mongo.nomad.hcl

job "mongodb" {
  datacenters = ["prod-azure"]
  type        = "service"

  constraint {
    distinct_hosts = true
  }

  update {
    max_parallel     = 1
    min_healthy_time = "10s"
    healthy_deadline = "3m"
    auto_revert      = false
    canary           = 0
  }

  group "mongo" {
    count = 3

    volume "mongodb" {
      type      = "host"
      source    = "mongodb"
      read_only = false
    }

    service {
      name         = "mongodb"
      provider     = "consul"
      port         = "mongodb"
      address_mode = "alloc"
      tags         = ["mongodb"]

      connect {
        sidecar_service {
        }
      }

      meta {
        index = "${NOMAD_ALLOC_INDEX}"
      }
    }

    restart {
      attempts = 10
      interval = "5m"
      delay    = "25s"
      mode     = "delay"
    }

    network {
      mode     = "bridge"
      hostname = "mongodb"

      port mongodb {
        # static = 27017
        to = 27017
      }
    }

    task "mongodb" {
      driver = "docker"

      service {
        name = "mongodb-${NOMAD_ALLOC_INDEX}"
        tags = ["mongodb"]
        port = "mongodb"
      }

      service {
        name = "mongodb-primary"
        tags = ["mongodb", "primary"]
        port = "mongodb"

        check {
          type      = "script"
          name      = "check-primary"
          task      = "mongodb"
          command   = "${NOMAD_TASK_DIR}/check-primary.sh"
          interval  = "10s"
          timeout   = "2s"
          on_update = "ignore"
        }
      }

      template {
        data        = <<EOF
#!/bin/bash
mongo_primary=$(mongo --quiet --eval 'JSON.stringify(db.isMaster())' | jq -r .ismaster 2> /dev/null)
if [[ $mongo_primary == false ]]; then
    exit 1
fi

echo "Mongo primary healthy and reachable"
EOF
        destination = "local/check-primary.sh"
        perms       = "755"
      }

      template {
        destination = "local/mongodb.conf"
        change_mode = "restart"
        data        = <<EOF
security:
  keyFile: {{ env "NOMAD_SECRETS_DIR" }}/replsetkey.secret
replication:
    replSetName: clash-prod-cluster
net:
   bindIp: localhost,mongo-{{ env "NOMAD_ALLOC_INDEX" }}.virtual.consul
EOF
      }

      template {
        destination = "secrets/replsetkey.secret"
        change_mode = "restart"
        data        = "{{ with nomadVar \"nomad/jobs/mongodb\" }}{{ .replsetkey }}{{ end }}"
        perms       = "400"
        uid         = "999"
        gid         = "999"
      }

      template {
        destination = "secrets/initadmin.secret"
        change_mode = "restart"
        data        = "{{ with nomadVar \"nomad/jobs/mongodb\" }}{{ .initadmin }}{{ end }}"
      }

      config {
        image = "mongo:6"
        ports = ["mongodb"]
        args  = ["--config", "${NOMAD_TASK_DIR}/mongodb.conf"]
      }

      env {
        MONGO_INITDB_ROOT_USERNAME      = "initadmin"
        MONGO_INITDB_ROOT_PASSWORD_FILE = "${NOMAD_SECRETS_DIR}/initadmin.secret"
      }

      volume_mount {
        volume      = "mongodb"
        destination = "/data/db"
        read_only   = false
      }

      resources {
        cpu    = 500 # 500 MHz
        memory = 512 # 512MB
      }
    }
  }
}