Flowable

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.
• Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting point for the Flowable UI plus its local PostgreSQL.
• NSG inbound: allow 22/tcp from your management network and 80/tcp for the Flowable UI. To expose the UI publicly, front it with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Flowable by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, then create the VM:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:flowable-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name flowable \
  --image sac1647283583153:flowable-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name flowable --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check the three services:

systemctl is-active flowable.service nginx.service postgresql.service

All three report active. On first boot, Flowable generates a unique admin password, and the Flowable IDM bootstraps the admin user with it against an empty database.

Step 5 - Retrieve your admin password

First boot generates the admin password uniquely for your VM and writes it to a root-only file. Read the file:

sudo cat /root/flowable-credentials.txt

This file contains FLOWABLE_ADMIN_USER (admin), FLOWABLE_ADMIN_PASSWORD and the FLOWABLE_URL for your VM. Store the password somewhere safe, because it grants full administrative access to every Flowable application.

Step 6 - Check the health endpoint

nginx serves a static health endpoint that does not require a login and does not depend on the application being fully started. Request it:

curl -s -o /dev/null -w '%{http_code}\n' http://localhost/health

The request returns 200. The Flowable UI itself requires authentication, so the static /health endpoint is the liveness probe.

Step 7 - Sign in to the Flowable UI

Browse to http://<vm-public-ip>/flowable-ui/ (the bare / redirects there). Sign in as admin with the password from Step 5.

After you sign in, you land on the application launcher, which links to the four Flowable applications: Task App, Modeler App, Admin App and IDM App.

Step 8 - Design a process in the Modeler

Open the Modeler App to design BPMN 2.0 processes, DMN decision tables, CMMN case models and forms with the visual editor. Create a new process model, then drag start events, tasks and gateways from the palette onto the canvas and wire them together.

Step 9 - Monitor the engines in the Admin app

Open the Admin App to inspect the Process, CMMN, App, Form, DMN and Content engines: deployments, process definitions, running instances, jobs and tasks. The endpoint configuration points at the local Flowable REST API on the same VM.

Step 10 - Verify the admin login from the command line

Confirm that the admin credentials authenticate against the Flowable IDM REST API:

PW=$(sudo grep '^FLOWABLE_ADMIN_PASSWORD=' /root/flowable-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w '%{http_code}\n' -u "admin:${PW}" http://localhost/flowable-ui/api/idm/users/admin

The command returns 200 for the correct password. A wrong password returns 401.

Data storage on the dedicated data disk

Flowable's state lives in a local PostgreSQL database named flowable. The PostgreSQL data directory is relocated onto a dedicated Azure data disk mounted at /var/lib/flowable (the cluster data lives under /var/lib/flowable/pgdata). Your process definitions, running instances, decision tables and user data therefore ride on the data volume and survive image and instance maintenance.

Check the data disk:

df -h /var/lib/flowable

The Flowable application binds to loopback only (127.0.0.1:8080). nginx on port 80 is the single public listener and reverse-proxies the Flowable UI.

Enabling HTTPS

To expose Flowable publicly, terminate TLS in front of it. Point a DNS record at the VM's public IP, then install a certificate with Certbot's nginx plugin. Flowable is then served over HTTPS.

Certbot prompts interactively for your email and domain, so consult the Certbot documentation for the exact certbot --nginx invocation for your domain.

Maintenance

• Service status: systemctl status flowable.service shows the Flowable application, and systemctl status postgresql.service shows the database.
• Logs: run journalctl -u flowable.service for the Flowable application logs.
• Restart: run sudo systemctl restart flowable.service after configuration changes under /etc/flowable.
• Backups: back up the flowable PostgreSQL database with pg_dump and snapshot the /var/lib/flowable data disk.
• OS updates: the image ships with unattended security updates enabled.

Support

SecureAnyCloud publishes this image and provides 24/7 support for it. Flowable is a trademark of Flowable AG. This image bundles the open-source Flowable distribution (Apache License 2.0) and is not affiliated with or endorsed by Flowable AG.

Deploy on Azure

Launch Flowable on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Application stack

Component Role

Flowable 6.8.1 The full web UI (Modeler, Task, Admin, IDM) as an executable Spring Boot WAR, bound to 127.0.0.1:8080

Eclipse Temurin 17 JRE The supported LTS Java runtime for the Flowable 6.8.x Spring Boot 2.7 line

PostgreSQL Stores all process, case, decision and identity data, on the dedicated /var/lib/flowable volume

nginx Reverse proxy on port 80; serves the static /health endpoint and forwards to the UI

Connecting to your instance

Connect over SSH on port 22 as the default login user for your operating system variant, using the key pair you selected at launch:

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i your-key.pem ubuntu@<public-ip>

Replace your-key.pem with the path to your private key and <public-ip> with the instance's public address.

Retrieve the administrator password

The administrator password is unique to your instance, and first boot writes it to a root-only file. Read it over SSH:

sudo cat /root/flowable-credentials.txt

The file shows the sign-in URL, the administrator user name and the generated password:

# Flowable 6.8.1 — generated on first boot.
# These credentials are unique to this instance. Store them somewhere safe. FLOWABLE_URL=http://203.0.113.10/flowable-ui/ FLOWABLE_ADMIN_USER=admin FLOWABLE_ADMIN_PASSWORD=<set-at-first-boot>

Store the password somewhere safe. You can change it later from the Identity Management app.

Sign in

Open your browser to the instance's public address on port 80. The bare address redirects to the Flowable UI, which presents the sign-in form:

Sign in as admin with the password from the credentials file. You arrive in the Flowable UI, where you can switch between the Modeler, Task, Admin and Identity Management applications.

Design a process in the Modeler

The Modeler is the visual designer for your BPMN 2.0 processes, DMN decision tables and CMMN cases. Create a process model, and Flowable opens the drag-and-drop BPMN editor. Build the flow from the palette of start events, tasks, gateways and end events.

When a model is ready, publish it into an app and deploy it to the engine, or export the BPMN XML for use elsewhere.

Administer running instances

The Admin console connects to the running engines, so you can inspect and manage what is live. It shows process and case definitions and their deployments, running and historic instances, jobs, and the endpoint configuration for the Process, CMMN, App, Form, DMN and Content engines.

Manage users and groups

The Identity Management app is where you administer the accounts and groups that can sign in and the privileges they hold. The single administrator account created on first boot is shown here. As your team grows, add users and groups, and assign privileges.

Verify the deployment

Everything is running when the instance boots. To confirm over SSH, check that the three services are active:

systemctl is-active flowable.service nginx.service postgresql.service

active active active

Confirm the static health endpoint answers on port 80:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/health

HTTP 200

Confirm the listeners: nginx on port 80 is the only public surface, while Flowable (8080) and PostgreSQL (5432) bind to loopback:

sudo ss -tlnp | grep -E ':(80|8080|5432)'

LISTEN 0.0.0.0:80 LISTEN 127.0.0.1:8080 LISTEN 127.0.0.1:5432

The dedicated data volume

All Flowable and PostgreSQL data lives on a dedicated 30 GiB gp3 EBS volume mounted at /var/lib/flowable, separate from the operating system disk and independently resizable. The PostgreSQL cluster data directory is relocated onto it at /var/lib/flowable/pgdata. Confirm the layout:

df -h /var/lib/flowable

/dev/nvme1n1 30G 67M 28G 1% /var/lib/flowable

The volume is mounted by filesystem UUID in /etc/fstab with the nofail option, so every instance reproduces the identical layout and stays bootable even if the volume is ever detached.

To grow the volume, resize the EBS volume in the AWS console, then extend the filesystem with sudo resize2fs /dev/nvme1n1.

Point Flowable at an external database

You can point Flowable at an external or managed database (for example Amazon RDS for PostgreSQL) instead of the bundled PostgreSQL. Edit the datasource in /etc/flowable/flowable-ui.properties, setting the JDBC URL, user name and database password. Then restart flowable.service:

# In /etc/flowable/flowable-ui.properties, set the external datasource: spring.datasource.url=jdbc:postgresql://your-db-host:5432/flowable spring.datasource.username=flowable spring.datasource.password=<new-password>
# then apply it:
sudo systemctl restart flowable.service

Flowable creates and upgrades its schema on startup, so an empty target database is populated automatically on the next start.

Enable HTTPS

To serve Flowable over HTTPS, terminate TLS at nginx. Point a DNS name at the instance, then obtain and install a certificate with certbot for <your-domain>:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

certbot updates the nginx site in place and sets up automatic renewal. Restrict inbound access to ports 80 and 443 in your security group.

Service management

The appliance is managed with standard systemctl commands. To view status or logs:

systemctl status flowable.service journalctl -u flowable.service -n 100 --no-pager

flowable.service runs the Spring Boot WAR as the unprivileged flowable system user. nginx.service is the public listener, and postgresql.service must be active before Flowable.

Support

Every deployment is backed by SecureAnyCloud engineers available around the clock via email and live chat.

• Contact: sales@secureanycloud.com
• Response times: one-hour average response for critical issues (service down or data loss risk), and general inquiries within business hours.

Support covers initial deployment and instance sizing, connecting Flowable to an external database, Identity Management and LDAP configuration, TLS termination, BPMN, DMN and CMMN modeling guidance, and Flowable and PostgreSQL version upgrades. Include your instance ID and AWS region to speed up troubleshooting.

Flowable is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Flowable Workflow Engine on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com