security: externalize secrets to environment variables

Replace hardcoded credentials with ${ENV:} placeholders:
- ${SPRING_DATASOURCE_PASSWORD} — MySQL password
- ${SPRING_DATA_REDIS_PASSWORD} — Redis password
- ${OPENBLOG_JWT_SECRET} — JWT signing key
- ${OPENBLOG_STORAGE_MINIO_ACCESS_KEY} — MinIO access key
- ${OPENBLOG_STORAGE_MINIO_SECRET_KEY} — MinIO secret key

Co-Authored-By: Claude <noreply@anthropic.com>

Author: yyyCode

OpenBlog-business/src/main/resources/application-local.example.yaml

@@ -3,11 +3,12 @@ spring:
   datasource:
     url: jdbc:mysql://127.0.0.1:3306/openblog?useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=UTC&characterEncoding=utf8&useUnicode=true
     username: root
-    password: your_password
+    password: ${SPRING_DATASOURCE_PASSWORD:your_password}
   data:
     redis:
       host: 127.0.0.1
       port: 6379
+      password: ${SPRING_DATA_REDIS_PASSWORD:}
 
 openblog:
   cache:
@@ -26,7 +27,7 @@ openblog:
     login-lockout:
       enabled: false
   jwt:
-    secret: "REPLACE_WITH_LONG_RANDOM_AT_LEAST_32_CHARS"
+    secret: ${OPENBLOG_JWT_SECRET:REPLACE_WITH_LONG_RANDOM_AT_LEAST_32_CHARS}
   storage:
     # local：读写本机目录；minio：读写远程 MinIO（与生产共用 endpoint 即可在本地看到线上图片）
     type: minio
@@ -35,6 +36,6 @@ openblog:
     thumb-long-edge: 320
     minio:
       endpoint: "http://127.0.0.1:9000"
-      access-key: "your_minio_access_key"
-      secret-key: "your_minio_secret_key"
+      access-key: ${OPENBLOG_STORAGE_MINIO_ACCESS_KEY:your_minio_access_key}
+      secret-key: ${OPENBLOG_STORAGE_MINIO_SECRET_KEY:your_minio_secret_key}
       bucket: "openblog"

OpenBlog-business/src/main/resources/application.yaml

@@ -7,7 +7,7 @@ spring:
   datasource:
     url: jdbc:mysql://10.21.32.85:3307/openblog?useSSL=false&allowPublicKeyRetrieval=true&serverTimezone=UTC&characterEncoding=utf8&useUnicode=true
     username: root
-    password: admin123
+    password: ${SPRING_DATASOURCE_PASSWORD:}
   jpa:
     database-platform: org.hibernate.dialect.MySQL8Dialect
     hibernate:
@@ -30,7 +30,7 @@ spring:
       # 若 Redis 设置了 requirepass，在此填写密码
       # password: your_redis_password
       timeout: 3s
-      password: admin123
+      password: ${SPRING_DATA_REDIS_PASSWORD:}
   thymeleaf:
     prefix: classpath:/templates/
     suffix: .html
@@ -81,7 +81,7 @@ openblog:
       failure-window-seconds: 300
       lockout-seconds: 900
   jwt:
-    secret: "PLEASE_CHANGE_THIS_TO_A_LONG_RANDOM_SECRET_32_PLUS_CHARS"
+    secret: ${OPENBLOG_JWT_SECRET:}
     issuer: openblog
     access-token-expire-seconds: 7200
     refresh-token-expire-seconds: 2592000
@@ -95,6 +95,6 @@ openblog:
     # 当 type=minio 时填写以下配置
     minio:
       endpoint: "http://10.21.32.85:9000"
-      access-key: "zoRKQFmL5UjnYz5HNrbh"
-      secret-key: "3T8kopnAh4mQVLSDDgqQpxH3oSn8jhH5H0wzKlzE"
+      access-key: ${OPENBLOG_STORAGE_MINIO_ACCESS_KEY:}
+      secret-key: ${OPENBLOG_STORAGE_MINIO_SECRET_KEY:}
       bucket: "openblog-document"