From 6f5d20fe0cbd2d6769120f8bc5886065d4c71050 Mon Sep 17 00:00:00 2001
From: Leona Maroni <lm@flyingcircus.io>
Date: Wed, 24 Jun 2026 10:56:49 +0200
Subject: [PATCH 1/2] nixos/mysql: fix initalScript option after security fix

services.mysql.initalScript runs with the root@localhost mysql user.
This seems consistent with the other invocations that run in the first
startup of mysql.
After the security fix, the mysql command executing the initial script
was broken as it tried to connect to root@localhost while being the mysql
system user.

We could instead use the mysql@localhost mysql user, but this would be
inconsistent with the other invocations.

Co-Authored-By: osnyx <os@flyingcircus.io>
---
 nixos/modules/services/databases/mysql.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index c31b6b7ebbf8..cfd7c8c76af3 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -662,11 +662,6 @@ in
                 ) | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
-              # Secure root@localhost for MySQL/Percona on first initialization
-              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
-                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
-              ''}
-
               ${lib.optionalString (cfg.initialScript != null) ''
                 # Execute initial script
                 # using toString to avoid copying the file to nix store if given as path instead of string,
@@ -674,6 +669,11 @@ in
                 cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
+              # Secure root@localhost for MySQL/Percona on first initialization
+              ${lib.optionalString (cfg.secureSuperUserByDefault && !isMariaDB) ''
+                echo "ALTER USER root@localhost IDENTIFIED WITH auth_socket;" | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
               rm ${cfg.dataDir}/mysql_init
           fi
 

From 3f3a5310c82eaf953642933d8ae435364555e57f Mon Sep 17 00:00:00 2001
From: Leona Maroni <lm@flyingcircus.io>
Date: Wed, 24 Jun 2026 11:02:55 +0200
Subject: [PATCH 2/2] mysql84: add nixosTests.mysql.mysql84 to passthru.tests

Co-Authored-By: osnyx <os@flyingcircus.io>
---
 pkgs/by-name/my/mysql84/package.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/my/mysql84/package.nix b/pkgs/by-name/my/mysql84/package.nix
index 129355bfb336..7f5b682121a5 100644
--- a/pkgs/by-name/my/mysql84/package.nix
+++ b/pkgs/by-name/my/mysql84/package.nix
@@ -112,10 +112,14 @@ stdenv.mkDerivation (finalAttrs: {
     connector-c = finalAttrs.finalPackage;
     server = finalAttrs.finalPackage;
     mysqlVersion = lib.versions.majorMinor finalAttrs.version;
-    tests.mysql-secure-root-by-default =
-      nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
-    tests.mysql-root-can-be-kept-insecure =
-      nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+    tests = {
+      mysql =
+        nixosTests.mysql."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+      mysql-secure-root-by-default =
+        nixosTests.mysql-secure-root.secure-by-default."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+      mysql-root-can-be-kept-insecure =
+        nixosTests.mysql-secure-root.can-be-insecure."mysql${lib.versions.major finalAttrs.version}${lib.versions.minor finalAttrs.version}";
+    };
   };
 
   meta = {