From ee6b319ec945aeec3c7cbb5f28d24c21af108193 Mon Sep 17 00:00:00 2001 From: DJ Mountney Date: Fri, 9 Jan 2026 16:24:59 -0800 Subject: [PATCH] chore: Setup mongo to use auth --- on-prem/.env.example | 10 +++++ on-prem/docker-compose.cache.yml | 6 --- on-prem/docker-compose.database.yml | 52 +++++++++++++++++++++----- on-prem/docker-compose.full.yml | 52 +++++++++++++++++++++----- on-prem/scripts/setup.sh | 6 +++ on-prem/templates/compose.currents.yml | 6 --- on-prem/templates/compose.mongodb.yml | 46 +++++++++++++++++++++-- 7 files changed, 142 insertions(+), 36 deletions(-) diff --git a/on-prem/.env.example b/on-prem/.env.example index bdbcbc5..53822ce 100644 --- a/on-prem/.env.example +++ b/on-prem/.env.example @@ -30,6 +30,16 @@ REDIS_URI=redis://redis:6379 REDIS_URI_SLAVE=redis://redis:6379 +# ============================================================================= +# MongoDB Configuration +# ============================================================================= +# Connection settings +MONGODB_USERNAME=currents-user +# Password generated by setup.sh +MONGODB_PASSWORD= +MONGODB_DATABASE=currents +MONGODB_URI=mongodb://${MONGODB_USERNAME}:${MONGODB_PASSWORD}@mongodb:27017/${MONGODB_DATABASE}?authSource=admin&replicaSet=rs0 + # ============================================================================= # Object Storage (RustFS / S3) # ============================================================================= diff --git a/on-prem/docker-compose.cache.yml b/on-prem/docker-compose.cache.yml index 3568e12..4944bf6 100644 --- a/on-prem/docker-compose.cache.yml +++ b/on-prem/docker-compose.cache.yml @@ -25,7 +25,6 @@ services: - CURRENTS_ENV=onprem - API_URL="http://localhost:4000/v1" - APP_BASE_URL=http://localhost:4000 - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false depends_on: redis: condition: service_started @@ -45,7 +44,6 @@ services: environment: - CURRENTS_ENV=onprem - INCLUDE_DASHBOARD=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000 - CURRENTS_RECORD_API_URL=http://localhost:1234 @@ -62,7 +60,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} depends_on: redis: @@ -77,7 +74,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000 - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} depends_on: @@ -93,7 +89,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} - RUN_STARTUP_TASKS=true volumes: @@ -111,7 +106,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - DASHBOARD_URL=http://localhost:4000 depends_on: redis: diff --git a/on-prem/docker-compose.database.yml b/on-prem/docker-compose.database.yml index e34d300..5ecd837 100644 --- a/on-prem/docker-compose.database.yml +++ b/on-prem/docker-compose.database.yml @@ -25,7 +25,6 @@ services: - CURRENTS_ENV=onprem - API_URL="http://localhost:4000/v1" - APP_BASE_URL=http://localhost:4000 - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false depends_on: clickhouse: condition: service_healthy @@ -51,7 +50,6 @@ services: environment: - CURRENTS_ENV=onprem - INCLUDE_DASHBOARD=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000 - CURRENTS_RECORD_API_URL=http://localhost:1234 @@ -74,7 +72,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} depends_on: clickhouse: @@ -95,7 +92,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000 - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} depends_on: @@ -117,7 +113,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} - RUN_STARTUP_TASKS=true volumes: @@ -141,7 +136,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - DASHBOARD_URL=http://localhost:4000 depends_on: clickhouse: @@ -180,22 +174,60 @@ services: - ${DC_CLICKHOUSE_VOLUME:-./data/clickhouse}:/var/lib/clickhouse mongodb: hostname: mongodb - image: mongo:7.0.0 + image: mongo:8.2.3 expose: - 27017 ports: - 27017:27017 restart: unless-stopped - entrypoint: ['/usr/bin/mongod', '--bind_ip_all', '--replSet', 'rs0'] + entrypoint: + - bash + - -c + - | + # Generate keyFile if it doesn't exist + KEYFILE=/data/db/replica.key + if [ ! -f "$$KEYFILE" ]; then + echo "Generating MongoDB replica set keyFile..." + openssl rand -base64 756 > "$$KEYFILE" + fi + chmod 400 "$$KEYFILE" + chown mongodb:mongodb "$$KEYFILE" + + # Call original Docker entrypoint (handles MONGO_INITDB_* user creation) + exec docker-entrypoint.sh mongod --bind_ip_all --replSet rs0 --auth --keyFile "$$KEYFILE" + environment: + MONGO_INITDB_ROOT_USERNAME: ${MONGODB_USERNAME} + MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD} networks: - default + post_start: + - command: + - bash + - -c + - | + echo 'Waiting for MongoDB to be ready...' + until mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval "db.adminCommand('ping')" 2>/dev/null; do sleep 1; done + + echo 'Initializing replica set...' + mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval " + try { + rs.status(); + print('Replica set already initialized'); + } catch (err) { + rs.initiate({_id:'rs0', members:[{_id:0, host:'mongodb:27017'}]}); + print('Replica set initialized'); + } + " + + echo 'MongoDB initialization complete' healthcheck: test: - 'CMD-SHELL' - - (echo "try { rs.status() } catch (err) { rs.initiate({_id:'rs0',members:[{_id:0,host:'mongodb:27017'}]}) }" | mongosh localhost:27017 --quiet) && mongosh --eval 'db.runCommand("ping").ok' localhost:27017 --quiet - interval: 2s + - mongosh --quiet --eval "db.runCommand('ping').ok" localhost:27017 + interval: 5s timeout: 5s retries: 10 + start_period: 10s volumes: - ${DC_MONGODB_VOLUME:-./data/mongodb}:/data/db redis: diff --git a/on-prem/docker-compose.full.yml b/on-prem/docker-compose.full.yml index 3556012..b94e3c0 100644 --- a/on-prem/docker-compose.full.yml +++ b/on-prem/docker-compose.full.yml @@ -25,7 +25,6 @@ services: - CURRENTS_ENV=onprem - API_URL="http://localhost:4000/v1" - APP_BASE_URL=http://localhost:4000 - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false depends_on: clickhouse: condition: service_healthy @@ -51,7 +50,6 @@ services: environment: - CURRENTS_ENV=onprem - INCLUDE_DASHBOARD=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000 - CURRENTS_RECORD_API_URL=http://localhost:1234 @@ -74,7 +72,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} depends_on: clickhouse: @@ -95,7 +92,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000 - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} depends_on: @@ -117,7 +113,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} - RUN_STARTUP_TASKS=true volumes: @@ -141,7 +136,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - DASHBOARD_URL=http://localhost:4000 depends_on: clickhouse: @@ -180,22 +174,60 @@ services: - ${DC_CLICKHOUSE_VOLUME:-./data/clickhouse}:/var/lib/clickhouse mongodb: hostname: mongodb - image: mongo:7.0.0 + image: mongo:8.2.3 expose: - 27017 ports: - 27017:27017 restart: unless-stopped - entrypoint: ['/usr/bin/mongod', '--bind_ip_all', '--replSet', 'rs0'] + entrypoint: + - bash + - -c + - | + # Generate keyFile if it doesn't exist + KEYFILE=/data/db/replica.key + if [ ! -f "$$KEYFILE" ]; then + echo "Generating MongoDB replica set keyFile..." + openssl rand -base64 756 > "$$KEYFILE" + fi + chmod 400 "$$KEYFILE" + chown mongodb:mongodb "$$KEYFILE" + + # Call original Docker entrypoint (handles MONGO_INITDB_* user creation) + exec docker-entrypoint.sh mongod --bind_ip_all --replSet rs0 --auth --keyFile "$$KEYFILE" + environment: + MONGO_INITDB_ROOT_USERNAME: ${MONGODB_USERNAME} + MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD} networks: - default + post_start: + - command: + - bash + - -c + - | + echo 'Waiting for MongoDB to be ready...' + until mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval "db.adminCommand('ping')" 2>/dev/null; do sleep 1; done + + echo 'Initializing replica set...' + mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval " + try { + rs.status(); + print('Replica set already initialized'); + } catch (err) { + rs.initiate({_id:'rs0', members:[{_id:0, host:'mongodb:27017'}]}); + print('Replica set initialized'); + } + " + + echo 'MongoDB initialization complete' healthcheck: test: - 'CMD-SHELL' - - (echo "try { rs.status() } catch (err) { rs.initiate({_id:'rs0',members:[{_id:0,host:'mongodb:27017'}]}) }" | mongosh localhost:27017 --quiet) && mongosh --eval 'db.runCommand("ping").ok' localhost:27017 --quiet - interval: 2s + - mongosh --quiet --eval "db.runCommand('ping').ok" localhost:27017 + interval: 5s timeout: 5s retries: 10 + start_period: 10s volumes: - ${DC_MONGODB_VOLUME:-./data/mongodb}:/data/db redis: diff --git a/on-prem/scripts/setup.sh b/on-prem/scripts/setup.sh index 29ef614..cf57fd6 100755 --- a/on-prem/scripts/setup.sh +++ b/on-prem/scripts/setup.sh @@ -71,6 +71,12 @@ setup_env_file() { sed -i.bak "s|^CLICKHOUSE_CURRENTS_PASSWORD=.*|CLICKHOUSE_CURRENTS_PASSWORD=$CLICKHOUSE_CURRENTS|" "$ENV_FILE" fi + # Generate MONGODB_PASSWORD + MONGODB_PASS=$("$SCRIPT_DIR/generate-secrets.sh" token 32) + if grep -q "^MONGODB_PASSWORD=" "$ENV_FILE"; then + sed -i.bak "s|^MONGODB_PASSWORD=.*|MONGODB_PASSWORD=$MONGODB_PASS|" "$ENV_FILE" + fi + # Generate GITLAB_STATE_SECRET (RSA private key, base64 encoded) GITLAB_KEY_FILE="$ON_PREM_DIR/.gitlab-key.pem" if [ ! -f "$GITLAB_KEY_FILE" ]; then diff --git a/on-prem/templates/compose.currents.yml b/on-prem/templates/compose.currents.yml index 14eb2c0..53d4c88 100644 --- a/on-prem/templates/compose.currents.yml +++ b/on-prem/templates/compose.currents.yml @@ -17,7 +17,6 @@ services: - CURRENTS_ENV=onprem - API_URL="http://localhost:4000/v1" - APP_BASE_URL=http://localhost:4000 - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false api: hostname: api @@ -34,7 +33,6 @@ services: environment: - CURRENTS_ENV=onprem - INCLUDE_DASHBOARD=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000 - CURRENTS_RECORD_API_URL=http://localhost:1234 @@ -48,7 +46,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} write-worker: @@ -60,7 +57,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000 - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} @@ -73,7 +69,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD} - RUN_STARTUP_TASKS=true volumes: @@ -88,7 +83,6 @@ services: - .env environment: - CURRENTS_ENV=onprem - - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false - DASHBOARD_URL=http://localhost:4000 networks: diff --git a/on-prem/templates/compose.mongodb.yml b/on-prem/templates/compose.mongodb.yml index 4ac23f9..a7b97a4 100644 --- a/on-prem/templates/compose.mongodb.yml +++ b/on-prem/templates/compose.mongodb.yml @@ -4,22 +4,60 @@ services: mongodb: hostname: mongodb - image: mongo:7.0.0 + image: mongo:8.2.3 expose: - 27017 ports: - 27017:27017 restart: unless-stopped - entrypoint: ['/usr/bin/mongod', '--bind_ip_all', '--replSet', 'rs0'] + entrypoint: + - bash + - -c + - | + # Generate keyFile if it doesn't exist + KEYFILE=/data/db/replica.key + if [ ! -f "$$KEYFILE" ]; then + echo "Generating MongoDB replica set keyFile..." + openssl rand -base64 756 > "$$KEYFILE" + fi + chmod 400 "$$KEYFILE" + chown mongodb:mongodb "$$KEYFILE" + + # Call original Docker entrypoint (handles MONGO_INITDB_* user creation) + exec docker-entrypoint.sh mongod --bind_ip_all --replSet rs0 --auth --keyFile "$$KEYFILE" + environment: + MONGO_INITDB_ROOT_USERNAME: ${MONGODB_USERNAME} + MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD} networks: - default + post_start: + - command: + - bash + - -c + - | + echo 'Waiting for MongoDB to be ready...' + until mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval "db.adminCommand('ping')" 2>/dev/null; do sleep 1; done + + echo 'Initializing replica set...' + mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval " + try { + rs.status(); + print('Replica set already initialized'); + } catch (err) { + rs.initiate({_id:'rs0', members:[{_id:0, host:'mongodb:27017'}]}); + print('Replica set initialized'); + } + " + + echo 'MongoDB initialization complete' healthcheck: test: - 'CMD-SHELL' - - (echo "try { rs.status() } catch (err) { rs.initiate({_id:'rs0',members:[{_id:0,host:'mongodb:27017'}]}) }" | mongosh localhost:27017 --quiet) && mongosh --eval 'db.runCommand("ping").ok' localhost:27017 --quiet - interval: 2s + - mongosh --quiet --eval "db.runCommand('ping').ok" localhost:27017 + interval: 5s timeout: 5s retries: 10 + start_period: 10s volumes: - ${DC_MONGODB_VOLUME:-./data/mongodb}:/data/db