Installation Guide

Deploy the Flomation platform on Enterprise Linux 8 & 9 — RHEL, Rocky Linux, AlmaLinux, Oracle Linux.

01 Overview

The Flomation platform consists of six components.

Architecture

Each backend service (Sentinel, API, Launch) requires its own PostgreSQL database. These can run on the same PostgreSQL server for cost savings. The Runner polls the API for pending executions and invokes the Executor to run workflows.

02 Prerequisites

• Enterprise Linux 8 or 9 (RHEL, Rocky Linux, AlmaLinux, Oracle Linux)
• Root or sudo access
• A PostgreSQL server (see Section 4)
• Network connectivity between all component hosts
• SMTP server (required for user registration email verification)

Recommended Install Order

Components should be installed and configured in this order, as later services depend on earlier ones:

1. PostgreSQL database
2. Sentinel (identity — no dependencies on other Flomation services)
3. API (depends on Sentinel)
4. Launch (depends on API)
5. Editor (depends on API, Launch, and Sentinel)
6. Executor and Runner (depend on API)

03 Install the Flomation Repository

Install the Flomation yum repository configuration package on each host that will run a Flomation component.

For EL8:

bashCopy
sudo dnf install -y https://flomation-packages-live.s3.eu-west-2.amazonaws.com/yum/flomation-repo-1.0.1-1.el8.noarch.rpm

For EL9:

bashCopy
sudo dnf install -y https://flomation-packages-live.s3.eu-west-2.amazonaws.com/yum/flomation-repo-1.0.1-1.el9.noarch.rpm

Verify the repository is available:

bashCopy
sudo dnf repolist | grep flomation

04 PostgreSQL Database

The Flomation platform requires a PostgreSQL database with the uuid-ossp and pgcrypto extensions, plus vector (pgvector) on the API database.

Setting up and administering PostgreSQL is outside the scope of this guide. Ensure you have a running PostgreSQL instance accessible from the hosts running Sentinel, API, and Launch.

Create the Database

Connect to your PostgreSQL server and create a database and user for Flomation:

sqlCopy
CREATE USER flomation WITH PASSWORD 'your-secure-password';

-- Create databases for each service
CREATE DATABASE flomation_sentinel OWNER flomation;
CREATE DATABASE flomation_api OWNER flomation;
CREATE DATABASE flomation_launch OWNER flomation;

-- Connect to each database and enable required extensions
\c flomation_sentinel
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS "pgcrypto";

\c flomation_api
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE EXTENSION IF NOT EXISTS "vector";   -- pgvector; must be run as a superuser

\c flomation_launch
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS "pgcrypto";

05 Install Flomation Sentinel

Sentinel provides identity and access management — authentication, user accounts, sessions, and MFA.

Install

bashCopy
sudo dnf install -y flomation-sentinel

Configure

Create the configuration file:

bashCopy
sudo vi /opt/flomation/sentinel/config.json

jsonCopy
{
  "listener": {
    "address": "0.0.0.0",
    "port": 8999,
    "url": "https://sentinel.example.com"
  },
  "database": {
    "hostname": "db.example.com",
    "port": 5432,
    "username": "flomation",
    "password": "your-secure-password",
    "database": "flomation_sentinel",
    "encryption_key": "PLACEHOLDER-GENERATE-A-SECURE-KEY",
    "ssl_mode": "require"
  },
  "security": {
    "cookie": {
      "domain": "example.com",
      "secure": true,
      "http_only": false,
      "expiration": 86400
    },
    "realm": "example.com",
    "secret": "PLACEHOLDER-GENERATE-A-SECURE-SECRET",
    "login_redirect": "https://editor.example.com/",
    "logout_redirect": "https://editor.example.com/logout"
  },
  "notification": {
    "enabled": true,
    "send_from": "noreply@example.com",
    "smtp": {
      "host": "smtp.example.com",
      "port": 587,
      "username": "smtp-user",
      "password": "smtp-password"
    }
  }
}

Set appropriate permissions on the configuration file:

bashCopy
sudo chown flomation:flomation /opt/flomation/sentinel/config.json
sudo chmod 640 /opt/flomation/sentinel/config.json

Configuration Reference

Start

bashCopy
sudo systemctl enable --now flomation-sentinel

Verify the service is running:

bashCopy
sudo systemctl status flomation-sentinel

06 Install Flomation API

The API server is the core of the platform — it manages organisations, workflows, executions, runners, and environments.

Install

bashCopy
sudo dnf install -y flomation-api

Configure

Create the configuration file:

bashCopy
sudo vi /opt/flomation/api/config.json

jsonCopy
{
  "http": {
    "address": "0.0.0.0",
    "port": 8888
  },
  "database": {
    "hostname": "db.example.com",
    "port": 5432,
    "username": "flomation",
    "password": "your-secure-password",
    "database": "flomation_api",
    "encryption_key": "PLACEHOLDER-GENERATE-A-SECURE-KEY",
    "ssl_mode": "require"
  },
  "security": {
    "identity_service": "https://sentinel.example.com",
    "allowed_origins": "https://editor.example.com"
  },
  "launch": {
    "url": "https://launch.example.com"
  }
}

Set appropriate permissions:

bashCopy
sudo chown flomation:flomation /opt/flomation/api/config.json
sudo chmod 640 /opt/flomation/api/config.json

Configuration Reference

Start

bashCopy
sudo systemctl enable --now flomation-api

07 Install Flomation Launch

Launch is the trigger and webhook ingress service — it handles webhooks, QR codes, forms, tracking pixels, and scheduled triggers.

Install

bashCopy
sudo dnf install -y flomation-launch

Configure

Create the configuration file:

bashCopy
sudo vi /opt/flomation/launch/config.json

jsonCopy
{
  "http": {
    "address": "0.0.0.0",
    "port": 8081
  },
  "database": {
    "hostname": "db.example.com",
    "port": 5432,
    "username": "flomation",
    "password": "your-secure-password",
    "database": "flomation_launch",
    "encryption_key": "PLACEHOLDER-GENERATE-A-SECURE-KEY",
    "ssl_mode": "require"
  },
  "automate": {
    "url": "https://api.example.com"
  },
  "security": {
    "identity_service": "https://sentinel.example.com",
    "editor_url": "https://editor.example.com"
  },
  "public_url": "https://launch.example.com"
}

Set appropriate permissions:

bashCopy
sudo chown flomation:flomation /opt/flomation/launch/config.json
sudo chmod 640 /opt/flomation/launch/config.json

Configuration Reference

Start

bashCopy
sudo systemctl enable --now flomation-launch

08 Install Flomation Editor

The Editor is the web-based UI for designing and managing workflows. It is a Node.js application (React Router / SSR).

Install

bashCopy
sudo dnf install -y flomation-editor

Configure

The Editor is configured via an environment file. Copy the sample and edit it:

bashCopy
sudo cp /opt/flomation/editor/etc/environment.sample /opt/flomation/editor/etc/environment
sudo vi /opt/flomation/editor/etc/environment

bashCopy
# Flomation Editor Configuration
AUTOMATE_API_URL=https://api.example.com
BILLING_API_URL=https://billing.example.com
TRIGGER_URL=https://launch.example.com
LOGIN_URL=https://sentinel.example.com
LAUNCH_URL=https://launch.example.com
PORT=8080
NODE_ENV=production

Set appropriate permissions:

bashCopy
sudo chown flomation:flomation /opt/flomation/editor/etc/environment
sudo chmod 640 /opt/flomation/editor/etc/environment

Configuration Reference

Start

bashCopy
sudo systemctl enable --now flomation-editor

09 Install Flomation Executor

The Executor is a command-line tool that runs workflow definitions. It is invoked by the Runner and does not run as a persistent service.

Install

bashCopy
sudo dnf install -y flomation-executor

The Executor binary is installed to /opt/flomation/executor/ and added to the system PATH via /etc/profile.d/flomation-executor.sh.

No additional configuration is needed — the Runner passes all required parameters when invoking the Executor.

10 Install Flomation Runner

The Runner is a background agent that polls the Flomation API for pending workflow executions and invokes the Executor to run them.

Install

Install both the Runner and Executor on the same host:

bashCopy
sudo dnf install -y flomation-runner flomation-executor

Obtain a Registration Code

Before configuring the Runner, you need a registration code from the API server. This is generated through the Flomation Editor UI after initial platform setup (see Section 11).

Configure

Create the configuration file:

bashCopy
sudo vi /opt/flomation/runner/config.json

jsonCopy
{
  "runner": {
    "url": "https://api.example.com",
    "registration_code": "your-registration-code",
    "name": "runner-01",
    "checkin_timeout": 5,
    "certificate": "flomation-runner.pem"
  },
  "execution": {
    "max_concurrent_executors": 5,
    "execution_directory": "/opt/flomation/runner/workspace/",
    "executable_name": "/opt/flomation/executor/executor"
  }
}

Create the workspace directory:

bashCopy
sudo mkdir -p /opt/flomation/runner/workspace
sudo chown flomation:flomation /opt/flomation/runner/workspace

Set appropriate permissions:

bashCopy
sudo chown flomation:flomation /opt/flomation/runner/config.json
sudo chmod 640 /opt/flomation/runner/config.json

Configuration Reference

Start

bashCopy
sudo systemctl enable --now flomation-runner

11 First-Time Setup

Once all services are running, follow these steps to bootstrap the platform.

1. Register the First User

Sentinel provides a self-registration flow:

1. Navigate to your Sentinel instance's /authenticate endpoint in a browser (e.g. https://sentinel.example.com/authenticate).
2. Enter your email address. Since no accounts exist yet, Sentinel will present a registration prompt.
3. Click Create account.
4. Check your email for a verification message containing a link to set your password.
5. Click the verification link and set your password.

2. Log In to the Editor

Navigate to your Editor instance (e.g. https://editor.example.com). You will be redirected to Sentinel to authenticate. Log in with the credentials you just created.

3. Create an Organisation

After logging in, the API automatically creates your user record. You can then create your first organisation through the Editor UI.

4. Register a Runner

To execute workflows, you need at least one Runner registered. Registration codes are issued per queue, not from the Runners page:

1. In the Editor, open the Queues section and click Create Queue.
2. Each queue displays a registration code — copy it.
3. Set it as runner.registration_code in the Runner's config.json (see Section 10).
4. Start (or restart) the Runner service — it will register into that queue.

12 Service Management

All Flomation services are managed via systemd. The RPM packages install service unit files to /etc/systemd/system/.

Common operations:

bashCopy
# Start a service
sudo systemctl start flomation-api

# Stop a service
sudo systemctl stop flomation-api

# Restart a service
sudo systemctl restart flomation-api

# View service status
sudo systemctl status flomation-api

# View logs
sudo journalctl -u flomation-api -f

Log Files

Service logs are written to:

• stdout/stderr logs: /opt/flomation/<component>/logs/<component>.log and .err
• Symlink: /var/log/flomation/<component> points to the logs directory

File Locations

Upgrades

To upgrade a component:

bashCopy
sudo dnf update flomation-api

The RPM upgrade process automatically:

1. Stops the running service.
2. Creates a snapshot of the current installation in /opt/flomation/snapshots/.
3. Installs the new version.
4. Restarts the service.

13 Firewall Configuration

If firewalld is enabled, you will need to open ports for each service running on the host. The specific ports depend on your configuration.

For example, to allow traffic to the API on port 8888:

bashCopy
sudo firewall-cmd --permanent --add-port=8888/tcp
sudo firewall-cmd --reload

Repeat for each service port as needed. Only open ports that need to be accessible from other hosts — services communicating on localhost do not require firewall rules.

14 SELinux

The Flomation RPM packages handle SELinux context configuration automatically during installation.

The packages set appropriate contexts for:

• Application directories (usr_t)
• Log directories (var_log_t)
• Snapshot directories (usr_t)

If you encounter SELinux denials, check the audit log:

bashCopy
sudo ausearch -m avc -ts recent

To generate and apply a custom policy module if needed:

bashCopy
sudo ausearch -m avc -ts recent | audit2allow -M flomation-custom
sudo semodule -i flomation-custom.pp

15 TLS Configuration

The Sentinel, API, and Launch services support TLS termination directly. This is the recommended way to serve Flomation over HTTPS — a separate reverse proxy is not required.

Direct TLS termination (recommended)

Place the certificate and private key in each service's installation root:

• /opt/flomation/sentinel/certificate.crt and /opt/flomation/sentinel/certificate.key
• /opt/flomation/api/certificate.crt and /opt/flomation/api/certificate.key
• /opt/flomation/launch/certificate.crt and /opt/flomation/launch/certificate.key

When these files are present, the service serves HTTPS automatically.

When serving over HTTPS, also ensure:

• Sentinel's security.cookie.secure is set to true.
• The listener.url (Sentinel), security.identity_service (API), and all URL references in the Editor environment file use https:// URLs.

Editor

The Editor service does not support TLS termination directly. To serve the Editor over HTTPS, place it behind a reverse proxy such as nginx, HAProxy, or Caddy that handles TLS termination.

Example: nginx

nginxCopy
server {
    listen 80;
    server_name editor.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name editor.example.com;

    ssl_certificate     /etc/nginx/ssl/editor.crt;
    ssl_certificate_key /etc/nginx/ssl/editor.key;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Replace editor.example.com and the certificate paths with values appropriate for your environment.

Reverse proxy (optional for Sentinel, API, Launch)

A TLS-terminating reverse proxy such as HAProxy, nginx, or Caddy is also supported in front of Sentinel, API, and Launch. This can be useful for consolidating certificates, terminating TLS at the network edge, or fronting multiple services on a single hostname.

When using a reverse proxy, ensure the X-Forwarded-For and X-Forwarded-Proto headers are set correctly.

16 Troubleshooting

Service fails to start

Check the service logs:

bashCopy
sudo journalctl -u flomation-<component> -e --no-pager
sudo cat /opt/flomation/<component>/logs/<component>.err

First start logs "unable to load config"

Every Go service package (Sentinel, API, Launch, Runner) auto-starts immediately on install — before its config.json exists — and logs a single fatal: unable to load config. This is expected. Once you write the configuration file and start (or restart) the service, it recovers. Don't mistake this first-boot message for a failure.

Database connection errors

• Verify PostgreSQL is running and accessible from the service host.
• Check that the database credentials in config.json are correct.
• Ensure the uuid-ossp and pgcrypto extensions are installed on every database, and that vector (pgvector) is installed on the API database and was created by a superuser — see Section 4.
• If using SSL, verify the ssl_mode setting matches your PostgreSQL configuration.

Editor shows blank page or API errors

• Verify the URLs in /opt/flomation/editor/etc/environment are correct and reachable from the user's browser (these are client-side URLs).
• Delete /opt/flomation/editor/build/client/run-config.js and restart the Editor service to regenerate it from the environment file.

Runner cannot register

• Verify the runner.url in the Runner's config.json points to the API server.
• Ensure the registration code is valid and has not already been used.
• Check that the Runner can reach the API server over the network.

Verification email not received

• Check Sentinel logs for SMTP errors.
• Verify SMTP settings in Sentinel's config.json.
• Ensure notification.enabled is set to true.