huawei-cloud-sac-dify

Huawei Cloud Dify LLM App development Platform

Overview

Deploy the "Building a Dify LLM Application Development Platform" SAC solution on Huawei Cloud end-to-end using Terraform.

Architecture: VPC + Subnet + Security Group (ICMP/HTTP/HTTPS ingress), one ECS instance, and one EIP (1-300 Mbit/s). Cloud-init installs and starts Dify services on Ubuntu. The template supports both Dify community versions and flexus-ai-agent mode (controlled by dify_version).

Tool chain: Playwright CLI (price/solution metadata extraction) + Python 3.8+ (helper scripts) + Terraform (infrastructure provisioning). No KooCLI; deployment and lifecycle operations are handled through Terraform only.

Prerequisites

• Python 3.8+, Playwright CLI, Terraform 1.15.4+ — see CLI Installation Guide
• Huawei Cloud AK/SK via environment variables (HW_ACCESS_KEY, HW_SECRET_KEY); if not set, prompt user to manually edit /dify-workdir/terraform.auto.tfvars.json to fill in AK/SK
• IAM user with sufficient permissions or rf_admin_trust agency — see IAM Policies

Security

• 🚫 Never expose AK/SK in conversation or output
• 🚫 Never ask user to type AK/SK in chat
• ✅ Prefer IAM users over primary account
• ✅ Modification ops (apply, destroy) require explicit user confirmation

Core Commands

Placeholder values (see Parameters for per-OS resolution):

# 1. Extract solution info
 /extract_sac_deploy_info.py \
  --url "https://www.huaweicloud.com/solution/implementations/building-a-dify-llm-application-development-platform.html" \
  --out /sac_selected.json

# 2. Download and normalize template
mkdir -p /dify-workdir
curl -fsSL "https://documentation-samples.obs.cn-north-4.myhuaweicloud.com/solution-as-code-publicbucket/solution-as-code-moudle/flexus/dify-ecs.tf" \
  -o /dify-workdir/dify-ecs.tf

 /normalize_tf_providers.py /dify-workdir \
  --region "cn-north-4"

# 3. List variables for review
 /list_tf_variables.py /dify-workdir

# 4. Deploy
terraform init
terraform plan
# ⛔ STOP — Review the plan output above. Do NOT auto-apply.
# Confirm with the user (AskUserQuestion or equivalent) before proceeding.
# Only after explicit user confirmation:
terraform apply

# 5. Verify
terraform state list
terraform output -json

# 6. Cleanup
terraform destroy
# Only after terraform destroy succeeds:
# Linux / macOS
rm -f /dify-workdir/terraform.auto.tfvars.json
# Windows PowerShell
Remove-Item -Force /dify-workdir/terraform.auto.tfvars.json

Workflow

1. Extract solution info

 /extract_sac_deploy_info.py \
  --url "" \
  --out /sac_selected.json

After extraction, display the results to the user:

• Solution name: title field from output JSON
• Estimated price: estimated_price_text field
• If title or estimated_price_text is empty, warn the user and suggest manual verification on the solution page

2. Download and normalize template

mkdir -p /dify-workdir
curl -fsSL "https://documentation-samples.obs.cn-north-4.myhuaweicloud.com/solution-as-code-publicbucket/solution-as-code-moudle/flexus/dify-ecs.tf" \
  -o /dify-workdir/dify-ecs.tf

 /normalize_tf_providers.py /dify-workdir \
  --region "cn-north-4"

Prefer downloading the template from the explicit Dify Terraform URL above. Use the extracted template candidate only as a fallback if that URL is unavailable.

normalize_tf_providers.py writes /dify-workdir/terraform.auto.tfvars.json (including region and other parameters). If environment variables HW_ACCESS_KEY/HW_SECRET_KEY are not set, AK/SK fields are left empty. Prompt the user to manually edit the file to fill in AK/SK, then continue to the next step.

3. Confirm variables

 /list_tf_variables.py /dify-workdir

Review with user. Block apply if sensitive variables are empty/weak. Partially mask sensitive values such as passwords to avoid leaking them into the LLM context.

4. Deploy

⛔ STOP — Before running terraform apply, review the terraform plan output and confirm with the user (AskUserQuestion or equivalent). Do NOT auto-apply. Only proceed after explicit user confirmation.

5. Verify

See Verification Method and Acceptance Criteria.

6. Cleanup

Run terraform destroy to remove managed resources. Delete /dify-workdir/terraform.auto.tfvars.json only after terraform destroy succeeds, so failed destroy attempts can still reuse the existing credentials file for retry.

Linux / macOS:

rm -f /dify-workdir/terraform.auto.tfvars.json

Windows PowerShell:

Remove-Item -Force /dify-workdir/terraform.auto.tfvars.json

Parameters

Post-Deploy Output

• terraform output -json — includes access_instructions with Dify platform URL
• Dify UI: http:// (allow ~10 min for cloud-init)

Output Format

All script outputs are in JSON format: extract_sac_deploy_info.py outputs solution info JSON, list_tf_variables.py outputs variable list JSON.

Verification

Verify deployment results step by step:

1. Template extraction — Check /sac_selected.json contains solution_name, price fields
2. Template download — Confirm .tf files exist under /sac-workdir and terraform validate passes
3. Variable confirmation — Sensitive variables (AK/SK, password) are not empty in list_tf_variables.py output
4. Deployment — terraform plan shows no errors; user confirmed deployment; after apply, terraform state list shows all expected resources
5. Service reachability — Wait 10-15 min for cloud-init, thencurl -s http:// returns 200

See Verification Method and Acceptance Criteria for details.

Best Practices

• Always terraform plan before apply
• Start with charging_unit=month; switch to year after validation
• Allow 10-15 min post-deploy for cloud-init

Reference Documents

Notes

• /dify-workdir/terraform.auto.tfvars.json is sensitive — never commit to VCS
• Delete /dify-workdir/terraform.auto.tfvars.json after a successful terraform destroy to avoid leaving credentials on disk
• normalize_tf_providers.py writes region to tfvars; AK/SK left empty if env vars not set, user must fill manually
• Tool chain: Playwright CLI + Python + Terraform — no KooCLI