Notes Sändu

Checklist

• Update variables in var.tf
• Set passwords in terraform.tfvars (see: Generate secure keys)
• Clean state if needed:

  rm -rf .terraform .terraform.lock.hcl terraform.tfstate terraform.tfstate.backup

Commands

# Login
az login
az login --use-device-code --tenant <name>.onmicrosoft.com 
az account set --subscription <subscriptionID>

# Register provider (first time only)
az provider register --namespace Microsoft.App

# Deploy
terraform init
terraform plan
terraform apply # -auto-approve

Production Variables

Existing resource group

terraform import azurerm_resource_group.rg /subscriptions//resourceGroups/

⚠️ Must change for production:

Variable	Description
subscription-id	Your Azure subscription ID
pgsql-password	PostgreSQL password (no default, required)
dify-secret-key	API encryption key
dify-plugin-daemon-key	Plugin daemon auth key
dify-inner-api-key	Internal API key
dify-sandbox-api-key	Sandbox execution key

Generate secure keys

Generate secure keys and write them to terraform.tfvars:

cat <<EOF > terraform.tfvars
pgsql-password         = "$(openssl rand -base64 24 | tr -d '/+=' | head -c 32)"
dify-secret-key        = "$(openssl rand -base64 42)"
dify-plugin-daemon-key = "$(openssl rand -base64 42)"
dify-inner-api-key     = "$(openssl rand -base64 42)"
dify-sandbox-api-key   = "$(openssl rand -base64 42)"
EOF

Should also review:

• group-name - Resource group name
• region - Azure region
• storage-account, redis, psql-flexible - Must be globally unique

---

Dify Azure Terraform

Deploy Dify (v1.14.0) on Azure using Terraform.

Architecture

Component	Azure Service
nginx	Container Apps
web	Container Apps
api	Container Apps
worker	Container Apps
worker_beat	Container Apps (singleton, scheduled tasks)
sandbox	Container Apps
ssrf_proxy	Container Apps
plugin_daemon	Container Apps
db	PostgreSQL Flexible Server
redis	Azure Cache for Redis
storage	Azure Blob Storage

Quick Start

1. Copy and configure variables:

   cp terraform.tfvars.example terraform.tfvars
   # Edit terraform.tfvars with your values

2. Deploy:

   terraform init
   terraform apply # -auto-approve if # if you are lazy of saying yes everytime

Documentation

See PROJECT.md for detailed configuration and troubleshooting.

References

• Dify Documentation
• Dify GitHub
• Azure Container Apps

Dify Tipps

Adding new Microsoft Foundry (Azure OpenAI) Models

• Deployment Name (your model deployment, e.g. gpt-5-mini)3

1. Get Values from Foundry

• API Key
• Azure OpenAI Endpoint

e.g https://.openai.azure.com/openai/v1

2. Configure in Dify

Path: Settings → Model Provider → Add Model → Azure OpenAI

Field	Value
Deployment Name	<deployment-name>
Model Type	LLM
Authorization Name	any
API Endpoint URL	https://<resource>.openai.azure.com/openai/v1
API Key	<api-key>
API Version	(optional: automatically set on endpoint openai/v1)
Base Model	same as deployment name

---

Notes

• Must use deployment name, not model name
• Endpoint must include /openai/v1
• API version must match Azure support