From cb574fc6bd3ffdaa164b330c47542172a5b86b1f Mon Sep 17 00:00:00 2001
From: Jeff Turner <jeff@redradishtech.com>
Date: Thu, 30 Jul 2026 17:10:23 +1000
Subject: [PATCH 1/2] fix(mariadb plugin): mariadbd-safe and mariadb-install-db
 had no devbox wrapper

The intention of mariadb/flake.nix is to invoke these commands with Devbox-specific flags:

mariadb-safe --defaults-file=$MYSQL_CONF --basedir=$out --datadir=$MYSQL_DATADIR --pid-file=$MYSQL_PID_FILE
mariadb-install-db --basedir=$out --datadir=$MYSQL_DATADIR --pid-file=$MYSQL_PID_FILE --basedir=$MYSQL_BASEDIR

but that was not happening - the upstream Nix versions were being used with no extra flags.

Notably this caused mariadb-install-db to inherit settings from /etc/mysql. If e.g.
/etc/mysql/mariadb.conf.d/50-server.cnf sets 'user=mysql', mariadb-install-db fails.

A second, hidden-till-now bug is that flake.nix wrapped `mariadb_install_db`, when the correct upstream script is
`mariadb-install-db`.
---
 plugins/mariadb/flake.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/plugins/mariadb/flake.nix b/plugins/mariadb/flake.nix
index 1ac539e6357..2ca97fd210f 100644
--- a/plugins/mariadb/flake.nix
+++ b/plugins/mariadb/flake.nix
@@ -23,7 +23,7 @@
           wrapProgram $out/bin/mysqld_safe \
             --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
 
-          if [-f $out/bin/mariadbd-safe]; then
+          if [ -f $out/bin/mariadbd-safe ]; then
             wrapProgram $out/bin/mariadbd_safe \
               --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
           fi
@@ -31,8 +31,8 @@
           wrapProgram "$out/bin/mysql_install_db" \
             --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
 
-          if [-f $out/bin/mariadb-install-db]; then
-            wrapProgram "$out/bin/mariadb_install_db" \
+          if [ -f $out/bin/mariadb-install-db ]; then
+            wrapProgram "$out/bin/mariadb-install-db" \
               --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
           fi
         '';

From 829a0ed39c3fd8a76fc258c658a2d4993e0ffa55 Mon Sep 17 00:00:00 2001
From: Jeff Turner <jeff@redradishtech.com>
Date: Mon, 6 Jul 2026 18:01:14 +1000
Subject: [PATCH 2/2] fix(mariadb,mysql plugin): ignore /etc/mysql config
 files, for better isolation (#2904)

By default, mariadbd reads /etc/mysql/mariadb.cnf, and if the system has
another version of MariaDB installed, those config files can cause the
Devbox mariadbd to fail (e.g. requesting loading plugins not available).

This commit causes devbox mariadbd (and mysqld) to only read from
$MYSQL_CONF (typically devbox.d/mariadb/my.cnf).

Additionally, wrap the client/admin binaries (mariadb, mariadb-admin,
mariadb-dump, mysqldump, mysql, mysqladmin) with --defaults-file and
--socket so they also ignore /etc/mysql and connect to the correct
socket.

Fixes #2904
---
 plugins/mariadb/flake.nix | 27 +++++++++++++++------------
 plugins/mariadb/my.cnf    | 19 +++++++++++++++----
 plugins/mysql/flake.nix   | 13 +++++++++++--
 plugins/mysql/my.cnf      | 19 ++++++++++++++++---
 4 files changed, 57 insertions(+), 21 deletions(-)

diff --git a/plugins/mariadb/flake.nix b/plugins/mariadb/flake.nix
index 2ca97fd210f..d337a2bcee5 100644
--- a/plugins/mariadb/flake.nix
+++ b/plugins/mariadb/flake.nix
@@ -14,27 +14,30 @@
         nativeBuildInputs = [ nixpkgs.legacyPackages.{{.System}}.makeWrapper];
         postBuild = ''
 
-          wrapProgram $out/bin/mysqld \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
-
           wrapProgram $out/bin/mariadbd \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
-
-          wrapProgram $out/bin/mysqld_safe \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
 
           if [ -f $out/bin/mariadbd-safe ]; then
             wrapProgram $out/bin/mariadbd_safe \
-              --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+              --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
           fi
 
-          wrapProgram "$out/bin/mysql_install_db" \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
-
           if [ -f $out/bin/mariadb-install-db ]; then
             wrapProgram "$out/bin/mariadb-install-db" \
-              --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
+              --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
           fi
+
+          wrapProgram $out/bin/mariadb-admin \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mariadb \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mariadb-dump \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          # Don't wrap 'mysql' or any mysql binaries, as they are correctly left as symlinks
+
         '';
       };
     in{
diff --git a/plugins/mariadb/my.cnf b/plugins/mariadb/my.cnf
index fbe15dd80be..83716567cdf 100644
--- a/plugins/mariadb/my.cnf
+++ b/plugins/mariadb/my.cnf
@@ -1,6 +1,17 @@
-# MySQL configuration file
+# MySQL configuration file for Devbox MariaDB
+#
+# This file is read via --defaults-file, which means ONLY this config file
+# is read (system configs in /etc/ are skipped).
+#
+# Runtime paths (datadir, socket, pid-file, basedir) are set by the wrapper
+# script via environment variables and cannot be overridden here:
+#
+#   MYSQL_DATADIR  = --datadir   (default: .devbox/virtenv/mariadb/data)
+#   MYSQL_UNIX_PORT = --socket   (default: .devbox/virtenv/mariadb/run/mysql.sock)
+#   MYSQL_PID_FILE = --pid-file  (default: .devbox/virtenv/mariadb/run/mysql.pid)
 
 [mariadbd]
-# Change this port if 3306 is already used
-#port = 3306
-log_error=mysql.log
+
+# The TCP/IP port the server listens on.
+# Change this if 3306 is already in use.
+# port = 3306
diff --git a/plugins/mysql/flake.nix b/plugins/mysql/flake.nix
index 74787d4497e..333e77bcb7a 100644
--- a/plugins/mysql/flake.nix
+++ b/plugins/mysql/flake.nix
@@ -15,10 +15,19 @@
         postBuild = ''
 
           wrapProgram $out/bin/mysqld \
-            --add-flags '--basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
 
           wrapProgram $out/bin/mysqld_safe \
-            --add-flags '--basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysqladmin \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysql \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysqldump \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
         '';
       };
     in{
diff --git a/plugins/mysql/my.cnf b/plugins/mysql/my.cnf
index a749c470084..43bbd19478e 100644
--- a/plugins/mysql/my.cnf
+++ b/plugins/mysql/my.cnf
@@ -1,6 +1,19 @@
-# MySQL configuration file
+# MySQL configuration file for Devbox MySQL
+#
+# This file is read via --defaults-file, which means ONLY this config file
+# is read (system configs in /etc/ are skipped).
+#
+# Runtime paths (datadir, socket, pid-file, basedir) are set by the wrapper
+# script via environment variables and cannot be overridden here:
+#
+#   MYSQL_DATADIR  = --datadir   (default: .devbox/virtenv/mysql/data)
+#   MYSQL_UNIX_PORT = --socket   (default: .devbox/virtenv/mysql/run/mysql.sock)
+#   MYSQL_PID_FILE = --pid-file  (default: .devbox/virtenv/mysql/run/mysql.pid)
 
-# [mysqld]
+[mysqld]
+# Uncomment to disable binary logging.
 # skip-log-bin
-# Change this port if 3306 is already used
+#
+# The TCP/IP port the server listens on.
+# Change this if 3306 is already in use.
 #port = 3306