## Configure Mongodb Config servers have physically no dependances on other mongodb services. They can be installed and configured on their own. module.exports = (service) -> options = service.options ## Identities # Group options.group = name: options.group if typeof options.group is 'string' options.group ?= {} options.group.name ?= 'mongod' options.group.system ?= true # User options.user = name: options.user if typeof options.user is 'string' options.user ?= {} options.user.name ?= 'mongod' options.user.gid = options.group.name options.user.system ?= true options.user.comment ?= 'MongoDB User' options.user.home ?= '/var/lib/mongod' options.user.limits ?= {} options.user.limits.nofile ?= 64000 options.user.limits.nproc ?= true # Configuration options.conf_dir ?= '/etc/mongod-config-server/conf' options.pid_dir ?= '/var/run/mongod' # MongoDB admin user options.admin ?= {} options.admin.name ?= 'admin' options.admin.password ?= 'admin123' options.root ?= {} options.root.name ?= 'root_admin' options.root.password ?= 'root123' # Misc options.fqdn ?= service.node.fqdn options.hostname = service.node.hostname options.iptables ?= service.deps.iptables and service.deps.iptables.options.action is 'start' options.clean_logs ?= false # Setting the role of mongod process as a mongodb config server options.config ?= {} options.config.sharding ?= {} options.config.sharding.clusterRole ?= 'configsvr' ## Logs options.config.systemLog ?= {} options.config.systemLog.destination ?= 'file' options.config.systemLog.logAppend ?= true options.config.systemLog.path ?= "/var/log/mongodb/mongod-config-server-#{service.node.hostname}.log" ## Storage From 3.2, config servers for sharded clusters can be deployed as a replica set. The replica set config servers must run the WiredTiger storage engine options.config.storage ?= {} options.config.storage.dbPath ?= "#{options.user.home}/configsrv/db" options.config.storage.journal ?= {} options.config.storage.journal.enabled ?= true options.config.storage.engine ?= 'wiredTiger' options.config.storage.repairPath ?= "#{options.config.storage.dbPath}/repair" unless options.config.storage.engine is 'wiredTiger' throw Error 'Need WiredTiger Storage for config server as replica set' unless options.config.storage.engine is 'wiredTiger' if options.config.storage.repairPath?.indexOf(options.config.storage.dbPath) is -1 throw Error 'Must use a repairpath that is a subdirectory of dbpath when using journaling' if options.config.storage.journal.enabled ## Process options.config.processManagement ?= {} options.config.processManagement.fork ?= true options.config.processManagement.pidFilePath ?= "#{options.pid_dir}/mongod-config-server-#{service.node.hostname}.pid" ## Network [Configuring][mongod-ssl] ssl for the mongod process. options.config.net ?= {} options.config.net.port ?= 27017 options.config.net.bindIp ?= '0.0.0.0' ## Security # Disables the apis options.config.net.http ?= {} options.config.net.http.enabled ?= false options.config.net.http.JSONPEnabled ?= false options.config.net.http.RESTInterfaceEnabled ?= false options.config.net.unixDomainSocket ?= {} options.config.net.unixDomainSocket.pathPrefix ?= "#{options.pid_dir}" options.config.security ?= {} options.config.security.clusterAuthMode ?= 'x509' ## SSL options.ssl = merge {}, service.deps.ssl?.options, options.ssl options.ssl.enabled = !!service.deps.ssl if options.ssl.enabled throw Error "Required Option: ssl.cert" if not options.ssl.cert throw Error "Required Option: ssl.key" if not options.ssl.key throw Error "Required Option: ssl.cacert" if not options.ssl.cacert switch options.config.security.clusterAuthMode when 'x509' throw Error 'can not use x509' unless options.ssl.enabled options.config.net.ssl ?= {} options.config.net.ssl.mode ?= 'preferSSL' options.config.net.ssl.PEMKeyFile ?= "#{options.conf_dir}/key.pem" options.config.net.ssl.PEMKeyPassword ?= "mongodb123" # use PEMkeyfile by default for membership authentication # options.config.net.ssl.clusterFile ?= "#{mongodb.configsrv.conf_dir}/cluster.pem" # this is the mongodb version of java truststore # options.config.net.ssl.clusterPassword ?= "mongodb123" options.config.net.ssl.CAFile ?= "#{options.conf_dir}/cacert.pem" options.config.net.ssl.allowConnectionsWithoutCertificates ?= false options.config.net.ssl.allowInvalidCertificates ?= false options.config.net.ssl.allowInvalidHostnames ?= false when 'keyFile' options.sharedsecret ?= 'sharedSecretForMongodbCluster' else throw Error ' unsupported cluster authentication Mode' ## ACL's options.config.security.authorization ?= 'enabled' ## Kerberos Kerberos authentication is only avaiable in enterprise edition. options.krb5 ?= {} options.krb5.realm ?= service.deps.krb5_client.options.etc_krb5_conf?.libdefaults?.default_realm # Admin Information options.krb5.admin ?= service.deps.krb5_client.options.admin[options.krb5.realm] options.config.security.sasl ?= {} options.config.security.sasl.hostName ?= service.node.fqdn options.config.security.sasl.serviceName ?= 'mongodb' # Can override only on enterprise edition options.sasl_password ?= 'mongodb123' ## Replicat Set Discovery Custom layout is mandatory, ryba does not create replicaset automatically anymore. The property `ryba.mongodb.configsrv.replicaset` contains the replicaset name whom the config server belongs to. Ryba will go through every ryba/mongodb/configsrv to compute the replica sets and check the layout. Ryba user must provide the replica set master by set the boolean property `ryba.mongodb.configsrv.is_master`. throw Error 'Missing Replica Set Name ryba.mongodb.configsrv.replicaset' unless options.replicaset? options.replicasets = {} options.is_master ?= false for srv in service.deps.config_servers options.replicasets[srv.options.replicaset] ?= {} options.replicasets[srv.options.replicaset]['hosts'] ?= [] options.replicasets[srv.options.replicaset]['hosts'].push srv.node.fqdn options.replicaset_master = srv.node.fqdn if srv.options.is_master and (srv.options.replicaset is options.replicaset) options.config.replication ?= {} options.config.replication.replSetName ?= options.replicaset throw Error 'No master defined for replica' unless options.replicaset_master ## Wait options.wait_krb5_client = service.deps.krb5_client.options.wait options.wait = {} options.wait.tcp = for srv in service.deps.config_servers host: srv.node.fqdn port: options.config.net.port options.wait.local = host: service.node.fqdn port: options.config.net.port ## Dependencies {merge} = require '@nikitajs/core/lib/misc' [mongod-ssl]:(https://docs.mongodb.org/manual/reference/configuration-options/#net.ssl.mode)