Tutorial: Install 1.2.0 (newer version is broken)

[AndiTheHacker]

Important notice to this workaround

Please only use this workaround to get an initial flow install ready.
There has been a major security issue (CVE-2026-29059) that allows control over your nextcloud instance.
After installing 1.2.0, please update immediately to 1.3.1, as the issue is fixed in that version.

Original workaround

For everyone having issues with the new 1.3.0 version of flow, here is a tutorial on how to install the old one:

1. Create your HaRP deploy demon for ExApps as usual. Use the test deploy to verify if it is working.
2. In your Nextcloud docker instance, create a new file called info.xml. For example, you could do this via docker exec -it nextcloud-app touch info.xml.
3. Go to https://github.com/nextcloud/flow/blob/main/appinfo/info.xml and copy the contents of that file.
4. Paste the content somewhere, then edit the <image-tag> entry in the <docker-install> entry. Instead of 1.3.0, you want to have 1.2.0. This is the version of the package that docker will pull. A working info.xml could look like this:

<!--
  - SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
  - SPDX-License-Identifier: MIT
-->
<info>
        <id>flow</id>
        <name>Flow (Custom 1.2)</name>
        <summary>Automate and Streamline Your Workflows in Nextcloud</summary>
        <description>
        <![CDATA[Nextcloud Flow is a set of intuitive automation components that allow organizations to automate and streamline internal workflows.

Through easy low-code and no-code interfaces it enables users to effortlessly automate routine tasks, ease data entry and manipulation and reduce manual work.

It includes components designed for a variety of businesses needs and at various scales, from SME to large enterprises.

1. Users can build simple mini-apps to manage structured data through the no-code interface in the Tables app.
2. Users can automate actions on a variety of triggers through no-code interfaces in the Flow user settings.
3. Administrators can additionally configure file access controls to automatically block unauthorized access to sensitive data.
4. Business process annalists and administrators have access to the powerful business automation features built on the open source **Windmill** tool, capable of modeling large business processes that require interaction with internal and external services.

This app provides an easy way to install the Windmill based Business Process Automation component of Flow.

**Requires [`AppAPI`](https://github.com/nextcloud/app_api) and `webhook_listeners` to be enabled to work.**

        ]]></description>
        <version>1.2.0.99</version>
        <licence>agpl</licence>
        <author mail="julien-nc@posteo.net" homepage="https://github.com/julien-nc">Julien Veyssier</author>
        <author mail="mklehr@gmx.net" homepage="https://github.com/marcelklehr">Marcel Klehr</author>
        <author mail="bigcat88@icloud.com" homepage="https://github.com/bigcat88">Alexander Piskun</author>
        <namespace>PyAppV2_flow</namespace>
        <category>tools</category>
        <category>workflow</category>
        <website>https://github.com/nextcloud/flow</website>
        <bugs>https://github.com/nextcloud/flow/issues</bugs>
        <repository type="git">https://github.com/nextcloud/flow</repository>
        <screenshot>https://raw.githubusercontent.com/nextcloud/flow/main/screenshots/flow_1.png</screenshot>
        <screenshot>https://raw.githubusercontent.com/nextcloud/flow/main/screenshots/flow_2.png</screenshot>
        <screenshot>https://raw.githubusercontent.com/nextcloud/flow/main/screenshots/flow_3.png</screenshot>
        <dependencies>
                <nextcloud min-version="30" max-version="33"/>
        </dependencies>
        <external-app>
                <docker-install>
                        <registry>ghcr.io</registry>
                        <image>nextcloud/flow</image>
                        <image-tag>1.2.0</image-tag>
                </docker-install>
                <routes>
                        <route>
                                <url>^api\/w\/nextcloud\/jobs\/.*</url>
                                <verb>GET,POST,PUT,DELETE</verb>
                                <access_level>PUBLIC</access_level>
                                <headers_to_exclude>[]</headers_to_exclude>
                                <bruteforce_protection>[401]</bruteforce_protection>
                        </route>
                        <route>
                                <url>^api\/w\/nextcloud\/jobs_u\/.*</url>
                                <verb>GET,POST,PUT,DELETE</verb>
                                <access_level>PUBLIC</access_level>
                                <headers_to_exclude>[]</headers_to_exclude>
                                <bruteforce_protection>[401]</bruteforce_protection>
                        </route>
                        <route>
                                <url>.*</url>
                                <verb>GET,POST,PUT,DELETE</verb>
                                <access_level>ADMIN</access_level>
                                <headers_to_exclude>[]</headers_to_exclude>
                        </route>
                </routes>
                <environment-variables>
                        <variable>
                                <name>NUM_WORKERS</name>
                                <display-name>Number of workers</display-name>
                                <description>Override the default count of Windmill workers</description>
                        </variable>
                        <variable>
                                <name>EXTERNAL_DATABASE</name>
                                <display-name>External database</display-name>
                                <description>External database URL in format: postgres://db_user:db_pass@db_address:5432/db_name</description>
                        </variable>
                        <variable>
                                <name>RUST_LOG</name>
                                <display-name>Windmill log level</display-name>
                                <description>Possible values: debug, info, warn, error</description>
                                <default>warn</default>
                        </variable>
                </environment-variables>
        </external-app>
</info>

As you can see, I also manipulated the <version> tag for me to know that this is my manual install.

5. Put the new content into your info.xml file. I did this with the nano editor, but this only works outside of the Nextcloud instance. Hence, it is only possible if you have access to the Nextcloud filesystem. I believe that you could also paste the content into the file using the echo command inside of the Nextcloud docker instance (something like docker exec -it nextcloud-app echo "your xml here" > info.xml)
6. Now, use occ to register the app with a custom info.xml: docker exec -it nextcloud-app php occ app_api:app:register --info-xml /path/to/your/info.xml flow your_harp_daemon

Done!

[Technotrickie]

Absolutely marvellous!
Although I'm running bareback Nextcloud not the docker, this worked a charm by following the above. Just placed the info.xml within /var/www/nextcloud directory, pasted in the gubbins as described, then
sudo -u www-data php occ app_api:app:register --info-xml /var/www/nextcloud/info.xml flow

first attemtpo failed as i missed that it said --info-xml i put the file name info.xml which failed. Then second attempt failed as I put the docker container name in nextcloud-appapi-dsp instead of looking in the appapi daemon settings and taking the socket name.
Swapped these bits to the correct names and Boom!

Next confusion was I couldn't see anything in Nextcloud.. Flow app just indicated 'Upgrade to 1.3.0' no settings and nothing extra in the flow part. I broke, i clicked the upgrade button..
Whadyaknow, the docker container for flow remained running! (sudo docker stats) #cannybelieveitafter5daysofpain

Still confused over lack of 'Flow' showing, I closed my eyes, thought of england and voilla! the little icon appeared to me at the top of the screen.. Workflow Engine...

@AndiTheHacker this has made my day - thanks for the birthday present! best one yet!

[tilkov]

Hi, thanks to both of you, I've also returned to 1.2.0 using your tutorials, but Windmill does now work correctly, complaining about numerous missing tables.
I guess the database scheme got updated in that huge version jump.

[AndiTheHacker]

If possible, I would suggest saving your workflows externally and then deleting the docker volume.
This deletes all the data of the app. But save your workflows before deleting!

[mattes3]

Wow, thanks, I got the same problem here and was able to solve it using your Tutorial.

I hope that the bug in 1.3.0 will be fixed in Nextcloud, soon!

[oleksandr-nc]

Excellent guide 👍

[mihai-bad]

Received the same error today with the latest 1.3.1 version, and i managed to make it work with this downgrade.

[Teddyder3te]

Same here, 1.3.1 not working

[AndiTheHacker]

Important notice to this workaround

Please only use this workaround to get your initial windmill install ready.
There has been a security issue with windmill/flow that allows for external control of your server.
After the initial install, please update immediately to 1.3.1. That version is fully working (at least for me) once you have an existing instance ready.

[AndiTheHacker]

reopening so that people can see it in issues tab. please don't reply.