MariaDB That Ran Its Own Secure Installation
MariaDB bound to loopback (the package listens everywhere), with the mariadb-secure-installation steps applied by the role: anonymous users, the test database and remote root gone, LOAD DATA LOCAL off, reverse DNS off. Provisions an application database and a user that can see nothing else. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-19 · podman 4.9.3 · ansible 2.21.4 · how we verify
Documentation
mariadb-server
MariaDB server on Enterprise Linux, bound to loopback, with the steps of
mariadb-secure-installation applied by the role and an application database
and owner provisioned. Original role for EL 9 and 10, live-tested with podman on
Rocky Linux 10.
The package listens everywhere and keeps the leftovers. A fresh
mariadb-server sets no bind-address, so it accepts connections on every
interface; it ships a test database any user can write to and anonymous
accounts that can log in without a password; and LOAD DATA LOCAL is on, which
lets a hostile server read files from a connecting client. The interactive
mariadb-secure-installation script exists to undo the first three - and
nothing runs it for you. This role binds to 127.0.0.1, removes the anonymous
users, the test database and any root account that could log in from the
network, turns local_infile off, and turns skip_name_resolve on so grants
keyed by address mean what they say.
The application user gets its own database and nothing else. The verify
step logs in over TCP as that user and asserts it sees appdb and
information_schema only.
The password placeholder is refused when you ask. mariadb_server_password
ships as a placeholder so the live test can run; set
mariadb_server_refuse_placeholder_password: true in any real inventory and the
role stops before provisioning a user with it.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-postgresql
PostgreSQL server with guarded initdb, SCRAM-SHA-256 auth, managed conf.d drop-in, templated pg_hba, and app database + owner provisioning. Original, live-tested (Molecule/podman) role.
ansible-valkey-server
Valkey, the Redis successor EL 10 ships in place of a redis package that no longer exists. The package sets no password, no maxmemory and no append-only log; this role sets all three, on loopback, with the drop-in given the last word over the package configuration. Original role, live-tested on Rocky Linux 10.