mariadb backup fails with unexpected access denied

zjean commented

2025-12-18 10:53:29 +00:00

What I'm trying to do and why

I run borgmatic in docker, and use the mariadb backup feature like this:

...
mariadb_databases:
    - name: all
      hostname: ${MYSQL_HOST}

      username: ${MYSQL_ROOT_USER}
      password: ${MYSQL_ROOT_PASSWORD}
      
    - name: all

      # Database hostname to connect to. Defaults to connecting
      # via local Unix socket.
      hostname: ${BOOKLORE_MYSQL_HOST}
      username: ${BOOKLORE_MYSQL_ROOT_USER}

      password: ${BOOKLORE_MYSQL_ROOT_PASSWORD}

    - name: nextcloud

      # Database hostname to connect to. Defaults to connecting
      # via local Unix socket.
      hostname: ${NEXTCLOUD_MYSQL_HOST}
      username: ${NEXTCLOUD_MYSQL_ROOT_USER}
      password: ${NEXTCLOUD_MYSQL_ROOT_PASSWORD}
...

My .env has these variables, and they work. The start of the backup is doing fine, I see in the logs the dumps of the databases being made.

However, at the end, I suddenly see this:

mariadb-dump: Got error: 1045: "Access denied for user 'root'@'borgmatic.backups' (using password: YES)" when trying to connect

I dont use the borgmatic.backups mariadb host anywhere.

Steps to reproduce

Database config part of my .env:

MYSQL_HOST=mariadb.backups
MYSQL_ROOT_USER=root
MYSQL_ROOT_PASSWORD="redacted"

BOOKLORE_MYSQL_HOST=booklore_mariadb.backups
BOOKLORE_MYSQL_ROOT_USER=root
BOOKLORE_MYSQL_ROOT_PASSWORD=redacted

NEXTCLOUD_MYSQL_HOST=nextcloud_mariadb.backups
NEXTCLOUD_MYSQL_ROOT_USER=root
NEXTCLOUD_MYSQL_ROOT_PASSWORD="redacted"

Actual behavior

/etc/borgmatic.d/config.yaml: MYSQL_HOST=*** BORG_PASSPHRASE=*** MYSQL_ROOT_PASSWORD=*** MYSQL_ROOT_USER=*** BORG_RSH=*** BORG_DEBUG_PASSPHRASE=*** BORG_DISPLAY_PASSPHRASE=*** BORG_RELOCATED_REPO_ACCESS_IS_OK=*** BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=*** BORG_USE_CHUNKS_ARCHIVE=*** BORG_EXIT_CODES=*** borg --version --debug --show-rc
/etc/borgmatic.d/config.yaml: Borg 1.4.3

At the and, after the stats of the repo:

mariadb-dump: Got error: 1045: "Access denied for user 'root'@'borgmatic.backups' (using password: YES)" when trying to connect

Edit: It seems to happen when running for the second repository destination in my configuration. I want to backup the databases to both borg repositories. Running the backup to the first succeeds.

Expected behavior

Don't fail. Use only mariadb config that I specified.

Other notes / implementation ideas

No response

borgmatic version

2.0.12

borgmatic installation method

docker (modem7/borgmatic-docker:latest)

Borg version

borg 1.4.3

Python version

Python 3.14.2

Database version (if applicable)

No response

Operating system and version

No response

### What I'm trying to do and why I run borgmatic in docker, and use the mariadb backup feature like this: ``` ... mariadb_databases: - name: all hostname: ${MYSQL_HOST} username: ${MYSQL_ROOT_USER} password: ${MYSQL_ROOT_PASSWORD} - name: all # Database hostname to connect to. Defaults to connecting # via local Unix socket. hostname: ${BOOKLORE_MYSQL_HOST} username: ${BOOKLORE_MYSQL_ROOT_USER} password: ${BOOKLORE_MYSQL_ROOT_PASSWORD} - name: nextcloud # Database hostname to connect to. Defaults to connecting # via local Unix socket. hostname: ${NEXTCLOUD_MYSQL_HOST} username: ${NEXTCLOUD_MYSQL_ROOT_USER} password: ${NEXTCLOUD_MYSQL_ROOT_PASSWORD} ... ``` My .env has these variables, and they work. The start of the backup is doing fine, I see in the logs the dumps of the databases being made. However, at the end, I suddenly see this: mariadb-dump: Got error: 1045: "Access denied for user 'root'@'borgmatic.backups' (using password: YES)" when trying to connect I dont use the `borgmatic.backups` mariadb host anywhere. ### Steps to reproduce Database config part of my .env: ``` MYSQL_HOST=mariadb.backups MYSQL_ROOT_USER=root MYSQL_ROOT_PASSWORD="redacted" BOOKLORE_MYSQL_HOST=booklore_mariadb.backups BOOKLORE_MYSQL_ROOT_USER=root BOOKLORE_MYSQL_ROOT_PASSWORD=redacted NEXTCLOUD_MYSQL_HOST=nextcloud_mariadb.backups NEXTCLOUD_MYSQL_ROOT_USER=root NEXTCLOUD_MYSQL_ROOT_PASSWORD="redacted" ``` ### Actual behavior ``` /etc/borgmatic.d/config.yaml: MYSQL_HOST=*** BORG_PASSPHRASE=*** MYSQL_ROOT_PASSWORD=*** MYSQL_ROOT_USER=*** BORG_RSH=*** BORG_DEBUG_PASSPHRASE=*** BORG_DISPLAY_PASSPHRASE=*** BORG_RELOCATED_REPO_ACCESS_IS_OK=*** BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=*** BORG_USE_CHUNKS_ARCHIVE=*** BORG_EXIT_CODES=*** borg --version --debug --show-rc /etc/borgmatic.d/config.yaml: Borg 1.4.3 ``` At the and, after the stats of the repo: ``` mariadb-dump: Got error: 1045: "Access denied for user 'root'@'borgmatic.backups' (using password: YES)" when trying to connect ``` Edit: It seems to happen when running for the second repository destination in my configuration. I want to backup the databases to both borg repositories. Running the backup to the first succeeds. ### Expected behavior Don't fail. Use only mariadb config that I specified. ### Other notes / implementation ideas _No response_ ### borgmatic version 2.0.12 ### borgmatic installation method docker (modem7/borgmatic-docker:latest) ### Borg version borg 1.4.3 ### Python version Python 3.14.2 ### Database version (if applicable) _No response_ ### Operating system and version _No response_

witten commented

2025-12-18 17:13:08 +00:00

Owner

/etc/borgmatic.d/config.yaml: MYSQL_HOST=*** BORG_PASSPHRASE=*** MYSQL_ROOT_PASSWORD=*** MYSQL_ROOT_USER=*** BORG_RSH=*** BORG_DEBUG_PASSPHRASE=*** BORG_DISPLAY_PASSPHRASE=*** BORG_RELOCATED_REPO_ACCESS_IS_OK=*** BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=*** BORG_USE_CHUNKS_ARCHIVE=*** BORG_EXIT_CODES=*** borg --version --debug --show-rc

This is interesting.. There's a bunch of MYSQL_* environment variables there that borgmatic doesn't set, including MYSQL_HOST—which could maybe override the host that the mariadb* commands try to connect to. So could something in your borgmatic container be setting those environment variables? What happens if you exec into that container and type env |grep MYSQL?

> /etc/borgmatic.d/config.yaml: MYSQL_HOST=*** BORG_PASSPHRASE=*** MYSQL_ROOT_PASSWORD=*** MYSQL_ROOT_USER=*** BORG_RSH=*** BORG_DEBUG_PASSPHRASE=*** BORG_DISPLAY_PASSPHRASE=*** BORG_RELOCATED_REPO_ACCESS_IS_OK=*** BORG_UNKNOWN_UNENCRYPTED_REPO_ACCESS_IS_OK=*** BORG_USE_CHUNKS_ARCHIVE=*** BORG_EXIT_CODES=*** borg --version --debug --show-rc This is interesting.. There's a bunch of `MYSQL_*` environment variables there that borgmatic doesn't set, including `MYSQL_HOST`—which could maybe override the host that the `mariadb*` commands try to connect to. So could something in your borgmatic container be setting those environment variables? What happens if you `exec` into that container and type `env |grep MYSQL`?

zjean commented

2025-12-18 19:28:00 +00:00

Author

Hi, thanks for your response.

The output of the env | grep MYSQL is this (with passwords redacted)

MYSQL_ROOT_PASSWORD=redacted
MYSQL_ROOT_USER=root
BOOKLORE_MYSQL_HOST=booklore_mariadb.backups
NEXTCLOUD_MYSQL_ROOT_USER=root
NEXTCLOUD_MYSQL_ROOT_PASSWORD=redacted
BOOKLORE_MYSQL_ROOT_USER=root
BOOKLORE_MYSQL_ROOT_PASSWORD=redacted
MYSQL_HOST=mariadb.backups
NEXTCLOUD_MYSQL_HOST=nextcloud_mariadb.backups

so this maps to my .env

I can try to rename the MYSQL_** env vars to a different name

Hi, thanks for your response. The output of the `env | grep MYSQL` is this (with passwords redacted) ``` MYSQL_ROOT_PASSWORD=redacted MYSQL_ROOT_USER=root BOOKLORE_MYSQL_HOST=booklore_mariadb.backups NEXTCLOUD_MYSQL_ROOT_USER=root NEXTCLOUD_MYSQL_ROOT_PASSWORD=redacted BOOKLORE_MYSQL_ROOT_USER=root BOOKLORE_MYSQL_ROOT_PASSWORD=redacted MYSQL_HOST=mariadb.backups NEXTCLOUD_MYSQL_HOST=nextcloud_mariadb.backups ``` so this maps to my .env I can try to rename the MYSQL_** env vars to a different name

witten commented

2025-12-18 19:42:15 +00:00

Owner

Ah, that explains it. Yeah, I'd recommend renaming and seeing if that fixes it. Because I'm guessing that on the second database for instance, the MYSQL_HOST value is overriding whatever borgmatic is passing to MariaDB for host. On the first database, they are the same value, so you don't see the problem there.

Ah, that explains it. Yeah, I'd recommend renaming and seeing if that fixes it. Because I'm guessing that on the second database for instance, the `MYSQL_HOST` value is overriding whatever borgmatic is passing to MariaDB for host. On the first database, they are the same value, so you don't see the problem there.

witten added the

question / support

label

2025-12-18 19:42:42 +00:00

zjean commented

2025-12-19 17:57:44 +00:00

Author

I have changed the environment variables to use MAIN_MYSQL_ as a prefix instead of MYSQL_, however I still get a weird error, at the end of backing up my mysql database at the first repository:

external-disk: Dumping MariaDB databases
ERROR 1045 (28000): Access denied for user 'root'@'borgmatic.backups' (using password: YES)
external-disk: Running 3 commands for after create action hook
Backup created.
Calling Uptime Kuma after backup
external-disk: Error running actions for repository
external-disk: Command '('mariadb', '--defaults-extra-file=/dev/fd/3', '--host', 'mariadb.backups', '--protocol', 'tcp', '--skip-column-names', '--batch', '--execute', 'show schemas')' returned non-zero exit status 1.
second-repo: Running 2 commands for before create action hook

there is no borgmatic.backups mysql host at all.
the `backups` is the name of the docker network, which is right. however the host `borgmatic` is over written somehow.
Any ideas? The backup of this repo stops,and you see the second-repo being started.

I have changed the environment variables to use `MAIN_MYSQL_` as a prefix instead of `MYSQL_`, however I still get a weird error, at the end of backing up my mysql database at the first repository: ``` external-disk: Dumping MariaDB databases ERROR 1045 (28000): Access denied for user 'root'@'borgmatic.backups' (using password: YES) external-disk: Running 3 commands for after create action hook Backup created. Calling Uptime Kuma after backup external-disk: Error running actions for repository external-disk: Command '('mariadb', '--defaults-extra-file=/dev/fd/3', '--host', 'mariadb.backups', '--protocol', 'tcp', '--skip-column-names', '--batch', '--execute', 'show schemas')' returned non-zero exit status 1. second-repo: Running 2 commands for before create action hook ``` there is no borgmatic.backups mysql host at all. the `backups` is the name of the docker network, which is right. however the host `borgmatic` is over written somehow. Any ideas? The backup of this repo stops,and you see the second-repo being started. -

witten commented

2025-12-19 18:26:08 +00:00

Owner

Okay, looks like I was wrong about the MYSQL_HOST override theory. And now I'm pretty sure that borgmatic.backups is just the hostname of the borgmatic container itself... borgmatic is connecting to the database as user "root", and the "@borgmatic.backups" portion is implicit. Meaning it's just how MariaDB displays the error message. It's equivalent to saying "root@localhost".

As for the actual mariadb command failing, I think the most likely explanation is that the password is wrong! I can produce a very similar error message locally here when I change my MariaDB user password to be incorrect. So some thoughts on different things to try, one at a time:

First, double check that your password is the right one for the first database!
Is it possible the password contains a special character that is getting interpreted by your shell instead of getting passed through correctly?
You can try setting and using a simpler password just for testing, if that's not too inconvenient/disruptive.
Try putting the password directly in the borgmatic config, although use quoting and be mindful of YAML interpreting special characters.
You can try password_transport: environment in the database config, which uses a different (slightly less secure) way of passing the password to the mariadb client. If that works, that probably indicates there's a problem with how borgmatic gives the password to mariadb by default.

Okay, looks like I was wrong about the `MYSQL_HOST` override theory. And now I'm pretty sure that `borgmatic.backups` is just the hostname of the borgmatic container itself... borgmatic is connecting to the database as user "root", and the "@borgmatic.backups" portion is implicit. Meaning it's just how MariaDB displays the error message. It's equivalent to saying "root@localhost". As for the actual `mariadb` command failing, I think the most likely explanation is that the password is wrong! I can produce a very similar error message locally here when I change my MariaDB user password to be incorrect. So some thoughts on different things to try, one at a time: * First, double check that your password is the right one for the first database! * Is it possible the password contains a special character that is getting interpreted by your shell instead of getting passed through correctly? * You can try setting and using a simpler password just for testing, if that's not too inconvenient/disruptive. * Try putting the password directly in the borgmatic config, although use quoting and be mindful of YAML interpreting special characters. * You can try `password_transport: environment` in the database config, which uses a different (slightly less secure) way of passing the password to the `mariadb` client. If that works, that probably indicates there's a problem with how borgmatic gives the password to `mariadb` by default.

witten added the

waiting for response

label

2025-12-25 22:08:44 +00:00

zjean commented

2026-01-28 07:56:30 +00:00

Author

It looked like my mariadb instance got corrupted. I created a new one, and everything is working fine!

zjean closed this issue

2026-01-28 07:56:30 +00:00

witten commented

2026-01-28 18:41:02 +00:00

Owner

Aha! Glad to hear you got it working now.

Rows
Columns

mariadb backup fails with unexpected access denied #1205

What I'm trying to do and why

Steps to reproduce

Actual behavior

Expected behavior

Other notes / implementation ideas

borgmatic version

borgmatic installation method

Borg version

Python version

Database version (if applicable)

Operating system and version

there is no borgmatic.backups mysql host at all. the backups is the name of the docker network, which is right. however the host borgmatic is over written somehow. Any ideas? The backup of this repo stops,and you see the second-repo being started.

there is no borgmatic.backups mysql host at all.
the `backups` is the name of the docker network, which is right. however the host `borgmatic` is over written somehow.
Any ideas? The backup of this repo stops,and you see the second-repo being started.