Bootstrap mongodb binary (mongod) properly from command line with encrypted storage engine enabled (full database encryption)

mongod_boostrap_with_ese.sh

# See: https://docs.mongodb.com/manual/tutorial/configure-encryption/#local-key-management


# As non-root user, possibly in a startup script:

/usr/bin/mongod \
--fork \
--logpath=/tmp/mdb.log \
--dbpath=/data/db \
--enableEncryption \
--encryptionKeyFile <( curl -s https://some.web.service/keys/mykey )


# Alternatively, as root:

KEYTMP=/dev/shm/mbd/keys
mkdir -p $KEYTMP
curl -s https://some.web.service/keys/mykey > $KEYTMP/key1
chmod 0600 $KEYDIR/key1
chown mongodb.mongodb $KEYTMP/key1

runuser -u mongodb -- /usr/bin/mongod \
--fork \
--logpath=/tmp/mdb.log \
--dbpath=/data/db \
--enableEncryption \
--encryptionKeyFile $KEYTMP/key1

# Remove the temporary key from non-persistent memory
echo > $KEYTMP/key1