---
title: MariaDB
url: "/docs/databases/mariadb/"
canonical_url: https://docs.blossom88.com/docs/databases/mariadb/
markdown_url: https://docs.blossom88.com/docs/databases/mariadb.md
summary: MariaDB databases with recovery backups, public access over TLS, and a stable
  private endpoint
categories:
- data
- databases
- mariadb
---

# MariaDB

Blossom runs MariaDB 12 as a Database with a stable private endpoint,
generated credentials, encrypted recovery backups, and opt-in public access
over TLS.

## Dedicated Node And Storage

A Dedicated Database is one MariaDB node on its own Server, with its data on
separate storage that follows the node. You choose the region and the storage
size in GB; Blossom provisions the Server, attaches the storage, starts
MariaDB only from that storage, and reports each step in Activity. Storage
grows online while MariaDB keeps serving and never shrinks. When a Server
fails, Blossom confirms the failure, reattaches the same storage to a
replacement Server, and starts MariaDB from the same data behind the same
endpoint.

    blossom database_instance:init

writes database_instance.yml; set `engine: mariadb`:

```yaml
database_instance:
  name: production
  engine: postgres # postgres, mysql, mariadb, or mongodb
  availability: shared # the default where the Location has Data Capacity; or dedicated, its own Server
  storage_gib: 20 # 10 to 1000 GB; grows online later, never shrinks
  # ...
```

    blossom database_instance:create --data database_instance.yml --follow

## Recovery Backups

Select Backup Storage to enable encrypted logical recovery backups. Each
backup is a transaction-consistent `mariadb-dump` of the database, encrypted
before it leaves the node. Blossom creates the initial backup automatically,
and a completed backup restores an independent Database while the source
lives or after it is deleted. MariaDB backups restore to the backup's own
consistency point; point-in-time recovery is a PostgreSQL feature.

## Public Access

A Database is private by default. Turning public access on gives it one public
name that answers only over TLS, with a certificate Blossom issues and renews,
and only to the source addresses you list. MariaDB terminates the TLS itself
and refuses plaintext connections. Private links, credentials, and data do
not change, and turning public access off withdraws the name, the network
path, and the certificate.

Public access needs Dedicated availability. A Shared Database stays
private to its linked Environments; choose Dedicated when it must be reachable
from the Internet.

    blossom database_instance:update --id database_instance-100 --data '{"database_instance":{"public_access":true,"public_allowed_sources":["203.0.113.4/32"]}}'
    blossom database_instance:credentials --id database_instance-100

Connect with a client that verifies the server certificate, such as
`mariadb --ssl-verify-server-cert`. The password is shown only by
`database_instance:credentials` on an explicit request.

## Connect

Create an Environment Link with `target_type: DatabaseInstance`. Blossom supplies a
private `DATABASE_URL` containing the generated credentials, endpoint, port,
and database name to every Service in the Environment. Applications should
use that URL rather than a provider address or Container name.

The current MariaDB scope is one primary. Read replicas, standbys, automatic
failover, and database monitoring are not available for MariaDB.

- [Databases](/docs/databases/)
- [Database And Cache Security](/docs/databases/security/)
- [MariaDB documentation](https://mariadb.com/docs/)