Issue
- For security reasons, we would like to store passwords using environment variables within OSGi .config files. For example, to store the Elasticsearch server's password.
Environment
- 7.3+
Resolution
- In Liferay versions containing LPS-123057, it is possible to use environment variables in OSGi configuration files. To do so, use the syntax
${env:VARIABLE_NAME}. This is the recommended approach for handling sensitive information like passwords. - For example, to configure your Elasticsearch connection password using an environment variable:
- Create or edit the OSGi configuration file for the Elasticsearch connector. For Liferay versions using Elasticsearch 8, this would be named
com.liferay.portal.search.elasticsearch8.configuration.ElasticsearchConfiguration.config. - In this file, set the password property as follows:
authenticationEnabled=B"true" username="elastic" password="${env:ELASTIC_PASSWORD}" - Then, ensure the ELASTIC_PASSWORD environment variable is set in the environment where your Liferay DXP instance is running. For example:
export ELASTIC_PASSWORD=your_secret_password
- Create or edit the OSGi configuration file for the Elasticsearch connector. For Liferay versions using Elasticsearch 8, this would be named
The Liferay OSGi runtime will automatically substitute the placeholder with the value of the environment variable upon startup.
You can also provide a default value in case the environment variable is not set:
authenticationEnabled=B"true"
username="elastic"
password="${env:ELASTIC_PASSWORD}"
password="${env:ELASTIC_PASSWORD:defaultPassword123}"
Additional Information
- For more information, see Configuration Files: Interpolating Environment Variables.