Add MariaDB to Docker Compose file (closes #81) #84

luca0N · 2026-08-04T23:24:40Z

luca0N commented

2026-08-04 23:24:40 +00:00

Add the MariaDB Docker image as a server container dependency in the
project Docker Compose file.

Add the MariaDB Docker image as a `server` container dependency in the project Docker Compose file.

luca0N added the

Priority

High

Kind/Feature

labels

2026-08-04 23:24:40 +00:00

luca0N self-assigned this

2026-08-04 23:24:40 +00:00

luca0N added 1 commit

2026-08-04 23:24:40 +00:00

Add MariaDB to Docker Compose file 4ef0d8d588

Add the MariaDB Docker image as a `server` container dependency in the
project Docker Compose file.

luca0N commented

2026-08-04 23:25:43 +00:00

I have already validated these changes and I can confirm that they work flawlessly. I will refrain from merging this pull request at this time to mull over a potential security issue, which I will go into detail in the next comment.

luca0N reviewed

2026-08-04 23:29:39 +00:00

docker-compose.yaml

					
				@ -67,0 +97,4 @@

				      MARIADB_RANDOM_ROOT_PASSWORD: 1

				      MARIADB_DATABASE: lanbassador

				      MARIADB_USER: lanbassador

				      MARIADB_PASSWORD: lanbassador

Using lanbassador as the database password is precisely why I wanted to use *NIX sockets (see #81).

Although this is more secure and locks down database server access a bit further, I want to take some time to investigate about the security implications of this, because, even though a *NIX socket is being used, it can still be accessed in the host, depending on filesystem directory permissions.

An option would be to keep everything as is, and have the system administrator deal with hardening the server by changing the permissions of the directory on the host filesystem (e.g., mode 0700 to root on ./mariadb-run/). If this route were to be taken, then I have to make sure that this is crystal clear in this file by adding some comments about it.

Using `lanbassador` as the database password is precisely why I wanted to use *NIX sockets (see #81). Although this is more secure and locks down database server access a bit further, I want to take some time to investigate about the security implications of this, because, even though a *NIX socket is being used, it can still be accessed in the host, depending on filesystem directory permissions. An option would be to keep everything as is, and have the system administrator deal with hardening the server by changing the permissions of the directory on the host filesystem (e.g., mode `0700` to root on `./mariadb-run/`). If this route were to be taken, then I have to make sure that this is crystal clear in this file by adding some comments about it.