Hi Mridul, That's a lot of good updates. Thanks for taking the time to update all these docs.
One quick thing I noticed in https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/340037428/How+to+implement+RESTful+APIs+using+the+OFBiz+rest-api+component It says that OFBiz services need to have export=true to be exposed as an API. For the latest trunk that is not true. Thanks -- Divesh Dutta www.hotwaxsystems.com On Fri, Aug 14, 2026 at 4:36 PM Mridul Pathak <[email protected]> wrote: > Hi all, > > My earlier email may have landed in spam for many due to the number of > short links, so I'm resending it again. > > The Technical Production Setup Guide and the cluster of pages it links > to had drifted from reality over time — some of it cosmetic, some of > it wrong enough to actively mislead someone following the docs today. > I've recently gone through and fixed what I found; summarizing the > changes here since this affects both people running OFBiz in > production and anyone relying on these pages while contributing. > > Pages updated: > - Apache OFBiz Technical Production Setup Guide > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/7045138/Apache+OFBiz+Technical+Production+Setup+Guide > ) > - System Requirements > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/13271447/System+Requirements > ) > - Scaling and Performance Plan > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/7766067/Scaling+and+Performance+Plan > ) > - Entity Engine Configuration Guide > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/48201940/Entity+Engine+Configuration+Guide > ) > - How to migrate OFBiz from Derby/H2 to MySQL database, renamed from > Derby-only ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/27845063/How+to+migrate+OFBiz+from+Derby+to+MySQL+database > ) > - Connecting OFBiz to PostGIS spatially-enabled database > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/6553994/Connecting+OFBiz+to+PostGIS+spatially-enabled+database > ) > - Keeping OFBiz secure > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/61330745/Keeping+OFBiz+secure > ) > - Demo and Test Setup Guide > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/7766066/Demo+and+Test+Setup+Guide > ) > - How to implement RESTful APIs using the OFBiz rest-api component, > renamed from "...plugin" > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/340037428/How+to+implement+RESTful+APIs+using+the+OFBiz+rest-api+plugin > ) > - How to Secure HTTP Headers > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/61332194/How+to+Secure+HTTP+Headers > ) > > New page: > - Load Balancing and Clustering Multiple OFBiz Instances > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/446071472/Load+Balancing+and+Clustering+Multiple+OFBiz+Instances > ) > — replaces relying on the old "Load balance across multiple instances > of OFBiz" page, which was still describing 2011-era > SVN/pre-ASF-package/Tomcat 6 setups > > Highlights of what actually changed (not an exhaustive list — see page > history for full detail): > - Source control: remaining SVN references across these pages replaced > with Git. > - Default embedded database: now documented as version-dependent — > Derby on release24.09 and earlier, H2 on trunk. Several pages > previously assumed Derby unconditionally. > - rest-api: now documented as a core framework component on trunk > (framework/rest-api) vs. still a plugin on release24.09 > (ofbiz-plugins). The REST API page also picked up a new > base-permission requirement and a new customHeaders attribute, both > merged very recently, and fixed an XML example that used a > non-existent action attribute (the real attribute is verb). > - Container/Tomcat config: ofbiz-containers.xml doesn't exist anymore > (replaced by framework/catalina/ofbiz-component.xml); trunk is on > Tomcat 10.1, not 9.x. Updated everywhere this was referenced. > - startofbiz.sh/stopofbiz.sh: these no longer exist in the repo. Setup > Guide now documents the actual current start/stop mechanism (gradlew > ofbiz -PjvmArgs=..., and graceful shutdown via the Admin Port + > start.properties key, matching what docker/send_ofbiz_stop_signal.sh > already does). > - Entity Engine Configuration Guide: this one had genuine factual > errors, not just staleness — three documented attribute defaults were > simply wrong (use-fk-initially-deferred, alias-view-columns, > distributed-cache-clear-user-login-id all had backwards defaults vs. > the actual schema), and it referenced classes that no longer exist > (JotmFactory, WeblogicFactory — the real default is > GeronimoTransactionFactory). Also added ~15 real schema attributes > across the datasource/inline-jdbc tables that were undocumented. > - Secrets management: added a new section on > > generateSecretKeys/generateDBPassword/generateEncryptedSecret/reEncryptAllSecrets, > none of which were documented anywhere before. > - Docker: added a cross-link from the Setup Guide to the existing (and > good) Docker documentation, which wasn't referenced from there at all. > - Email security: outgoing mail can now use OAuth2/XOAUTH2 (for > providers like Gmail and Office 365 that are dropping basic auth) via > the new MailSmtpConfig entity, and can be DKIM-signed via the new DKIM > Signing Setup Guide > ( > https://cwiki.apache.org/confluence/spaces/OFBIZ/pages/446071424/DKIM+Signing+Setup+Guide > ) > — both documented in the Setup Guide's Email Server Settings section. > - HTTP security headers: added documentation of the actual current > shipped defaults, marked X-XSS-Protection as browser-obsolete (still > sent for legacy compat, but ignored by modern browsers), and reframed > the Content-Security-Policy section — it's shipped as > Content-Security-Policy-Report-Only and has been for a while, not "not > for today" as the page still said. > - Assorted dead/moved links fixed (PostGIS driver package rename, a > defunct Heroku-hosted header-checking tool, JDBC driver artifact > coordinate changes, etc.) > > If anyone notices something I got wrong or missed in this pass, please > reply here or fix it directly — these are living pages and I'm sure I > didn't catch everything. > > Thanks, > Mridul Pathak > > On Thu, Aug 13, 2026 at 12:49 PM Mridul Pathak <[email protected]> > wrote: > > > > Hi all, > > > > > > The Technical Production Setup Guide and the cluster of pages it links > to had drifted from reality over time — some of it cosmetic, some of it > wrong enough to actively mislead someone following the docs today. I've > recently gone through and fixed what I found; summarizing the changes here > since this affects both people running OFBiz in production and anyone > relying on these pages while contributing. > > > > > > Pages updated: > > > > Apache OFBiz Technical Production Setup Guide ( > https://cwiki.apache.org/confluence/x/EoBr) > > System Requirements (https://cwiki.apache.org/confluence/x/l4HK) > > Scaling and Performance Plan (https://cwiki.apache.org/confluence/x/M4B2 > ) > > Entity Engine Configuration Guide ( > https://cwiki.apache.org/confluence/x/1IDfAg) > > How to migrate OFBiz from Derby/H2 to MySQL database, renamed from > Derby-only (https://cwiki.apache.org/confluence/x/x_GoAQ) > > Connecting OFBiz to PostGIS spatially-enabled database ( > https://cwiki.apache.org/confluence/x/igFk) > > Keeping OFBiz secure (https://cwiki.apache.org/confluence/x/OdWnAw) > > Demo and Test Setup Guide (https://cwiki.apache.org/confluence/x/MoB2) > > How to implement RESTful APIs using the OFBiz rest-api component, > renamed from "...plugin" (https://cwiki.apache.org/confluence/x/NI9EF) > > How to Secure HTTP Headers (https://cwiki.apache.org/confluence/x/4tqnAw > ) > > > > > > New page: > > > > Load Balancing and Clustering Multiple OFBiz Instances ( > https://cwiki.apache.org/confluence/x/sIKWGg) — replaces relying on the > old "Load balance across multiple instances of OFBiz" page, which was still > describing 2011-era SVN/pre-ASF-package/Tomcat 6 setups > > > > > > Highlights of what actually changed (not an exhaustive list — see page > history for full detail): > > > > Source control: remaining SVN references across these pages replaced > with Git. > > Default embedded database: now documented as version-dependent — Derby > on release24.09 and earlier, H2 on trunk. Several pages previously assumed > Derby unconditionally. > > rest-api: now documented as a core framework component on trunk > (framework/rest-api) vs. still a plugin on release24.09 (ofbiz-plugins). > The REST API page also picked up a new base-permission requirement and a > new customHeaders attribute, both merged very recently, and fixed an XML > example that used a non-existent action attribute (the real attribute is > verb). > > Container/Tomcat config: ofbiz-containers.xml doesn't exist anymore > (replaced by framework/catalina/ofbiz-component.xml); trunk is on Tomcat > 10.1, not 9.x. Updated everywhere this was referenced. > > startofbiz.sh/stopofbiz.sh: these no longer exist in the repo. Setup > Guide now documents the actual current start/stop mechanism (gradlew ofbiz > -PjvmArgs=..., and graceful shutdown via the Admin Port + start.properties > key, matching what docker/send_ofbiz_stop_signal.sh already does). > > Entity Engine Configuration Guide: this one had genuine factual errors, > not just staleness — three documented attribute defaults were simply wrong > (use-fk-initially-deferred, alias-view-columns, > distributed-cache-clear-user-login-id all had backwards defaults vs. the > actual schema), and it referenced classes that no longer exist > (JotmFactory, WeblogicFactory — the real default is > GeronimoTransactionFactory). Also added ~15 real schema attributes across > the datasource/inline-jdbc tables that were undocumented. > > Secrets management: added a new section on > generateSecretKeys/generateDBPassword/generateEncryptedSecret/reEncryptAllSecrets, > none of which were documented anywhere before. > > Docker: added a cross-link from the Setup Guide to the existing (and > good) Docker documentation, which wasn't referenced from there at all. > > Email security: outgoing mail can now use OAuth2/XOAUTH2 (for providers > like Gmail and Office 365 that are dropping basic auth) via the new > MailSmtpConfig entity, and can be DKIM-signed via the new DKIM Signing > Setup Guide (https://cwiki.apache.org/confluence/x/gIKWGg) — both > documented in the Setup Guide's Email Server Settings section. > > HTTP security headers: added documentation of the actual current shipped > defaults, marked X-XSS-Protection as browser-obsolete (still sent for > legacy compat, but ignored by modern browsers), and reframed the > Content-Security-Policy section — it's shipped as > Content-Security-Policy-Report-Only and has been for a while, not "not for > today" as the page still said. > > Assorted dead/moved links fixed (PostGIS driver package rename, a > defunct Heroku-hosted header-checking tool, JDBC driver artifact coordinate > changes, etc.) > > > > > > If anyone notices something I got wrong or missed in this pass, please > reply here or fix it directly — these are living pages and I'm sure I > didn't catch everything. > > > > > > Thanks, > > Mridul Pathak >
