Hi all,
The Technical Production Setup Guide and the cluster of pages it links to had drifted from reality over time — some of it cosmetic, some of it wrong enough to actively mislead someone following the docs today. I've recently gone through and fixed what I found; summarizing the changes here since this affects both people running OFBiz in production and anyone relying on these pages while contributing. *Pages updated:* - Apache OFBiz Technical Production Setup Guide ( https://cwiki.apache.org/confluence/x/EoBr) - System Requirements (https://cwiki.apache.org/confluence/x/l4HK) - Scaling and Performance Plan ( https://cwiki.apache.org/confluence/x/M4B2) - Entity Engine Configuration Guide ( https://cwiki.apache.org/confluence/x/1IDfAg) - How to migrate OFBiz from Derby/H2 to MySQL database, renamed from Derby-only (https://cwiki.apache.org/confluence/x/x_GoAQ) - Connecting OFBiz to PostGIS spatially-enabled database ( https://cwiki.apache.org/confluence/x/igFk) - Keeping OFBiz secure (https://cwiki.apache.org/confluence/x/OdWnAw) - Demo and Test Setup Guide (https://cwiki.apache.org/confluence/x/MoB2) - How to implement RESTful APIs using the OFBiz rest-api component, renamed from "...plugin" (https://cwiki.apache.org/confluence/x/NI9EF) - How to Secure HTTP Headers ( https://cwiki.apache.org/confluence/x/4tqnAw) *New page:* - Load Balancing and Clustering Multiple OFBiz Instances ( https://cwiki.apache.org/confluence/x/sIKWGg) — replaces relying on the old "Load balance across multiple instances of OFBiz" page, which was still describing 2011-era SVN/pre-ASF-package/Tomcat 6 setups *Highlights of what actually changed* (not an exhaustive list — see page history for full detail): - *Source control*: remaining SVN references across these pages replaced with Git. - *Default embedded database*: now documented as version-dependent — Derby on release24.09 and earlier, H2 on trunk. Several pages previously assumed Derby unconditionally. - *rest-api*: now documented as a core framework component on trunk ( framework/rest-api) vs. still a plugin on release24.09 (ofbiz-plugins). The REST API page also picked up a new base-permission requirement and a new customHeaders attribute, both merged very recently, and fixed an XML example that used a non-existent action attribute (the real attribute is verb). - *Container/Tomcat config*: ofbiz-containers.xml doesn't exist anymore (replaced by framework/catalina/ofbiz-component.xml); trunk is on Tomcat 10.1, not 9.x. Updated everywhere this was referenced. - *startofbiz.sh/stopofbiz.sh*: these no longer exist in the repo. Setup Guide now documents the actual current start/stop mechanism (gradlew ofbiz -PjvmArgs=..., and graceful shutdown via the Admin Port + start.properties key, matching what docker/send_ofbiz_stop_signal.sh already does). - *Entity Engine Configuration Guide*: this one had genuine factual errors, not just staleness — three documented attribute defaults were simply wrong (use-fk-initially-deferred, alias-view-columns, distributed-cache-clear-user-login-id all had backwards defaults vs. the actual schema), and it referenced classes that no longer exist ( JotmFactory, WeblogicFactory — the real default is GeronimoTransactionFactory). Also added ~15 real schema attributes across the datasource/inline-jdbc tables that were undocumented. - *Secrets management*: added a new section on generateSecretKeys/ generateDBPassword/generateEncryptedSecret/reEncryptAllSecrets, none of which were documented anywhere before. - *Docker*: added a cross-link from the Setup Guide to the existing (and good) Docker documentation, which wasn't referenced from there at all. - *Email security*: outgoing mail can now use OAuth2/XOAUTH2 (for providers like Gmail and Office 365 that are dropping basic auth) via the new MailSmtpConfig entity, and can be DKIM-signed via the new DKIM Signing Setup Guide (https://cwiki.apache.org/confluence/x/gIKWGg) — both documented in the Setup Guide's Email Server Settings section. - *HTTP security headers*: added documentation of the actual current shipped defaults, marked X-XSS-Protection as browser-obsolete (still sent for legacy compat, but ignored by modern browsers), and reframed the Content-Security-Policy section — it's shipped as Content-Security-Policy-Report-Only and has been for a while, not "not for today" as the page still said. - Assorted dead/moved links fixed (PostGIS driver package rename, a defunct Heroku-hosted header-checking tool, JDBC driver artifact coordinate changes, etc.) If anyone notices something I got wrong or missed in this pass, please reply here or fix it directly — these are living pages and I'm sure I didn't catch everything. Thanks, Mridul Pathak
