Home/Field Guide/Security & operations
CONCEPT 25
Deployments, configuration, and operations
Plan hosting boundaries, runtime dependencies, observability, and recovery.
Who owns the runtime?
With self-hosting, your team operates the application, database, search, document store, network, and backups. On Liferay PaaS, use the documented service deployment and extension path and clarify which operations your team owns. In SaaS, use the supported configuration, APIs, and client extension routes. Verify packaging and operational capabilities for the exact hosting arrangement.
Keep configuration at the right scope. System or instance settings, site-level settings, deployment property overrides, and OSGi configuration all solve different problems. Version environment-neutral configuration and inject credentials from environment-specific secret storage. Record the effective configuration for each environment.
Know what to observe
| Layer | Signals to collect |
|---|---|
| Edge and app | Request rate, error rate, latency, correlation IDs, and health checks |
| JVM | Heap, garbage collection, threads, and restarts |
| Persistence | Connection pool, slow queries, replication and backup health |
| Search | Cluster status, indexing lag, failed operations, and query latency |
| Integrations | Retries, latency, authorization failures, and backlog |
Rehearse an operational incident
If requests time out while the database is healthy, compare app-node thread and connection saturation, search latency, and dependency timeouts. Use correlation IDs and consistent timestamps. Protect administrative endpoints, preserve sensitive data boundaries in logs, and exercise backup restore across the database, document store, and required configuration. Search data is derived, but the rebuild time still matters to recovery.