MongoDB

backupd backs up MongoDB 4.2 and later with mongodump, as a single archive. When it backs up a whole replica set it includes the oplog, so the copy is consistent to one moment. MongoDB Atlas works with the mongodb+srv:// string Atlas gives you.

Connection stringCopy Anchor Link

mongodb+srv://user:password@cluster0.example.mongodb.net/app

• The scheme is mongodb:// or mongodb+srv://.
• Put a database in the path to back up only that database. Leave it out to back up the whole instance. The admin, config and local databases are never restored or tested.
• Every host, including each SRV target, must resolve to a public address.

TLSCopy Anchor Link

backupd always connects with TLS. A mongodb+srv:// address uses TLS already. For a mongodb:// address, add tls=true:

mongodb://user:password@db1.example.com:27017,db2.example.com:27017/?replicaSet=rs0&tls=true

Without it, the backup fails with backupd connects over TLS; add tls=true to the connection string.

Authentication and optionsCopy Anchor Link

• Authentication must be SCRAM (SCRAM-SHA-1 or SCRAM-SHA-256). Other mechanisms fail with Use SCRAM authentication (authMechanism=SCRAM-SHA-256).
• These connection options are supported: appName, authSource, authMechanism, compressors, connectTimeoutMS, directConnection, loadBalanced, maxPoolSize, readConcernLevel, readPreference, readPreferenceTags, replicaSet, retryReads, retryWrites, serverSelectionTimeoutMS, socketTimeoutMS, srvMaxHosts, srvServiceName, ssl, tls, tlsAllowInvalidCertificates, tlsAllowInvalidHostnames, tlsInsecure, w, wtimeoutMS and zlibCompressionLevel. Any other option fails with The connection option "…" isn't supported.

PermissionsCopy Anchor Link

Give the backupd user the built-in backup role. To restore from the app, the target user also needs the restore role.

db.getSiblingDB("admin").createUser({
  user: "backupd",
  pwd: "choose-a-strong-password",
  roles: [{ role: "backup", db: "admin" }],
});

On Atlas, create a database user with the equivalent access and add backupd to the project's network access list.

What is backed upCopy Anchor Link

• The database in the path, or the whole instance when there is none.
• The oplog, when the connection string points at a whole replica set (no database in the path). A single-database backup, or a sharded cluster through mongos, is dumped without it.

Files are named with the .archive.zst.age extension: a mongodump archive, compressed with zstd and encrypted with age.

Document counts and restore testsCopy Anchor Link

mongodump reports the documents it dumped for each collection. The restore test restores the archive under a temporary prefix on a sandbox MongoDB server, counts every collection, compares the counts, and drops the copy. The admin, config and local databases are never restored or tested. See Integrity checks and restore tests.

RestoringCopy Anchor Link

In-app restores use mongorestore and stop on the first error. Backups that include the oplog are replayed with it. Tick Replace tables that already exist in the target to drop each collection before it is restored.

To restore yourself, see Restore without backupd.

LimitationsCopy Anchor Link

• No point-in-time recovery or incremental backups. Every backup is a full copy.
• No private networks, VPC peering or SSH tunnels.
• A dump that sends no data for 5 minutes is stopped.