Install MariaDB

When to use it

Before running an application that stores data in MariaDB or MySQL, such as WordPress or Laravel, on the same server. The WordPress Server and Laravel Server templates include it.

This playbook has no options.

What it does on the server

1. Refuses a server that runs MySQL: MariaDB cannot be installed beside it.
2. Installs MariaDB from the distribution's packages. On the RHEL family, where MariaDB listens on every address by default, it writes /etc/my.cnf.d/iap-bind-address.cnf with bind-address = 127.0.0.1 before the first start, so the database is never reachable from the network. On Ubuntu and Debian the packages already listen on this server only.
3. Enables and starts MariaDB.
4. On a new installation, applies what mysql_secure_installation would: removes anonymous accounts and the empty test database, and makes root sign in only as the system's root user through the local socket.

An existing MariaDB is never altered. If it accepts connections from the network, the run says so.

After the run

Create a database and an account for each application. Signed in to the server as root, this creates a database and account named shop with a generated password, and prints the password once:

password=$(openssl rand -base64 24)
mariadb -e "CREATE DATABASE shop; CREATE USER 'shop'@'localhost' IDENTIFIED BY '$password'; GRANT ALL ON shop.* TO 'shop'@'localhost';"
echo "$password"

Put the password in your application's configuration. Back the database up with Backups.

Common problems

"MySQL (…) is installed on this server, and MariaDB cannot be installed beside it." — Use the MySQL that is there, or remove it yourself if nothing uses it.

"MariaDB was installed and started, but root cannot sign in through the local socket." — Another tool changed root's authentication. Sign in with the password it set and check SELECT user, host, plugin FROM mysql.user.

"MariaDB accepts connections from the network on this server" — Set bind-address = 127.0.0.1 in its configuration and restart it with Restart Services, unless other servers need to connect. If they do, allow port 3306 only for their addresses.