[LLM / MLOps] Dify 자체 호스팅
U
uniglot
global:
host: "dify.uniglot.com"
enableTLS: true
extraBackendEnvs:
- name: SECRET_KEY
value: "superconfidentialsecretkey"global:
# omit
extraBackendEnvs:
# omit
- name: DB_HOST
value: dify-uniglot.supersecret.ap-northeast-2.rds.amazonaws.com
- name: DB_USERNAME
valueFrom:
secretKeyRef:
name: dify-db-credentials
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: dify-db-credentials
key: password
- name: DB_DATABASE
value: dify
postgresql:
embedded: false
global:
# omit
extraBackendEnvs:
# omit
- name: REDIS_HOST
value: test-cluster.redis.svc.cluster.local
- name: CELERY_BROKER_URL
value: redis://test-cluster.redis.svc.cluster.local:6379/1
redis:
embedded: falseapiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: qdrant
namespace: argocd
spec:
source:
repoURL: https://qdrant.github.io/qdrant-helm
targetRevision: '1.13.1'
chart: qdrant
helm:
releaseName: qdrant
# omitglobal:
# omit
extraBackendEnvs:
# omit
- name: VECTOR_STORE
value: qdrant
- name: QDRANT_URL
value: http://qdrantglobal:
host: "dify.uniglot.com"
enableTLS: true
extraBackendEnvs:
- name: SECRET_KEY
value: "superconfidentialsecretkey"
- name: DB_HOST
value: dify-uniglot.supersecret.ap-northeast-2.rds.amazonaws.com
- name: DB_USERNAME
valueFrom:
secretKeyRef:
name: dify-db-credentials
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: dify-db-credentials
key: password
- name: DB_DATABASE
value: dify
- name: REDIS_HOST
value: test-cluster.redis.svc.cluster.local
- name: CELERY_BROKER_URL
value: redis://test-cluster.redis.svc.cluster.local:6379/1
- name: VECTOR_STORE
value: qdrant
- name: QDRANT_URL
value: http://qdrant
postgresql:
embedded: false
redis:
embedded: false# envoy-gateway/values.yaml
# omit
envoyProxy:
# omit
gatewayClass:
# omit
gateway:
# omit
externalHelmRoutes: []externalHelmRoutes:
- name: dify-route
namespace: ml
hostnames:
- dify.uniglot.com
rules:
- path: /
service: dify-frontend
port: 80
- path: /console/api
service: dify-api-svc
port: 80
- path: /api
service: dify-api-svc
port: 80
- path: /v1
service: dify-api-svc
port: 80
- path: /files
service: dify-api-svc
port: 80
internalAccess: true # 내부망에서만 접근하도록 하기
clientCIDRs: # 접근 허용 대역 (내부망 대역)
- 10.0.42.0/10# envoy-gateway/templates/httproute.yaml
{{- range .Values.externalHelmRoutes -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: {{ .name }}
namespace: {{ .namespace | default "default" }}
spec:
parentRefs: # 사정에 맞게 올바른 게이트웨이를 바라보도록 설정
- name: {{ $.Values.gateway.name }}
namespace: {{ $.Values.envoyProxy.namespace }}
hostnames:
{{- range .hostnames }}
- {{ . | quote }}
{{- end }}
rules:
{{- range .rules }}
- matches:
- path:
type: PathPrefix
value: {{ .path | quote }}
backendRefs:
- name: {{ .service | quote }}
port: {{ .port }}
{{- end }}
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
name: {{ .name }}-security-policy
namespace: {{ .namespace | default "default" }}
spec:
targetRef:
group: gateway.networking.k8s.io
kind: HTTPRoute
name: {{ .name }}
{{- if .internalAccess }} # 외부 접속 허용하지 않음
authorization:
defaultAction: Deny
rules:
- action: Allow
principal:
clientCIDRs:
{{- range .clientCIDRs }}
- {{ . | quote }}
{{- end }}
{{- end }}
---
{{- end }}