ssh root@your-vps-ip
apt update && apt upgrade -y

curl -fsSL https://get.docker.com | bash
apt install -y docker-compose-plugin

docker --version
docker compose version

mkdir -p /srv/apps/mongodb/{backups,init-scripts,scripts}
cd /srv/apps/mongodb

nano .env

MONGO_INITDB_ROOT_USERNAME=admin
MONGO_INITDB_ROOT_PASSWORD=

# Mongo Express GUI
ME_BASIC_AUTH_USER=
ME_BASIC_AUTH_PASS=

docker network create appnet

nano docker-compose.yml

volumes:
  mongo_data:
  mongo_backups:

networks:
  appnet:
    external: true
  internal:
    driver: bridge

services:
  mongodb:
    image: mongo:8.0
    container_name: mongodb
    restart: unless-stopped
    env_file: .env
    command: ["--auth"]
    networks:
      - appnet
      - internal
    volumes:
      - mongo_data:/data/db
      - mongo_backups:/backups
      - ./init-scripts:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "mongosh -u \"$${MONGO_INITDB_ROOT_USERNAME}\" -p \"$${MONGO_INITDB_ROOT_PASSWORD}\" --authenticationDatabase admin --quiet --eval \"db.runCommand({ ping: 1 })\""]
      interval: 30s
      timeout: 5s
      retries: 10
      start_period: 20s
    ulimits:
      nofile:
        soft: 64000
        hard: 64000
    environment:
      - TZ=Asia/Dhaka
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"

docker compose up -d

docker ps

docker logs -f mongodb

docker volume ls
docker volume inspect mongo_data

docker exec -it mongodb mongosh -u admin -p SuperSecret123 --authenticationDatabase admin

use newdatabase
db.createUser({
  user: "newuser",
  pwd: passwordPrompt(),
  roles: [{ role: "readWrite", db: "newdatabase" }]
});

exit

ufw deny 27017

ssh -L 27017:localhost:27017 root@your-vps-ip

mongodb://admin:SuperSecret123@127.0.0.1:27017/myappdb?authSource=admin

mongo-express:
    image: mongo-express:1.0.2
    container_name: mongo-express
    restart: unless-stopped
    depends_on:
      mongodb:
        condition: service_healthy
    env_file: .env
    environment:
      ME_CONFIG_MONGODB_URL: "mongodb://${MONGO_INITDB_ROOT_USERNAME}:${MONGO_INITDB_ROOT_PASSWORD}@mongodb:27017/?authSource=admin"
      ME_CONFIG_MONGODB_ENABLE_ADMIN: "true"
      ME_CONFIG_BASICAUTH_USERNAME: "${ME_BASIC_AUTH_USER}"
      ME_CONFIG_BASICAUTH_PASSWORD: "${ME_BASIC_AUTH_PASS}"
      ME_CONFIG_SITE_HTTPS_ENABLED: "false"
      TZ: Asia/Dhaka
    networks:
      - internal
      - appnet
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=appnet"
      - "traefik.http.routers.mongo-express.rule=Host(`mongo.naturalsefaa.com`)"
      - "traefik.http.routers.mongo-express.entrypoints=websecure"
      - "traefik.http.routers.mongo-express.tls=true"
      - "traefik.http.routers.mongo-express.tls.certresolver=letsencrypt"
      - "traefik.http.services.mongo-express.loadbalancer.server.port=8081"
    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "5"

nano /srv/apps/mongodb/backups/scripts/dbname_backup.sh

#!/bin/bash
DB_NAME=dbname
DB_USER=db_user
DB_PASS=db_pass
BACKUP_DIR=/srv/apps/mongodb/backups/$DB_NAME
TIMESTAMP=$(date +%F-%H-%M-%S)
BACKUP_NAME="backup-$DB_NAME-$TIMESTAMP.gz"

mkdir -p $BACKUP_DIR
docker exec mongodb mkdir -p /backups/$DB_NAME

docker exec mongodb mongodump \
  --db $DB_NAME \
  -u $DB_USER \
  -p $DB_PASS \
  --authenticationDatabase $DB_NAME \
  --archive=/backups/$DB_NAME/$BACKUP_NAME --gzip

ls -t $BACKUP_DIR/backup-$DB_NAME-*.gz | tail -n +15 | xargs -r rm --

echo "[$(date '+%F %T')] Backup saved to $BACKUP_DIR/$BACKUP_NAME"

chmod +x /srv/apps/mongodb/backups/scripts/dbname_backup.sh

/srv/apps/mongodb/backups/scripts/dbname_backup.sh

crontab -e

0 0 * * * /root/backups/scripts/dbname_backup.sh >> /var/log/mongo-backup.log 2>&1

docker exec -i mongodb mongorestore \
  --db myappdb \
  -u $MONGO_APP_USER \
  -p $MONGO_APP_PASS \
  --authenticationDatabase myappdb \
  --gzip --archive < backup-myappdb-2025-08-24-12-00-00.gz