This guide covers connecting self-hosted MySQL or MariaDB to Airlock via Database Service.

Prerequisites

  • A MySQL or MariaDB instance.
  • A host for Database Service.
  • Access to airctl.

Step 1. Join token

airctl tokens add --type=db --format=text > /tmp/token

Step 2. Certificates for mTLS

airctl auth sign --format=db --host=db.example.com --out=server --ttl=2190h

Copy server.cas, server.crt, server.key to the MySQL/MariaDB host.

Step 3. Configure MySQL

In mysql.cnf:

[mysqld]
require_secure_transport=ON
ssl-ca=/path/to/server.cas
ssl-cert=/path/to/server.crt
ssl-key=/path/to/server.key

Step 4. Configure MariaDB

In mysql.cnf:

[mariadb]
require_secure_transport=ON
ssl-ca=/path/to/server.cas
ssl-cert=/path/to/server.crt
ssl-key=/path/to/server.key

Database user

Create a user with certificate authentication:

CREATE USER 'alice'@'%' REQUIRE SUBJECT '/CN=alice';
GRANT ALL ON `mydb`.* TO 'alice'@'%';

For an existing user:

ALTER USER 'alice'@'%' REQUIRE SUBJECT '/CN=alice';

Airlock authenticates users by certificate; a password is not used for such accounts.

Step 5. Database Service and Airlock user

airctl users add --roles=access,db alice

sudo airlock db configure create \
  --token=/tmp/token \
  --name=example-mysql \
  --proxy=airlock.example.com:443 \
  --protocol=mysql \
  --uri=mysql.example.com:3306 \
  --output file:///etc/airlock.yaml

sudo systemctl enable --now airlock

Step 6. Connect

airsh login --proxy=airlock.example.com --user=alice
airsh db ls
airsh db connect --db-user=root --db-name=mysql example-mysql

The mysql or mariadb client must be in PATH.

airsh db logout example-mysql
←
Airlock Agents / PostgreSQL
Airlock Agents / OpenSearch / Elasticsearch
→