Docs / MongoDB

Connect MongoDB

Document database

MongoDB stores data as JSON-like documents. climpt connects with a user holding the built-in read role, which covers every non-system collection in a database and permits no writes.

Credentials

Host
Hostname or IP, for example mongo.example.com.
Port
27017 unless you have changed it.
Database
The database to query. Users authenticate against the database they were created in, so this is usually the same one.
Username
The read-only user created below.
Password
That user’s password.

Before you start

Authentication must be on. In mongod.conf that is security.authorization: enabled. A MongoDB reachable over a network without it is open to anyone who can route to the port.

Creating a read-only user

Connect with mongosh as an admin.

use analytics;

db.createUser({
  user: "climpt_readonly",
  pwd:  "strong_password_here",
  roles: [ { role: "read", db: "analytics" } ]
});

Then confirm the account works and cannot write:

mongosh --host mongo.example.com --port 27017 \
  -u climpt_readonly -p 'strong_password_here' \
  --authenticationDatabase analytics

TLS

net:
  tls:
    mode: requireTLS
    certificateKeyFile: /path/to/server.pem
    CAFile: /path/to/ca.pem

Also set net.bindIp to the interfaces you actually serve on rather than 0.0.0.0, and open port 27017 only to the addresses that need it.

MongoDB Atlas

Atlas differs enough from self-hosted to be worth listing separately, though the concepts map one to one.

  • Connection string — Dashboard → Connect → Connect your application. Atlas uses the mongodb+srv:// protocol, which discovers hosts through DNS.
  • Network access — add our address under Network Access.
  • TLS — on by default, nothing to configure.
  • User — create one under Database Access and pick the built-in Read Only role, which is the same thing as read.

Worth knowing

  • The read role covers all non-system collections in one database. For tighter scope, use collection-level privileges instead.
  • MongoDB 4.0 and later authenticate with SCRAM-SHA-256 by default.
  • Rotate the password roughly every 90 days.