The Capstone
A fictional Arizona community bank run on MongoDB the way production has to be run: fast queries you can prove, money that always balances, a cluster that survives failures, backups that restore, and data that only the right people can read.
Two deployments
| MongoDB Atlas | Self-managed | |
|---|---|---|
| Cluster | Free M0 for everyday work; an M10 for a few hours for backup labs | A 3-member replica set on my own Linux VMs |
| Resilience | Snapshots and point-in-time restore | Failover drills, oplog sizing, mongodump/mongorestore |
| Security | Least-privilege database users, IP access list, encryption at rest with Google Cloud KMS | SCRAM users, custom roles, TLS |
| Built with | Pulumi (infrastructure as code), mongosh, Compass, the Atlas CLI | |
The bank's data
| Collection | Shape | Why |
|---|---|---|
customers | Embedded addresses and identity (KYC) documents | Read together, so stored together |
accounts | One document per account, referencing its customer | Updated constantly; kept small |
transactions | A time-series collection | Append-heavy, queried by account and date |
sessions | TTL index | Expired logins delete themselves |
Schema validation rejects malformed documents at the door: no account without a customer, no negative balance, no transaction without an amount.
The DBA work
Teller lookups, statements and fraud queries, each proven with explain() as an index scan, with before and after timings.
Transfers between accounts in multi-document ACID transactions with retry logic. The day's books reconcile to the cent.
Kill the primary, watch the election, confirm nothing acknowledged with majority write concern was lost.
Transactions sharded on { account_id, date }, with the reasoning written down: why a timestamp alone would be a hot spot.
Every backup restored and timed. A runbook for each kind of recovery.
Atlas alerts, the profiler and Performance Advisor, and on-call runbooks for replication lag, full disks and connection storms.
The security layer
Tellers read. Only the batch user writes. Auditors get read-only access plus the audit log.
IP access list, and a written PrivateLink design for production.
At rest with a Google Cloud KMS key I control. SSNs encrypted in the client, so even a DBA can't read them.
Every control documented the way a HIPAA or SOX auditor would ask for it.
Big Iron Bank: progress
| Week | Build | Done when | Status |
|---|---|---|---|
| 1 · Sep 28 | The bank's data model, validation, indexes, transactions | Every key bank query is an IXSCAN; transfers balance to the cent | In progress |
| 2 · Oct 5 | Performance, sharding, monitoring | A slow query found and fixed; transactions sharded; alerts firing | Planned |
| 3 · Oct 12 | Replica set, backups, security | Failover drill passes; a restore is timed; SSNs unreadable to the DBA | Planned |
| 4 · Oct 19 | Runbooks, rebuild from code, certification | Rebuilds from scratch with one Pulumi command; MongoDB Associate Atlas Administrator | Planned |
| 1–4 · by Oct 20 | Big Iron West: an acquired bank's MySQL core migrated to a MongoDB replica set across five Azure regions | Up to 1 TB moved with zero unexplained differences; failover, upgrade and restore drills; forecast vs actual cost reconciled | Planned |
| 5 · Oct 26 | Backups and migration staging through S3 (AWS on LocalStack); vector search basics | A backup restored from S3 and timed; first $vectorSearch query | Planned |
| 6 · Nov 2 | The huge migration on Google Cloud | Resharding, cutover with a tested rollback, point-in-time restore at scale | Planned |
| 7 · Nov 9 | A banking RAG assistant on MongoDB Vector Search, live on this site | Answers from the bank's own documents, filtered by each employee's role | Planned |
Side project, also on MongoDB: Entropa Migrated ✓
Entropa is a live Java (Spring Boot) system that records AI decisions in a tamper-evident hash chain, running on Google Kubernetes Engine. On September 28, 2026 I migrated its audit log from Postgres to MongoDB Atlas, with no lost events:
- Atlas as code: the project, an M0 cluster on Google Cloud, a least-privilege database user and the network allow list, all provisioned with Pulumi (TypeScript).
- Test-first: the service switched to Spring Data MongoDB, with unique indexes on
leaf_indexandtracking_id. The new test failed for the right reason before the code existed, and CI now runs a MongoDB container. - Zero-loss cutover: the single writer was paused while Kafka held new events; the data moved as typed Extended JSON; the new version resumed from the same Kafka offset.
- Proof: the hash chain recomputed across old and new records:
35 records checked, 0 broken. Both hot queries use an index and examine one document (explain()).
The write-up, with the evidence: github.com/aimozart/entropa-public
Code, runbooks and evidence: github.com/aimozart. All data is fictional.