Your first node
Start a node, find the root password and check that it answers.
A single node is already a complete database: it stores your collections, splits them into ranges and serves the drivers. It is what you use to develop.
Start
teseladb start --dbpath ./dataWithout --dbpath, the data directory is ./teseladb-data. The node listens on 127.0.0.1 and opens these ports:
| Port | What for |
|---|---|
| 27017 | Clients and drivers, always with TLS |
| 27100 | Traffic between nodes, with mutual TLS |
| 27200 | Administration: teseladb admin, /metrics and /healthz |
| 27080 | REST API and MCP server |
What the first start creates
In an empty directory, the first start creates the security of the cluster. The path of the credentials file is in the log; its content, never.
| File | Content | Permissions |
|---|---|---|
pki/ca.pem, pki/ca.key | Cluster certificate authority | 0644 / 0600 |
pki/node.pem, pki/node.key | Certificate and key of this node | 0644 / 0600 |
master.key | Master key, which encrypts the other keys | 0600 |
root-credentials.txt | The root user and its initial password | 0600 |
Read the root password:
cat ./data/root-credentials.txtCheck that it answers
/healthz returns 200 when the node is serving:
curl -s -o /dev/null -w "%{http_code}\n" --cacert ./data/pki/ca.pem https://127.0.0.1:27200/healthzDevelop without TLS
For local tests you can start without PKI or users with --insecure. The node warns in the log and only listens on
127.0.0.1, unless you add --insecure-allow-remote. Do not use it outside your machine.
teseladb start --insecure --dbpath ./dev-dataNext step
Connect with mongosh and with your driver: Connect.