detoxd/mongo repository overview

security:
  authorization: enabled
  javascriptEnabled: false  # Disable if not needed

net:
  port: 27017
  bindIp: 127.0.0.1  # Only local connections
  ssl:
    mode: requireSSL
    PEMKeyFile: /etc/ssl/mongodb.pem
    CAFile: /etc/ssl/ca.pem

setParameter:
  authenticationMechanisms: SCRAM-SHA-256

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json

// Create admin user
use admin
db.createUser({
  user: "adminUser",
  pwd: passwordPrompt(),  // Prompts for password
  roles: [
    { role: "userAdminAnyDatabase", db: "admin" },
    { role: "readWriteAnyDatabase", db: "admin" }
  ]
})

// Create application user with minimal privileges
use myapp
db.createUser({
  user: "appUser",
  pwd: passwordPrompt(),
  roles: [
    { role: "readWrite", db: "myapp" }
  ]
})

// Enable authentication
db.adminCommand({ setParameter: 1, authenticationMechanisms: ["SCRAM-SHA-256"] })

// Create custom role with specific permissions
use myapp
db.createRole({
  role: "readWriteRestricted",
  privileges: [
    { resource: { db: "myapp", collection: "users" }, actions: ["find", "insert", "update"] },
    { resource: { db: "myapp", collection: "posts" }, actions: ["find"] }
  ],
  roles: []
})

MONGO_INITDB_ROOT_USERNAME=admin
MONGO_INITDB_ROOT_PASSWORD=your_secure_password
MONGO_INITDB_DATABASE=myapp

# Optional: Disable scripting
MONGO_DISABLE_JAVASCRIPT=true

version: '3.8'
services:
  mongodb:
    image: detoxd/mongo:8.0-detox.1
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: ${MONGO_PASSWORD}
    volumes:
      - mongo_data:/data/db
      - ./mongod.conf:/etc/mongod.conf:ro
    command: ["mongod", "--config", "/etc/mongod.conf"]
    networks:
      - backend
    deploy:
      resources:
        limits:
          memory: 1G