Something went wrong. Try again.
Monorepo for Aesthetic.Computer aesthetic.computer
Something went wrong. Try again.
Shell
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236#!/bin/bash# Setup MongoDB Authentication on silo.aesthetic.computer# Run this script ON the silo server: bash setup-silo-mongodb-auth.sh
set -e
GREEN='\033[0;32m'YELLOW='\033[1;33m'BLUE='\033[0;36m'RED='\033[0;31m'NC='\033[0m'
echo -e "${BLUE}╔════════════════════════════════════════════════════════════╗${NC}"echo -e "${BLUE}║ MongoDB Authentication Setup for Silo ║${NC}"echo -e "${BLUE}╚════════════════════════════════════════════════════════════╝${NC}"echo ""
# Check if running as root or with sudoif [ "$EUID" -ne 0 ]; then echo -e "${RED}Please run with sudo: sudo bash setup-silo-mongodb-auth.sh${NC}" exit 1fi
# Generate secure credentialsecho -e "${YELLOW}Generating secure credentials...${NC}"MONGO_ADMIN_USER="admin"MONGO_ADMIN_PASS=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-32)
MONGO_APP_USER="aesthetic_app"MONGO_APP_PASS=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-32)
echo -e "${GREEN}✓ Generated secure passwords${NC}"echo ""
# Check if MongoDB is runningecho -e "${YELLOW}Checking MongoDB status...${NC}"if ! systemctl is-active --quiet mongod; then echo -e "${RED}MongoDB is not running. Starting it...${NC}" systemctl start mongod sleep 2fiecho -e "${GREEN}✓ MongoDB is running${NC}"echo ""
# Create admin user (if not exists)echo -e "${YELLOW}Creating MongoDB admin user...${NC}"mongosh --quiet --eval " try { db = db.getSiblingDB('admin'); const existing = db.getUser('${MONGO_ADMIN_USER}'); if (existing) { print('⚠️ Admin user already exists, updating password...'); db.changeUserPassword('${MONGO_ADMIN_USER}', '${MONGO_ADMIN_PASS}'); } else { db.createUser({ user: '${MONGO_ADMIN_USER}', pwd: '${MONGO_ADMIN_PASS}', roles: [ { role: 'root', db: 'admin' } ] }); print('✓ Admin user created'); } } catch(e) { print('Error creating admin user: ' + e); quit(1); }"echo ""
# Create application user for 'aesthetic' databaseecho -e "${YELLOW}Creating application user for 'aesthetic' database...${NC}"mongosh --quiet --eval " try { db = db.getSiblingDB('aesthetic'); const existing = db.getUser('${MONGO_APP_USER}'); if (existing) { print('⚠️ App user already exists, updating password...'); db.changeUserPassword('${MONGO_APP_USER}', '${MONGO_APP_PASS}'); } else { db.createUser({ user: '${MONGO_APP_USER}', pwd: '${MONGO_APP_PASS}', roles: [ { role: 'readWrite', db: 'aesthetic' }, { role: 'dbAdmin', db: 'aesthetic' } ] }); print('✓ Application user created'); } } catch(e) { print('Error creating app user: ' + e); quit(1); }"echo ""
# Enable authentication in mongod.confecho -e "${YELLOW}Configuring MongoDB for authentication...${NC}"
MONGO_CONF="/etc/mongod.conf"BACKUP_CONF="/etc/mongod.conf.backup.$(date +%Y%m%d_%H%M%S)"
# Backup existing configcp "$MONGO_CONF" "$BACKUP_CONF"echo -e "${GREEN}✓ Backed up config to $BACKUP_CONF${NC}"
# Check if authentication is already enabledif grep -q "^security:" "$MONGO_CONF"; then echo -e "${YELLOW}Security section already exists in config${NC}"else # Add security section cat >> "$MONGO_CONF" << 'EOF'
# Security settingssecurity: authorization: enabledEOF echo -e "${GREEN}✓ Added authentication to MongoDB config${NC}"fi
# Ask about network bindingecho ""echo -e "${YELLOW}Network Configuration:${NC}"echo "1. Keep MongoDB on localhost only (SSH tunnel required) - MOST SECURE"echo "2. Bind to 0.0.0.0 to allow remote connections - REQUIRES FIREWALL SETUP"echo ""read -p "Choose option [1/2] (default: 1): " NETWORK_CHOICENETWORK_CHOICE=${NETWORK_CHOICE:-1}
if [ "$NETWORK_CHOICE" = "2" ]; then echo -e "${YELLOW}Configuring MongoDB to accept remote connections...${NC}"
# Update bindIp in config if grep -q "bindIp:" "$MONGO_CONF"; then sed -i 's/bindIp:.*/bindIp: 0.0.0.0/' "$MONGO_CONF" else sed -i '/^net:/a\ bindIp: 0.0.0.0' "$MONGO_CONF" fi
echo -e "${GREEN}✓ MongoDB will accept remote connections${NC}" echo -e "${RED}⚠️ IMPORTANT: Configure firewall to only allow trusted IPs!${NC}" echo -e "${YELLOW}Run: sudo ufw allow from YOUR_IP to any port 27017${NC}"else echo -e "${GREEN}✓ MongoDB will remain localhost-only (most secure)${NC}"fi
# Restart MongoDB to apply changesecho ""echo -e "${YELLOW}Restarting MongoDB...${NC}"systemctl restart mongodsleep 2
if systemctl is-active --quiet mongod; then echo -e "${GREEN}✓ MongoDB restarted successfully${NC}"else echo -e "${RED}✗ MongoDB failed to restart. Check logs: journalctl -u mongod${NC}" exit 1fi
# Test authenticationecho ""echo -e "${YELLOW}Testing authentication...${NC}"mongosh "mongodb://localhost:27017/aesthetic" \ -u "$MONGO_APP_USER" \ -p "$MONGO_APP_PASS" \ --authenticationDatabase aesthetic \ --quiet \ --eval "db.runCommand({ping: 1})" > /dev/null
if [ $? -eq 0 ]; then echo -e "${GREEN}✓ Authentication working!${NC}"else echo -e "${RED}✗ Authentication test failed${NC}" exit 1fi
# Generate connection stringsecho ""echo -e "${BLUE}╔════════════════════════════════════════════════════════════╗${NC}"echo -e "${BLUE}║ SUCCESS! ║${NC}"echo -e "${BLUE}╚════════════════════════════════════════════════════════════╝${NC}"echo ""
HOSTNAME=$(hostname -f 2>/dev/null || echo "silo.aesthetic.computer")
if [ "$NETWORK_CHOICE" = "2" ]; then CONNECTION_STRING="mongodb://${MONGO_APP_USER}:${MONGO_APP_PASS}@${HOSTNAME}:27017/aesthetic?authSource=aesthetic"else CONNECTION_STRING="mongodb://${MONGO_APP_USER}:${MONGO_APP_PASS}@localhost:27017/aesthetic?authSource=aesthetic"fi
ADMIN_CONNECTION="mongodb://${MONGO_ADMIN_USER}:${MONGO_ADMIN_PASS}@localhost:27017/admin?authSource=admin"
# Save to fileCRED_FILE="/root/mongodb-credentials.txt"cat > "$CRED_FILE" << EOFMongoDB Credentials for silo.aesthetic.computerGenerated: $(date)
=== Admin User (root access) ===Username: $MONGO_ADMIN_USERPassword: $MONGO_ADMIN_PASSDatabase: adminConnection: $ADMIN_CONNECTION
=== Application User (aesthetic database) ===Username: $MONGO_APP_USERPassword: $MONGO_APP_PASSDatabase: aestheticConnection: $CONNECTION_STRING
=== For .env files ===MONGODB_CONNECTION_STRING="$CONNECTION_STRING"MONGODB_NAME="aesthetic"
=== If using SSH tunnel ===# On local machine, create tunnel:ssh -L 27018:localhost:27017 user@silo.aesthetic.computer
# Then use:MONGODB_CONNECTION_STRING="mongodb://${MONGO_APP_USER}:${MONGO_APP_PASS}@localhost:27018/aesthetic?authSource=aesthetic"MONGODB_NAME="aesthetic"EOF
chmod 600 "$CRED_FILE"echo -e "${GREEN}Credentials saved to: $CRED_FILE${NC}"echo ""
# Display credentialscat "$CRED_FILE"
echo ""echo -e "${YELLOW}════════════════════════════════════════════════════════${NC}"echo -e "${YELLOW}IMPORTANT: Copy these credentials to your vault!${NC}"echo -e "${YELLOW}File location: $CRED_FILE${NC}"echo -e "${YELLOW}════════════════════════════════════════════════════════${NC}"