mrcharles
10e558500f
Windmill is an open-source workflow-automation / internal-apps platform
that turns scripts (Python, JS/TS, Go, Bash, SQL, Rust, ...) into HTTP
endpoints, scheduled jobs, and visual flows. It is PostgreSQL-only —
it uses Postgres LISTEN/NOTIFY for job queuing, so no Redis is required,
making it a clean Cloudron fit.
- Wraps the official ghcr.io/windmill-labs/windmill:1.514.1 image in
single-container server mode (embedded default worker)
- start.sh composes DATABASE_URL from the Cloudron postgresql addon and
waits for the DB (bash /dev/tcp, no pg_isready dependency)
- HTTP port 8000, health check on /api/version, 2GB memory limit
- OIDC/SAML supported via the in-app Admin Settings UI (post-install)
- Validated end-to-end: throwaway postgres + windmill ran migrations and
returned /api/version => "CE v1.514.1", HTTP 200
Gardening: STATUS/README/JOURNAL updated (9/~57 packaged; Automation
1/4). Windmill logged as a new OIDC-preferred completed package.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
Windmill Cloudron Package
Description
Windmill is an open-source developer platform to turn scripts into workflows and internal apps. Write scripts in Python, JavaScript/TypeScript, Go, Bash, SQL, PHP, Rust, PowerShell, or Deno; Windmill turns them into sharable HTTP endpoints, cron-scheduled jobs, and steps in visual Flows. It also generates internal apps from those flows.
This package wraps the official ghcr.io/windmill-labs/windmill image in
single-container server mode (the server embeds a default worker, so no
separate worker container is needed).
State lives entirely in PostgreSQL (Cloudron postgresql addon). Windmill
uses Postgres LISTEN/NOTIFY for job queuing, so no Redis is required.
Authentication
Windmill supports OIDC and SAML natively. Unlike many apps, these are configured in the in-app Admin Settings UI (persisted in the database), not via environment variables.
Post-install OIDC setup (recommended)
- Open the Windmill app and sign in as the bootstrap superadmin (the first run
prints a
SUPERADMIN_SECRET/ creates an admin — see Windmill docs). - Go to Admin Settings → Auth → OIDC.
- Enter your identity provider details (Cloudron's OIDC provider issuer, client ID, and client secret). The platform OIDC issuer / client creds come from your Cloudron instance's app SSO configuration.
- Save; users can then log in via OIDC.
OIDC is the preferred auth path for this app. Until OIDC is configured, access is limited to the local superadmin account.
Features
- Scripts to endpoints: any script becomes a typed HTTP API + background job
- Flows: visually chain scripts with branching, loops, retries, error handling
- Schedules: cron-based job scheduling
- Apps: generate internal UIs from flows
- Multi-language: Python, JS/TS, Go, Bash, SQL, PHP, Rust, PowerShell, Deno
- Secrets: encrypted secret management with inheritance
- Queuing: Postgres
LISTEN/NOTIFY(no external broker)
Configuration
Ports
- 8000: Windmill web UI + REST API
Addons
- postgresql (v14): all persistent state, jobs, flows, users, queue
- localstorage (
/app/data): ephemeral job working files
Environment Variables
The start.sh entrypoint derives DATABASE_URL automatically from the
Cloudron PostgreSQL addon. The only fixed knob is:
| Variable | Default | Purpose |
|---|---|---|
MODE |
server |
Run mode (server embeds a default worker) |
DATABASE_URL is composed at runtime as
postgres://$USER:$PASS@$HOST:$PORT/$DB?sslmode=disable.
Usage
- Install the package on Cloudron (provisions a PostgreSQL database).
- On first boot, Windmill runs migrations and bootstraps a superadmin.
- Sign in, then immediately configure OIDC under Admin Settings (above).
- Create a script, expose it as a flow/app, schedule it, or call its HTTP endpoint.
Upstream
- Repository: https://github.com/windmill-labs/windmill
- Image:
ghcr.io/windmill-labs/windmill:1.514.1 - Docs: https://www.windmill.dev/docs