Installation of External MariaDB server

In /etc/default/grub add `transparent_hugepage=never` to the GRUB_CMDLINE_LINUX_DEFAULT variable.

GRUB_CMDLINE_LINUX_DEFAULT="transparent_hugepage=never"

Run `update-grub` and reboot

In /etc/default/grub add `transparent_hugepage=never` to the end of the GRUB_CMDLINE_LINUX variable.

Run `grub2-mkconfig -o /boot/grub2/grub.cfg` and reboot.

After rebooting the system, verify that transparent_hugepage is disabled.

$ cat /sys/kernel/mm/transparent_hugepage/enabled
always madvise [never]

# Add the following to /etc/yum.repos.d/mariadb.repo
[mariadb]
name = MariaDB
baseurl = http://yum.mariadb.org/10.3/centos7-amd64
gpgkey=https://yum.mariadb.org/RPM-GPG-KEY-MariaDB
gpgcheck=1

$ yum install MariaDB-server MariaDB-client MariaDB-tokudb-engine
$ systemctl enable --now mariadb

MariaDB should be started automatically on installation, and TokuDB should be enabled. Check this by running `show engines;` in the MySQL cli and verify that TokuDB has YES next to it.

To import time zone tables, run the following command.

$ mysql_tzinfo_to_sql /usr/share/zoneinfo | mysql -u root mysql

We're going to set up a self signed certificate for this server for simplicity, this is easier to manage and doesn't rely on any CA infrastructure. The certificate (but not the private key) is needed during the Doppler onPrem database configuration, so keep a copy of it.

In this example, the database server has a static IP address of "192.168.4.100" so we use this at the Common Name. You can alternatively provide a hostname here, but this will require Doppler onPrem to be configured with DNS.

Generate a self signed certificate:

$ mkdir -p /etc/mysql/ssl
$ openssl req -subj '/CN=192.168.4.100' -new -newkey rsa:2048 -sha256 -days 7300 -nodes -x509 -keyout /etc/mysql/ssl/server.key -out /etc/mysql/ssl/server.crt
$ chmod 640 /etc/mysql/ssl/server.key
$ chown root.mysql /etc/mysql/ssl/server.key

Configure MariaDB to enable TLS and use the certificate by adding the the following to /etc/mysql/mariadb.conf.d/tls.cnf (Debian) or /etc/my.cnf.d/tls.cnf (RHEL/CentOS)

[mysqld]
ssl
ssl-cert=/etc/mysql/ssl/server.crt
ssl-key=/etc/mysql/ssl/server.key

Restart MariaDB and verify that TLS has been enabled

$ systemctl restart mariadb.service

Verify that TLS has been enabled by checking that 'have_ssl" is set to YES

# mysql -p -e "show variables like '%ssl%'"
Enter password:
+---------------------+-----------------------------+
| Variable_name       | Value                       |
+---------------------+-----------------------------+
| have_openssl        | YES                         |
| have_ssl            | YES                         |
| ssl_ca              |                             |
| ssl_capath          |                             |
| ssl_cert            | /etc/mysql/ssl/server.crt   |
| ssl_cipher          |                             |
| ssl_crl             |                             |
| ssl_crlpath         |                             |
| ssl_key             | /etc/mysql/ssl/server.key   |
| version_ssl_library | OpenSSL 1.1.0j  20 Nov 2018 |
+---------------------+-----------------------------+

NOTE: After you have created a MySQL user with 'require ssl' parameters, you can verify that external clients can connect using TLS by create the following ~/.my.cnf file.

[client]
user=doppler
password=changeme
host=192.168.4.100 
ssl-ca=~/server.crt
ssl-verify-server-cert

And executing:

$ mysql -e "\s" | grep SSL
SSL:      Cipher in use is DHE-RSA-AES256-SHA

NOTE: Keep a copy of the `server.crt` file as you need it during the Doppler onPrem installation.

Run the `mysql_secure_installation` script:

• Change the root password, unless you did so previously.
• Enable network traffic (listen on all interfaces)
• Disable anonymous users
• Remove test tables

In the example below, 192.168.4.50 is the IPv4 address of the Dopper onPrem system, and 'changeme' will be used the password for the database user. Please modify these variables.

MariaDB [(none)]> create database doppler;
Query OK, 1 row affected (0.001 sec)

MariaDB [(none)]> grant all privileges on doppler.* to doppler@192.168.4.50 identified by 'changeme' require ssl;
Query OK, 0 rows affected (0.000 sec)

Use a random source to create secure passwords, preferably 16 characters or longer. Please make a secure note of this password, as it is needed during the the Doppler onPrem installation.

# The following shell command can be used to generate a secure password:
$ tr -dc A-Za-z0-9 < /dev/urandom | head -c32; echo

The schema for the database is installed automatically during the Doppler onPrem installation process.

MariaDB uses port 3306, the Doppler onPrem server needs to be able to connect to this port on the database server. We recommend that the firewall on the machine is configured to only allow access incoming connections from the Doppler onPrem server.