

How to add http_proxy and no_proxy correctly in internal network in docker-compose.yaml? Do I need to use ssrf_proxy? #21064

New Issue
Closed
opened 2026-02-21 20:10:31 -05:00 by yindo · 9 comments
yindo commented 2026-02-21 20:10:31 -05:00
Owner
Copy Link
Copy Source

Originally created by @Guofu1149 on GitHub (Dec 15, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

How to add http_proxy and no_proxy correctly in internal network in docker-compose.yaml? Do I need to use ssrf_proxy?

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

How to add http_proxy and no_proxy correctly in internal network in docker-compose.yaml? Do I need to use ssrf_proxy?

✔️ Expected Behavior

successful

❌ Actual Behavior

error

Originally created by @Guofu1149 on GitHub (Dec 15, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version How to add http_proxy and no_proxy correctly in internal network in docker-compose.yaml? Do I need to use ssrf_proxy? ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce How to add http_proxy and no_proxy correctly in internal network in docker-compose.yaml? Do I need to use ssrf_proxy? ### ✔️ Expected Behavior successful ### ❌ Actual Behavior error
yindo added the 🙋‍♂️ question label 2026-02-21 20:10:31 -05:00
yindo closed this issue 2026-02-21 20:10:31 -05:00
yindo commented 2026-02-21 20:10:31 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 15, 2025):

To set up proxying for Dify in a self-hosted Docker Compose environment, you should use both uppercase and lowercase variants of http_proxy, https_proxy, and no_proxy for compatibility. These should be set in your .env file and referenced in docker-compose.yaml for all relevant services. For internal networking, no_proxy should include all internal service names (like api, db, plugin_daemon, redis, sandbox, ssrf_proxy, weaviate, web, worker, localhost, 127.0.0.1) so internal traffic bypasses the proxy. Example:

# .env
HTTP_PROXY=http://ssrf_proxy:3128
HTTPS_PROXY=http://ssrf_proxy:3128
http_proxy=http://ssrf_proxy:3128
https_proxy=http://ssrf_proxy:3128
NO_PROXY=api,db,plugin_daemon,redis,sandbox,ssrf_proxy,weaviate,web,worker,localhost,127.0.0.1
no_proxy=api,db,plugin_daemon,redis,sandbox,ssrf_proxy,weaviate,web,worker,localhost,127.0.0.1

# docker-compose.yaml (service example)
services:
  api:
    environment:
      HTTP_PROXY: ${HTTP_PROXY}
      HTTPS_PROXY: ${HTTPS_PROXY}
      http_proxy: ${http_proxy}
      https_proxy: ${https_proxy}
      NO_PROXY: ${NO_PROXY}
      no_proxy: ${no_proxy}

Reference

You do need to use the ssrf_proxy service (Squid proxy) in Dify's Docker setup. It is required for SSRF protection and to control/whitelist external HTTP access. The default setup routes internal HTTP requests through ssrf_proxy at http://ssrf_proxy:3128 Reference. If you need to allow access to specific external domains, add ACL entries and allow rules to the Squid config file used by ssrf_proxy Reference.

After updating proxy settings or Squid config, restart your Docker Compose services for changes to take effect. If you encounter errors like "Network is unreachable" or 502, check the ssrf_proxy configuration, Docker network connectivity, firewall rules, and Squid logs Reference.

If your proxy does SSL interception, mount your CA certificates into containers and set REQUESTS_CA_BUNDLE to the cert path for HTTPS requests to work Reference.

Let me know if you need help with Squid config or troubleshooting specific errors!

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 15, 2025): <!-- Answer --> To set up proxying for Dify in a self-hosted Docker Compose environment, you should use both uppercase and lowercase variants of `http_proxy`, `https_proxy`, and `no_proxy` for compatibility. These should be set in your `.env` file and referenced in `docker-compose.yaml` for all relevant services. For internal networking, `no_proxy` should include all internal service names (like `api`, `db`, `plugin_daemon`, `redis`, `sandbox`, `ssrf_proxy`, `weaviate`, `web`, `worker`, `localhost`, `127.0.0.1`) so internal traffic bypasses the proxy. Example: ```env # .env HTTP_PROXY=http://ssrf_proxy:3128 HTTPS_PROXY=http://ssrf_proxy:3128 http_proxy=http://ssrf_proxy:3128 https_proxy=http://ssrf_proxy:3128 NO_PROXY=api,db,plugin_daemon,redis,sandbox,ssrf_proxy,weaviate,web,worker,localhost,127.0.0.1 no_proxy=api,db,plugin_daemon,redis,sandbox,ssrf_proxy,weaviate,web,worker,localhost,127.0.0.1 ``` ```yaml # docker-compose.yaml (service example) services: api: environment: HTTP_PROXY: ${HTTP_PROXY} HTTPS_PROXY: ${HTTPS_PROXY} http_proxy: ${http_proxy} https_proxy: ${https_proxy} NO_PROXY: ${NO_PROXY} no_proxy: ${no_proxy} ``` [Reference](https://github.com/langgenius/dify/issues/26177) You do need to use the `ssrf_proxy` service (Squid proxy) in Dify's Docker setup. It is required for SSRF protection and to control/whitelist external HTTP access. The default setup routes internal HTTP requests through `ssrf_proxy` at `http://ssrf_proxy:3128` [Reference](https://github.com/langgenius/dify/issues/14205). If you need to allow access to specific external domains, add ACL entries and allow rules to the Squid config file used by `ssrf_proxy` [Reference](https://github.com/langgenius/dify/issues/14621). After updating proxy settings or Squid config, restart your Docker Compose services for changes to take effect. If you encounter errors like "Network is unreachable" or 502, check the `ssrf_proxy` configuration, Docker network connectivity, firewall rules, and Squid logs [Reference](https://github.com/langgenius/dify/issues/14621). If your proxy does SSL interception, mount your CA certificates into containers and set `REQUESTS_CA_BUNDLE` to the cert path for HTTPS requests to work [Reference](https://github.com/langgenius/dify/issues/28752). Let me know if you need help with Squid config or troubleshooting specific errors! <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/ade02e89-86c2-444e-a646-511b1b590e38?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/ade02e89-86c2-444e-a646-511b1b590e38?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/ade02e89-86c2-444e-a646-511b1b590e38?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/ade02e89-86c2-444e-a646-511b1b590e38?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/ade02e89-86c2-444e-a646-511b1b590e38?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/ade02e89-86c2-444e-a646-511b1b590e38?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/ade02e89-86c2-444e-a646-511b1b590e38?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=To%20set%20up%20proxying%20for%20Dify%20in%20a%20self-hosted%20Docker%20Compose%20environment%2C%20you%20should%20use%20both%20uppercase%20and%20lowercase%20variants%20of%20%60http_proxy%60%2C%20%60https_proxy%60%2C%20and%20%60no_proxy%60%20for%20compatibility.%20These%20should%20be%20set%20in%20your%20%60.env%60%20file%20and%20referenced%20in%20%60docker-compose.yaml%60%20for%20all%20relevant%20services.%20For%20internal%20networking%2C%20%60no_proxy%60%20should%20include%20all%20internal%20service%20names%20%28like%20%60api%60%2C%20%60db%60%2C%20%60plugin_daemon%60%2C%20%60redis%60%2C%20%60sandbox%60%2C%20%60ssrf_proxy%60%2C%20%60weaviate%60%2C%20%60web%60%2C%20%60worker%60%2C%20%60localhost%60%2C%20%60127.0.0.1%60%29%20so%20internal%20traffic%20bypasses%20the%20proxy.%20Example%3A%0A%0A%60%60%60env%0A%23%20.env%0AHTTP_PROXY%3Dhttp%3A//ssrf_proxy%3A3128%0AHTTPS_PROXY%3Dhttp%3A//ssrf_proxy%3A3128%0Ahttp_proxy%3Dhttp%3A//ssrf_proxy%3A3128%0Ahttps_proxy%3Dhttp%3A//ssrf_proxy%3A3128%0ANO_PROXY%3Dapi%2Cdb%2Cplugin_daemon%2Credis%2Csandbox%2Cssrf_proxy%2Cweaviate%2Cweb%2Cworker%2Clocalhost%2C127.0.0.1%0Ano_proxy%3Dapi%2Cdb%2Cplugin_daemon%2Credis%2Csandbox%2Cssrf_proxy%2Cweaviate%2Cweb%2Cworker%2Clocalhost%2C127.0.0.1%0A%60%60%60%0A%0A%60%60%60yaml%0A%23%20docker-compose.yaml%20%28service%20example%29%0Aservices%3A%0A%20%20api%3A%0A%20%20%20%20environment%3A%0A%20%20%20%20%20%20HTTP_PROXY%3A%20%24%7BHTTP_PROXY%7D%0A%20%20%20%20%20%20HTTPS_PROXY%3A%20%24%7BHTTPS_PROXY%7D%0A%20%20%20%20%20%20http_proxy%3A%20%24%7Bhttp_proxy%7D%0A%20%20%20%20%20%20https_proxy%3A%20%24%7Bhttps_proxy%7D%0A%20%20%20%20%20%20NO_PROXY%3A%20%24%7BNO_PROXY%7D%0A%20%20%20%20%20%20no_proxy%3A%20%24%7Bno_proxy%7D%0A%60%60%60%0A%5BReference%5D%28https%3A//github.com/langgenius/dify/issues/26177%29%0A%0AYou%20do%20need%20to%20use%20the%20%60ssrf_proxy%60%20service%20%28Squid%20proxy%29%20in%20Dify%27s%20Docker%20setup.%20It%20is%20required%20for%20SSRF%20protection%20and%20to%20control/whitelist%20external%20HTTP%20access.%20The%20default%20setup%20routes%20internal%20HTTP%20requests%20through%20%60ssrf_proxy%60%20at%20%60http%3A//ssrf_proxy%3A3128%60%C2%A0%5BReference%5D%28https%3A//github.com/langgenius/dify/issues/14205%29.%20If%20you%20need%20to%20allow%20access%20to%20specific%20external%20domains%2C%20add%20ACL%20entries%20and%20allow%20rules%20to%20the%20Squid%20config%20file%20used%20by%20%60ssrf_proxy%60%C2%A0%5BReference%5D%28https%3A//github.com/langgenius/dify/issues/14621%29.%0A%0AAfter%20updating%20proxy%20settings%20or%20Squid%20config%2C%20restart%20your%20Docker%20Compose%20services%20for%20changes%20to%20take%20effect.%20If%20you%20encounter%20errors%20like%20%22Network%20is%20unreachable%22%20or%20502%2C%20check%20the%20%60ssrf_proxy%60%20configuration%2C%20Docker%20network%20connectivity%2C%20firewall%20rules%2C%20and%20Squid%20logs%C2%A0%5BReference%5D%28https%3A//github.com/langgenius/dify/issues/14621%29.%0A%0AIf%20your%20proxy%20does%20SSL%20interception%2C%20mount%20your%20CA%20certificates%20into%20containers%20and%20set%20%60REQUESTS_CA_BUNDLE%60%20to%20the%20cert%20path%20for%20HTTPS%20requests%20to%20work%C2%A0%5BReference%5D%28https%3A//github.com/langgenius/dify/issues/28752%29.%0A%0ALet%20me%20know%20if%20you%20need%20help%20with%20Squid%20config%20or%20troubleshooting%20specific%20errors%21)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29701)
yindo commented 2026-02-21 20:10:31 -05:00
Author
Owner
Copy Link
Copy Source

@Guofu1149 commented on GitHub (Dec 15, 2025):

in dify/docker/ssrf, I find a squid.config.template file. Do I need to write something in it? Please teach me the usage of ssrf proxy and how it works?

@Guofu1149 commented on GitHub (Dec 15, 2025): in dify/docker/ssrf, I find a squid.config.template file. Do I need to write something in it? Please teach me the usage of ssrf proxy and how it works?
yindo commented 2026-02-21 20:10:32 -05:00
Author
Owner
Copy Link
Copy Source

@Guofu1149 commented on GitHub (Dec 15, 2025):

in dify/docker/ssrf, I find a squid.config.template file. Do I need to write something in it? Please teach me the usage of ssrf proxy and how it works?
@dosu.

@Guofu1149 commented on GitHub (Dec 15, 2025): in dify/docker/ssrf, I find a squid.config.template file. Do I need to write something in it? Please teach me the usage of ssrf proxy and how it works? [@dosu](https://go.dosu.dev/dosubot).
yindo commented 2026-02-21 20:10:32 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 15, 2025):

The squid.config.template file is the configuration template for the ssrf_proxy (Squid proxy) service in Dify's Docker setup. By default, it only allows outbound HTTP(S) access to .marketplace.dify.ai and blocks all other external domains for security. If you need to allow access to more external domains or set up an upstream proxy (for example, to comply with your organization's network policies), you should edit this file—add new ACL entries and http_access allow rules for the domains you want to permit, or uncomment and configure the cache_peer line for an upstream proxy. After making changes, restart the ssrf_proxy container for them to take effect.

ssrf_proxy works by routing all HTTP(S) traffic from internal services (like the sandbox) through itself, enforcing strict outbound access control and protecting against SSRF attacks. The template uses environment variables (like HTTP_PORT, SANDBOX_HOST) that are filled in at container startup, and the entrypoint script generates the final Squid config and starts the proxy. For more details, see the template file and docker-compose setup.

If you want to whitelist more domains or use a corporate proxy, edit squid.config.template accordingly and restart the service.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 15, 2025): <!-- Answer --> The squid.config.template file is the configuration template for the ssrf_proxy (Squid proxy) service in Dify's Docker setup. By default, it only allows outbound HTTP(S) access to .marketplace.dify.ai and blocks all other external domains for security. If you need to allow access to more external domains or set up an upstream proxy (for example, to comply with your organization's network policies), you should edit this file—add new ACL entries and http_access allow rules for the domains you want to permit, or uncomment and configure the cache_peer line for an upstream proxy. After making changes, restart the ssrf_proxy container for them to take effect. ssrf_proxy works by routing all HTTP(S) traffic from internal services (like the sandbox) through itself, enforcing strict outbound access control and protecting against SSRF attacks. The template uses environment variables (like HTTP_PORT, SANDBOX_HOST) that are filled in at container startup, and the entrypoint script generates the final Squid config and starts the proxy. For more details, see the [template file](https://github.com/langgenius/dify/blob/a232da564a23314ed9ad3b9da5695cb6de76b6d2/docker/ssrf_proxy/squid.conf.template) and [docker-compose setup](https://github.com/langgenius/dify/blob/a232da564a23314ed9ad3b9da5695cb6de76b6d2/docker/docker-compose.yaml#L904-L1022). If you want to whitelist more domains or use a corporate proxy, edit squid.config.template accordingly and restart the service. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/ffede975-eb4b-412a-a4a0-ebdfc0ada824?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/ffede975-eb4b-412a-a4a0-ebdfc0ada824?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/ffede975-eb4b-412a-a4a0-ebdfc0ada824?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/ffede975-eb4b-412a-a4a0-ebdfc0ada824?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/ffede975-eb4b-412a-a4a0-ebdfc0ada824?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/ffede975-eb4b-412a-a4a0-ebdfc0ada824?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/ffede975-eb4b-412a-a4a0-ebdfc0ada824?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20squid.config.template%20file%20is%20the%20configuration%20template%20for%20the%20ssrf_proxy%20%28Squid%20proxy%29%20service%20in%20Dify%27s%20Docker%20setup.%20By%20default%2C%20it%20only%20allows%20outbound%20HTTP%28S%29%20access%20to%20.marketplace.dify.ai%20and%20blocks%20all%20other%20external%20domains%20for%20security.%20If%20you%20need%20to%20allow%20access%20to%20more%20external%20domains%20or%20set%20up%20an%20upstream%20proxy%20%28for%20example%2C%20to%20comply%20with%20your%20organization%27s%20network%20policies%29%2C%20you%20should%20edit%20this%20file%E2%80%94add%20new%20ACL%20entries%20and%20http_access%20allow%20rules%20for%20the%20domains%20you%20want%20to%20permit%2C%20or%20uncomment%20and%20configure%20the%20cache_peer%20line%20for%20an%20upstream%20proxy.%20After%20making%20changes%2C%20restart%20the%20ssrf_proxy%20container%20for%20them%20to%20take%20effect.%20%0A%0Assrf_proxy%20works%20by%20routing%20all%20HTTP%28S%29%20traffic%20from%20internal%20services%20%28like%20the%20sandbox%29%20through%20itself%2C%20enforcing%20strict%20outbound%20access%20control%20and%20protecting%20against%20SSRF%20attacks.%20The%20template%20uses%20environment%20variables%20%28like%20HTTP_PORT%2C%20SANDBOX_HOST%29%20that%20are%20filled%20in%20at%20container%20startup%2C%20and%20the%20entrypoint%20script%20generates%20the%20final%20Squid%20config%20and%20starts%20the%20proxy.%20For%20more%20details%2C%20see%20the%20%5Btemplate%20file%5D%28https%3A//github.com/langgenius/dify/blob/a232da564a23314ed9ad3b9da5695cb6de76b6d2/docker/ssrf_proxy/squid.conf.template%29%20and%20%5Bdocker-compose%20setup%5D%28https%3A//github.com/langgenius/dify/blob/a232da564a23314ed9ad3b9da5695cb6de76b6d2/docker/docker-compose.yaml%23L904-L1022%29.%20%0A%0AIf%20you%20want%20to%20whitelist%20more%20domains%20or%20use%20a%20corporate%20proxy%2C%20edit%20squid.config.template%20accordingly%20and%20restart%20the%20service.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29701)
yindo commented 2026-02-21 20:10:32 -05:00
Author
Owner
Copy Link
Copy Source

@Guofu1149 commented on GitHub (Dec 15, 2025):

So, if I don't use squid.config.template , only by editing in docker-compose.yaml and .env, I can still make Dify work correctly and use marketplase with HTTP_proxy and NO_PROXY args?

below is what I add in squid.config.template file. below is not actually working,right?

cache_peer s13242ad3432426.corpintra.net parent 3128 0 default name=corp_proxy
never_direct allow all

acl all src all
http_access allow all

@dosu.

@Guofu1149 commented on GitHub (Dec 15, 2025): So, if I don't use squid.config.template , only by editing in docker-compose.yaml and .env, I can still make Dify work correctly and use marketplase with HTTP_proxy and NO_PROXY args? below is what I add in squid.config.template file. below is not actually working,right? cache_peer s13242ad3432426.corpintra.net parent 3128 0 default name=corp_proxy never_direct allow all acl all src all http_access allow all [@dosu](https://go.dosu.dev/dosubot).
yindo commented 2026-02-21 20:10:32 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 15, 2025):

You do need both the HTTP_PROXY/NO_PROXY environment variables set in your .env and docker-compose.yaml, but that alone is not enough if the Squid proxy (ssrf_proxy) blocks outbound domains or ports. By default, Dify’s squid.config.template only allows access to .marketplace.dify.ai, so marketplace access will work out of the box, but any other external domains or a corporate proxy require you to edit squid.config.template and restart the ssrf_proxy container for changes to take effect (reference, reference).

Your current squid.config.template snippet is not working because it’s overly permissive and doesn’t follow Dify’s security model. For a corporate proxy, you should use a cache_peer directive like:

cache_peer s13242ad3432426.corpintra.net parent 3128 0 no-query no-digest no-netdb-exchange default
never_direct allow all

But you also need to ensure the rest of the config has proper ACLs and http_access rules to allow only the domains and ports you need, and comment out or adjust the reverse proxy to sandbox section if you’re not using it (reference). After editing, restart the ssrf_proxy container.

In summary: environment variables are necessary, but squid.config.template controls what the proxy actually allows. For marketplace access only, the default template is fine. For anything else, you must update squid.config.template and restart ssrf_proxy.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 15, 2025): <!-- Answer --> You do need both the HTTP_PROXY/NO_PROXY environment variables set in your `.env` and `docker-compose.yaml`, but that alone is not enough if the Squid proxy (ssrf_proxy) blocks outbound domains or ports. By default, Dify’s squid.config.template only allows access to `.marketplace.dify.ai`, so marketplace access will work out of the box, but any other external domains or a corporate proxy require you to edit squid.config.template and restart the ssrf_proxy container for changes to take effect ([reference](https://github.com/langgenius/dify/issues/26177), [reference](https://github.com/langgenius/dify/issues/14621)). Your current squid.config.template snippet is not working because it’s overly permissive and doesn’t follow Dify’s security model. For a corporate proxy, you should use a cache_peer directive like: ``` cache_peer s13242ad3432426.corpintra.net parent 3128 0 no-query no-digest no-netdb-exchange default never_direct allow all ``` But you also need to ensure the rest of the config has proper ACLs and http_access rules to allow only the domains and ports you need, and comment out or adjust the reverse proxy to sandbox section if you’re not using it ([reference](https://github.com/langgenius/dify/issues/14472)). After editing, restart the ssrf_proxy container. In summary: environment variables are necessary, but squid.config.template controls what the proxy actually allows. For marketplace access only, the default template is fine. For anything else, you must update squid.config.template and restart ssrf_proxy. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/c8c2c58c-d7ae-4186-91ef-d22a4b463e57?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/c8c2c58c-d7ae-4186-91ef-d22a4b463e57?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/c8c2c58c-d7ae-4186-91ef-d22a4b463e57?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/c8c2c58c-d7ae-4186-91ef-d22a4b463e57?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/c8c2c58c-d7ae-4186-91ef-d22a4b463e57?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/c8c2c58c-d7ae-4186-91ef-d22a4b463e57?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/c8c2c58c-d7ae-4186-91ef-d22a4b463e57?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=You%20do%20need%20both%20the%20HTTP_PROXY/NO_PROXY%20environment%20variables%20set%20in%20your%20%60.env%60%20and%20%60docker-compose.yaml%60%2C%20but%20that%20alone%20is%20not%20enough%20if%20the%20Squid%20proxy%20%28ssrf_proxy%29%20blocks%20outbound%20domains%20or%20ports.%20By%20default%2C%20Dify%E2%80%99s%20squid.config.template%20only%20allows%20access%20to%20%60.marketplace.dify.ai%60%2C%20so%20marketplace%20access%20will%20work%20out%20of%20the%20box%2C%20but%20any%20other%20external%20domains%20or%20a%20corporate%20proxy%20require%20you%20to%20edit%20squid.config.template%20and%20restart%20the%20ssrf_proxy%20container%20for%20changes%20to%20take%20effect%C2%A0%28%5Breference%5D%28https%3A//github.com/langgenius/dify/issues/26177%29%2C%20%5Breference%5D%28https%3A//github.com/langgenius/dify/issues/14621%29%29.%0A%0AYour%20current%20squid.config.template%20snippet%20is%20not%20working%20because%20it%E2%80%99s%20overly%20permissive%20and%20doesn%E2%80%99t%20follow%20Dify%E2%80%99s%20security%20model.%20For%20a%20corporate%20proxy%2C%20you%20should%20use%20a%20cache_peer%20directive%20like%3A%0A%0A%60%60%60%0Acache_peer%20s13242ad3432426.corpintra.net%20parent%203128%200%20no-query%20no-digest%20no-netdb-exchange%20default%0Anever_direct%20allow%20all%0A%60%60%60%0A%0ABut%20you%20also%20need%20to%20ensure%20the%20rest%20of%20the%20config%20has%20proper%20ACLs%20and%20http_access%20rules%20to%20allow%20only%20the%20domains%20and%20ports%20you%20need%2C%20and%20comment%20out%20or%20adjust%20the%20reverse%20proxy%20to%20sandbox%20section%20if%20you%E2%80%99re%20not%20using%20it%C2%A0%28%5Breference%5D%28https%3A//github.com/langgenius/dify/issues/14472%29%29.%20After%20editing%2C%20restart%20the%20ssrf_proxy%20container.%0A%0AIn%20summary%3A%20environment%20variables%20are%20necessary%2C%20but%20squid.config.template%20controls%20what%20the%20proxy%20actually%20allows.%20For%20marketplace%20access%20only%2C%20the%20default%20template%20is%20fine.%20For%20anything%20else%2C%20you%20must%20update%20squid.config.template%20and%20restart%20ssrf_proxy.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29701)
yindo commented 2026-02-21 20:10:32 -05:00
Author
Owner
Copy Link
Copy Source

@Guofu1149 commented on GitHub (Dec 15, 2025):

After I add http_proxy and no_proxy args in .env and docker-compose.yaml, Dify can work correctly and use marketplace.But now, my knowledge base cannot recall test using vector database! By the way, knowledge base can use Embedding model to segment ,it is ok.

Below is webUI error and log errors! What should I do?@dosu.

Query call with protocol GRPC search failed with message The request to Weaviate failed after 5 retries. Details: <_InactiveRpcError of RPC that terminated with: status = StatusCode.UNAVAILABLE details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403" debug_error_string = "UNKNOWN:Error received from peer {grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403", grpc_status:14}" >.

/dify/docker$ docker compose logs -t --tail=120 2>&1 | grep -i -E "error"
weaviate-1 | 2025-12-16T03:12:47.114743507Z {"action":"startup","build_git_commit":"6c571ff","build_go_version":"go1.22.8","build_image_tag":"","build_wv_version":"","level":"error","msg":"telemetry failed to start: push: failed to send request: Post "https://telemetry.weaviate.io/weaviate-telemetry": dial tcp 34.149.252.24:443: i/o timeout","time":"2025-12-16T03:12:47Z"}
api-1 | 2025-12-16T03:20:08.403620870Z 2025-12-16 03:20:08.403 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with:
api-1 | 2025-12-16T03:20:08.403632338Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"
api-1 | 2025-12-16T03:20:08.403635495Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}"
api-1 | 2025-12-16T03:20:09.405006071Z 2025-12-16 03:20:09.404 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with:
api-1 | 2025-12-16T03:20:09.405036672Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"
api-1 | 2025-12-16T03:20:09.405039973Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}"
api-1 | 2025-12-16T03:20:11.406591295Z 2025-12-16 03:20:11.406 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with:
api-1 | 2025-12-16T03:20:11.406621903Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"
api-1 | 2025-12-16T03:20:11.406625071Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}"
api-1 | 2025-12-16T03:20:15.408569701Z 2025-12-16 03:20:15.408 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with:
api-1 | 2025-12-16T03:20:15.408618933Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"
api-1 | 2025-12-16T03:20:15.408622387Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}"
api-1 | 2025-12-16T03:20:23.411352566Z 2025-12-16 03:20:23.410 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with:
api-1 | 2025-12-16T03:20:23.411415519Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"
api-1 | 2025-12-16T03:20:23.411425679Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}"
api-1 | 2025-12-16T03:20:39.413851166Z 2025-12-16 03:20:39.413 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection

Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with:
api-1 | 2025-12-16T03:20:39.413886805Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"
api-1 | 2025-12-16T03:20:39.413890025Z debug_error_string = "UNKNOWN:Error received from peer {grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403", grpc_status:14}"
nginx-1 | 2025-12-16T03:19:57.544616417Z 53.217.177.253 - - [16/Dec/2025:03:19:57 +0000] "GET /console/api/datasets/5fcecd41-2afe-4560-aa20-0d3131e606aa/error-docs HTTP/1.1" 200 22 "http://53.89.35.151/datasets/5fcecd41-2afe-4560-aa20-0d3131e606aa/documents" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" "53.88.202.69"
ssrf_proxy-1 | 2025-12-16T03:13:32.632198370Z 2025/12/16 03:13:32 pinger| SendEcho ERROR: sending to ICMPv6 packet to [2606:4700:20::681a:89c]: (101) Network is unreachable

@Guofu1149 commented on GitHub (Dec 15, 2025): After I add http_proxy and no_proxy args in .env and docker-compose.yaml, Dify can work correctly and use marketplace.But now, my knowledge base cannot recall test using vector database! By the way, knowledge base can use Embedding model to segment ,it is ok. Below is webUI error and log errors! What should I do?[@dosu](https://go.dosu.dev/dosubot). Query call with protocol GRPC search failed with message The request to Weaviate failed after 5 retries. Details: <_InactiveRpcError of RPC that terminated with: status = StatusCode.UNAVAILABLE details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403" debug_error_string = "UNKNOWN:Error received from peer {grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403", grpc_status:14}" >. /dify/docker$ docker compose logs -t --tail=120 2>&1 | grep -i -E "error" weaviate-1 | 2025-12-16T03:12:47.114743507Z {"action":"startup","build_git_commit":"6c571ff","build_go_version":"go1.22.8","build_image_tag":"","build_wv_version":"","level":"error","msg":"telemetry failed to start: push: failed to send request: Post \"https://telemetry.weaviate.io/weaviate-telemetry\": dial tcp 34.149.252.24:443: i/o timeout","time":"2025-12-16T03:12:47Z"} api-1 | 2025-12-16T03:20:08.403620870Z 2025-12-16 03:20:08.403 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with: api-1 | 2025-12-16T03:20:08.403632338Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403" api-1 | 2025-12-16T03:20:08.403635495Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}" api-1 | 2025-12-16T03:20:09.405006071Z 2025-12-16 03:20:09.404 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with: api-1 | 2025-12-16T03:20:09.405036672Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403" api-1 | 2025-12-16T03:20:09.405039973Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}" api-1 | 2025-12-16T03:20:11.406591295Z 2025-12-16 03:20:11.406 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with: api-1 | 2025-12-16T03:20:11.406621903Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403" api-1 | 2025-12-16T03:20:11.406625071Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}" api-1 | 2025-12-16T03:20:15.408569701Z 2025-12-16 03:20:15.408 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with: api-1 | 2025-12-16T03:20:15.408618933Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403" api-1 | 2025-12-16T03:20:15.408622387Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}" api-1 | 2025-12-16T03:20:23.411352566Z 2025-12-16 03:20:23.410 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with: api-1 | 2025-12-16T03:20:23.411415519Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403" api-1 | 2025-12-16T03:20:23.411425679Z debug_error_string = "UNKNOWN:Error received from peer {grpc_status:14, grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403"}" api-1 | 2025-12-16T03:20:39.413851166Z 2025-12-16 03:20:39.413 INFO [ThreadPoolExecutor-1_0] [retry.py:55] - Searching in collection Vector_index_5fcecd41_2afe_4560_aa20_0d3131e606aa_Node received exception: <_InactiveRpcError of RPC that terminated with: api-1 | 2025-12-16T03:20:39.413886805Z details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403" api-1 | 2025-12-16T03:20:39.413890025Z debug_error_string = "UNKNOWN:Error received from peer {grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:53.89.34.207:3128: HTTP proxy returned response code 403", grpc_status:14}" nginx-1 | 2025-12-16T03:19:57.544616417Z 53.217.177.253 - - [16/Dec/2025:03:19:57 +0000] "GET /console/api/datasets/5fcecd41-2afe-4560-aa20-0d3131e606aa/error-docs HTTP/1.1" 200 22 "http://53.89.35.151/datasets/5fcecd41-2afe-4560-aa20-0d3131e606aa/documents" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36" "53.88.202.69" ssrf_proxy-1 | 2025-12-16T03:13:32.632198370Z 2025/12/16 03:13:32 pinger| SendEcho ERROR: sending to ICMPv6 packet to [2606:4700:20::681a:89c]: (101) Network is unreachable
yindo commented 2026-02-21 20:10:32 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 15, 2025):

The 403 proxy error happens because internal API-to-Weaviate traffic is being routed through your proxy, which blocks it. To fix this, make sure your NO_PROXY and no_proxy environment variables (in both your .env and docker-compose.yaml) include all internal service names—especially weaviate, api, db, redis, plugin_daemon, web, worker, sandbox, ssrf_proxy, localhost, and 127.0.0.1. This ensures internal Docker traffic bypasses the proxy and avoids the 403 error [details][details][details].

Example for your .env:

NO_PROXY=localhost,127.0.0.1,weaviate,api,db,redis,plugin_daemon,web,worker,sandbox,ssrf_proxy
no_proxy=localhost,127.0.0.1,weaviate,api,db,redis,plugin_daemon,web,worker,sandbox,ssrf_proxy

And in docker-compose.yaml for each relevant service:

environment:
  HTTP_PROXY: ${HTTP_PROXY}
  HTTPS_PROXY: ${HTTPS_PROXY}
  http_proxy: ${http_proxy}
  https_proxy: ${https_proxy}
  NO_PROXY: ${NO_PROXY}
  no_proxy: ${no_proxy}

Also, check for global proxy settings in ~/.docker/config.json or your system environment that might override these variables—remove or adjust them if needed [details].

After updating, restart all your Docker Compose services. If the issue persists, test connectivity between the api and weaviate containers (e.g., with curl or grpcurl), and check for firewall or network restrictions on port 50051 [details].

Let me know if you need help with specific config or troubleshooting steps!

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 15, 2025): <!-- Answer --> The 403 proxy error happens because internal API-to-Weaviate traffic is being routed through your proxy, which blocks it. To fix this, make sure your NO_PROXY and no_proxy environment variables (in both your `.env` and `docker-compose.yaml`) include all internal service names—especially `weaviate`, `api`, `db`, `redis`, `plugin_daemon`, `web`, `worker`, `sandbox`, `ssrf_proxy`, `localhost`, and `127.0.0.1`. This ensures internal Docker traffic bypasses the proxy and avoids the 403 error [[details](https://github.com/langgenius/dify/issues/26177)][[details](https://github.com/langgenius/dify/issues/14608)][[details](https://github.com/langgenius/dify/issues/29698)]. Example for your `.env`: ``` NO_PROXY=localhost,127.0.0.1,weaviate,api,db,redis,plugin_daemon,web,worker,sandbox,ssrf_proxy no_proxy=localhost,127.0.0.1,weaviate,api,db,redis,plugin_daemon,web,worker,sandbox,ssrf_proxy ``` And in `docker-compose.yaml` for each relevant service: ```yaml environment: HTTP_PROXY: ${HTTP_PROXY} HTTPS_PROXY: ${HTTPS_PROXY} http_proxy: ${http_proxy} https_proxy: ${https_proxy} NO_PROXY: ${NO_PROXY} no_proxy: ${no_proxy} ``` Also, check for global proxy settings in `~/.docker/config.json` or your system environment that might override these variables—remove or adjust them if needed [[details](https://github.com/langgenius/dify/issues/18904)]. After updating, restart all your Docker Compose services. If the issue persists, test connectivity between the `api` and `weaviate` containers (e.g., with `curl` or `grpcurl`), and check for firewall or network restrictions on port 50051 [[details](https://github.com/langgenius/dify/issues/29698)]. Let me know if you need help with specific config or troubleshooting steps! <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/e7c9df5c-f770-4f2a-b4e8-fa65fc0477a5?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/e7c9df5c-f770-4f2a-b4e8-fa65fc0477a5?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/e7c9df5c-f770-4f2a-b4e8-fa65fc0477a5?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/e7c9df5c-f770-4f2a-b4e8-fa65fc0477a5?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/e7c9df5c-f770-4f2a-b4e8-fa65fc0477a5?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/e7c9df5c-f770-4f2a-b4e8-fa65fc0477a5?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/e7c9df5c-f770-4f2a-b4e8-fa65fc0477a5?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=The%20403%20proxy%20error%20happens%20because%20internal%20API-to-Weaviate%20traffic%20is%20being%20routed%20through%20your%20proxy%2C%20which%20blocks%20it.%20To%20fix%20this%2C%20make%20sure%20your%20NO_PROXY%20and%20no_proxy%20environment%20variables%20%28in%20both%20your%20%60.env%60%20and%20%60docker-compose.yaml%60%29%20include%20all%20internal%20service%20names%E2%80%94especially%20%60weaviate%60%2C%20%60api%60%2C%20%60db%60%2C%20%60redis%60%2C%20%60plugin_daemon%60%2C%20%60web%60%2C%20%60worker%60%2C%20%60sandbox%60%2C%20%60ssrf_proxy%60%2C%20%60localhost%60%2C%20and%20%60127.0.0.1%60.%20This%20ensures%20internal%20Docker%20traffic%20bypasses%20the%20proxy%20and%20avoids%20the%20403%20error%20%5B%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/26177%29%5D%5B%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/14608%29%5D%5B%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/29698%29%5D.%0A%0AExample%20for%20your%20%60.env%60%3A%0A%60%60%60%0ANO_PROXY%3Dlocalhost%2C127.0.0.1%2Cweaviate%2Capi%2Cdb%2Credis%2Cplugin_daemon%2Cweb%2Cworker%2Csandbox%2Cssrf_proxy%0Ano_proxy%3Dlocalhost%2C127.0.0.1%2Cweaviate%2Capi%2Cdb%2Credis%2Cplugin_daemon%2Cweb%2Cworker%2Csandbox%2Cssrf_proxy%0A%60%60%60%0AAnd%20in%20%60docker-compose.yaml%60%20for%20each%20relevant%20service%3A%0A%60%60%60yaml%0Aenvironment%3A%0A%20%20HTTP_PROXY%3A%20%24%7BHTTP_PROXY%7D%0A%20%20HTTPS_PROXY%3A%20%24%7BHTTPS_PROXY%7D%0A%20%20http_proxy%3A%20%24%7Bhttp_proxy%7D%0A%20%20https_proxy%3A%20%24%7Bhttps_proxy%7D%0A%20%20NO_PROXY%3A%20%24%7BNO_PROXY%7D%0A%20%20no_proxy%3A%20%24%7Bno_proxy%7D%0A%60%60%60%0A%0AAlso%2C%20check%20for%20global%20proxy%20settings%20in%20%60~/.docker/config.json%60%20or%20your%20system%20environment%20that%20might%20override%20these%20variables%E2%80%94remove%20or%20adjust%20them%20if%20needed%20%5B%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/18904%29%5D.%0A%0AAfter%20updating%2C%20restart%20all%20your%20Docker%20Compose%20services.%20If%20the%20issue%20persists%2C%20test%20connectivity%20between%20the%20%60api%60%20and%20%60weaviate%60%20containers%20%28e.g.%2C%20with%20%60curl%60%20or%20%60grpcurl%60%29%2C%20and%20check%20for%20firewall%20or%20network%20restrictions%20on%20port%2050051%20%5B%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/29698%29%5D.%0A%0ALet%20me%20know%20if%20you%20need%20help%20with%20specific%20config%20or%20troubleshooting%20steps%21)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29701)
yindo commented 2026-02-21 20:10:32 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Dec 15, 2025):

This is only for bug report, if you would like to ask a question, please head to Discussions.

@crazywoola commented on GitHub (Dec 15, 2025): This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🙋‍♂️ question
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#21064
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?