# ADR 0004 — Shared MariaDB instance, per-site DB + user

**Status:** Accepted

## Context
Two models: (a) a MariaDB container per customer — strong isolation, aligns with
per-customer ZFS snapshots, but ~100–300 MB idle RAM each; or (b) one shared
MariaDB instance with a separate database and least-privilege user per site —
RAM-efficient via a shared buffer pool, but the live datadir is shared.

## Decision
Run **one shared MariaDB** instance. Each site gets its **own database and its
own least-privilege user**. The instance's datadir lives on a dedicated platform
ZFS dataset, not inside any customer dataset.

## Consequences
- ✅ Efficient memory use (shared buffer pool) — favours density on one host.
- ✅ Per-site DB users mean a compromised site's credentials expose only that
  site's database.
- ❌ The live datadir cannot be snapshotted per-customer atomically with their
  files — addressed by decoupling DB backups (see
  [ADR 0006](0006-decoupled-backup-streams.md)): per-database dumps via
  automysqlbackup give per-customer restore granularity.
- ⚠️ The shared instance is a shared-fate component (a crash or bad query can
  affect all sites) and a noisy-neighbour surface — mitigate with tuning and,
  later, `mysqld_exporter` monitoring. Revisit per-customer DB if a tenant needs
  strong isolation or a different engine/version.