Skip to content

Harden mongo#555

Open
tvdijen wants to merge 3 commits intoOpenConext:mainfrom
tvdijen:patch-1
Open

Harden mongo#555
tvdijen wants to merge 3 commits intoOpenConext:mainfrom
tvdijen:patch-1

Conversation

@tvdijen
Copy link
Contributor

@tvdijen tvdijen commented Oct 16, 2025 •
edited
Loading

This disables legacy TLS-protocols and server-side javascript processing which is enabled by default.
Taken from CIS hardening guidelines for Mongo

@tvdijen
Harden mongo
e995016 
This disables legacy TLS-protocols and server-side javascript processing which is enabled by default
@tvdijen
Copy link
Contributor Author

tvdijen commented Oct 16, 2025

To consider:

Add:

security:
  clusterIpSourceAllowlist:
    - 10.x.x.x/28

To restrict the clients that can communicate with the Mongo server.

@crosmuller
Copy link
Contributor

crosmuller commented Nov 14, 2025

Thank you for this, I haven't had time to test and merge but will soon as possible, same for the mariadb PR

@tvdijen
Copy link
Contributor Author

tvdijen commented Nov 14, 2025

Sure @crosmuller, no worries! It's just something I'm returning to the community. All fine if you don't accept it

@phavekes phavekes requested a review from crosmuller February 27, 2026 08:38
@phavekes
Copy link
Member

phavekes commented Feb 27, 2026

Oppakken na https://github.com/OpenConext/OpenConext-deploy/tree/feature/refactor_mongo

@phavekes phavekes added the Do not merge Work in progress, or other blocking reasons label Feb 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@crosmuller crosmuller Awaiting requested review from crosmuller

Assignees

@crosmuller crosmuller

Labels

Do not merge Work in progress, or other blocking reasons

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@tvdijen @crosmuller @phavekes