Install and maintain Flowise AI on Ubuntu

Flowise AI runs from a global npm installation on Node.js 20, listens on localhost port 4000, and is exposed through an authenticated Nginx TLS reverse proxy.

Before you start

• Use a clean, supported Ubuntu server with root or sudo access.
• Point app.example.com to the server before requesting a public TLS certificate.
• Replace every value written as CHANGE_ME and store the generated credentials in a password manager.
• Take a snapshot before changing an existing installation.
• A browser-login username and strong password; the playbook enables both Flowise credentials and Nginx Basic Authentication.
• Enough memory for the flows and models you intend to use.

What the AppStore installation creates

• Node.js 20 and global npm package flowise
• Flowise service flowiseai.service on port 4000
• Environment file in the global Flowise package directory
• Nginx Basic Authentication and TLS termination

1. Install Node.js 20 and web packages

sudo apt update
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo bash -
sudo apt install -y nodejs build-essential nginx apache2-utils certbot python3-certbot-nginx ufw fail2ban
sudo npm install -g flowise

2. Create the Flowise environment

The playbook stores this beside the global package. Protect it because integrations may add secrets later.

sudo install -d -m 0755 /usr/local/lib/node_modules/flowise/logs
sudo nano /usr/local/lib/node_modules/flowise/.env
PORT=4000
HTTPS=false
FLOWISE_USERNAME=admin
FLOWISE_PASSWORD=CHANGE_ME_STRONG_PASSWORD
sudo chmod 600 /usr/local/lib/node_modules/flowise/.env

3. Create the systemd service

Set WorkingDirectory to the installed Flowise package and load its environment file.

sudo nano /etc/systemd/system/flowiseai.service
# ExecStart=/usr/bin/npx flowise start
# WorkingDirectory=/usr/local/lib/node_modules/flowise
# EnvironmentFile=/usr/local/lib/node_modules/flowise/.env
sudo systemctl daemon-reload
sudo systemctl enable --now flowiseai

4. Configure Nginx authentication and TLS

Proxy to http://127.0.0.1:4000. Set 1200-second proxy timeouts for long-running flows and bypass Basic Auth for the ACME challenge path.

sudo htpasswd -c /etc/nginx/.htpasswd-app.example.com admin
sudo nano /etc/nginx/sites-available/app.example.com
sudo ln -s /etc/nginx/sites-available/app.example.com /etc/nginx/sites-enabled/app.example.com
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d app.example.com -m admin@example.com --agree-tos --redirect

Important files and data

• Environment: /usr/local/lib/node_modules/flowise/.env
• Service: /etc/systemd/system/flowiseai.service
• Nginx site: /etc/nginx/sites-available/app.example.com
• Browser credentials: /etc/nginx/.htpasswd-app.example.com

Health checks and logs

Run these checks after installation and after each upgrade:

sudo systemctl status flowiseai nginx --no-pager
sudo journalctl -u flowiseai -n 100 --no-pager
curl -I http://127.0.0.1:4000
sudo nginx -t

Routine maintenance

Review release notes and take a backup or snapshot before upgrading. Use the following playbook-aligned commands as the starting point:

sudo npm list -g flowise
# Back up first, then install the selected release rather than upgrading blindly.
sudo npm install -g flowise@SELECTED_VERSION
sudo systemctl restart flowiseai

Backup scope

• Flowise application data/database and uploaded files
• Flowise environment and integration-secret configuration
• Nginx site and htpasswd file

A usable backup needs both application files and application data. Test restoration on a separate server; an untested backup is not a recovery plan.

Troubleshooting

• Confirm DNS with dig +short app.example.com before retrying Certbot.
• Test the web-server configuration before reloading it: sudo nginx -t or sudo apache2ctl configtest.
• Check free space with df -h and listening ports with sudo ss -ltnup.
• If a service fails, inspect its systemd journal before changing configuration.
• A 502 response usually means Flowise is not listening on port 4000; check the service journal.
• If long flows time out, confirm the Nginx proxy timeout values match the playbook’s 1200-second settings.

Security notes

• Do not paste passwords, API keys, repository credentials, private keys, or access tokens into tickets or public logs.
• Expose only the documented public ports. Keep database and application backend ports bound to localhost or a private network.
• Keep SSH access working before enabling UFW, then allow only the ports this guide lists.
• Renewal can be tested safely with sudo certbot renew --dry-run where Certbot manages TLS.