Use ConfigService

Read decrypted secrets through NestJS ConfigService.

Prefer NestJS ConfigService? Keep the Dotenvx scripts from Ship and add @nestjs/config.

$ npm install @nestjs/config

$ pnpm add @nestjs/config

In your AppModule, import ConfigModule and add this to the module's imports array:

import { ConfigModule } from '@nestjs/config';

// Inside @Module({ imports: [...] })
ConfigModule.forRoot({
  isGlobal: true,
  ignoreEnvFile: true,
})

Dotenvx already decrypts your secrets into process.env. Setting ignoreEnvFile prevents ConfigModule from reading the encrypted file again.

Use ConfigService in your app's service:

// src/app.service.ts
import { Injectable } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';

@Injectable()
export class AppService {
  constructor(private readonly config: ConfigService) {}

  getHello(): string {
    return `Hello ${this.config.get<string>('HELLO')}`;
  }
}

Run npm start or pnpm start and visit http://localhost:3000 to see Hello Secret. The same setup works with the production script.