Databases
One database, one user, granted on that database only, from localhost. Root stays on the Unix socket and no credential is shared between sites.
Creating a database
klyrn db list
klyrn db create acme acme_wp
klyrn db user-add 3 acme_wp2 # a second user on database 3
klyrn db password 5 # reset a user's password
klyrn db user-delete 5
klyrn db delete 3
klyrn site create makes a WordPress site's database and user for you. Use
these commands for extra databases or extra users.
A name that does not match the allowed pattern is refused. So is one starting with
-, which the MariaDB client would read as one of its own options.
Exporting
klyrn db export acme_wp # run the dump
klyrn db exports # what is available and when it expires
An export is a job. It runs
mariadb-dump --single-transaction --quick --routines --triggers --events
and gzips the result. The file is written to
/var/lib/klyrn/<state>/db-exports/<token>/ as
root:klyrn mode 0750.
An export never lands under a document root. Nothing under that directory is served by nginx, so a dump cannot become a URL on the customer's website.
The download link contains a 32-character token, but the token is not authority. The download still checks that the signed-in principal owns the account. A different tenant holding the URL gets the same answer as a missing export: "that export is not here".
Exports are kept for 24 hours and pruned when a new one is created or the list is read. The job refuses to start if free space under the state directory is below 512 MB, and says to remove old backups or exports first.
Importing
klyrn db import acme_wp /root/dump.sql
klyrn db import acme_wp /root/dump.sql.gz
In the panel, upload a .sql or .sql.gz. The file is staged
outside any document root and applied as a job. A gzip is decompressed with a ceiling
of the lower of 8 GB and the free disk minus a 256 MB margin. Above the
ceiling the job stops before writing anything and says to import from the command line.
The last step counts the tables and fails the job if the count is zero.
An import is not transactional. A dump that fails part way leaves what it already wrote. The error names the database and states that it holds whatever the dump applied before the error.
The uploaded file is removed whenever the job stops, successfully or not.
phpMyAdmin
phpMyAdmin answers at /phpmyadmin on every site. Opened from the panel, it
signs in as the database user through a short-lived link, so nobody types a database
password into it.