# Configuration

## Format

Use `application.properties` or `application.yml`, **matching what the project already uses**. New projects generated by start.spring.io get `application.properties`; YAML is fine for deeply nested settings. Do not mix both in one project.

## Profiles

```properties
# application.properties (shared defaults)
spring.application.name=demo
spring.jpa.open-in-view=false
server.shutdown=graceful
```

- `application-dev.properties`, `application-prod.properties`, activated with `SPRING_PROFILES_ACTIVE` (environment variable) or `--spring.profiles.active`.
- Keep prod-safe values in the base file; override only what differs in dev (e.g. `logging.level.com.example=DEBUG`).
- Tests: use `src/test/resources/application.properties` or `@TestPropertySource`, not a "test" profile checked into `main`.

## Externalized values and secrets

- Read values from environment variables with defaults for local development: `spring.datasource.url=${SPRING_DATASOURCE_URL:jdbc:postgresql://localhost:5432/mydb}`.
- Spring Boot also maps `SPRING_DATASOURCE_URL` to `spring.datasource.url` automatically (relaxed binding).
- For a local `.env` file: `spring.config.import=optional:file:.env[.properties]`. Add `.env` to `.gitignore`; commit `.env.sample` with placeholder values.
- Never commit passwords, tokens or API keys. In production use the platform's secret store (Kubernetes secrets, Vault, cloud key vault) exposed as environment variables or config trees (`spring.config.import=configtree:/run/secrets/`).

## Type-safe properties

```java
@ConfigurationProperties(prefix = "app.mail")
@Validated
public record MailProperties(@NotBlank String from, @Positive int retries) {}
```

Enable with `@ConfigurationPropertiesScan` on the application class (or `@EnableConfigurationProperties`). Prefer this over scattered `@Value`. Spring Boot's annotation processor (`spring-boot-configuration-processor`, optional dependency) generates IDE metadata.

## Checklist

- [ ] One format (properties or YAML) used consistently
- [ ] No secrets in the repository
- [ ] Defaults work locally; production values come from the environment
- [ ] `@ConfigurationProperties` with validation for custom settings