[{"data":1,"prerenderedAt":188},["ShallowReactive",2],{"seo-verification":3,"blog-deploying-dify-on-a-vps-ai-workflows-under-control-ma-en":6,"promo-bar-likely":187},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-deploying-dify-on-a-vps-ai-workflows-under-control-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":32,"intro":34,"sections":35,"ctaTitle":120,"ctaBody":121,"ctaButton":122,"ctaUrl":123,"relatedPosts":124},2,"deploying-dify-on-a-vps-ai-workflows-under-control",{"fr":12,"en":10,"ar":13,"es":14},"deployer-dify-vps","نشر-dify-على-vps-سير-عمل-الذكاء-الاصطناعي-تحت-السيطرة","desplegar-dify-en-un-vps","Deploy Dify on a VPS: Complete Guide from Installation to Plugins","Install Dify on a ServOrbit VPS: requirements, Docker Compose, offline plugins, known Docker limits, backup before upgrading, and troubleshooting.",15,1,false,"2026-02-11T00:00:00+00:00","2026-10-29T03:10:23+00:00",{"id":18,"name":23,"slug":24,"color":25,"icon":26},"Artificial Intelligence","intelligence-artificielle","bg-purple-500\u002F10 text-purple-400","ia",[28],{"id":18,"name":23,"slug":24,"color":25,"icon":26},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fdeployer-dify-vps-poster.svg",{"categorySlug":24,"appSlug":33},"dify","Dify lets you build AI agents, chatflows and multi-model workflows without rebuilding the entire backend from scratch. Self-hosting it on a ServOrbit VPS keeps your API keys, prompts and knowledge bases within a perimeter you control. This guide covers the full journey: sizing, Docker Compose installation, first login, offline plugins, the known limits of the Docker install (Agent node, MCP tools), backup before an upgrade, and troubleshooting common errors.",[36,40,50,53,72,75,78,81,84,87,90,108,111,114,117],{"type":37,"title":38,"body":39},"h2","Why Host Dify on a VPS?","Using the cloud version of Dify means entrusting your prompts, your business data and your API keys to a third-party server, with limits on the number of applications and models you can access. By self-hosting Dify on a VPS, you remove these constraints: no monthly usage-based subscription, no sensitive data sent outside, and the freedom to connect any model provider (OpenAI, Anthropic, Ollama locally, etc.). It is the ideal solution for teams that want to build robust AI pipelines in an environment under their full control.",{"type":41,"title":42,"items":43},"ul","What You Can Do With Dify",[44,45,46,47,48,49],"Create custom chatbots and AI agents connected to your own data sources (RAG)","Orchestrate multi-step workflows combining several language models and external tools","Connect Dify to OpenAI, Anthropic Claude, Mistral, or a local model via Ollama","Expose your AI applications via a REST API or an embeddable widget for your site","Manage your team's access with a system of roles and workspaces","Track usage logs, per-model costs and the performance of your pipelines",{"type":37,"title":51,"body":52},"Prerequisites: Sizing Your VPS Correctly","Dify runs a fleet of Docker services in parallel: an API server, a Celery worker for embeddings and async jobs, the web frontend, PostgreSQL (the `db_postgres` service), Redis, Weaviate as the default vector store (`VECTOR_STORE=weaviate`), a code-execution `sandbox`, the `plugin_daemon`, SSRF proxies (Squid) and nginx. Since 1.16.0, `agent_backend` and `local_sandbox` join them to run Agent applications.\n\n**Official minimum**: 2 CPU cores and 4 GiB of RAM, with Docker Compose 2.24.0 or newer (Dify documentation). Plan 2 vCPU · 4 GB · 40 GB SSD to test the basic features.\n\n**Recommended for real use**: 4 vCPU · 8 GB RAM · 80 GB storage. As soon as you index large documents, several users query at once or you enable Agent applications, embeddings, the vector store and the agent services saturate 4 GB. The ServOrbit **VPS Power** plan (4 vCPU, 8 GB) suits a team workload without a local model.\n\n**With a local model (Ollama)**: add the model's own footprint. A quantised Llama 3 8B (Q4) needs ~6 GB of VRAM or dedicated RAM; plan for at least 16 GB RAM to run Dify and Ollama side by side without swap.\n\nRecommended OS: Ubuntu 22.04 LTS.",{"type":54,"title":55,"steps":56},"steps","Install Dify on Your ServOrbit VPS",[57,60,63,66,69],{"title":58,"body":59},"Order a ServOrbit Cloud VPS","Go to the \u002Fvps-cloud page and choose a plan suited to your usage (minimum 2 vCPU \u002F 4 GB RAM, recommended 4 vCPU \u002F 8 GB). Select Ubuntu 22.04 LTS as the operating system, then complete the order. Your VPS is provisioned in under a minute.",{"title":61,"body":62},"Clone a published release and copy the configuration","Connect via SSH, then run `git clone --branch 1.18.0 https:\u002F\u002Fgithub.com\u002Flanggenius\u002Fdify.git`, `cd dify\u002Fdocker` and `cp .env.example .env`. Pin a release tag rather than the `main` branch, which moves with every merge: the official documentation asks you to clone the latest release.\n\nThe `.env` file holds the configuration. Before the first start, replace the development values it ships with: `DB_PASSWORD` (default `difyai123456`), `REDIS_PASSWORD`, `SANDBOX_API_KEY`, `PLUGIN_DAEMON_KEY`, `DIFY_AGENT_API_TOKEN` and `DIFY_AGENT_SERVER_SECRET_KEY`. Leave `SECRET_KEY` empty so a persistent key is generated: changing it later logs every user out and makes plugin OAuth credentials unreadable. Finally, generate the agent sandbox token with `openssl rand -base64 32` and put it in `DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN`: without it, the Agent backend and its sandbox do not start.",{"title":64,"body":65},"Start the Docker Compose stack","From `dify\u002Fdocker`, run `docker compose up -d`. Docker pulls the images and starts the containers: `api`, `worker`, `worker_beat`, `web`, `db_postgres`, `redis`, `weaviate`, `sandbox`, `plugin_daemon`, `ssrf_proxy`, `agent_backend`, `local_sandbox` and `nginx`. Check with `docker compose ps` that services are `Up` or `healthy`; `init_permissions` shows `Exited`, which is expected. The operation typically takes 3 to 5 minutes depending on your bandwidth.",{"title":67,"body":68},"Create the administrator account","Open `http:\u002F\u002F[YOUR-VPS-IP]\u002Finstall` in your browser.\n\nWarning: do this immediately. As long as the admin account does not exist, the `\u002Finstall` page is open to anyone, and whoever arrives first becomes the owner of your instance. If you set `INIT_PASSWORD` in `.env` (30 characters maximum), the page asks for it before creating the account.\n\nEnter your e-mail address and a strong password. This account is the owner of the default workspace.",{"title":70,"body":71},"Point a domain name and enable HTTPS","For production, associate a domain name with the VPS IP and deploy a TLS certificate. Dify's internal nginx listens on host port 80 by default (`EXPOSE_NGINX_PORT=80`): if you install an nginx on the host, the two collide. Set `EXPOSE_NGINX_PORT=8080` in `.env`, then install nginx and Certbot on the host (`sudo apt install nginx certbot python3-certbot-nginx -y`), create a vhost that proxies to `127.0.0.1:8080` and run `sudo certbot --nginx -d your-domain.com`.\n\nThen set `CONSOLE_API_URL`, `APP_WEB_URL`, `SERVICE_API_URL` and `FILES_URL` to `https:\u002F\u002Fyour-domain.com` (empty by default): `CONSOLE_API_URL` serves OAuth logins and plugins, `APP_WEB_URL` the Human Input node links, and if `FILES_URL` and `CONSOLE_API_URL` both stay empty, file previews do not work. Restart with `docker compose up -d`.",{"type":37,"title":73,"body":74},"Post-Install Configuration: Models, API and Workspace","Once logged in, the first step is to register a model provider. In settings (icon top-right) → **Model Providers**, add your OpenAI, Anthropic, Mistral or any other supported API key. For a local model, enter your Ollama instance URL (`http:\u002F\u002F[host-IP]:11434`).\n\nDify also exposes its own REST API so you can integrate your applications into external pipelines. Find your API keys under **Settings → API Keys**. These keys allow you to query your Dify apps from n8n, Zapier or any Python script without going through the GUI.\n\nThe default workspace is the one created at first login. Invite members via **Settings → Members** and assign them `Admin`, `Normal` or `Dataset operator` roles.",{"type":37,"title":76,"body":77},"Offline Plugins: Working Around the 500\u002F404 Error on Self-Hosted Instances","Since November 2025 (GitHub issue #27720, opened on Dify 1.9.2), self-hosted users see plugin installation from the marketplace fail: HTTP 500 for `langgenius\u002Fperplexity`, HTTP 404 for `langgenius\u002Fanthropic`, then `Reached maximum retries (3)` for `langgenius\u002Fazure_openai`. The same plugins install on Dify Cloud. The issue was closed as not planned on 18 December 2025 with the `cant-reproduce` label and no fix: the workarounds below come from a bot in the thread and were not confirmed by maintainers.\n\n**Workaround 1: local `.difypkg` file.** Download the plugin's `.difypkg` file on a connected machine, then install it with \"Install from local file\". For a server without outbound access, the `dify-plugin-repackaging` tool bundles dependencies into the package. If the file is rejected for its size, raise `PLUGIN_MAX_PACKAGE_SIZE` (52428800 bytes by default) and `NGINX_CLIENT_MAX_BODY_SIZE` (`100M` by default).\n\n**Workaround 2: disable signature verification.** To install unsigned plugins or develop your own, set `FORCE_VERIFYING_SIGNATURE=false` (default: `true`) in `.env`, then run `docker compose restart plugin_daemon`.\n\nWarning: disabling signatures removes a security guard. Keep this setting for development or plugins whose source you control; in production with third-party users, prefer a verified `.difypkg`.",{"type":37,"title":79,"body":80},"Known Limits of the Docker Install: the Agent Node","**Agent node in Chatflow and Workflow on 1.15.0.** On the standard Docker install of 1.15.0, the \"Agent\" node fails before any model call with `ValueError: base_url is required when creating a real Agent backend client`. It needs an \"Agent backend\" service pointed to by `AGENT_BACKEND_BASE_URL`, which the official `docker-compose.yaml` of that version did not contain. The langgenius\u002Fdify issues #38283 (closed as not planned on 17 August 2026) and #39161 (closed as a duplicate on 23 October 2026) produced no fix; a better error message is still under review (PR #39878). Two workarounds circulate and neither fits: `AGENT_BACKEND_USE_FAKE=true` plugs in a fake client that returns a hard-coded answer and never calls the LLM or the MCP tools, and deploying a `dify-agent` service by hand is neither documented nor supported.\n\n**Since 1.16.** The official compose now ships `agent_backend` and `local_sandbox`, with `AGENT_BACKEND_BASE_URL=http:\u002F\u002Fagent_backend:5050` in `.env.example`, and you must set `DIFY_AGENT_API_TOKEN` (which has to equal `AGENT_BACKEND_API_TOKEN` since 1.16.1) and `DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN`. But Agent V2 was hidden from Chatflow as early as 1.16.1, for lack of multi-turn context; the request to restore it (#41269, opened on 26 August 2026) has no target version. In Chatflow, only the legacy Agent node is available. The standalone Agent application type is the alternative the reporter of #39161 says worked on 1.15.0.",{"type":37,"title":82,"body":83},"Known Limits: Editing a Chatflow With an MCP Tool on 1.18.0","Issue #44742 (opened on 25 October 2026) reports that after removing and re-adding an MCP tool in an Agent node on 1.18.0, the Chatflow no longer runs: `TypeError: object of type 'NoneType' has no len()`, raised in `build_parameters`. The exported YAML shows `allowed_tools`, `context` and `files` saved as `type: variable` with `value: null`. Another MCP tool left untouched in the same flow keeps working. Going back to 1.17.x does not repair a flow that is already damaged, and importing the broken export into another instance fails too.\n\n**Reported workarounds.** Edit the YAML to set these three fields to `type: constant` with `value: []`, then import it as is (repackaging it as a `.difypkg` fails the integrity check), or rebuild the flow.\n\n**State of the thread.** The issue was closed on 26 October 2026 by PR #44748, merged into `main`: it no longer writes cleared optional fields into the saved graph. It resolves #44579 (`AgentVariableNotFoundError`), but states that nested manual parameters and the full remove\u002Fre-add MCP sequence are outside its scope. No release after 1.18.0 appeared on the releases page on 28 October 2026. Until then, export the YAML before every edit of a Chatflow that uses an MCP tool.",{"type":37,"title":85,"body":86},"Connecting Ollama and n8n","Dify becomes particularly powerful combined with other self-hosted tools.\n\n**Ollama** lets you run an LLM directly on your VPS or a server on the same network, without depending on an external API. After deploying Ollama, register it in Dify as a model provider with the URL `http:\u002F\u002F[Ollama-IP]:11434`. All generation then stays on your infrastructure — zero prompt leakage to the outside.\n\n**n8n** is a workflow orchestrator that can drive Dify via its REST API. Create an HTTP Request node in n8n pointing to `https:\u002F\u002Fyour-domain.com\u002Fv1\u002Fchat-messages` with your Dify API key in the `Authorization` header. You can then trigger a Dify conversation from a web form, an inbound e-mail or a Slack webhook, and send the AI response to any destination.",{"type":37,"title":88,"body":89},"Back Up the Volume and the Database Before Upgrading","A Dify upgrade touches the PostgreSQL schema (migrations run when the API starts as long as `MIGRATION_ENABLED=true`), the vector data and the agent stack images. The 1.18.0 notes open with \"Back up first\": database, vector store data, uploaded files, Agent storage, secrets and environment files.\n\nOn Docker Compose, almost everything lives in `docker\u002Fvolumes\u002F` (`db\u002Fdata` for PostgreSQL, `weaviate`, `redis\u002Fdata`), as folder mounts rather than named volumes. For a consistent copy: `docker compose stop`, then `tar czf ..\u002Fdify-backup.tar.gz volumes .env docker-compose.yaml`, then copy the archive off the VPS. Without a full stop, a logical export is still possible: `docker compose exec -T db_postgres pg_dump -U postgres dify > dify-dump.sql`.\n\nAlso keep, outside the repository, `SECRET_KEY` and `PASSWORD_PEPPER` if you set one: losing the first makes encrypted credentials unreadable, and changing the second invalidates existing password hashes (1.18.0 notes). Finally, plan the steps: if your stack still bundles Weaviate 1.27, the 1.17.1 notes require a staged move to 1.39, with no minor-version skipping.",{"type":54,"title":91,"steps":92},"Upgrade Safely: Rehearse on a Copy First",[93,96,99,102,105],{"title":94,"body":95},"Freeze the current state","Note the running version (`docker compose images`), stop the stack with `docker compose stop` and take the backup described above. Check that the archive opens (`tar tzf`) before going further: a backup that was never read back is not a backup.",{"title":97,"body":98},"Duplicate the instance","From the parent folder, run `cp -a dify dify-test`. In `dify-test\u002Fdocker\u002F.env`, change `EXPOSE_NGINX_PORT` and `EXPOSE_NGINX_SSL_PORT` (for example 8081 and 8444) so they do not collide with production, and leave disk and RAM for a second stack. The Compose project name follows the folder name, which keeps the two stacks apart.",{"title":100,"body":101},"Move the copy to the target version","In `dify-test`, run `git fetch --tags` then `git checkout \u003Ctag>`. Compare each `.env.example` with your `.env` to spot new or renamed variables, and if you edited `docker-compose.yaml`, re-apply your changes onto the new release's file instead of keeping the old one. Run `docker compose pull` then `docker compose up -d` and follow `docker compose logs -f api` until the migrations finish. From 1.17.1 to 1.18.0 the notes count 22 of them: API, workers, Agent Backend and runtime images move together.",{"title":103,"body":104},"Replay your sensitive flows","On the copy, open every Chatflow that uses an Agent node or an MCP tool, run it, then edit it and save it once: editing is what broke flows on 1.18.0. Also test a knowledge base query, a plugin call and a YAML export. Then destroy the copy: `docker compose down`, then delete the `dify-test` folder.",{"title":106,"body":107},"Switch production, or roll back","Replay the same steps in production during a maintenance window. To roll back, do not just switch the tag back: the migrations changed the database. Run `docker compose down`, restore the volumes archive, then return to the previous tag.",{"type":37,"title":109,"body":110},"Troubleshooting: The Most Common Errors","**`worker` container restarting in a loop.** The Celery worker depends on Redis and PostgreSQL. Check their status with `docker compose ps db_postgres redis` and read `docker compose logs worker --tail=50`. If Redis was not ready at startup, a `docker compose restart worker` is enough.\n\n**`plugin_daemon` looping on the PostgreSQL connection.** Report dify-plugin-daemon #729 (Dify 1.14.0) shows `failed to connect to host=db_postgres … lookup db_postgres on 127.0.0.11:53: no such host`, then `panic: failed to init dify plugin db`. The host name must match a running service: check that `db_postgres` is `healthy`, that `DB_HOST` in `.env` carries that name and that `COMPOSE_PROFILES` contains `postgresql`, then run `docker compose down` and `docker compose up -d`. That issue was closed without a confirmed cause.\n\n**A service fails to start because of `vm.max_map_count`.** This kernel setting concerns Elasticsearch (the `elasticsearch` profile), not Weaviate. If you chose it, Elastic documentation asks for 1048576 when the default is lower: `sudo sysctl -w vm.max_map_count=1048576`, then the same line in `\u002Fetc\u002Fsysctl.conf` and `sudo sysctl --system` to make it permanent.\n\n**Marketplace plugins: 500\u002F404 error.** See the \"Offline Plugins\" section. If a network block is involved, test outbound 443 from a container: `docker compose exec api curl -I https:\u002F\u002Fmarketplace.dify.ai`.\n\n**WebSocket disconnected behind a reverse proxy.** If response streaming stops, your external nginx does not forward the upgrade headers. Add in `location \u002F`: `proxy_set_header Upgrade $http_upgrade;` and `proxy_set_header Connection \"upgrade\";`.",{"type":37,"title":112,"body":113},"Troubleshooting: Agents, MCP Tools and Upgrades","**`base_url is required when creating a real Agent backend client`.** See \"Known Limits of the Docker Install: the Agent Node\". On a recent version, check that `agent_backend` is running and that `AGENT_BACKEND_BASE_URL` points to `http:\u002F\u002Fagent_backend:5050`.\n\n**`agent_backend` or `local_sandbox` will not start.** The `DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN` value is empty: the documentation states that the Agent backend and its sandbox do not start without it. Generate it with `openssl rand -base64 32`, put it in `docker\u002F.env` and restart.\n\n**`TypeError: object of type 'NoneType' has no len()`.** Chatflow damaged after editing an MCP tool on 1.18.0 (#44742): see the dedicated section, and fix the YAML before importing.\n\n**`AgentVariableNotFoundError: Variable '' does not exist`.** A cleared optional field in the Agent node leaves an empty selector in the saved graph (#44579, seen on 1.17.1). Put a value back in the field, or wait for a release that includes PR #44748.\n\n**Real IP lost behind Cloudflare or a load balancer.** Since 1.18.0, the bundled nginx replaces `X-Forwarded-For`: configure trusted real-IP handling.\n\n**Cannot log in after an update.** A `PASSWORD_PEPPER` that was added, changed or removed invalidates existing passwords: restore the original value.",{"type":115,"body":116},"tip","Take an on-demand ServOrbit snapshot from the client area before every upgrade: it covers the `docker\u002Fvolumes\u002F` folder (PostgreSQL, Weaviate, Redis) and your `.env` files. Stop the stack first with `docker compose stop` so the database is copied in a consistent state. If an update goes wrong, rollback takes just a few minutes from the client area. The snapshot complements the test copy, it does not replace it.",{"type":115,"title":118,"body":119},"The Official Documentation","For advanced configuration, the full list of environment variables and release notes, refer to the \u003Ca href=\"https:\u002F\u002Fdocs.dify.ai\u002Fen\u002Fhome\" target=\"_blank\" rel=\"noopener noreferrer\">official Dify documentation\u003C\u002Fa>. The `docker-compose.yaml` in the official repository remains the source of truth for image versions and inter-service dependencies.","Deploy Dify in Minutes on a ServOrbit Cloud VPS","Launch your own Dify instance on a high-performance VPS and take full control of your AI applications, with no usage limits and no compromise on data privacy.","Launch My Cloud VPS","\u002Fvps-cloud",[125,145,167],{"id":126,"slug":127,"slugs":128,"title":132,"excerpt":133,"readTime":134,"views":135,"isPinned":19,"noindex":19,"publishedAt":136,"updatedAt":137,"category":138,"categories":139,"featuredImage":29,"bgImage":30,"posterImage":141,"relatedSolution":142},11,"how-to-host-ollama-on-a-vps",{"fr":129,"en":127,"ar":130,"es":131},"heberger-ollama-vps","كيفية-استضافة-ollama-على-خادم-vps","como-alojar-ollama-en-un-vps","Hosting Ollama on a VPS: advanced operational guide","Advanced Ollama VPS setup: model management, nginx reverse proxy, API security, Q4_K_M\u002FQ8 quantization, CVE-2026-45672 Open WebUI and secure coupling.",9,3,"2026-06-09T00:00:00+00:00","2026-11-04T16:30:24+00:00",{"id":18,"name":23,"slug":24,"color":25,"icon":26},[140],{"id":18,"name":23,"slug":24,"color":25,"icon":26},"\u002Fblog\u002Fcovers\u002Fheberger-ollama-vps-poster.svg",{"categorySlug":143,"appSlug":144},"artificial-intelligence","ollama",{"id":135,"slug":146,"slugs":147,"title":151,"excerpt":152,"readTime":153,"views":154,"isPinned":19,"noindex":19,"publishedAt":155,"updatedAt":156,"category":157,"categories":161,"featuredImage":29,"bgImage":30,"posterImage":163,"relatedSolution":164},"install-n8n-on-vps-with-docker-complete-2026-guide",{"fr":148,"en":146,"ar":149,"es":150},"installer-n8n-vps","تثبيت-n8n-على-vps-مع-docker-دليل-شامل-2026","instalar-n8n-en-vps-con-docker","Install n8n on VPS with Docker: complete 2026 guide","Deploy n8n on VPS with Docker, reverse proxy and HTTPS. Covers V8 crash, 502 nginx, npm migration and execution security (GHSA-vrv8-j27g-g7cr advisory, August 2026).",19,4,"2026-06-05T00:00:00+00:00","2026-11-09T20:55:18+00:00",{"id":9,"name":158,"slug":159,"color":160,"icon":159},"Automation","automatisation","bg-brand-action\u002F10 text-brand-action",[162],{"id":9,"name":158,"slug":159,"color":160,"icon":159},"\u002Fblog\u002Fcovers\u002Finstaller-n8n-vps-poster.svg",{"categorySlug":165,"appSlug":166},"automation-workflows","n8n",{"id":168,"slug":169,"slugs":170,"title":174,"excerpt":175,"readTime":176,"views":18,"isPinned":19,"noindex":19,"publishedAt":177,"updatedAt":178,"category":179,"categories":184,"featuredImage":29,"bgImage":30,"posterImage":186,"relatedSolution":29},228,"initial-linux-server-hardening",{"fr":171,"en":169,"ar":172,"es":173},"durcissement-serveur-linux-initial","تصليب-الخادم-linux-الأولي","hardening-inicial-servidor-linux","Initial Linux Server Hardening","Create a sudo user, configure SSH with keys, enable UFW and fail2ban on Ubuntu or Debian in under an hour.",8,"2026-08-06T00:00:00+00:00","2026-10-20T23:18:07+00:00",{"id":176,"name":180,"slug":181,"color":182,"icon":183},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[185],{"id":176,"name":180,"slug":181,"color":182,"icon":183},"\u002Fblog\u002Fcovers\u002Fdurcissement-serveur-linux-initial-poster.svg",true,1794270392228]