git - How to prevent storing postgres password in tomcat's context.xml -

in application have context.xml file in src/main/tomcat/conf contains following information:

<?xml version='1.0' encoding='utf-8'?> <context>     <watchedresource>web-inf/web.xml</watchedresource>      <resource             factory="org.apache.tomcat.jdbc.pool.datasourcefactory"             name="jdbc/tomcatdatasource"             auth="container"             type="javax.sql.datasource"             initialsize="1"             maxactive="20"             maxidle="3"             minidle="1"             maxwait="5000"             username="postgres"             password="postgres"             driverclassname="org.postgresql.driver"             validationquery="select 'ok'"             testwhileidle="true"             testonborrow="true"             numtestsperevictionrun="5"             timebetweenevictionrunsmillis="30000"             minevictableidletimemillis="60000"             url="jdbc:postgresql://localhost:5432/tradebook_db" />  </context> 

every developer has own postgres server on computer, guess information username , password should not placed in git repository. should put context.xml file in .gitignore after adding repo, every developer has specific user , password? or there other ways prevent putting password postgres server in repository?

you should put application passwords in o/s environment variables (envvars).

• can read assigned o/s user (or root)
• you won't accidentally screw file permissions (if putting passwords in files)
• you won't accidentally check passwords in source control (this particularly important in open source)
• survives reboots
• envvars easy read languages
• make sure don't send envars child proccesses

you should follow principle of least privilege , run web server own user.

in tomcat, can use ant-style variable substitution in config files, such as:

<some-setting>${somejavasystemproperty}</some-setting> 

you can't use os environment variables directly (i think...).

to use os environment variables, can put

set "catalina_opts=-dsomejavasystemproperty=%some_os_environment_variable%" 

in bin/setenv.bat (or in bin/setenv.sh *nix). may need create file.

http://tomcat.apache.org/tomcat-7.0-doc/config/

if use spring, can use os envvars directly in spring config files using context:property-placeholder.