一、环境初始化1. 创建目录结构mkdir-p/home/ops_app_user/middleware/mysql/configmkdir-p/home/ops_app_user/middleware/redis/configmkdir-p/home/ops_app_user/middleware/nacosmkdir-p/home/ops_app_user/middleware/minio/datamkdir-p/home/ops_app_user/middleware/minio/config2. 生成安全密钥openssl rand-base64323. 创建自定义网络dockernetwork create middleware-network4. 配置环境变量exportMYSQL_ROOT_PASSWORD强密码exportREDIS_PASSWORD强密码exportMYSQL_NACOS_PASSWORD强密码exportMINIO_ROOT_USERminioadminexportMINIO_ROOT_PASSWORD强密码exportMINIO_KMS_SECRET_KEYmy-key:上一步生成的密钥exportRABBITMQ_USERxxxexportRABBITMQ_PASSWORDxxxx二、配置文件初始化1. MySQL 配置文件dockerrun--rm\-v/home/ops_app_user/middleware/mysql/config:/etc/mysql\mysql:8.0.39\cat/etc/mysql/my.cnf/home/ops_app_user/middleware/mysql/config/my.cnf2. Redis 配置文件cat/home/ops_app_user/middleware/redis/config/redis.confEOF bind 0.0.0.0 protected-mode no daemonize no appendonly yes appendfilename appendonly.aof appendfsync everysec auto-aof-rewrite-percentage 100 auto-aof-rewrite-min-size 64mb EOF三、docker-compose.yaml 部署文件优化版version:3.8services:# MySQL 8.0mysql:image:mysql:8.0.39container_name:mysqlrestart:alwaysports:-3306:3306environment:MYSQL_ROOT_PASSWORD:${MYSQL_ROOT_PASSWORD}TZ:Asia/Shanghaivolumes:-/home/ops_app_user/middleware/mysql/config/conf.d:/etc/mysql/conf.d-/home/ops_app_user/middleware/mysql/data:/var/lib/mysql-/home/ops_app_user/middleware/mysql/config/my.cnf:/etc/mysql/my.cnf-/home/ops_app_user/middleware/mysql/log:/var/log/mysql-/etc/localtime:/etc/localtime:ro-/etc/timezone:/etc/timezone:rocommand:--default-authentication-pluginmysql_native_password--character-set-serverutf8mb4--collation-serverutf8mb4_unicode_cinetworks:-middleware-network# Redisredis:image:redis:6.2-alpinecontainer_name:redisrestart:alwaysports:-6379:6379volumes:-/home/ops_app_user/middleware/redis/data:/data-/home/ops_app_user/middleware/redis/config/redis.conf:/etc/redis/redis.confcommand:redis-server /etc/redis/redis.conf--requirepass ${REDIS_PASSWORD}networks:-middleware-network# Nacosnacos:image:nacos/nacos-server:v2.3.2container_name:nacosrestart:alwaysports:-8848:8848-9848:9848environment:MODE:standaloneSPRING_DATASOURCE_PLATFORM:mysqlMYSQL_SERVICE_HOST:mysqlMYSQL_SERVICE_PORT:3306MYSQL_SERVICE_DB_NAME:nacosMYSQL_SERVICE_USER:nacos_userMYSQL_SERVICE_PASSWORD:${MYSQL_NACOS_PASSWORD}volumes:-/home/ops_app_user/middleware/nacos/conf:/home/nacos/conf-/home/ops_app_user/middleware/nacos/data:/home/nacos/data-/home/ops_app_user/middleware/nacos/logs:/home/nacos/logsdepends_on:-mysqlnetworks:-middleware-network# MinIOminio:restart:alwayscontainer_name:minioimage:minio/minio:latestprivileged:trueports:-9100:9000-9111:9111volumes:-/home/ops_app_user/middleware/minio/data:/data-/home/ops_app_user/middleware/minio/config:/root/.minio-/etc/localtime:/etc/localtime:roenvironment:TZ:Asia/ShanghaiMINIO_ROOT_USER:${MINIO_ROOT_USER}MINIO_ROOT_PASSWORD:${MINIO_ROOT_PASSWORD}MINIO_SERVER_URL:http://192.168.11.47:9100MINIO_BROWSER_REDIRECT_URL:http://192.168.11.47:9111MINIO_KMS_SECRET_KEY:${MINIO_KMS_SECRET_KEY}command:server /data--console-address :9111healthcheck:test:[CMD,curl,-f,http://localhost:9000/minio/health/live]interval:5stimeout:3sretries:10networks:-middleware-networkrabbitmq:image:rabbitmq:3.13-managementcontainer_name:rabbitmqrestart:alwaysports:-5672:5672# 客户端连接端口-15672:15672# Web 管理控制台端口environment:TZ:Asia/ShanghaiRABBITMQ_DEFAULT_USER:${RABBITMQ_USER}# 管理员账号RABBITMQ_DEFAULT_PASS:${RABBITMQ_PASSWORD}# 管理员密码volumes:-/home/ops_app_user/middleware/rabbitmq/data:/var/lib/rabbitmq# 数据持久化-/etc/localtime:/etc/localtime:ronetworks:-middleware-networknetworks:middleware-network:external:true四、MySQL 初始化 Nacos 库安全版1. 创建数据库与用户CREATEDATABASEIFNOTEXISTSnacosDEFAULTCHARACTERSETutf8mb4COLLATEutf8mb4_unicode_ci;CREATEUSERnacos_user%IDENTIFIEDBY${MYSQL_NACOS_PASSWORD};GRANTALLPRIVILEGESONnacos.*TOnacos_user%;FLUSHPRIVILEGES;2. 执行 Nacos 官方表结构直接使用你提供的 SQL 即可五、Nacos 配置修复必须执行1. 删除错误配置rm-rf/home/ops_app_user/middleware/nacos/conf2. 从官方镜像复制标准配置dockerrun--rm--entrypoint/bin/sh nacos/nacos-server:v2.3.2-ctar -cf - -C /home/nacos conf|tar-xf--C/home/ops_app_user/middleware/nacos/3. 重启 Nacosdockerstop nacosdocker-composeup-dnacos六、Nacos 开启安全鉴权加固修改application.properties添加# 开启鉴权 nacos.core.auth.enabledtrue # 使用内置的鉴权系统可选默认就是true nacos.core.auth.system.typenacos # 设置JWT token的密钥自定义建议复杂一些 nacos.core.auth.plugin.nacos.token.secret.keyVGhpc0lzTXlDdXN0b21TZWNyZXRLZXkwMTIzNDU2Nzg # token过期时间默认18000秒即5小时 nacos.core.auth.plugin.nacos.token.expire.seconds18000 # 开启控制台登录默认就是true nacos.core.auth.enable.userAgentAuthWhitefalse # 是否开启服务身份识别建议开启 nacos.core.auth.server.identity.keyVGhpc0lzTXlDdXN0b21TZWNyZXRLZXkwMTIzNDU2Nzg nacos.core.auth.server.identity.valueVGhpc0lzTXlDdXN0b21TZWNyZXRLZXkwMTIzNDU2Nzg七、Minio自动加解密bash-5.1# echo $MINIO_BROWSER_REDIRECT_URLhttp://xxxx:9111 bash-5.1# echo $MINIO_SERVER_URLhttp://xxx:9100exportMINIO_SERVER_URLhttp://xxx:8001exportMINIO_BROWSER_REDIRECT_URLhttp://xxxx:8001mcencryptsetsse-s3 myminio/user-bucketmcencrypt info myminio/user-bucket# 查看KMS根密钥状态mcadmin kms key status myminiomcencryptsetsse-s3 myminio/default-bucketmcencryptsetsse-s3 myminio/draft-bucketmcencryptsetsse-s3 myminio/system-bucketmcencryptsetsse-s3 myminio/task-bucket