Langflow - Hardened Low-Code AI Builder

What is Langflow

Langflow is an open-source, low-code visual builder for multi-agent and Retrieval-Augmented-Generation (RAG) AI applications. A drag-and-drop canvas lets you compose chains of LLM calls, tool integrations, vector retrievers, memory blocks, and conditional logic into a working AI application without writing application code. Each flow can be exposed as a REST API, embedded in an existing product, or run from the visual editor. Native components ship for OpenAI, Anthropic, Ollama, Azure OpenAI, vector stores, document loaders, and dozens of other building blocks.

Why self-host Langflow

Self-hosting keeps every prompt, conversation, embedding, and credential inside your own tenant. No third-party SaaS sees your customer data, provider API keys, or internal knowledge bases. Recommended for teams with data residency requirements, organisations under regulated frameworks (HIPAA, GDPR, ISO 27001), and AI labs that need full visibility into the inference path.

What this VM image adds

Security hardening:

• Per-instance admin password generated at first boot - the cloud Instance ID is written to /root/langflow-credentials.txt and used as the initial admin password, unique to every deployment
• Persistent JWT secret per instance - 64-character random hex key signs all Langflow session tokens and seals encrypted variables; never the same on two deployments
• Authentication enforced - LANGFLOW_AUTO_LOGIN is disabled out of the box; no anonymous access to flows, variables, or secrets
• Langflow bound to localhost only - the FastAPI runtime listens on 127.0.0.1:7860, exposed externally only through the hardened Nginx reverse proxy on 80/443 (auto HTTP-to-HTTPS redirect, self-signed TLS pre-deployed)
• WebSocket-aware reverse proxy - streaming LLM responses work end-to-end through the proxy with extended 300s timeouts for long-running flow executions
• Langflow runs as non-root - dedicated langflow system user, no shell, locked home directory
• Flow data owned by langflow user - SQLite database, encrypted variables, and uploaded files are 0750 with UMask=0027 enforced via systemd
• Telemetry disabled - DO_NOT_TRACK=true
• Trivy CVE scan - every image is scanned with Trivy before release
• Trivy secret scan - blocks any image that ships with leaked credentials
• UFW firewall - only ports 80, 443, and 22 open
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Credentials file - /root/langflow-credentials.txt with web UI URL and the per-instance admin password

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 or larger recommended; Langflow loads its component graph and Python dependencies on first start)
2. Open NSG: TCP 80 and 443 from your client networks - SSH 22 from your management IPs only
3. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
4. Read connection details: sudo cat /root/langflow-credentials.txt - contains the web UI URL and the per-instance admin password
5. Open https://<PUBLIC_IP> - accept the self-signed certificate warning (replace with a CA-signed certificate via certbot for production), log in with the credentials from the file, then change the password from User Settings

First boot takes 1-2 minutes to become fully responsive: the FastAPI runtime cold-loads the component registry from disk and initialises the SQLite database. The Nginx proxy serves a friendly auto-refreshing wait page during that window. Subsequent restarts complete in under a minute.