# MongoDB Encryption Configuration for DPDPA Rule 6(1)(a)
# Version: 1.0 | Date: 2026-04-02
# Usage: Copy to /etc/mongod.conf and restart MongoDB

# =============================================================================
# 1. WiredTiger Encryption at Rest
# =============================================================================

security:
  # Enable encryption (requires MongoDB Enterprise)
  enableEncryption: true

  # Encryption key file (master key)
  encryptionKeyFile: /etc/mongodb/encryption-keyfile
  # IMPORTANT: Secure with chmod 600, backup to secure location

  # Encryption cipher mode
  encryptionCipherMode: AES256-CBC

# KMIP (Key Management Interoperability Protocol) integration (alternative to keyfile)
# security:
#   kmip:
#     serverName: kmip.example.com
#     port: 5696
#     clientCertificateFile: /etc/ssl/mongodb-client.pem
#     serverCAFile: /etc/ssl/kmip-ca.pem

# =============================================================================
# 2. TLS/SSL for Client and Replica Set Connections
# =============================================================================

net:
  port: 27017
  bindIp: 0.0.0.0

  tls:
    mode: requireTLS  # Require TLS for all connections
    certificateKeyFile: /etc/ssl/mongodb.pem  # Server certificate + private key
    CAFile: /etc/ssl/ca.pem  # Certificate Authority
    allowConnectionsWithoutCertificates: false  # Require client certs (mTLS)

    # TLS version (MongoDB 4.0+ supports TLS 1.3)
    disabledProtocols: TLS1_0,TLS1_1  # Disable weak TLS versions

# =============================================================================
# 3. Audit Logging (Track Access to Encrypted Data)
# =============================================================================

auditLog:
  destination: file
  format: JSON
  path: /var/log/mongodb/audit.json

  # Audit filter (log only data access operations)
  filter: '{ atype: { $in: [ "authenticate", "createCollection", "dropCollection", "insert", "update", "delete", "find" ] } }'

# =============================================================================
# 4. Storage Configuration
# =============================================================================

storage:
  dbPath: /var/lib/mongodb
  journal:
    enabled: true

  # WiredTiger storage engine (required for encryption)
  engine: wiredTiger

  wiredTiger:
    engineConfig:
      cacheSizeGB: 1  # Adjust based on RAM (50-80% of available RAM)

# =============================================================================
# Setup Instructions
# =============================================================================

# 1. Generate encryption key file:
#    openssl rand -base64 32 > /etc/mongodb/encryption-keyfile
#    chown mongodb:mongodb /etc/mongodb/encryption-keyfile
#    chmod 600 /etc/mongodb/encryption-keyfile

# 2. Generate TLS certificates:
#    # Self-signed (for testing):
#    openssl req -newkey rsa:2048 -nodes -keyout mongodb-key.pem -x509 -days 365 -out mongodb-cert.pem
#    cat mongodb-key.pem mongodb-cert.pem > /etc/ssl/mongodb.pem
#
#    # Production: Use Let's Encrypt or corporate CA

# 3. Restart MongoDB:
#    systemctl restart mongod

# 4. Verify encryption is enabled:
#    mongo --tls --tlsCertificateKeyFile /etc/ssl/mongodb.pem --tlsCAFile /etc/ssl/ca.pem
#    db.serverStatus().security

# 5. Verify TLS connection:
#    mongo --tls --tlsCertificateKeyFile client.pem --tlsCAFile ca.pem mongodb://hostname:27017/admin

# =============================================================================
# Backup with Encryption
# =============================================================================

# Encrypt mongodump backups:
# mongodump --archive | openssl enc -aes-256-cbc -salt -out backup-$(date +%Y%m%d).archive.enc

# Decrypt backup:
# openssl enc -d -aes-256-cbc -in backup-20260402.archive.enc | mongorestore --archive

# =============================================================================
# Best Practices
# =============================================================================

# DO: Store encryption keyfile in KMS (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault)
# DON'T: Commit keyfile to Git or store in plaintext on disk

# DO: Use KMIP for enterprise key management (integrates with HSM)
# DON'T: Rely solely on filesystem permissions for key security

# DO: Test TLS connection before deploying to production
# DON'T: Disable TLS in production (even temporarily)

# DO: Rotate encryption keys annually
# DON'T: Never rotate keys (increases cryptoperiod risk)