From b8bb524cbb13e73cfc6bb390d369d066ae00a55e Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Fri, 27 Mar 2026 19:42:21 +0100
Subject: [PATCH] Improve MariaDB readiness handling

---
 roles/svc-db-mariadb/tasks/01_core.yml        | 11 +++++++++--
 roles/svc-db-mariadb/templates/compose.yml.j2 |  2 +-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/roles/svc-db-mariadb/tasks/01_core.yml b/roles/svc-db-mariadb/tasks/01_core.yml
index febdcea21a..ea94b958b6 100644
--- a/roles/svc-db-mariadb/tasks/01_core.yml
+++ b/roles/svc-db-mariadb/tasks/01_core.yml
@@ -14,13 +14,17 @@
     global_install: true
   when: MARIADB_EXPOSE_LOCAL | bool
 
-- name: "Wait until the MariaDB container with hostname '{{ MARIADB_NAME }}' is healthy"
+- name: "Wait until the MariaDB container with hostname '{{ MARIADB_NAME }}' is running"
+  # We only wait for the container process here. A healthcheck can stay red
+  # when the persisted volume still has an older root password, and that would
+  # block the recovery reset path below. The login probe below retries so we
+  # do not treat normal startup lag as a password mismatch.
   community.docker.docker_container_info:
     name: "{{ MARIADB_NAME }}"
   register: db_info
   until:
     - db_info.container is defined
-    - db_info.container.State.Health.Status == "healthy"
+    - db_info.container.State.Running
   retries: 30
   delay: 5
 
@@ -36,6 +40,9 @@
       register: mariadb_login_desired
       changed_when: false
       failed_when: false
+      retries: 30
+      delay: 5
+      until: mariadb_login_desired.rc == 0
 
     - name: "Ensure MariaDB root password matches desired value"
       include_tasks: 03_reset_root_password.yml
diff --git a/roles/svc-db-mariadb/templates/compose.yml.j2 b/roles/svc-db-mariadb/templates/compose.yml.j2
index 76497a7eab..796c443cf2 100644
--- a/roles/svc-db-mariadb/templates/compose.yml.j2
+++ b/roles/svc-db-mariadb/templates/compose.yml.j2
@@ -19,7 +19,7 @@
     healthcheck:
       test:
         - "CMD-SHELL"
-        - "mariadb {% if MARIADB_EXPOSE_LOCAL %}-h127.0.0.1 -P3306{% endif %} -u root -p$MARIADB_ROOT_PASSWORD -e 'SHOW DATABASES;'"
+        - "mariadb {% if MARIADB_EXPOSE_LOCAL %}-h127.0.0.1 -P3306{% endif %} -u root -p\"$MARIADB_ROOT_PASSWORD\" -e 'SHOW DATABASES;'"
       interval: 10s
       timeout: 5s
       retries: 18