main.yml

---
### CONFIGURATION FLAGS
prep_conf: true
enterprise_edition: true
fips_mode: true
mongostig_cat1: true
mongostig_cat2: true
# Enable 'encryption_at_rest' if any data is PII, classified or is deemed by the organization the need to be encrypted at rest.
encryption_at_rest: false
kmip_enabled: false

### CONNECTION VARIABLES
mongo_owner: root
mongo_group: root
mongo_dba: root
mongo_dba_password: root
mongo_host: localhost
mongo_port: 27017
mongo_auth_source: admin
max_incoming_connections: 800000
authentication_mechanism: 
  - SCRAM-SHA-256

### ROLES AND USERS
mongo_admin_roles:
  - "root"
mongo_super_users:
  - "admin.root"
mongo_users:
  - "test.myTester"
  - "products.myRoleTestUser"
inappropriate_mongo_privileges:
  - "changeStream"
  - "createCollection"

### FILE PATHS
mongo_permissions: 0600
mongod_config_path: /etc/mongod.conf
# Set 'audit_log_destination' to either "file" or "syslog"
audit_log_destination: file
mongo_audit_directory_path: /var/log/mongodb/audit/
mongo_audit_file_path: /var/log/mongodb/audit/auditLog.bson
certificate_key_file_dest: /etc/ssl/mongodb.pem
certificate_key_file_src: ../../certificates/mongodb.pem
ca_file_dest: /etc/ssl/CA_bundle.pem
ca_file_src: ../../certificates/dod_CAs.pem
data_file_directory_path: /data/db/

### ENCRYPTION SETTINGS
encryption_cipher_mode: AES256-GCM
KMIP_server_host_name: 
KMIP_server_port: 
KMIP_server_ca_file: 
KMIP_client_certificate_file: 
security_encryption_key_file: 

### AUDIT SETTINGS
mongo_filter: "'{ atype: { $in: [ \"createCollection\", \"dropCollection\" ] } }'"