chore(deploy): drop Docker DB orchestration, document the native tier - #113
Merged
Conversation
The database tier now runs natively on its own hosts (DB1 = MariaDB 11.8,
THETRIANGLE-MAXSCALE = MaxScale 24.02, both apt on unprivileged LXC), so the
compose-based bring-up in this repo no longer describes anything that exists.
Worse, it pins MariaDB 11.7, which has been withdrawn from deb.mariadb.org
(only LTS lines remain), so it cannot be executed even as a fallback.
Delete the dead orchestration: compose.mariadb-{primary,replica,dev}.yml,
mariadb/primary-initdb/ (docker-entrypoint-initdb.d only; the repl and maxscale
users were created by hand on DB1), mariadb/dev.cnf, and cms.env.dryrun.example
(the throwaway dry-run node and its volume were removed 2026-07-29). Nothing in
CI, deploy/scripts/, or the READMEs referenced them.
Keep the .cnf files — they ARE the deployed config — and correct them:
- Both headers claimed they install as 50-triangle-*.cnf, contradicting the
bind-address note in the same file. A 50- file cannot override Ubuntu's stock
50-server.cnf, which binds 127.0.0.1 and would leave the node unreachable.
- replica.cnf had no bind-address at all, so DB2 would have come up on
127.0.0.1 and been invisible to MaxScale. Added as a must-set line.
- maxscale.cnf's header described compose-supplied env vars; it now documents
the systemd drop-in and /etc/maxscale.secrets.d/backend.env.
Rewrite setup-replica.sh to run natively on the replica host, and fix the
privilege bug while there: it dumped as REPL_USER, which holds only
REPLICATION SLAVE and cannot read tables, so it would have failed at the dump
step when DB2 arrives. It now takes a separate DUMP_USER/DUMP_PASSWORD, and
writes the dump via mktemp with 0600 and a cleanup trap since it is a full
plaintext copy of the database.
deploy/mariadb/README.md is rewritten for the native tier: host table, apt and
GPG specifics, where secrets actually live, DB1's grants, DB2 bring-up, and the
operational traps (MaxScale mis-sizing its cache from the Proxmox host's RAM
inside LXC, the lapsing DHCP leases, the open firewall on DB1, DB1 currently
being the only copy of the data).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ssavutu
force-pushed
the
chore/prune-docker-db-tier
branch
from
July 30, 2026 06:24
044eb97 to
0597177
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The database tier now runs natively on its own hosts — DB1 (
10.248.40.154, MariaDB 11.8 LTS) and THETRIANGLE-MAXSCALE (10.248.40.183, MaxScale 24.02), both apt installs on unprivileged LXC. The compose-based bring-up in this repo no longer describes anything that exists, and it pins MariaDB 11.7, which has been withdrawn fromdeb.mariadb.org(only LTS lines remain), so it cannot be executed even as a fallback.Deleted
deploy/compose.mariadb-primary.yml,deploy/compose.mariadb-replica.yml,deploy/compose.mariadb-dev.ymldeploy/mariadb/primary-initdb/—docker-entrypoint-initdb.donly; thereplandmaxscaleusers were created by hand on DB1deploy/mariadb/dev.cnfanddeploy/cms.env.dryrun.example— the throwaway dry-run node and its volume were removed 2026-07-29Nothing in CI,
deploy/scripts/, or either README referenced any of them.Kept and corrected
The
.cnffiles stay, because they are the deployed config — edit here, copy up, restart. Three things in them were wrong:50-triangle-*.cnf, contradicting thebind-addressnote in the same file. A50-file cannot override Ubuntu's stock50-server.cnf, which binds127.0.0.1, so the node would be unreachable from MaxScale. Now70-.replica.cnfhad nobind-addressat all — DB2 would have come up on127.0.0.1and been invisible to both MaxScale and the primary. Added as a must-set line (commented, since DB2's address doesn't exist yet).maxscale.cnf's header described compose-supplied env vars; it now documents the systemd drop-in and/etc/maxscale.secrets.d/backend.env.Rewritten
setup-replica.shnow runs natively on the replica host instead of viadocker compose exec, and fixes a bug that would have bitten at DB2 provisioning time: it dumped asREPL_USER, which holds onlyREPLICATION SLAVEand therefore cannot read tables — the dump step would have failed with "SELECT command denied". It now takes a separateDUMP_USER/DUMP_PASSWORD, and writes the dump viamktempwith mode 0600 and a cleanup trap, since it is a full plaintext copy of the database.deploy/mariadb/README.mdis rewritten for the native tier: host table, apt/GPG specifics (MaxScale needs its own key, rotated 2025-12-10), where secrets actually live, DB1's account grants, DB2 bring-up, and the operational traps — MaxScale sizing its query-classifier cache from the Proxmox host's RAM inside LXC (9.38 GiB on a 4 GB box), the lapsing DHCP leases on both hosts, DB1's open firewall, and DB1 currently being the only copy of the data.Verification
deploy/scripts/deploy_scripts_test.shpasses.docker compose -f deploy/compose.cms.yml configvalidates (CI supplies the env vars). No code changes.🤖 Generated with Claude Code