From 3f8a2242b200d10eb33ee83caa870bec0c458e7e Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 21 Jan 2025 14:44:10 +0100
Subject: [PATCH 1/7] nixos/mongodb: use mongosh instead of legacy shell

---
 nixos/doc/manual/release-notes/rl-2505.section.md |  2 ++
 nixos/modules/services/databases/mongodb.nix      | 14 ++++++++------
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index cb005a1e9b96..93612cee03f1 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -390,6 +390,8 @@
 
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.
 
+- [`services.mongodb.enableAuth`](#opt-services.mongodb.enableAuth) now uses the newer [mongosh](https://github.com/mongodb-js/mongosh) shell instead of the legacy shell to configure the initial superuser. You can configure the mongosh package to use through the [`services.mongodb.mongoshPackage`](#opt-services.mongodb.mongoshPackage) option.
+
 - The paperless module now has an option for regular automatic export of
   documents data using the integrated document exporter.
 
diff --git a/nixos/modules/services/databases/mongodb.nix b/nixos/modules/services/databases/mongodb.nix
index 90b749574bf5..206b076dab49 100644
--- a/nixos/modules/services/databases/mongodb.nix
+++ b/nixos/modules/services/databases/mongodb.nix
@@ -10,6 +10,8 @@ let
 
   mongodb = cfg.package;
 
+  mongoshExe = lib.getExe cfg.mongoshPackage;
+
   mongoCnf =
     cfg:
     pkgs.writeText "mongodb.conf" ''
@@ -36,6 +38,8 @@ in
 
       package = lib.mkPackageOption pkgs "mongodb" { };
 
+      mongoshPackage = lib.mkPackageOption pkgs "mongosh" { };
+
       user = lib.mkOption {
         type = lib.types.str;
         default = "mongodb";
@@ -125,8 +129,6 @@ in
     };
     users.groups.mongodb = lib.mkIf (cfg.user == "mongodb") { };
 
-    environment.systemPackages = [ mongodb ];
-
     systemd.services.mongodb = {
       description = "MongoDB server";
 
@@ -164,10 +166,10 @@ in
           if ! test -e "${cfg.dbpath}/.auth_setup_complete"; then
             systemd-run --unit=mongodb-for-setup --uid=${cfg.user} ${mongodb}/bin/mongod --config ${mongoCnf cfg_}
             # wait for mongodb
-            while ! ${mongodb}/bin/mongo --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done
+            while ! ${mongoshExe} --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done
 
-          ${mongodb}/bin/mongo <<EOF
-            use admin
+          ${mongoshExe} <<EOF
+            use admin;
             db.createUser(
               {
                 user: "root",
@@ -187,7 +189,7 @@ in
       postStart = ''
         if test -e "${cfg.dbpath}/.first_startup"; then
           ${lib.optionalString (cfg.initialScript != null) ''
-            ${mongodb}/bin/mongo ${lib.optionalString (cfg.enableAuth) "-u root -p ${cfg.initialRootPassword}"} admin "${cfg.initialScript}"
+            ${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p ${cfg.initialRootPassword}"} admin "${cfg.initialScript}"
           ''}
           rm -f "${cfg.dbpath}/.first_startup"
         fi

From 2f8af3ea9341d37e6203cb8ca4a8d5dcacbca5e7 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 21 Jan 2025 14:47:51 +0100
Subject: [PATCH 2/7] nixos/mongodb: replace option initialRootPassword with
 initialRootPasswordFile

---
 .../manual/release-notes/rl-2505.section.md   |  2 ++
 nixos/modules/services/databases/mongodb.nix  | 23 +++++++++++++------
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 93612cee03f1..67283646c95c 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -220,6 +220,8 @@
 
 - `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.
 
+- `services.mongodb.initialRootPassword` has been replaced with the more secure option [`services.mongodb.initialRootPasswordFile`](#opt-services.mongodb.initialRootPasswordFile)
+
 - `rofi` has been updated from 1.7.5 to 1.7.6 which introduces some breaking changes to binary plugins, and also contains a lot of new features and bug fixes. This is highlighted because the patch version bump does not indicate the volume of changes by itself. See the [upstream release notes](https://github.com/davatorium/rofi/releases/tag/1.7.6) for the full list of changes.
 
 - `ente-auth` now uses the name `enteauth` for its binary. The previous name was `ente_auth`.
diff --git a/nixos/modules/services/databases/mongodb.nix b/nixos/modules/services/databases/mongodb.nix
index 206b076dab49..6ad00d3682c3 100644
--- a/nixos/modules/services/databases/mongodb.nix
+++ b/nixos/modules/services/databases/mongodb.nix
@@ -27,6 +27,13 @@ let
 in
 
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mongodb"
+      "initialRootPassword"
+    ] "Use services.mongodb.initialRootPasswordFile to securely provide the initial root password.")
+  ];
 
   ###### interface
 
@@ -64,10 +71,10 @@ in
         description = "Enable client authentication. Creates a default superuser with username root!";
       };
 
-      initialRootPassword = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
+      initialRootPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
-        description = "Password for the root user if auth is enabled.";
+        description = "Path to the file containing the password for the root user if auth is enabled.";
       };
 
       dbpath = lib.mkOption {
@@ -116,8 +123,8 @@ in
   config = lib.mkIf config.services.mongodb.enable {
     assertions = [
       {
-        assertion = !cfg.enableAuth || cfg.initialRootPassword != null;
-        message = "`enableAuth` requires `initialRootPassword` to be set.";
+        assertion = !cfg.enableAuth || cfg.initialRootPasswordFile != null;
+        message = "`enableAuth` requires `initialRootPasswordFile` to be set.";
       }
     ];
 
@@ -168,12 +175,13 @@ in
             # wait for mongodb
             while ! ${mongoshExe} --eval "db.version()" > /dev/null 2>&1; do sleep 0.1; done
 
+            initialRootPassword=$(<${cfg.initialRootPasswordFile})
           ${mongoshExe} <<EOF
             use admin;
             db.createUser(
               {
                 user: "root",
-                pwd: "${cfg.initialRootPassword}",
+                pwd: "$initialRootPassword",
                 roles: [
                   { role: "userAdminAnyDatabase", db: "admin" },
                   { role: "dbAdminAnyDatabase", db: "admin" },
@@ -189,7 +197,8 @@ in
       postStart = ''
         if test -e "${cfg.dbpath}/.first_startup"; then
           ${lib.optionalString (cfg.initialScript != null) ''
-            ${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p ${cfg.initialRootPassword}"} admin "${cfg.initialScript}"
+            initialRootPassword=$(<${cfg.initialRootPasswordFile})
+            ${mongoshExe} ${lib.optionalString (cfg.enableAuth) "-u root -p $initialRootPassword"} admin "${cfg.initialScript}"
           ''}
           rm -f "${cfg.dbpath}/.first_startup"
         fi

From d223d3f15d6bf78a7d5a50a3738b30a671d43433 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 21 Jan 2025 14:51:41 +0100
Subject: [PATCH 3/7] nixos/mongodb: add pkgs.mongodb-ce as package option
 example

---
 nixos/doc/manual/release-notes/rl-2505.section.md | 2 ++
 nixos/modules/services/databases/mongodb.nix      | 4 +++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 67283646c95c..b53e59995ac0 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -380,6 +380,8 @@
 
 - GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details.
 
+- [`services.mongodb`](#opt-services.mongodb.enable) is now compatible with the `mongodb-ce` binary package. To make use of it, set [`services.mongodb.package`](#opt-services.mongodb.package) to `pkgs.mongodb-ce`.
+
 - [`services.jupyter`](#opt-services.jupyter.enable) is now compatible with `Jupyter Notebook 7`. See [the migration guide](https://jupyter-notebook.readthedocs.io/en/latest/migrate_to_notebook7.html) for details.
 
 - `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option.
diff --git a/nixos/modules/services/databases/mongodb.nix b/nixos/modules/services/databases/mongodb.nix
index 6ad00d3682c3..129b679d73f8 100644
--- a/nixos/modules/services/databases/mongodb.nix
+++ b/nixos/modules/services/databases/mongodb.nix
@@ -43,7 +43,9 @@ in
 
       enable = lib.mkEnableOption "the MongoDB server";
 
-      package = lib.mkPackageOption pkgs "mongodb" { };
+      package = lib.mkPackageOption pkgs "mongodb" {
+        example = "pkgs.mongodb-ce";
+      };
 
       mongoshPackage = lib.mkPackageOption pkgs "mongosh" { };
 

From fd348f4354390ae87836e879730d4465449cd239 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 21 Jan 2025 16:28:54 +0100
Subject: [PATCH 4/7] nixosTests.mongodb: migrate from handleTest to runTest

---
 nixos/tests/all-tests.nix |   2 +-
 nixos/tests/mongodb.nix   | 109 ++++++++++++++++++--------------------
 2 files changed, 54 insertions(+), 57 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index a8c334f62b84..467263d37dc4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -622,7 +622,7 @@ in {
   monado = handleTest ./monado.nix {};
   monetdb = handleTest ./monetdb.nix {};
   monica = handleTest ./web-apps/monica.nix {};
-  mongodb = handleTest ./mongodb.nix {};
+  mongodb = runTest ./mongodb.nix;
   moodle = handleTest ./moodle.nix {};
   moonraker = handleTest ./moonraker.nix {};
   mopidy = handleTest ./mopidy.nix {};
diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix
index a42ba0abf423..c1dac415234f 100644
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@@ -1,59 +1,56 @@
 # This test start mongodb, runs a query using mongo shell
+{ pkgs, ... }:
+let
+  testQuery = pkgs.writeScript "nixtest.js" ''
+    db.greetings.insert({ "greeting": "hello" });
+    print(db.greetings.findOne().greeting);
+  '';
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    testQuery = pkgs.writeScript "nixtest.js" ''
-      db.greetings.insert({ "greeting": "hello" });
-      print(db.greetings.findOne().greeting);
+  runMongoDBTest = pkg: ''
+    node.execute("(rm -rf data || true) && mkdir data")
+    node.execute(
+        "${pkg}/bin/mongod --fork --logpath logs --dbpath data"
+    )
+    node.wait_for_open_port(27017)
+
+    assert "hello" in node.succeed(
+        "${pkg}/bin/mongo ${testQuery}"
+    )
+
+    node.execute(
+        "${pkg}/bin/mongod --shutdown --dbpath data"
+    )
+    node.wait_for_closed_port(27017)
+  '';
+
+in
+{
+  name = "mongodb";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      bluescreen303
+      offline
+      phile314
+    ];
+  };
+
+  nodes = {
+    node =
+      { ... }:
+      {
+        environment.systemPackages = with pkgs; [
+          # remember to update mongodb.passthru.tests if you change this
+          mongodb-7_0
+        ];
+      };
+  };
+
+  testScript =
+    ''
+      node.start()
+    ''
+    + runMongoDBTest pkgs.mongodb-7_0
+    + ''
+      node.shutdown()
     '';
-
-    runMongoDBTest = pkg: ''
-      node.execute("(rm -rf data || true) && mkdir data")
-      node.execute(
-          "${pkg}/bin/mongod --fork --logpath logs --dbpath data"
-      )
-      node.wait_for_open_port(27017)
-
-      assert "hello" in node.succeed(
-          "${pkg}/bin/mongo ${testQuery}"
-      )
-
-      node.execute(
-          "${pkg}/bin/mongod --shutdown --dbpath data"
-      )
-      node.wait_for_closed_port(27017)
-    '';
-
-  in
-  {
-    name = "mongodb";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        bluescreen303
-        offline
-        phile314
-      ];
-    };
-
-    nodes = {
-      node =
-        { ... }:
-        {
-          environment.systemPackages = with pkgs; [
-            # remember to update mongodb.passthru.tests if you change this
-            mongodb-7_0
-          ];
-        };
-    };
-
-    testScript =
-      ''
-        node.start()
-      ''
-      + runMongoDBTest pkgs.mongodb-7_0
-      + ''
-        node.shutdown()
-      '';
-  }
-)
+}

From ac16c51570b99aa0e2afc3b076c852caf24fae8e Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 21 Jan 2025 16:33:39 +0100
Subject: [PATCH 5/7] nixosTests.mongodb: actually use mongodb service module
 and add support for mongodb-ce

---
 nixos/tests/mongodb.nix | 71 +++++++++++++++--------------------------
 1 file changed, 26 insertions(+), 45 deletions(-)

diff --git a/nixos/tests/mongodb.nix b/nixos/tests/mongodb.nix
index c1dac415234f..2b4b0fbe6a50 100644
--- a/nixos/tests/mongodb.nix
+++ b/nixos/tests/mongodb.nix
@@ -1,56 +1,37 @@
-# This test start mongodb, runs a query using mongo shell
-{ pkgs, ... }:
+# This test starts mongodb and runs a query using mongo shell
+{ config, lib, ... }:
 let
+  # required for test execution on darwin
+  pkgs = config.node.pkgs;
   testQuery = pkgs.writeScript "nixtest.js" ''
-    db.greetings.insert({ "greeting": "hello" });
+    db.greetings.insertOne({ "greeting": "hello" });
     print(db.greetings.findOne().greeting);
   '';
-
-  runMongoDBTest = pkg: ''
-    node.execute("(rm -rf data || true) && mkdir data")
-    node.execute(
-        "${pkg}/bin/mongod --fork --logpath logs --dbpath data"
-    )
-    node.wait_for_open_port(27017)
-
-    assert "hello" in node.succeed(
-        "${pkg}/bin/mongo ${testQuery}"
-    )
-
-    node.execute(
-        "${pkg}/bin/mongod --shutdown --dbpath data"
-    )
-    node.wait_for_closed_port(27017)
-  '';
-
+  mongoshExe = lib.getExe pkgs.mongosh;
 in
 {
   name = "mongodb";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [
-      bluescreen303
-      offline
-      phile314
-    ];
+  meta.maintainers = with pkgs.lib.maintainers; [
+    bluescreen303
+    offline
+    phile314
+    niklaskorz
+  ];
+
+  nodes.mongodb = {
+    services.mongodb.enable = true;
   };
 
-  nodes = {
-    node =
-      { ... }:
-      {
-        environment.systemPackages = with pkgs; [
-          # remember to update mongodb.passthru.tests if you change this
-          mongodb-7_0
-        ];
-      };
-  };
+  testScript = ''
+    start_all()
 
-  testScript =
-    ''
-      node.start()
-    ''
-    + runMongoDBTest pkgs.mongodb-7_0
-    + ''
-      node.shutdown()
-    '';
+    with subtest("start mongodb"):
+        mongodb.wait_for_unit("mongodb.service")
+        mongodb.wait_for_open_port(27017)
+
+    with subtest("insert and find a document"):
+        result = mongodb.succeed("${mongoshExe} ${testQuery}")
+        print("Test output:", result)
+        assert result.strip() == "hello"
+  '';
 }

From 9e1806e012179c2fe66e6fdf9715f28278720569 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 21 Jan 2025 17:27:18 +0100
Subject: [PATCH 6/7] nixosTests.mongodb-ce: init

---
 nixos/tests/all-tests.nix              |  4 ++++
 pkgs/by-name/mo/mongodb-ce/package.nix | 10 +++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 467263d37dc4..838aba2711d0 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -623,6 +623,10 @@ in {
   monetdb = handleTest ./monetdb.nix {};
   monica = handleTest ./web-apps/monica.nix {};
   mongodb = runTest ./mongodb.nix;
+  mongodb-ce = runTest ({ config, ... }: {
+    imports = [ ./mongodb.nix ];
+    defaults.services.mongodb.package = config.node.pkgs.mongodb-ce;
+  });
   moodle = handleTest ./moodle.nix {};
   moonraker = handleTest ./moonraker.nix {};
   mopidy = handleTest ./mopidy.nix {};
diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 81fc56bf02d5..2201a737cb86 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -12,6 +12,7 @@
   nix-update,
   gitMinimal,
   pup,
+  nixosTests,
 }:
 
 let
@@ -102,9 +103,12 @@ stdenv.mkDerivation (finalAttrs: {
         command = lib.getExe script;
       };
 
-    tests.version = testers.testVersion {
-      package = mongodb-ce;
-      command = "mongod --version";
+    tests = {
+      inherit (nixosTests) mongodb-ce;
+      version = testers.testVersion {
+        package = mongodb-ce;
+        command = "mongod --version";
+      };
     };
   };
 

From 1accb059212ddc4ada4a24d760c2b48c1b7b243a Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Wed, 22 Jan 2025 15:20:28 +0100
Subject: [PATCH 7/7] mongodb-ce: migrate from version tester to install
 version check

---
 pkgs/by-name/mo/mongodb-ce/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/mo/mongodb-ce/package.nix b/pkgs/by-name/mo/mongodb-ce/package.nix
index 2201a737cb86..2fd6497c3ed0 100644
--- a/pkgs/by-name/mo/mongodb-ce/package.nix
+++ b/pkgs/by-name/mo/mongodb-ce/package.nix
@@ -5,8 +5,7 @@
   autoPatchelfHook,
   curl,
   openssl,
-  testers,
-  mongodb-ce,
+  versionCheckHook,
   writeShellApplication,
   jq,
   nix-update,
@@ -64,6 +63,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/mongod";
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
   passthru = {
 
     updateScript =
@@ -105,10 +109,6 @@ stdenv.mkDerivation (finalAttrs: {
 
     tests = {
       inherit (nixosTests) mongodb-ce;
-      version = testers.testVersion {
-        package = mongodb-ce;
-        command = "mongod --version";
-      };
     };
   };