diff --git a/en/getting-started/install-self-hosted/install-faq.md b/en/getting-started/install-self-hosted/install-faq.md index a66e1f8..7196a7e 100644 --- a/en/getting-started/install-self-hosted/install-faq.md +++ b/en/getting-started/install-self-hosted/install-faq.md @@ -42,52 +42,6 @@ This may be due to switching the domain name/website, causing cross-domain betwe `CONSOLE_CORS_ALLOW_ORIGINS` Console CORS cross-domain policy, default to `*`, which allows access from all domain names. `WEB_API_CORS_ALLOW_ORIGINS` WebAPP CORS cross-domain strategy, default to `*`, which allows access from all domain names. -**Cookie policy configuration** - -The cookie policy is divided into three configurations `HttpOnly`, `SameSite` and `Secure`. - -`HttpOnly`: Default to true, normally does not need to be modified, used to prevent XSS attacks, that is, JS can not get the content of the cookie, only carry it on Http requests. - -`SameSite`: Divided into three gears, Strict, Lax and None, but because Dify needs to be able to get identity information from cookies when authorizing callback from external domains such as Github and Google, it can only be chosen between Lax and None, of which None can be completely cross-domain accessed. - -`Secure`: This parameter restricts whether the server interface must be under HTTPS in order for the Cookie to be saved locally, and it must be true in cross-domain scenarios (except for localhost / 127.0.0.1 on different ports), otherwise the browser will not pass. - -**Recommended Configuration** - -According to the configuration description, we recommend the following configuration in these three scenarios: - -1. Local debug (default policy) Development mode same domain policy. Support HTTP / HTTPS protocol, but need to ensure that the front-end page and interface are under the same domain. - -``` -WEB_API_CORS_ALLOW_ORIGINS:'' -CONSOLE_CORS_ALLOW_ORIGINS: '' -COOKIE_HTTPONLY:'true' -COOKIE_SAMESITE: 'Lax' -COOKIE_SECURE: 'false' -``` - -2. Cross-Domain Policy (do not use in production) Cross-domain between server and web client, server must be HTTPS. Since SameSite=None must be coupled with Secure=true, the server must be in the `HTTPS` protocol in order to cross-domain access, which can be used in the server remotely and provide `HTTPS` protocol support, or local start-up server and front-end project (localhost, but different ports, tested available, although prompt warning). - -``` -WEB_API_CORS_ALLOW_ORIGINS: 'https://your-domain-for-web-app' -CONSOLE_CORS_ALLOW_ORIGINS: 'https://your-domain-for-console' -COOKIE_HTTPONLY: 'true' -COOKIE_SAMESITE: 'None' -COOKIE_SECURE: 'true' -``` - -3.Production Policy Strict Mode. Due to the need to support callbacks and cookies for some third-party integration, it is not possible to use the highest Strict policy, so it is necessary to strictly limit the CORS domain name and set the cookie policy to SameSite=Lax, Secure=true. - -``` -WEB_API_CORS_ALLOW_ORIGINS: 'https://your-domain-for-web-app' -CONSOLE_CORS_ALLOW_ORIGINS: 'https://your-domain-for-console' -COOKIE_HTTPONLY: 'true' -COOKIE_SAMESITE: 'Lax' -COOKIE_SECURE: 'true' -``` - -Unavailable scenarios When the front end and back end are cross-domain and the server-side is http protocol, no Cookie policy can support this scenario. Please adjust the back end to HTTPS protocol or set to the same domain. - ### 4. After starting, the page keeps loading and checking the request prompts CORS error? This may be because the domain name/URL has been switched, resulting in cross-domain between the front end and the back end. Please change all the following configuration items in `docker-compose.yml` to the new domain name: `CONSOLE_API_URL:` The backend URL of the console API. `CONSOLE_WEB_URL:` The front-end URL of the console web. `SERVICE_API_URL:` Service API Url `APP_API_URL:` WebApp API backend Url. `APP_WEB_URL:` WebApp Url. @@ -123,11 +77,11 @@ Modify in the `tenants` table in the database. ### 8. Where can I modify the domain name for accessing the application? -Find the configuration domain name APP\_WEB\_URL in `docker_compose. yal`. +Find the configuration domain name APP\_WEB\_URL in `docker_compose.yaml`. ### 9. If database migration is required, what things need to be backed up? -The database, configured storage, and vector database data need to be backed up. If deployed in Docker Compose mode, all data content in the `dify/Docker/volumes` directory can be directly backed up. +The database, configured storage, and vector database data need to be backed up. If deployed in Docker Compose mode, all data content in the `dify/docker/volumes` directory can be directly backed up. ### 10. Why is Docker deploying Dify and starting OpenLLM locally using 127.0.0.1, but unable to access the local port? @@ -147,41 +101,41 @@ Local deployment edition, members can be invited through email. After entering t This is because the port is occupied. You can use the `netstat -tunlp | grep 80` command to view the process that occupies the port, and then kill the process. For example, the apache and nginx processes occupy the port, you can use the `service apache2 stop` and `service nginx stop` commands to stop the process. -### 14. What to do if this error occurs in text-to-speech? +### 14. What to do if this error occurs in text-to-speech? ``` [openai] Error: ffmpeg is not installed ``` -Since OpenAI TTS has implemented audio stream segmentation, ffmpeg needs to be installed for normal use when deploying the source code. Here are the detailed steps: +Since OpenAI TTS has implemented audio stream segmentation, ffmpeg needs to be installed for normal use when deploying the source code. Here are the detailed steps: -**Windows:** +**Windows:** -1. Visit the [FFmpeg official website](https://ffmpeg.org/download.html) and download the precompiled Windows shared library. -2. Download and unzip the FFmpeg folder, which will generate a folder similar to "ffmpeg-20200715-51db0a4-win64-static". -3. Move the unzipped folder to a location of your choice, for example, C:\Program Files. -4. Add the absolute path of the FFmpeg bin directory to the system environment variables. -5. Open the command prompt and enter "ffmpeg -version" to see if the FFmpeg version information is displayed, indicating successful installation. +1. Visit the [FFmpeg official website](https://ffmpeg.org/download.html) and download the precompiled Windows shared library. +2. Download and unzip the FFmpeg folder, which will generate a folder similar to "ffmpeg-20200715-51db0a4-win64-static". +3. Move the unzipped folder to a location of your choice, for example, C:\Program Files. +4. Add the absolute path of the FFmpeg bin directory to the system environment variables. +5. Open the command prompt and enter "ffmpeg -version" to see if the FFmpeg version information is displayed, indicating successful installation. -**Ubuntu:** +**Ubuntu:** -1. Open the terminal. -2. Enter the following commands to install FFmpeg: `sudo apt-get update`, then enter `sudo apt-get install ffmpeg`. -3. Enter "ffmpeg -version" to check if it has been successfully installed. +1. Open the terminal. +2. Enter the following commands to install FFmpeg: `sudo apt-get update`, then enter `sudo apt-get install ffmpeg`. +3. Enter "ffmpeg -version" to check if it has been successfully installed. -**CentOS:** +**CentOS:** -1. First, you need to enable the EPEL repository. In the terminal, enter: `sudo yum install epel-release` -2. Then, enter: `sudo rpm -Uvh http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm` -3. Update the yum package, enter: `sudo yum update` -4. Finally, install FFmpeg, enter: `sudo yum install ffmpeg ffmpeg-devel` -5. Enter "ffmpeg -version" to check if it has been successfully installed. +1. First, you need to enable the EPEL repository. In the terminal, enter: `sudo yum install epel-release` +2. Then, enter: `sudo rpm -Uvh http://li.nux.ro/download/nux/dextop/el7/x86_64/nux-dextop-release-0-5.el7.nux.noarch.rpm` +3. Update the yum package, enter: `sudo yum update` +4. Finally, install FFmpeg, enter: `sudo yum install ffmpeg ffmpeg-devel` +5. Enter "ffmpeg -version" to check if it has been successfully installed. -**Mac OS X:** +**Mac OS X:** -1. Open the terminal. -2. If you haven't installed Homebrew yet, you can install it by entering the following command in the terminal: `/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"` -3. Install FFmpeg with Homebrew, enter: `brew install ffmpeg` +1. Open the terminal. +2. If you haven't installed Homebrew yet, you can install it by entering the following command in the terminal: `/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"` +3. Install FFmpeg with Homebrew, enter: `brew install ffmpeg` 4. Enter "ffmpeg -version" to check if it has been successfully installed. ### 15. Migrate Vector Database to Qdrant or Milvus @@ -189,25 +143,26 @@ Since OpenAI TTS has implemented audio stream segmentation, ffmpeg needs to be i If you want to migrate the vector database from weaviate to qdrant or milvus, you need to migrate the data in the vector database. The following is the migration method: Step: -1. If you are starting from local source code, modify the environment variable in the `.env` file to the vector database you want to migrate to. -etc: `VECTOR_STORE=qdrant` -2. If you are starting from docker-compose, modify the environment variable in the `docker-compose.yaml` file to the vector database you want to migrate to, both api and worker are all needed. -etc: + +1. If you are starting from local source code, modify the environment variable in the `.env` file to the vector database you want to migrate to. etc: `VECTOR_STORE=qdrant` +2. If you are starting from docker-compose, modify the environment variable in the `docker-compose.yaml` file to the vector database you want to migrate to, both api and worker are all needed. etc: + ``` # The type of vector store to use. Supported values are `weaviate`, `qdrant`, `milvus`. VECTOR_STORE: weaviate ``` + 3. run the below command in your terminal or docker container ``` flask vdb-migrarte # or docker exec -it docker-api-1 flask vdb-migrarte ``` -### 16. Why is SYS_ADMIN permission needed? +### 16. Why is SYS\_ADMIN permission needed? -#### Why does the sandbox service need SYS_ADMIN permission? +#### Why does the sandbox service need SYS\_ADMIN permission? -The sandbox service is based on `Seccomp` for sandbox isolation, but also, Docker is based on `Seccomp` for resource isolation. In Docker, Linux Seccomp BPF is disabled by default, which prevents the use of `Seccomp` in containers, so SYS_ADMIN permission is required to enable `Seccomp`. +The sandbox service is based on `Seccomp` for sandbox isolation, but also, Docker is based on `Seccomp` for resource isolation. In Docker, Linux Seccomp BPF is disabled by default, which prevents the use of `Seccomp` in containers, so SYS\_ADMIN permission is required to enable `Seccomp`. #### How does the sandbox service ensure security?