From ada57b946936330cac2681bae7b86a530fc75d77 Mon Sep 17 00:00:00 2001
From: Jeff Turner <jeff@redradishtech.com>
Date: Thu, 30 Jul 2026 17:10:23 +1000
Subject: [PATCH 1/2] fix(mariadb plugin): mariadbd-safe and mariadb-install-db
 had no devbox wrapper

The intention of mariadb/flake.nix is to invoke these commands with Devbox-specific flags:

mariadb-safe --defaults-file=$MYSQL_CONF --basedir=$out --datadir=$MYSQL_DATADIR --pid-file=$MYSQL_PID_FILE
mariadb-install-db --basedir=$out --datadir=$MYSQL_DATADIR --pid-file=$MYSQL_PID_FILE --basedir=$MYSQL_BASEDIR

but that was not happening - the upstream Nix versions were being used with no extra flags.

Notably this caused mariadb-install-db to inherit settings from /etc/mysql. If e.g.
/etc/mysql/mariadb.conf.d/50-server.cnf sets 'user=mysql', mariadb-install-db fails.

A second, hidden-till-now bug is that flake.nix wrapped `mariadb_install_db` and `mariadbd_safe`, when the correct
upstream scripts are `mariadb-install-db` and `mariadbd-safe`.
---
 plugins/mariadb/flake.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/plugins/mariadb/flake.nix b/plugins/mariadb/flake.nix
index 1ac539e6357..6b38774af97 100644
--- a/plugins/mariadb/flake.nix
+++ b/plugins/mariadb/flake.nix
@@ -23,16 +23,17 @@
           wrapProgram $out/bin/mysqld_safe \
             --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
 
-          if [-f $out/bin/mariadbd-safe]; then
-            wrapProgram $out/bin/mariadbd_safe \
+          if [ -f $out/bin/mariadbd-safe ]; then
+            wrapProgram $out/bin/mariadbd-safe \
               --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
           fi
 
           wrapProgram "$out/bin/mysql_install_db" \
             --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
 
-          if [-f $out/bin/mariadb-install-db]; then
-            wrapProgram "$out/bin/mariadb_install_db" \
+          if [ -f $out/bin/mariadb-install-db ]; then
+            # Note: no --defaults-file= as mariadb-install-db wraps mariadbd which already has it
+            wrapProgram "$out/bin/mariadb-install-db" \
               --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
           fi
         '';

From 48ef009aa69114551fc2c93d0cd40dc1791799cd Mon Sep 17 00:00:00 2001
From: Jeff Turner <jeff@redradishtech.com>
Date: Mon, 6 Jul 2026 18:01:14 +1000
Subject: [PATCH 2/2] fix(mariadb,mysql plugin): ignore /etc/mysql config
 files, for better isolation (#2904)

By default, mariadbd reads /etc/mysql/mariadb.cnf, and if the system has
another version of MariaDB installed, those config files can cause the
Devbox mariadbd to fail (e.g. requesting loading plugins not available).

This commit causes devbox mariadbd (and mysqld) to only read from
$MYSQL_CONF (typically devbox.d/mariadb/my.cnf).

Additionally, wrap the client/admin binaries (mariadb, mariadb-admin,
mariadb-dump, mysqldump, mysql, mysqladmin) with --defaults-file and
--socket so they also ignore /etc/mysql and connect to the correct
socket.

Fixes #2904
---
 plugins/mariadb/flake.nix | 29 +++++++++++++++++++----------
 plugins/mariadb/my.cnf    | 19 +++++++++++++++----
 plugins/mysql/flake.nix   | 13 +++++++++++--
 plugins/mysql/my.cnf      | 19 ++++++++++++++++---
 4 files changed, 61 insertions(+), 19 deletions(-)

diff --git a/plugins/mariadb/flake.nix b/plugins/mariadb/flake.nix
index 6b38774af97..4433960cf5f 100644
--- a/plugins/mariadb/flake.nix
+++ b/plugins/mariadb/flake.nix
@@ -14,28 +14,37 @@
         nativeBuildInputs = [ nixpkgs.legacyPackages.{{.System}}.makeWrapper];
         postBuild = ''
 
-          wrapProgram $out/bin/mysqld \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
-
           wrapProgram $out/bin/mariadbd \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
-
-          wrapProgram $out/bin/mysqld_safe \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
 
           if [ -f $out/bin/mariadbd-safe ]; then
             wrapProgram $out/bin/mariadbd-safe \
-              --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+              --add-flags '--defaults-file=''$MYSQL_CONF --basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
           fi
 
-          wrapProgram "$out/bin/mysql_install_db" \
-            --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
+          # my_print_defaults needs --defaults-file too, otherwise it
+          # falls back to /etc/mysql. mariadb-install-db calls it via
+          # $print_defaults, not via mariadbd's wrapper.
+          wrapProgram $out/bin/my_print_defaults \
+            --add-flags '--defaults-file=''$MYSQL_CONF';
 
           if [ -f $out/bin/mariadb-install-db ]; then
             # Note: no --defaults-file= as mariadb-install-db wraps mariadbd which already has it
             wrapProgram "$out/bin/mariadb-install-db" \
               --add-flags '--basedir=$out --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --basedir=''$MYSQL_BASEDIR';
           fi
+
+          wrapProgram $out/bin/mariadb-admin \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mariadb \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mariadb-dump \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          # Don't wrap 'mysql' or any mysql binaries, as they are correctly left as symlinks
+
         '';
       };
     in{
diff --git a/plugins/mariadb/my.cnf b/plugins/mariadb/my.cnf
index fbe15dd80be..83716567cdf 100644
--- a/plugins/mariadb/my.cnf
+++ b/plugins/mariadb/my.cnf
@@ -1,6 +1,17 @@
-# MySQL configuration file
+# MySQL configuration file for Devbox MariaDB
+#
+# This file is read via --defaults-file, which means ONLY this config file
+# is read (system configs in /etc/ are skipped).
+#
+# Runtime paths (datadir, socket, pid-file, basedir) are set by the wrapper
+# script via environment variables and cannot be overridden here:
+#
+#   MYSQL_DATADIR  = --datadir   (default: .devbox/virtenv/mariadb/data)
+#   MYSQL_UNIX_PORT = --socket   (default: .devbox/virtenv/mariadb/run/mysql.sock)
+#   MYSQL_PID_FILE = --pid-file  (default: .devbox/virtenv/mariadb/run/mysql.pid)
 
 [mariadbd]
-# Change this port if 3306 is already used
-#port = 3306
-log_error=mysql.log
+
+# The TCP/IP port the server listens on.
+# Change this if 3306 is already in use.
+# port = 3306
diff --git a/plugins/mysql/flake.nix b/plugins/mysql/flake.nix
index 74787d4497e..333e77bcb7a 100644
--- a/plugins/mysql/flake.nix
+++ b/plugins/mysql/flake.nix
@@ -15,10 +15,19 @@
         postBuild = ''
 
           wrapProgram $out/bin/mysqld \
-            --add-flags '--basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
 
           wrapProgram $out/bin/mysqld_safe \
-            --add-flags '--basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+            --add-flags '--defaults-file=''$MYSQL_CONF --basedir=''$MYSQL_BASEDIR --datadir=''$MYSQL_DATADIR --pid-file=''$MYSQL_PID_FILE --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysqladmin \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysql \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
+
+          wrapProgram $out/bin/mysqldump \
+            --add-flags '--defaults-file=''$MYSQL_CONF --socket=''$MYSQL_UNIX_PORT';
         '';
       };
     in{
diff --git a/plugins/mysql/my.cnf b/plugins/mysql/my.cnf
index a749c470084..43bbd19478e 100644
--- a/plugins/mysql/my.cnf
+++ b/plugins/mysql/my.cnf
@@ -1,6 +1,19 @@
-# MySQL configuration file
+# MySQL configuration file for Devbox MySQL
+#
+# This file is read via --defaults-file, which means ONLY this config file
+# is read (system configs in /etc/ are skipped).
+#
+# Runtime paths (datadir, socket, pid-file, basedir) are set by the wrapper
+# script via environment variables and cannot be overridden here:
+#
+#   MYSQL_DATADIR  = --datadir   (default: .devbox/virtenv/mysql/data)
+#   MYSQL_UNIX_PORT = --socket   (default: .devbox/virtenv/mysql/run/mysql.sock)
+#   MYSQL_PID_FILE = --pid-file  (default: .devbox/virtenv/mysql/run/mysql.pid)
 
-# [mysqld]
+[mysqld]
+# Uncomment to disable binary logging.
 # skip-log-bin
-# Change this port if 3306 is already used
+#
+# The TCP/IP port the server listens on.
+# Change this if 3306 is already in use.
 #port = 3306