Env Sync

Location

Both .env.example and .env live in dify/docker/ (DOCKER_DIR). All commands below run from that directory.

Edge Case: .env Does Not Exist

cd $DOCKER_DIR

if [ ! -f ".env" ]; then
  echo "WARNING: .env does not exist"
  echo "Creating from .env.example..."
  cp .env.example .env
  echo "CREATED .env from .env.example"
  echo ""
  echo "IMPORTANT: Review and set these security-sensitive values:"
  grep -E '^(SECRET_KEY|DB_PASSWORD|REDIS_PASSWORD|INIT_PASSWORD)=' .env
fi

After creating, show the user the critical variables that need manual attention.

Edge Case: Official dify-env-sync.sh

Check if Dify's own sync script exists before using the manual algorithm:

if [ -f "$DOCKER_DIR/dify-env-sync.sh" ]; then
  echo "Found official dify-env-sync.sh"
  echo "This script:"
  echo "  - One-way sync from .env.example to .env"
  echo "  - Preserves all existing custom values"
  echo "  - Creates timestamped backup in env-backup/"
  echo ""
  echo "Run it with: bash dify-env-sync.sh"
fi

Offer the user a choice: use the official script or the manual algorithm below.

Sync Algorithm

Step 1: Extract Keys

cd $DOCKER_DIR

# Keys from .env.example (skip comments and empty lines)
grep -E '^[A-Z_][A-Z0-9_]*=' .env.example | cut -d= -f1 | sort > /tmp/dify-env-example-keys

# Keys from .env
grep -E '^[A-Z_][A-Z0-9_]*=' .env | cut -d= -f1 | sort > /tmp/dify-env-keys

Step 2: Find New Variables

# Keys in .env.example that are NOT in .env
NEW_KEYS=$(comm -23 /tmp/dify-env-example-keys /tmp/dify-env-keys)

if [ -z "$NEW_KEYS" ]; then
  echo "No new environment variables found. .env is up to date."
else
  echo "Found new variables:"
  echo "$NEW_KEYS" | wc -l
fi

Step 3: Extract Full Lines for New Variables

For each new key, get the full KEY=VALUE line from .env.example:

for KEY in $NEW_KEYS; do
  LINE=$(grep -E "^${KEY}=" .env.example | head -1)
  VALUE=$(echo "$LINE" | cut -d= -f2-)
  echo "$KEY=$VALUE"
done

Step 4: Show User What Will Be Added

Present as a table before making changes:

| Variable              | Default Value      | Action Required? |
|-----------------------|-------------------|-----------------|
| NEW_FEATURE_FLAG      | false             | No              |
| PLUGIN_API_KEY        | (empty)           | YES — set value |
| NEW_TIMEOUT_SECONDS   | 300               | No              |

Flag as "Action Required" any variable matching these patterns:

• *SECRET*
• *PASSWORD*
• *KEY* (but not *_TIMEOUT* or *_SIZE*)
• *TOKEN*
• Value is empty

Step 5: Append to .env

After user confirms:

cd $DOCKER_DIR

echo "" >> .env
echo "# --- Added by dify-ops update on $(date +%Y-%m-%d) ---" >> .env

for KEY in $NEW_KEYS; do
  LINE=$(grep -E "^${KEY}=" .env.example | head -1)
  echo "$LINE" >> .env
done

echo "Added $(echo "$NEW_KEYS" | wc -l | tr -d ' ') new variables to .env"

Step 6: Cleanup

rm -f /tmp/dify-env-example-keys /tmp/dify-env-keys

Checking Removed Variables

Also check for variables in .env that are no longer in .env.example:

REMOVED_KEYS=$(comm -13 /tmp/dify-env-example-keys /tmp/dify-env-keys)
if [ -n "$REMOVED_KEYS" ]; then
  echo ""
  echo "Note: These variables are in .env but no longer in .env.example:"
  echo "$REMOVED_KEYS"
  echo "They may be deprecated. Check Dify release notes before removing."
fi

Do NOT automatically remove these — just inform the user. They may be custom additions.

Security-Sensitive Variables

When adding new variables, flag these for special attention:

If any of these are added with empty defaults, warn the user explicitly.