How to self-host Dify 1.17.1 on your own VPS, no Docker

ox new <you>/dify
ox review dify --from-file dify.env --wait

# Dify 1.17.1 on ox: the processes of docker/docker-compose.yaml without Docker.
#   [app]          web: the Next.js standalone server (web/Dockerfile, web/docker/entrypoint.sh)
#   api            the Flask API and its socket.io (api/docker/entrypoint.sh MODE=api), at the paths nginx sends it
#   worker, beat   Celery (MODE=worker, MODE=beat)
#   plugin-daemon  langgenius/dify-plugin-daemon 0.6.10 (the compose image's tag), built from source
# Not run: nginx (ox's proxy routes the paths below), ssrf_proxy, sandbox,
# agent_backend and local_sandbox (Docker or root only; Dify works without them,
# the Code node and Agent v2 aside).

# The first admin: setup_admin.py makes it in migrate, as /install's form does.
required_variables = ["DIFY_ADMIN_EMAIL", "DIFY_ADMIN_PASSWORD"]

# api/Dockerfile's apt packages: gmpy2's headers, CJK fonts, mime types, libmagic.
packages = ["libgmp-dev", "libmpfr-dev", "libmpc-dev", "fonts-noto-cjk", "media-types", "libmagic1t64"]

[app]
start = "exec bash ox/web.sh"

[build]
# web/Dockerfile's workspace install, then api/Dockerfile's venv.
install = "pnpm install --frozen-lockfile --ignore-scripts && cd api && uv sync --frozen --no-dev --no-editable"
commands = [
  # web/Dockerfile: next build with its heap and its skipped deps check, and
  # the standalone layout its production stage copies. --webpack: on 8 CPUs
  # Turbopack's build held 13.2 GiB at its peak, past the 12 GB a build gets
  # on the 16 GB server (killed 3 of 3 times at 12G), and webpack's 6.0 GiB
  # (measured 2026-10-17).
  "cd web && NODE_OPTIONS=--max-old-space-size=4096 pnpm_config_verify_deps_before_run=false pnpm build --webpack && cp -r public .next/standalone/web/public && mkdir -p .next/standalone/web/.next && cp -r .next/static .next/standalone/web/.next/static",
  # api/Dockerfile: the NLTK data and the tiktoken cache the image bakes in (ox/api.sh points at both).
  # -d names the folder: the Dockerfile makes it first, and without either the
  # downloader picks ~/nltk_data. The find fails the build if any is missing.
  "cd api && .venv/bin/python -m nltk.downloader -d \"$PWD/nltk_data\" punkt_tab averaged_perceptron_tagger_eng stopwords && NLTK_DATA=\"$PWD/nltk_data\" .venv/bin/python -c \"import nltk; nltk.data.find('tokenizers/punkt_tab'); nltk.data.find('taggers/averaged_perceptron_tagger_eng'); nltk.data.find('corpora/stopwords')\"",
  "cd api && TIKTOKEN_CACHE_DIR=\"$PWD/.tiktoken_cache\" .venv/bin/python -c \"import tiktoken; tiktoken.encoding_for_model('gpt2')\"",
  # The plugin daemon at the commit of its tag 0.6.10, built as docker/local.dockerfile builds it.
  """
  src=$(mktemp -d)
  git -C "$src" init -q
  git -C "$src" fetch -q --depth 1 https://github.com/langgenius/dify-plugin-daemon.git 1310a18b2f6bc6f18768a0a6265484830891433c
  git -C "$src" checkout -q FETCH_HEAD
  mkdir -p .ox/bin
  (cd "$src" && go build -ldflags "-X 'github.com/langgenius/dify-plugin-daemon/pkg/manifest.VersionX=0.6.10'" -o "$OLDPWD/.ox/bin/plugin-daemon" ./cmd/server \
    && go build -ldflags "-X 'main.VersionX=0.6.10'" -o "$OLDPWD/.ox/bin/plugin-daemon-cli" ./cmd/commandline)
  rm -rf "$src"
  """,
]
# entrypoint.sh's MIGRATION_ENABLED=true (flask upgrade-db), the plugin daemon's
# `commandline migrate`, then the first admin.
migrate = "bash ox/api.sh migrate && bash ox/plugin-daemon.sh migrate && bash ox/api.sh admin"

[workers]
api = { run = "exec bash ox/api.sh api", port = true, health = "/health", paths = ["/console/api", "/api", "/v1", "/openapi", "/files", "/mcp", "/triggers", "/socket.io"] }
worker = { run = "exec bash ox/api.sh worker", stop_timeout = "10m" }
beat = "exec bash ox/api.sh beat"
# Named so ox gives the api PLUGIN_DAEMON_URL, the key it reads. /e is its endpoints' path.
plugin-daemon = { run = "exec bash ox/plugin-daemon.sh", port = true, health = "/health/check", paths = ["/e"] }

[services]
postgres = { extensions = ["vector"] }  # Dify's database, and its pgvector store (VECTOR_STORE=pgvector)
plugin   = { type = "postgres" }        # the plugin daemon's own database (compose's dify_plugin)
redis    = {}

[storage]
# OPENDAL_FS_ROOT=storage is api/storage (uploads, and each workspace's key with
# KEY_PROVIDER_TYPE=local); docker/volumes/plugin_daemon is the daemon's /app/storage.
keep = ["api/storage", "docker/volumes/plugin_daemon"]

[tools]
python = "3.12"  # api/pyproject.toml: requires-python ~=3.12.0
uv     = "0.8.9" # api/Dockerfile's UV_VERSION
go     = "1.26"  # the plugin daemon's go.mod and its Dockerfile's golang:1.26

#!/usr/bin/env bash
# The api image (api/Dockerfile) in one mode: its environment with /app/api as
# the release's api/, then what its entrypoint runs.
#   api, worker, beat  api/docker/entrypoint.sh with that MODE
#   migrate            the entrypoint's MIGRATION_ENABLED step, `flask upgrade-db`
#   admin              the first admin, from DIFY_ADMIN_EMAIL and DIFY_ADMIN_PASSWORD
set -eo pipefail
cd "$(dirname "$0")/../api"
export VIRTUAL_ENV="$PWD/.venv" PATH="$PWD/.venv/bin:$PATH" FLASK_APP=app.py \
  NLTK_DATA="$PWD/nltk_data" TIKTOKEN_CACHE_DIR="$PWD/.tiktoken_cache"
case $1 in
  api) export MODE=api DIFY_BIND_ADDRESS=127.0.0.1 DIFY_PORT="$PORT" ;;
  worker) export MODE=worker ;;
  # Beat's schedule (a Berkeley DB of each task's last run, celerybeat-schedule
  # in its cwd by default) lives in the data dir: in the release a deploy
  # would lose it, and each deploy would restart every interval task's wait.
  # celery reads CELERY_BEAT_SCHEDULE as `beat --schedule` (auto_envvar_prefix).
  beat) export MODE=beat CELERY_BEAT_SCHEDULE="$OX_DATA_DIR/celerybeat-schedule" ;;
  migrate) exec flask upgrade-db ;;
  admin) PYTHONPATH="$PWD" exec python ../ox/setup_admin.py ;;
  *) echo "ox/api.sh: unknown mode '$1'" >&2; exit 2 ;;
esac
unset MIGRATION_ENABLED
exec bash docker/entrypoint.sh

#!/usr/bin/env bash
# Dify's plugin daemon (docker-compose.yaml's plugin_daemon) with the compose
# file's environment, /app/storage being the kept docker/volumes/plugin_daemon.
# `migrate` runs its migrations (the image's `commandline migrate`); with no
# argument it serves on $PORT.
# DB_* are Dify's own database, so the daemon's come from the `plugin` entry
# (compose gives it DB_DATABASE=dify_plugin on the same server).
set -eo pipefail
cd "$(dirname "$0")/.."
storage=$(realpath docker/volumes/plugin_daemon)
export PLATFORM=local GIN_MODE=release \
  SERVER_HOST=127.0.0.1 SERVER_KEY="$PLUGIN_DAEMON_KEY" \
  DIFY_INNER_API_URL="$API_URL" DIFY_INNER_API_KEY="$INNER_API_KEY_FOR_PLUGIN" \
  DB_TYPE=postgresql DB_HOST="$PLUGIN_DB_HOST" DB_PORT="$PLUGIN_DB_PORT" DB_USERNAME="$PLUGIN_DB_USERNAME" \
  DB_PASSWORD="$PLUGIN_DB_PASSWORD" DB_DATABASE="$PLUGIN_DB_DATABASE" DB_SSL_MODE=disable \
  PLUGIN_STORAGE_TYPE=local PLUGIN_STORAGE_LOCAL_ROOT="$storage" PLUGIN_WORKING_PATH="$storage/cwd" \
  PLUGIN_INSTALLED_PATH=plugin PLUGIN_PACKAGE_CACHE_PATH=plugin_packages PLUGIN_MEDIA_CACHE_PATH=assets \
  PLUGIN_REMOTE_INSTALLING_ENABLED=false FORCE_VERIFYING_SIGNATURE=true \
  PYTHON_ENV_INIT_TIMEOUT=120 PLUGIN_MAX_EXECUTION_TIMEOUT=600 MAX_PLUGIN_PACKAGE_SIZE=52428800 \
  PYTHON_INTERPRETER_PATH="$(readlink -f api/.venv/bin/python)" UV_PATH="$(command -v uv)"
bin=$PWD/.ox/bin
# The daemon reads a .env in its folder (godotenv): the storage folder has none.
cd "$storage"
if [ "${1:-}" = migrate ]; then
  exec "$bin/plugin-daemon-cli" migrate
fi
export SERVER_PORT="$PORT"
exec "$bin/plugin-daemon"

"""Dify's first admin from DIFY_ADMIN_EMAIL and DIFY_ADMIN_PASSWORD (and
DIFY_ADMIN_NAME), made by the service /install's form calls (POST
/console/api/setup), so the first visitor cannot claim the instance. Safe to
rerun: once Dify is set up it changes nothing."""

import os

from app import app
from extensions.ext_application_services import application_services
from libs.password import valid_password
from services.setup_service import SetupAlreadyCompletedError, SetupInput

with app.app_context():
    email = os.environ["DIFY_ADMIN_EMAIL"].strip().lower()
    name = os.environ.get("DIFY_ADMIN_NAME") or email.split("@")[0]
    try:
        application_services().setup.initialize(
            SetupInput(
                email=email,
                name=name,
                password=valid_password(os.environ["DIFY_ADMIN_PASSWORD"]),
                ip_address="127.0.0.1",
                language="en-US",
            ),
            initialization_validated=True,
        )
    except SetupAlreadyCompletedError:
        print("Dify is already set up: the admin is unchanged.")
    else:
        print(f"Made the Dify admin {email}.")

#!/usr/bin/env bash
# The web image (web/Dockerfile's production stage): web/docker/entrypoint.sh's
# NEXT_PUBLIC_* exports, then the Next.js standalone server it starts (the
# vinext target, off by default, is not built). Bound to 127.0.0.1 on $PORT
# behind ox's proxy.
set -eo pipefail
cd "$(dirname "$0")/.."
export NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=127.0.0.1
# The collaboration socket is the api's /socket.io on this site.
if [ -z "${NEXT_PUBLIC_SOCKET_URL:-}" ]; then
  if [ "$PUBLIC_SCHEME" = https ]; then scheme=wss; else scheme=ws; fi
  export NEXT_PUBLIC_SOCKET_URL="$scheme://$PUBLIC_HOST"
fi
source <(sed '/EXPERIMENTAL_ENABLE_VINEXT/,$d' web/docker/entrypoint.sh)
cd web/.next/standalone/web
exec node server.js

SECRET_KEY
CONSOLE_API_URL
CONSOLE_WEB_URL
SERVICE_API_URL
APP_API_URL
APP_WEB_URL
FILES_URL
TRIGGER_URL
ENDPOINT_URL_TEMPLATE
CONSOLE_CORS_ALLOW_ORIGINS
WEB_API_CORS_ALLOW_ORIGINS
SERVER_CONSOLE_API_URL
DEPLOY_ENV
DB_TYPE
DB_HOST
DB_PORT
DB_USERNAME
DB_PASSWORD
DB_DATABASE
REDIS_HOST
REDIS_PORT
REDIS_PASSWORD
REDIS_DB
CELERY_BROKER_URL
STORAGE_TYPE
OPENDAL_SCHEME
OPENDAL_FS_ROOT
VECTOR_STORE
PGVECTOR_HOST
PGVECTOR_PORT
PGVECTOR_USER
PGVECTOR_PASSWORD
PGVECTOR_DATABASE
PLUGIN_DAEMON_KEY
INNER_API_KEY_FOR_PLUGIN
PLUGIN_DB_HOST
PLUGIN_DB_PORT
PLUGIN_DB_USERNAME
PLUGIN_DB_PASSWORD
PLUGIN_DB_DATABASE
MARKETPLACE_URL
MARKETPLACE_API_URL
DIFY_ADMIN_EMAIL
DIFY_ADMIN_NAME
DIFY_ADMIN_PASSWORD