Hi all, My earlier email may have landed in spam for many due to the number of short links, so I'm resending it again.
The Technical Production Setup Guide and the cluster of pages it links to had drifted from reality over time — some of it cosmetic, some of it wrong enough to actively mislead someone following the docs today. I've recently gone through and fixed what I found; summarizing the changes here since this affects both people running OFBiz in production and anyone relying on these pages while contributing. Pages updated: - Apache OFBiz Technical Production Setup Guide (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/7045138/Apache+OFBiz+Technical+Production+Setup+Guide) - System Requirements (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/13271447/System+Requirements) - Scaling and Performance Plan (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/7766067/Scaling+and+Performance+Plan) - Entity Engine Configuration Guide (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/48201940/Entity+Engine+Configuration+Guide) - How to migrate OFBiz from Derby/H2 to MySQL database, renamed from Derby-only (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/27845063/How+to+migrate+OFBiz+from+Derby+to+MySQL+database) - Connecting OFBiz to PostGIS spatially-enabled database (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/6553994/Connecting+OFBiz+to+PostGIS+spatially-enabled+database) - Keeping OFBiz secure (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/61330745/Keeping+OFBiz+secure) - Demo and Test Setup Guide (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/7766066/Demo+and+Test+Setup+Guide) - How to implement RESTful APIs using the OFBiz rest-api component, renamed from "...plugin" (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/340037428/How+to+implement+RESTful+APIs+using+the+OFBiz+rest-api+plugin) - How to Secure HTTP Headers (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/61332194/How+to+Secure+HTTP+Headers) New page: - Load Balancing and Clustering Multiple OFBiz Instances (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/446071472/Load+Balancing+and+Clustering+Multiple+OFBiz+Instances) — replaces relying on the old "Load balance across multiple instances of OFBiz" page, which was still describing 2011-era SVN/pre-ASF-package/Tomcat 6 setups Highlights of what actually changed (not an exhaustive list — see page history for full detail): - Source control: remaining SVN references across these pages replaced with Git. - Default embedded database: now documented as version-dependent — Derby on release24.09 and earlier, H2 on trunk. Several pages previously assumed Derby unconditionally. - rest-api: now documented as a core framework component on trunk (framework/rest-api) vs. still a plugin on release24.09 (ofbiz-plugins). The REST API page also picked up a new base-permission requirement and a new customHeaders attribute, both merged very recently, and fixed an XML example that used a non-existent action attribute (the real attribute is verb). - Container/Tomcat config: ofbiz-containers.xml doesn't exist anymore (replaced by framework/catalina/ofbiz-component.xml); trunk is on Tomcat 10.1, not 9.x. Updated everywhere this was referenced. - startofbiz.sh/stopofbiz.sh: these no longer exist in the repo. Setup Guide now documents the actual current start/stop mechanism (gradlew ofbiz -PjvmArgs=..., and graceful shutdown via the Admin Port + start.properties key, matching what docker/send_ofbiz_stop_signal.sh already does). - Entity Engine Configuration Guide: this one had genuine factual errors, not just staleness — three documented attribute defaults were simply wrong (use-fk-initially-deferred, alias-view-columns, distributed-cache-clear-user-login-id all had backwards defaults vs. the actual schema), and it referenced classes that no longer exist (JotmFactory, WeblogicFactory — the real default is GeronimoTransactionFactory). Also added ~15 real schema attributes across the datasource/inline-jdbc tables that were undocumented. - Secrets management: added a new section on generateSecretKeys/generateDBPassword/generateEncryptedSecret/reEncryptAllSecrets, none of which were documented anywhere before. - Docker: added a cross-link from the Setup Guide to the existing (and good) Docker documentation, which wasn't referenced from there at all. - Email security: outgoing mail can now use OAuth2/XOAUTH2 (for providers like Gmail and Office 365 that are dropping basic auth) via the new MailSmtpConfig entity, and can be DKIM-signed via the new DKIM Signing Setup Guide (https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/446071424/DKIM+Signing+Setup+Guide) — both documented in the Setup Guide's Email Server Settings section. - HTTP security headers: added documentation of the actual current shipped defaults, marked X-XSS-Protection as browser-obsolete (still sent for legacy compat, but ignored by modern browsers), and reframed the Content-Security-Policy section — it's shipped as Content-Security-Policy-Report-Only and has been for a while, not "not for today" as the page still said. - Assorted dead/moved links fixed (PostGIS driver package rename, a defunct Heroku-hosted header-checking tool, JDBC driver artifact coordinate changes, etc.) If anyone notices something I got wrong or missed in this pass, please reply here or fix it directly — these are living pages and I'm sure I didn't catch everything. Thanks, Mridul Pathak On Thu, Aug 13, 2026 at 12:49 PM Mridul Pathak <[email protected]> wrote: > > Hi all, > > > The Technical Production Setup Guide and the cluster of pages it links to had > drifted from reality over time — some of it cosmetic, some of it wrong enough > to actively mislead someone following the docs today. I've recently gone > through and fixed what I found; summarizing the changes here since this > affects both people running OFBiz in production and anyone relying on these > pages while contributing. > > > Pages updated: > > Apache OFBiz Technical Production Setup Guide > (https://cwiki.apache.org/confluence/x/EoBr) > System Requirements (https://cwiki.apache.org/confluence/x/l4HK) > Scaling and Performance Plan (https://cwiki.apache.org/confluence/x/M4B2) > Entity Engine Configuration Guide > (https://cwiki.apache.org/confluence/x/1IDfAg) > How to migrate OFBiz from Derby/H2 to MySQL database, renamed from Derby-only > (https://cwiki.apache.org/confluence/x/x_GoAQ) > Connecting OFBiz to PostGIS spatially-enabled database > (https://cwiki.apache.org/confluence/x/igFk) > Keeping OFBiz secure (https://cwiki.apache.org/confluence/x/OdWnAw) > Demo and Test Setup Guide (https://cwiki.apache.org/confluence/x/MoB2) > How to implement RESTful APIs using the OFBiz rest-api component, renamed > from "...plugin" (https://cwiki.apache.org/confluence/x/NI9EF) > How to Secure HTTP Headers (https://cwiki.apache.org/confluence/x/4tqnAw) > > > New page: > > Load Balancing and Clustering Multiple OFBiz Instances > (https://cwiki.apache.org/confluence/x/sIKWGg) — replaces relying on the old > "Load balance across multiple instances of OFBiz" page, which was still > describing 2011-era SVN/pre-ASF-package/Tomcat 6 setups > > > Highlights of what actually changed (not an exhaustive list — see page > history for full detail): > > Source control: remaining SVN references across these pages replaced with Git. > Default embedded database: now documented as version-dependent — Derby on > release24.09 and earlier, H2 on trunk. Several pages previously assumed Derby > unconditionally. > rest-api: now documented as a core framework component on trunk > (framework/rest-api) vs. still a plugin on release24.09 (ofbiz-plugins). The > REST API page also picked up a new base-permission requirement and a new > customHeaders attribute, both merged very recently, and fixed an XML example > that used a non-existent action attribute (the real attribute is verb). > Container/Tomcat config: ofbiz-containers.xml doesn't exist anymore (replaced > by framework/catalina/ofbiz-component.xml); trunk is on Tomcat 10.1, not 9.x. > Updated everywhere this was referenced. > startofbiz.sh/stopofbiz.sh: these no longer exist in the repo. Setup Guide > now documents the actual current start/stop mechanism (gradlew ofbiz > -PjvmArgs=..., and graceful shutdown via the Admin Port + start.properties > key, matching what docker/send_ofbiz_stop_signal.sh already does). > Entity Engine Configuration Guide: this one had genuine factual errors, not > just staleness — three documented attribute defaults were simply wrong > (use-fk-initially-deferred, alias-view-columns, > distributed-cache-clear-user-login-id all had backwards defaults vs. the > actual schema), and it referenced classes that no longer exist (JotmFactory, > WeblogicFactory — the real default is GeronimoTransactionFactory). Also added > ~15 real schema attributes across the datasource/inline-jdbc tables that were > undocumented. > Secrets management: added a new section on > generateSecretKeys/generateDBPassword/generateEncryptedSecret/reEncryptAllSecrets, > none of which were documented anywhere before. > Docker: added a cross-link from the Setup Guide to the existing (and good) > Docker documentation, which wasn't referenced from there at all. > Email security: outgoing mail can now use OAuth2/XOAUTH2 (for providers like > Gmail and Office 365 that are dropping basic auth) via the new MailSmtpConfig > entity, and can be DKIM-signed via the new DKIM Signing Setup Guide > (https://cwiki.apache.org/confluence/x/gIKWGg) — both documented in the Setup > Guide's Email Server Settings section. > HTTP security headers: added documentation of the actual current shipped > defaults, marked X-XSS-Protection as browser-obsolete (still sent for legacy > compat, but ignored by modern browsers), and reframed the > Content-Security-Policy section — it's shipped as > Content-Security-Policy-Report-Only and has been for a while, not "not for > today" as the page still said. > Assorted dead/moved links fixed (PostGIS driver package rename, a defunct > Heroku-hosted header-checking tool, JDBC driver artifact coordinate changes, > etc.) > > > If anyone notices something I got wrong or missed in this pass, please reply > here or fix it directly — these are living pages and I'm sure I didn't catch > everything. > > > Thanks, > Mridul Pathak
