MySQL single-server installation (production-ready)

Installs a single MySQL 8.4 LTS (or 8.0) server from the official repository from scratch, ready for production: separate directories for data, binlog and logs, a my.cnf calculated from RAM/CPU/disk type, GTID and binlog retention, the slow query log, SELinux/AppArmor, restricted root access and an application user. You end up with a verified instance that already has its first backup; the replication, InnoDB Cluster, backup and security guides build on this installation.

Topology: 1 server

Before you start

• The server runs a supported operating system and is up to date; time zone and NTP (chrony) are correct.
• RAM and CPU match the values in the form (my.cnf is calculated from them: buffer pool … MB).
• A disk/LV is mounted for …, … and … (persistent in fstab), the file system is XFS or ext4, and there is enough free space. Binlogs will be kept for … days; reserve at least … times your daily write volume.
• Hostname … is set and resolves to its own IP; the application network (…) is reachable.
• The server can reach repo.mysql.com over HTTPS, or an internal mirror is configured.
• Port … (and the X Protocol port …) is free.
• Neither MariaDB nor the operating system's own MySQL build is installed on the server (it conflicts with the official MySQL).
• The application user's password is ready… (on the RHEL family validate_password is enabled by default: at least 8 characters, upper/lower case, a digit and a special character)…. The password is prompted during the installation without being echoed; it must not contain ' or \.
• You are logged in with root or sudo privileges; the maintenance window and a fallback plan (server snapshot) are ready.

Phases of the guide

• Operating system preparation — Hostname and system update · Kernel settings (sysctl) · Apply the sysctl settings · Disable Transparent Huge Pages
• Installing the MySQL software — Disable the operating system's MySQL module · Add the official MySQL repository · Install the MySQL server software · Define the official MySQL APT repository · Install the MySQL server software
• Directories and configuration — Create the directories and set ownership · Write my.cnf · Raise the open files limit (systemd) · Reload the systemd configuration · Define the SELinux labels · Register the new directories with AppArmor …
• Starting the service — Enable and start the service · Clean up the old default data directory
• Root access and security — Find the temporary root password · Switch root to auth_socket · Set the root password · Store the root login details (mysql_config_editor) · Remove the default accounts and the test database · Password policy component (validate_password)
• Application database and user — Create the database and the application user
• Network access — Open the port in the firewall
• Verification — Check that the settings are applied · Check the error log · Remote connection test
• Post-installation — Take the first logical backup · Connect monitoring