Nacos 配置中心实战：从多环境隔离到敏感信息加密

version: '3'
services:
  nacos:
    image: nacos/nacos-server:v2.3.0
    container_name: nacos-server
    environment:
      - MODE=standalone              # 单机模式，测试环境够用
      - SPRING_DATASOURCE_PLATFORM=mysql
      - MYSQL_SERVICE_HOST=mysql
      - MYSQL_SERVICE_PORT=3306
      - MYSQL_SERVICE_DB_NAME=nacos_config
      - MYSQL_SERVICE_USER=nacos
      - MYSQL_SERVICE_PASSWORD=nacos123
      - NACOS_AUTH_ENABLE=true       # 启用认证
      - NACOS_AUTH_TOKEN_EXPIRE_SECONDS=18000
      - NACOS_AUTH_TOKEN_SECRET_KEY=your_secret_key_32_chars_min
    ports:
      - "8848:8848"                  # 配置中心端口
      - "9848:9848"                  # gRPC 端口
    depends_on:
      - mysql
    networks:
      - nacos-net
    restart: unless-stopped

  mysql:
    image: mysql:8.0
    container_name: nacos-mysql
    environment:
      - MYSQL_ROOT_PASSWORD=root123
      - MYSQL_DATABASE=nacos_config
      - MYSQL_USER=nacos
      - MYSQL_PASSWORD=nacos123
    ports:
      - "3306:3306"
    volumes:
      - nacos-mysql-data:/var/lib/mysql
      - ./nacos-mysql.sql:/docker-entrypoint-initdb.d/nacos-mysql.sql
    networks:
      - nacos-net
    restart: unless-stopped

networks:
  nacos-net:
    driver: bridge

volumes:
  nacos-mysql-data:

docker-compose up -d

docker exec nacos-mysql mysql -u root -proot123 < nacos-mysql.sql

# bootstrap.yml 配置
spring:
  cloud:
    nacos:
      config:
        server-addr: 127.0.0.1:8848
        namespace: dev-namespace      # 开发环境的 namespace ID
        group: order-service          # 服务所属的 group
        file-extension: yaml
        auto-refresh: true            # 开启自动刷新
  application:
    name: order-service
    profiles:
      active: dev

# Data Id: database.yaml
# Group: order-service

spring:
  datasource:
    url: jdbc:mysql://mysql.dev.internal:3306/order_db
    username: dev_user
    password: dev_password_123
    driver-class-name: com.mysql.cj.jdbc.Driver

  jpa:
    hibernate:
      ddl-auto: update
    show-sql: true

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/order_db_dev
    username: dev_user
    password: dev_password123
    driver-class-name: com.mysql.cj.jdbc.Driver
  jpa:
    hibernate:
      ddl-auto: update

// 在任何 Spring Bean 中就可以直接用
@RestController
public class OrderController {
    
    @Autowired
    private DataSource dataSource;
    
    @GetMapping("/health")
    public String health() {
        // dataSource 的配置会自动从 Nacos 拉取
        return "OK";
    }
}

@RestController
@RequestMapping("/api/order")
public class OrderController {
    
    @Value("${order.max-retry-times:3}")
    private Integer maxRetryTimes;  // 这样不行！
    
    @GetMapping("/retry-times")
    public Integer getRetryTimes() {
        return maxRetryTimes;
    }
}

@Configuration
public class OrderConfig {
    
    @Bean
    @RefreshScope
    public OrderProperties orderProperties() {
        return new OrderProperties();
    }
}

@Data
@Component
@ConfigurationProperties(prefix = "order")
public class OrderProperties {
    private Integer maxRetryTimes =;
    private String retryStrategy = "exponential";
}

// 控制器中注入对象
@RestController
@RequestMapping("/api/order")
public class OrderController {
    
    @Autowired
    private OrderProperties orderProperties;
    
    @GetMapping("/retry-times")
    public Integer getRetryTimes() {
        // 这样就会动态刷新
        return orderProperties.getMaxRetryTimes();
    }
}

@Configuration
public class OrderConfig {
    
    @NacosValue(value = "${order.max-retry-times:3}", autoRefreshed = true)
    private Integer maxRetryTimes;
    
    public Integer getMaxRetryTimes() {
        return maxRetryTimes;
    }
}

2026-01-15 14:22:33 [NacosConfigListener] Refresh config from nacos...
2026-01-15 14:22:33 [OrderProperties] Properties refreshed: maxRetryTimes=5

@Configuration
public class EncryptedPropertyResolver {
    
    // 这里用一个固定的密钥，生产环境应该从环境变量或密钥管理系统取
    private static final String SECRET_KEY = "your-secret-key-here-32-chars";
    
    @Bean
    public static PropertySourcesPlaceholderConfigurer propertySourcesPlaceholderConfigurer() {
        PropertySourcesPlaceholderConfigurer configurer = new PropertySourcesPlaceholderConfigurer();
        configurer.setPlaceholderPrefix("${");
        configurer.setPlaceholderSuffix("}");
        return configurer;
    }
    
    /**
     * 解密被 ENC() 包装的属性值
     */
    public static String decrypt(String encryptedValue) {
        if (encryptedValue == null || !encryptedValue.startsWith("ENC(") || !encryptedValue.endsWith(")")) {
            return encryptedValue;
        }
        
        String encrypted = encryptedValue.substring(, encryptedValue.length() -);
        // 使用 AES 或其他加密算法解密
        // 这里用伪代码表示
        return AesUtil.decrypt(encrypted, SECRET_KEY);
    }
}

// 自定义环境预处理器，在配置加载时进行解密
@Component
public class DecryptEnvironmentPostProcessor implements EnvironmentPostProcessor {
    
    @Override
    public void postProcessEnvironment(ConfigurableEnvironment environment, SpringApplication application) {
        // 遍历所有的 property source，对 ENC(...) 的值进行解密
        for (PropertySource<?> source : environment.getPropertySources()) {
            if (source instanceof EnumerablePropertySource) {
                EnumerablePropertySource<?> enumerable = (EnumerablePropertySource<?>) source;
                for (String name : enumerable.getPropertyNames()) {
                    String value = (String) enumerable.getProperty(name);
                    if (value != null && value.startsWith("ENC(")) {
                        // 解密后替换
                        String decrypted = EncryptedPropertyResolver.decrypt(value);
                        // 这里的替换方式取决于具体的实现...
                    }
                }
            }
        }
    }
}

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/order_db_prod
    username: prod_user
    password: ENC(x7y8z9a0b1c2d3e4f5g6h7i8j9k0l1m2n3)  # 加密后的密码
    driver-class-name: com.mysql.cj.jdbc.Driver

# bootstrap.yml - 正确的位置
spring:
  cloud:
    nacos:
      config:
        server-addr: nacos-server.internal:8848
        namespace: prod-namespace-id
        group: my-service

@Component
public class OrderConfigListener implements ApplicationListener<RefreshEvent> {
    
    @Override
    public void onApplicationEvent(RefreshEvent event) {
        // 这个监听器会在配置刷新时被触发
        System.out.println("配置已刷新");
    }
}