Install MariaDB primary-replica replication with GTID and TLS

Primary Bash, logged in as the same dbadmin administrator. Each remote write refuses to overwrite an existing file. pipefail propagates local read and SSH failures. Passwordless sudo for these specific reads or a prior local sudo authentication is required; no secrets are echoed. Verify SSH host fingerprints by your existing trusted channel before this operation.

(
set -euo pipefail
sudo -v
sudo cat /root/academy-seed/seed.sql | ssh -l dbadmin 10.20.0.11 'umask 077; set -C; cat > "$HOME/academy-seed/seed.sql"'
sudo cat /root/academy-seed/SHA256SUMS | ssh -l dbadmin 10.20.0.11 'umask 077; set -C; cat > "$HOME/academy-seed/SHA256SUMS"'
)

Replica Bash as dbadmin. This guard refuses any pre-existing academy_lab schema, any configured replication channel, any user table in other schemas or any applied GTID. It does not erase them. Verify checksum BEFORE import. Restore runs with session binary logging disabled so local seed writes do not create a competing domain 0 history; read_only stays ON because privileged bootstrap bypass is intentional here. Import errors stop immediately and leave the partial state for diagnosis; do not force or rerun on top of it.

(
set -euo pipefail
cd "$HOME/academy-seed"
sha256sum -c SHA256SUMS
test "$(sudo mariadb -NBe "SELECT COUNT(*) FROM information_schema.SCHEMATA WHERE SCHEMA_NAME='academy_lab';")" = 0
test "$(sudo mariadb -NBe "SELECT COUNT(*) FROM information_schema.TABLES WHERE TABLE_SCHEMA NOT IN ('mysql','information_schema','performance_schema','sys');")" = 0
channels=$(sudo mariadb -NBe 'SHOW SLAVE STATUS;')
test -z "$channels"
applied=$(sudo mariadb -NBe 'SELECT @@GLOBAL.gtid_slave_pos;')
test -z "$applied"
{ printf 'SET SESSION sql_log_bin=0;\n'; cat seed.sql; } | sudo mariadb
sudo mariadb -e 'SELECT @@read_only; SELECT * FROM academy_lab.replication_probe;'
)

Replica Bash. Extract exactly one commented GTID line, reject a malformed/domain-mismatched position and send only that reviewed statement to the local administrator connection. It must be domain 0 with primary server_id101 and a positive sequence. Do not use current_pos, invent a GTID or copy the primary’s current position after the backup. This snapshot has only one GTID domain; multi-source histories need a different plan.

(
set -euo pipefail
cd "$HOME/academy-seed"
sha256sum -c SHA256SUMS
position=$(sed -n "s/^-- SET GLOBAL gtid_slave_pos='\(0-101-[1-9][0-9]*\)';$/\1/p" seed.sql)
if [[ ! "$position" =~ ^0-101-[1-9][0-9]*$ ]]; then
  echo 'Missing, multiple or unexpected snapshot GTID; STOP' >&2; exit 1
fi
printf "SET GLOBAL gtid_slave_pos='%s';\n" "$position" | sudo mariadb
sudo mariadb -NBe 'SELECT @@GLOBAL.gtid_slave_pos;'
)

Replica terminal. Use the same history-free interactive method. Retrieve the SAME unique account password used on the primary. Do not place the CHANGE MASTER statement in a shell -e argument or publish its unredacted output/logs.

sudo env MYSQL_HISTFILE=/dev/null mariadb

Inside replica SQL. MariaDB retains the historical CHANGE MASTER/SLAVE spelling for compatibility. The hostname must match the certificate SAN and private DNS. Replace the password safely before execution. slave_pos starts AFTER the restored snapshot. Verification remains explicitly ON across all supported versions; a TLS error is a stop condition, not permission to disable verification.

CHANGE MASTER TO
  MASTER_HOST='db-primary.example.internal',
  MASTER_PORT=3306,
  MASTER_USER='academy_repl',
  MASTER_PASSWORD='REPLACE_WITH_THE_SAME_UNIQUE_SECRET',
  MASTER_USE_GTID=slave_pos,
  MASTER_SSL=1,
  MASTER_SSL_CA='/etc/mariadb/tls/ca.pem',
  MASTER_SSL_VERIFY_SERVER_CERT=1,
  MASTER_CONNECT_RETRY=10;
START SLAVE;
SHOW SLAVE STATUS\G
EXIT;

Replica Bash. Inspect both Yes flags, zero Last_IO_Errno/Last_SQL_Errno, empty corresponding errors, Using_Gtid Slave_Pos, correct Master_Server_Id101 and both TLS flags Yes. Seconds_Behind_Master0 alone is not proof: NULL can mean a stopped thread, and lag may not reflect queued or idle-source conditions. Protect status/log output because it contains internal topology.

sudo mariadb -e "SHOW SLAVE STATUS\G"
sudo mariadb -e "SELECT @@server_id,@@read_only,@@GLOBAL.gtid_slave_pos;"