Skip to content

Commit

Permalink
Doc changes
Browse files Browse the repository at this point in the history
  • Loading branch information
Giorgio committed Apr 9, 2021
1 parent 9a75a81 commit bafe406
Show file tree
Hide file tree
Showing 5 changed files with 95 additions and 11 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ So, if we use the suggested location:
- move certs to the new directory(```sudo mv path-to-cert-file/*.pem .```)
- move certs to the new directory(```sudo mv path-to-cert-file/*.crt .```)
- set the user ownership, ```sudo chown your-user:your-user *```,
- set restricted file permission, ```sudo chmod 600 *.pem```
- set restricted file permission, ```sudo chmod 600 *```
- go back to the home folder (```cd ..```)
- change the owner also for the mongodb folder (```sudo chown your-user:your-user mongodb```)
- change also the dir permission (```sudo chmod 770 mongodb```)
Expand Down Expand Up @@ -112,5 +112,4 @@ or

If the key was password protected you must add also the `tlsCertificateKeyFilePassword` parameter, either in the connection string or as a `db.open()` parameter.

[Prev doc.](tls_connection_no_auth_self_signed_certificate.md)

[Prev doc.](tls_connection_no_auth_self_signed_certificate.md)
Original file line number Diff line number Diff line change
Expand Up @@ -53,10 +53,10 @@ Provided that all files are in PEM format (that one that has a '----- Begin ....

- .key files -> Are files in PEM format containing the private key. They can be password protected or gpg encrypted (in this last case you have to decrypt them before using)
- .csr files -> Are files in PEM format containing the certificate request. As they are of no use in or case, I delete them after that the public certificate have been created.
- .crt files -> Are files in PEM format containing the public key. Those endind with -full-chain.crt contains a list of certificates in importatnce order (from less to more important). In our case the your-ca-name-full-chain.crt fille will contain two certificates: your-ca-name-ia.crt + your-ca-name-ca.crt strictly in this order. Inverting the order of the certificated causes strange and incomprehensible errors when trying to connect. The mongo db tutorial call these as .pem.
- .pem files -> Are files in PEM format containing a public and a private key. Nornally they are concatenend in this order, and this works. I have never tried to change the order, but I cannot guarantee that it would work.
- .crt files -> Are files in PEM format containing the public key. Those endind with -full-chain.crt contains a list of certificates in importatnce order (from less to more important). In our case the your-ca-name-full-chain.crt file will contain two certificates: your-ca-name-ia.crt + your-ca-name-ca.crt strictly in this order. Inverting the order of the certificates causes strange and incomprehensible errors when trying to connect. The mongo db tutorial call these as .pem.
- .pem files -> Are files in PEM format containing a public and a private key. Normally they are concatenated in this order, and this works. I have never tried to change the order, but I cannot guarantee that it would work.

I explicitly specify "PEM" format because there is also another kind of format, the "DER" one. I didn't use it, so I cannot give you more details on it, with the exception that I'm sure that you can convert the teo formats back and forth.
I explicitly specify "PEM" format because there is also another kind of format, the "DER" one. I didn't use it, so I cannot give you more details on it, with the exception that I'm sure that you can convert the two formats back and forth.
So, please note that the PEM format does not only refers to the .pem files.

## Server certificates
Expand All @@ -79,9 +79,9 @@ You can follow it or [run the script](script/server-certificate.sh) I have prepa
You can run it in the cert folder generated before (the intermediate key file ".key" must be decrypted if you used gpg), in this way:
move to the cert folder, run the command ./server-certificate.sh your-ca-name server-ip-address dns-server-name.
The dns-server-name is optional. If you give it, you will need to use that name in the mongodb connection string.
The script will require some parameters, set them as you like, be only careful to set the "Organization name" and the "Organizational Unit name" equal for all the servers that you will generate. Also the DC (Domain Component) parameters must be equal, but the script will not ask you for it.
The script will require some parameters, set them as you like, only be careful to set the "Organization name" and the "Organizational Unit name" equal for all the servers that you will generate. Also the DC (Domain Component) parameters must be equal, but the script will not ask you for it.

Create all servers certificates and send them to the servers in a safe way.
Create all servers certificates and send them to the servers in a safe way (at least "your-server-name.pem" and "your-ca-name-full-chain.crt").

## Install certificates

Expand All @@ -93,12 +93,12 @@ Now that we have the certificates on the server we have to store them somewhere.
- move certs to the new directory(```sudo mv path-to-cert-file/*.pem .```)
- move certs to the new directory(```sudo mv path-to-cert-file/*.crt .```)
- set the mongodb user ownership (or any user running mongodb), ```sudo chown mongodb:mongodb *```,
- set restricted file permission, ```sudo chmod 600 *.pem```
- set restricted file permission, ```sudo chmod 600 *```
- go back to the /var/local folder (```cd ..```)
- change the owner also for the mongodb folder (```sudo chown mongodb:mongodb /var/local/mongodb```)
- change also the dir permission (```sudo chmod 770 /var/local/mongodb```)

Ok, now we only to change the configuration file and restart the mongod daemon.
Ok, now we only have to change the configuration file and restart the mongod daemon.
Here I'm assuming that you are running mongod as a daemon, if not you can already run it on the command line
(```mongod --tlsMode requireTLS --tlsCertificateKeyFile <pem>```)

Expand Down
84 changes: 84 additions & 0 deletions example/manual/db_connection.dart
Original file line number Diff line number Diff line change
@@ -0,0 +1,84 @@
import 'package:mongo_dart/mongo_dart.dart';

const dbName = 'mongo-dart-example';
const dbAddress = '127.0.0.1';

void main() async {
var db = await connection.db;

if (!db.masterConnection.serverCapabilities.supportsOpMsg) {
return;
}

var collectionName = 'delete-many';
await db.dropCollection(collectionName);
var collection = db.collection(collectionName);

var ret = await collection.insertMany([
{'_id': 3, 'name': 'John', 'age': 32},
{'_id': 4, 'name': 'Mira', 'age': 27},
{'_id': 7, 'name': 'Luis', 'age': 42},
]);
if (!ret.isSuccess) {
print('Error detected in record insertion');
}

var res = await collection.deleteMany(where.lt('age', 40));

print('Removed documents: ${res.nRemoved}'); // 2

var findResult = await collection.find().toList();

print('First record name: ${findResult.first['name']}'); // 'Luis';

await connection.close();
}

DbConnection connection = DbConnection._(dbAddress, '27017', dbName);

class DbConnection {
DbConnection._(this.host, this.port, this.dbName);
final String host;
final String port;
final String dbName;

String get connectionString => 'mongodb://$host:$port/$dbName';

int retryAttempts = 5;

static bool started = false;

Db? _db;
Future<Db> get db async => getConnection();

Future<void> close() async {
if (_db != null) {
await _db!.close();
}
}

Future<Db> getConnection() async {
if (_db == null || !_db!.isConnected) {
await close();
var retry = 0;
while (true) {
try {
retry++;
var db = Db(connectionString);
await db.open();
_db = db;
print('OK after "$retry" attempts');
break;
} catch (e) {
if (retryAttempts < retry) {
print('Exiting after "$retry" attempts');
rethrow;
}
// each time waits a little bit more before re-trying
await Future.delayed(Duration(milliseconds: 100 * retry));
}
}
}
return _db!;
}
}
2 changes: 1 addition & 1 deletion pubspec.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ dependencies:
collection: ^1.15.0
path: ^1.8.0
pool: ^1.5.0
basic_utils: ^3.0.0-nullsafety.3
basic_utils: ^3.0.0
rational: ^1.0.0
uuid: ^3.0.0

Expand Down
1 change: 1 addition & 0 deletions test/database_test.dart
Original file line number Diff line number Diff line change
Expand Up @@ -1356,6 +1356,7 @@ Future testSimpleQuery() async {
}
expect(result1['my_field'], 3);
id = result1['_id'] as ObjectId;
expect(id.toHexString(), id.$oid);

var result2 = await collection.findOne(where.id(id));
expect(result2, isNotNull);
Expand Down

0 comments on commit bafe406

Please sign in to comment.