MongoDB replica set installation (3 members, keyfile and authorization)

Builds a three-member MongoDB 8.0 (or 7.0) replica set from scratch: official repository, XFS data directory, WiredTiger cache sized to RAM, keyfile authentication between members, authorization, administrator and application users, read/write concern, failover test and connection string. The result is a password-protected replica set that survives the loss of a single member without downtime. If the data or write load will outgrow a single server, open the sharded cluster guide; day-to-day operations, backup and hardening of an existing set are covered in separate MongoDB guides.

Topology: 3 servers (1 primary + 2 secondaries), an odd number of data-bearing members

Before you start

• All servers run the same, up-to-date operating system; time is synchronized with NTP (chrony). Clock skew between members causes session and oplog problems.
• RAM and CPU match the values in the form (the WiredTiger cache is calculated from this value). Swap is configured but small.
• The data directory (…) is on a separate disk/LV, formatted with XFS, mounted with noatime and persistent in fstab. ext4 with WiredTiger can cause performance problems.
• Every server name resolves from all servers and from the application servers (DNS or /etc/hosts). The replica set configuration uses names, not IPs.
• Port … is open between the servers; the application network can reach these ports. The port is not used by another service.
• The servers can reach repo.mongodb.org and pgp.mongodb.com over HTTPS, or an internal mirror is configured.
• Neither the operating system's own mongodb package nor an old MongoDB installation is present.
• scp works from the first server to the others as root (or a sudo-capable user) (to copy the keyfile). Otherwise move the file manually by a secure method.
• You are logged in with root or sudo privileges; the maintenance window and a server snapshot (fallback) plan are ready.

Phases of the guide

• Operating system preparation (all members) — Hostname: … · System update and required tools · Name resolution (/etc/hosts) · Kernel parameters (sysctl) · Apply the sysctl settings · Transparent Huge Pages: enable for 8.0 …
• Installing the MongoDB software (all members) — Add the MongoDB … repository · Add the MongoDB … repository · Install MongoDB · Prepare the data directory · SELinux policy and labels
• Keyfile (authentication between members) — Create the keyfile · Copy the keyfile to the other members · Keyfile permissions: …
• Configuration — mongod.conf: … · Check the systemd settings · Open the port in the firewall
• Starting the service (all members) — Enable and start mongod
• Initiate the replica set and create the users — Check access to the other members · rs.initiate · Create the administrator user · Create the application user · Default read/write concern
• Verification and failover test — Replica set status · Write/read test · Planned failover test (rs.stepDown) · Application connection string
• Post-installation — Log rotation · Test logrotate · Plan backups (mandatory) · Set up monitoring · Security: TLS and access