feat(activepieces): standalone self-host stack + Git Sync flows-as-code (Phase 1) - #2233
Conversation
Phase 1 of ActivePieces integration (low-code automation companion to the n8n fabric). Opt-in standalone compose so it runs on demand, not baked into the main fleet compose (Phase 2 = first-class main-compose service, tracked). - pmoves/activepieces/docker-compose.yml: app + worker + postgres(pgvector) + redis (ghcr.io/activepieces/activepieces:0.86.3), hardened (no-new-privileges, healthchecks, named volumes, 127.0.0.1-bound UI :8087), secrets via :?-guarded env substitution. - env.activepieces.example: non-secret defaults + secret placeholders (emit via the PMOVES secrets pipeline, never hand-written). - flows/: Git Sync target (flows-as-code), mirrors pmoves/n8n/flows. - README.md: bring-up, Git Sync connection to the hosted (cataclysmstudios@gmail.com) account (AP_EDITION=ee), CE export→commit→import fallback, secrets table. compose config validated. Connection model = Git Sync (both cloud + self-host → pmoves/activepieces/flows); represented on the LinkedIn profile alongside n8n. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
📝 WalkthroughWalkthroughAdds an opt-in ActivePieces self-hosting stack with Compose services for the app, worker, Postgres, and Redis. It also adds environment defaults and documents operational setup, secrets, edition-specific Git Sync, and flow export locations. ChangesActivePieces self-hosting
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant Operator
participant Compose
participant ActivePiecesApp
participant ActivePiecesWorker
participant Postgres
participant Redis
Operator->>Compose: Load environment file and start stack
Compose->>Postgres: Start and check database health
Compose->>Redis: Start and check Redis health
Compose->>ActivePiecesApp: Start application
ActivePiecesApp->>Postgres: Connect to configured database
ActivePiecesApp->>Redis: Connect to configured Redis
Compose->>ActivePiecesWorker: Start worker after dependencies
ActivePiecesWorker->>Redis: Connect for job processing
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 786f2663c5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| cd pmoves/activepieces | ||
| cp env.activepieces.example env.activepieces # then hydrate the SECRET values | ||
| # secrets (AP_ENCRYPTION_KEY, AP_JWT_SECRET, AP_POSTGRES_PASSWORD, AP_LICENSE_KEY) | ||
| # come from the PMOVES secrets pipeline — do NOT hand-write real values. |
There was a problem hiding this comment.
Following this bring-up step creates pmoves/activepieces/env.activepieces and then places the encryption key, JWT secret, database password, and possibly license key in it, but that filename is not covered by either repository .gitignore (a repo-root git status reports it as untracked). Consequently, an ordinary git add pmoves/activepieces can commit all four secrets; rename it to an already-ignored .env.* form or explicitly ignore this runtime file.
AGENTS.md reference: AGENTS.md:L86-L90
Useful? React with 👍 / 👎.
| Add these to the secrets manifest and emit via `secrets-rotate`; the compose | ||
| reads them from `env.activepieces` (which the pipeline hydrates). See | ||
| `.claude/context/credentials-workflow.md`. |
There was a problem hiding this comment.
On a fresh checkout, the documented secrets path cannot hydrate this file: the shipped CHIT manifest contains neither these AP_* labels nor an env.activepieces target, while secrets-rotate writes pmoves/env.shared and the manifest-declared tier files only. Thus the copied template retains commented-out required variables and Compose aborts at the ${AP_ENCRYPTION_KEY:?}, ${AP_JWT_SECRET:?}, and ${AP_POSTGRES_PASSWORD:?} guards unless the operator manually copies secrets, contrary to the instructions; add the manifest targets/generation step or consume an existing generated env file.
AGENTS.md reference: AGENTS.md:L92-L97
Useful? React with 👍 / 👎.
| ports: | ||
| - "${AP_BIND:-127.0.0.1}:${AP_APP_PORT:-8087}:80" |
There was a problem hiding this comment.
When the normal PMOVES stack is running, the up target starts hi-rag-gateway-v2-gpu, whose host binding already defaults to 127.0.0.1:8087 in pmoves/docker-compose.yml; this new app claims the same address and port. As a result, whichever stack starts second cannot bind, so the documented ActivePieces companion cannot coexist with the core stack without an undocumented port override; choose a free registered default and keep AP_FRONTEND_URL aligned with it.
AGENTS.md reference: pmoves/AGENTS.md:L48-L48
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pmoves/activepieces/docker-compose.yml`:
- Line 109: Update the Redis server command in the docker-compose service to
enable append-only file persistence alongside the existing RDB snapshot
settings, preserving the current warning log level and standalone Redis
configuration.
- Around line 14-16: Update the ActivePieces service definitions in the Compose
file to assign the app and worker services to the workers profile, and
PostgreSQL and Redis to both data and workers profiles. Change the documented
startup command to include --profile workers so it brings up the intended full
stack while respecting profile scoping.
In `@pmoves/activepieces/env.activepieces.example`:
- Line 13: Set AP_EXECUTION_MODE to SANDBOX_CODE_ONLY in
pmoves/activepieces/env.activepieces.example:13 and update both compose fallback
values in pmoves/activepieces/docker-compose.yml:36 and :72 accordingly.
Document or enforce any production worker constraints required for compatibility
with sandboxed execution.
In `@pmoves/activepieces/README.md`:
- Line 9: Remove the cloud-account email from both committed documents: update
pmoves/activepieces/README.md lines 9-9 and pmoves/activepieces/flows/README.md
lines 4-4 to use the same non-identifying role alias or placeholder.
- Around line 8-10: Update the README’s Edition entry to identify the default
deployment as ActivePieces Community Edition, remove the claim that the entire
stack is MIT open-source, and note that setting AP_EDITION=ee enables Enterprise
features subject to ActivePieces commercial licensing.
- Around line 29-36: Update the Git Sync guidance in
pmoves/activepieces/README.md (lines 29-36) and
pmoves/activepieces/flows/README.md (lines 3-6) to describe the flows directory
as a repository artifact target, not a live mirror. Document the required
Environments setup, SSH repository and branch configuration, and explicit
Project Releases pushes for published flows; remove claims of continuous
push/pull or automatic two-way synchronization, keeping both files consistent.
- Around line 22-23: Update the Bring-up/UI documentation in README.md to add a
brief note explaining that AP_FRONTEND_URL must be set to the externally
reachable mesh/Tailscale frontend URL for SaaS trigger webhooks, while the local
UI remains bound to 127.0.0.1:8087 by default.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 08ba53a4-d295-480e-bbab-62bbe9f32365
📒 Files selected for processing (4)
pmoves/activepieces/README.mdpmoves/activepieces/docker-compose.ymlpmoves/activepieces/env.activepieces.examplepmoves/activepieces/flows/README.md
| # Bring up: docker compose --env-file env.activepieces -p pmoves-activepieces up -d | ||
| # (seed env.activepieces from env.activepieces.example first; generate the | ||
| # secret values via the PMOVES secrets pipeline, never by hand.) |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate relevant docs/files =="
git ls-files | rg 'pmoves/(docs/(ROADMAP|NEXT_STEPS|LOCAL_CI_CHECKS)\.md|activepieces/docker-compose\.yml|.*\.example$)' || true
echo
echo "== docs guidance =="
for f in pmoves/docs/PMOVES.AI\ PLANS/ROADMAP.md pmoves/docs/NEXT_STEPS.md pmoves/docs/LOCAL_CI_CHECKS.md; do
if [ -f "$f" ]; then
echo "--- $f ---"
sed -n '1,220p' "$f" | sed -n '/PROFILE\|Compose profile\|profile\|data\|workers\|activepieces/d;p' | head -80 || true
fi
done
echo
echo "== compose file profile/usages =="
python3 - <<'PY'
from pathlib import Path
import re, yaml
p=Path('pmoves/activepieces/docker-compose.yml')
text=p.read_text()
print(text)
print('--- summary ---')
print('profiles lines:', [lineno for lineno,line in enumerate(text.splitlines(),1) if re.search(r'\bprofiles\s*:', line)])
print('data lines:', [lineno for lineno,line in enumerate(text.splitlines(),1) if re.search(r'\bdata\b', line)])
print('workers lines:', [lineno for lineno,line in enumerate(text.splitlines(),1) if re.search(r'\bworkers\b', line)])
try:
dc=yaml.safe_load(text)
for svc, cfg in dc.get('services',{}).items():
print(f"{svc} profiles={cfg.get('profiles')}")
except Exception as e:
print('yaml parse failed:', e)
PY
echo
echo "== references to data/profiles/activepieces compose =="
rg -n "profiles|data|workers|pmoves-activepieces|docker compose|compose --profile" pmoves -S || true
echo
echo "== Docker Compose profile dependency behavior docs snippet via local text only if present? =="
# No local docs maybe, but we need deterministic local verifier if Compose is available and repo is not run.
if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
tmp="$(mktemp -d)"
cat > "$tmp/docker-compose.profile.yaml" <<'YML'
services:
app:
image: alpine
profiles: ["workers"]
depends_on:
db:
condition: service_healthy
db:
image: alpine
workers:
image: alpine
profiles: ["workers"]
YML
echo "docker compose --profile workers config --services:"
docker compose -f "$tmp/docker-compose.profile.yaml" --profile workers config --services || true
echo "docker compose --profile workers config includes dependencies?:"
docker compose -f "$tmp/docker-compose.profile.yaml" --profile workers config --services --no-interpolate 2>&1 || true
rm -rf "$tmp"
else
echo "docker compose not available"
fiRepository: POWERFULMOVES/PMOVES.AI
Length of output: 50380
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target compose file =="
if [ -f pmoves/activepieces/docker-compose.yml ]; then
cat -n pmoves/activepieces/docker-compose.yml
else
echo "missing pmoves/activepieces/docker-compose.yml"
fi
echo
echo "== activepieces compose-specific references =="
rg -n "activepieces|pmoves-activepieces|\bprofiles:\b|data|workers" pmoves/activepieces pmoves/docs/LOCAL_CI_CHECKS.md pmoves/Makefile -S || true
echo
echo "== docker compose profile availability =="
if command -v docker >/dev/null 2>&1; then
docker compose version 2>&1 || true
tmp="$(mktemp -d)"
cat > "$tmp/docker-compose.profile.yaml" <<'YML'
services:
app:
image: alpine:3.21
profiles: ["workers"]
depends_on:
db:
condition: service_healthy
db:
image: alpine:3.21
workers-only:
image: alpine:3.21
profiles: ["workers"]
YML
echo "docker compose --profile workers config services:"
docker compose -f "$tmp/docker-compose.profile.yaml" --profile workers config --services || true
echo "docker compose config (no profile) services containing profile constraints:"
docker compose -f "$tmp/docker-compose.profile.yaml" config --services || true
rm -rf "$tmp"
else
echo "docker not available"
fi
echo
echo "== relevant code guideline snippets =="
sed -n '1,80p' pmoves/docs/LOCAL_CI_CHECKS.md 2>/dev/null || true
sed -n '1,80p' pmoves/Makefile 2>/dev/null || trueRepository: POWERFULMOVES/PMOVES.AI
Length of output: 33080
🌐 Web query:
Docker Compose profiles enabled profile dependencies depend on services not matching profiles documentation
💡 Result:
In Docker Compose, services assigned a profiles attribute are only enabled when that specific profile is active [1][2]. When you use depends_on to link services, Docker Compose does not automatically enable or pull in dependency services if they are gated behind a profile that is not currently enabled [1][3]. Key points regarding this behavior include: Dependency Validation: If a service depends on another service, and that dependency is assigned a profile, the dependency must be enabled either by explicitly activating its profile (via --profile or COMPOSE_PROFILES) or by ensuring the dependency is "always enabled" (i.e., it has no profiles attribute) [1][4][5]. If a dependency is missing or its profile is not active, Docker Compose will return an error stating that the service is not enabled [1][6][3]. Targeting Services Directly: When you explicitly run a specific service on the command line (e.g., docker compose up <service_name>), Docker Compose automatically enables that service's profiles and pulls in its direct dependencies [1][4]. However, this "auto-enabling" behavior is limited; it does not recursively resolve or enable profiles for nested dependencies [6][7]. If a service depends on another service, and that second service depends on a third, all services in that chain must either share a profile, be profile-free, or have their profiles explicitly enabled to avoid errors [6][7]. Best Practices: To maintain a stable configuration, it is generally recommended to keep core infrastructure dependencies (like databases or shared networks) profile-free so they are always enabled [2][8]. For optional features or debugging tools, ensure that all services within a dependency chain share the same profile, or explicitly activate the necessary profiles in your environment variables or command-line arguments [6][4][5]. For further details, refer to the official Docker documentation on service profiles and dependency resolution [1][2].
Citations:
- 1: https://docs.docker.com/reference/compose-file/profiles/
- 2: https://docs.docker.com/compose/how-tos/profiles/
- 3: https://github.com/compose-spec/compose-spec/blob/main/15-profiles.md
- 4: https://github.com/docker/docs/blob/main/content/manuals/compose/how-tos/profiles.md
- 5: Allow depends_on to be optional to use profiles to control which services to run in development vs production compose-spec/compose-spec#274
- 6: Automatically-enabled profiles aren't enabled for nested dependencies docker/compose#8458
- 7: https://www.howtogeek.com/devops/how-to-use-service-profiles-to-simplify-stacks-in-docker-compose/
- 8: https://selfhostsetup.com/posts/docker-compose-profiles-dev-staging-production/
Wire this ActivePieces stack to Compose profiles.
The documented startup still starts every service, so add profiles to the ActivePieces stack—e.g. workers for app/worker and both data + workers for PostgreSQL/Redis—and invoke the full stack with --profile workers so the documented command respects the scoping guideline.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/activepieces/docker-compose.yml` around lines 14 - 16, Update the
ActivePieces service definitions in the Compose file to assign the app and
worker services to the workers profile, and PostgreSQL and Redis to both data
and workers profiles. Change the documented startup command to include --profile
workers so it brings up the intended full stack while respecting profile
scoping.
Source: Coding guidelines
| activepieces-redis: | ||
| image: redis:7.0.7 | ||
| restart: unless-stopped | ||
| command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"] |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target file excerpt =="
sed -n '90,120p' pmoves/activepieces/docker-compose.yml || true
echo
echo "== related env/queue config searches =="
rg -n "AP_QUEUE_MODE|QUEUE_MODE|REDIS|redis|appendonly|appendfsync|--save" pmoves/activepieces -S || true
echo
echo "== roadmap/next steps/README/docs references if any =="
for f in pmoves/docs/PMOVES.AI PLANS/ROADMAP.md pm_moves/docs/NEXT_STEPS.md pmoves/docs/LOCAL_CI_CHECKS.md 2>/dev/null; do
: # placeholder
done
for f in docs/PMOVES.AI\ PLANS/ROADMAP.md docs/NEXT_STEPS.md docs/LOCAL_CI_CHECKS.md 2>/dev/null; do
if [ -f "$f" ]; then echo "-- $f --"; sed -n '1,80p' "$f"; fi
done
if [ -f "pmoves/docs/PMOVES.AI PLANS/ROADMAP.md" ]; then echo "-- ROADMAP excerpt --"; sed -n '1,120p' "pmoves/docs/PMOVES.AI PLANS/ROADMAP.md"; fi
if [ -f "pmoves/docs/NEXT_STEPS.md" ]; then echo "-- NEXT_STEPS excerpt --"; sed -n '1,120p' "pmoves/docs/NEXT_STEPS.md"; fiRepository: POWERFULMOVES/PMOVES.AI
Length of output: 2580
🌐 Web query:
ActivePieces AP_QUEUE_MODE REDIS redis durable queue documentation
💡 Result:
The environment variable AP_QUEUE_MODE is deprecated and has been replaced by AP_REDIS_TYPE [1][2]. You should no longer use AP_QUEUE_MODE to configure Redis settings [1][2]. To configure Redis as your durable queue, you should use the following approach documented in the current Activepieces configuration references [3][4]: 1. Use AP_REDIS_TYPE: Set this variable to define the type of Redis deployment. Supported values typically include MEMORY (for in-process/non-durable), STANDALONE (default), or SENTINEL [3]. 2. Configure Connection Details: Provide the connection information using AP_REDIS_URL (which overrides other settings) or by specifying individual variables such as AP_REDIS_HOST, AP_REDIS_PORT, AP_REDIS_USER, and AP_REDIS_PASSWORD [3]. 3. Ensure Durability: Activepieces relies on BullMQ via Redis to manage its job queue [3][5]. Because jobs are queued in Redis, its durability depends on your configuration [6][7]. To prevent job loss: - Use a managed Redis service or ensure your self-hosted Redis instance has persistence enabled (e.g., AOF with everysec) [6][7]. - Note that while Postgres handles long-term state (flow definitions, run logs), Redis acts as the transient queue [5][6]. If Redis loses its dataset, queued jobs that have not yet been picked up by a worker may be lost [7]. For further details, refer to the official Activepieces environment variables reference [3].
Citations:
- 1: https://www.activepieces.com/docs/install/reference/breaking-changes
- 2: https://www.activepieces.com/docs/install/configuration/breaking-changes
- 3: https://www.activepieces.com/docs/install/reference/environment-variables
- 4: https://activepieces-activepieces.mintlify.app/deployment/environment-variables
- 5: https://www.activepieces.com/docs/install/architecture/overview
- 6: https://www.activepieces.com/docs/install/guarantees/crash-recovery
- 7: https://www.activepieces.com/docs/install/guarantees/disaster-recovery
Enable append-only persistence for the Redis queue.
With AP_QUEUE_MODE=REDIS, ActivePieces stores workflow jobs in Redis. The current --save 60 1 only creates periodic RDB snapshots, so queued jobs added after the last snapshot can be lost on an unclean restart. Add AOF persistence for the standalone Redis stack.
Proposed durability fix
- command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"]
+ command:
+ ["redis-server", "--appendonly", "yes", "--appendfsync", "everysec",
+ "--save", "60", "1", "--loglevel", "warning"]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| command: ["redis-server", "--save", "60", "1", "--loglevel", "warning"] | |
| command: | |
| ["redis-server", "--appendonly", "yes", "--appendfsync", "everysec", | |
| "--save", "60", "1", "--loglevel", "warning"] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/activepieces/docker-compose.yml` at line 109, Update the Redis server
command in the docker-compose service to enable append-only file persistence
alongside the existing RDB snapshot settings, preserving the current warning log
level and standalone Redis configuration.
| AP_BIND=127.0.0.1 | ||
| AP_APP_PORT=8087 | ||
| AP_FRONTEND_URL=http://localhost:8087 | ||
| AP_EXECUTION_MODE=UNSANDBOXED |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Candidate files =="
fd -a '^(ROADMAP|NEXT_STEPS|LOCAL_CI_CHECKS|STARTER_PR_BODY|docker-compose|env\.activepieces\.example)\.md$|^docker-compose\.yml$|^env\.activepieces\.example$' . | sed 's#^\./##'
echo
echo "== ActivePieces files =="
fd -a '^(docker-compose\.yml|env\.activepieces\.example)$' . | sed 's#^\./##'
echo
echo "== env.activepieces.example =="
if [ -f pmoves/activepieces/env.activepieces.example ]; then
cat -n pmoves/activepieces/env.activepieces.example
fi
echo
echo "== relevant docker-compose sections =="
if [ -f pmoves/activepieces/docker-compose.yml ]; then
nl -ba pmoves/activepieces/docker-compose.yml | sed -n '1,110p'
fi
echo
echo "== references to AP_EXECUTION_MODE and sandbox =="
rg -n "AP_EXECUTION_MODE|UNSANDBOXED|SANDBOX_CODE_ONLY|sandbox" pmoves/activepieces README.md .github docs 2>/dev/null || true
echo
echo "== activepieces docs links around execution mode? =="
rg -n "AP_EXECUTION_MODE|SANDBOX_CODE_ONLY|UNSANDBOXED" README.md pmoves 2>/dev/null || trueRepository: POWERFULMOVES/PMOVES.AI
Length of output: 3212
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== docker-compose relevant sections =="
awk '{printf "%6d\t%s\n", NR, $0}' pmoves/activepieces/docker-compose.yml | sed -n '1,110p'
echo
echo "== roadmap/next steps activepieces references =="
for f in pmoves/docs/PMOVES.AI\ PLANS/ROADMAP.md pmoves/docs/NEXT_STEPS.md pmoves/docs/ROADMAP.md pmoves/docs/LOCAL_CI_CHECKS.md pmoves/activepieces/README.md; do
if [ -f "$f" ]; then
echo "-- $f --"
rg -n "activepieces|ActivePieces|AP_EXECUTION_MODE|SANDBOX_CODE_ONLY|UNSANDBOXED|local ci|pr testing|PR Testing" "$f" || true
fi
done
echo
echo "== all repository references =="
rg -n "AP_EXECUTION_MODE|UNSANDBOXED|SANDBOX_CODE_ONLY|activepieces" .Repository: POWERFULMOVES/PMOVES.AI
Length of output: 12083
🌐 Web query:
ActivePieces deployment AP_EXECUTION_MODE SANDBOX_CODE_ONLY UN-sanboxed environment variables
💡 Result:
In Activepieces, AP_EXECUTION_MODE controls the sandboxing strategy for user-defined code (such as Code steps or piece actions) [1][2]. When you set AP_EXECUTION_MODE to SANDBOX_CODE_ONLY, Activepieces uses V8 isolation (specifically isolated-vm) to secure code execution [1]. This mode is designed for enterprise and multi-tenant environments because it allows the code to run within an unprivileged container, meaning it does not require privileged Docker or Kubernetes capabilities (like CAP_SYS_ADMIN) [1][3]. In this mode, each Code step is wrapped in a fresh V8 context that restricts access to require, the filesystem, and npm modules, providing a secure, lightweight, and fast execution environment [1][3]. For a production deployment using SANDBOX_CODE_ONLY, the recommended configuration typically includes [4][5]: - AP_EXECUTION_MODE=SANDBOX_CODE_ONLY - AP_WORKER_CONCURRENCY=1 (This ensures that only one flow executes per worker, providing stronger isolation of the container's filesystem and memory) [4][6]. - AP_REUSE_SANDBOX=true (This allows sandboxes to remain warm across jobs for improved performance) [1][4]. Note that SANDBOX_CODE_ONLY is not compatible with certain setups, such as Worker Groups, where SANDBOX_PROCESS is required instead [4][5]. If you need to expose specific environment variables to the sandboxed code, you can use the AP_SANDBOX_PROPAGATED_ENV_VARS variable, though it is generally recommended to include configuration within authentication objects for better instance-to-instance consistency [2][7].
Citations:
- 1: https://www.activepieces.com/docs/install/architecture/sandboxing
- 2: https://www.activepieces.com/docs/install/configuration/environment-variables
- 3: https://github.com/activepieces/activepieces/blob/3d0b6ef9/docs/_snippets/execution-mode.mdx
- 4: https://www.activepieces.com/docs/install/configure-operate/production-setup
- 5: https://www.activepieces.com/docs/install/configuration/overview
- 6: https://www.activepieces.com/docs/install/guarantees/execution-isolation
- 7: https://www.activepieces.com/docs/install/reference/environment-variables
🌐 Web query:
ActivePieces AP_EXECUTION_MODE default UNSANDBOXED documentation
💡 Result:
In Activepieces, AP_EXECUTION_MODE is an environment variable that determines the sandbox strategy used for executing flow code [1][2]. The default value for this variable is UNSANDBOXED [2][3]. When AP_EXECUTION_MODE is set to UNSANDBOXED: - Security: This mode is not secure for multi-tenant deployments because it does not provide isolation between flows [4]. - Performance: It is fast and lightweight, as it avoids the overhead of kernel-level or V8-based sandboxing [4]. - Functionality: It supports the use of NPM packages in Code pieces [4]. - Requirements: It does not require the Docker container to be privileged [4]. Because UNSANDBOXED mode lacks isolation, the documentation strongly recommends using other modes (such as SANDBOX_CODE_ONLY for V8 isolation or SANDBOX_PROCESS for kernel-level isolation) in production environments to ensure flows cannot access each other's memory, files, or environment [1][5]. The choice of execution mode is considered the most important security decision for self-hosted, multi-tenant Activepieces deployments [1][6].
Citations:
- 1: https://www.activepieces.com/docs/install/architecture/sandboxing
- 2: https://www.activepieces.com/docs/install/configuration/environment-variables
- 3: https://www.activepieces.com/docs/install/reference/environment-variables
- 4: https://github.com/activepieces/activepieces/blob/3d0b6ef9/docs/_snippets/execution-mode.mdx
- 5: https://www.activepieces.com/docs/install/guarantees/execution-isolation
- 6: https://www.activepieces.com/docs/install/architecture/workers
Use sandboxed execution as the ActivePieces default. env.activepieces.example, activepieces-app, and activepieces-worker all fall back to UNSANDBOXED, so copied/local environments can run user flow code without ActivePieces’ V8/process isolation. Set the template and both compose fallbacks to SANDBOX_CODE_ONLY, and document/ensure any production worker constraints compatible with that mode.
📍 Affects 2 files
pmoves/activepieces/env.activepieces.example#L13-L13(this comment)pmoves/activepieces/docker-compose.yml#L36-L36pmoves/activepieces/docker-compose.yml#L72-L72
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/activepieces/env.activepieces.example` at line 13, Set
AP_EXECUTION_MODE to SANDBOX_CODE_ONLY in
pmoves/activepieces/env.activepieces.example:13 and update both compose fallback
values in pmoves/activepieces/docker-compose.yml:36 and :72 accordingly.
Document or enforce any production worker constraints required for compatibility
with sandboxed execution.
| - **Edition:** MIT open-source, self-hosted (`ghcr.io/activepieces/activepieces:0.86.3`). | ||
| - **Hosted account:** `cataclysmstudios@gmail.com` on ActivePieces Cloud. | ||
| - **Phase 1 (this):** standalone self-host. **Phase 2 (tracked):** integrate as a first-class service in the main fleet `docker-compose.yml`. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repo files matching README.md:\n'
git ls-files | grep '\.md$' | rg 'activepieces|README' || true
printf '\nTarget README excerpt:\n'
if [ -f pmoves/activepieces/README.md ]; then
nl -ba pmoves/activepieces/README.md | sed -n '1,80p'
else
echo 'pmoves/activepieces/README.md not found'
fi
printf '\nSearch for ActivePieces AP_EDITION mentions:\n'
rg -n "AP_EDITION|activepieces|Git Sync|GitSync|activepieces/activepieces" -S . || trueRepository: POWERFULMOVES/PMOVES.AI
Length of output: 9607
🌐 Web query:
ActivePieces 0.86.3 license edition EE AP_EDITION community MIT
💡 Result:
Activepieces uses an open-core business model where the software is released under two distinct licenses based on the edition [1][2][3]. As of version 0.86.3, the licensing structure remains consistent with this model [1][4][5]: Community Edition (CE) The core functionality of Activepieces is released under the permissive MIT License [1][2][6]. This edition is open source and intended for users who self-host and do not require enterprise-specific administrative or security features [1][3][7]. Enterprise Edition (EE) Features located within the packages/ee and packages/server/api/src/app/ee directories are released under a proprietary Commercial License [1][8][9]. Using these enterprise features on a self-hosted instance requires a valid Activepieces Enterprise license [1][2][3]. These features are gated by "plan flags" managed via a license key system [10][2]. In summary, while the core Activepieces codebase is MIT-licensed, the enterprise-specific modules are proprietary and require a commercial subscription [1][3][7]. GitHub may report the overall repository license as "Other" because the repository contains both the MIT-licensed core and the commercially licensed enterprise packages [3].
Citations:
- 1: https://www.activepieces.com/docs/about/license
- 2: https://deepwiki.com/activepieces/activepieces/1.2-editions-and-licensing
- 3: https://www.usecarly.com/blog/activepieces-alternatives/
- 4: https://newreleases.io/project/github/activepieces/activepieces/release/0.86.3
- 5: https://github.com/activepieces/activepieces
- 6: https://www.activepieces.com/open-source
- 7: https://www.activepieces.com/pricing
- 8: https://github.com/activepieces/activepieces/blob/main/packages/ee/LICENSE
- 9: https://github.com/activepieces/activepieces/blob/0.81.4/docs/about/license.mdx
- 10: https://github.com/activepieces/activepieces/blob/main/.agents/features/ee-overview.md
🌐 Web query:
ActivePieces AP_EDITION ee 0.86.3 license MIT
💡 Result:
ActivePieces uses a dual-licensing model and is not exclusively licensed under MIT [1][2]. The software repository is structured to differentiate between core functionality and enterprise features, governed by distinct license terms [3][1]: 1. Community Edition (CE): Code residing outside the 'packages/ee/' and 'packages/server/api/src/app/ee' directories is licensed under the MIT License [3]. This includes the core automation engine and standard community pieces [1][2]. 2. Enterprise Edition (EE): All content within 'packages/ee/' and 'packages/server/api/src/app/ee' is subject to a Commercial License, not the MIT License [3][1]. Use of these enterprise features in a self-hosted production environment requires a valid commercial license key [1][4][5]. The 'AP_EDITION' environment variable is used to determine which modules are loaded at runtime [2]. When set to 'ee', the application enables enterprise-specific features that require license validation [4][2]. As of version 0.86.3, the repository continues to maintain this separation, where the core remains MIT-licensed while enterprise-specific components remain under the commercial license [3][6][5].
Citations:
- 1: https://www.activepieces.com/docs/about/license
- 2: https://deepwiki.com/activepieces/activepieces/1.2-editions-and-licensing
- 3: https://github.com/activepieces/activepieces/blob/main/LICENSE
- 4: https://www.activepieces.com/docs/handbook/engineering/playbooks/run-ee
- 5: https://github.com/activepieces/activepieces/blob/main/packages/ee/LICENSE
- 6: https://github.com/activepieces/activepieces/releases/tag/0.86.3
Clarify ActivePieces edition licensing.
Label the README as Community Edition by default and note that enabling AP_EDITION=ee uses Enterprise features governed by ActivePieces commercial licensing. Calling the stack “MIT open-source” conflicts with the optional EE path.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/activepieces/README.md` around lines 8 - 10, Update the README’s
Edition entry to identify the default deployment as ActivePieces Community
Edition, remove the claim that the entire stack is MIT open-source, and note
that setting AP_EDITION=ee enables Enterprise features subject to ActivePieces
commercial licensing.
| [`flows/`](flows/) — the same convention as the 34 n8n flows. | ||
|
|
||
| - **Edition:** MIT open-source, self-hosted (`ghcr.io/activepieces/activepieces:0.86.3`). | ||
| - **Hosted account:** `cataclysmstudios@gmail.com` on ActivePieces Cloud. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Remove the cloud-account email from both committed documents.
pmoves/activepieces/README.md#L9-L9: replace the email with a role alias or placeholder.pmoves/activepieces/flows/README.md#L4-L4: replace the repeated email with the same non-identifying label.
📍 Affects 2 files
pmoves/activepieces/README.md#L9-L9(this comment)pmoves/activepieces/flows/README.md#L4-L4
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/activepieces/README.md` at line 9, Remove the cloud-account email from
both committed documents: update pmoves/activepieces/README.md lines 9-9 and
pmoves/activepieces/flows/README.md lines 4-4 to use the same non-identifying
role alias or placeholder.
| UI: <http://localhost:8087> (bound to `127.0.0.1` by default — front it with the | ||
| mesh/Tailscale rather than publishing to the LAN, per the privacy-mesh rule). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | rg '(^pmoves/activepieces/README\.md$|pmoves/activepieces/docker-compose\.yml$|docs/ROADMAP\.md$|docs/NEXT_STEPS\.md$|\.claude/context/nats-subjects\.md$|\.claude/context/services-catalog\.md$)' || true
echo
echo "== README relevant =="
if [ -f pmoves/activepieces/README.md ]; then
nl -ba pmoves/activepieces/README.md | sed -n '1,80p'
fi
echo
echo "== compose relevant =="
if [ -f pmoves/activepieces/docker-compose.yml ]; then
nl -ba pmoves/activepieces/docker-compose.yml | sed -n '1,90p'
fi
echo
echo "== references to AP_FRONTEND_URL/frontends/webhooks in activepieces =="
rg -n "AP_FRONTEND_URL|FRONTEND_URL|webhook|localhost:8087|activepieces|8087" pmoves/activepieces README.md docs .claude 2>/dev/null || trueRepository: POWERFULMOVES/PMOVES.AI
Length of output: 507
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== README relevant =="
if [ -f pmoves/activepieces/README.md ]; then
sed -n '1,120p' pmoves/activepieces/README.md
fi
echo
echo "== compose relevant =="
if [ -f pmoves/activepieces/docker-compose.yml ]; then
sed -n '1,120p' pmoves/activepieces/docker-compose.yml
fi
echo
echo "== references to AP_FRONTEND_URL/frontends/webhooks in activepieces =="
python3 - <<'PY'
import pathlib, re
for p in ["pmoves/activepieces/README.md","pmoves/activepieces/docker-compose.yml","pmoves/docs/NEXT_STEPS.md","pmoves/docs/ROADMAP.md",".claude/context/services-catalog.md",".claude/context/nats-subjects.md"]:
try:
text=pathlib.Path(p).read_text()
except Exception as e:
print(f"{p}: cannot read ({e})")
continue
hits=[(i+1,line) for i,line in enumerate(text.splitlines()) if re.search(r'AP_FRONTEND_URL|FRONTEND_URL|webhook|localhost:8087|127\.0\.0\.1:8087|activepieces|8087',line,re.I)]
if hits:
print(f"--- {p} ---")
for line_no,line in hits:
print(f"{line_no}: {line}")
PYRepository: POWERFULMOVES/PMOVES.AI
Length of output: 13824
🌐 Web query:
ActivePieces AP_FRONTEND_URL Docker Compose frontend URL webhook localhost documentation
💡 Result:
In ActivePieces, the AP_FRONTEND_URL environment variable is the critical setting that defines the public-facing URL of your instance [1][2]. This URL is used by the system to generate webhook endpoints and redirect URLs, meaning it must be accessible by third-party services for triggers and webhooks to function correctly [1][3][2]. When using Docker Compose on a local machine (localhost), the default configuration often fails to receive external webhooks because the service is not reachable from the internet [4][5]. To resolve this, you must set AP_FRONTEND_URL to a public address that points to your instance [1][6]. For local development or testing, you can use a tunneling service such as ngrok to expose your local service to the internet [4][6]. The typical process is: 1. Use ngrok to tunnel to your ActivePieces service port (typically 8080) [4][5]: ngrok http 8080 2. Copy the resulting public URL (e.g., https://your-tunnel-id.ngrok-free.app) provided by ngrok [4][6]. 3. Update your.env file or environment configuration for the ActivePieces service to set this URL [4][6]: AP_FRONTEND_URL=https://your-tunnel-id.ngrok-free.app After updating the variable, ensure your Docker Compose services are restarted to apply the changes [4][6]. In a production environment, you should replace this with your actual domain name (e.g., https://activepieces.yourdomain.com) [3][7].
Citations:
- 1: https://www.activepieces.com/docs/install/reference/environment-variables
- 2: https://github.com/activepieces/activepieces/blob/6b04e9e9/docs/install/configuration/environment-variables.mdx
- 3: https://activepieces-activepieces.mintlify.app/deployment/environment-variables
- 4: https://www.activepieces.com/docs/install/options/docker-compose
- 5: https://www.activepieces.com/docs/install/options/docker
- 6: https://github.com/activepieces/activepieces/blob/6b04e9e9/docs/install/options/docker-compose.mdx
- 7: https://www.activepieces.com/docs/install/configure-operate/production-setup
Document the externally reachable AP_FRONTEND_URL for webhooks.
docker-compose.yml defaults both app and worker to ${AP_FRONTEND_URL:-http://localhost:8087}, but SaaS trigger webhooks need an ingress URL reachable by external callers. Add a short note under Bring-up/UI to set AP_FRONTEND_URL to the mesh/Tailscale frontend URL and distinguish it from the local 127.0.0.1:8087 bind.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/activepieces/README.md` around lines 22 - 23, Update the Bring-up/UI
documentation in README.md to add a brief note explaining that AP_FRONTEND_URL
must be set to the externally reachable mesh/Tailscale frontend URL for SaaS
trigger webhooks, while the local UI remains bound to 127.0.0.1:8087 by default.
| Git Sync makes flows version-controlled and shared between the Cloud project and | ||
| this self-host — both point at `pmoves/activepieces/flows/`. **Git Sync is an | ||
| ActivePieces Enterprise feature** (set `AP_EDITION=ee` + `AP_LICENSE_KEY`). | ||
|
|
||
| **If your Cloud plan includes Git Sync:** | ||
| 1. Cloud → Project Settings → **Git Sync** → connect this repo, branch, folder `pmoves/activepieces/flows`. | ||
| 2. Self-host: set `AP_EDITION=ee` + `AP_LICENSE_KEY` in `env.activepieces`, then in its Project Settings → Git Sync → same repo/branch/folder. | ||
| 3. Push/pull flows through git; both environments stay in sync and the flows are represented in the repo (and on the LinkedIn profile). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repository files matching activepieces READMEs:\n'
git ls-files | rg '(^|/)activepieces/README\.md$|(^|/)flows/README\.md$' || true
printf '\nActivePieces README sections:\n'
for f in pmoves/activepieces/README.md pmoves/activepieces/flows/README.md; do
if [ -f "$f" ]; then
echo "--- ${f} ---"
nl -ba "$f" | sed -n '1,80p'
else
echo "missing: $f"
fi
done
printf '\nSearch for Git Sync / project releases wording elsewhere:\n'
rg -n "Git Sync|project releases|Project Releases|Git artifact|flows-as-code|Mirrors pmoves" -S .Repository: POWERFULMOVES/PMOVES.AI
Length of output: 385
🌐 Web query:
ActivePieces Git Sync documentation project releases repository push to repository
💡 Result:
Activepieces provides a Git Sync feature that allows users to manage version control for their projects, including flows, connections, and tables [1][2]. This functionality is part of the Project Releases system and requires the Environments feature to be enabled on your instance plan [1][3]. Key aspects of Git Sync and pushing to a repository include: Prerequisites - Feature Access: You must have the Environments feature enabled for your project [1][3]. Contact your instance administrator if this option is unavailable in Project Settings [1][3]. - Configuration: Before syncing, you must connect a Git repository. This involves configuring the remote URL (SSH format), branch, and providing an SSH private key [1][4][3]. Pushing to Repository Activepieces allows you to push content from your project to the connected Git repository using two primary methods: 1. Push Everything: You can push all published flows, connections, and tables at once. - Navigate to the releases page and click the Push Everything button [1][3][5]. - Provide a descriptive commit message to explain the changes [1][5]. - Confirm by clicking the Push button to send all published items to the repository [1][3]. 2. Pushing Individual Flows or Tables: It is also possible to push specific items without performing a bulk push. - Select the specific flows or tables you wish to push [5]. - Click the Push to Git option [6][5]. - Enter a commit message and confirm the action to send the selected items to your repository [6][5]. Note: Only published flows can be pushed to a Git repository [1][3][5]. For troubleshooting, ensure your SSH private key is correctly formatted and that the remote URL uses the SSH protocol [1][3].
Citations:
- 1: https://www.activepieces.com/docs/admin-guide/guides/project-releases
- 2: https://deepwiki.com/activepieces/activepieces/7.4-git-sync-and-releases
- 3: https://github.com/activepieces/activepieces/blob/0.81.4/docs/admin-guide/guides/project-releases.mdx
- 4: https://www.activepieces.com/docs/endpoints/git-repos/configure
- 5: activepieces/activepieces@0cda2b4
- 6: https://github.com/activepieces/activepieces/blob/6b04e9e9/packages/web/src/features/project-releases/components/push-to-git-dialog.tsx
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in pmoves/activepieces/README.md pmoves/activepieces/flows/README.md; do
if [ -f "$f" ]; then
echo "--- ${f} ---"
awk '{printf "%7d\t%s\n", NR, $0}' "$f" | sed -n '1,80p'
else
echo "missing: $f"
fi
done
printf '\nSearch for Git Sync / project releases wording elsewhere:\n'
rg -n "Git Sync|project releases|Project Releases|Git artifact|flows-as-code|Mirrors pmoves" -S . || trueRepository: POWERFULMOVES/PMOVES.AI
Length of output: 6432
Document Git Sync as Project Releases push behavior, not a live mirror.
Both files imply continuous push/pull or automatic “Mirrors pmoves/n8n/flows/” synchronization. ActivePieces Git Sync requires Environments, repository connection with SSH/branch selection, and explicit pushes only for published flows via project releases, not automatic two-way flow sync. Update pmoves/activepieces/README.md and pmoves/activepieces/flows/README.md to describe this repository artifact target and release-based workflow consistently.
📍 Affects 2 files
pmoves/activepieces/README.md#L29-L36(this comment)pmoves/activepieces/flows/README.md#L3-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pmoves/activepieces/README.md` around lines 29 - 36, Update the Git Sync
guidance in pmoves/activepieces/README.md (lines 29-36) and
pmoves/activepieces/flows/README.md (lines 3-6) to describe the flows directory
as a repository artifact target, not a live mirror. Document the required
Environments setup, SSH repository and branch configuration, and explicit
Project Releases pushes for published flows; remove claims of continuous
push/pull or automatic two-way synchronization, keeping both files consistent.
…cker compose) (#2235) Follow-up to #2233. The README documented raw 'docker compose up' for the standalone ActivePieces stack, which bypasses the make-target/env-injection convention and trips the pipeline guard. Fix: - Makefile: add up-activepieces / down-activepieces / activepieces-health wrapping the standalone compose (own --env-file env.activepieces, project pmoves-activepieces) with a missing-env guard. Bring-up now goes through the Known Road, not raw docker. - README: replace raw docker commands with 'make -C pmoves up-activepieces' etc. - .gitignore: ignore pmoves/activepieces/env.activepieces so the instance secrets (self-managed openssl keys, seeded from .example) never land in the repo. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
Phase 1 of ActivePieces integration — a low-code automation companion to the n8n fabric. Standalone, opt-in stack (runs on demand, not in the main fleet compose).
What
pmoves/activepieces/docker-compose.yml— app + worker + postgres (pgvector) + redis (ghcr.io/activepieces/activepieces:0.86.3), hardened:no-new-privileges, healthchecks, named volumes, UI bound to127.0.0.1:8087(front via mesh, per privacy rule), secrets via:?-guarded env substitution.env.activepieces.example— non-secret defaults + secret placeholders (AP_ENCRYPTION_KEY,AP_JWT_SECRET,AP_POSTGRES_PASSWORD,AP_LICENSE_KEY) emitted via the PMOVES secrets pipeline.flows/— Git Sync target (flows-as-code), mirrorspmoves/n8n/flows.README.md— bring-up, Git Sync connection to the hosted (cataclysmstudios@gmail.com) account, CE export→commit→import fallback, secrets table.Connection model
Git Sync — both the ActivePieces Cloud project and this self-host point at
pmoves/activepieces/flows/, so flows become versioned flows-as-code (needsAP_EDITION=ee+ license; CE fallback documented). Represented on the LinkedIn persona profile alongside the 34 n8n flows.Verify
docker compose configvalidated (with dummy secrets).Next (tracked)
Phase 2 — promote to a first-class service in the main fleet
docker-compose.yml(tier + profile + overlay regen).🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation