---
type: reference
title: MariaDB (RomM Backend)
description: "The MariaDB backend for RomM: quadlet unit, network alias, env-file secret handling, and the backup path."
tags: [mariadb, romm, dankserver]
timestamp: 2026-09-03T00:00:00Z
---

# MariaDB (RomM Backend)

MariaDB 11 provides the database backend for [[RomM]] on Dankserver. RomM's
current release requires MariaDB (or PostgreSQL) for its data store; this
deployment uses MariaDB.

**Host:** Dankserver — container name `romm-mariadb`, unit
`romm-mariadb.service` (user-manager quadlet from
`dankserver/romm/quadlet/romm-mariadb.container`).

## Facts (verified from the live unit)

| Item | Value |
|------|-------|
| Image | `docker.io/library/mariadb:11` |
| Port | 3306 — internal only; the unit publishes **no** port, so the DB is unreachable from the host network by construction |
| Network | `dankserver_appnet` with `alias=mariadb` — RomM reaches it via `DB_HOST=mariadb` |
| Database / user | `romm` / `romm` |
| Data volume | `/home/dank/Containers/romm/mariadb:/var/lib/mysql` |
| Secrets | supplied via `EnvironmentFile=/home/dank/Containers/romm/env` (mode 0600, host-local — `MARIADB_ROOT_PASSWORD` and friends never enter the repo) |

## Unit shape (as deployed)

```ini
[Unit]
Description=RomM mariadb container
After=network.target
Wants=romm-redis.service

[Container]
ContainerName=romm-mariadb
Image=docker.io/library/mariadb:11
Network=dankserver_appnet:alias=mariadb
EnvironmentFile=/home/dank/Containers/romm/env
Environment=MARIADB_DATABASE=romm
Environment=MARIADB_USER=romm
Volume=/home/dank/Containers/romm/mariadb:/var/lib/mysql
HealthCmd=mariadb-admin ping -h localhost
HealthInterval=30s
HealthTimeout=10s
HealthRetries=3

[Service]
Restart=always
RestartSec=5
```

`MARIADB_ROOT_PASSWORD` and `MARIADB_PASSWORD` are read from the env file at
container-create time (`EnvironmentFile=` appears in both `[Container]` and
`[Service]` so `podman generate systemd`-style regeneration keeps them). The
root password is a real secret — per repo secret rules it lives only in the
host-local env file, never in git.

## Boot order

RomM declares `Wants=romm-mariadb.service` + `After=romm-mariadb.service`, so
a cold boot starts the database first; the health ping (`mariadb-admin ping`)
is what marks the unit healthy for anything gating on it.

## Backup

Back up the volume directory periodically (stop-free: rsync of a quiet DB dir):

```bash
sudo rsync -a /home/dank/Containers/romm/mariadb /mnt/backup/romm-mariadb/
```

For consistency-critical dumps prefer `mariadb-dump` over file copy; the data
dir copy is only safe while RomM traffic is idle.

## See Also

- [[RomM]] — service that uses this database
- [[redis]] — the sibling cache/queue container on the same network