Deploy Dify for a production environment - Deployment Tutorial - Technical Solutions - Alibaba Cloud

This solution uses a dual-zone design. Deploying cloud resources in multiple zones helps avoid single points of failure.

1. Log on to the VPC console. In the navigation pane on the left, click VPC. In the top navigation bar, select the Singapore region, and then click Create VPC. Configure the VPC with the following settings and follow the on-screen instructions.

   Use the default values for the parameters that are not mentioned.

   • VPC:

     • Region: Select Singapore.

       This topic uses the Singapore region as an example.

     • Name: Enter VPC_SGP.

     • IPv4 CIDR block: Enter 192.168.0.0/16.

   • vSwitches:

     • Name: Create two vSwitches named vsw_001 and vsw_002.

     • Zone: Deploy the 2 vSwitches to 2 separate zones: Zone A (vsw_001) and Zone B (vsw_002).

     • IPv4 CIDR block: Configure an IPv4 CIDR block for each vSwitch.

       • vsw_001: 192.168.1.0/24

       • vsw_002: 192.168.2.0/24

Create one security group to control the inbound and outbound network traffic for ECS instances within the VPC.

1. Log on to the ECS console. In the navigation pane on the left, click Security Groups. In the top navigation bar, select the Singapore region, and then click Create Security Group. Use the following settings and follow the on-screen instructions to create the security group.

   Use the default values for the parameters that are not mentioned.

   • Security Group Name: Enter SecurityGroup_1.

   • Network: Select the VPC that you created in the previous step, VPC_SGP.

   • Security Group Type: Select Basic Security Group.

     This solution needs to pull related software from the public network. Therefore, you must allow all outbound traffic.

   • Access Rule: For the Inbound traffic direction, allow ports 80, 3000, 5001, 5002, and 5003. Set Protocol Type to Custom TCP and Source to Anywhere (IPv4). Then, click Create Security Group.

Create one Tair (Redis OSS-compatible) instance to provide a high-performance cache service for Dify.

1. Log on to the Tair (Redis OSS-compatible) console. In the navigation pane on the left, click Instances. In the top navigation bar, select the Singapore region, and then click Create Instance. Configure the instance with the following settings and follow the on-screen instructions.

   Use the default values for the parameters that are not mentioned.

   • Product: Select Redis Open-Source Edition.

   • Billing Method: Select Pay-As-You-Go.

   • Deployment Mode: Select Cloud-native.

   • Region: Select Singapore.

   • Zone Settings: Select Dual-zone Deployment. Set the primary zone to Zone A and the secondary zone to Zone B.

   • VPC: Select the VPC that you created in the previous step, VPC_SGP.

   • VSwitch: Select the vSwitch that you created in the previous step, vsw_001.

   • Major Version: Select Redis 6.0.

   • Architecture: Select Non-cluster.

   • Shard Specifications: Select 4 GB.

   • Instance Name: Enter a name for the instance.

   • Set Password: Select Now, and then enter the access password for the instance.

     The Redis password used by Dify can only contain uppercase letters, lowercase letters, and numbers. Do not use other characters.

2. Go to the Tair (Redis OSS-compatible) console and click Instances in the navigation pane on the left. After the instance status changes to Running, click the target instance ID to go to the Instance Information page. In the navigation pane on the left, click Whitelist Settings.

3. In the list, find the default whitelist and click Modify on the right. Set Whitelist to 192.168.0.0/16.

   

4. On the Instance Information page, in the Connection Information section, find the instance's VPC endpoint. This endpoint will be used later.

Create one Tablestore instance to provide a high-performance vector search service for Dify.

1. Log on to the Tablestore console. In the top navigation bar, select the Singapore region, and click Create Instance.

   If this is your first time using Tablestore, follow the on-screen instructions to activate and authorize the service.

2. In the Billing Method dialog box, select CU Mode (formerly On-demand Mode). Create the instance with the following settings and follow the on-screen instructions.

   Use the default values for the parameters that are not mentioned.

   • Region: Select Singapore.

   • Instance Name: Enter difydb.

   • Instance Type: Select Compute-optimized.

   • Redundancy Type: Select Zone-redundant Storage.

3. After you create the instance, click the instance name to find and record its VPC endpoint. This endpoint will be used later.

   

Create one ApsaraDB RDS for PostgreSQL instance to provide a high-performance relational database service for Dify.

1. Create an RDS for PostgreSQL instance:

   Log on to the ApsaraDB RDS console. In the navigation pane on the left, click Instances. In the top navigation bar, select the Singapore region, and then click Create Instance. Follow the on-screen instructions to create an instance with the following settings.

   Use the default values for the parameters that are not mentioned.

   • Billing Method: Select Pay-As-You-Go.

   • Region: Select or Singapore.

   • Engine: Select PostgreSQL 17.

   • SLR Authorization: Click Go To Authorize, and then follow the on-screen instructions.

     This is required only if you create an instance for the first time.

   • Edition: Select High-availability Series.

   • Product Type: Select Yitian Edition.

   • Network Type: Select VPC.

   • VPC: Select the VPC that you created in the previous steps, VPC_SGP.

   • Add To Whitelist: Select Yes. Otherwise, you cannot add your VPC CIDR block to the RDS instance whitelist.

   • Primary Zone And Network: Select the first zone (Zone A) and vSwitch (vsw_001) that you created.

     If the zone is not in the list, you can select a new zone and create a vSwitch.

   • Deployment Method: Select Multi-zone Deployment.

   • Secondary Zone And Network: Select the second zone (Zone B) and vSwitch (vsw_002) that you created.

     If the zone is not in the list, you can select a new zone and create a vSwitch.

   • Instance Type: Click General-purpose, then search for and select pg.n4m.2c.2m.

     We recommend selecting a 2-core CPU and 8 GB memory. You can change this configuration at any time.

     Note

     Instance creation takes more than 10 minutes. Wait for the instance status to change to Running before you proceed.

2. Create a database account:

   1. Go to the RDS console. In the navigation pane on the left, click Instances, find the target instance, and click its instance ID to go to the instance details page. In the navigation pane on the left, click Account Management. On the User Account tab, click Create Account.

   2. In the Create Account panel, set the database account name, select Privileged Account as the account type, set a password, and then click OK.

3. Create a database for Dify:

   1. On the instance details page, click Database Management in the navigation pane on the left. Then, click Create Database.

   2. In the Create Database panel, set the database name, select the privileged account that you created in the previous step for Authorized Account, and then click Create.

4. On the instance details page, click Database Connection in the navigation pane on the left. Find the instance's internal endpoint for later use.

Create one ACK managed cluster to deploy the Dify platform and related applications.

1. Log on to the ACK console. In the navigation pane on the left, click Clusters. In the top navigation bar, select the Singapore region and then click Create Cluster.

   If this is your first time using ACK, follow the on-screen instructions to activate and authorize the service.

2. Configure an ACK managed cluster.

   Use the default values for the parameters that are not mentioned.

   • Auto Mode: Turn off Auto Mode.

   • Cluster Name: Enter dify-prod.

   • Cluster Specification: Select Pro.

   • Region: Select Singapore.

   • VPC: Select Select Existing, and then select VPC_SGP.

     Ensure that Configure SNAT For VPC is enabled.

   • VSwitch: Select the vSwitches that you created in the previous steps: vsw_001 (Zone A) and vsw_002 (Zone B).

   • Security Group: Select the security group that you created in the previous step, SecurityGroup_1.

   • Pod VSwitch: Select the vSwitches that you created in the previous steps: vsw_001 (Zone A) and vsw_002 (Zone B).

   After the configuration is complete, click Next: Node Pool Configurations.

3. On the Node Pool Configurations page, enable Create Node Pool and configure a node pool.

   Use the default values for the parameters that are not mentioned.

   • Billing Method: Select Pay-As-You-Go.

   • Instance Configuration Method: Select Specify Instance Type.

   • Instance Type: Click Current Generation, then search for and select ecs.u1-c1m2.xlarge and ecs.c6.xlarge.

     If the instance types are sold out, select a specification with 4 vCPU and 8 GiB of memory or higher.

   • Operating System: Select Public Image, and choose the version Alibaba Cloud Linux 3.2104 LTS 64-bit.

   • Expected Nodes: Enter 2.

     If pod scheduling fails because of insufficient cluster capacity, see Enable node autoscaling to learn how to scale your nodes (optional).

   After the configuration is complete, click Next: Component Configurations.

4. On the Component Configurations page, configure the components.

   Use the default values for the parameters that are not mentioned.

   • Ingress: Select ALB Ingress, set Instance Source to Create New, Network Type to Public Network, and Virtual Switch to vsw_001 (Zone A) and vsw_002 (Zone B).

   • Volume Plug-in: Select CSI, and then select Create default NAS file system and CNFS container network file system dynamic storage types.

   • Container Monitoring: Select Container Cluster Monitoring Basic Edition.

   After the configuration is complete, click Next: Confirm Configuration.

5. On the Confirm Configuration page, confirm that all configurations are correct, and then click Create Cluster.

   In the Dependency Check section, if the status is Failed, follow the on-screen prompts to create roles and grant permissions. Once complete, return to the current page and click Recheck until all statuses are Passed.

   Note

   Cluster creation takes about 5 minutes. When the Cluster Status on the Clusters page changes to Running, the cluster is successfully created.

Follow these steps to deploy Dify in ACK.

1. In the navigation pane on the left of the ACK console, click Clusters. In the top navigation bar, select the Singapore region. Find the dify-prod cluster and click its name to go to the Cluster Information page.

2. In the navigation pane on the left, choose Applications > Helm, and then click Create. Follow the wizard to configure the Basic Information and Parameter Settings.

   • Basic Information:

     • Application Name: Enter ack-dify.

     • Namespace: Select default.

     • Source: Select Marketplace.

     • Chart: Search for and select ack-dify.

       After you click Next, if a dialog box appears, click Yes to use the default chart namespace, dify-system.

   • Parameter Settings:

     • Chart Version: Select 1.1.21 (Dify version 1.11.4).

     • Modify the Parameters as described below:

       • Configure the worker: Set the number of worker replicas to 2 and remove its resource limits.

         

       • Enable autoscaling: Enable autoscaling to automatically adjust the number of replicas based on the load.

         

       • Configure the proxy: Remove the resource limits for the proxy.

         

       • Configure the web: Set the number of web replicas to 2 and remove its resource limits.

         

       • Configure the sandbox: Set the number of sandbox replicas to 2 and remove its resource limits.

         

       • Disable test environment PostgreSQL: Disable the PostgreSQL container for the test environment.

         

       • Disable test environment weaviate: Disable the weaviate container for the test environment.

         

       • Enable Ingress: Enable Ingress (using Alibaba Cloud ALB as the Ingress controller) and forward all requests without a specified Host to Dify. This lets you access Dify from the public network.

         

       • Disable test environment Redis: Disable the Redis container for the test environment.

         

       • Configure RDS for PostgreSQL: Replace the placeholders <> in the following configuration with your actual values.

         externalPostgres:
           enabled: true
           username: "<The username of the RDS for PostgreSQL account that you created>"
           password: "<The password for the RDS for PostgreSQL account that you created>"
           address: "<The endpoint of the RDS for PostgreSQL instance that you created, for example, pgm-bp1***4lt.pg.rds.aliyuncs.com>"
           port: 5432
           dbName: "<The name of the RDS for PostgreSQL database that you created>"
           database:
             api: "<The name of the RDS for PostgreSQL database that you created>"
             pluginDaemon: "dify_plugin"
           maxOpenConns: 20
           maxIdleConns: 5

       • Configure Tair (Redis OSS-compatible): Replace the placeholders <> in the following configuration with your actual values.

         externalRedis:
           enabled: true
           host: "<The internal endpoint of the Tair instance that you created, for example, r-bp1***qrl.redis.rds.aliyuncs.com>"
           port: 6379
           username: "default"
           password: "<The password for the Tair instance that you created>"
           useSSL: false
           dbNumber: "0"

       • Configure Tablestore: Replace the placeholders <> in the following configuration with actual values. Learn how to obtain an AccessKey pair.

         externalTablestore:
           enabled: true
           endpoint: "<The VPC endpoint of the Tablestore instance that you created>"
           instanceName: "<The instance alias or name of the Tablestore instance that you created>"
           accessKeyId: "<The AccessKey ID of your Alibaba Cloud account>"
           accessKeySecret: "<The AccessKey secret of your Alibaba Cloud account>"

3. Click OK to start deploying Dify. In the navigation pane on the left, choose Applications > Helm. Switch the namespace to dify-system. When the status of ack-dify changes to Deployed, the deployment is complete.

   Note

   Dify deployment takes about 1 minute.

1. In the navigation pane on the left, choose Network > Ingresses. Switch the namespace to dify-system. Find the Ingress with the Name ack-dify, and click "/" in its Rules column to access the Dify platform. If a blank page appears, refresh the Ingresses list page and repeat this step until the Dify logon page appears.

   This access uses the CNAME address provided by ALB, which is suitable for temporary testing only. In a production environment, we recommend that you use a CNAME record to point your custom domain name to the CNAME address provided by ALB to complete the domain name resolution. For more information, see Configure a CNAME record for an ALB instance.

2. On the Set Up Administrator Account page, select your language in the upper-right corner. Enter your Email, Username, and Password, then click Set Up to initialize the administrator account. The browser automatically redirects to the logon page. Enter the email and password that you set, and click Log On.

3. After you open Dify, click your profile picture in the top-right corner, and then click Settings in the pop-up menu. In the Settings panel, click Workspace > Model Providers on the left. Find Qwen in the area on the right, hover over it, and click Install. In the dialog box that opens, click Install again. The installation takes about 5 minutes to complete. If the installation is unsuccessful, refresh the page and repeat the preceding steps until Qwen appears in the To be configured area on the Model Providers page.

4. On the right side of the Qwen section under To be configured, click Set Up. In the pop-up panel, enter the API key from Alibaba Cloud Model Studio in the API Key input box, and then click Save. Learn how to obtain a Model Studio API key.

   This API key is used by Dify to call the Qwen large language model (LLM).

5. Click System Model Settings in the upper-right corner:

   • System Reasoning Model: Select qwen-plus.

   • Embedding Model: Select text-embedding-v4.

   • Rerank Model: Select gte-rerank-v2.

   • Speech-to-Text Model: Select paraformer-realtime-v2.

   • Text-to-Speech Model: Select tts-1.

     For information about the billing and free quotas for these models, see Billing and free quotas for models.

   After you complete the settings, click Save.

   Note

   • Select a model based on the task type: For simple tasks, such as classification and summarization, prioritize cost-effective lightweight models like qwen-turbo. Avoid always using powerful but more expensive models like qwen-plus.

   • Monitor and set alerts: Monitor token consumption through model monitoring. Configure usage alerts to receive prompt notifications about abnormal usage.