Step 1 – Verify MongoDB Works

Your server’s IP address and root password are shown in the Server Information section on the Overview tab of your server in the client portal. The application settings you entered when ordering, passwords included, are shown in the MongoDB Credentials card on the same tab. mongo-express is a web-based admin interface for MongoDB. Open https://your.server.ip/mongo-express in a browser to verify it works.

HTTPS without a domain. Since January 2026 Let’s Encrypt issues certificates for IP addresses (official announcement), so your server gets a real, browser-trusted certificate on first boot – before you connect any domain. Certificates of this kind are short-lived (about six days) and renew automatically. If your server is not reachable from the internet on port 80 (for example, it sits behind a router), the certificate cannot be issued – in that case the browser shows a warning for a self-signed certificate – accept it, or use http:// instead.

MongoDB admin login:

• Username: admin
• Password: the MongoDB Admin Password you entered during the order

With mongo-express you can browse databases, view and edit documents, run queries and manage collections without using the command line.

Database servers don’t need public internet access. For secure access, place the server on a private network behind a VyOS router and connect through a VPN on the router (WireGuard or OpenVPN, on the router’s Configuration tab) to reach MongoDB and mongo-express on the server’s private IP. On a private address the server does not get the IP certificate, so open mongo-express over http:// there – the VPN already encrypts the connection.

Firewall. If you turn on the Firewall for this server in the client portal, allow incoming TCP port 80 in its rules, along with 443 for mongo-express. Certificates renew over port 80 – the IP certificate every few days – and without that rule the certificate expires and the browser starts showing a warning.

Step 2 – Connect to MongoDB Remotely

MongoDB is configured to accept remote connections with authentication. You can connect from any application or tool:

mongosh "mongodb://admin:your_admin_password@your.server.ip:27017/admin"

Connection details for MongoDB GUI tools (MongoDB Compass, Studio 3T, etc.):

Connection string format:

mongodb://admin:your_admin_password@your.server.ip:27017/admin

Note: Port 27017 is the MongoDB wire protocol, not HTTP – it cannot be opened in a browser. Use a database client or the command above.

Step 3 – Enable SSL for mongo-express (Optional)

If you have a domain pointing to this server, you can enable HTTPS for mongo-express with a free Let’s Encrypt certificate. Connect via SSH and run:

ssh root@your.server.ip

/opt/setup/get-ssl.sh db.yourdomain.com

The script will verify DNS, obtain a certificate and configure Apache for HTTPS automatically. After completion, mongo-express is available at https://db.yourdomain.com/mongo-express.

Note: Make sure your domain’s A record points to the server IP before running the script. SSL is optional – mongo-express works fine over HTTP with IP address access.

Creating Additional Databases and Users

You can create additional databases and users via mongo-express or SSH:

mongosh -u admin -p --authenticationDatabase admin

use newdb
db.createUser({
    user: "newuser",
    pwd: "strong_password",
    roles: [{ role: "readWrite", db: "newdb" }]
})

Import and Export

Via mongo-express: Use the web interface to view and edit individual documents.

Via command line (recommended for bulk operations):

# Export entire database
mongodump -u admin -p your_admin_password --authenticationDatabase admin -d your_database -o /tmp/backup/

# Import database
mongorestore -u admin -p your_admin_password --authenticationDatabase admin -d your_database /tmp/backup/your_database/

# Export single collection to JSON
mongoexport -u admin -p your_admin_password --authenticationDatabase admin -d your_database -c your_collection -o collection.json

# Import JSON into collection
mongoimport -u admin -p your_admin_password --authenticationDatabase admin -d your_database -c your_collection --file collection.json

Fail2Ban – Brute-Force Protection

Your server comes with Fail2Ban pre-configured to protect both SSH and mongo-express from brute-force attacks.

Useful commands:

# Check banned IPs
fail2ban-client status mongo-express
fail2ban-client status sshd

# Unban an IP
fail2ban-client set mongo-express unbanip 1.2.3.4

If you accidentally lock yourself out, open the Console on your server’s Overview tab in the client portal and unban your IP.

Service Management

MongoDB, mongo-express and Apache run via systemd. Common commands:

# Check service status
systemctl status mongod
systemctl status mongo-express
systemctl status apache2

# Restart MongoDB
systemctl restart mongod

# View MongoDB logs
journalctl -u mongod -n 100

MongoDB Performance Tuning

WiredTiger cache is automatically set to 50% of RAM on first boot. To check the current value:

mongosh -u admin -p --authenticationDatabase admin --eval "db.serverStatus().wiredTiger.cache"

To adjust manually, edit /etc/mongod.conf (under storage.wiredTiger.engineConfig.cacheSizeGB) and restart MongoDB:

systemctl restart mongod

Server Credentials

MongoDB and mongo-express credentials are stored in /root/.mongo_credentials.

What’s Pre-Configured

• Authentication: MongoDB authorization enabled with SCRAM-SHA-256. Admin user has root privileges
• Remote access: MongoDB accepts connections from any IP on port 27017
• WiredTiger cache: Automatically tuned to 50% of available RAM on first boot
• Web interface: mongo-express runs behind Apache reverse proxy at /mongo-express

Software Included

• MongoDB Documentation: mongodb.com/docs/manual
• mongo-express Documentation: github.com/mongo-express