currents-dev · twk3 · Jan 10, 2026 · Jan 10, 2026
diff --git a/on-prem/.env.example b/on-prem/.env.example
@@ -30,6 +30,16 @@
 REDIS_URI=redis://redis:6379
 REDIS_URI_SLAVE=redis://redis:6379
 
+# =============================================================================
+# MongoDB Configuration
+# =============================================================================
+# Connection settings
+MONGODB_USERNAME=currents-user
+# Password generated by setup.sh
+MONGODB_PASSWORD=
+MONGODB_DATABASE=currents
+MONGODB_URI=mongodb://${MONGODB_USERNAME}:${MONGODB_PASSWORD}@mongodb:27017/${MONGODB_DATABASE}?authSource=admin&replicaSet=rs0
+
 # =============================================================================
 # Object Storage (RustFS / S3)
 # =============================================================================

diff --git a/on-prem/docker-compose.cache.yml b/on-prem/docker-compose.cache.yml
@@ -25,7 +25,6 @@ services:
       - CURRENTS_ENV=onprem
       - API_URL="http://localhost:4000/v1"
       - APP_BASE_URL=http://localhost:4000
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
     depends_on:
       redis:
         condition: service_started
@@ -45,7 +44,6 @@ services:
     environment:
       - CURRENTS_ENV=onprem
       - INCLUDE_DASHBOARD=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
       - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000
       - CURRENTS_RECORD_API_URL=http://localhost:1234
@@ -62,7 +60,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
     depends_on:
       redis:
@@ -77,7 +74,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
     depends_on:
@@ -93,7 +89,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
       - RUN_STARTUP_TASKS=true
     volumes:
@@ -111,7 +106,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - DASHBOARD_URL=http://localhost:4000
     depends_on:
       redis:

diff --git a/on-prem/docker-compose.database.yml b/on-prem/docker-compose.database.yml
@@ -25,7 +25,6 @@ services:
       - CURRENTS_ENV=onprem
       - API_URL="http://localhost:4000/v1"
       - APP_BASE_URL=http://localhost:4000
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
     depends_on:
       clickhouse:
         condition: service_healthy
@@ -51,7 +50,6 @@ services:
     environment:
       - CURRENTS_ENV=onprem
       - INCLUDE_DASHBOARD=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
       - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000
       - CURRENTS_RECORD_API_URL=http://localhost:1234
@@ -74,7 +72,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
     depends_on:
       clickhouse:
@@ -95,7 +92,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
     depends_on:
@@ -117,7 +113,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
       - RUN_STARTUP_TASKS=true
     volumes:
@@ -141,7 +136,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - DASHBOARD_URL=http://localhost:4000
     depends_on:
       clickhouse:
@@ -180,22 +174,60 @@ services:
       - ${DC_CLICKHOUSE_VOLUME:-./data/clickhouse}:/var/lib/clickhouse
   mongodb:
     hostname: mongodb
-    image: mongo:7.0.0
+    image: mongo:8.2.3
     expose:
       - 27017
     ports:
       - 27017:27017
     restart: unless-stopped
-    entrypoint: ['/usr/bin/mongod', '--bind_ip_all', '--replSet', 'rs0']
+    entrypoint:
+      - bash
+      - -c
+      - |
+        # Generate keyFile if it doesn't exist
+        KEYFILE=/data/db/replica.key
+        if [ ! -f "$$KEYFILE" ]; then
+          echo "Generating MongoDB replica set keyFile..."
+          openssl rand -base64 756 > "$$KEYFILE"
+        fi
+        chmod 400 "$$KEYFILE"
+        chown mongodb:mongodb "$$KEYFILE"
+
+        # Call original Docker entrypoint (handles MONGO_INITDB_* user creation)
+        exec docker-entrypoint.sh mongod --bind_ip_all --replSet rs0 --auth --keyFile "$$KEYFILE"
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MONGODB_USERNAME}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD}
     networks:
       - default
+    post_start:
+      - command:
+          - bash
+          - -c
+          - |
+            echo 'Waiting for MongoDB to be ready...'
+            until mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval "db.adminCommand('ping')" 2>/dev/null; do sleep 1; done
+
+            echo 'Initializing replica set...'
+            mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval "
+              try {
+                rs.status();
+                print('Replica set already initialized');
+              } catch (err) {
+                rs.initiate({_id:'rs0', members:[{_id:0, host:'mongodb:27017'}]});
+                print('Replica set initialized');
+              }
+            "
+
+            echo 'MongoDB initialization complete'
     healthcheck:
       test:
         - 'CMD-SHELL'
-        - (echo "try { rs.status() } catch (err) { rs.initiate({_id:'rs0',members:[{_id:0,host:'mongodb:27017'}]}) }" | mongosh localhost:27017 --quiet) && mongosh --eval 'db.runCommand("ping").ok' localhost:27017 --quiet
-      interval: 2s
+        - mongosh --quiet --eval "db.runCommand('ping').ok" localhost:27017
+      interval: 5s
       timeout: 5s
       retries: 10
+      start_period: 10s
     volumes:
       - ${DC_MONGODB_VOLUME:-./data/mongodb}:/data/db
   redis:

diff --git a/on-prem/docker-compose.full.yml b/on-prem/docker-compose.full.yml
@@ -25,7 +25,6 @@ services:
       - CURRENTS_ENV=onprem
       - API_URL="http://localhost:4000/v1"
       - APP_BASE_URL=http://localhost:4000
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
     depends_on:
       clickhouse:
         condition: service_healthy
@@ -51,7 +50,6 @@ services:
     environment:
       - CURRENTS_ENV=onprem
       - INCLUDE_DASHBOARD=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
       - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000
       - CURRENTS_RECORD_API_URL=http://localhost:1234
@@ -74,7 +72,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
     depends_on:
       clickhouse:
@@ -95,7 +92,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
     depends_on:
@@ -117,7 +113,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
       - RUN_STARTUP_TASKS=true
     volumes:
@@ -141,7 +136,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - DASHBOARD_URL=http://localhost:4000
     depends_on:
       clickhouse:
@@ -180,22 +174,60 @@ services:
       - ${DC_CLICKHOUSE_VOLUME:-./data/clickhouse}:/var/lib/clickhouse
   mongodb:
     hostname: mongodb
-    image: mongo:7.0.0
+    image: mongo:8.2.3
     expose:
       - 27017
     ports:
       - 27017:27017
     restart: unless-stopped
-    entrypoint: ['/usr/bin/mongod', '--bind_ip_all', '--replSet', 'rs0']
+    entrypoint:
+      - bash
+      - -c
+      - |
+        # Generate keyFile if it doesn't exist
+        KEYFILE=/data/db/replica.key
+        if [ ! -f "$$KEYFILE" ]; then
+          echo "Generating MongoDB replica set keyFile..."
+          openssl rand -base64 756 > "$$KEYFILE"
+        fi
+        chmod 400 "$$KEYFILE"
+        chown mongodb:mongodb "$$KEYFILE"
+
+        # Call original Docker entrypoint (handles MONGO_INITDB_* user creation)
+        exec docker-entrypoint.sh mongod --bind_ip_all --replSet rs0 --auth --keyFile "$$KEYFILE"
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: ${MONGODB_USERNAME}
+      MONGO_INITDB_ROOT_PASSWORD: ${MONGODB_PASSWORD}
     networks:
       - default
+    post_start:
+      - command:
+          - bash
+          - -c
+          - |
+            echo 'Waiting for MongoDB to be ready...'
+            until mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval "db.adminCommand('ping')" 2>/dev/null; do sleep 1; done
+
+            echo 'Initializing replica set...'
+            mongosh -u $$MONGO_INITDB_ROOT_USERNAME -p $$MONGO_INITDB_ROOT_PASSWORD --authenticationDatabase admin --quiet --eval "
+              try {
+                rs.status();
+                print('Replica set already initialized');
+              } catch (err) {
+                rs.initiate({_id:'rs0', members:[{_id:0, host:'mongodb:27017'}]});
+                print('Replica set initialized');
+              }
+            "
+
+            echo 'MongoDB initialization complete'
     healthcheck:
       test:
         - 'CMD-SHELL'
-        - (echo "try { rs.status() } catch (err) { rs.initiate({_id:'rs0',members:[{_id:0,host:'mongodb:27017'}]}) }" | mongosh localhost:27017 --quiet) && mongosh --eval 'db.runCommand("ping").ok' localhost:27017 --quiet
-      interval: 2s
+        - mongosh --quiet --eval "db.runCommand('ping').ok" localhost:27017
+      interval: 5s
       timeout: 5s
       retries: 10
+      start_period: 10s
     volumes:
       - ${DC_MONGODB_VOLUME:-./data/mongodb}:/data/db
   redis:

diff --git a/on-prem/scripts/setup.sh b/on-prem/scripts/setup.sh
@@ -71,6 +71,12 @@ setup_env_file() {
         sed -i.bak "s|^CLICKHOUSE_CURRENTS_PASSWORD=.*|CLICKHOUSE_CURRENTS_PASSWORD=$CLICKHOUSE_CURRENTS|" "$ENV_FILE"
     fi
 
+    # Generate MONGODB_PASSWORD
+    MONGODB_PASS=$("$SCRIPT_DIR/generate-secrets.sh" token 32)
+    if grep -q "^MONGODB_PASSWORD=" "$ENV_FILE"; then
+        sed -i.bak "s|^MONGODB_PASSWORD=.*|MONGODB_PASSWORD=$MONGODB_PASS|" "$ENV_FILE"
+    fi
+
     # Generate GITLAB_STATE_SECRET (RSA private key, base64 encoded)
     GITLAB_KEY_FILE="$ON_PREM_DIR/.gitlab-key.pem"
     if [ ! -f "$GITLAB_KEY_FILE" ]; then

diff --git a/on-prem/templates/compose.currents.yml b/on-prem/templates/compose.currents.yml
@@ -17,7 +17,6 @@ services:
       - CURRENTS_ENV=onprem
       - API_URL="http://localhost:4000/v1"
       - APP_BASE_URL=http://localhost:4000
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
 
   api:
     hostname: api
@@ -34,7 +33,6 @@ services:
     environment:
       - CURRENTS_ENV=onprem
       - INCLUDE_DASHBOARD=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
       - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000
       - CURRENTS_RECORD_API_URL=http://localhost:1234
@@ -48,7 +46,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
 
   write-worker:
@@ -60,7 +57,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - AUTOMATED_REPORTS_CURRENTS_DASHBOARD_HOSTNAME=http://host.docker.internal:4000
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
 
@@ -73,7 +69,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - CLICKHOUSE_PASSWORD=${CLICKHOUSE_CURRENTS_PASSWORD}
       - RUN_STARTUP_TASKS=true
     volumes:
@@ -88,7 +83,6 @@ services:
       - .env
     environment:
       - CURRENTS_ENV=onprem
-      - MONGODB_URI=mongodb://host.docker.internal:27017/?readPreference=primary&directConnection=true&ssl=false
       - DASHBOARD_URL=http://localhost:4000
 
 networks: