allow google oauth environment variables for self hosted

[drew-harris]

• modifies config.clj to allow for google oauth client id and secret
• slightly more complicated diff because in the .edn file the google config is a nested object

tested e2e with a fresh google oauth pair and the docker-compose.local.yml file

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds optional Google OAuth configuration for the dashboard, including server-side validation, self-hosting deployment wiring, environment examples, and setup documentation with the required redirect URI.

Changes

Dashboard Google OAuth

Layer / File(s)	Summary
Server OAuth configuration and validation server/src/instant/config.clj, server/test/instant/config_test.clj	OAuth credentials are read from environment variables, validated as a pair, obfuscated when supplied, resolved during initialization, and covered by tests.
Self-hosting credential propagation self-hosting/docker-compose*.yml, self-hosting/swarm.yml, self-hosting/deploy-swarm.sh	Compose and Swarm configurations pass the optional Google OAuth client ID and secret to the server, defaulting to empty values when unset.
Self-hosting OAuth setup documentation self-hosting/.env.example, client/www/app/docs/self-hosting/page.md	Examples and deployment documentation describe the OAuth variables, Google Cloud setup, and the ${INSTANT_BACKEND_URL}/dash/oauth/callback redirect URI.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• instantdb/instant#2729: Both changes update Swarm env -i whitelisting for deployment environment variables.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main change: enabling Google OAuth environment variables for self-hosted deployments.
Description check	✅ Passed	The description is directly about the config changes and self-hosted Google OAuth support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch drewh/google-oauth-self-hosted

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

self-hosting/docker-compose.local.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

self-hosting/docker-compose.with-caddy.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

self-hosting/docker-compose.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

• 1 others

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

server/test/instant/config_test.clj (1)

6-28: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover the zero-arity path and startup validation.

These tests exercise only the two-argument helper, so they would still pass if environment lookup or the new init validation call regressed. Add coverage for the zero-argument path and an init test that verifies validation is invoked.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/test/instant/config_test.clj` around lines 6 - 28, Extend
google-oauth-client-test to cover the zero-argument
config/get-google-oauth-client path, preserving the existing fallback and
override expectations. Add an init-focused test that verifies startup invokes
the Google OAuth configuration validation, using the relevant init and
validation symbols and stubbing dependencies as needed.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@server/test/instant/config_test.clj`:
- Around line 6-28: Extend google-oauth-client-test to cover the zero-argument
config/get-google-oauth-client path, preserving the existing fallback and
override expectations. Add an init-focused test that verifies startup invokes
the Google OAuth configuration validation, using the relevant init and
validation symbols and stubbing dependencies as needed.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 8f517eb8-963b-4a57-a709-81bfb2065fb1

📥 Commits

Reviewing files that changed from the base of the PR and between efb502b and 6e68bed.

📒 Files selected for processing (9)

• client/www/app/docs/self-hosting/page.md
• self-hosting/.env.example
• self-hosting/deploy-swarm.sh
• self-hosting/docker-compose.local.yml
• self-hosting/docker-compose.with-caddy.yml
• self-hosting/docker-compose.yml
• self-hosting/swarm.yml
• server/src/instant/config.clj
• server/test/instant/config_test.clj

[github-actions]

View Vercel preview at instant-www-js-drewh-google-oauth-self-hosted-jsv.vercel.app.

[dwwoelfel]

LGTM