Overview

WolfFlow is WolfStack’s visual workflow automation engine. It lets you design multi-step runbooks in a drag-and-drop editor, schedule them with cron expressions, and execute them across your entire infrastructure — all from the WolfStack dashboard.

Think of it as n8n or Rundeck built directly into your server management platform. No external dependencies, no separate services to install — WolfFlow runs inside WolfStack and has full access to every node, container, and VM in your cluster.

WolfFlow visual workflow editor with drag-and-drop action nodes

Key Features

  • Visual workflow editor — Drag-and-drop canvas with a toolbox of built-in actions, step-by-step flow, and per-step configuration
  • 18 built-in action types — Update packages, update WolfStack, restart services, run shell commands, clean logs, check disk space, restart containers, Docker prune, HTTP requests, Docker image updates, NetBird management, TrueNAS snapshots, Unifi device control, conditional branching, AI Invoke (ask the configured AI model a question mid-workflow), Agent Chat (message a named WolfAgent with persistent memory and tools), and more
  • Flexible targeting — Execute on a single node, all nodes, a specific cluster, hand-picked nodes, individual containers/VMs, or everything (all nodes + all their containers and VMs)
  • Cron scheduling — Full 5-field cron expressions with quick presets (daily, hourly, weekly, etc.) or manual-only execution
  • Parallel cross-node execution — Steps run on all target nodes simultaneously, with results collected per-node before moving to the next step
  • Structured outputs & data passing — Each action produces structured key-value data (not just text). Use {{step_name.key}} to reference previous step outputs in downstream steps
  • Conditional branching — If/Else nodes evaluate expressions and jump to different steps based on the result. Build real decision logic into your workflows
  • Output reference picker — When editing a Condition, the UI shows clickable {{step_name.key}} references from all previous steps — no need to remember field names
  • Retry logic — Configure per-step retry count and delay. Failed steps are automatically retried before triggering the failure policy
  • Workflow timeout — Set a maximum runtime for the entire workflow. If exceeded, the workflow aborts cleanly
  • 5 failure policies — Abort, Continue, Alert, Notify & Abort, Notify & Continue — with alerting integration (email, Discord, Slack, Telegram)
  • Email notifications — Get HTML-formatted results emails with step-by-step output when workflows complete
  • Per-step target overrides — Run most steps on all nodes but target a specific container for one step
  • Infrastructure explorer — Browse your entire cluster tree (nodes, Docker containers, LXC containers, Proxmox VMs) when selecting targets
  • Execution history — Full run logs with per-node, per-step status, duration, and output

The Visual Editor

WolfFlow’s editor is a three-panel layout designed for fast workflow creation:

Left Panel — Toolbox

22 action cards organised by category (System, Docker, Integration, Logic, Services), each colour-coded by type. Click or drag an action to add it as a new step in your workflow.

Centre Panel — Canvas

Your workflow is displayed as a vertical flow of step cards connected by arrows. Each card shows the step name, action type, and target scope. Click the + button between steps to insert a new step, or drag from the toolbox to reorder. Click any step to select it and edit its properties.

Right Panel — Properties

When a step is selected, the properties panel shows:

  • Step name — Editable label for the step
  • Action type — Change the action (parameters update automatically)
  • Action-specific fields — Text inputs, dropdowns, number fields depending on the action
  • On failure policy — Continue, Abort, or Alert
  • Target override — Optionally override the workflow-level target for this step only

Toolbar

The toolbar across the top of the editor provides:

  • Workflow name — Large editable text field
  • Schedule — Cron expression input with quick preset buttons
  • Enabled toggle — Enable or disable the workflow
  • Email results — Optional email address for completion notifications
  • Save and Run Now buttons

Action Types

WolfFlow includes 16 built-in actions that cover the most common infrastructure automation tasks:

Action Description Parameters
Update System Packages Runs the system package manager (apt, dnf, pacman, or zypper) to update and upgrade all packages None
Update WolfStack Pulls and installs the latest WolfStack from GitHub channel — Branch name (default: master)
Restart Service Restarts a systemd service by name service_name — e.g. nginx, docker, mysql
Run Shell Command Executes an arbitrary shell command with timeout protection command — Shell command
timeout_secs — Timeout (default: 300s)
Clean Journal Logs Vacuums the systemd journal to free disk space max_size_mb — Maximum journal size (default: 500 MB)
Check Disk Space Checks disk usage and fails if above the threshold. Automatically excludes network filesystems (NFS, CIFS, SSHFS) to prevent hangs warn_threshold_pct — Alert threshold (default: 90%)
mount_point — Target mount or “all”
Restart Container Restarts a Docker or LXC container by name runtime — docker or lxc
name — Container name
Docker Prune Removes all unused Docker images, containers, volumes, and networks (docker system prune -af) None
HTTP Request Sends an HTTP request to any URL. Useful for triggering webhooks, health checks, or external API calls url — Target URL
method — GET, POST, PUT, DELETE
headers — Optional headers (JSON)
body — Optional request body
Docker Image Update Checks upstream registries for newer images, backs up the running container, pulls the new image, and recreates the container. Supports one-click rollback container_name — Container to update
backup — Create backup before update (default: true)
NetBird Management Manages NetBird network peers — list peers, enable/disable routes, restart the NetBird service action — list_peers, enable_route, disable_route, restart
api_key — NetBird API key
peer_id — Target peer (optional)
TrueNAS Integration Interacts with TrueNAS SCALE/CORE API for snapshot management, replication triggers, and pool health checks action — create_snapshot, list_snapshots, check_pools
api_url — TrueNAS API endpoint
api_key — TrueNAS API key
dataset — Target dataset (optional)
Unifi Device Control Controls Unifi network devices — restart APs, enable/disable ports, force provision, and query device status action — restart_device, enable_port, disable_port, provision
controller_url — Unifi controller URL
api_key — Unifi API key
device_mac — Target device MAC
Condition (If/Else) Evaluates an expression and branches the workflow. Use {{step_name.key}} to reference previous step outputs. Supports operators: eq, neq, gt, lt, contains, matches, truthy expression — Value or template reference
operator — Comparison operator
compare_to — Value to compare against
Integration Action Execute any operation on a configured external integration instance (NetBird, TrueNAS, Unifi, or custom connectors via the API Integration Framework) instance_id — Integration instance ID
operation — Operation name (e.g. list_peers)
params — JSON parameters
AI Invoke New Ask the configured AI model a question mid-workflow and capture its response in a step output. Stateless — no per-agent memory, no tool access. Typical use: yes/no branching ("Is this disk-full alert real or routine log growth?") or summarising prior-step output. Prompt supports {{step_name.key}} templating. prompt — The question (templated)
system_prompt — Optional override (default is an ops-assistant framing)
model / provider — Optional per-step override to pick a cheaper/faster model
max_tokens — Response length cap
Agent Chat New Send a message to a named WolfAgent. Uses the agent's persistent memory + tool allowlist, so the agent can take actions during the turn (restart a container, fetch metrics) and remember the exchange next time. agent_id — Agent ID from /api/agents
message — Message text (templated)
timeout_secs — Wait for agent turn (default 180s)

Every action has built-in timeout protection and captures stdout/stderr output (up to 5,000 characters per step) for review in the execution history.

Template Variables

Steps can reference outputs from previous steps using the {{step_name.key}} syntax. This allows you to chain steps together — for example, check if a Docker image has an update, then use the result in a Condition step to decide whether to proceed with the update.

example
Step 1: Docker Update Check  (name: "Check Nginx")
         container_or_image: nginx

Step 2: Condition (If/Else)
         expression: {{Check Nginx.update_available}}
         operator: eq
         compare_to: true

Step 3: Docker Container Update  (only runs if Step 2 is true)
         container_name: nginx
         backup_first: true

Structured Outputs

Each action type produces structured key-value data that downstream steps can reference. For example:

ActionOutput Keys
Docker Update Checkimage, local_digest, update_available, container
Docker Container Updatesuccess, container, image
HTTP Requeststatus_code, response_body, json (parsed response)
Condition (If/Else)result (true/false)
NetBird / TrueNAS / Unifistatus_code, response_body, json
All other actionsPlain text output (command stdout/stderr)

Output Reference Picker

When editing a Condition (If/Else) step, the properties panel shows a clickable list of all available {{step_name.key}} references from previous steps. Click any reference to insert it into the expression field — no need to remember field names or type the template syntax manually.

Retry Logic

Each step can be configured with a retry count and retry delay. If a step fails, WolfFlow automatically retries it the specified number of times before triggering the failure policy. This is useful for flaky operations like network calls or external API requests.

Workflow Timeout

Set a maximum runtime (in seconds) on the workflow. If the total execution time exceeds this limit, WolfFlow aborts the workflow cleanly. Set to 0 for no limit.

Execution Targets

WolfFlow supports six targeting scopes. Set a default target at the workflow level, then optionally override it per step.

Target Behaviour Use Case
Local Execute only on the primary WolfStack node Single-node maintenance, leader-only tasks
All Nodes Execute on every online WolfStack node Fleet-wide updates, log cleanup, disk checks
Everything Execute on every node and inside every Docker container, LXC container, and running VM on each node Fleet-wide maintenance that includes containerised workloads — update packages everywhere, clean logs everywhere
Cluster Execute on all nodes in a named cluster Multi-cluster environments where you want to target one cluster at a time
Specific Nodes Hand-pick individual nodes by ID Staged rollouts, targeting a subset of your fleet
Containers / VMs Target specific Docker containers, LXC containers, or VMs — commands execute inside the container/VM, not on the host Per-container maintenance, targeted updates, health checks inside workloads

Execution Inside Containers & VMs

When targeting containers or VMs, WolfFlow executes commands inside the target, not on the host:

  • Docker — commands run via docker exec <container> sh -c "..."
  • LXC — commands run via lxc-attach -n <container> -- sh -c "..."
  • VMs — commands run via SSH to the VM’s IP address (WolfNet IP or ARP-discovered)

Actions like Update Packages, Clean Logs, Check Disk Space, Restart Service, and Run Shell Command all work inside containers. The AI automatically adapts the command to the container’s environment.

VM SSH access: For VM execution, WolfStack connects via SSH as root using the VM’s WolfNet IP or MAC-derived ARP address. Ensure SSH is running in the VM and root key-based auth is configured.

Infrastructure Explorer

When selecting targets, click Set Target to open the infrastructure explorer. It displays your entire cluster tree with:

  • All clusters and nodes with online/offline status
  • Docker containers (blue icon) with running/stopped state
  • LXC containers (green icon) with running/stopped state
  • VMs (orange icon) with running/stopped state
  • Multi-select checkboxes for picking exactly what you need

The infrastructure tree is cached for 60 seconds and refreshes automatically.

Scheduling

WolfFlow uses standard 5-field cron expressions (UTC) for scheduling:

format
minute  hour  day-of-month  month  day-of-week

Quick Presets

The editor includes one-click preset buttons for common schedules:

Preset Expression Meaning
Daily 3am0 3 * * *Every day at 03:00 UTC
Midnight0 0 * * *Every day at 00:00 UTC
Hourly0 * * * *Every hour on the hour
15min*/15 * * * *Every 15 minutes
Weekly Sun0 2 * * 0Every Sunday at 02:00 UTC
Monthly0 2 1 * *1st of every month at 02:00 UTC
Manual(blank)No schedule — run manually only

Cron Syntax

  • * — Any value
  • 5 — Specific value
  • 1,15,30 — Multiple values
  • 1-5 — Range
  • */15 — Every N units
  • 1-30/5 — Every 5th value in range 1–30
  • Day-of-week: Sunday = 0 or 7, Monday = 1 … Saturday = 6

The built-in scheduler checks all enabled workflows every 60 seconds. Duplicate runs within the same minute are automatically prevented.

Failure Handling

Each step has an on-failure policy that controls what happens when the step fails on one or more target nodes:

Policy Behaviour Use Case
Abort (default) Stop the entire workflow immediately. No remaining steps execute. Workflow marked as Failed. Critical operations where proceeding after a failure would be dangerous
Continue Log the failure and proceed to the next step. Workflow marked as Partial Failure at the end. Non-critical checks, optional maintenance tasks
Alert Log an error alert and continue. Similar to Continue but with elevated visibility in the task log. Steps you want to be notified about but that shouldn’t block the workflow
Notify & Abort Send a notification via the alerting system (email, Discord, Slack, Telegram) and then abort the workflow. Critical failures that need immediate human attention
Notify & Continue Send a notification via the alerting system and continue to the next step. Non-critical failures that should be flagged but not block the workflow

When a workflow targets multiple nodes, each node executes independently. One node failing a step doesn’t prevent other nodes from completing that step — the failure policy determines whether the workflow continues to the next step.

Execution & Monitoring

How Workflows Execute

  1. Trigger — A workflow runs either on its cron schedule or when you click Run Now
  2. Resolve targets — WolfFlow resolves the target scope into a list of online nodes
  3. Execute steps sequentially — Each step runs on all target nodes in parallel, then results are collected before the next step begins
  4. Remote execution — For remote nodes, commands are sent via the WolfStack node proxy API with cluster secret authentication
  5. Collect results — Each step records per-node status (success/failure), output, and duration
  6. Email results — If an email address is configured, an HTML report is sent with a detailed step-by-step breakdown

Task Log Integration

Every workflow execution appears in WolfStack’s main task log with live progress updates. You can see:

  • Which step is currently executing
  • Per-node status with colour-coded badges (success, failed, running)
  • Command output for each step
  • Total duration and final status

Run History

WolfFlow keeps a history of the last 500 workflow runs. Each run record includes:

  • Workflow name and run ID
  • Trigger type (Manual or Scheduled)
  • Start time and total duration
  • Overall status (Completed, Failed, Partial Failure, Running)
  • Per-step, per-node results with output

Email Notifications

When an email address is set on a workflow, WolfFlow sends an HTML-formatted results email after every run. The email includes:

  • Status header — Workflow name, overall status (Completed/Failed/Partial Failure), and trigger type
  • Duration — Total execution time
  • Step table — Each step with target node hostname, status badge, duration, and command output (truncated to 500 characters per step)

Email uses the SMTP settings configured in Settings → AI Agent. Make sure SMTP is configured before enabling email notifications.

Example Workflows

Daily Fleet Maintenance

workflow
Schedule: 0 3 * * *  (Daily at 3 AM UTC)
Target:   All Nodes

Step 1: Check Disk Space        [on failure: Continue]
         warn_threshold_pct: 90
         mount_point: all

Step 2: Clean Journal Logs      [on failure: Continue]
         max_size_mb: 500

Step 3: Update System Packages  [on failure: Alert]

Step 4: Docker Prune            [on failure: Continue]

Email results to: admin@example.com

Staged WolfStack Update

workflow
Schedule: Manual only
Target:   Specific Nodes (staging-node-01)

Step 1: Update WolfStack        [on failure: Abort]
         channel: master

Step 2: Run Shell Command        [on failure: Abort]
         command: systemctl status wolfstack
         timeout_secs: 30

-- After verifying staging, run a second workflow
-- targeting production nodes

Container Lifecycle

workflow
Schedule: 0 2 * * 0  (Weekly, Sunday at 2 AM UTC)
Target:   Local

Step 1: Run Shell Command        [on failure: Abort]
         command: docker pull myapp:latest

Step 2: Restart Container        [on failure: Abort]
         runtime: docker
         name: myapp

Step 3: Run Shell Command        [on failure: Alert]
         command: curl -sf http://localhost:8080/health
         timeout_secs: 30

Multi-Cluster Health Check

workflow
Schedule: */15 * * * *  (Every 15 minutes)
Target:   All Nodes

Step 1: Check Disk Space        [on failure: Continue]
         warn_threshold_pct: 85
         mount_point: all

Step 2: Run Shell Command        [on failure: Continue]
         command: systemctl is-active docker || echo "Docker not running"

Email results to: oncall@example.com

REST API

WolfFlow exposes a full REST API for programmatic access:

Endpoint Method Description
/api/wolfflow/workflows GET List all workflows (optional ?cluster= filter)
/api/wolfflow/workflows POST Create a new workflow
/api/wolfflow/workflows/{id} GET Get a workflow by ID
/api/wolfflow/workflows/{id} PUT Update a workflow
/api/wolfflow/workflows/{id} DELETE Delete a workflow
/api/wolfflow/workflows/{id}/run POST Trigger a workflow manually
/api/wolfflow/runs GET List execution history (?workflow_id= and ?limit= filters)
/api/wolfflow/runs/{id} GET Get a single run with full step results
/api/wolfflow/toolbox GET List available actions with field definitions
/api/wolfflow/infrastructure GET Full infrastructure tree (clusters, nodes, containers, VMs)

All endpoints require a valid wolfstack_session cookie. Inter-node execution uses the X-WolfStack-Secret header for authentication.

Configuration & Persistence

WolfFlow stores all data as JSON files:

  • /etc/wolfstack/wolfflow/workflows.json — All workflow definitions
  • /etc/wolfstack/wolfflow/runs.json — Execution history (last 500 runs)

Data is loaded on startup and saved automatically after every create, update, delete, or run operation. The /etc/wolfstack/wolfflow/ directory is created automatically if it doesn’t exist.

Back up the /etc/wolfstack/wolfflow/ directory to preserve your workflows and run history.

WolfFlow vs. Cron Jobs

WolfStack already has a Cron Jobs page for managing system crontabs. WolfFlow is a higher-level tool that builds on top of that concept:

Feature Cron Jobs WolfFlow
ScopeSingle nodeEntire cluster (cross-node)
InterfaceCrontab editorVisual drag-and-drop editor
Multi-stepNo (single command)Yes (sequential + conditional branching)
BranchingNoIf/Else conditions with step jumps
Data passingNoStructured outputs with {{step.key}} templates
RetryNoPer-step retry count + delay
Failure handlingNone5 policies: Abort, Continue, Alert, Notify & Abort, Notify & Continue
TargetingRuns on one nodeLocal, all nodes, everything (nodes + containers + VMs), cluster, specific nodes, specific containers/VMs
External APIsNoHTTP requests, NetBird, TrueNAS, Unifi connectors
Execution historySyslog onlyFull run history with per-step structured output
Email resultsBasic (MAILTO)Rich HTML reports
Built-in actionsNo (shell commands)16 purpose-built actions + shell commands

Use Cron Jobs for simple, single-node tasks. Use WolfFlow for multi-step, multi-node automation with visibility and failure handling.

Esc