Setting Admin Password via CFConfig seems to not be working

Correct.

Correct.

Yes, if you want that setting to always be present. Nothing requires you to use CFConfig with CommandBox servers, it’s just very very useful.

Well, when you save a datasource in the actual Lucee web admin UI, it’s saved to the XML files in the Lucee server home, but those go away if you forget the server or change server versions. That’s why we recommend using a tool like CFConfig to manage all of those outside the Lucee server admin so you don’t have to worry about what happens when a server disappears because you have all the building blocks in your config files to create the same server from scratch with a single start command. This is the same reason CommandBox is so useful for a team of developers running code locally, because every dev on the team gets the exact same server instantly by just cloning the Git repo and running “server start” and letting the config JSON files do their thing.

Then forget about env for now. It’s useful but another thing for you to learn. Just get familiar with how the servers work and then come back and start a new thread to ask about env.

We’ve given you about 5 different ways to do it in this thread? Are you asking for more ways to do it, or do you have a specific question about one of the several ways we’ve shown you?

CFConfig finds and uses environment variables whose names follow a special convention automatically. So any env var named cfconfig_something will automatically get picked up by CFConfdig when the server starts and will set the “something” setting into the server. So using .env isn’t an alternative to using CFConfig. It’s just one of the may ways you can get CFConfig to load settings for you. All the .env file does is load up ad-hoc environment variables into the server process for you which is commonplace in Docker and other cloud hosting setups.

Nothing, really. Once a password is written to Lucee’s XML files, it’s there forever. Now, if you change what version of Lucee you want CommandBox to start, it will download and extract it to a new server home with different XML files. This is where having it in the JSON or an env var will ensure it gets set every time.

I assume you’re asking about the ${blah} placeholders. Honestly, would have waited to drop that wrinkle on you since you’re having so much trouble with the basics, but those place holders are simply swapped out when CFConfig reads the JSON file with any env var of the same name. So, if you declare

myEnvVar=brad

in your .env file and you have a ${myEnvVar} placeholder in a JSON file, those get merged when the file is read.

You’re not wrong. CommandBox allows you to configure any or all of these files to be outside the web root. But again, I haven’t mentioned that because you’re already complaining about all the basic information not making sense I’m trying to not overload you. It’s worth noting the CommandBox web server will BLOCK all access to files starting with a dot as well as all the known JSON config files. However, if you put another proxy in front of CommandBox, all bets are off as Nginx may happily serve up your .cfconfig.json file to a user if they look for it, so that’s something you have to take into account. here’s docs on the lockdown rules:

I’m not sure why you’re still balking about this. You were able to set the admin password like 6 messages ago and log in. Why are you still saying it’s an issue? You can find answers for this

here CommandBox Password - dev - Lucee Dev
here Use CFConfig to set default password · Issue #22 · foundeo/ubuntu-nginx-lucee · GitHub
here Resetting Admin Password · Lucee
here Where should I put the /lucee-server/context/password.txt file?
and here Setting Lucee Admin Password with CommandBox

And that’s just the first page of Google results.