Terraform for Dify on Google Cloud

This repository allows you to automatically set up Google Cloud resources using Terraform and deploy Dify in a highly available configuration.

• Serverless hosting
• Auto-scaling
• Data persistence

• Google Cloud account
• Terraform installed
• gcloud CLI installed

• Set environment-specific values in the terraform/environments/dev/terraform.tfvars file.

• Create a GCS bucket to manage Terraform state in advance, and replace "your-tfstate-bucket" in the terraform/environments/dev/provider.tf file with the name of the created bucket.

1. Clone the repository:

   git clone https://github.com/DeNA/dify-google-cloud-terraform.git

2. Initialize Terraform:

   cd terraform/environments/dev
   terraform init

3. Make Artifact Registry repository:

   terraform apply -target=module.registry

4. Build & push container images:

   cd ../../..
   sh ./docker/cloudbuild.sh <your-project-id> <your-region>

   You can also specify a version of the dify-api image.

   sh ./docker/cloudbuild.sh <your-project-id> <your-region> <dify-api-version>

   If no version is specified, the latest version is used by default.

5. Terraform plan:

   cd terraform/environments/dev
   terraform plan

6. Terraform apply:

   terraform apply

terraform destroy

Note: Cloud Storage, Cloud SQL, VPC, and VPC Peering cannot be deleted with the terraform destroy command. These are critical resources for data persistence. Access the console and carefully delete them. After that, use the terraform destroy command to ensure all resources have been deleted.

When running terraform apply, you may encounter an invalid_auth error while creating the google_monitoring_notification_channel for Slack, even if your webhook URL is correct.

│ Error: Error creating NotificationChannel: googleapi: Error 400: invalid_auth

This can be caused by a rare inconsistency in the GCP API when the channel is created via Terraform. If you have verified your webhook URL is correct (e.g., by testing it with curl), the workaround is to create the channel manually in the GCP console and then import it into your Terraform state.

Resolution Steps:

1. Create the Channel Manually in GCP:

   • Go to the GCP Console: Monitoring > Alerting.
   • Click EDIT NOTIFICATION CHANNELS.
   • Under Slack, click ADD NEW and create the channel using your webhook URL.

2. Ensure the Resource Exists in Your Terraform Code: Make sure the notification channel resource is defined in your Terraform configuration (e.g., modules/cloudrun/main.tf). The terraform import command requires a corresponding resource block in the code.

   resource "google_monitoring_notification_channel" "slack" {
     display_name = "Slack"
     type         = "slack"
     labels = {
       channel_name = var.slack_channel_name
     }
     sensitive_labels {
       auth_token = var.slack_webhook_url
     }
   }

3. Find the Notification Channel's Full ID: Use the gcloud CLI to find the full name/ID of the channel you just created. Replace [YOUR_CHANNEL_DISPLAY_NAME] with the name you gave it in the console.

   gcloud beta monitoring channels list --filter="displayName='[YOUR_CHANNEL_DISPLAY_NAME]'" --format="value(name)"

   The output will look something like projects/[your-project-id]/notificationChannels/[channel-id].

4. Run terraform import: From the terraform/environments/dev directory, run the import command. Replace [FULL_CHANNEL_ID_FROM_PREVIOUS_STEP] with the value you just copied.

   terraform import module.cloudrun.google_monitoring_notification_channel.slack [FULL_CHANNEL_ID_FROM_PREVIOUS_STEP]

   You should see an "Import successful!" message.

5. Verify the State: Run terraform plan. The output should be No changes. Your infrastructure matches the configuration.. This confirms the manually created channel is now fully managed by Terraform.

• Dify
• GitHub

This software is licensed under the MIT License. See the LICENSE file for more details.