PCSM-202: Add 3-shard local dev environment

- Add third shard (rs2) to source cluster in hack/sh
- Disable keyFile authentication for local development to avoid Docker volume permission issues
- Remove keyFile and user creation scripts
- Add cleanup.sh script for environment teardown
- Add /tmp/ to .gitignore for demo artifacts

Author: chupe

.gitignore

@@ -9,6 +9,7 @@
 .env
 
 /bin/
+/tmp/
 vendor/
 
 .pytest_cache

hack/cleanup.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Clean up Docker resources for test environments
+# Removes: containers, volumes, networks
+#
+# Usage: ./cleanup.sh [ENV...]
+#   (no args)  Clean all (rs, sh, sh-ha)
+#   rs         Replica set only
+#   sh         Sharded cluster only (3→2 shards, project: s1)
+#   sh-ha      Sharded cluster HA only
+#
+# Example:
+#   ./cleanup.sh rs sh    # rs and sh
+
+set -euo pipefail
+
+SCRIPT_DIR=$(dirname "${BASH_SOURCE[0]}")
+ENVS_TO_CLEAN=()
+
+if [[ $# -eq 0 ]]; then
+    ENVS_TO_CLEAN=("rs" "sh" "sh-ha")
+else
+    while [[ $# -gt 0 ]]; do
+        case $1 in
+            rs|sh|sh-ha)
+                ENVS_TO_CLEAN+=("$1")
+                shift
+                ;;
+            *)
+                echo "Unknown environment: $1"
+                echo "Valid: rs, sh, sh-ha"
+                exit 1
+                ;;
+        esac
+    done
+fi
+
+# Function to clean up a compose environment
+cleanup_env() {
+    local name=$1
+    local compose_file=$2
+    local project_name=${3:-}
+
+    if [[ ! -f "$compose_file" ]]; then
+        echo "Skipping $name (compose file not found)"
+        return
+    fi
+
+    echo "Cleaning $name..."
+
+    local compose_cmd="docker compose -f $compose_file"
+    if [[ -n "$project_name" ]]; then
+        compose_cmd="docker compose -p $project_name -f $compose_file"
+    fi
+
+    # Stop and remove containers, then remove volumes
+    $compose_cmd down --remove-orphans 2>/dev/null || true
+    $compose_cmd down -v 2>/dev/null || true
+}
+
+# Clean specified environments
+for env in "${ENVS_TO_CLEAN[@]}"; do
+    case $env in
+        rs)
+            cleanup_env "rs" "$SCRIPT_DIR/rs/compose.yml"
+            docker volume ls -q | grep -E '^rs[0-9]+' | xargs -r docker volume rm 2>/dev/null || true
+            ;;
+        sh)
+            cleanup_env "sh" "$SCRIPT_DIR/sh/compose.yml" "s1"
+            docker volume ls -q | grep -E '^(src-|tgt-|s1_)' | xargs -r docker volume rm 2>/dev/null || true
+            ;;
+        sh-ha)
+            cleanup_env "sh-ha" "$SCRIPT_DIR/sh-ha/compose.yml" "s1"
+            docker volume ls -q | grep -E '^s1_' | xargs -r docker volume rm 2>/dev/null || true
+            ;;
+    esac
+done
+
+echo "Done."

hack/rs/mongo/keyFile

@@ -9,13 +9,6 @@ RDIR="$BASE/rs"
 
 export compose="$RDIR/compose.yml"
 
-# https://www.mongodb.com/docs/v7.0/tutorial/deploy-sharded-cluster-with-keyfile-access-control/
-if [ ! -s "$RDIR/mongo/keyFile" ]; then
-    echo >&2 generate "$RDIR/mongo/keyFile"
-    openssl rand -base64 756 >"$RDIR/mongo/keyFile"
-    chmod 400 "$RDIR/mongo/keyFile"
-fi
-
 dcf up -d rs00 rs01 rs02 rs10 rs11 rs12
 
 mwait "rs00:30000"

hack/rs/mongo/users.adm.js

@@ -2,4 +2,3 @@ systemLog.quiet: true
 net.bindIpAll: true
 storage.dbPath: /data/db
 sharding.clusterRole: configsvr
-security.keyFile: /cfg/keyFile

hack/rs/mongo/users.js

@@ -1,3 +1,2 @@
 systemLog.quiet: true
 net.bindIpAll: true
-security.keyFile: /cfg/keyFile

hack/rs/run.sh

@@ -2,4 +2,3 @@ systemLog.quiet: true
 net.bindIpAll: true
 storage.dbPath: /data/db
 sharding.clusterRole: shardsvr
-security.keyFile: /cfg/keyFile