## Configure module.exports = (service) -> options = service.options ## Identities By default, merge group and user from the MongoDb config server. options.group = merge service.deps.config_servers[0].options.group, options.group options.user = merge service.deps.config_servers[0].options.user, options.user ## Configuration options.conf_dir ?= '/etc/mongod-shard-server/conf' options.pid_dir ?= '/var/run/mongod' #mongo admin user for mongod instances belonging to a replica set options.admin ?= {} options.admin.name ?= 'admin' options.admin.password ?= 'admin123' options.root ?= {} options.root.name ?= 'root_admin' options.root.password ?= 'root123' # Misc options.fqdn ?= service.node.fqdn options.hostname = service.node.hostname options.iptables ?= service.deps.iptables and service.deps.iptables.options.action is 'start' options.clean_logs ?= false options.config ?= {} # setting the role of mongod process as a mongodb config server options.config.sharding ?= {} options.config.sharding.clusterRole ?= 'shardsvr' ## Logs options.config.systemLog ?= {} options.config.systemLog.destination ?= 'file' options.config.systemLog.logAppend ?= true options.config.systemLog.path ?= "/var/log/mongodb/mongod-shard-server-#{service.node.hostname}.log" ## Storage From 3.2, config servers for sharded clusters can be deployed as a replica set. The replica set config servers must run the WiredTiger storage engine options.config.storage ?= {} options.config.storage.dbPath ?= "#{options.user.home}/shard/db" options.config.storage.journal ?= {} options.config.storage.journal.enabled ?= true options.config.storage.engine ?= 'wiredTiger' options.config.storage.repairPath ?= "#{options.config.storage.dbPath}/repair" unless options.config.storage.engine is 'wiredTiger' throw Error 'Need WiredTiger Storage for shard server as replica set' unless options.config.storage.engine is 'wiredTiger' if options.config.storage.repairPath?.indexOf(options.config.storage.dbPath) is -1 throw Error 'Must use a repairpath that is a subdirectory of dbpath when using journaling' if options.config.storage.journal.enabled ## Replica Set Sharding Custom layout is mandatory, ryba does not create replicaset automatically. The property `ryba.options.replicaset` contains the replicaset name whom the shard server belongs to. Ryba will go through every ryba/mongodb/shard to compute the replica sets and check the layout. Ryba user must provide the replica set master by set the boolean property `ryba.options.is_master`. options.config.replication ?= {} throw Error 'Missing Replica Set Name ryba.options.replicaset' unless options.replicaset? options.replicasets = {} options.is_master ?= false for srv in service.deps.shard_servers options.replicasets[srv.options.replicaset] ?= {} options.replicasets[srv.options.replicaset]['hosts'] ?= [] options.replicasets[srv.options.replicaset]['hosts'].push srv.node.fqdn options.replicaset_master = srv.node.fqdn if srv.options.is_master and (srv.options.replicaset is options.replicaset) options.config.replication ?= {} options.config.replication.replSetName ?= options.replicaset throw Error 'No master defined for replica' unless options.replicaset_master ## ShardServer to ConfigServer Mapping Each Shard Cluster must be attributed to only one Config server Replica set. In the configuration, administrator must set the property `ryba.options.config_replicat_set`, to designated which config servers replica set will hold metadata. # we check if shard Cluster is not attributed to different config replica set #for now shard server only know to which shard server replica set it is attributed. # lest attribute it to a config server replicat set if not one is defnied. throw Error 'Missing Config Server Replicat Set Name' unless options.config_replicaset? ## Process options.config.processManagement ?= {} options.config.processManagement.fork ?= true options.config.processManagement.pidFilePath ?= "#{options.pid_dir}/mongod-shard-server-#{@config.host}.pid" ## Network [Configuring][mongod-ssl] ssl for the mongod process. options.config.net ?= {} options.config.net.port ?= 27019 options.config.net.bindIp ?= '0.0.0.0' options.config.net.unixDomainSocket ?= {} options.config.net.unixDomainSocket.pathPrefix ?= "#{options.pid_dir}" ## Security # disables the apis options.config.net.http ?= {} options.config.net.http.enabled ?= false options.config.net.http.JSONPEnabled ?= false options.config.net.http.RESTInterfaceEnabled ?= false options.config.security ?= {} options.config.security.clusterAuthMode ?= 'x509' ## SSL options.ssl = merge {}, service.deps.ssl?.options, options.ssl options.ssl.enabled = !!service.deps.ssl if options.ssl.enabled throw Error "Required Option: ssl.cert" if not options.ssl.cert throw Error "Required Option: ssl.key" if not options.ssl.key throw Error "Required Option: ssl.cacert" if not options.ssl.cacert switch options.config.security.clusterAuthMode when 'x509' options.config.net.ssl ?= {} options.config.net.ssl.mode ?= 'preferSSL' options.config.net.ssl.PEMKeyFile ?= "#{options.conf_dir}/key.pem" options.config.net.ssl.PEMKeyPassword ?= "mongodb123" # use PEMkeyfile by default for membership authentication # options.config.net.ssl.clusterFile ?= "#{mongodb.options.configsrv.conf_dir}/cluster.pem" # this is the mongodb version of java trustore # options.config.net.ssl.clusterPassword ?= "mongodb123" options.config.net.ssl.CAFile ?= "#{options.conf_dir}/cacert.pem" options.config.net.ssl.allowConnectionsWithoutCertificates ?= false options.config.net.ssl.allowInvalidCertificates ?= false options.config.net.ssl.allowInvalidHostnames ?= false when 'keyFile' mongodb.sharedsecret ?= 'sharedSecretForMongodbCluster' else throw Error ' unsupported cluster authentication Mode' ## ACL's options.config.security.authorization ?= 'enabled' ## Kerberos Kerberos authentication is only avaiable in enterprise edition. Should work nonetheless. options.krb5 ?= {} options.krb5.realm ?= service.deps.krb5_client.options.etc_krb5_conf?.libdefaults?.default_realm # Admin Information options.krb5.admin ?= service.deps.krb5_client.options.admin[options.krb5.realm] options.config.security.sasl ?= {} options.config.security.sasl.hostName ?= service.node.fqdn options.config.security.sasl.serviceName ?= 'mongodb' # Can override only on interprise edition options.sasl_password ?= 'mongodb123' ## Wait options.wait_krb5_client = service.deps.krb5_client.options.wait options.wait = {} options.wait.tcp = for srv in service.deps.shard_servers host: srv.node.fqdn port: options.config.net.port or 27019 options.wait.local = host: service.node.fqdn port: options.config.net.port or 27019 ## Dependencies {merge} = require '@nikitajs/core/lib/misc' [mongod-ssl]:(https://docs.mongodb.org/manual/reference/configuration-options/#net.ssl.mode)