# MongoDB (/docs/databases/mongodb)

backupd backs up MongoDB 4.2 and later with `mongodump`, as a single archive. When it backs up a whole replica set it includes the oplog, so the copy is consistent to one moment. MongoDB Atlas works with the `mongodb+srv://` string Atlas gives you.

## Connection string [#connection-string]

```txt
mongodb+srv://user:password@cluster0.example.mongodb.net/app
```

- The scheme is `mongodb://` or `mongodb+srv://`.
- **Put a database in the path** to back up only that database. **Leave it out** to back up the whole instance. The `admin`, `config` and `local` databases are never restored or tested.
- Every host, including each SRV target, must resolve to a public address.

## TLS [#tls]

backupd always connects with TLS. A `mongodb+srv://` address uses TLS already. For a `mongodb://` address, add `tls=true`:

```txt
mongodb://user:password@db1.example.com:27017,db2.example.com:27017/?replicaSet=rs0&tls=true
```

Without it, the backup fails with _backupd connects over TLS; add tls=true to the connection string_.

## Authentication and options [#authentication-and-options]

- Authentication must be SCRAM (`SCRAM-SHA-1` or `SCRAM-SHA-256`). Other mechanisms fail with _Use SCRAM authentication (authMechanism=SCRAM-SHA-256)_.
- These connection options are supported: `appName`, `authSource`, `authMechanism`, `compressors`, `connectTimeoutMS`, `directConnection`, `loadBalanced`, `maxPoolSize`, `readConcernLevel`, `readPreference`, `readPreferenceTags`, `replicaSet`, `retryReads`, `retryWrites`, `serverSelectionTimeoutMS`, `socketTimeoutMS`, `srvMaxHosts`, `srvServiceName`, `ssl`, `tls`, `tlsAllowInvalidCertificates`, `tlsAllowInvalidHostnames`, `tlsInsecure`, `w`, `wtimeoutMS` and `zlibCompressionLevel`. Any other option fails with _The connection option "…" isn't supported_.

## Permissions [#permissions]

Give the backupd user the built-in `backup` role. To restore from the app, the target user also needs the `restore` role.

```js
db.getSiblingDB("admin").createUser({
  user: "backupd",
  pwd: "choose-a-strong-password",
  roles: [{ role: "backup", db: "admin" }],
});
```

On Atlas, create a database user with the equivalent access and add backupd to the project's network access list.

## What is backed up [#what-is-backed-up]

- The database in the path, or the whole instance when there is none.
- **The oplog**, when the connection string points at a whole replica set (no database in the path). A single-database backup, or a sharded cluster through `mongos`, is dumped without it.

Files are named with the `.archive.zst.age` extension: a `mongodump` archive, compressed with zstd and encrypted with age.

## Document counts and restore tests [#document-counts-and-restore-tests]

`mongodump` reports the documents it dumped for each collection. The restore test restores the archive under a temporary prefix on a sandbox MongoDB server, counts every collection, compares the counts, and drops the copy. The `admin`, `config` and `local` databases are never restored or tested. See [Integrity checks and restore tests](/docs/backups/verification).

## Restoring [#restoring]

In-app restores use `mongorestore` and stop on the first error. Backups that include the oplog are replayed with it. Tick **Replace tables that already exist in the target** to drop each collection before it is restored.

To restore yourself, see [Restore without backupd](/docs/restoring/without-backupd).

## Limitations [#limitations]

- No point-in-time recovery or incremental backups. Every backup is a full copy.
- No private networks, VPC peering or SSH tunnels.
- A dump that sends no data for 5 minutes is stopped.