👷 Add missing dep for CI

due to wokes changes...

.config/ansible-lint.yml

@@ -8,3 +8,5 @@ exclude_paths:
   - venv/
   - tests/  # TODO: Remove this line when tests are migrated to molecule
   - .github/
+
+offline: false

.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+---
+
+name: ci
+'on':
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+
+  yaml-lint:
+    name: YAML Lint
+    runs-on: ubuntu-latest
+    steps:
+
+      - name: Fetch code
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v2
+        with:
+          python-version: '3.x'
+
+      - name: Install test dependencies.
+        run: pip3 install yamllint
+
+      - name: Lint code.
+        run: |
+          yamllint .
+
+  ansible-lint:
+    name: Ansible Lint
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Fetch code
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      - name: Install lib dependencies
+        run: pip3 install netaddr
+
+      - name: Run ansible-lint
+        uses: ansible/ansible-lint@v24.7.0

.github/workflows/galaxy.yml

@@ -0,0 +1,17 @@
+---
+
+name: Deploy on Ansible Galaxy
+
+'on':
+  - push
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch code
+        uses: actions/checkout@v4
+      - name: galaxy
+        uses: robertdebock/galaxy-action@1.2.0
+        with:
+          galaxy_api_key: ${{ secrets.galaxy_api_key }}

.github/workflows/molecule.yml

@@ -0,0 +1,40 @@
+---
+name: Molecule
+
+'on':
+  pull_request:
+  push:
+    branches:
+      - master
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        scenario:
+          - debian12_master_slave
+          - debian12_upstream
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          path: "${{ github.repository }}"
+
+      - name: Set up Python 3.
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      - name: Install lib dependencies
+        run: pip3 install netaddr
+
+      - name: Molecule
+        uses: gofrolist/molecule-action@v2
+        with:
+          molecule_options: --base-config molecule/_shared/base.yml
+          molecule_args: --scenario-name ${{ matrix.scenario }}
+        env:
+          ANSIBLE_FORCE_COLOR: '1'

.travis.yml

@@ -1,57 +0,0 @@
----
-
-env:
-  global:
-    - VAGRANT_VERSION='2.2.18'
-  jobs:
-    - PLATFORM='docker-buster-default-master'      ANSIBLE_VERSION='>=2.11,<2.12'
-    - PLATFORM='docker-buster-upstream-master'     ANSIBLE_VERSION='>=2.11,<2.12'
-    - PLATFORM='docker-buster-default-galera-1'    ANSIBLE_VERSION='>=2.11,<2.12'
-    - PLATFORM='docker-buster-upstream-galera-1'   ANSIBLE_VERSION='>=2.11,<2.12'
-    - PLATFORM='docker-bullseye-default-master'    ANSIBLE_VERSION='>=2.11,<2.12'
-    - PLATFORM='docker-bullseye-upstream-master'   ANSIBLE_VERSION='>=2.11,<2.12'
-    - PLATFORM='docker-bullseye-default-galera-1'  ANSIBLE_VERSION='>=2.11,<2.12'
-    - PLATFORM='docker-bullseye-upstream-galera-1' ANSIBLE_VERSION='>=2.11,<2.12'
-
-os:
-  - linux
-dist: focal
-
-language: python
-python:
-  - 3.8
-
-services:
-  - docker
-
-before_install:
-  - sudo apt-get -q update
-  - sudo apt-get install -y yamllint
-  - sudo wget -nv https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}_x86_64.deb
-  - sudo dpkg -i vagrant_${VAGRANT_VERSION}_x86_64.deb
-  - vagrant plugin install vagrant-hostmanager
-
-install:
-  - sudo pip install "ansible-core$ANSIBLE_VERSION"
-  - sudo pip install ansible-lint
-  - ansible-galaxy collection install community.general community.mysql community.crypto ansible.posix
-
-script:
-  - VAGRANT_DEFAULT_PROVIDER=docker vagrant up $PLATFORM
-  - >
-    VAGRANT_DEFAULT_PROVIDER=docker vagrant provision $PLATFORM
-    | grep -q 'changed=0.*failed=0'
-    && (echo 'Idempotence test: pass' && exit 0)
-    || (echo 'Idempotence test: fail' && exit 1)
-  - VAGRANT_DEFAULT_PROVIDER=docker vagrant status
-  - >
-    yamllint .
-    && (echo 'YAML lint test: pass' && exit 0)
-    || (echo 'YAML lint test: fail' && exit 1)
-  - >
-    ansible-lint -v tests/test.yml
-    && (echo 'Ansible lint test: pass' && exit 0)
-    || (echo 'Ansible lint test: fail' && exit 1)
-
-notifications:
-  webhooks: https://galaxy.ansible.com/api/v1/notifications/

README.md

@@ -1,16 +1,16 @@
 MariaDB (MySQL) Ansible role for Debian
 =======================================
 
-[![Ansible Galaxy](http://img.shields.io/badge/ansible--galaxy-HanXHX.mysql-blue.svg)](https://galaxy.ansible.com/HanXHX/mysql) [![Build Status](https://app.travis-ci.com/HanXHX/ansible-mysql.svg?branch=master)](https://app.travis-ci.com/HanXHX/ansible-mysql)
+[![Ansible Galaxy](http://img.shields.io/badge/ansible--galaxy-HanXHX.mysql-blue.svg)](https://galaxy.ansible.com/HanXHX/mysql) ![GitHub Workflow Status (master)](https://img.shields.io/github/actions/workflow/status/hanxhx/ansible-mysql/molecule.yml?branch=master)
 
 Install and configure MariaDB (Galera Cluster). Manage replication (master/slave). Create users and databases.
 
-| OS              | Origin    | MariaDB versions  |
+|          OS          | Origin    | MariaDB versions |
-| --------------- | --------- | ----------------- |
+|:--------------------:|:----------|:-----------------|
-| Debian Buster   | Debian    | 10.3              |
+| Debian Bookworm (12) | Debian    | 10.11            |
-| Debian Buster   | Upstream  | Up from 10.3      |
+| Debian Bookworm (12) | Upstream  | From 10.11       |
-| Debian Bullseye | Debian    | 10.5              |
+
-| Debian Bullseye | Upstream  | Up from 10.5      |
+If you need to manage previous Debian versions, please use the [latest managed version](https://github.com/HanXHX/ansible-mysql/releases/tag/2.2.1).
 
 
 Notes
@@ -23,8 +23,8 @@ Notes
 Requirements
 ------------
 
-- Ansible >=2.11
+- Ansible - see [meta/main.yml](meta/main.yml)
-- Collections: community.general / community.mysql / community.crypto / ansible.posix
+- Collections: see [requirements.yml](requirements.yml)
 
 Role Variables
 --------------
@@ -57,7 +57,7 @@ mariadb_users:
     host_all: yes
 ```
 
-Check "priv" syntax in [mysql\_user module documentation](http://docs.ansible.com/mysql_user_module.html)
+Check "priv" syntax in [mysql\_user module documentation](https://docs.ansible.com/ansible/latest/collections/community/mysql/mysql_user_module.html)
 
 ### Packaging
 
@@ -72,12 +72,23 @@ Dependencies
 
 None.
 
+If you need to dev this role locally with molecule
+--------------------------------------------------
+
+Check available scenarios in [molecule](molecule) directory.
+
+With `debian12_master_slave` scenario:
+
+```commandline
+molecule -v -c molecule/_shared/base.yml verify -s debian12_master_slave
+```
+
 Example Playbook
 ----------------
 
     - hosts: servers
       roles:
-         - { role: HanXHX.mysql, mariadb_origin: 'upstream' }
+         - { role: hanxhx.mysql, mariadb_origin: 'upstream' }
 
 License
 -------

defaults/main.yml

@@ -35,7 +35,6 @@ mariadb_read_buffer_size: '1M'
 mariadb_read_rnd_buffer_size: '2M'
 mariadb_myisam_sort_buffer_size: '128M'
 mariadb_thread_cache_size: '256'
-mariadb_query_cache_size: '16M'
 
 # Other settings.
 mariadb_wait_timeout: 28800
@@ -69,7 +68,6 @@ mariadb_extra_configuration: {}
 # -------------------------------------
 mariadb_replication_master: false
 mariadb_replication_slave: false
-# This formula don't work with vagrant! All boxes have same default ip!
 mariadb_server_id: "{{ ansible_default_ipv4.address | ipaddr('int') }}"
 
 mariadb_replication_user: 'repl'
@@ -117,7 +115,7 @@ mariadb_users: []
 # MariaDB Upstream
 # -------------------------------------
 mariadb_upstream_setup_script: 'https://r.mariadb.com/downloads/mariadb_repo_setup'
-mariadb_upstream_version: '10.6'
+mariadb_upstream_version: '11.4'
 
 # -------------------------------------
 # Galera
@@ -126,7 +124,7 @@ mariadb_galera_resetup: false
 mariadb_wsrep_node_address: false    # Set primary node IP
 mariadb_galera_members: []
 mariadb_galera_primary_node: 'change_me'    # See: https://github.com/ansible/ansible/issues/17453
-mariadb_wsrep_stt_method: 'rsync'
+mariadb_wsrep_sst_method: 'rsync'
 
 mariadb_galera_package_name: 'galera-4'
 

handlers/main.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: restart mariadb
+- name: Restart mariadb
   ansible.builtin.service:
     name: "{{ mariadb_service_name }}"
     state: restarted

meta/main.yml

@@ -5,9 +5,9 @@ galaxy_info:
   role_name: mysql
   author: Emilien Mantel
   description: Install and configure MariaDB (and Galera Cluster) on Debian
-  company:
+  company: TripleStack
   license: GPLv2
-  min_ansible_version: 2.11
+  min_ansible_version: '2.17'
   platforms:
     - name: Debian
       versions:

molecule/_shared/Dockerfile.j2

@@ -0,0 +1,19 @@
+# Molecule managed
+
+{% if item.registry is defined %}
+FROM {{ item.registry.url }}/{{ item.image }}
+{% else %}
+FROM {{ item.image }}
+{% endif %}
+
+{% if item.env is defined %}
+{% for var, value in item.env.items() %}
+{% if value %}
+ENV {{ var }} {{ value }}
+{% endif %}
+{% endfor %}
+{% endif %}
+
+RUN apt-get update && \
+	apt-get install -y python3 sudo bash ca-certificates iproute2 python-apt-common \
+	&& apt-get clean

molecule/_shared/base.yml

@@ -0,0 +1,36 @@
+---
+
+scenario:
+  test_sequence:
+    - dependency
+    - syntax
+    - create
+    - prepare
+    - converge
+    - idempotence
+    - verify
+    - destroy
+driver:
+  name: docker
+role_name_check: 1
+provisioner:
+  name: ansible
+  config_options:
+    defaults:
+      deprecation_warnings: false
+      callback_whitelist: timer,profile_tasks
+      fact_caching: jsonfile
+      fact_caching_connection: ./cache
+      forks: 100
+    connection:
+      pipelining: true
+  playbooks:
+    prepare: ../_shared/prepare.yml
+  inventory:
+    group_vars:
+      all:
+        is_dev: true
+    links:
+      group_vars: ../_shared/inventory/group_vars/
+verifier:
+  name: ansible

molecule/_shared/files/import1.sql

@@ -9,4 +9,3 @@ INSERT IGNORE INTO `user` (`id`,`email`) VALUES (11,"vitae.dolor@rutrumnon.net")
 INSERT IGNORE INTO `user` (`id`,`email`) VALUES (21,"aliquam@atpretium.co.uk"),(22,"cursus@sapienmolestie.edu"),(23,"ornare.Fusce@pede.ca"),(24,"at@estac.co.uk"),(25,"sed@risusodioauctor.ca"),(26,"sit.amet.consectetuer@necorciDonec.com"),(27,"Nulla@infaucibus.co.uk"),(28,"tempus.scelerisque@utlacusNulla.com"),(29,"pellentesque.a@nostraper.com"),(30,"libero.et.tristique@Nunclaoreet.co.uk");
 INSERT IGNORE INTO `user` (`id`,`email`) VALUES (31,"dolor.sit.amet@Donecelementum.net"),(32,"ornare@massanonante.ca"),(33,"quam.elementum@semper.net"),(34,"Duis.ac.arcu@Integermollis.com"),(35,"magna.Sed.eu@magnaPraesent.co.uk"),(36,"Mauris.eu.turpis@mattis.ca"),(37,"ornare.facilisis.eget@urna.net"),(38,"Sed.diam.lorem@fringilla.co.uk"),(39,"pellentesque.Sed.dictum@Donec.edu"),(40,"faucibus.Morbi@nuncid.com");
 INSERT IGNORE INTO `user` (`id`,`email`) VALUES (41,"ullamcorper@at.co.uk"),(42,"nec.ante.blandit@utcursus.edu"),(43,"diam.vel.arcu@egestasFuscealiquet.com"),(44,"ridiculus@musAeneaneget.com"),(45,"ad@turpisvitaepurus.ca"),(46,"ultrices.posuere.cubilia@purusMaecenas.net"),(47,"luctus@libero.org"),(48,"mi@elitNulla.com"),(49,"elementum@ipsumdolorsit.edu"),(50,"orci@Donec.co.uk");
-

molecule/_shared/inventory/group_vars/all.yml

@@ -5,3 +5,5 @@ mariadb_extra_configuration:
   innodb_commit_concurrency: 0
 mariadb_install_xtrabackup_package: true
 mariadb_slow_query_log_enabled: true
+mariadb_debug_role: true
+mariadb_innodb_buffer_pool_size: 128M

molecule/_shared/inventory/group_vars/galera.yml

@@ -0,0 +1,4 @@
+---
+
+mariadb_use_galera: true
+mariadb_galera_members: "{{ groups['galera'] }}"

molecule/_shared/inventory/group_vars/master.yml

@@ -15,6 +15,5 @@ mariadb_users:
     host: '%'
 mariadb_replication_master: true
 mariadb_replication_slave: false
-mariadb_server_id: 1
 
 # vim: set ft=yaml :

molecule/_shared/inventory/group_vars/slave.yml

@@ -4,7 +4,8 @@ mariadb_replication_master: false
 mariadb_replication_slave: true
 mariadb_replication_user: 'replication'
 mariadb_replication_password: '1a2b3c'
-mariadb_server_id: 2
 mariadb_slave_ignore_db: ['norepl']
+mariadb_slave_import_from: "{{ groups['master'][0] }}"
+mariadb_replication_host: "{{ groups['master'][0] }}"
 
 # vim: set ft=yaml :

molecule/_shared/inventory/group_vars/upstream.yml

@@ -0,0 +1,3 @@
+---
+
+mariadb_origin: 'upstream'

molecule/_shared/prepare.yml

@@ -0,0 +1,21 @@
+---
+
+- name: Prepare hosts
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: APT | Install some packages
+      ansible.builtin.apt:
+        name: "{{ p }}"
+        update_cache: true
+        cache_valid_time: 3600
+      vars:
+        p: ['ca-certificates', 'curl', 'rsync', 'rsyslog', 'ssh', 'strace', 'vim']
+
+    - name: SERVICE | Ensure daemon are started
+      ansible.builtin.service:
+        name: "{{ item }}"
+        state: started
+      loop:
+        - rsyslog
+        - ssh

molecule/debian12_master_slave/converge.yml

@@ -0,0 +1,34 @@
+---
+
+# Note: master must be converged first
+- name: Converge master
+  hosts: master
+  gather_facts: true
+  tasks:
+    - name: Include role
+      ansible.builtin.include_role:
+        name: "hanxhx.mysql"
+
+    - name: COPY | Deploy first dump
+      ansible.builtin.copy:
+        src: ../_shared/files/import1.sql
+        dest: /tmp/import1.sql
+        mode: 0644
+        owner: root
+        group: root
+
+    - name: MYSQL_DB | Import first dump
+      community.mysql.mysql_db:
+        name: "{{ item }}"
+        state: import
+        target: /tmp/import1.sql
+        login_unix_socket: "/run/mysqld/mysqld.sock"
+      loop: "{{ mariadb_databases }}"
+
+- name: Converge slave
+  hosts: slave
+  gather_facts: true
+  tasks:
+    - name: Include role
+      ansible.builtin.include_role:
+        name: "hanxhx.mysql"

molecule/debian12_master_slave/molecule.yml

@@ -0,0 +1,46 @@
+---
+
+platforms:
+  - name: debian12-master1
+    image: dokken/debian-12
+    command: /lib/systemd/systemd
+    dockerfile: ../_shared/Dockerfile.j2
+    capabilities:
+      - SYS_ADMIN
+    cgroupns_mode: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    privileged: true
+    networks:
+      - name: "00-molecule-d12-ms"
+        ipv4_address: '172.16.50.1'
+    docker_networks:
+      - name: "00-molecule-d12-ms"
+        ipam_config:
+          - subnet: "172.16.50.0/24"
+            gateway: "172.16.50.254"
+    groups:
+      - master
+
+  - name: debian12-slave1
+    image: dokken/debian-12
+    command: /lib/systemd/systemd
+    dockerfile: ../_shared/Dockerfile.j2
+    capabilities:
+      - SYS_ADMIN
+    cgroupns_mode: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    privileged: true
+    networks:
+      - name: "00-molecule-d12-ms"
+        ipv4_address: '172.16.50.2'
+    groups:
+      - slave
+
+provisioner:
+  inventory:
+    host_vars: ~
+    group_vars:
+      master: ~
+      slave: ~

molecule/debian12_master_slave/verify.yml

@@ -0,0 +1,32 @@
+---
+
+- name: Verify slave
+  hosts: slave
+  gather_facts: false
+  tasks:
+    - name: MYSQL_REPLICATION | Get slave infos
+      community.mysql.mysql_replication:
+        mode: getreplica
+      register: slave
+
+    - name: ASSERT | If slave threads are not running
+      ansible.builtin.assert:
+        that:
+          - slave.Slave_IO_Running == 'Yes'
+          - slave.Slave_SQL_Running == 'Yes'
+        fail_msg: "Slave issue, please check"
+        success_msg: "Slave is running"
+
+    - name: Check replication data
+      community.mysql.mysql_query:
+        login_db: testrepl
+        query: 'SELECT COUNT(*) AS c FROM user'
+        login_unix_socket: /run/mysqld/mysqld.sock
+      register: result
+
+    - name: ASSERT | Check replication data
+      ansible.builtin.assert:
+        that:
+          - result.query_result.0.0.c == 50
+        fail_msg: "Replication data is not correct"
+        success_msg: "Replication data is correct"

molecule/debian12_upstream/converge.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Converge
+  hosts: all
+  gather_facts: true
+  tasks:
+    - name: Include role
+      ansible.builtin.include_role:
+        name: "hanxhx.mysql"

molecule/debian12_upstream/molecule.yml

@@ -0,0 +1,15 @@
+---
+
+platforms:
+  - name: debian12-upstream1
+    image: dokken/debian-12
+    command: /lib/systemd/systemd
+    dockerfile: ../_shared/Dockerfile.j2
+    capabilities:
+      - SYS_ADMIN
+    cgroupns_mode: host
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    privileged: true
+    groups:
+      - upstream

molecule/debian12_upstream/verify.yml

@@ -0,0 +1,11 @@
+---
+
+- name: Verify slave
+  hosts: all
+  gather_facts: false
+  tasks:
+    - name: COMMAND | Check if mariadb is running  # noqa: command-instead-of-module
+      ansible.builtin.command: "systemctl is-active mariadb"
+      register: mariadb_is_running
+      changed_when: false
+      failed_when: mariadb_is_running.rc != 0

requirements.txt

@@ -0,0 +1,52 @@
+ansible==10.3.0
+ansible-compat==24.8.0
+ansible-core==2.17.3
+ansible-lint==24.7.0
+attrs==24.2.0
+black==24.8.0
+bracex==2.5
+certifi==2024.7.4
+cffi==1.17.0
+charset-normalizer==3.3.2
+click==8.1.7
+click-help-colors==0.9.4
+cryptography==43.0.0
+distro==1.9.0
+docker==6.1.3
+enrich==1.2.7
+filelock==3.15.4
+idna==3.8
+importlib_metadata==8.4.0
+Jinja2==3.1.4
+jsonschema==4.23.0
+jsonschema-specifications==2023.12.1
+markdown-it-py==3.0.0
+MarkupSafe==2.1.5
+mdurl==0.1.2
+molecule==24.8.0
+molecule-plugins==23.5.3
+mypy-extensions==1.0.0
+netaddr==1.3.0
+packaging==24.1
+pathspec==0.12.1
+platformdirs==4.2.2
+pluggy==1.5.0
+pycparser==2.22
+Pygments==2.18.0
+PyYAML==6.0.2
+referencing==0.35.1
+requests==2.31.0
+resolvelib==1.0.1
+rich==13.7.1
+rpds-py==0.20.0
+ruamel.yaml==0.18.6
+ruamel.yaml.clib==0.2.8
+selinux==0.3.0
+subprocess-tee==0.4.2
+tomli==2.0.1
+typing_extensions==4.12.2
+urllib3==2.2.2
+wcmatch==9.0
+websocket-client==1.8.0
+yamllint==1.35.1
+zipp==3.20.0

requirements.yml

@@ -0,0 +1,8 @@
+---
+
+collections:
+  - ansible.posix
+  - ansible.netcommon
+  - community.crypto
+  - community.general
+  - community.mysql

tasks/galera/bootstrap.yml

@@ -8,7 +8,9 @@
     path: "{{ __mark }}"
   register: s
 
-- block:
+- name: COMMAND | Setup galera cluster
+  when: not s.stat.exists or mariadb_galera_resetup
+  block:
     - name: SET_FACT | We must NOT restart after bootstrap!
       ansible.builtin.set_fact:
         mariadb_notify_restart: false
@@ -21,6 +23,7 @@
     - name: COMMAND | Bootstrap first node (systemd)
       ansible.builtin.command: galera_new_cluster
       when: ansible_service_mgr == 'systemd'
+      changed_when: true
 
     - name: SERVICE | Bootstrap first node (clean init)
       ansible.builtin.service:
@@ -30,8 +33,6 @@
       register: bootstrap_run
       when: ansible_service_mgr != 'systemd'
 
-  when: not s.stat.exists or mariadb_galera_resetup
-
 - name: COMMAND | Create Bootstrap mark
   ansible.builtin.command: "touch {{ __mark }}"
   args:

tasks/galera/nodes.yml

@@ -11,25 +11,25 @@
   register: ondc
   changed_when: false
 
-- block:
+- name: BLOCK | Compare debian.cnf
-
-  - name: SERVICE | Stop MariaDB
-    ansible.builtin.service:
-      name: "{{ mariadb_service_name }}"
-      state: stopped
-
-  - name: COPY | Paste primary node's debian.cnf
-    ansible.builtin.copy:
-      content: "{{ debiancnf.stdout }}"
-      dest: /etc/mysql/debian.cnf
-      mode: 0600
-      owner: root
-      group: root
-    register: paste
-
-  - name: SERVICE | Start MariaDB
-    ansible.builtin.service:
-      name: "{{ mariadb_service_name }}"
-      state: started
-
   when: debiancnf.stdout != ondc.stdout
+  block:
+
+    - name: SERVICE | Stop MariaDB
+      ansible.builtin.service:
+        name: "{{ mariadb_service_name }}"
+        state: stopped
+
+    - name: COPY | Paste primary node's debian.cnf
+      ansible.builtin.copy:
+        content: "{{ debiancnf.stdout }}"
+        dest: /etc/mysql/debian.cnf
+        mode: 0600
+        owner: root
+        group: root
+      register: paste
+
+    - name: SERVICE | Start MariaDB
+      ansible.builtin.service:
+        name: "{{ mariadb_service_name }}"
+        state: started

tasks/install/mariadb/upstream.yml

@@ -4,13 +4,15 @@
   ansible.builtin.apt:
     name: gpg
 
-- name: COMMAND | Check indempotent
+- name: COMMAND | Check expected mariadb version
   ansible.builtin.command: 'grep -q "{{ mariadb_upstream_version }}" /etc/apt/sources.list.d/mariadb.list'
-  register: check_idempotent
+  register: check_version
   failed_when: false
   changed_when: false
 
-- block:
+- name: APT | Add MariaDB upstream repository
+  when: check_version.rc > 0
+  block:
 
     - name: GET_URL | Download MariaDB setup script
       ansible.builtin.get_url:
@@ -28,12 +30,3 @@
       ansible.builtin.file:
         path: '/tmp/mariadb_repo_setup'
         state: absent
-
-  when: check_idempotent.rc > 0
-
-- name: SHELL | Remove useless old files
-  ansible.builtin.shell: 'rm -f /etc/apt/sources.list.d/mariadb.list.old_*'
-  args:
-    removes: /etc/apt/sources.list.d/mariadb.list.old_1
-  tags:
-    - skip_ansible_lint

tasks/main.yml

@@ -19,6 +19,11 @@
 - name: INCLUDE | Install
   ansible.builtin.import_tasks: install/main.yml
 
+- name: SHELL | Get current mariadb version  # noqa: risky-shell-pipe
+  ansible.builtin.shell: dpkg -l mariadb-common | awk '/^ii/ { print $3 }' | sed -r 's/^1://g; s/^([[:digit:]]+\.[[:digit:]]+).+$/\1/g'
+  register: __mariadb_version
+  changed_when: false
+
 - name: TEMPLATE | Deploy config files
   ansible.builtin.template:
     src: "{{ item }}"
@@ -28,13 +33,18 @@
     group: root
   register: config
   loop:
-    - etc/mysql/my.cnf
     - etc/mysql/conf.d/mysqldump.cnf.j2
     - etc/mysql/mariadb.conf.d/10-extra.cnf.j2
-    - etc/mysql/mariadb.conf.d/50-client.cnf.j2
-    - etc/mysql/mariadb.conf.d/50-mysqld_safe.cnf.j2
     - etc/mysql/mariadb.conf.d/50-server.cnf.j2
 
+- name: FILE | Ensure log dir exists
+  ansible.builtin.file:
+    path: "{{ mariadb_slow_query_log_file | dirname }}"
+    state: directory
+    mode: 0755
+    owner: mysql
+    group: mysql
+
 - name: SERVICE | Restart Mariadb now one at a time (prevent bugs)
   throttle: 1
   ansible.builtin.service:

tasks/replication/master.yml

@@ -7,4 +7,4 @@
     mode: 0644
     owner: root
     group: root
-  notify: restart mariadb
+  notify: Restart mariadb

tasks/replication/slave.yml

@@ -14,26 +14,26 @@
     mode: 0644
     owner: root
     group: root
-  notify: restart mariadb
+  notify: Restart mariadb
 
 - name: MYSQL_REPLICATION | Get slave status
   community.mysql.mysql_replication:
-    mode: getslave
+    mode: getreplica
     login_unix_socket: "{{ mariadb_socket }}"
   ignore_errors: true
   register: slave_status
 
 - name: INCLUDE | Import data
   ansible.builtin.import_tasks: slave/import_data.yml
-  when: (slave_status.failed or not slave_status.Is_Slave) and mariadb_slave_import_data
+  when: (slave_status.failed or not slave_status.Is_Replica) and mariadb_slave_import_data
 
-- name: Configure GTID Recplication
+- name: Configure GTID Replication
   ansible.builtin.import_tasks: slave/gtid.yml
-  when: slave_status.failed or not slave_status.Is_Slave or mariadb_slave_force_setup
+  when: slave_status.failed or not slave_status.Is_Replica or mariadb_slave_force_setup
 
 - name: MYSQL_REPLICATION | Get slave status
   community.mysql.mysql_replication:
-    mode: getslave
+    mode: getreplica
     login_unix_socket: "{{ mariadb_socket }}"
   ignore_errors: true
   register: slave_status

tasks/replication/slave/gtid.yml

@@ -2,12 +2,12 @@
 
 - name: MYSQL_REPLICATION | Stop slave
   community.mysql.mysql_replication:
-    mode: stopslave
+    mode: stopreplica
     login_unix_socket: "{{ mariadb_socket }}"
 
 - name: MYSQL_REPLICATION | Configure master host
   community.mysql.mysql_replication:
-    mode: changemaster
+    mode: changeprimary
     master_host: "{{ mariadb_replication_host }}"
     master_port: "{{ mariadb_replication_port }}"
     master_user: "{{ mariadb_replication_user }}"
@@ -22,5 +22,5 @@
 
 - name: MYSQL_REPLICATION | Start slave
   community.mysql.mysql_replication:
-    mode: startslave
+    mode: startreplica
     login_unix_socket: "{{ mariadb_socket }}"

tasks/replication/slave/import_data.yml

@@ -7,11 +7,13 @@
     mode: 0700
 
 - name: OPENSSH_KEYPAIR | Create SSH key
-  openssh_keypair:
+  community.crypto.openssh_keypair:
     path: "{{ ansible_env.HOME }}/.ssh/id_rsa"
   register: gen_ssh
 
-- block:
+- name: BLOCK | Prepare backup
+  delegate_to: "{{ mariadb_slave_import_from }}"
+  block:
 
     - name: AUTHORIZED_KEY | Auth slave to backup host
       ansible.posix.authorized_key:
@@ -33,14 +35,12 @@
         creates: "{{ mariadb_backup_dir }}/xtrabackup_info"
       register: backup
 
-    - name: COMMAND | Dump
+    - name: COMMAND | Dump  # noqa: no-handler
       ansible.builtin.command: "mariabackup --prepare --target-dir={{ mariadb_backup_dir }}"
       when: backup.changed
       register: prep
       changed_when: "'This target seems to be not prepared yet' in prep.stderr"
 
-  delegate_to: "{{ mariadb_slave_import_from }}"
-
 - name: MYSQL_VARIABLES | Get datadir
   community.mysql.mysql_variables:
     variable: datadir
@@ -56,8 +56,8 @@
     name: "{{ mariadb_service_name }}"
     state: stopped
 
-- name: COMMAND | Sync backup to slave - TODO remove vagrant as static user (see why mariadb_backup_user is not working)
+- name: COMMAND | Sync backup to slave
-  ansible.builtin.command: "sudo -E rsync --rsync-path='sudo rsync' -a -e 'ssh -o StrictHostKeyChecking=no' {{ mariadb_backup_user }}@{{ mariadb_slave_import_from }}:{{ mariadb_backup_dir }}/ {{ mariadb_datadir }}/"
+  ansible.builtin.command: "sudo -E rsync --rsync-path='sudo rsync' --delete -a -e 'ssh -o StrictHostKeyChecking=no' {{ mariadb_backup_user }}@{{ mariadb_slave_import_from }}:{{ mariadb_backup_dir }}/ {{ mariadb_datadir }}/"
   become: false
   tags:
     - skip_ansible_lint
@@ -71,12 +71,6 @@
     group: mysql
     recurse: true
 
-- name: SHELL | Remove InnoDB redo logs
-  ansible.builtin.shell: "rm -f {{ mariadb_datadir }}/ib_logfile*"
-  args:
-    removes: "{{ mariadb_datadir }}/ib_logfile0"
-    warn: false
-
 - name: SERVICE | Start MariaDB
   ansible.builtin.service:
     name: "{{ mariadb_service_name }}"

tasks/replication/slave/replication.yml

@@ -1,29 +0,0 @@
----
-
-- name: MYSQL_REPLICATION | Stop slave
-  mysql_replication:
-    mode: stopslave
-    login_unix_socket: "{{ mariadb_socket }}"
-
-- name: MYSQL_REPLICATION | Configure master host
-  mysql_replication:
-    mode: changemaster
-    master_host: "{{ mariadb_replication_host }}"
-    master_port: "{{ mariadb_replication_port }}"
-    master_user: "{{ mariadb_replication_user }}"
-    master_password: "{{ mariadb_replication_password }}"
-    login_unix_socket: "{{ mariadb_socket }}"
-  no_log: "{{ not mariadb_debug_role }}"
-
-- name: MYSQL_REPLICATION | Change master
-  mysql_replication:
-    mode: changemaster
-    master_log_file: "{{ mariadb_master_log_file }}"
-    master_log_pos: "{{ mariadb_master_log_pos }}"
-    login_unix_socket: "{{ mariadb_socket }}"
-  when: mariadb_master_log_file is defined and mariadb_master_log_pos is defined
-
-- name: MYSQL_REPLICATION | Start slave
-  mysql_replication:
-    mode: startslave
-    login_unix_socket: "{{ mariadb_socket }}"

tasks/secure.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: MYSQL_USER | Remove all anonymous users
-  mysql_user:
+  community.mysql.mysql_user:
     name: ''
     host: "{{ item }}"
     state: absent
@@ -13,7 +13,7 @@
     - localhost
 
 - name: MYSQL_DB | Remove the test database
-  mysql_db:
+  community.mysql.mysql_db:
     name: test
     state: absent
     login_unix_socket: "{{ mariadb_socket }}"

templates/etc/mysql/conf.d/mysqldump.cnf.j2

@@ -1,3 +1,7 @@
+# -------------------------------------------
+# {{ ansible_managed }}
+# -------------------------------------------
+
 [mysqldump]
 quick
 quote-names

templates/etc/mysql/mariadb.conf.d/20-galera.cnf.j2

@@ -1,31 +0,0 @@
-#
-# {{ ansible_managed }}
-#
-
-[mysqld]
-
-# --------------------
-# Galera config
-# --------------------
-
-# Global
-wsrep_on=ON
-wsrep_provider=/usr/lib/galera/libgalera_smm.so
-wsrep_cluster_address=gcomm://{{ mariadb_galera_members | join(",") }}
-wsrep_sst_method="{{ mariadb_wsrep_stt_method }}"
-{% if mariadb_wsrep_cluster_name is defined %}
-wsrep_cluster_name="{{ mariadb_wsrep_cluster_name }}"
-{% endif %}
-
-# Node Configuration
-wsrep_node_address="{{ mariadb_wsrep_node_address | default(ansible_default_ipv4.address if ansible_default_ipv4 is defined else '127.0.0.1') }}"
-wsrep_node_name="{{ mariadb_wsrep_node_name | default(ansible_fqdn) }}"
-
-
-# --------------------
-# Deps
-# --------------------
-binlog_format=ROW
-default_storage_engine=InnoDB
-innodb_autoinc_lock_mode=2
-innodb_doublewrite=1

templates/etc/mysql/mariadb.conf.d/40-master.cnf.j2

@@ -1,6 +1,6 @@
-#
+# -------------------------------------------
 # {{ ansible_managed }}
-#
+# -------------------------------------------
 
 # Replication master
 

templates/etc/mysql/mariadb.conf.d/40-slave.cnf.j2

@@ -1,8 +1,7 @@
-#
+# -------------------------------------------
 # {{ ansible_managed }}
-#
+# -------------------------------------------
 
-#
 # Replication slave
 
 [mysqld]

templates/etc/mysql/mariadb.conf.d/50-client.cnf.j2

@@ -1,29 +0,0 @@
-#
-# {{ ansible_managed }}
-#
-
-#
-# This group is read by the client library
-# Use it for options that affect all clients, but not the server
-#
-
-[client]
-# Default is Latin1, if you need UTF-8 set this (also in server section)
-default-character-set = utf8mb4
-
-# socket location
-socket = {{ mariadb_socket }}
-
-# Example of client certificate usage
-# ssl-cert=/etc/mysql/client-cert.pem
-# ssl-key=/etc/mysql/client-key.pem
-#
-# Allow only TLS encrypted connections
-# ssl-verify-server-cert=on
-
-# This group is *never* read by mysql client library, though this
-# /etc/mysql/mariadb.cnf.d/client.cnf file is not read by Oracle MySQL
-# client anyway.
-# If you use the same .cnf file for MySQL and MariaDB,
-# use it for MariaDB-only client options
-[client-mariadb]

templates/etc/mysql/mariadb.conf.d/50-mysqld_safe.cnf.j2

@@ -1,34 +0,0 @@
-#
-# {{ ansible_managed }}
-#
-
-# NOTE: This file is read only by the traditional SysV init script, not systemd.
-# MariaDB systemd does _not_ utilize mysqld_safe nor read this file.
-#
-# For similar behaviour, systemd users should create the following file:
-# /etc/systemd/system/mariadb.service.d/migrated-from-my.cnf-settings.conf
-#
-# To achieve the same result as the default 50-mysqld_safe.cnf, please create
-# /etc/systemd/system/mariadb.service.d/migrated-from-my.cnf-settings.conf
-# with the following contents:
-#
-# [Service]
-# User=mysql
-# StandardOutput=syslog
-# StandardError=syslog
-# SyslogFacility=daemon
-# SyslogLevel=err
-# SyslogIdentifier=mysqld
-#
-# For more information, please read https://mariadb.com/kb/en/mariadb/systemd/
-#
-
-[mysqld_safe]
-# This will be passed to all mysql clients
-# It has been reported that passwords should be enclosed with ticks/quotes
-# especially if they contain "#" chars...
-# Remember to edit /etc/mysql/debian.cnf when changing the socket location.
-socket		= {{ mariadb_socket }}
-nice		= 0
-skip_log_error
-syslog

templates/etc/mysql/mariadb.conf.d/50-server.cnf.j2

@@ -1,18 +1,16 @@
-#
+# -------------------------------------------
 # {{ ansible_managed }}
-#
+# -------------------------------------------
 
 #
 # These groups are read by MariaDB server.
 # Use it for options that only the server (but not clients) should see
-#
-# See the examples of server my.cnf files in /usr/share/mysql
 
 # this is read by the standalone daemon and embedded servers
 [server]
 
-# this is only for the mysqld standalone daemon
+# this is only for the mariadbd daemon
-[mysqld]
+[mariadbd]
 
 #
 # * Basic Settings
@@ -25,7 +23,10 @@ basedir                 = /usr
 datadir                 = {{ mariadb_datadir }}
 tmpdir                  = /tmp
 lc-messages-dir         = /usr/share/mysql
-#skip-external-locking
+
+# Broken reverse DNS slows down connections considerably and name resolve is
+# safe to skip if there are no "host by domain name" access grants
+#skip-name-resolve
 
 # Instead of skip-networking the default is now to listen only on
 # localhost which is more compatible and is not less secure.
@@ -34,6 +35,7 @@ bind-address            = {{ mariadb_bind_address }}
 #
 # * Fine Tuning
 #
+
 key_buffer_size         = {{ mariadb_key_buffer_size }}
 max_allowed_packet      = {{ mariadb_max_allowed_packet }}
 #thread_stack           = 192K
@@ -51,19 +53,22 @@ read_buffer_size        = {{ mariadb_read_buffer_size }}
 read_rnd_buffer_size    = {{ mariadb_read_rnd_buffer_size }}
 myisam_sort_buffer_size = {{ mariadb_myisam_sort_buffer_size }}
 
-#
-# * Query Cache Configuration
-#
-query_cache_size        = {{ mariadb_query_cache_size }}
 
 #
 # * Logging and Replication
 #
+
+# Note: The configured log file or its directory need to be created
+# and be writable by the mysql user, e.g.:
+# $ sudo mkdir -m 2750 /var/log/mysql
+# $ sudo chown mysql /var/log/mysql
+
 # Both location gets rotated by the cronjob.
 # Be aware that this log type is a performance killer.
-# As of 5.1 you can enable the log at runtime!
+# Recommend only changing this at runtime for short testing periods if needed!
 #general_log_file       = /var/log/mysql/mysql.log
 #general_log            = 1
+
 #
 # Error log - should be very few entries.
 #
@@ -71,81 +76,56 @@ query_cache_size        = {{ mariadb_query_cache_size }}
 syslog
 syslog-tag = {{ mariadb_syslog_tag }}
 {% else %}
-log-error = {{ mariadb_log_error }}
+log_error = {{ mariadb_log_error }}
 {% endif %}
 
 #
 # Enable the slow query log to see queries with especially long duration
-#slow_query_log_file    = /var/log/mysql/mariadb-slow.log
-#long_query_time        = 10
-#log_slow_rate_limit    = 1000
-#log_slow_verbosity     = query_plan
 #log-queries-not-using-indexes
 {% if mariadb_slow_query_log_enabled %}
 slow_query_log_file = {{ mariadb_slow_query_log_file }}
 long_query_time = {{ mariadb_slow_query_time }}
 slow_query_log = 1
+{% else %}
+#slow_query_log_file    = /var/log/mysql/mariadb-slow.log
+#long_query_time        = 10
+#log_slow_rate_limit    = 1000
+#log_slow_verbosity     = query_plan
 {% endif %}
 
 #
-# The following can be used as easy to replay backup logs or for replication.
+# * SSL/TLS
-# note: if you are setting up a replication slave, see README.Debian about
+#
-#       other settings you may need to change.
-#server-id              = 1
-#log_bin                = /var/log/mysql/mysql-bin.log
-#expire_logs_days       = 10
-#max_binlog_size        = 100M
-#binlog_do_db           = include_database_name
-#binlog_ignore_db       = exclude_database_name
 
-#
+# For documentation, please read
-# * Security Features
+# https://mariadb.com/kb/en/securing-connections-for-client-and-server/
-#
-# Read the manual, too, if you want chroot!
-#chroot = /var/lib/mysql/
-#
-# For generating SSL certificates you can use for example the GUI tool "tinyca".
-#
 #ssl-ca = /etc/mysql/cacert.pem
 #ssl-cert = /etc/mysql/server-cert.pem
 #ssl-key = /etc/mysql/server-key.pem
-#
+#require-secure-transport = on
-# Accept only connections using the latest and most secure TLS protocol version.
-# ..when MariaDB is compiled with OpenSSL:
-#ssl-cipher = TLSv1.2
-# ..when MariaDB is compiled with YaSSL (default in Debian):
-#ssl = on
 
 #
 # * Character sets
 #
-# MySQL/MariaDB default is Latin1, but in Debian we rather default to the full
+
+# MariaDB default is Latin1, but in Debian we rather default to the full
 # utf8 4-byte character set. See also client.cnf
-#
 character-set-server  = utf8mb4
 collation-server      = utf8mb4_general_ci
 
 #
 # * InnoDB
 #
+
 # InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
 # Read the manual for more InnoDB related options. There are many!
-innodb_file_per_table = 1
+# Most important is to give InnoDB 80 % of the system RAM for buffer use:
-innodb_buffer_pool_size = {{ mariadb_innodb_buffer_pool_size }}
+# https://mariadb.com/kb/en/innodb-system-variables/#innodb_buffer_pool_size
-innodb_log_buffer_size = {{ mariadb_innodb_log_buffer_size }}
+innodb_buffer_pool_size        = {{ mariadb_innodb_buffer_pool_size }}
+innodb_log_buffer_size         = {{ mariadb_innodb_log_buffer_size }}
 innodb_flush_log_at_trx_commit = {{ mariadb_innodb_flush_log_at_trx_commit }}
-innodb_lock_wait_timeout = {{ mariadb_innodb_lock_wait_timeout }}
+innodb_lock_wait_timeout       = {{ mariadb_innodb_lock_wait_timeout }}
-innodb_log_file_size = {{ mariadb_innodb_log_file_size }}
+innodb_log_file_size           = {{ mariadb_innodb_log_file_size }}
-
-
-#
-# * Unix socket authentication plugin is built-in since 10.0.22-6
-#
-# Needed so the root database user can authenticate without a password but
-# only when running as the unix root user.
-#
-# Also available for other users if required.
-# See https://mariadb.com/kb/en/unix_socket-authentication-plugin/
 
 # this is only for embedded server
 [embedded]
@@ -153,10 +133,9 @@ innodb_log_file_size = {{ mariadb_innodb_log_file_size }}
 # This group is only read by MariaDB servers, not by MySQL.
 # If you use the same .cnf file for MySQL and MariaDB,
 # you can put MariaDB-only options here
-[mariadb]
+[mariadbd]
 
-# This group is only read by MariaDB-10.3 servers.
+# This group is only read by MariaDB-{{ __mariadb_version.stdout }} servers.
 # If you use the same .cnf file for MariaDB of different versions,
 # use this group for options that older servers don't understand
-[mariadb-10.3]
+[mariadb-{{ __mariadb_version.stdout }}]
-

templates/etc/mysql/mariadb.conf.d/60-galera.cnf.j2

@@ -0,0 +1,29 @@
+# -------------------------------------------
+# {{ ansible_managed }}
+# -------------------------------------------
+
+#
+# * Galera-related settings
+#
+# See the examples of server wsrep.cnf files in /usr/share/mariadb
+# and read more at https://mariadb.com/kb/en/galera-cluster/
+
+[galera]
+
+# Global
+wsrep_on              = ON
+wsrep_cluster_address = gcomm://{{ mariadb_galera_members | join(",") }}
+wsrep_sst_method      = "{{ mariadb_wsrep_sst_method }}"
+{% if mariadb_wsrep_cluster_name is defined %}
+wsrep_cluster_name    = "{{ mariadb_wsrep_cluster_name }}"
+{% endif %}
+
+# Node Configuration
+wsrep_node_address    = "{{ mariadb_wsrep_node_address | default(ansible_default_ipv4.address if ansible_default_ipv4 is defined else '127.0.0.1') }}"
+wsrep_node_name       = "{{ mariadb_wsrep_node_name | default(ansible_fqdn) }}"
+
+# Deps
+binlog_format            = ROW
+default_storage_engine   = InnoDB
+innodb_autoinc_lock_mode = 2
+innodb_doublewrite       = 1

templates/etc/mysql/my.cnf

@@ -1,23 +0,0 @@
-# The MariaDB configuration file
-#
-# The MariaDB/MySQL tools read configuration files in the following order:
-# 1. "/etc/mysql/mariadb.cnf" (this file) to set global defaults,
-# 2. "/etc/mysql/conf.d/*.cnf" to set global options.
-# 3. "/etc/mysql/mariadb.conf.d/*.cnf" to set MariaDB-only options.
-# 4. "~/.my.cnf" to set user-specific options.
-#
-# If the same option is defined multiple times, the last one will apply.
-#
-# One can use all long options that the program supports.
-# Run program with --help to get a list of available options and with
-# --print-defaults to see which it would actually understand and use.
-
-#
-# This group is read both both by the client and the server
-# use it for options that affect everything
-#
-[client-server]
-
-# Import all .cnf files from configuration directory
-!includedir /etc/mysql/conf.d/
-!includedir /etc/mysql/mariadb.conf.d/

tests/group_vars/galera.yml

@@ -1,7 +0,0 @@
----
-
-mariadb_use_galera: true
-mariadb_galera_members:
-  - '{% if is_docker %}docker-{% else %}vbox-{% endif %}{{ ansible_distribution_release }}-{{ mariadb_origin }}-galera-1'
-  - '{% if is_docker %}docker-{% else %}vbox-{% endif %}{{ ansible_distribution_release }}-{{ mariadb_origin }}-galera-2'
-  - '{% if is_docker %}docker-{% else %}vbox-{% endif %}{{ ansible_distribution_release }}-{{ mariadb_origin }}-galera-3'