Flowable Workflow Engine on AWS User Guide

Overview

This image runs Flowable, the open source workflow and Business Process Management engine. Flowable executes BPMN 2.0 process models, DMN decision tables and CMMN cases on a lightweight Java runtime, and ships a complete web UI for designing, running and administering them.

The appliance runs the bundled flowable-ui.war — the full Flowable UI, which is four applications in one: the Modeler (a visual designer for BPMN, DMN and CMMN models), the Task application (where people pick up and complete the work a process assigns them), the Admin console (for inspecting and administering running process and case instances, jobs and deployments), and the Identity Management (IDM) app (users, groups and privileges). It is an executable Spring Boot application, launched with java -jar flowable-ui.war and served under the context path /flowable-ui.

Flowable binds to the loopback interface only. nginx publishes the interface on port 80 and reverse-proxies to it, and also serves a small static health endpoint at /health. All process, case, decision and identity data is stored in a local PostgreSQL database, whose cluster data directory lives on a dedicated, independently resizable EBS volume mounted at /var/lib/flowable, kept off the operating system disk.

The administrator password is generated on the first boot of every deployed instance, so two instances launched from the same Amazon Machine Image never share a password. It is written to /root/flowable-credentials.txt with mode 0600, so only the root user can read it. Upstream Flowable ships a well known default administrator account; this image does not — the shipped AMI carries no known Flowable credential, and the administrator account is created fresh, with the per instance password, on first boot.

Application stack

Connecting to your instance

Connect over SSH on port 22 as the default login user for your operating system variant, using the key pair you selected at launch:

ssh -i your-key.pem ubuntu@<public-ip>

Replace your-key.pem with the path to your private key and <public-ip> with the instance's public address.

Retrieve the administrator password

The administrator password is unique to your instance and is written to a root only file on first boot. Read it over SSH:

sudo cat /root/flowable-credentials.txt

You will see the sign in URL, the administrator user name and the generated password:

# Flowable 6.8.1 — generated on first boot.
# These credentials are unique to this instance. Store them somewhere safe.

FLOWABLE_URL=http://203.0.113.10/flowable-ui/
FLOWABLE_ADMIN_USER=admin
FLOWABLE_ADMIN_PASSWORD=************************

Store the password somewhere safe. You can change it later from the Identity Management app.

Sign in

Open your browser to the instance's public address on port 80. The bare address redirects to the Flowable UI, which presents the sign in form:

Sign in as admin with the password from the credentials file. You arrive in the Flowable UI, from where you can switch between the Modeler, Task, Admin and Identity Management applications.

Design a process in the Modeler

The Modeler is the visual designer for your BPMN 2.0 processes, DMN decision tables and CMMN cases. Create a process model and Flowable opens the drag and drop BPMN editor, where you build the flow from the palette of start events, tasks, gateways and end events.

When a model is ready, publish it into an app and deploy it to the engine, or export the BPMN XML for use elsewhere.

Administer running instances

The Admin console connects to the running engines and lets you inspect and manage what is live: process and case definitions and their deployments, running and historic instances, jobs, and the endpoint configuration for the Process, CMMN, App, Form, DMN and Content engines.

Manage users and groups

The Identity Management app is where you administer the accounts and groups that can sign in and the privileges they hold. The single administrator account created on first boot is shown here; add users and groups, and assign privileges, as your team grows.

Verify the deployment

Everything is running when the instance boots. To confirm over SSH, check that the three services are active:

systemctl is-active flowable.service nginx.service postgresql.service

active
active
active

Confirm the static health endpoint answers on port 80:

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1/health

HTTP 200

Confirm the listeners: nginx on port 80 is the only public surface, while Flowable (8080) and PostgreSQL (5432) bind to loopback:

sudo ss -tlnp | grep -E ':(80|8080|5432)'

LISTEN 0.0.0.0:80
LISTEN 127.0.0.1:8080
LISTEN 127.0.0.1:5432

The dedicated data volume

All Flowable and PostgreSQL data lives on a dedicated 30 GiB gp3 EBS volume mounted at /var/lib/flowable, separate from the operating system disk and independently resizable. The PostgreSQL cluster data directory is relocated onto it at /var/lib/flowable/pgdata. Confirm the layout:

df -h /var/lib/flowable

/dev/nvme1n1     30G   67M   28G   1% /var/lib/flowable

The volume is mounted by filesystem UUID in /etc/fstab with the nofail option, so every instance reproduces the identical layout and stays bootable even if the volume is ever detached. To grow it, resize the EBS volume in the AWS console, then extend the filesystem with sudo resize2fs /dev/nvme1n1.

Point Flowable at an external database

The bundled PostgreSQL is production ready, but you can point Flowable at an external or managed database (for example Amazon RDS for PostgreSQL). Edit the datasource in /etc/flowable/flowable-ui.properties, setting the JDBC URL, user name and database password, then restart flowable.service:

# In /etc/flowable/flowable-ui.properties, set the external datasource:
spring.datasource.url=jdbc:postgresql://your-db-host:5432/flowable
spring.datasource.username=flowable
spring.datasource.password=<new-password>
# then apply it:
sudo systemctl restart flowable.service

Flowable creates and upgrades its schema on startup, so an empty target database is populated automatically on the next start.

Enable HTTPS

For production use, terminate TLS at nginx. Point a DNS name at the instance, then obtain and install a certificate with certbot for <your-domain>:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

certbot updates the nginx site in place and sets up automatic renewal. Restrict inbound access to ports 80 and 443 in your security group.

Service management

The appliance is managed with standard systemctl commands. To view status or logs:

systemctl status flowable.service
journalctl -u flowable.service -n 100 --no-pager

flowable.service runs the Spring Boot WAR as the unprivileged flowable system user; nginx.service is the public listener; postgresql.service must be active before Flowable.

Support

Every deployment is backed by cloudimg engineers available around the clock via email and live chat.

• Contact: support@cloudimg.co.uk
• Response times: one hour average response for critical issues (service down or data loss risk); general enquiries within business hours.

Support covers initial deployment and instance sizing, connecting Flowable to an external database, Identity Management and LDAP configuration, TLS termination, BPMN, DMN and CMMN modeling guidance, and Flowable and PostgreSQL version upgrades. Include your instance ID and AWS region to expedite troubleshooting.

Flowable is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.