EC2构建NestJS Docker镜像时OAuth2环境变量配置错误

错误日志 #

[Nest] 1  - 07/07/2024, 9:31:03 AM   ERROR [ExceptionHandler] OAuth2Strategy requires a clientID option
TypeError: OAuth2Strategy requires a clientID option
    at GoogleStrategy.OAuth2Strategy (/usr/src/app/node_modules/passport-oauth2/lib/strategy.js:83:34)
    at new Strategy (/usr/src/app/node_modules/passport-google-oauth20/lib/strategy.js:52:18)
    at new MixinStrategy (/usr/src/app/node_modules/@nestjs/passport/dist/passport/passport.strategy.js:32:13)
    at new GoogleStrategy (/usr/src/app/dist/auth/utils/strategies/google.strategy.js:23:9)
    at Injector.instantiateClass (/usr/src/app/node_modules/@nestjs/core/injector/injector.js:365:19)
    at callback (/usr/src/app/node_modules/@nestjs/core/injector/injector.js:65:45)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Injector.resolveConstructorParams (/usr/src/app/node_modules/@nestjs/core/injector/injector.js:144:24)
    at async Injector.loadInstance (/usr/src/app/node_modules/@nestjs/core/injector/injector.js:70:13)
    at async Injector.loadProvider (/usr/src/app/node_modules/@nestjs/core/injector/injector.js:97:9)

相关配置代码 #

docker-compose.yaml #

version: '3'

services:
  backend:
    build: ./
    container_name: EZCryptoExchange
    environment:
      - GOOGLE_CLIENTID=XXXXXXX.apps.googleusercontent.com
      - GOOGLE_SECRET=XXXXXXXXX
      - APP_PORT=3001
      - GOOGLE_CALLBACK_URL="http://localhost:3001/api/auth/google/redirect"
      - KAKAO_CLIENTID=XXXXXXXXXX
      - KAKAO_SECRET=XXXXXXXXX
      - KAKAO_CALLBACK_URL="http://localhost:3001/api/auth/kakao/redirect"
      - SESSION_SECRET=XXXXXXXXXXXXXXX
      - KAKAOPAY_SECRET=XXXXXXXXXXXXXX
    ports:
      -"3001:3001"

GoogleStrategy实现代码 #

@Injectable()
export class GoogleStrategy extends PassportStrategy(Strategy) {
    constructor(
        private readonly configService: ConfigService,
        @Inject('AUTH_SERVICE') private readonly authService: AuthService,
    ) {
        super({
            clientID: process.env.GOOGLE_CLIENTID,
            clientSecret: process.env.GOOGLE_SECRET,
            callbackURL: process.env.GOOGLE_CALLBACK_URL,
            scope: ['profile', 'email'],
        });    
    }

    async validate(accessToken: string, refreshToken: string, profile: Profile) {
        console.log(profile)
        const user = await this.authService.validateUser({
            email: profile.emails[0].value, 
            displayName: profile.displayName, 
            walletPrivateKey: "1", 
            walletAddress: "1"
        })
        return user || null; 
    }
}

排查与解决方法 #

1. 修复docker-compose.yaml格式错误 #

配置文件存在两处语法问题，直接导致环境变量无法正常解析：

• 端口映射缺少空格：ports字段下的-"3001:3001"需改为- "3001:3001"
• 环境变量引号转义错误：GOOGLE_CALLBACK_URL和KAKAO_CALLBACK_URL中的"是无效转义，直接去掉引号（值无空格时无需引号）或使用普通双引号即可。

修正后的关键配置片段：

environment:
  - GOOGLE_CLIENTID=XXXXXXX.apps.googleusercontent.com
  - GOOGLE_SECRET=XXXXXXXXX
  - APP_PORT=3001
  - GOOGLE_CALLBACK_URL=http://localhost:3001/api/auth/google/redirect
  - KAKAO_CLIENTID=XXXXXXXXXX
  - KAKAO_SECRET=XXXXXXXXX
  - KAKAO_CALLBACK_URL=http://localhost:3001/api/auth/kakao/redirect
  - SESSION_SECRET=XXXXXXXXXXXXXXX
  - KAKAOPAY_SECRET=XXXXXXXXXXXXXX
ports:
  - "3001:3001"

2. 验证容器环境变量是否生效 #

启动容器后，执行以下命令进入容器检查环境变量：

docker exec -it EZCryptoExchange env

确认输出中存在GOOGLE_CLIENTID等配置的变量，若不存在则需重新检查docker-compose配置格式。

3. 排查Dockerfile是否干扰环境变量 #

若Dockerfile中存在COPY .env .或ENV指令覆盖相关变量，会导致docker-compose的环境变量失效。确保Dockerfile未复制本地.env文件到容器，也未手动设置冲突的环境变量。

4. （可选）统一使用NestJS ConfigService读取变量 #

代码中已注入ConfigService但未使用，建议通过它读取环境变量，避免直接依赖process.env，同时确保根模块正确配置ConfigModule：

// 根模块配置
@Module({
  imports: [ConfigModule.forRoot({ isGlobal: true })],
})
export class AppModule {}

// GoogleStrategy中修改为ConfigService读取
super({
  clientID: this.configService.get('GOOGLE_CLIENTID'),
  clientSecret: this.configService.get('GOOGLE_SECRET'),
  callbackURL: this.configService.get('GOOGLE_CALLBACK_URL'),
  scope: ['profile', 'email'],
});

内容的提问来源于stack exchange，提问作者김민겸