Wexflow on Ubuntu 24.04

Wexflow is an open source workflow engine and automation platform for the repetitive work that keeps a business running but that nobody wants to do by hand: move the files that arrived overnight, unpack and convert them, hash and encrypt them, push them somewhere over SFTP, call an API, run a query, wait for a person to approve the result, then tell somebody it is done. You assemble that in a browser rather than writing and maintaining a pile of scripts.

A workflow is a list of tasks with settings, built in a visual designer. Wexflow ships more than one hundred ready made tasks covering file and folder operations, archives, encryption and hashing, HTTP calls, SQL queries, SSH and FTP transfers, image and document conversion, electronic mail and scripting. Workflows run on demand, on a cron or periodic schedule, or automatically when a file lands in a watched folder. An approval and records module lets a person sign off a step before the rest continues. A manager view starts, suspends, resumes and stops jobs, a dashboard shows live counters and full execution history, and everything the interface can do is also available through a documented REST API with a browsable specification.

This cloudimg image delivers Wexflow fully installed and running behind a reverse proxy with its database embedded on the same instance, so the platform is ready to design and run workflows within minutes of launch with no runtime to install, no database to provision and no web server to configure. The engine is the official upstream release, pinned by SHA-256 and recorded on the instance along with its digest, its licence and the runtime it was built against. The complete library of example workflows ships with the image, one per task type, so there is a working reference from the first sign in, and a cloudimg authored health check workflow gives a one click end to end proof that the engine really executes tasks. Examples that would otherwise launch themselves are shipped switched off, so nothing runs on your instance until you ask it to.

The image is hardened to be secure by default, and this is the main reason to take it rather than install the platform yourself. The upstream distribution seeds two administrator accounts that share one publicly documented password, and a publicly documented token signing key that would let anyone mint a valid session for any user without ever touching the sign in page. Neither survives here. The second account is removed outright, and on the first boot of every instance a unique administrator password, a unique signing key and a unique certificate passphrase are generated, with the sign in details written to a root only file. Until that has happened nothing at all is listening on the public port, so there is no window in which a newly launched instance is reachable with a known credential. First boot then proves the result before handing the instance over: it confirms that every published default is refused, that a token signed with the published key is refused, that the new password works, and that a real workflow runs to completion. The same check ships on the instance and can be re-run at any time. The engine itself runs as an unprivileged service account rather than as root, and an unauthenticated health endpoint is provided for load balancer probes.

Systemd manages the engine and the web server for automatic restarts and clean logging, the operating system is fully patched at build time and continues to receive unattended security updates, and every deployment is paired with a step by step deployment guide. Wexflow is licensed under the MIT licence, free and open source with no per user or per deployment fee, and is redistributed unmodified with its licence text retained on the image. cloudimg provides the packaging, the hardened configuration, the systemd integration, the per instance credential bootstrap, the verification tooling, security patching and 24/7 support with a guaranteed 24 hour response SLA. Wexflow is an independent open source project and this image is not affiliated with or endorsed by it.