WIUNIX ACADEMY
Install MariaDB primary-replica replication with GTID and TLS
Page 2 of 6. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment3 editable values
LET’S BUILD
Install and verify the primary certificate
On the primary. These paths are for the delivered inputs, not download URLs. Install service-readable files; only mysql and root may read the key. Matching public-key hashes must be equal. The hostname must resolve to the private primary address on the replica; add an approved internal DNS record before continuing.
Primary
(
set -euo pipefail
sudo install -d -o root -g mysql -m 0750 /etc/mysql/tls
sudo install -o root -g mysql -m 0640 /root/academy-pki/ca.pem /etc/mysql/tls/ca.pem
sudo install -o root -g mysql -m 0640 /root/academy-pki/primary-fullchain.pem /etc/mysql/tls/server.pem
sudo install -o root -g mysql -m 0640 /root/academy-pki/primary-key.pem /etc/mysql/tls/server.key
sudo openssl x509 -in /etc/mysql/tls/server.pem -noout -subject -issuer -dates -ext subjectAltName
sudo openssl x509 -in /etc/mysql/tls/server.pem -checkend 86400 -noout
sudo openssl x509 -in /etc/mysql/tls/server.pem -pubkey -noout | openssl sha256
sudo openssl pkey -in /etc/mysql/tls/server.key -pubout | openssl sha256
sudo -u mysql test -r /etc/mysql/tls/server.key
)
Certificate has correct SAN, validity and matching key; key readable by mysql, not other users.
LET’S BUILD
Open the primary configuration
Create this new included configuration on the primary. Do not replace the distribution base file. The filename/path belongs to the selected OS; LTS and Debian alternatives below use their real included directory.
Primary
sudo nano /etc/mysql/mariadb.conf.d/90-academy-replication.cnf
New selected-OS primary include opened; no existing base file overwritten.
LET’S BUILD
Primary settings: identity, durability and TLS
File contents, primary only. Domain0 is one stream, not a unique node ID. ROW reduces statement nondeterminism. Seven days of binlog retention is only a small-lab example: size disk and retention beyond full seed time, transfer, catch-up and outage. Never purge logs a lagging replica still needs. These durability settings cannot guarantee lossless asynchronous failover.
File contents; save in named file, not a shell.
[mariadb]
server_id=101
bind_address=10.20.0.10
log_bin=/var/lib/mysql/primary-bin
binlog_format=ROW
gtid_domain_id=0
gtid_strict_mode=ON
log_slave_updates=ON
sync_binlog=1
innodb_flush_log_at_trx_commit=1
binlog_expire_logs_seconds=604800
read_only=OFF
ssl_ca=/etc/mysql/tls/ca.pem
ssl_cert=/etc/mysql/tls/server.pem
ssl_key=/etc/mysql/tls/server.key
File saved with unique101 identity, ROW/domain 0 and reviewed private TLS paths.
LET’S BUILD
Validate options, then restart the primary
Primary only. The help invocation checks option parsing, not full startup or certificate usability. Restart briefly interrupts connections. If it fails, leave the application disconnected and inspect the diagnostic panel; do not proceed to seeding. Verify the actual runtime values and private listener.
Primary
(
set -euo pipefail
sudo mariadbd --verbose --help >/dev/null
sudo systemctl restart mariadb
systemctl is-active mariadb
sudo mariadb -e "SHOW VARIABLES WHERE Variable_name IN ('server_id','log_bin','binlog_format','gtid_domain_id','gtid_strict_mode','read_only','have_ssl','sync_binlog','innodb_flush_log_at_trx_commit','binlog_expire_logs_seconds');"
sudo ss -lntp 'sport = :3306'
)
sudo mariadb -e "SELECT @@datadir;"
101, log_bin ON, ROW, domain 0, strict ON, read_only OFF, have_ssl YES; listener10.20.0.10:3306.
LET’S BUILD
Install the replica trust chain and check DNS
Replica only. This one-way TLS design authenticates the primary with a CA and hostname; the primary authenticates the replica with a restricted password account. No client private key is required. The verified DNS result must be10.20.0.10. CA files are public material, but replacing them changes trust and must be controlled.
Replica
(
set -euo pipefail
sudo install -d -o root -g mysql -m 0750 /etc/mysql/tls
sudo install -o root -g mysql -m 0640 /root/academy-pki/ca.pem /etc/mysql/tls/ca.pem
sudo -u mysql test -r /etc/mysql/tls/ca.pem
getent ahostsv4 db-primary.example.internal
)
Trusted CA readable by mysql; internal hostname resolves to10.20.0.10.
LET’S BUILD
Open the replica configuration
Create the selected OS include on the replica; use the replica contents in the following panel, not the primary contents.
Replica
sudo nano /etc/mysql/mariadb.conf.d/90-academy-replication.cnf
Replica include opened at the selected OS path.
LET’S BUILD
Keep the replica read-only
Replica file contents. read_only blocks ordinary writers but not replication and privileged administrators (READ_ONLY ADMIN/SUPER). Never give application accounts those bypass privileges, and do not point application writes here. MariaDB 10.11/11.8 semantics are used; no MySQL-only super_read_only assumption. Binary logging plus log_slave_updates preserves the applied stream for a separately planned future topology; it does not promote this node.
File contents; save in named file, not a shell.
[mariadb]
server_id=102
bind_address=127.0.0.1
log_bin=/var/lib/mysql/replica-bin
relay_log=/var/lib/mysql/replica-relay
binlog_format=ROW
gtid_domain_id=0
gtid_strict_mode=ON
log_slave_updates=ON
sync_binlog=1
innodb_flush_log_at_trx_commit=1
binlog_expire_logs_seconds=604800
read_only=ON
Replica file saved with102 identity, loopback binding and persistent read_only ON.