Architecture
One gateway in front of the modeler, the command API, the runtime, the sync worker, and the query API. Your OIDC provider signs people and workers in. Clients are Node.js, Python, Go, or plain HTTP.
Components
| Component | Responsibility |
|---|---|
| Frontend | BPMN modeler, dashboards, identity views, SDK clients, and workflow operations. |
| Gateway | Routes / to the frontend, /api/ to the command service, and /api/query/ to the query service. |
| Command service | Workflow writes, worker APIs, identity endpoints, idempotency, and the transactional outbox. |
| Runtime | Advances execution and handles timers, jobs, and SLA processing. A Postgres lease keeps a single active scheduler when more than one runtime pod is running. |
| Sync worker | Consumes application events and Debezium records, then updates search projections. |
| Query service | Serves process and instance reads from Elasticsearch. |
| IAM | Validates browser and machine identities through your OIDC provider. |
Request flow
- A person opens the frontend through the gateway and signs in with the configured OIDC provider.
- Command APIs handle writes and emit outbox records in Postgres.
- The runtime and external workers execute jobs.
- The sync worker projects changes into search.
- Query APIs serve dashboards, processes, and instance history.
Postgres is the source of truth. Search views are eventually consistent. Kafka carries application events, and Debezium Connect captures Postgres changes into that bus.
Deployment modes
- Docker Compose, for a local stack that starts Postgres, Elasticsearch, Kafka, and Debezium and connects to your OIDC provider.
- Helm, for production Kubernetes with those same dependencies operated outside the chart.
Fresh installs use project and release name artificialflow, with artificialflow/* images. Production Helm keeps Postgres, Kafka, Debezium, Elasticsearch, secrets, TLS, backups, and observability outside the chart. See Deployment.