Proposal for a production build for Cocoon
''Work-in-progress...Please feel free to edit directly or add comments inline.''
When the rough edges have been sanded off, this hopefully will be included in the distribution.
Cocoon does not currently provide an example production build configuration. This is making the transition from evaluation/development to production more difficult than it needs to be.
- Create a reasonable and relatively secure "production.build.properties" file.
- Add clear directions for using the new example production build.
- Provide a pointer to directions for further customization.
Notes: An example production build does not need to satisfy everyone. It only needs to have reasonable defaults and be relatively secure. Cocoon's customization system is designed to pick up from here to satisfy everyone else. It is rare for server software to be run without at least some configuration/customization.
Insert a new step 2 in "INSTALL.txt" and renumber the following steps:
2) For a full build skip to step 3 To make a production build without the documentation, samples, scratchpad, or deprecated code simply copy the example "production.build.properties" file to "local.build.properties" before going on to step 3. See below if you are rebuilding or wish to further customize the build. 3) Build Cocoon by typing "build" or "./build.sh" 4) Run Cocoon by typing "cocoon servlet" or "./cocoon.sh servlet" 5) Open http://localhost:8888/ with your browser
Create the new file "production.build.properties":
# ---- Webapp Exclusions ---- exclude.webapp.documentation=true exclude.webapp.javadocs=true exclude.webapp.idldocs=true exclude.webapp.scratchpad=true exclude.webapp.samples=true # ---- Build Exclusions ---- exclude.scratchpad=true exclude.deprecated=true exclude.javadocs=true exclude.idldocs=true # ---- Configuration ---- #config.enable-uploads=true # ---- Webapp Build Properties ---- build.webapp.loglevel=WARN
Rational:[[BR]] Documentation and samples would rarely be desired for production. Scratchpad and deprecated code are excluded as they may not be secure. Uploads are left disabled by default to prevent denial-of-service attacks. The settings for uploads and the loglevel are included because they are among the most likely to be customized.
Revisions:[[BR]] Loglevel changed from INFO to WARN, because INFO is too verbose for production. Do you think WARN or ERROR would be most appropriate?