spring:
  datasource:
    username: myuser
    password: my-secret-password

@Slf4j
public class DecryptEnvPostProcessor implements EnvironmentPostProcessor {

    // 預(yù)定義需要解密的配置項 key，只對這些 key 進行解密處理
    private static final Set<String> ENCRYPTED_KEYS = Set.of(
            "spring.datasource.password",
            "custom.service.password"
    );

    @Override
    public void postProcessEnvironment(ConfigurableEnvironment env, SpringApplication app) {
        boolean enabled = Boolean.parseBoolean(env.getProperty("config.decrypt.enabled", "true"));
        if (!enabled) {
            log.info("配置解密功能已關(guān)閉，跳過解密流程");
            return;
        }

        String key = System.getenv("DB_SECRET_KEY");
        if (StringUtils.isBlank(key)) {
            throw new IllegalStateException("缺少解密密鑰(DB_SECRET_KEY)，無法完成解密");
        }

        Map<String, Object> decryptedValues = new HashMap<>();

        for (PropertySource<?> source : env.getPropertySources()) {
            if (source instanceof EnumerablePropertySource<?> eps) {
                for (String name : eps.getPropertyNames()) {
                    if (ENCRYPTED_KEYS.contains(name)) {
                        Object val = eps.getProperty(name);
                        if (val instanceof String s && s.startsWith("ENC(") && s.endsWith(")")) {
                            String cipherText = s.substring(4, s.length() - 1);
                            try {
                                String plainText = EncryptionTool.decrypt(key, cipherText, "RSA");
                                decryptedValues.put(name, plainText);
                            } catch (Exception e) {
                                log.warn("解密配置項 [{}] 失敗，保持原密文", name, e);
                            }
                        }
                    }
                }
            }
        }

        if (!decryptedValues.isEmpty()) {
            env.getPropertySources().addFirst(new MapPropertySource("decryptedProperties", decryptedValues));
        }
        log.info("配置文件敏感信息解密完成");
    }
}

public class EncryptionTool {

    private static final String RSA = "RSA";

    public static String decrypt(String key, String cipherText, String algorithm) throws Exception {
        if (RSA.equalsIgnoreCase(algorithm)) {
            return decryptByPrivateKey(cipherText, key);
        } else {
            SecretKey secretKey = decodeKey(key, algorithm);
            Cipher cipher = Cipher.getInstance(algorithm);
            cipher.init(Cipher.DECRYPT_MODE, secretKey);
            byte[] decrypted = cipher.doFinal(Base64.getDecoder().decode(cipherText));
            return new String(decrypted, StandardCharsets.UTF_8);
        }
    }

    private static String decryptByPrivateKey(String cipherText, String base64PrivateKey) throws Exception {
        byte[] keyBytes = Base64.getDecoder().decode(base64PrivateKey);
        PrivateKey privateKey = KeyFactory.getInstance(RSA).generatePrivate(new PKCS8EncodedKeySpec(keyBytes));
        Cipher cipher = Cipher.getInstance(RSA);
        cipher.init(Cipher.DECRYPT_MODE, privateKey);
        byte[] decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(cipherText));
        return new String(decryptedBytes, StandardCharsets.UTF_8);
    }

    private static SecretKey decodeKey(String encodedKey, String algorithm) {
        byte[] decodedKey = Base64.getDecoder().decode(encodedKey);
        return new SecretKeySpec(decodedKey, algorithm);
    }
}

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter</artifactId>
</dependency>

org.springframework.boot.env.EnvironmentPostProcessor=\
com.example.config.DecryptionEnvironmentPostProcessor

spring:
  datasource:
    username: db_user
    password: ENC(rGA1bK3t...EncryptedText...)

config:
  decrypt:
    enabled: true

export DB_SECRET_KEY=$(cat /etc/secure/rsa_private_key.pem)
java -jar app.jar --spring.profiles.active=prod