MongoDB 8.0 With Authorization On And SCRAM-SHA-256 Only
MongoDB Community 8.0 from MongoDB's repository, its key pinned by fingerprint: authorization on from the first start, the first administrator made through the localhost exception with a generated password, SCRAM-SHA-256 only, loopback. The live test writes as the administrator and is refused anonymously, with a wrong password and over SCRAM-SHA-1. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-10-03 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-mongodb?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [MongoDB 8.0 With Authorization On And SCRAM-SHA-256 Only](https://www.iac-bazaar.com/catalog/ansible-mongodb?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# MongoDB 8.0 With Authorization On And SCRAM-SHA-256 Only: https://www.iac-bazaar.com/catalog/ansible-mongodb (download from your IaC Bazaar account)
```Preview:
Documentation
mongodb
MongoDB Community Server 8.0 from MongoDB's own repository, its signing key checked against a pinned fingerprint: authorization on from the first start, the first administrator made through the localhost exception with a password generated on the host, SCRAM-SHA-256 as the only way to log in, and the listener on loopback. Original role for EL 10, live-tested with podman on Rocky Linux 10.
The vendor's repository, the vendor's key - and the vendor's licence. EL
10 packages no MongoDB. The role adds repo.mongodb.org only after the signing
key's fingerprint matches the one pinned in defaults, and installs the server
and mongosh from the 8.0 line (8.2 publishes no EL 10 server package -
measured). MongoDB Community Server is licensed under the Server Side Public
License: this role installs it on your host from MongoDB's repository and does
not redistribute it.
The vendor's unit, our configuration. The unit runs mongod as the mongod
user, Type=simple, with no restart on failure. mongod has no configuration
checker (--outputConfig aborted on every file, good or bad - measured), and a
file it cannot use stops it within a second while systemctl start still
returns 0, so the role waits for the server to answer after every start and
fails the run when it does not. The data directory goes from the package's 0755
to 0750; the listener is 127.0.0.1:27017 and stays on loopback, with any
other address added beside it.
The localhost exception, used once. With authorization on and no users,
mongod lets a client on the loopback interface create the first user and then
closes that door. The role makes the password (root 0600) and runs a script in
mongosh that logs in or, the first time, creates the administrator; the
script reads the password from its file, so it is in no command line and no
environment. A second run logs in and changes nothing. Change the password with
db.changeUserPassword and the file together: the script refuses to go on when
it cannot log in.
SCRAM-SHA-256 only. The server offers no other mechanism and the administrator has SHA-256 credentials only, so a SCRAM-SHA-1 login with the right password is refused (measured).
Proven by mongosh. The administrator writes a document and reads it back;
an anonymous read and an anonymous createUser are both refused ("requires
authentication": the exception is closed), a wrong password is refused,
SCRAM-SHA-1 is refused, the password file is root's alone, the data directory
is mongod's at 0750, and the log carries no access-control warning.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-clickhouse
ClickHouse on EL 10 from the upstream LTS release (sha512-verified), as a hardened systemd service on loopback with the default user behind a password; the live test creates a MergeTree table, inserts a row and selects it back over HTTP; a query without credentials is refused. Original role, live-tested on Rocky Linux 10.
ansible-dragonfly
Dragonfly on EL 10 from the vendor's release, pinned by a SHA-256 the role carries (the vendor publishes no checksum file), as a hardened systemd service on loopback behind a password kept in a flagfile; the live test speaks RESP itself: an unauthenticated PING and a wrong password are refused, AUTH + SET + GET round-trip. Original role, live-tested on Rocky Linux 10.
ansible-influxdb3
InfluxDB 3 Core on EL 10 from the vendor's release (checksum-verified), as a hardened systemd service on loopback with file object storage; the binary runs from its release directory (it links the Python it ships); the live test writes a point in line protocol and reads it back with SQL. Original role, live-tested on Rocky Linux 10.
ansible-mariadb-server
MariaDB bound to loopback (the package listens everywhere), with the mariadb-secure-installation steps applied by the role: anonymous users, the test database and remote root gone, LOAD DATA LOCAL off, reverse DNS off. Provisions an application database and a user that can see nothing else. Original role, live-tested on Rocky Linux 10.
ansible-meilisearch
Meilisearch on EL 10 from the vendor's release, pinned by a SHA-256 the role carries (the vendor publishes no checksum file), as a hardened systemd service on loopback in production mode behind a master key; the live test creates an index and documents, waits for the indexing task, searches and finds the one match, and sees a keyless request refused. Original role, live-tested on Rocky Linux 10.
ansible-opensearch
OpenSearch 3 (sha512-verified min distribution, bundled JDK), one node on EL 10 from the upstream release, as a hardened systemd service on loopback; the live test reads the root document, indexes one document with a refresh, finds it by a search, deletes the index and checks the keystore belongs to the service; the release tree stays read-only. Original role, live-tested on Rocky Linux 10.