Nectere Andante

01The app

Each sidebar entry opens one panel. The mock is clickable, Engine Log in the footer included, and the switch changes who is signed in.

All entries are visible to every role. A user can view everything, run workflows, test steps and use the Sandbox; any save or delete returns Admin access required. Array sign-on hides Users and Sign Out.

02How the pieces fit

A workflow is a list of steps. Most steps point at something set up on another panel (a script, webhook, file check or credential), so building one is mostly picking those in order and filling in parameters.

The usual order

1. Configuration: connect storage and press Prepare Containers. Required before anything else.
2. Scripts, Webhooks, File Checks, Credentials: add what the workflow calls.
3. Workflows: + New Workflow, add steps, set parameters, save.
4. Run / Schedule: test steps with Run Step, run the whole thing with Run Now, then schedule it.
5. Logs and Dashboard: review runs.

03Getting Andante

Andante is deployed from Nectere Array (Menu › Deploy › Nectere Andante). The sign-in mode is picked there. Restart, update and logs are on the back of the tile.

An admin has to connect an Azure storage account on Configuration before workflows can be built. Workflows, scripts, credentials, schedules and run logs all live in it.

Tile settings

Set from the tile's .env button in Array. Saving restarts Andante briefly.

04Sign-in and setup

With Application sign-in, the first visit to a new tile shows Initial Setup. The account created there (password 8 characters or more) is an admin. After that everyone uses Sign In, and sessions last 8 hours.

There is no lockout after failed attempts. An expired session drops you back to Sign In on the next click.

Two roles

An admin can do everything. A user can read every panel, press Run Now and Run Step, and use the Sandbox. Saving, editing, copying, uploading, installing and deleting need an admin.

Array sign-on

No setup screen and no Andante password. Opening the tile from Array signs you in with the matching role, and accounts are managed in Array. If the Array session expires, Andante shows its plain Sign In card. Don't sign in there; reopen the tile from Array.

05Configuration

Sets the Azure storage account that holds everything. Visit it first on a new tile.

Connecting storage

1. Enter Storage Account Name, an Access Key and the Resource Group, then press Save Configuration.
2. Press Prepare Containers. The first time it lists what it created (Created containers: nexus-config, nexus-powershell, …). Later presses report All containers already exist.

The saved key shows as dots and is kept if left alone. Use a dedicated storage account: anyone with its keys can read your workflows and logs.

Log retention

Tick Age out logs after and set 1 to 365 days (default 30). Old run logs are deleted once a day across all workflows. Manual cleanup, one workflow at a time, is on Logs.

TLS Certificate

Shows Andante's own certificate and whether it is self-signed. Through Array the browser sees Array's certificate instead, so this rarely needs touching. Generate CSR builds a signing request for your CA, and Upload Signed Certificate installs the returned PEM and reloads the page. Admin only.

06Sidebar and Engine Log

Notifications from every panel stack in the sidebar footer: green for success, blue for info, rose for errors. Successes clear after 5 seconds, errors after 8. The server clock under the buttons is the one schedules use.

Engine Log

One file per day of engine events: startup, workflow and step start and finish, schedules fired or skipped, log cleanup. Today loads automatically. Pick another day and press Load, or Refresh for new lines. Check here first when a schedule seems not to have run.

Engine Log history starts over when Andante is updated or recreated from Array. Run logs are unaffected.

07Dashboard

The landing panel. Refreshes every 30 seconds while open.

1. 1Running Jobs. The blue count blinks while anything runs. Click a name to go to Run / Schedule. Idle shows No jobs running.
2. 2Last 24 Hours. Total, Succeeded, Failed and Success rate for runs started in the past day, step tests included.
3. 3Count tiles. Click to open the panel. Scripts counts only PowerShell, Python and shell files. Webhooks always reads 0 (see Things to know).
4. 4Recent Runs. The five latest failed runs from the last 30 days. VIEW ALL → and the names open Logs. Empty shows No recent failed runs.
5. 5Upcoming. Next three enabled schedules with a countdown like in 11h 28m. Empty shows No upcoming runs.

08Workflows

Saved workflows with their step counts. Edit opens the editor; the icon buttons export, copy and delete.

Copy suggests <name>-copy. Delete removes only the workflow: its run logs stay in storage but drop out of the Logs dropdown, and a schedule pointing at it keeps firing and failing until it's deleted too.

The editor

Name the workflow, press + Add Step once per step, and fill each one in. The switch compares a three-step workflow with a new one. Only ×, Cancel or Save Workflow close the window.

1. 1Step header. Number, type badge, and the script or resource. ↑ and ↓ reorder, Preview shows what will run, Remove drops the step.
2. 2Input Mapping. Pulls values from earlier steps (below). Not shown on step 1.
3. 3Parameters. Key/value pairs passed to the script. Auto fills them from the script; a red ⚠ marks required ones.
4. 4Halt on any error. Fails the step on any error output, even after a clean exit.
5. 5Breakpoint Checks. Values the step must produce for the run to continue.

Renaming saves a new workflow and leaves the old one in place.

Adding a step

Pick a Step Type, then the item from the second dropdown, and press Add. New steps go to the bottom.

Step types and parameters

File Check, CloudFormation and ARM Template steps start with some keys filled in.

With awsAccountId set, CloudFormation verifies the credential's account and fails with Account mismatch: … if it differs. A blank region uses the credential's default. Deployment outputs become step output. Only one CloudFormation or ARM deployment runs at a time across all workflows, and the rest queue.

Parameters and Auto

Auto reads the script and adds a row per parameter. Typed values are kept, script defaults fill the rest, and required ones get a red ⚠. It reads PowerShell param() blocks ([switch], arrays, ValidateSet as a dropdown), Python argparse, and template parameter sections. Nothing found gives No parameters detected in this script.

+ Add Key/Value adds rows by hand. Blank keys are dropped on save.

Passing values between steps

Each value a finished step reports becomes step<N>.<key>, e.g. step1.region (reporting is covered in Step output). Later steps use them two ways.

• Input Mapping: parameter on the left, variable on the right, e.g. VmName ← step1.nextVmName. Overrides a parameter with the same key.
• Inline: $step1.region as a whole value, or inside a string like $($step1.prefix)-web or Built $step2.vmName. Substituted just before the step runs.

A mapping to an unreported value is skipped and the script runs without it. Put a breakpoint check on the earlier step if that should stop the run.

Breakpoint checks and Halt on any error

A Breakpoint Check names a value the step must report, with an optional expected value. Missing or mismatched, the step fails. Halt on any error also fails it on any error output, whatever the exit code.

Preview

Read-only view of what the step uses: script or template source, or the saved webhook or file check settings.

param(
    [Parameter(Mandatory)] [string]$ResourceGroup,
    [switch]$IncludeStopped
)

Import-Module NLS
$sp = Get-NLSCredential -Name 'azure-sp-lab'
# sign in, then list the lab vms
$vms = Get-AzVM -ResourceGroupName $ResourceGroup -Status
Write-Host "Found $($vms.Count) VMs in $ResourceGroup"

Write-NLSOutput @{ region = 'eastus'; vmCount = $vms.Count; nextVmName = "labvm$($vms.Count + 1)"; status = 'ok' }

Export and Import

Export downloads <name>.json, optionally with the webhooks and file checks its steps use. Scripts and credentials are never included. Upload the scripts to the target before importing and recreate credentials under the same names; import refuses and lists any missing scripts.

Import replaces a same-named workflow, webhook or file check without asking.

09Step output and failure

For script authors. A script passes values on by registering output, which is read when the step finishes. Ordinary printing is just logging. The in-app copy is under Scripts › Help.

Registering output

NLS is preinstalled for PowerShell and Python. Values accumulate across calls and a repeated key keeps the last value.

# PowerShell
Import-Module NLS
Write-Host "Working..."   # log whatever you want
Write-NLSOutput -Key 'region' -Value 'us-east-2'
Write-NLSOutput @{ vmName = 'web01'; status = 'ready' }

# Python
import nls
nls.write_output("region", "us-east-2")
nls.write_output({"vmName": "web01", "status": "ready"})

# Shell: append key=value lines
echo "region=us-east-2" >> "$NEXUS_OUTPUT"
echo "status=ready"     >> "$NEXUS_OUTPUT"

The older method still works. If a script's last output is a JSON object, its top-level properties are registered, and NLS values win on shared keys. Webhook steps register the response fields; CloudFormation and ARM steps register their outputs. The console prints Registered step output from NEXUS_OUTPUT file when NLS values were picked up.

How a step fails

10Scripts

Five tabs: PowerShell, Python, Shell, CloudFormation and ARM Template. Uploads go to the selected tab.

Upload, copy and delete

Click the dashed box or drop a file on it. Files keep their names, and a same-named upload replaces the old file. Row buttons are Edit, Preview (eye), Copy and Delete.

Delete doesn't check whether a workflow uses the script. One that does fails at that step with Script 'New-LabVm.ps1' not found ….

Editing in the browser

Full-width editor with syntax highlighting. Save shows Saved., closes the window and posts Script "New-LabVm.ps1" saved. The next run picks up the change.

Help

Opens the Script Output & Workflow Chaining Guide, the in-app version of Step output.

11Webhooks

A saved URL a step POSTs to, like a chat hook or pipeline trigger. Each row shows the name and Direct or OAuth auth.

None (Direct POST) sends the step parameters as a JSON body. OAuth Client Credentials (e.g. Data Factory) first gets an Azure management token from Microsoft Entra ID with the given Tenant ID, Client ID and Client Secret, then sends it with the request. Use it for Azure management endpoints, for example starting a Data Factory pipeline run.

No Edit button. To change a webhook, add it again under the same name.

12File Checks

A saved Azure storage connection. File Check steps use it to wait for files to land or confirm fresh ones exist, e.g. holding a nightly report until the day's export arrives.

No Edit button; save again under the same name. Form errors are Name and Storage Account are required and SAS token is required for SAS auth type.

The File Check step

container and folderPath set where to look, each with a Browse button. What minutes means depends on mode.

Browse Storage

On container, Browse lists containers. On folderPath it walks folders in the chosen container, so set the container first (otherwise Please set the container first before browsing folders.). .. goes up and (select this folder) picks the current one. Files are shown but can't be selected. Select fills the step.

13Credentials

Secrets are saved here under a name and scripts ask for them by that name at run time. Secret fields are encrypted on save and show as ******** when editing; leave them as is to keep the stored value.

Row buttons are Edit, ? (ready-to-paste code), Copy and Delete. Names take letters, numbers, hyphens and underscores only. Name and type lock after saving, so renaming means copy, then delete the original.

Adding a credential

Type sets the fields. AWS, Azure and GCP types add a How to generate button with steps for creating that identity.

Using a credential in a script

The NLS module returns every field, secrets decrypted. A row's ? generates the code for that credential; below is the Azure service principal version.

Import-Module NLS
Import-Module Az.Accounts
$azure_sp_lab = Get-NLSCredential -Name 'azure-sp-lab'
$secPwd = ConvertTo-SecureString $azure_sp_lab.clientSecret -AsPlainText -Force
$psCred = [PSCredential]::new($azure_sp_lab.clientId, $secPwd)
Connect-AzAccount -ServicePrincipal -Tenant $azure_sp_lab.tenantId -Credential $psCred

import nls
from azure.identity import ClientSecretCredential

azure_sp_lab = nls.get_credential("azure-sp-lab")
credential = ClientSecretCredential(
    tenant_id=azure_sp_lab["tenantId"],
    client_id=azure_sp_lab["clientId"],
    client_secret=azure_sp_lab["clientSecret"],
)

Import-Module NLS
$azure_sp_lab = Get-NLSCredential -Name 'azure-sp-lab'
az login --service-principal -u $azure_sp_lab.clientId -p $azure_sp_lab.clientSecret --tenant $azure_sp_lab.tenantId

Help at the top of the panel opens the NLS Credential Store — Usage Guide with AWS, GCP and username/password examples.

Any script can read any credential. Admin access to Andante is access to every secret in it.

14Run / Schedule

Manual Run and Test Step are open to regular users. Changing Schedules needs an admin.

Manual Run and Test Step

Run Now starts the selected workflow and opens the live console. Run Step runs a single step (picked as Step 2: [python] build_vm_plan.py) in isolation, so values from earlier steps aren't available.

A workflow runs once at a time. A second start from either button or a schedule gets Workflow 'lab-vm-rebuild' is already running.

The live console

Step banners are orange, commands cyan, output white, information and Andante notes green, errors red. The result posts to the sidebar when the run ends. Closing the console doesn't stop the run; the full output is kept on Logs.

Schedules

+ Add Schedule opens a form under the list: workflow, Interval and First Run. Each run moves the next one forward one interval. Next Run is in browser local time. Enabled pauses a schedule and the bin deletes it.

• Schedules are named <workflow>-<interval>, so a workflow gets one per interval. A second daily schedule replaces the first.
• Checked once a minute. If the workflow is still running when due, it fires on the first check after the run ends.
• Scheduled runs go one at a time, so a long one delays others that come due.
• After downtime, missed runs catch up at one per minute until Next Run is in the future. Pause the schedule beforehand to avoid it.
• The suggested First Run should be tomorrow 02:00 but can be off by a few hours depending on time zone. Check it.

15Logs

Every run, tests included, writes up to four files. Load Logs lists them for the selected workflow, newest first.

Test runs carry the step in the name: lab-vm-rebuild-step2-20261026-104410.json.

Reading a run

A .json summary shows a card per step: number, type, script and a success or failed badge, then command, output, error and duration. Steps after a failure never ran and don't appear. .log files open as plain text.

Clearing old logs

With logs loaded, Clear logs older than N days prunes the selected workflow after a confirm and reports Removed 12 log(s) older than 30 days for 'lab-vm-rebuild'. Automatic cleanup is log retention.

16Packages / Modules

Scripts can only use what's installed here. Show lists a tab's installed items; Add installs more (admin).

17Sandbox

A terminal for trying things before they go in a workflow. It has pwsh, python3, bash, the az, aws and gcloud CLIs, and NLS for pulling credentials and scripts. It runs as a restricted account and can't change Andante.

• Launch Terminal opens a pop-out, or reattaches to the running terminal (Reconnected to existing terminal). Nothing appearing means pop-ups are blocked for the Array address.
• One terminal per tile, shared by everyone.
• Kill & Reset closes it and empties the working folder after a confirm.
• Write-NLSOutput only prints a warning here, since there's no run to report to.

NLS Help

Opens the NLS Module Reference, with PowerShell and Python tabs per command.

18Users and API tokens

Accounts for Application sign-in. + New User and Edit open a form above the list. On edit the username is locked and a blank password keeps the current one. Deleting a user also revokes their sessions and tokens.

API tokens

For tools like CI pipelines. Name it and press Generate Token. The full token is shown once; afterwards only its prefix is listed. Tokens carry the creating admin's role and never expire, so Revoke unused ones.

Regular users see No users found. and No API tokens yet. Under Array sign-on the panel is hidden.

19Backup and restore

Covers local settings only: users and API tokens, the storage connection, the certificate. Everything else lives in the storage account.

• Export configuration downloads a zip.
• Import configuration overwrites current settings after a confirm. Restart afterwards from the tile in Array (State › Restart).
• Admin only. Credentials in the backup are encrypted with NEXUS_CREDENTIAL_KEY, so the zip holds no readable secrets. A tile with a different key restores the settings, but the credentials won't open.

20Things to know

• Configure storage first. Other panels are empty or error until it's saved and containers are prepared.
• One failure stops the ladder. Later steps don't run.
• One run per workflow at a time. Copy it to run two at once.
• Saving over is silent. Same-named scripts, webhooks, file checks and imports replace without asking.
• Deletes don't check what uses them. The breakage shows on the next run.
• The Dashboard's Webhooks tile reads 0. Display bug; the Webhooks panel is right. The Scripts tile skips templates.
• Recent Runs means recent failures. Successful runs are on Logs.
• Schedules use the server clock in the sidebar footer. Next Run shows local time.
• Updates reset installed modules and the Sandbox. Reinstall PowerShell and Python modules afterwards. Keep nothing important in the sandbox folder.
• Regular users can still run things. Run Now, Run Step and the Sandbox are open to user.

21Troubleshooting