Production Deployment - Dify Enterprise Docs

Requirements

If you can scale resources as needed, or refer to our Performance Tuning documentation.

Kubernetes Cluster
- 6 Worker Nodes: 8 CPU, 32 GB RAM each
Container Registry (Plugins)
- AWS ECR (with AK/SK or IRSA) / Azure ACR / Aliyun ACR (with AK/SK) / Tencent TCR (with AK/SK) / Dockerhub / Google Artifact Registry
Persistent Storage
- S3 / AWS S3 (with AK/SK or IRSA) / Azure Blob / Aliyun OSS (with AK/SK) / Tencent COS (with AK/SK) / Google GCS
- 512 GB Storage
Postgres Database
- Version 14+
- 8 CPU, 16 GB RAM
- At least 512G SSD
Redis Database
- Version 6+
- 2 GB RAM
Vector Database VM - Qdrant Cluster
- 3 VMs
- 8 CPU, 64 GB RAM
- 100 GB Storage

Dify Service Resource `limits`

workerBeat should always run as a single replica.

Services	Replicas	CPU	RAM - GB	Total CPU	Total RAM - GB
api	6	1	2	9	12
worker	9	1	2	6	18
workerBeat	1	1	1	1	1
web	3	1	1	3	3
sandbox	3	1	2	3	6
enterprise	3	1	2	3	6
enterpriseAudit	3	1	2	3	6
enterpriseFrontend	3	1	1	3	3
enterpriseCollector	1	1	1	1	1
ssrfProxy	3	1	1	3	3
unstructured	3	1	2	3	6
plugin_daemon	3	1	3	3	9
plugin_controller	3	1	2	3	6
plugin_connector	3	1	2	3	6
plugin_manager	3	1	2	3	6
gateway	3	1	2	3	6
agentBackend	1	1	2	1	2
sandboxGateway	1	1	1	1	1
			Total	54	101

Sandbox Pods are created dynamically per Agent session and are not included in the table above. Running N concurrent Agent sessions requires extra headroom of roughly (N + warmPoolReplicas) x per-sandbox limits (1 CPU / 1 GB by default), and the agent-sandbox controller must be pre-installed in the cluster. See Agent Sandbox Deployment.

Deployment

1. Get Helm Repository Info

helm repo add dify https://langgenius.github.io/dify-helm
helm repo update

For more information, please refer to Dify Helm Chart.

2. Save Helm Chart Values

Save Helm chart values to a file named values.yaml.
Update the values.yaml file with your configuration.

Please replace the #REPLACE_ME# placeholder with your actual values.
Please replace “dify123456” with your own value.
global.appSecretKey and enterprise.appSecretKey must be different.

###################################
# Please replace "dify123456" with your own value
###################################
global:
  appSecretKey: 'dify123456'
  innerApiKey: 'dify123456'
  consoleApiDomain: "console.dify.local"
  consoleWebDomain: "console.dify.local"
  serviceApiDomain: "api.dify.local"
  appApiDomain: "app.dify.local"
  appWebDomain: "app.dify.local"
  filesDomain: "upload.dify.local"
  enterpriseDomain: "enterprise.dify.local"

ingress:
  enabled: true
  className: "nginx"
  annotations: {
    # set file upload size limit
    nginx.ingress.kubernetes.io/proxy-body-size: "15m"
  }

api:
  replicas: 6
  serverWorkerAmount: 1
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
worker:
  replicas: 9
  celeryWorkerAmount: 1
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
workerBeat:
  resources:
    limits:
      cpu: 1000m
      memory: 1024Mi
    requests:
      cpu: 500m
      memory: 512Mi
web:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 1024Mi
    requests:
      cpu: 500m
      memory: 512Mi
sandbox:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
agentBackend:
  serverSecretKey: "#REPLACE_ME#"
enterprise:
  replicas: 3
  appSecretKey: "dify123456"
  adminAPIsSecretKeySalt: "dify123456"
  passwordEncryptionKey: "dify123456"
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
enterpriseAudit:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
enterpriseFrontend:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 1024Mi
    requests:
      cpu: 500m
      memory: 512Mi
ssrfProxy:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 1024Mi
    requests:
      cpu: 500m
      memory: 512Mi
unstructured:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
plugin_daemon:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 3072Mi
    requests:
      cpu: 500m
      memory: 1536Mi
plugin_controller:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
plugin_connector:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
plugin_manager:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi
gateway:
  replicas: 3
  resources:
    limits:
      cpu: 1000m
      memory: 2048Mi
    requests:
      cpu: 500m
      memory: 1024Mi

###################################
# Persistence Configration
###################################
persistence:
  type: "s3"
  s3:
    endpoint: "https://xxx.r2.cloudflarestorage.com"
    accessKey: "#REPLACE_ME#"
    secretKey: "#REPLACE_ME#"
    region: "us-east-1"
    bucketName: "your-bucket-name"
    addressType: ""
    useAwsManagedIam: false
    useAwsS3: true

###################################
# External database (Postgres/MySQL/TiDB) v3.9.0 configuration
###################################
externalDatabase:
  enabled: false
  # postgres | mysql | tidb
  engine: "postgres"
  host: "localhost"
  # Default ports: postgres=5432, mysql=3306, tidb=4000
  # Note: when switching engine, remember to update port accordingly
  port: 5432
  user: "postgres"
  password: "#REPLACE_ME#"
  timezone: "UTC"
  databases:
    dify: "dify"
    plugin_daemon: "dify_plugin_daemon"
    enterprise: "enterprise"
    audit: "audit"
  dialectOptions:
    postgres:
      sslMode: "require"
      uriScheme: "postgresql"
      # extras: "options=-c search_path=your-schema -c your-other-option=xxx"
      extras: ""
    mysql:
      # MySQL/TiDB params, e.g. charset=utf8mb4&parseTime=true&loc=UTC
      params: "charset=utf8mb4&parseTime=true&loc=UTC"
      tls: false

###################################
# External database (Postgres/MySQL/TiDB) v3.9.1 configuration
###################################
externalDatabase:
  enabled: false
  # postgres | mysql | tidb
  engine: "postgres"
  host: "localhost"

  # Default ports: postgres=5432, mysql=3306, tidb=4000
  # Note: when switching engine, remember to update port accordingly
  port: 5432

  # Global database credentials (used by default)
  user: "postgres"
  password: "#REPLACE_ME#"

  timezone: "UTC"

  databases:
    dify: "dify"
    plugin_daemon: "dify_plugin_daemon"
    enterprise: "enterprise"
    audit: "audit"

  ###################################
  # Per-database credentials (optional)
  ###################################
  # Configure username and password independently for each database
  # These take precedence over the global user/password
  # If empty, fallback to the global credentials
  databaseCredentials:
    dify:
      user: ""
      password: ""
    enterprise:
      user: ""
      password: ""
    audit:
      user: ""
      password: ""
    plugin_daemon:
      user: ""
      password: ""

  dialectOptions:
    postgres:
      sslMode: "require"
      uriScheme: "postgresql"
      # extras: "options=-c search_path=your-schema -c your-other-option=xxx"
      extras: ""

    mysql:
      # MySQL/TiDB params, e.g. charset=utf8mb4&parseTime=true&loc=UTC
      params: "charset=utf8mb4&parseTime=true&loc=UTC"
      tls: false

###################################
# External Redis
###################################
externalRedis:
  enabled: true
  host: "#REPLACE_ME#"
  port: 6379
  username: ""
  password: "#REPLACE_ME#"
  useSSL: false

###################################
# External Qdrant
###################################
vectorDB:
  useExternal: true
  externalType: "qdrant"
  externalQdrant:
    endpoint: "http://your-qdrant-cluster-url.qdrant.tech/"
    apiKey: "#REPLACE_ME#"

imagePullSecrets: []

3. Configure `Container Registry`

3.1 Configure Plugin Container Registry
- For more information, please refer to Container Registry Configuration for Plugins.
3.2 Configure Service Container Registry
- For more information, please refer to Container Registry Configuration.

4. Configure `Persistence Storage`

For more information, please refer to Persistence Storage.

5. Configure `External Database`

For more information, please refer to External Database.

6. Configure `External Redis`

For more information, please refer to External Redis.

7. Configure `External Qdrant`

For more information, please refer to External Qdrant Cluster.

8. Configure `Ingress Controller`

For more information, please refer to Ingress Controller Configuration.

9. Install Dify Helm Chart

helm upgrade -i dify -f values.yaml dify/dify

10. Verify Installation Results

For more information, please refer to Service Status Verification.

Advanced Configuration

1. Domain and SSL Certificate

For more information, please refer to Domain and SSL Certificate Configuration.

2. Email Service Provider

For more information, please refer to Email Service Configuration.

3. Performance Tuning

For more information, please refer to Performance Tuning.

​Requirements

​Dify Service Resource limits

​Deployment

​1. Get Helm Repository Info

​2. Save Helm Chart Values

​3. Configure Container Registry

​4. Configure Persistence Storage

​5. Configure External Database

​6. Configure External Redis

​7. Configure External Qdrant

​8. Configure Ingress Controller

​9. Install Dify Helm Chart

​10. Verify Installation Results

​Advanced Configuration

​1. Domain and SSL Certificate

​2. Email Service Provider

​3. Performance Tuning

Requirements

Dify Service Resource `limits`

Deployment

1. Get Helm Repository Info

2. Save Helm Chart Values

3. Configure `Container Registry`

4. Configure `Persistence Storage`

5. Configure `External Database`

6. Configure `External Redis`

7. Configure `External Qdrant`

8. Configure `Ingress Controller`

9. Install Dify Helm Chart

10. Verify Installation Results

Advanced Configuration

1. Domain and SSL Certificate

2. Email Service Provider

3. Performance Tuning