# MongoDB cluster
> [HTML Version](configure-mongodb.html)
The article describes the installation of MongoDB 6.0 for the Ubuntu Linux 22.04 OS. For supported MongoDB versions, see [System requirements for BRIX On-Premises](elma365-enterprise-on-premises.md#mongo). You can also refer to the guide in the [official MongoDB documentation](https://www.mongodb.com/docs/manual/installation/).
````
начало внимание
````
In this example, the database name is **brix365**, the user is **brix365**, and the password is **SecretPassword**. When configuring the cluster, set these data according to the security policy adopted in your organization.
````
конец внимание
````
The installation consists of 7 steps:
1. [Prepare the nodes (servers)](#preparation-node).
2. [Install MongoDB](#installation-mongodb).
3. [Configure MongoDB](#setting-mongodb).
4. [Configure connection to MongoDB](#setting-connection-to-mongodb).
5. [Initialize the replica](#initialization-replica).
6. [MongoDB security](#safety-mongodb).
7. [Connect to MongoDB](#connection-to-mongodb).
## Step 1: Prepare the nodes (servers)
````
Начало внимание
````
The minimum number of servers to organize a cluster is three.
````
Конец внимание
1. ````
Create three nodes (servers) with sequentially numbered host name:
- **mongodb-server1.your\_domain**;
- **mongodb-server2.your\_domain**;
- **mongodb-server3.your\_domain**.
2. Create the necessary host name mappings in DNS. If this is not possible, add the required entries to** **\[OBJECT\].
## Step 2: Install MongoDB
1. To install MongoDB on each node, add the official repository::
````
sudo apt-get install gnupg
curl -fsSL https://pgp.mongodb.com/server-6.0.asc | sudo gpg -o /usr/share/keyrings/mongodb-server-6.0.gpg --dearmor
echo "deb \[ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-6.0.gpg \] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/6.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list
sudo apt-get update
2. ````
Install MongoDB on each node:
````
sudo apt install mongodb-org
3. ````
Start MongoDB on each node:
````
sudo systemctl enable --now mongod
## ````
Step 3: Configure MongoDB
````
начало примечание
````
**Note**
For the password, the following characters are allowed:
- Uppercase Latin letters: A to Z
- Lowercase Latin letters: a to z
- Digits: 0 to 9
- Symbols: -\_
Reserved (invalid) symbols:
\! \* ' ( ) ; : @ \& = + \$ , / ? % # \[ \]
````
конец примечание
````
The following actions are performed on the** mongodb-server1.your\_domain **node:
1. Enter **mongosh** (Command Line Interface) and create a database:
````
mongosh
2. ````
Use the brix365 database. If the database is missing, create it:
````
use brix365
3. ````
Create a separate user **brix365** to work with the database with the password **SecretPassword**. The username and password are provided for example purposes::
````
db.createUser(\{user:'brix365', pwd:'SecretPassword', roles:\[\{role:"readWrite", db:"brix365"\},\{"role":"root", "db":"admin"\}\]\})
4. ````
Ensure the user is created:
````
show users
5. ````
Create a superuser to enable authentication:
````
use admin
db.createUser(\{user:'superuser', pwd:'SecretPassword', roles: \["root"\]\})
6. ````
Ensure the user is created:
````
show users
7. ````
Finish the configuration:
````
exit
## ````
Step 4: Configure connection to MongoDB
1. Make changes to the configuration file \[OBJECT\] on each node:
````
sudo nano /etc/mongod.conf
2. ````
Configure the variable values:
- **bindIp** is the list of addresses from which connections on port 27017 can be accepted (in this case, it makes the MongoDB service accessible from all external addresses).
- **replSetName** is the replica name, by default **rs0**.
````
. . .
\# network interfaces
net:
port: 27017
bindIp: 0.0.0.0
. . .
replication:
replSetName: "rs0"
enableMajorityReadConcern: true
. . .
````
Configuring TLS/SSL in MongoDB
To enable TLS/SSL support in MongoDB, follow these steps:
1. Prepare a fullchain certificate. See the [Create a fullchain certificate](fullchain-sertificate.md) article for instructions on how to do this.
2. Copy the contents of the **your\_domain.key** private key into **mongodb.pem**:
````
cat your\_domain.key > mongodb.pem
3. ````
Copy the contents of the fullchain certificate into **mongodb.pem**.
````
cat fullchain\_your\_domain.pem >> mongodb.pem
4. ````
Add a configuration block for net on each node. In the **net.tls.certificateKeyFile** parameter, specify the path to the **PEM** file containing the fullchain certificates and associated private keys. Each node has unique domain names, and certificates must be issued for each node.
````
net:
tls:
mode: requireTLS
certificateKeyFile: /path/to/mongodb.pem
````
For more detailed information on configuring TLS/SSL in MongoDB, refer to the [official MongoDB documentation](https://www.mongodb.com/docs/v5.0/tutorial/configure-ssl/).
3. Restart MongoDB on each node for the changes to take effect:
````
sudo systemctl restart mongod
## ````
Step 5: Initialize the replica
The following actions are performed on the** mongodb-server1.your\_domain **node:
1. Open the **mongosh** console for configuration.
To connect to MongoDB, execute the following command:
````
sudo mongosh -u superuser admin
````
To connect to MongoDB with TLS/SSL enabled:
````
sudo mongosh -u superuser --tls --host mongodb-server1.your\_domain --tlsCAFile /etc/ssl/CA.pem
2. ````
Initialize the replica:
````
rs.initiate(\{ \_id: "rs0", members: \[\{ \_id: 0, host: "mongodb-server1.your\_domain" \},\{ \_id: 1, host: "mongodb-server2.your\_domain" \},\{ \_id: 2, host: "mongodb-server3.your\_domain" \}\]\})
3. ````
Check the configuration:
````
rs.conf()
## ````
Step 6: MongoDB security
1. Create and specify permissions for the file with the shared authentication key. All **Replica Set** members will use this key to communicate with each other:
````
openssl rand -base64 756 > /var/lib/mongodb/keyfile
chmod 400 /var/lib/mongodb/keyfile
chown mongodb:mongodb /var/lib/mongodb/keyfile
2. ````
Copy the key file to each replica.
````
начало внимание
````
The contents of the key file on all nodes must be identical while preserving access rights.
````
конец внимание
3. ````
Enable secure access to the MongoDB server if it is in an open zone.
4. To configure, edit the \[OBJECT\] file on each of the servers. The lines should look like this:
````
. . .
setParameter:
enableLocalhostAuthBypass: false
security:
authorization: "enabled"
keyFile: /var/lib/mongodb/keyfile
. . .
4. ````
Restart MongoDB on each node:
````
sudo systemctl restart mongod
5. ````
Open the **mongosh** console using the user for MongoDB access.
To connect to MongoDB, execute the command:
````
sudo mongosh -u superuser
````
To connect to MongoDB with TLS/SSL enabled:
````
sudo mongosh -u superuser --tls --host mongodb-server1.your\_domain --tlsCAFile /etc/ssl/CA.pem
6. ````
Check the configuration:
````
rs.conf()
## ````
Step 7: Connect to MongoDB
Connection string to connect to MongoDB:
````
mongodb://brix365:SecretPassword@mongodb-server1.your\_domain:27017,mongodb-server2.your\_domain:27017,mongodb-server3.your\_domain:27017/brix365?replicaSet=rs0\&readPreference=nearest\&maxStalenessSeconds=120
````
Connection string to connect to MongoDB with TLS/SSL:
````
mongodb://brix365:SecretPassword@mongodb-server1.your\_domain:27017,mongodb-server2.your\_domain:27017,mongodb-server3.your\_domain:27017/brix365?ssl=true\&replicaSet=rs0\&readPreference=nearest\&maxStalenessSeconds=120
## ````
Prepare a MongoDB database for restoration
If you need to restore a database from backup, first prepare the database for restoration. For more details, refer to the article [MongoDB](mongodb.md#prepare-to-restore).