But whatis to be considered configuration?
log4.xml clearly is, dtds clearly are not.
Currently we find:
datatypes.xml functions security
Which is IMHO generally not so bad. datatypes.xml and functions are only templates, which is good. security is context security which you probably want to change to (if only to change admin2k).
Most sadly the README is missing.
In 1.8 we also find:
builders/applications - stupid
applications - not really necesasry, as but could as a matter of example be shipped in an _example_ webapp..
modules - this can in production environment be omitted, but to get started at least a jdbc.xml can be handy to find.
taglib - contains template configuration, so should be included
utils - contains several actual settings, so should be included
xslt - xslt is code, so this IMHO could just as wel be just in the jar (we don't ship .java's either).