---
title: MongoDB
url: "/docs/databases/mongodb/"
canonical_url: https://docs.blossom88.com/docs/databases/mongodb/
markdown_url: https://docs.blossom88.com/docs/databases/mongodb.md
summary: MongoDB databases with recovery backups, public access, TLS on every connection,
  and a stable private endpoint
categories:
- data
- databases
- mongodb
---

# MongoDB

Blossom runs MongoDB 8 as a Database with a stable private endpoint,
generated credentials, encrypted recovery backups, opt-in public access, and
TLS on every connection.

## Dedicated Node And Storage

A Dedicated Database is one MongoDB node on its own Server, with its data on
separate storage that follows the node. You choose the region and the storage
size in GB; Blossom provisions the Server, attaches the storage, starts
MongoDB only from that storage, and reports each step in Activity. Storage
grows online while MongoDB keeps serving and never shrinks. When a Server
fails, Blossom confirms the failure, reattaches the same storage to a
replacement Server, and starts MongoDB from the same data behind the same
endpoint.

    blossom database_instance:init

writes database_instance.yml; set `engine: mongodb`:

```yaml
database_instance:
  name: production
  engine: postgres # postgres, mysql, mariadb, or mongodb
  availability: shared # the default where the Location has Data Capacity; or dedicated, its own Server
  storage_gib: 20 # 10 to 1000 GB; grows online later, never shrinks
  # ...
```

    blossom database_instance:create --data database_instance.yml --follow

## Recovery Backups

Select Backup Storage to enable encrypted recovery backups. Each backup is a
compressed `mongodump` archive of the database, encrypted before it leaves
the node. Blossom creates the initial backup automatically, and a completed
backup restores an independent Database while the source lives or after it
is deleted. MongoDB backups restore to the backup's own point; point-in-time
recovery is a PostgreSQL feature.

## Public Access

A Database is private by default. Turning public access on gives it one public
name that answers only over TLS, with a certificate Blossom issues and renews,
and only to the source addresses you list. MongoDB terminates the TLS itself
and refuses plaintext connections. Private links, credentials, and data do
not change, and turning public access off withdraws the name, the network
path, and the certificate.

Public access needs Dedicated availability. A Shared Database stays
private to its linked Environments; choose Dedicated when it must be reachable
from the Internet.

    blossom database_instance:update --id database_instance-100 --data '{"database_instance":{"public_access":true,"public_allowed_sources":["203.0.113.4/32"]}}'
    blossom database_instance:credentials --id database_instance-100

Connect with a client that verifies the server certificate, such as
`mongosh --tls` with the public name. The password is shown only by
`database_instance:credentials` on an explicit request.

## Connect

Create an Environment Link with `target_type: DatabaseInstance`. Blossom supplies a
private `DATABASE_URL` containing the generated credentials, endpoint, port,
and database name to every Service in the Environment. The URL already asks
the driver for TLS, so connections inside your Account are encrypted without
any driver settings of your own. Applications should use that URL rather
than a provider address or Container name.

The current MongoDB scope is one primary. Replica sets, automatic failover,
and database monitoring are not available for MongoDB.

- [Databases](/docs/databases/)
- [Database And Cache Security](/docs/databases/security/)
- [MongoDB documentation](https://www.mongodb.com/docs/)