DATA
6de0bf9f5b
Vendored deer-flow upstream (bytedance/deer-flow) plus prompt-injection hardening: - New deerflow.security package: content_delimiter, html_cleaner, sanitizer (8 layers — invisible chars, control chars, symbols, NFC, PUA, tag chars, horizontal whitespace collapse with newline/tab preservation, length cap) - New deerflow.community.searx package: web_search, web_fetch, image_search backed by a private SearX instance, every external string sanitized and wrapped in <<<EXTERNAL_UNTRUSTED_CONTENT>>> delimiters - All native community web providers (ddg_search, tavily, exa, firecrawl, jina_ai, infoquest, image_search) replaced with hard-fail stubs that raise NativeWebToolDisabledError at import time, so a misconfigured tool.use path fails loud rather than silently falling back to unsanitized output - Native client back-doors (jina_client.py, infoquest_client.py) stubbed too - Native-tool tests quarantined under tests/_disabled_native/ (collect_ignore_glob via local conftest.py) - Sanitizer Layer 7 fix: only collapse horizontal whitespace, preserve newlines and tabs so list/table structure survives - Hardened runtime config.yaml references only the searx-backed tools - Factory overlay (backend/) kept in sync with deer-flow tree as a reference / source See HARDENING.md for the full audit trail and verification steps.
301 lines
12 KiB
Bash
Executable File
301 lines
12 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# deploy.sh - Build, start, or stop DeerFlow production services
|
|
#
|
|
# Commands:
|
|
# deploy.sh [--MODE] — build + start (default: --standard)
|
|
# deploy.sh build — build all images (mode-agnostic)
|
|
# deploy.sh start [--MODE] — start from pre-built images (default: --standard)
|
|
# deploy.sh down — stop and remove containers
|
|
#
|
|
# Runtime modes:
|
|
# --standard (default) All services including LangGraph server.
|
|
# --gateway No LangGraph container; nginx routes /api/langgraph/*
|
|
# to the Gateway compat API instead.
|
|
#
|
|
# Sandbox mode (local / aio / provisioner) is auto-detected from config.yaml.
|
|
#
|
|
# Examples:
|
|
# deploy.sh # build + start in standard mode
|
|
# deploy.sh --gateway # build + start in gateway mode
|
|
# deploy.sh build # build all images
|
|
# deploy.sh start --gateway # start pre-built images in gateway mode
|
|
# deploy.sh down # stop and remove containers
|
|
#
|
|
# Must be run from the repo root directory.
|
|
|
|
set -e
|
|
|
|
RUNTIME_MODE="standard"
|
|
|
|
case "${1:-}" in
|
|
build|start|down)
|
|
CMD="$1"
|
|
if [ -n "${2:-}" ]; then
|
|
case "$2" in
|
|
--standard) RUNTIME_MODE="standard" ;;
|
|
--gateway) RUNTIME_MODE="gateway" ;;
|
|
*) echo "Unknown mode: $2"; echo "Usage: deploy.sh [build|start|down] [--standard|--gateway]"; exit 1 ;;
|
|
esac
|
|
fi
|
|
;;
|
|
--standard|--gateway)
|
|
CMD=""
|
|
RUNTIME_MODE="${1#--}"
|
|
;;
|
|
"")
|
|
CMD=""
|
|
;;
|
|
*)
|
|
echo "Unknown argument: $1"
|
|
echo "Usage: deploy.sh [build|start|down] [--standard|--gateway]"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
DOCKER_DIR="$REPO_ROOT/docker"
|
|
COMPOSE_CMD=(docker compose -p deer-flow -f "$DOCKER_DIR/docker-compose.yaml")
|
|
|
|
# ── Colors ────────────────────────────────────────────────────────────────────
|
|
|
|
GREEN='\033[0;32m'
|
|
BLUE='\033[0;34m'
|
|
YELLOW='\033[1;33m'
|
|
RED='\033[0;31m'
|
|
NC='\033[0m'
|
|
|
|
# ── DEER_FLOW_HOME ────────────────────────────────────────────────────────────
|
|
|
|
if [ -z "$DEER_FLOW_HOME" ]; then
|
|
export DEER_FLOW_HOME="$REPO_ROOT/backend/.deer-flow"
|
|
fi
|
|
echo -e "${BLUE}DEER_FLOW_HOME=$DEER_FLOW_HOME${NC}"
|
|
mkdir -p "$DEER_FLOW_HOME"
|
|
|
|
# ── DEER_FLOW_REPO_ROOT (for skills host path in DooD) ───────────────────────
|
|
|
|
export DEER_FLOW_REPO_ROOT="$REPO_ROOT"
|
|
|
|
# ── config.yaml ───────────────────────────────────────────────────────────────
|
|
|
|
if [ -z "$DEER_FLOW_CONFIG_PATH" ]; then
|
|
export DEER_FLOW_CONFIG_PATH="$REPO_ROOT/config.yaml"
|
|
fi
|
|
|
|
if [ ! -f "$DEER_FLOW_CONFIG_PATH" ]; then
|
|
# Try to seed from repo (config.example.yaml is the canonical template)
|
|
if [ -f "$REPO_ROOT/config.example.yaml" ]; then
|
|
cp "$REPO_ROOT/config.example.yaml" "$DEER_FLOW_CONFIG_PATH"
|
|
echo -e "${GREEN}✓ Seeded config.example.yaml → $DEER_FLOW_CONFIG_PATH${NC}"
|
|
echo -e "${YELLOW}⚠ config.yaml was seeded from the example template.${NC}"
|
|
echo " Run 'make setup' to generate a minimal config, or edit $DEER_FLOW_CONFIG_PATH manually before use."
|
|
else
|
|
echo -e "${RED}✗ No config.yaml found.${NC}"
|
|
echo " Run 'make setup' from the repo root (recommended),"
|
|
echo " or 'make config' for the full template, then set the required model API keys."
|
|
exit 1
|
|
fi
|
|
else
|
|
echo -e "${GREEN}✓ config.yaml: $DEER_FLOW_CONFIG_PATH${NC}"
|
|
fi
|
|
|
|
# ── extensions_config.json ───────────────────────────────────────────────────
|
|
|
|
if [ -z "$DEER_FLOW_EXTENSIONS_CONFIG_PATH" ]; then
|
|
export DEER_FLOW_EXTENSIONS_CONFIG_PATH="$REPO_ROOT/extensions_config.json"
|
|
fi
|
|
|
|
if [ ! -f "$DEER_FLOW_EXTENSIONS_CONFIG_PATH" ]; then
|
|
if [ -f "$REPO_ROOT/extensions_config.json" ]; then
|
|
cp "$REPO_ROOT/extensions_config.json" "$DEER_FLOW_EXTENSIONS_CONFIG_PATH"
|
|
echo -e "${GREEN}✓ Seeded extensions_config.json → $DEER_FLOW_EXTENSIONS_CONFIG_PATH${NC}"
|
|
else
|
|
# Create a minimal empty config so the gateway doesn't fail on startup
|
|
echo '{"mcpServers":{},"skills":{}}' > "$DEER_FLOW_EXTENSIONS_CONFIG_PATH"
|
|
echo -e "${YELLOW}⚠ extensions_config.json not found, created empty config at $DEER_FLOW_EXTENSIONS_CONFIG_PATH${NC}"
|
|
fi
|
|
else
|
|
echo -e "${GREEN}✓ extensions_config.json: $DEER_FLOW_EXTENSIONS_CONFIG_PATH${NC}"
|
|
fi
|
|
|
|
|
|
# ── BETTER_AUTH_SECRET ───────────────────────────────────────────────────────
|
|
# Required by Next.js in production. Generated once and persisted so auth
|
|
# sessions survive container restarts.
|
|
|
|
_secret_file="$DEER_FLOW_HOME/.better-auth-secret"
|
|
if [ -z "$BETTER_AUTH_SECRET" ]; then
|
|
if [ -f "$_secret_file" ]; then
|
|
export BETTER_AUTH_SECRET
|
|
BETTER_AUTH_SECRET="$(cat "$_secret_file")"
|
|
echo -e "${GREEN}✓ BETTER_AUTH_SECRET loaded from $_secret_file${NC}"
|
|
else
|
|
export BETTER_AUTH_SECRET
|
|
BETTER_AUTH_SECRET="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
|
|
echo "$BETTER_AUTH_SECRET" > "$_secret_file"
|
|
chmod 600 "$_secret_file"
|
|
echo -e "${GREEN}✓ BETTER_AUTH_SECRET generated → $_secret_file${NC}"
|
|
fi
|
|
fi
|
|
|
|
# ── detect_sandbox_mode ───────────────────────────────────────────────────────
|
|
|
|
detect_sandbox_mode() {
|
|
local sandbox_use=""
|
|
local provisioner_url=""
|
|
|
|
[ -f "$DEER_FLOW_CONFIG_PATH" ] || { echo "local"; return; }
|
|
|
|
sandbox_use=$(awk '
|
|
/^[[:space:]]*sandbox:[[:space:]]*$/ { in_sandbox=1; next }
|
|
in_sandbox && /^[^[:space:]#]/ { in_sandbox=0 }
|
|
in_sandbox && /^[[:space:]]*use:[[:space:]]*/ {
|
|
line=$0; sub(/^[[:space:]]*use:[[:space:]]*/, "", line); print line; exit
|
|
}
|
|
' "$DEER_FLOW_CONFIG_PATH")
|
|
|
|
provisioner_url=$(awk '
|
|
/^[[:space:]]*sandbox:[[:space:]]*$/ { in_sandbox=1; next }
|
|
in_sandbox && /^[^[:space:]#]/ { in_sandbox=0 }
|
|
in_sandbox && /^[[:space:]]*provisioner_url:[[:space:]]*/ {
|
|
line=$0; sub(/^[[:space:]]*provisioner_url:[[:space:]]*/, "", line); print line; exit
|
|
}
|
|
' "$DEER_FLOW_CONFIG_PATH")
|
|
|
|
if [[ "$sandbox_use" == *"deerflow.community.aio_sandbox:AioSandboxProvider"* ]]; then
|
|
if [ -n "$provisioner_url" ]; then
|
|
echo "provisioner"
|
|
else
|
|
echo "aio"
|
|
fi
|
|
else
|
|
echo "local"
|
|
fi
|
|
}
|
|
|
|
# ── down ──────────────────────────────────────────────────────────────────────
|
|
|
|
if [ "$CMD" = "down" ]; then
|
|
# Set minimal env var defaults so docker compose can parse the file without
|
|
# warning about unset variables that appear in volume specs.
|
|
export DEER_FLOW_HOME="${DEER_FLOW_HOME:-$REPO_ROOT/backend/.deer-flow}"
|
|
export DEER_FLOW_CONFIG_PATH="${DEER_FLOW_CONFIG_PATH:-$DEER_FLOW_HOME/config.yaml}"
|
|
export DEER_FLOW_EXTENSIONS_CONFIG_PATH="${DEER_FLOW_EXTENSIONS_CONFIG_PATH:-$DEER_FLOW_HOME/extensions_config.json}"
|
|
export DEER_FLOW_DOCKER_SOCKET="${DEER_FLOW_DOCKER_SOCKET:-/var/run/docker.sock}"
|
|
export DEER_FLOW_REPO_ROOT="${DEER_FLOW_REPO_ROOT:-$REPO_ROOT}"
|
|
export BETTER_AUTH_SECRET="${BETTER_AUTH_SECRET:-placeholder}"
|
|
"${COMPOSE_CMD[@]}" down
|
|
exit 0
|
|
fi
|
|
|
|
# ── build ────────────────────────────────────────────────────────────────────
|
|
# Build produces mode-agnostic images. No --gateway or sandbox detection needed.
|
|
|
|
if [ "$CMD" = "build" ]; then
|
|
echo "=========================================="
|
|
echo " DeerFlow — Building Images"
|
|
echo "=========================================="
|
|
echo ""
|
|
|
|
# Docker socket is needed for compose to parse volume specs
|
|
if [ -z "$DEER_FLOW_DOCKER_SOCKET" ]; then
|
|
export DEER_FLOW_DOCKER_SOCKET="/var/run/docker.sock"
|
|
fi
|
|
|
|
"${COMPOSE_CMD[@]}" build
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo " ✓ Images built successfully"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo " Next: deploy.sh start [--gateway]"
|
|
echo ""
|
|
exit 0
|
|
fi
|
|
|
|
# ── Banner ────────────────────────────────────────────────────────────────────
|
|
|
|
echo "=========================================="
|
|
echo " DeerFlow Production Deployment"
|
|
echo "=========================================="
|
|
echo ""
|
|
|
|
# ── Detect runtime configuration ────────────────────────────────────────────
|
|
# Only needed for start / up — determines which containers to launch.
|
|
|
|
sandbox_mode="$(detect_sandbox_mode)"
|
|
echo -e "${BLUE}Sandbox mode: $sandbox_mode${NC}"
|
|
|
|
echo -e "${BLUE}Runtime mode: $RUNTIME_MODE${NC}"
|
|
|
|
case "$RUNTIME_MODE" in
|
|
gateway)
|
|
export LANGGRAPH_UPSTREAM=gateway:8001
|
|
export LANGGRAPH_REWRITE=/api/
|
|
services="frontend gateway nginx"
|
|
;;
|
|
standard)
|
|
services="frontend gateway langgraph nginx"
|
|
;;
|
|
esac
|
|
|
|
if [ "$sandbox_mode" = "provisioner" ]; then
|
|
services="$services provisioner"
|
|
fi
|
|
|
|
# ── DEER_FLOW_DOCKER_SOCKET ───────────────────────────────────────────────────
|
|
|
|
if [ -z "$DEER_FLOW_DOCKER_SOCKET" ]; then
|
|
export DEER_FLOW_DOCKER_SOCKET="/var/run/docker.sock"
|
|
fi
|
|
|
|
if [ "$sandbox_mode" != "local" ]; then
|
|
if [ ! -S "$DEER_FLOW_DOCKER_SOCKET" ]; then
|
|
echo -e "${RED}⚠ Docker socket not found at $DEER_FLOW_DOCKER_SOCKET${NC}"
|
|
echo " AioSandboxProvider (DooD) will not work."
|
|
exit 1
|
|
else
|
|
echo -e "${GREEN}✓ Docker socket: $DEER_FLOW_DOCKER_SOCKET${NC}"
|
|
fi
|
|
fi
|
|
|
|
echo ""
|
|
|
|
# ── Start / Up ───────────────────────────────────────────────────────────────
|
|
|
|
if [ "$CMD" = "start" ]; then
|
|
echo "Starting containers (no rebuild)..."
|
|
echo ""
|
|
# shellcheck disable=SC2086
|
|
"${COMPOSE_CMD[@]}" up -d --remove-orphans $services
|
|
else
|
|
# Default: build + start
|
|
echo "Building images and starting containers..."
|
|
echo ""
|
|
# shellcheck disable=SC2086
|
|
"${COMPOSE_CMD[@]}" up --build -d --remove-orphans $services
|
|
fi
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo " DeerFlow is running! ($RUNTIME_MODE mode)"
|
|
echo "=========================================="
|
|
echo ""
|
|
echo " 🌐 Application: http://localhost:${PORT:-2026}"
|
|
echo " 📡 API Gateway: http://localhost:${PORT:-2026}/api/*"
|
|
if [ "$RUNTIME_MODE" = "gateway" ]; then
|
|
echo " 🤖 Runtime: Gateway embedded"
|
|
echo " API: /api/langgraph/* → Gateway (compat)"
|
|
else
|
|
echo " 🤖 LangGraph: http://localhost:${PORT:-2026}/api/langgraph/*"
|
|
fi
|
|
echo ""
|
|
echo " Manage:"
|
|
echo " make down — stop and remove containers"
|
|
echo " make docker-logs — view logs"
|
|
echo ""
|