Broadleaf Commerce Discussion Forums

Some production configurations are sensitive and cannot be put under development source control that's built into jar/war. These include payment gateway configuration, server API credential, etc. Our solution is to store such data under the server file system that only operation team has access, for instance, under $CATALINA_HOME/config/ and let web app load it from there. The other non-sensitive configurations can still be under project/resources/runtime-properties.

The problem is how to merge these two sets of configurations. RuntimeEnvironmentPropertiesConfigurer implements a great way to merge properties from various properties. However, it hardcoded the file names to a predefined environments and to common, shared, etc. It ignores other files. I tried following:

<bean id="propertyConfigurer" class="org.broadleafcommerce.common.config.RuntimeEnvironmentPropertiesConfigurer">
<description>Property configurer for notification service properties input.</description>
<property name="locations">
<list>
<value>classpath*:/runtime-properties/*.properties</value>
<value>file:///${CATALINA_HOME}/config/runtime-properties/*.properties</value>
</list>
</property>
</bean>

And found it completely ignore the second file set.

I could put the sensitive data in configuration temporarily and build the war/jar, but if I try to build a formal release through maven, it'll complain that there are unchecked-in changes.

How should I resolve this problem?

Thank you!

you can pass in a 'property-override' -D argument to your CATALINA_OPTS in Tomcat's setenv.sh:

CATALINA_OPTS="-Dproperty-override=/path/to/sensitivevals.properties"

No need to put any of those values in your web application.

Thank you for your response. However this seems not working. The property file path was passed to tomcat, but I guess it's not loaded by BLC. How do you guys handle the production configuration other than building them into jar/war?

Right now, my workaround is after tomcat explores the war file, copy the production config to its CLASSPATH and restart it. Certainly this is plain to need to start tomcat twice.

Appreciate your help.

-Charlie

This method is working for us in multiple environments.

How are you setting the CATALINA_OPTS environment variable? This should be in your setenv.sh file in the same spot that Tomcat's startup.sh is:



In the code I referenced below I did not include the 'export' part. If you place the above snippet in your own setenv.sh file then that should work.

You will also need to replace /full/path/to/override.properties with the full file path starting at / to where your properties file is located.

Actually, what version of Broadleaf are you using? This method was added in Broadleaf 3.0.0-GA and above. See https://github.com/BroadleafCommerce/Br ... 935a01a648.

Never mind. I figured it must be BLC limitation. The tomcat CATALINA_OPTS are set correctly. However I'm still running BLC 2.01. Was trying to upgrade a week back, but quite some classes that we customized were gone. Due to time limitation, we had to move on and plan upgrading later.

Thank you!

-Charlie

Another issue with this single override option using single file. For instance if we run multiple sites with single tomcat instance, each site may have their own override properties file(s). This can be challenge and will require maintaining all the override values in a single file. A couple of options to resolve it:
1) Besides hard coded properties files, it should load files that applicationContext specifies just like spring properties management module, and the override rule will be in the order it's specified in the list.
2) Allow override root folder specified at runtime and it needs to load all files under this root folder and its sub dirs.

I feel option 1) is better. It's standard spring approach without changing tomcat startup command.

Just a thought.

Thank you!

-Charlie