Homelab Galera/MaxScale Topology

MariaDB Galera Cluster (3 nodes)

Node	VM ID	Proxmox Host	IP	Hostname
db1	300	proxmox2 (10.0.20.20)	10.0.30.71	mariadb-01
db2	301	proxmox6 (10.0.20.60)	10.0.30.72	mariadb-02
db3	302	proxmox4 (10.0.20.40)	10.0.30.73	mariadb-03

MariaDB version: 11.4.10-MariaDB-deb12
Cluster name: mariadb-galera
Galera address: gcomm://10.0.30.71,10.0.30.72,10.0.30.73
DB size: ~18GB (homeassistant schema)
Note: PVE HA may migrate VMs. Always verify current placement with qm list on each node before operating.

MaxScale Proxy (1 active + VIP)

Node	VM ID	Proxmox Host	IP	Hostname	Status
maxscale-01	310	proxmox4 (10.0.20.40)	10.0.30.81	maxscale-01	Active
VIP	—	—	10.0.30.70	keepalived VIP	—

MaxScale version: 24.02.9
Services: rw-router (readwritesplit), ro-router (readconnroute)
Monitor: galera-monitor (galeramon)
Listener: rw-listener on port 3306
Note: A second MaxScale VM (VM501 "MaxScale1") exists on proxmox4 but is stopped. If a standby MaxScale is needed, check VM501's config. The VIP 10.0.30.70 is the authoritative entry point.

SSH Access

# MariaDB VMs (user: debian)
ssh -i ~/.ssh/id_ed25519_proxmox debian@10.0.30.71
ssh -i ~/.ssh/id_ed25519_proxmox debian@10.0.30.72
ssh -i ~/.ssh/id_ed25519_proxmox debian@10.0.30.73

# MaxScale VMs (user: debian)
ssh -i ~/.ssh/id_ed25519_proxmox debian@10.0.30.81

# Proxmox hosts (user: root)
ssh -i ~/.ssh/id_ed25519_proxmox root@10.0.20.10   # proxmox1 (HA VM host)
ssh -i ~/.ssh/id_ed25519_proxmox root@10.0.20.91   # n5pro

Credentials

All credentials stored in 1Password Vault "Hermes", item mariadb-galera-vm:

root-password — MySQL root (localhost only on each node, not accessible via MaxScale VIP)
maxscale-password — MaxScale MySQL user with SUPER privilege — can run SET GLOBAL via VIP (see Section 6)
mariabackup-password — Galera SST transfer auth
ha-recorder-password — HA Recorder MySQL user, has SELECT/INSERT/UPDATE on homeassistant DB
keepalived-auth-pass — keepalived VIP failover auth

Retrieve all fields:

op item get "mariadb-galera-vm" --vault "Hermes" --reveal --fields password,root-password,mariabackup-password,maxscale-password,ha-recorder-password

Note: The generic password field is empty. Use the named fields instead.

Firewall (UFW on MariaDB VMs)

Port 3306: ALLOW from 10.0.30.81, 10.0.30.82 (MaxScale only)
Ports 4567, 4568, 4444: ALLOW between Galera nodes (10.0.30.71-73)

Home Assistant

VM 106 on proxmox1 (10.0.20.10)
Internal: http://10.0.30.10:8123
External: https://homeassistant.familie-schoen.com
Config: /mnt/data/supervisor/homeassistant/configuration.yaml
Recorder DB URL: mysql://ha_recorder:***@10.0.30.70:3306/homeassistant
InfluxDB: 10.0.30.109:8086, bucket ha_hot_90d (long-term history)
HA masks passwords with *** in configuration.yaml — retrieve real passwords from 1Password, not the config file

HAOS SSH Access (Port 22222)

HAOS exposes SSH on port 22222 (requires SSH addon enabled):

ssh -i ~/.ssh/id_ed25519_proxmox root@10.0.30.10 -p 22222

Inside HAOS, HA runs as Docker container homeassistant:

docker exec homeassistant cat /config/configuration.yaml
docker exec homeassistant python3 -c "..."
docker logs homeassistant 2>&1 | grep -i recorder | tail -20

Note: pip modules like pymysql are NOT available inside the HA container. Use sqlalchemy (bundled with HA) or query the DB from outside.

3.7 KiB Raw Blame History