MariaDB: Persistent Database Infrastructure

The Architecture Rationale

A robust VM ecosystem requires a reliable, performant, and accessible database layer. I opted for a dedicated MariaDB LXC instance rather than relying on bundled databases inside individual containers. This centralized approach allows for:

1. Simplified Backups: One point of truth for data recovery.
2. Resource Allocation: Fine-tuned memory and CPU limits specific to database workloads.
3. Connectivity: Centralized access for multiple applications (like n8n, CloudBeaver, or web apps) without managing multiple database instances.

Phase 1: Installation & Hardening

The server is deployed via Proxmox Helper-Scripts. After the initial deployment, security and network accessibility are prioritized.

SQL Authentication Hardening

By default, MariaDB often restricts root access to the local socket. To allow the LXC to act as a centralized database server for other containers, I perform an explicit user override:

SQL

-- Updating root permissions for both local socket and network-wide access
ALTER USER 'root'@'localhost' IDENTIFIED VIA mysql_native_password USING PASSWORD('YOUR_SECURE_PASSWORD');
GRANT ALL PRIVILEGES ON *.* TO 'root'@'localhost' IDENTIFIED BY 'YOUR_SECURE_PASSWORD' WITH GRANT OPTION;

-- Enabling remote access for the LXC host IP
CREATE USER 'root'@'%' IDENTIFIED VIA mysql_native_password USING PASSWORD('YOUR_SECURE_PASSWORD');
GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'YOUR_SECURE_PASSWORD' WITH GRANT OPTION;
FLUSH PRIVILEGES;

Phase 2: Network Exposure

To allow the application LXCs (like n8n or Dokploy apps) to communicate with the database, we must modify the bind-address configuration.

For Debian-based LXCs:

Edit /etc/mysql/mariadb.conf.d/50-server.cnf and modify the binding:

• Uncomment bind-address
• Set to 0.0.0.0 (to listen on all interfaces)
• Restart the service: systemctl restart mariadb

For Alpine-based LXCs:

Edit /etc/my.cnf.d/mariadb-server.cnf:

• Uncomment bind-address and set to 0.0.0.0
• Crucial: Comment out the skip-networking entry to ensure external packets are processed.
• Restart the service: rc-service mariadb restart

Phase 3: Operational Security

• Network Isolation: While the database is bound to 0.0.0.0, it is logically protected by the Proxmox Firewall. I restrict ingress to this LXC specifically to the internal IP range of my application network (192.168.100.x).
• Performance Tuning: Because the LXC is dedicated to MariaDB, I can independently scale the memory and CPU limits in Proxmox if a specific workflow (like a massive n8n sync) increases query load, without risking the stability of my other containers.

Evaluation: Centralized vs. Embedded

Approach	Rationale
Centralized MariaDB LXC	Selected. Higher efficiency, easier backup strategy, and consistent performance.
Embedded Databases	Rejected. Leads to “database sprawl,” harder backup management, and inefficient resource utilization.