Backup and Recovery, Security, and Operations

# === Back up the entire database ===
mongodump --uri="mongodb://localhost:27017/shopdb" --out=/backup/2026-07-01

# === Back Up a Specified Set ===
mongodump --uri="mongodb://localhost:27017/shopdb" --collection=users --out=/backup/users

# === Compressed Backup ===
mongodump --uri="mongodb://localhost:27017" --gzip --archive=/backup/shopdb.gz

# === Back up metadata only ===
mongodump --uri="mongodb://localhost:27017" --db=shopdb --collection=users --query='{"role":"admin"}'

# === Restore the entire backup ===
mongorestore --uri="mongodb://localhost:27017" /backup/2026-07-01

# === Restore a Specified Database ===
mongorestore --uri="mongodb://localhost:27017" /backup/2026-07-01/shopdb

# === Restore gzip Compressed Backup ===
mongorestore --uri="mongodb://localhost:27017" --gzip --archive=/backup/shopdb.gz

# === Restore and overwrite existing data ===
mongorestore --uri="mongodb://localhost:27017" --drop /backup/2026-07-01

# ShopHub Accidentally deleted 2026-07-01 10:00-10:30 Order Data，Need to revert to 10:00 Status

# 1. Restore the full backup from the previous day
mongorestore --uri="mongodb://localhost:27017/shopdb_recovery" --drop /backup/2026-06-30/shopdb

# 2. Replay oplog By the target date
mongorestore --uri="mongodb://localhost:27017/shopdb_recovery" --oplogReplay --oplogLimit=1750604400 /backup/2026-06-30/oplog.bson

# 3. Verify the restored data
mongosh --port 27017 shopdb_recovery --eval 'db.orders.count()'

# 4. Export the recovered data and import it into the production environment
mongodump --uri="mongodb://localhost:27017/shopdb_recovery" --collection=orders --query='{"createdAt":{"$gte":{"$date":"2026-07-01T10:00:00Z"},"$lt":{"$date":"2026-07-01T10:30:00Z"}}}' --out=/recovery/orders
mongorestore --uri="mongodb://localhost:27017/shopdb" /recovery/orders

// === Create an Administrator User ===
db.createUser({
  user: 'admin',
  pwd: 'SecurePass123!',
  roles: [
    { role: 'userAdminAnyDatabase', db: 'admin' },
    { role: 'readWriteAnyDatabase', db: 'admin' }
  ]
});

// === Create an Application User ===
db.createUser({
  user: 'app_user',
  pwd: 'AppPass456!',
  roles: [{ role: 'readWrite', db: 'shopdb' }]
});

// === Enable Authentication（mongod Startup Parameters）===
mongod --auth --bind_ip_all

// === Custom Characters ===
db.createRole({
  role: 'orderManager',
  privileges: [
    { resource: { db: 'shopdb', collection: 'orders' }, actions: ['find', 'insert', 'update'] },
    { resource: { db: 'shopdb', collection: 'products' }, actions: ['find'] }
  ],
  roles: []
});

// === Authorization ===
db.grantRolesToUser('app_user', [{ role: 'orderManager', db: 'shopdb' }]);

// TechCorp：Assign the minimum necessary permissions to different teams
// 1. Application Service Account（Read-write only shopdb）
db.createUser({
  user: 'app_service',
  pwd: 'AppSecurePass!',
  roles: [{ role: 'readWrite', db: 'shopdb' }]
});

// 2. Backup Service Account（Backup-only permissions）
db.createUser({
  user: 'backup_service',
  pwd: 'BackupSecurePass!',
  roles: [
    { role: 'backup', db: 'admin' },
    { role: 'readAnyDatabase', db: 'admin' }
  ]
});

// 3. Data Analytics Team（Read-only + Specific Set）
db.createRole({
  role: 'analyticsReader',
  privileges: [
    { resource: { db: 'shopdb', collection: 'orders' }, actions: ['find'] },
    { resource: { db: 'shopdb', collection: 'products' }, actions: ['find'] }
  ],
  roles: []
});
db.createUser({
  user: 'analyst',
  pwd: 'AnalystPass!',
  roles: [{ role: 'analyticsReader', db: 'shopdb' }]
});

// 4. Verify Permissions
db.auth('analyst', 'AnalystPass!');
db.orders.find({}); // ✅ Can be read
db.orders.insertOne({}); // ❌ Insufficient permissions

# === Start mongod with SSL ===
mongod --tlsMode requireTLS --tlsCertificateKeyFile /etc/ssl/mongodb.pem

# === Client Connection ===
mongosh "mongodb://localhost:27017/shopdb?ssl=true&sslCertificateKeyFile=/etc/ssl/client.pem"

db.serverStatus();
// {
//   host: 'mongo1',
//   version: '7.0.5',
//   process: 'mongod',
//   uptime: 864000,
//   connections: { current: 150, available: 83860 },
//   opcounters: {
//     insert: 1234567,
//     query: 9876543,
//     update: 234567,
//     delete: 12345
//   },
//   mem: { resident: 1024, virtual: 4096 },
//   ...
// }

db.stats();
// {
//   db: 'shopdb',
//   collections: 10,
//   objects: 1000000,
//   dataSize: 524288000,
//   storageSize: 268435456,
//   indexes: 20,
//   indexSize: 52428800
// }

// === Enable the slow query log（>100ms）===
db.setProfilingLevel(2, { slowms: 100 });

// === View Slow Queries ===
db.system.profile.find({ millis: { $gt: 100 } })
  .sort({ ts: -1 })
  .limit(10);

db.products.aggregate([{ $indexStats: {} }]);
// Identify unused indexes

// === Current Operation ===
db.currentOp({ "op": "query" });

// === Kill a process ===
db.killOp(opId);

// === Compressed Sets ===
db.runCommand({ compact: 'products' });

// === Rebuild Index ===
db.products.reIndex();

// === View Link ===
db.serverStatus().connections;

# === 1. Daily Automatic Backup Script（backup-daily.sh）===
#!/bin/bash
set -e

DATE=$(date +%Y%m%d)
BACKUP_DIR=/backup/mongodb/$DATE
RETENTION_DAYS=7

# 1.1 Full Backup（gzip Compression）
mongodump   --uri="mongodb://backup_user:SecurePass@mongo1:27017,mongo2:27017,mongo3:27017/shopdb?replicaSet=rs0"   --gzip   --archive=$BACKUP_DIR.gz   --oplog  # Includes oplog，Support PITR

# 1.2 Upload to S3
aws s3 cp $BACKUP_DIR.gz s3://my-bucket/mongodb-backups/$DATE/

# 1.3 Cleanup 7 Local backup from X days ago
find /backup/mongodb/ -name "*.gz" -mtime +$RETENTION_DAYS -delete

# 1.4 Record Backup Logs
echo "[$(date)] Backup completed: $BACKUP_DIR.gz ($(du -h $BACKUP_DIR.gz | cut -f1))" >> /var/log/mongodb-backup.log

# 1.5 Add to crontab (Daily at 2 AM)
# 0 2 * * * /usr/local/bin/backup-daily.sh

# === 2. Recovery Drill ===
# 2.1 View Available Backups
ls -lh /backup/mongodb/

# 2.2 Restore to the test environment
mongorestore   --uri="mongodb://localhost:27017/shopdb_test"   --gzip   --archive=/backup/mongodb/20260701.gz   --drop  # Overwrite existing data

# 2.3 PITR Restore to a Specific Point in Time
mongorestore   --uri="mongodb://localhost:27017"   --gzip   --archive=/backup/mongodb/20260701.gz   --oplogReplay   --pointInTime=2026-07-01T10:30:00

// === 3. Enable Authentication + Create RBAC User ===
// 3.1 Create an Administrator User（The first must）
db.createUser({
  user: 'root',
  pwd: 'RootSecurePass!',
  roles: [{ role: 'root', db: 'admin' }]
});

// 3.2 Create a User Dedicated to Backups（Least Privilege）
db.createUser({
  user: 'backup_user',
  pwd: 'BackupPass!',
  roles: [
    { role: 'backup', db: 'admin' },
    { role: 'readAnyDatabase', db: 'admin' }
  ]
});

// 3.3 Create an Application User（Reading and Writing shopdb）
db.createUser({
  user: 'app_user',
  pwd: 'AppPass!',
  roles: [{ role: 'readWrite', db: 'shopdb' }]
});

// 3.4 Create a read-only analysis user
db.createUser({
  user: 'analytics_user',
  pwd: 'AnalyticsPass!',
  roles: [{ role: 'read', db: 'shopdb' }]
});

// 3.5 Enable TLS/SSL（mongod Startup Parameters）
// mongod --tlsMode requireTLS --tlsCertificateKeyFile /etc/ssl/mongodb.pem --auth

// === 4. Monitoring Alerts ===
// Enable the slow query log
db.setProfilingLevel(2, { slowms: 100 });

// View Slow Queries Top 10
db.system.profile.find({ millis: { $gt: 100 } })
  .sort({ ts: -1 })
  .limit(10)
  .forEach(p => print(`[${p.ts}] ${p.command.find}: ${p.millis}ms`));

// Monitor Connection Count
const stats = db.serverStatus();
print(`Active connections: ${stats.connections.current}/${stats.connections.available}`);
// Alert Thresholds：current > 1000 → Email Alerts

// === 5. Automated Inspection Script ===
function dailyHealthCheck() {
  print('=== MongoDB Daily Health Check ===');

  // 5.1 Dungeon Collection Status
  const rsStatus = rs.status();
  const primary = rsStatus.members.find(m => m.stateStr === 'PRIMARY');
  print(`Primary: ${primary.name}`);

  // 5.2 oplog Window（Avoid Overwriting）
  const oplogWindow = primary.optimeDate ? (Date.now() - primary.optimeDate.getTime()) / 1000 : 0;
  print(`Oplog window: ${Math.floor(oplogWindow / 3600)} hours`);
  if (oplogWindow > 24 * 3600) print('⚠️  WARNING: oplog window > 24h');

  // 5.3 Index Usage Rate
  const indexes = db.products.aggregate([{ $indexStats: {} }]).toArray();
  const unused = indexes.filter(i => i.accesses.ops === 0);
  print(`Unused indexes: ${unused.length}`);
  if (unused.length > 0) {
    unused.forEach(i => print(`  - ${i.name}`));
  }
}

dailyHealthCheck();