DDNS & TLS/SSL for MongoDB
DNS
After you set the DNS record on your domain name registrar, change the bindIp from your IP to your domain in mongod.cfg. Then you can access your database by the domain name.
DDNS
About how to set up DDNS, you can check my previous article: https://medium.com/@xdxxxx4713/set-up-ddns-with-ddclient-google-domains-2eee300126d0.
After DDNS setting up, change the bindIp settings to bindIpAll: true .
TLS/SSL
To secure the data when the transmission, we can use TLS/SSL in MongoDB.
obtain certificate
I use Let’s Encript to obtain the certificate. You can see the detail in this article: https://medium.com/@xdxxxx4713/lets-encrypt-in-nginx-85866b848c8e.
mongo.pem
We need to cat the private key and the fullchain file into one pem file. Let’s call it mongo.pem .
sudo cat /etc/letsencrypt/archive/’+[db_domain]+’/{fullchain1.pem,privkey1.pem} | sudo tee /etc/letsencrypt/live/’+[db_domain]+’/mongo.pemmongod.cfg
Since TLS is more secure than SSL, let’s use TLS.
In MongoDB config file, set TLS mode and the certificate file.
auto renew mongo.pem and restart MongoDB
Due to the certificate obtained from Let’s Encript would be expired after 90 days, I write a script to auto renew mongo.pem and restart MongoDB.
client connect
To use URI connect, add ?tls=true&tlsAllowInvalidCertificate=true after your normal URL to connect MongoDB.
mongodump
To bake-up your data, you can use mongodump . Since we use TLS/SSL now, we need to add--ssl --tlsInsecure options for mongodump.
