5 posts tagged with "Self-hosting"
View All TagsInstance-level setting to enforce nsjail sandboxing across all jobs, and per-script #sandbox annotation for bash scripts.
New features
- job_isolation instance setting with nsjail_sandboxing value to enforce sandboxing for all jobs.
- Sandboxing enabled when either job_isolation is set or DISABLE_NSJAIL=false.
- #sandbox bash annotation to enable sandboxing for individual bash scripts.
- Nsjail always probed at startup regardless of DISABLE_NSJAIL setting.
Unauthenticated and authenticated health endpoints for monitoring Windmill instances. Includes Prometheus metrics, Kubernetes readiness probe support, and detailed diagnostics.
New features
- Unauthenticated /api/health endpoint with 5-second cache for lightweight uptime checks.
- Authenticated detailed endpoint returning database latency, connection pool stats, worker groups, and queue depth.
- Prometheus metrics: health_status_phase, health_database_latency_ms, health_active_workers, health_queue_depth.
- SILENCE_HEALTH_LOGS environment variable to suppress health check log noise.
PocketID is now supported as an SSO provider. Configure it from instance settings with your PocketID base URL, and OIDC endpoints are derived automatically.
New features
- PocketID as a new SSO/OAuth provider
- Automatic OIDC endpoint generation from base URL
- Custom display name for the login button
Users can now reset their password from the login page when SMTP is configured on the instance. A "Forgot password?" link sends a time-limited reset email (1 hour expiry). The flow prevents email enumeration by always showing a success message.
New features
- "Forgot password?" link on the login page
- Secure token-based reset flow with 1-hour expiry
- Email enumeration protection
Set QUIET=true on workers to suppress verbose per-job logs (fetched job, started handling, job finished) and reduce periodic log frequency by 10x. Useful for reducing log noise in production.
New features
- QUIET environment variable to reduce worker log verbosity
- Suppresses per-job lifecycle logs
- Reduces periodic "still running" and memory snapshot log frequency by 10x