graph TD
    subgraph A [環(huán)境變量方案]
        A1[開發(fā)環(huán)境] --> A11[數(shù)據(jù)庫地址=process.env.DB_URL]
        A2[測試環(huán)境] --> A21[數(shù)據(jù)庫地址=process.env.DB_URL]
        A3[生產(chǎn)環(huán)境] --> A31[數(shù)據(jù)庫地址=process.env.DB_URL]
        A11 & A21 & A31 --> A4[一處配置，多環(huán)境復(fù)用]
    end
    subgraph B [硬編碼方案]
        B1[開發(fā)環(huán)境] --> B11[數(shù)據(jù)庫地址=localhost:3306]
        B2[測試環(huán)境] --> B21[數(shù)據(jù)庫地址=test-db:3306]
        B3[生產(chǎn)環(huán)境] --> B31[數(shù)據(jù)庫地址=prod-db:3306]
        B11 & B21 & B31 --> B4[代碼修改頻繁
配置分散難維護]
    end
    A4 --> C[? 配置統(tǒng)一管理]
    B4 --> D[? 維護成本高]

// 探索 process.env 的奧秘
console.log(typeof process.env); // 'object'
console.log(process.env instanceof Object); // true
// 環(huán)境變量的鍵值對示例
for (const [key, value] of Object.entries(process.env)) {
  console.log(`${key}: ${value}`);
  // 輸出類似：
  // PATH: /usr/local/bin:/usr/bin:/bin
  // HOME: /Users/username
  // USER: username
}

// 環(huán)境變量的類型驗證
console.log(typeof process.env.NODE_ENV); // 'string' 或 'undefined'
// 設(shè)置環(huán)境變量
process.env.MY_VARIABLE = 'some value';
// 注意：這只會影響當(dāng)前進程及其子進程
console.log(process.env.MY_VARIABLE); // 'some value'

# 單變量設(shè)置
NODE_ENV=production node app.js
# 多變量設(shè)置
DB_HOST=localhost DB_PORT=5432 API_KEY=secret123 node app.js
# 使用變量嵌套
export API_BASE="https://api.example.com"
NODE_ENV=development API_URL="${API_BASE}/v1" node app.js

:: Command Prompt
set NODE_ENV=production&& set DB_HOST=localhost&& node app.js
:: PowerShell
$env:NODE_ENV="production"; $env:DB_HOST="localhost"; node app.js

{
  "scripts": {
    "dev": "NODE_ENV=development nodemon server.js",
    "start": "NODE_ENV=production node server.js",
    "test": "NODE_ENV=test jest",
    "debug": "NODE_ENV=development DEBUG=app:* node --inspect server.js",
    "build:dev": "NODE_ENV=development webpack --config webpack.config.js",
    "build:prod": "NODE_ENV=production webpack --config webpack.config.js"
  }
}

npm install --save-dev cross-env

{
  "scripts": {
    "dev": "cross-env NODE_ENV=development DB_HOST=localhost node server.js",
    "build": "cross-env NODE_ENV=production npm run build:client && npm run build:server"
  }
}

npm install dotenv

// app.js 或 server.js 最頂部
require('dotenv').config();
console.log(process.env.DB_HOST); // 輸出 .env 文件中的 DB_HOST 值

// 加載特定路徑的 .env 文件
require('dotenv').config({ path: '/path/to/custom/.env' });
// 根據(jù)不同環(huán)境加載不同文件
const envFile = process.env.NODE_ENV === 'test' ? '.env.test' : '.env';
require('dotenv').config({ path: envFile });

# 使用 node -r (--require) 參數(shù)預(yù)加載
node -r dotenv/config server.js
# 配合自定義路徑
node -r dotenv/config server.js dotenv_config_path=/custom/path/.env

require('dotenv').config({
  path: '.env.development',      // 指定文件路徑
  encoding: 'utf8',              // 文件編碼
  debug: process.env.NODE_ENV === 'development', // 開發(fā)模式下輸出調(diào)試信息
  override: false                // 是否覆蓋已存在的環(huán)境變量
});

# ======================
# 應(yīng)用基礎(chǔ)配置
# ======================
NODE_ENV=development
APP_NAME=My Awesome App
PORT=3000
HOST=0.0.0.0
API_VERSION=v1
# ======================
# 數(shù)據(jù)庫配置
# ======================
DB_HOST=localhost
DB_PORT=5432
DB_NAME=myapp_development
DB_USER=dev_user
DB_PASSWORD=dev_password123
DB_SSL=false
DB_POOL_MAX=20
DB_POOL_MIN=5
DB_POOL_ACQUIRE=30000
DB_POOL_IDLE=10000
# ======================
# JWT 認證配置
# ======================
JWT_SECRET=your_super_secret_jwt_key_here
JWT_EXPIRES_IN=7d
JWT_REFRESH_SECRET=your_refresh_secret_key
JWT_REFRESH_EXPIRES_IN=30d
# ======================
# 第三方服務(wù)配置
# ======================
# Stripe 支付
STRIPE_PUBLISHABLE_KEY=pk_test_xxxxxxxx
STRIPE_SECRET_KEY=sk_test_xxxxxxxx
# AWS S3 存儲
AWS_ACCESS_KEY_ID=your_aws_access_key
AWS_SECRET_ACCESS_KEY=your_aws_secret_key
AWS_REGION=us-east-1
S3_BUCKET_NAME=my-app-uploads
# 郵件服務(wù) (SendGrid)
SENDGRID_API_KEY=SG.xxxxxxxx
# Redis 緩存
REDIS_URL=redis://localhost:6379
REDIS_PASSWORD=your_redis_password
# ======================
# 功能開關(guān)
# ======================
FEATURE_NEW_UI=true
FEATURE_PAYMENT=false
ENABLE_ANALYTICS=true
MAINTENANCE_MODE=false
# ======================
# 性能與限流配置
# ======================
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX_REQUESTS=100
UPLOAD_LIMIT=10mb
SESSION_TIMEOUT=3600000

graph TD
    A[基礎(chǔ)層：環(huán)境變量源] --> B[驗證層：變量校驗]
    B --> C[結(jié)構(gòu)化層：配置整合]
    C --> D[適配層：多環(huán)境切換]
    D --> E[應(yīng)用層：配置使用]
    A1[.env文件] --> A
    A2[系統(tǒng)環(huán)境變量] --> A
    A3[配置中心] --> A
    B1[類型校驗] --> B
    B2[必填項檢查] --> B
    C1[整合為JSON結(jié)構(gòu)] --> C
    D1[根據(jù)NODE_ENV自動加載
對應(yīng)配置] --> D
    E1[業(yè)務(wù)模塊調(diào)用] --> E

// config/validateEnv.js
const Joi = require('joi');
// 環(huán)境變量 schema 定義
const envVarsSchema = Joi.object({
  NODE_ENV: Joi.string()
    .valid('development', 'production', 'test', 'staging')
    .default('development'),
  PORT: Joi.number()
    .default(3000),
  DB_HOST: Joi.string()
    .required()
    .description('Database host name'),
  DB_PORT: Joi.number()
    .default(5432),
  DB_NAME: Joi.string()
    .required()
    .description('Database name'),
  DB_USER: Joi.string()
    .required()
    .description('Database user'),
  DB_PASSWORD: Joi.string()
    .required()
    .description('Database password'),
  JWT_SECRET: Joi.string()
    .required()
    .description('JWT secret key'),
  API_RATE_LIMIT: Joi.number()
    .default(100)
    .description('API rate limit per window'),
}).unknown(); // 允許其他未定義的環(huán)境變量
const { value: envVars, error } = envVarsSchema.validate(process.env);
if (error) {
  throw new Error(`環(huán)境變量配置驗證失敗: ${error.message}`);
}
module.exports = envVars;

// config/index.js
const env = require('./validateEnv');
module.exports = {
  env: env.NODE_ENV,
  port: env.PORT,
  // 數(shù)據(jù)庫配置
  database: {
    host: env.DB_HOST,
    port: env.DB_PORT,
    name: env.DB_NAME,
    user: env.DB_USER,
    password: env.DB_PASSWORD,
    ssl: env.DB_SSL === 'true',
    pool: {
      max: parseInt(env.DB_POOL_MAX, 10),
      min: parseInt(env.DB_POOL_MIN, 10),
      acquire: parseInt(env.DB_POOL_ACQUIRE, 10),
      idle: parseInt(env.DB_POOL_IDLE, 10)
    }
  },
  // JWT 配置
  jwt: {
    secret: env.JWT_SECRET,
    expiresIn: env.JWT_EXPIRES_IN,
    refreshSecret: env.JWT_REFRESH_SECRET,
    refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN
  },
  // API 配置
  api: {
    prefix: `/api/${env.API_VERSION}`,
    rateLimit: {
      windowMs: parseInt(env.RATE_LIMIT_WINDOW_MS, 10),
      max: parseInt(env.RATE_LIMIT_MAX_REQUESTS, 10)
    }
  },
  // 第三方服務(wù)
  services: {
    stripe: {
      publishableKey: env.STRIPE_PUBLISHABLE_KEY,
      secretKey: env.STRIPE_SECRET_KEY
    },
    aws: {
      accessKeyId: env.AWS_ACCESS_KEY_ID,
      secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
      region: env.AWS_REGION,
      s3Bucket: env.S3_BUCKET_NAME
    }
  },
  // 功能開關(guān)
  features: {
    newUI: env.FEATURE_NEW_UI === 'true',
    payment: env.FEATURE_PAYMENT === 'true',
    analytics: env.ENABLE_ANALYTICS === 'true',
    maintenance: env.MAINTENANCE_MODE === 'true'
  }
};

// app.js
const express = require('express');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const config = require('./config');
const app = express();
// 安全中間件
app.use(helmet());
// 速率限制
const limiter = rateLimit({
  windowMs: config.api.rateLimit.windowMs,
  max: config.api.rateLimit.max,
  message: '請求過于頻繁，請稍后再試'
});
app.use(limiter);
// 數(shù)據(jù)庫連接
const { Pool } = require('pg');
const dbPool = new Pool(config.database);
// 路由配置
app.use(config.api.prefix, require('./routes'));
// 健康檢查端點
app.get('/health', (req, res) => {
  res.json({
    status: 'OK',
    environment: config.env,
    timestamp: new Date().toISOString(),
    uptime: process.uptime()
  });
});
// 錯誤處理中間件
app.use((err, req, res, next) => {
  console.error(err.stack);
  res.status(500).json({
    error: config.env === 'development' ? err.message : '內(nèi)部服務(wù)器錯誤',
    ...(config.env === 'development' && { stack: err.stack })
  });
});
app.listen(config.port, () => {
  console.log(`
?? 服務(wù)器啟動成功!
?? 環(huán)境: ${config.env}
?? 地址: http://localhost:${config.port}
?? 時間: ${new Date().toISOString()}
  `);
});
module.exports = app;

# Dockerfile
FROM node:18-alpine
WORKDIR /app
# 安裝依賴
COPY package*.json ./
RUN npm ci --only=production
# 復(fù)制源碼
COPY . .
# 創(chuàng)建非root用戶
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nextjs -u 1001
# 使用非root用戶
USER nextjs
# 健康檢查
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node health-check.js
# 通過環(huán)境變量傳遞配置
ENV NODE_ENV=production \
    PORT=3000
EXPOSE 3000
CMD ["node", "server.js"]

# docker-compose.yml
version: '3.8'
services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_NAME=myapp_production
      - REDIS_URL=redis://redis:6379
    env_file:
      - .env.production
    depends_on:
      - postgres
      - redis
    restart: unless-stopped
  postgres:
    image: postgres:14
    environment:
      - POSTGRES_DB=myapp_production
      - POSTGRES_USER=prod_user
      - POSTGRES_PASSWORD_FILE=/run/secrets/db_password
    secrets:
      - db_password
    volumes:
      - postgres_data:/var/lib/postgresql/data
    restart: unless-stopped
  redis:
    image: redis:6-alpine
    command: redis-server --requirepass ${REDIS_PASSWORD}
    volumes:
      - redis_data:/data
    restart: unless-stopped
volumes:
  postgres_data:
  redis_data:
secrets:
  db_password:
    file: ./secrets/db_password.txt

{
  "containerDefinitions": [
    {
      "name": "app",
      "image": "my-app:latest",
      "essential": true,
      "environment": [
        {
          "name": "NODE_ENV",
          "value": "production"
        },
        {
          "name": "DB_HOST",
          "value": "production-db.cluster-xxx.us-east-1.rds.amazonaws.com"
        }
      ],
      "secrets": [
        {
          "name": "DB_PASSWORD",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:db/password-abc123"
        },
        {
          "name": "JWT_SECRET",
          "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:jwt/secret-def456"
        }
      ]
    }
  ]
}

# k8s/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nodejs-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nodejs-app
  template:
    metadata:
      labels:
        app: nodejs-app
    spec:
      containers:
      - name: app
        image: my-app:latest
        ports:
        - containerPort: 3000
        env:
        - name: NODE_ENV
          value: "production"
        - name: DB_HOST
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: db.host
        - name: DB_NAME
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: db.name
        envFrom:
        - secretRef:
            name: app-secrets
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health
            port: 3000
          initialDelaySeconds: 5
          periodSeconds: 5
---
# ConfigMap 用于非敏感配置
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  db.host: "postgres-service"
  db.name: "myapp_production"
  redis.url: "redis-service:6379"
---
# Secret 用于敏感信息
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
type: Opaque
data:
  db.password: <base64-encoded-password>
  jwt.secret: <base64-encoded-secret>
  stripe.secretKey: <base64-encoded-key>

// config/env/development.js
module.exports = {
  database: {
    logging: true,
    sync: { force: false }
  },
  logging: {
    level: 'debug',
    prettyPrint: true
  },
  cors: {
    origin: ['http://localhost:3000', 'http://127.0.0.1:3000'],
    credentials: true
  }
};
// config/env/production.js
module.exports = {
  database: {
    logging: false,
    sync: { force: false }
  },
  logging: {
    level: 'info',
    prettyPrint: false
  },
  cors: {
    origin: ['https://myapp.com', 'https://www.myapp.com'],
    credentials: true
  }
};
// config/env/index.js
const development = require('./development');
const production = require('./production');
const test = require('./test');
const environments = {
  development,
  production,
  test
};
module.exports = environments[process.env.NODE_ENV] || {};

// utils/encryption.js
const crypto = require('crypto');
class ConfigEncryption {
  constructor(encryptionKey) {
    this.algorithm = 'aes-256-gcm';
    this.key = crypto.scryptSync(encryptionKey, 'salt', 32);
  }
  encrypt(text) {
    const iv = crypto.randomBytes(16);
    const cipher = crypto.createCipher(this.algorithm, this.key);
    cipher.setAAD(Buffer.from('additionalData'));
    let encrypted = cipher.update(text, 'utf8', 'hex');
    encrypted += cipher.final('hex');
    const authTag = cipher.getAuthTag();
    return {
      iv: iv.toString('hex'),
      data: encrypted,
      authTag: authTag.toString('hex')
    };
  }
  decrypt(encryptedData) {
    const decipher = crypto.createDecipher(this.algorithm, this.key);
    decipher.setAAD(Buffer.from('additionalData'));
    decipher.setAuthTag(Buffer.from(encryptedData.authTag, 'hex'));
    let decrypted = decipher.update(encryptedData.data, 'hex', 'utf8');
    decrypted += decipher.final('utf8');
    return decrypted;
  }
}
module.exports = ConfigEncryption;

// config/hot-reload.js
const fs = require('fs');
const path = require('path');
const chokidar = require('chokidar');
class ConfigHotReload {
  constructor(configPath) {
    this.configPath = configPath;
    this.watcher = null;
    this.callbacks = [];
  }
  watch() {
    if (process.env.NODE_ENV !== 'development') return;
    this.watcher = chokidar.watch(this.configPath, {
      ignoreInitial: true,
      persistent: true
    });
    this.watcher.on('change', (filePath) => {
      console.log(`配置文件變更: ${filePath}`);
      this.notifyCallbacks();
    });
    console.log(`正在監(jiān)聽配置文件變更: ${this.configPath}`);
  }
  onReload(callback) {
    this.callbacks.push(callback);
  }
  notifyCallbacks() {
    // 刪除緩存，重新加載配置
    Object.keys(require.cache).forEach(key => {
      if (key.includes(this.configPath)) {
        delete require.cache[key];
      }
    });
    this.callbacks.forEach(callback => {
      try {
        callback();
      } catch (error) {
        console.error('配置重載回調(diào)執(zhí)行失敗:', error);
      }
    });
  }
  stop() {
    if (this.watcher) {
      this.watcher.close();
    }
  }
}
module.exports = ConfigHotReload;

flowchart TD
    %% 起始節(jié)點
    A[環(huán)境變量異常
（如讀取為undefined）] --> B[檢查變量是否定義]
    %% 分支1：變量未定義
    B -->|否（未定義）| C[補充定義變量]
    C --> C1[選項1：修改.env文件添加變量]
    C --> C2[選項2：終端臨時設(shè)置（export 變量=值）]
    C --> C3[選項3：配置系統(tǒng)環(huán)境變量]
    C1 & C2 & C3 --> H[重新啟動服務(wù)驗證]
    %% 分支2：變量已定義，檢查加載方式
    B -->|是（已定義）| D[檢查dotenv加載方式]
    D -->|否（未加載/加載順序錯誤）| E[調(diào)整加載配置]
    E --> E1[1. 確認已安裝dotenv（npm list dotenv）]
    E --> E2[2. 在入口文件首行添加 require('dotenv').config()]
    E1 & E2 --> H
    %% 分支3：加載正常，檢查環(huán)境是否正確
    D -->|是（加載正常）| F[檢查NODE_ENV是否正確]
    F -->|否（環(huán)境不匹配）| G[修改NODE_ENV]
    G --> G1[開發(fā)環(huán)境：export NODE_ENV=development]
    G --> G2[生產(chǎn)環(huán)境：export NODE_ENV=production]
    G1 & G2 --> H
    %% 分支4：環(huán)境正確，檢查代碼邏輯
    F -->|是（環(huán)境正確）| I[排查業(yè)務(wù)代碼]
    I --> I1[1. 檢查變量名拼寫（如DB_URL vs DbUrl）]
    I --> I2[2. 確認變量使用在加載之后（避免提前調(diào)用）]
    I1 & I2 --> H
    %% 結(jié)束節(jié)點
    H --> J[驗證成功
（變量正常讀?。
    %% 樣式設(shè)置
    classDef start fill:#fff2e8,stroke:#fa8c16,stroke-width:2px;
    classDef branch fill:#e6f7ff,stroke:#1890ff,stroke-width:2px;
    classDef end fill:#f0fff4,stroke:#52c41a,stroke-width:2px;
    class A start;
    class B,D,F,I branch;
    class J end;

// utils/env-debug.js
function debugEnvironmentVariables() {
  const sensitiveKeys = ['PASSWORD', 'SECRET', 'KEY', 'TOKEN'];
  console.log('?? 環(huán)境變量調(diào)試信息:');
  console.log('='.repeat(50));
  Object.keys(process.env)
    .filter(key => key.includes('NODE') || 
                   key.includes('DB') || 
                   key.includes('API') ||
                   key.includes('JWT'))
    .sort()
    .forEach(key => {
      const value = process.env[key];
      const isSensitive = sensitiveKeys.some(sensitive => 
        key.toUpperCase().includes(sensitive)
      );
      const displayValue = isSensitive ? 
        '***' + value.slice(-4) : 
        value;
      console.log(`?? ${key}: ${displayValue}`);
    });
  console.log('='.repeat(50));
  // 檢查必需的變量
  const requiredVars = ['NODE_ENV', 'DB_HOST', 'DB_NAME'];
  const missingVars = requiredVars.filter(varName => !process.env[varName]);
  if (missingVars.length > 0) {
    console.error('? 缺失必需的環(huán)境變量:', missingVars);
    process.exit(1);
  }
}
module.exports = { debugEnvironmentVariables };

// config/validation-report.js
function generateValidationReport(config) {
  const report = {
    timestamp: new Date().toISOString(),
    environment: process.env.NODE_ENV,
    status: 'VALID',
    issues: [],
    warnings: [],
    recommendations: []
  };
  // 檢查數(shù)據(jù)庫配置
  if (config.database.host.includes('localhost') && process.env.NODE_ENV === 'production') {
    report.warnings.push('生產(chǎn)環(huán)境使用 localhost 作為數(shù)據(jù)庫主機');
  }
  // 檢查弱密碼
  if (config.database.password && config.database.password.length < 8) {
    report.issues.push('數(shù)據(jù)庫密碼強度不足');
  }
  // 檢查 JWT 密鑰
  if (config.jwt.secret === 'default-secret' || config.jwt.secret.length < 32) {
    report.issues.push('JWT 密鑰強度不足或使用默認值');
    report.status = 'INVALID';
  }
  // 性能建議
  if (config.database.pool.max > 50) {
    report.recommendations.push('考慮降低數(shù)據(jù)庫連接池最大值以優(yōu)化性能');
  }
  return report;
}

graph LR
    %% 中心節(jié)點
    A[環(huán)境變量管理
（Node.js場景）] --> B[基礎(chǔ)載體：process.env]
    A --> C[配置來源]
    A --> D[工具庫]
    A --> E[安全機制]
    A --> F[實踐場景]
    A --> G[問題排查]
    %% 基礎(chǔ)載體分支
    B --> B1[特性：全局可訪問]
    B --> B2[來源：繼承父進程環(huán)境變量]
    B --> B3[用法：process.env.變量名]
    %% 配置來源分支
    C --> C1[命令行臨時設(shè)置
（export 變量=值）]
    C --> C2[.env文件持久化
（項目級配置）]
    C --> C3[系統(tǒng)環(huán)境變量
（全局級配置）]
    C --> C4[配置中心
（企業(yè)級：如Nacos/Apollo）]
    %% 工具庫分支
    D --> D1[dotenv
（加載.env文件到process.env）]
    D --> D2[cross-env
（跨平臺設(shè)置NODE_ENV）]
    D1 --> D11[核心API：dotenv.config()]
    %% 安全機制分支
    E --> E1[敏感變量加密
（如openssl加密DB_PASSWORD）]
    E --> E2[密鑰管理服務(wù)
（如KMS存儲解密密鑰）]
    E --> E3[.env文件.gitignore
（避免敏感信息提交）]
    %% 實踐場景分支
    F --> F1[多環(huán)境配置
（開發(fā)/測試/生產(chǎn)隔離）]
    F --> F2[企業(yè)級架構(gòu)
（變量驗證→結(jié)構(gòu)化整合→應(yīng)用調(diào)用）]
    F --> F3[Docker部署
（ENV指令注入變量）]
    %% 問題排查分支
    G --> G1[變量未定義
（檢查定義/加載順序）]
    G --> G2[環(huán)境不匹配
（核對NODE_ENV）]
    G --> G3[拼寫錯誤
（檢查變量名大小寫）]
    %% 樣式設(shè)置
    classDef center fill:#fff2cc,stroke:#ffc107,stroke-width:3px;
    classDef branch fill:#e6f7ff,stroke:#1890ff,stroke-width:2px;
    class A center;
    class B,C,D,E,F,G branch;