# Configure MongoDB on TurboStack

Enable MongoDB on the host that needs it and pin the version you want to run.

![The MongoDB panel on a host's Services tab, enabled, showing the version field and Advanced Settings expanded to show the Bind IP|1000](../../assets/screenshots/technologies/mongodb.png)

## Where to configure it

MongoDB is a host-level service. To reach it, open the host, go to its **Services** tab, and find
the **MongoDB** entry. Enable the service there and choose the version. The change is saved to the
host's YAML configuration and applied on the next deployment.

> [!TIP]
> MongoDB is enabled per host. Turn it on only for the hosts whose applications connect to it.

## YAML configuration

### Required

| Key | Meaning |
|---|---|
| `mongodb_version` | The major version of Percona Server for MongoDB to run, for example `"7.0"` or newer. Setting this key installs and enables MongoDB on the host - there is no separate enable key. |

### Optional

| Key | Meaning |
|---|---|
| `mongodb_bindip` | The network interfaces MongoDB listens on, as a comma-separated list, or `ANY` for every interface. Security-sensitive - bind to the narrowest interface your application needs. |

```yaml
mongodb_version: "7.0"
# Optional, security-sensitive:
mongodb_bindip: "127.0.0.1"
```

### Listening address

`mongodb_bindip` takes a comma-separated list of addresses, or the keyword **`ANY`**, which makes
MongoDB listen on every interface the server has, over both IPv4 and IPv6.

> [!WARNING]
> `ANY` includes any public interface. A database reachable from the internet is a serious risk, so
> prefer specific private addresses, and restrict access with the
> [firewall](../firewall/configure.md) whatever you choose.

> [!IMPORTANT]
> On a host that runs **Kubernetes or Docker**, MongoDB listens on every interface. Unlike the other
> databases it does so even when `mongodb_bindip` is set to `127.0.0.1`, so on such a host give a
> specific private address if you need to keep it narrow.

> [!WARNING]
> Exposing MongoDB on a broad bind address can make the database reachable from outside the host.
> Restrict the bind IP and pair it with firewall rules so only trusted clients can connect.

## Related

- [What is MongoDB?](what-is.md)
- [Host Services](../../platform/hosts/services.md)
- [Applications overview](../../applications/index.md)