@thisOldDave Sounds like you could use some CFConfig too 🙂

@Evil Ware FWIW, I'm pretty sure the pass reset script in ACF just puts the plaintext password in the

cfusion/lib/password.properties

file and sets the

encrypted=false

flag which means it doesn't get encrypted until ACF starts the first time. So it's really not much different than Lucee's

password.txt

approach outside of Lucee involving two different files.

As far as Adam's original question-- if he wants to do this outside of CommandBox/CFConfig, he has two options really. • create password.txt file • warmup server by starting/stopping it • The warmup will hash the password and place it in the lucee-server.xml file and delete the password.txt • Do this as part of his image build Or the other option would basically be for him to re-create what CFConfig does from scratch • Grab my lucee-password-util library from ForgeBox which contains the logic to hash a password to Lucee's format • Create a manual step to hash a plain text password and place the password and the salt used in the hash into the Lucee-server.xml file directly. • This basically requires the ability to run CFML in the container, so it's not very easy outside of CommandBox unless you can somehow create a bash equivalent of the hashing algorithm and XML parsing (yuck) Or honestly, I guess there's a third option • create the hash/salt somewhere outside of the container in a manner that is convenient for him • Replace the salt and hash values directly in the XML file as part of the docker build, which could be done wish

sed

pretty easily.

Here's that password util which powers CFConfig to save someone the forgebox search https://www.forgebox.io/view/lucee-password-util

When you edit an existing datasource and scroll to the bottom they have the application.cfc format for the datasource with the pass in the

encrypted:xxxx

format

I have a client who really wanted to re-use the same docker images across dev/stage/prod and wanted to be able to control anything at start with env vars, so they just decided to not finalize their images and lived with larger images that booted slower in favor of having full flexibility every start.

It was a useful exercise in cruft removal if nothing else

My goal was to write some modules to integrate with common vaults or AWS secrets to allow people stuck with fancy enterprise secret vaults to easily use them in their config, I just haven't had the chance.

And while we're on this whole matter Adam raised, it may be of interest to some (tracking dfferences) that the json created by the cfsetup tool (new to cf2021) DOES store cf pwds as encrypted in the json file, where cfconfig leaves them plain text. I know Brad has his reasons why that's optimal and acceptable, and it relates to points made earlier in this thread. Again, just observing the difference in approaches, which each have pros and cons (that we need not debate here).