From 362be2d4b697464d1190ccee9c18f8309fb137eb Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Sun, 13 Sep 2026 08:37:19 -0400 Subject: [PATCH 1/2] fix: name SUPER as the only grant that lifts the trigger denial BINLOG ADMIN does not lift error 1419 on any MariaDB version, so the grant this page recommended first leaves the reader exactly where they started. Verified on 10.11.19, 11.3.2 and 11.8.9: only SUPER or the global flag works. MySQL stopped requiring SUPER for trigger DDL in 8.0.22, so scope the section to MariaDB rather than sending MySQL 8 readers after a privilege they hold no need for. Verified on 8.0.46 and 8.4.11 with binary logging on. Co-Authored-By: Claude Opus 5 (1M context) --- docs/install/databases.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/install/databases.md b/docs/install/databases.md index 0c7f7d3f..38fe29c8 100644 --- a/docs/install/databases.md +++ b/docs/install/databases.md @@ -68,7 +68,7 @@ services: ## Binary logging and trigger privileges -RomM's migrations create triggers on the `roms` table. MariaDB and MySQL refuse trigger DDL when binary logging is enabled and the connecting user lacks `SUPER`, so the container aborts during startup with: +RomM's migrations create triggers on the `roms` table. MariaDB refuses trigger DDL when binary logging is enabled and the connecting user lacks `SUPER`, so the container aborts during startup with: ```text sqlalchemy.exc.OperationalError: (mariadb.OperationalError) You do not have the SUPER @@ -77,7 +77,7 @@ log_bin_trust_function_creators variable) ERROR: [RomM][init] Failed to run database migrations ``` -This mainly affects external or managed database servers, because binary logging is on by default on MySQL 8 and is commonly enabled on hardened or replicated MariaDB instances. The `mariadb:11` container from the reference Compose is not affected out of the box. +This mainly affects external or managed database servers, where binary logging is commonly enabled on hardened or replicated instances. The `mariadb:11` container from the reference Compose is not affected out of the box, and neither is MySQL 8.0.22 or newer, which no longer requires `SUPER` for trigger DDL. Both fixes below have to be applied by an admin or root database user rather than the RomM user. The quickest one sets the global flag, though it is lost when the database restarts: @@ -92,13 +92,14 @@ To make it survive a restart, add it under `[mysqld]` in the server's option fil log_bin_trust_function_creators = 1 ``` -Alternatively, grant the privilege to the RomM user itself: +Alternatively, grant `SUPER` to the RomM user itself: ```sql -GRANT BINLOG ADMIN ON *.* TO 'romm-user'@'%'; -- MariaDB 10.5+ -GRANT SUPER ON *.* TO 'romm-user'@'%'; -- older MariaDB, or MySQL +GRANT SUPER ON *.* TO 'romm-user'@'%'; ``` +`SUPER` is the only grant that lifts this check. The finer-grained privileges MariaDB split out of it in 10.5, `BINLOG ADMIN` included, leave the denial in place. + Restart RomM once the change is in place. A migration that failed this way is safe to re-run, so it picks up from wherever it stopped and completes. ## PostgreSQL From 2c7819c41f902ae360f041027fa83ae62a9565a6 Mon Sep 17 00:00:00 2001 From: Georges-Antoine Assi Date: Sun, 13 Sep 2026 08:44:45 -0400 Subject: [PATCH 2/2] fix: drop the note about the privileges that do not lift the check Co-Authored-By: Claude Opus 5 (1M context) --- docs/install/databases.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/install/databases.md b/docs/install/databases.md index 38fe29c8..67bdac3e 100644 --- a/docs/install/databases.md +++ b/docs/install/databases.md @@ -98,8 +98,6 @@ Alternatively, grant `SUPER` to the RomM user itself: GRANT SUPER ON *.* TO 'romm-user'@'%'; ``` -`SUPER` is the only grant that lifts this check. The finer-grained privileges MariaDB split out of it in 10.5, `BINLOG ADMIN` included, leave the denial in place. - Restart RomM once the change is in place. A migration that failed this way is safe to re-run, so it picks up from wherever it stopped and completes. ## PostgreSQL