Automatisch

Open-source business automation platform — a self-hosted alternative to Zapier and Make. Automatisch provides a visual workflow builder, pre-built integrations with popular services, webhook triggers, and OAuth-based connection management. It requires PostgreSQL, Redis, an HTTP web process, and a background worker process to operate.

Set webAppUrl to your public URL before configuring integrations

The default automatisch.webAppUrl is http://localhost:3000. Without changing it to your public URL, OAuth callbacks from external services (GitHub, Slack, Google, etc.) will redirect to localhost and fail. Webhook URLs generated by Automatisch will also be unreachable from the internet. Set this before adding any integration.

Key Features

Visual workflow builder — drag-and-drop interface for creating multi-step automations
Pre-built integrations — connect GitHub, Slack, Google Sheets, Telegram, and more
Webhook triggers — start workflows from external HTTP events
OAuth connection management — secure service connections with token refresh
PostgreSQL backend — stores workflows, connections, and execution history
Redis queue — asynchronous job execution for reliable workflow processing
Dedicated worker — required background process enabled by default and independently scalable
Auto-generated secrets — encryption and JWT keys generated on first install
Hardened runtime — non-root containers, read-only filesystems, dropped capabilities, and NetworkPolicy

Architecture

The chart deploys separate web and worker Deployments from the same official image. The web process serves the API and UI and performs database migrations during startup. The worker sets WORKER=true and executes queued workflows. Both processes share PostgreSQL, Redis, and the same stable application keys. The Service selects only web pods, so it never routes HTTP traffic to workers.

automatisch.containerPorts.http configures both the container port and the upstream PORT environment variable. service.port remains the independent client-facing Kubernetes Service port. The chart also sets HOST=0.0.0.0 so Kubernetes probes and Services can reach the process.

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install automatisch helmforge/automatisch

OCI registry:

helm install automatisch oci://ghcr.io/helmforgedev/helm/automatisch

Deployment Examples

# values.yaml — Automatisch with bundled PostgreSQL and Redis
automatisch:
  webAppUrl: 'https://automate.example.com'

worker:
  enabled: true
  replicaCount: 1

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

redis:
  enabled: true

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: automate.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Production Automatisch with TLS and resource limits
automatisch:
  webAppUrl: 'https://automate.example.com'
  appEnv: production

worker:
  enabled: true
  replicaCount: 2
  resources:
    requests:
      memory: 256Mi
      cpu: 100m
    limits:
      memory: 512Mi

postgresql:
  enabled: true
  auth:
    password: 'postgres-password'

redis:
  enabled: true

resources:
  requests:
    memory: 256Mi
    cpu: 100m
  limits:
    memory: 1Gi
    cpu: 500m

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: automate.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: automatisch-tls
      hosts:
        - automate.example.com

# values.yaml — Automatisch with external PostgreSQL and Redis
automatisch:
  webAppUrl: 'https://automate.example.com'

database:
  external:
    host: postgresql.database.svc.cluster.local
    port: '5432'
    name: automatisch
    username: automatisch
    existingSecret: automatisch-db-credentials
    existingSecretPasswordKey: password

redis_config:
  external:
    host: redis.cache.svc.cluster.local
    port: '6379'
    existingSecret: automatisch-redis-credentials
    existingSecretPasswordKey: password

postgresql:
  enabled: false

redis:
  enabled: false

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: automate.example.com
      paths:
        - path: /
          pathType: Prefix

Configuration Reference

Core

Parameter	Type	Default	Description
`nameOverride`	string	`""`	Override the chart name.
`fullnameOverride`	string	`""`	Override the full release name.
`commonLabels`	object	`{}`	Extra labels added to all resources.

Image

Parameter	Type	Default	Description
`image.repository`	string	`docker.io/automatischio/automatisch`	Automatisch container image.
`image.tag`	string	`"0.15.0"`	Image tag.
`image.pullPolicy`	string	`IfNotPresent`	Image pull policy.
`imagePullSecrets`	array	`[]`	Pull secrets for private registries.

Automatisch Configuration

Parameter	Type	Default	Description
`automatisch.webAppUrl`	string	`http://localhost:3000`	Public URL of the Automatisch instance. Required for OAuth callbacks and webhooks.
`automatisch.host`	string	`0.0.0.0`	HTTP bind address inside the pod.
`automatisch.appEnv`	string	`production`	Application environment. Keep `production` in all non-development deployments.
`automatisch.containerPorts.http`	integer	`3000`	Process listener mapped to the upstream `PORT` variable.
`automatisch.extraEnv`	array	`[]`	Extra environment variables applied to web and worker containers.

Worker

Parameter	Type	Default	Description
`worker.enabled`	boolean	`true`	Run the required background workflow worker.
`worker.replicaCount`	integer	`1`	Number of independently scalable worker replicas.
`worker.resources`	object	`{}`	Worker CPU and memory requests and limits.

Database — External PostgreSQL

Used when postgresql.enabled: false.

Parameter	Type	Default	Description
`database.external.host`	string	`""`	External PostgreSQL hostname.
`database.external.port`	string	`"5432"`	External PostgreSQL port.
`database.external.name`	string	`automatisch`	Database name on the external server.
`database.external.username`	string	`automatisch`	Username for the external database.
`database.external.password`	string	`""`	Password for the external database (prefer `existingSecret`).
`database.external.existingSecret`	string	`""`	Existing secret containing the database password.
`database.external.existingSecretPasswordKey`	string	`password`	Key inside the existing secret for the password.

Redis — External

Used when redis.enabled: false. Note the key name is redis_config (with underscore).

Parameter	Type	Default	Description
`redis_config.external.host`	string	`""`	External Redis hostname.
`redis_config.external.port`	string	`"6379"`	External Redis port.
`redis_config.external.password`	string	`""`	Inline password for disposable installs.
`redis_config.external.existingSecret`	string	`""`	Existing secret containing the Redis password.
`redis_config.external.existingSecretPasswordKey`	string	`password`	Key inside the existing Secret.

Both PostgreSQL and Redis are required

Automatisch uses PostgreSQL to store workflow definitions, connections, and execution logs, and Redis as a job queue for asynchronous workflow execution. If either dependency is unavailable, workflows will not run. When using external services, ensure both are reachable from the cluster before deploying.

Subcharts

Parameter	Type	Default	Description
`postgresql.enabled`	boolean	`true`	Deploy the bundled PostgreSQL subchart.
`postgresql.auth.database`	string	`automatisch`	Database name created by the subchart.
`postgresql.auth.username`	string	`automatisch`	Database user created by the subchart.
`postgresql.auth.password`	string	`""`	Database password. Auto-generated if empty.
`redis.enabled`	boolean	`true`	Deploy the bundled Redis subchart.
`redis.architecture`	string	`standalone`	Redis architecture.

Service

Parameter	Type	Default	Description
`service.type`	string	`ClusterIP`	Kubernetes service type.
`service.port`	integer	`80`	Service port exposed to the cluster.
`service.annotations`	object	`{}`	Annotations for the Service.

Ingress

Parameter	Type	Default	Description
`ingress.enabled`	boolean	`false`	Enable an Ingress resource.
`ingress.ingressClassName`	string	`traefik`	Ingress class name.
`ingress.annotations`	object	`{}`	Annotations for the Ingress (e.g. cert-manager).
`ingress.hosts`	array	`[]`	Ingress host and path rules.
`ingress.tls`	array	`[]`	TLS configuration (secret name and hosts).

Probes

Parameter	Type	Default	Description
`probes.startup.enabled`	boolean	`true`	Enable startup probe.
`probes.startup.initialDelaySeconds`	integer	`10`	Startup probe initial delay.
`probes.startup.periodSeconds`	integer	`5`	Startup probe period.
`probes.startup.timeoutSeconds`	integer	`3`	Startup probe timeout.
`probes.startup.failureThreshold`	integer	`30`	Startup probe failure threshold.
`probes.liveness.enabled`	boolean	`true`	Enable liveness probe.
`probes.liveness.initialDelaySeconds`	integer	`0`	Liveness probe initial delay.
`probes.liveness.periodSeconds`	integer	`15`	Liveness probe period.
`probes.liveness.timeoutSeconds`	integer	`5`	Liveness probe timeout.
`probes.liveness.failureThreshold`	integer	`3`	Liveness probe failure threshold.
`probes.readiness.enabled`	boolean	`true`	Enable readiness probe.
`probes.readiness.initialDelaySeconds`	integer	`0`	Readiness probe initial delay.
`probes.readiness.periodSeconds`	integer	`10`	Readiness probe period.
`probes.readiness.timeoutSeconds`	integer	`5`	Readiness probe timeout.
`probes.readiness.failureThreshold`	integer	`3`	Readiness probe failure threshold.

Resources and Security

Parameter	Type	Default	Description
`resources`	object	`{}`	Web CPU and memory requests/limits.
`podSecurityContext`	object	non-root UID/GID 1000 and `RuntimeDefault`	Pod-level security context.
`securityContext`	object	read-only, no escalation, all caps dropped	Security context shared by application and datastore wait containers.

Service Account

Parameter	Type	Default	Description
`serviceAccount.create`	boolean	`false`	Create a dedicated ServiceAccount.
`serviceAccount.name`	string	`""`	Override the ServiceAccount name.
`serviceAccount.annotations`	object	`{}`	Annotations for the ServiceAccount.
`serviceAccount.automountServiceAccountToken`	boolean	`false`	Mount a Kubernetes API token.

Network Policy

Parameter	Type	Default	Description
`networkPolicy.enabled`	boolean	`true`	Restrict inbound traffic to the HTTP listener.
`networkPolicy.ingress`	array	`[]`	Additional ingress rules.
`networkPolicy.egress`	array	`[{}]`	Egress rules; open by default for arbitrary integration APIs.

Scheduling

Parameter	Type	Default	Description
`nodeSelector`	object	`{}`	Node selector for scheduling.
`tolerations`	array	`[]`	Tolerations for scheduling.
`affinity`	object	`{}`	Affinity rules.
`topologySpreadConstraints`	array	`[]`	Topology spread constraints.
`priorityClassName`	string	`""`	PriorityClass for the pod.
`terminationGracePeriodSeconds`	integer	`30`	Termination grace period.
`podLabels`	object	`{}`	Extra labels for the pod.
`podAnnotations`	object	`{}`	Extra annotations for the pod.

Extra

Parameter	Type	Default	Description
`extraVolumes`	array	`[]`	Extra volumes to attach to the pod.
`extraVolumeMounts`	array	`[]`	Extra volume mounts for the container.
`extraManifests`	array	`[]`	Extra Kubernetes manifests deployed alongside the chart.