Install and configure MongoDB 8.0 with authentication and SSL encryption

#!/usr/bin/env bash
set -euo pipefail

# MongoDB 8.0 Installation and Configuration Script
# Production-ready with authentication and SSL/TLS encryption

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m' # No Color

# Configuration variables
MONGODB_IP="${1:-127.0.0.1}"
ADMIN_USER="${2:-admin}"
ADMIN_PASSWORD="${3:-$(openssl rand -base64 32)}"
NETWORK_CIDR="${4:-127.0.0.0/8}"

usage() {
    echo "Usage: $0 [MONGODB_IP] [ADMIN_USER] [ADMIN_PASSWORD] [NETWORK_CIDR]"
    echo "Example: $0 192.168.1.100 dbadmin mypassword 192.168.1.0/24"
    exit 1
}

log_info() {
    echo -e "${GREEN}$1${NC}"
}

log_warn() {
    echo -e "${YELLOW}$1${NC}"
}

log_error() {
    echo -e "${RED}$1${NC}"
}

cleanup() {
    log_error "Installation failed. Cleaning up..."
    systemctl stop mongod 2>/dev/null || true
    systemctl disable mongod 2>/dev/null || true
    if [[ "$PKG_MGR" == "apt" ]]; then
        apt-get remove -y mongodb-org 2>/dev/null || true
        rm -f /etc/apt/sources.list.d/mongodb-org-8.0.list
        rm -f /usr/share/keyrings/mongodb-server-8.0.gpg
    else
        dnf remove -y mongodb-org 2>/dev/null || true
        rm -f /etc/yum.repos.d/mongodb-org-8.0.repo
    fi
    rm -rf /etc/mongodb/ssl
    exit 1
}

trap cleanup ERR

check_prerequisites() {
    log_info "[1/10] Checking prerequisites..."
    
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi

    if [[ $# -gt 4 ]]; then
        usage
    fi

    if ! command -v openssl &> /dev/null; then
        log_error "OpenSSL is required but not installed"
        exit 1
    fi
}

detect_distro() {
    log_info "[2/10] Detecting distribution..."
    
    if [[ ! -f /etc/os-release ]]; then
        log_error "Cannot detect distribution - /etc/os-release not found"
        exit 1
    fi

    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt-get install -y"
            PKG_UPDATE="apt-get update && apt-get upgrade -y"
            FIREWALL_CMD="ufw"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            FIREWALL_CMD="firewalld"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            FIREWALL_CMD="firewalld"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_info "Detected: $PRETTY_NAME using $PKG_MGR"
}

update_system() {
    log_info "[3/10] Updating system packages..."
    
    if [[ "$PKG_MGR" == "apt" ]]; then
        apt-get update && apt-get upgrade -y
        $PKG_INSTALL wget curl gnupg2 software-properties-common apt-transport-https ca-certificates lsb-release
    else
        $PKG_UPDATE
        $PKG_INSTALL wget curl gnupg2 yum-utils
    fi
}

add_mongodb_repository() {
    log_info "[4/10] Adding MongoDB official repository..."
    
    if [[ "$PKG_MGR" == "apt" ]]; then
        curl -fsSL https://www.mongodb.org/static/pgp/server-8.0.asc | gpg -o /usr/share/keyrings/mongodb-server-8.0.gpg --dearmor
        echo "deb [ arch=amd64,arm64 signed-by=/usr/share/keyrings/mongodb-server-8.0.gpg ] https://repo.mongodb.org/apt/ubuntu $(lsb_release -cs)/mongodb-org/8.0 multiverse" > /etc/apt/sources.list.d/mongodb-org-8.0.list
        apt-get update
    else
        rpm --import https://www.mongodb.org/static/pgp/server-8.0.asc
        cat > /etc/yum.repos.d/mongodb-org-8.0.repo << EOF
[mongodb-org-8.0]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/redhat/\$releasever/mongodb-org/8.0/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-8.0.asc
EOF
    fi
}

install_mongodb() {
    log_info "[5/10] Installing MongoDB 8.0..."
    $PKG_INSTALL mongodb-org
    
    # Prevent automatic updates
    if [[ "$PKG_MGR" == "apt" ]]; then
        echo "mongodb-org hold" | dpkg --set-selections
        echo "mongodb-org-database hold" | dpkg --set-selections
        echo "mongodb-org-server hold" | dpkg --set-selections
        echo "mongodb-org-mongos hold" | dpkg --set-selections
        echo "mongodb-org-tools hold" | dpkg --set-selections
    fi
}

create_ssl_certificates() {
    log_info "[6/10] Creating SSL certificates..."
    
    mkdir -p /etc/mongodb/ssl
    
    # Generate self-signed certificate for testing
    openssl req -new -x509 -days 365 -nodes \
        -out /etc/mongodb/ssl/mongodb.pem \
        -keyout /etc/mongodb/ssl/mongodb.pem \
        -subj "/C=US/ST=State/L=City/O=Organization/CN=$MONGODB_IP"
    
    chown -R mongod:mongod /etc/mongodb/ssl
    chmod 700 /etc/mongodb/ssl
    chmod 600 /etc/mongodb/ssl/mongodb.pem
    
    log_warn "Using self-signed certificate. For production, use certificates from a trusted CA."
}

configure_mongodb() {
    log_info "[7/10] Configuring MongoDB with security hardening..."
    
    cat > /etc/mongod.conf << EOF
storage:
  dbPath: /var/lib/mongodb
  journal:
    enabled: true
  wiredTiger:
    engineConfig:
      cacheSizeGB: 2
      directoryForIndexes: true

systemLog:
  destination: file
  logAppend: true
  path: /var/log/mongodb/mongod.log
  logRotate: rename
  verbosity: 1

net:
  port: 27017
  bindIp: 127.0.0.1,$MONGODB_IP
  maxIncomingConnections: 200
  tls:
    mode: requireTLS
    certificateKeyFile: /etc/mongodb/ssl/mongodb.pem
    allowConnectionsWithoutCertificates: true

processManagement:
  timeZoneInfo: /usr/share/zoneinfo
  fork: true
  pidFilePath: /var/run/mongodb/mongod.pid

security:
  authorization: enabled
  javascriptEnabled: false

operationProfiling:
  slowOpThresholdMs: 200
  mode: slowOp

setParameter:
  authenticationMechanisms: SCRAM-SHA-256
  tlsLogVersions: "TLS1_2,TLS1_3"
  cursorTimeoutMillis: 600000
  failIndexKeyTooLong: false
EOF

    chmod 644 /etc/mongod.conf
    chown root:root /etc/mongod.conf
}

configure_firewall() {
    log_info "[8/10] Configuring firewall rules..."
    
    if [[ "$FIREWALL_CMD" == "ufw" ]]; then
        if command -v ufw &> /dev/null; then
            ufw --force enable
            ufw allow from $NETWORK_CIDR to any port 27017
            ufw reload
        fi
    else
        if command -v firewall-cmd &> /dev/null; then
            systemctl enable --now firewalld
            firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='$NETWORK_CIDR' port protocol='tcp' port='27017' accept"
            firewall-cmd --reload
        fi
    fi
}

start_mongodb() {
    log_info "[9/10] Starting and enabling MongoDB service..."
    
    systemctl daemon-reload
    systemctl enable mongod
    systemctl start mongod
    
    # Wait for MongoDB to start
    sleep 10
}

create_admin_user() {
    log_info "[10/10] Creating admin user and testing connection..."
    
    # First, start MongoDB without authentication temporarily
    sed -i 's/authorization: enabled/# authorization: enabled/' /etc/mongod.conf
    systemctl restart mongod
    sleep 5
    
    # Create admin user
    mongosh --tls --tlsAllowInvalidCertificates --eval "
        use admin;
        db.createUser({
            user: '$ADMIN_USER',
            pwd: '$ADMIN_PASSWORD',
            roles: [
                { role: 'userAdminAnyDatabase', db: 'admin' },
                { role: 'readWriteAnyDatabase', db: 'admin' },
                { role: 'dbAdminAnyDatabase', db: 'admin' },
                { role: 'clusterAdmin', db: 'admin' }
            ]
        });
    "
    
    # Re-enable authentication
    sed -i 's/# authorization: enabled/authorization: enabled/' /etc/mongod.conf
    systemctl restart mongod
    sleep 5
}

verify_installation() {
    log_info "Verifying MongoDB installation..."
    
    if ! systemctl is-active --quiet mongod; then
        log_error "MongoDB service is not running"
        return 1
    fi
    
    if ! mongosh --tls --tlsAllowInvalidCertificates -u "$ADMIN_USER" -p "$ADMIN_PASSWORD" --authenticationDatabase admin --eval "db.adminCommand('ping')" &>/dev/null; then
        log_error "Cannot connect to MongoDB with admin credentials"
        return 1
    fi
    
    log_info "MongoDB 8.0 installation completed successfully!"
    log_info "Admin user: $ADMIN_USER"
    log_info "Admin password: $ADMIN_PASSWORD"
    log_info "Connection string: mongodb://$ADMIN_USER:$ADMIN_PASSWORD@$MONGODB_IP:27017/?tls=true&authSource=admin"
    log_warn "Store the admin password securely and change it if needed"
}

main() {
    check_prerequisites "$@"
    detect_distro
    update_system
    add_mongodb_repository
    install_mongodb
    create_ssl_certificates
    configure_mongodb
    configure_firewall
    start_mongodb
    create_admin_user
    verify_installation
}

main "$@"