mongo-express

Deploying the VM

Launch the image from the Azure Marketplace as you would any other VM. The recommended size is Standard_B2s (2 vCPU / 4 GiB), which the shipped configuration is tuned for.

The web console listens on TCP 8081. In the Azure network security group, open 8081 only to the client addresses that need it, never to the whole internet. Add 22 for SSH.

The MongoDB-compatible database on 27017 is bound to loopback and is deliberately not exposed.

First boot

On the first boot of each VM, two ordered one-shot services run:

• ferretdb-firstboot.service generates a unique database password, creates the PostgreSQL role that FerretDB authenticates as, and writes /root/ferretdb-credentials.txt.
• mongo-express-firstboot.service generates a unique web console password, wires mongo-express to the database, seeds the sac_demo demo database, and writes /root/mongo-express-credentials.txt.

Both complete within a few seconds of boot. Confirm that the whole stack is up:

systemctl status postgresql ferretdb mongo-express

Signing in to the web console

Read the generated web console credentials. The file is root-only, so use sudo:

sudo cat /root/mongo-express-credentials.txt

The file shows a username (SecureAnyCloud), a unique password and the URL. Open the console in your browser:

http://<your-vm-public-ip>:8081/

Sign in with the basic auth username and password from the credentials file. The admin / pass credentials that mongo-express normally ships with are disabled. Only the per-VM password works.

After you sign in, the console shows the database list, including the seeded sac_demo. Click View to open it, then open the books collection to browse its documents. Click a document to view and edit its JSON.

Connecting with the shell or a driver

The MongoDB-compatible endpoint is on loopback port 27017. Read the database password:

sudo cat /root/ferretdb-credentials.txt

Connect locally with the preinstalled shell and query the demo database. The command reads the generated password straight from the credentials file, so you can run it as is:

DBPASS=$(sudo grep '^FERRETDB_PASSWORD=' /root/ferretdb-credentials.txt | cut -d= -f2-) mongosh "mongodb://admin:${DBPASS}@127.0.0.1:27017/sac_demo?authMechanism=SCRAM-SHA-256" \
  --quiet --eval 'print("Books in the Databases genre:"); db.books.find({genre:"Databases"}).forEach(d => print(" - " + d.title)); print("total books: " + db.books.countDocuments({}))'

To open an interactive shell instead, run mongosh "mongodb://admin:PASSWORD@127.0.0.1:27017/?authMechanism=SCRAM-SHA-256" with the password from the credentials file. Then use commands such as use sac_demo, db.books.find({ genre: "Databases" }) and db.books.countDocuments({}).

Any MongoDB driver works the same way. Point its connection string at the endpoint, using the admin user and the generated password.

Serving remote database clients

By default, only the web console is reachable from outside the VM, and the database stays on loopback. To let an external application connect directly to the database:

• Set FERRETDB_LISTEN_ADDR=0.0.0.0:27017 in /etc/ferretdb/ferretdb.env.
• Restart the service with sudo systemctl restart ferretdb.
• Open 27017 in the Azure network security group to your trusted client addresses only, and put TLS in front of it.

Do not expose 27017 to the internet without TLS.

Security notes

• No default credential. Both the web console password and the database password are unique per VM, generated on first boot and stored in root-only files.
• The console is your network surface. mongo-express on 8081 is the only service reachable from outside the VM. Restrict 8081 in the network security group to trusted addresses. For production, front it with a TLS-terminating reverse proxy or an Azure Application Gateway. Use basic auth over plain HTTP only on a trusted network.
• The database is loopback-only unless you deliberately expose it as described above.
• Keep it patched. unattended-upgrades remains enabled, so the OS, PostgreSQL and Node.js receive security updates on your VM.
• Rotate the credentials for anything beyond evaluation. Change the PostgreSQL role password and update FERRETDB_POSTGRESQL_URL in /etc/ferretdb/ferretdb.env. Change ME_CONFIG_BASICAUTH_PASSWORD in /etc/mongo-express/mongo-express.env. Then restart the affected service.

Compatibility notes

FerretDB implements the MongoDB wire protocol and is compatible with the great majority of MongoDB operations, drivers and tools, including mongo-express. It is an independent open-source project and is not MongoDB Community Server.

Some advanced or server-specific MongoDB features may differ. See the FerretDB documentation for the current compatibility matrix.

Support

SecureAnyCloud publishes and supports this image. For help with the web console, connection strings and drivers, authentication, collections, indexes and queries, or the PostgreSQL and DocumentDB backend, contact SecureAnyCloud support.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them. MongoDB is a trademark of MongoDB, Inc. This image ships FerretDB, an independent open-source project, not MongoDB Community Server.

Deploy on Azure

Launch mongo-express with FerretDB on Ubuntu 24.04 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com