feat(db): add replication for pdnsmaster database

db/51-server.cnf

@@ -0,0 +1,11 @@
+[mysqld]
+ssl-ca   = /etc/ssl/private/sca.server2.crt
+ssl-cert = /etc/ssl/private/WILDCARD.dev.desec.io.crt
+ssl-key  = /etc/ssl/private/WILDCARD.dev.desec.io.key
+
+server-id               = 1
+log_bin                 = /var/log/mysql/mysql-bin.log
+binlog_format=ROW
+log-basename=nsmaster
+binlog-do-db=pdnsmaster
+expire_logs_days        = 10

db/Dockerfile

@@ -1,4 +1,8 @@
 FROM mariadb
 
-COPY *.sql /docker-entrypoint-initdb.d/
+# mountable ssl certificate and key directory
+# (we don't want any keys in this repository)
+VOLUME /etc/ssl/private/
 
+COPY initdb.d/*.sql /docker-entrypoint-initdb.d/
+COPY ./51-server.cnf /etc/mysql/conf.d/51-server.cnf

db/00-init.sql → db/initdb.d/00-init.sql

@@ -1,14 +1,24 @@
+-- deSEC user and domain database
 CREATE DATABASE desec;
 CREATE USER desec IDENTIFIED BY 'test123';
 GRANT SELECT, INSERT, UPDATE, DELETE, REFERENCES, INDEX, CREATE, ALTER, DROP ON desec.* TO desec;
 
+-- nslord database, including devadmin access
 CREATE DATABASE pdnslord;
 CREATE USER pdnslord IDENTIFIED BY '123test';
 GRANT SELECT, INSERT, UPDATE, DELETE ON pdnslord.* TO pdnslord;
 
+CREATE USER poweradmin IDENTIFIED BY '123passphrase';
+GRANT SELECT, INSERT, UPDATE, DELETE ON pdnslord.* TO poweradmin;
+
+-- nsmaster database
 CREATE DATABASE pdnsmaster;
 CREATE USER pdnsmaster IDENTIFIED BY '456test';
 GRANT SELECT, INSERT, UPDATE, DELETE ON pdnsmaster.* TO pdnsmaster;
 
-CREATE USER poweradmin IDENTIFIED BY '123passphrase';
-GRANT SELECT, INSERT, UPDATE, DELETE ON pdnslord.* TO poweradmin;
+-- replication
+CREATE USER ns1@'%' IDENTIFIED BY "test234";
+GRANT REPLICATION SLAVE ON *.* TO ns1@'%' REQUIRE SUBJECT '/CN=ns1.desec.io' AND ISSUER "/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3";
+
+CREATE USER ns2@'%' IDENTIFIED BY "test345";
+GRANT REPLICATION SLAVE ON *.* TO ns2@'%' REQUIRE SUBJECT '/CN=ns2.desec.io' AND ISSUER "/C=US/O=Let's Encrypt/CN=Let's Encrypt Authority X3";

docker-compose.yml

@@ -22,6 +22,10 @@ services:
 
   db:
     build: db
+    ports:
+    - "3306:3306"
+    volumes:
+    - ./desec-certs/dev.desec.io:/etc/ssl/private
     environment:
     - MYSQL_ROOT_PASSWORD=test123
     networks: