DDNS & TLS/SSL for MongoDB

DNS

After you set the DNS record on your domain name registrar, change the bindIp from your IP to your domain in mongod.cfg. Then you can access your database by the domain name.

DDNS

About how to set up DDNS, you can check my previous article: https://medium.com/@xdxxxx4713/set-up-ddns-with-ddclient-google-domains-2eee300126d0.

After DDNS setting up, change the bindIp settings to bindIpAll: true .

TLS/SSL

To secure the data when the transmission, we can use TLS/SSL in MongoDB.

obtain certificate

I use Let’s Encript to obtain the certificate. You can see the detail in this article: https://medium.com/@xdxxxx4713/lets-encrypt-in-nginx-85866b848c8e.

mongo.pem

We need to cat the private key and the fullchain file into one pem file. Let’s call it mongo.pem .

sudo cat /etc/letsencrypt/archive/’+[db_domain]+’/{fullchain1.pem,privkey1.pem} | sudo tee /etc/letsencrypt/live/’+[db_domain]+’/mongo.pem

mongod.cfg

Since TLS is more secure than SSL, let’s use TLS.

In MongoDB config file, set TLS mode and the certificate file.

auto renew mongo.pem and restart MongoDB

Due to the certificate obtained from Let’s Encript would be expired after 90 days, I write a script to auto renew mongo.pem and restart MongoDB.

client connect

To use URI connect, add ?tls=true&tlsAllowInvalidCertificate=true after your normal URL to connect MongoDB.

mongodump

To bake-up your data, you can use mongodump . Since we use TLS/SSL now, we need to add--ssl --tlsInsecure options for mongodump.