{
 "slug": "nifi",
 "name": "Apache NiFi",
 "tagline": "Dataflow automation and ETL with a visual flow designer",
 "category": "workflow-cicd",
 "use_cases": [
  "dataflow",
  "etl",
  "data-ingestion"
 ],
 "aliases": [
  "apache nifi"
 ],
 "status": "live",
 "upstream": {
  "vendor": "Apache Software Foundation",
  "url": "https://nifi.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/apache/nifi/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "2.12.0",
   "last_build": "2026-09-16",
   "offer_id": "nifi",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:nifi:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.nifi?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/nifi/",
  "json": "https://lynxroute.com/products/nifi/product.json"
 },
 "release_notes": [
  {
   "version": "2.11.0",
   "title": "Apache NiFi 2.11.0 - Initial release (August 2026)",
   "notes": "* Apache NiFi 2.11.0 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Random 24-character administrator password generated at first launch\n* Per-instance encryption key for sensitive flow properties\n* Anonymous access disabled; NiFi bound to 127.0.0.1:8443 behind an nginx TLS perimeter on 443\n* Flow, content and provenance data stored under /var/lib/nifi, separate from the application\n* certbot and the nginx plugin pre-installed for one-command CA-signed TLS\n* UFW firewall pre-configured (ports 22 and 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-10"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.12.0",
   "azure": "2026-09-16"
  },
  {
   "version": "2.11.0",
   "azure": "2026-08-10"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer nifi --plan payg-gen2\naz vm create -g my-rg -n nifi --size Standard_D2s_v3 \\\n  --image lynxroute:nifi:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache NiFi is an open-source dataflow automation and data integration server: it moves, routes, transforms and enriches data between systems, and it does it through a live browser canvas rather than code. It is a Java application running on a single JVM, built on flow-based programming - you drag processors onto a canvas, connect them into a flow, and NiFi handles queuing, back-pressure, retries and prioritisation between each step. This image ships more than 400 processors across 118 extension bundles: local and remote files, SFTP, HTTP and REST, JDBC databases, Kafka, MQTT, syslog, email, object storage, plus record-oriented readers and writers for JSON, Avro, CSV, XML and Parquet. Every change is versioned, and full data provenance records where each piece of data came from, what was done to it and where it went. NiFi persists flows, queued data, content and provenance on local disk; no external database is required. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* No credentials to hunt for - NiFi would generate a random UUID username and password on first start and print them only to an application log; this image instead generates a 24-character password for the \"admin\" account at first launch and writes it to /root/nifi-credentials.txt (mode 600)\n* Per-instance encryption key for sensitive flow properties - the passwords and tokens you enter into processors are encrypted with a key unique to your instance, so no two instances share a secret\n* NiFi bound to 127.0.0.1:8443 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - the application port is never exposed\n* Anonymous access disabled - every request to the canvas and the REST API is authenticated\n* The web address is re-derived on every boot, so the interface keeps working after a stop/start changes the instance's public address\n* certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one\n* JVM heap auto-sized to the instance RAM at first launch\n* Flow definition, queued data, content and provenance stored under /var/lib/nifi, separate from the application directory, so an upgrade does not touch your data\n* Runs as a non-root nifi system user with UMask 0027\n* UFW firewall pre-configured (only ports 22 and 443 open)\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}