I stumbled across the following idea: once a server has loaded its
configuration files (lucee-server.xml and each context’s
lucee-web.xml.cfm), these could be removed so that any sensitive
information in the configuration would not be accessible on a file on the
machine and the configuration of the machine could not be changed through
the web administrator.
Once the configuration files are loaded, are there any negative
repercussions to removing these, provided they are replaced before the next
time the service is restarted?
Actually the whole administration is something that is potentially should be overhauled because of things like Software as a Service and running Lucee on a Dokker-like environment. Many Saas approaches require that you have a read-only access to the file system and you only use services to talk to the environment. We have been approached by several companies that want to have their applications running in a SaaS environment. So there is work to be done here J
The current implications of running Lucee without a physical file are actually 0. Since even without such a file, Lucee loads with a default configuration. This mostly happens when Lucee cannot write to the directories where the whole configuration will be stored. So theoretically it is already possible. I just think that this should be something like a LSR (analog to JSR J) which then contains the whole details and as well what happens when you change something in the Lucee Administrators.
I stumbled across the following idea: once a server has loaded its configuration files (lucee-server.xml and each context’s lucee-web.xml.cfm), these could be removed so that any sensitive information in the configuration would not be accessible on a file on the machine and the configuration of the machine could not be changed through the web administrator.
Once the configuration files are loaded, are there any negative repercussions to removing these, provided they are replaced before the next time the service is restarted?
