# Read-Only Database Access

Keep this access method disabled until the operator approves the database account and connection details.

## Required variables

- `WP_DB_HOST`: The approved database host.
- `WP_DB_PORT`: The approved database port.
- `WP_DB_NAME`: The approved database name.
- `WP_DB_USER`: The name of the read-only database account.
- `WP_DB_PASSWORD`: The password from an approved private source.
- `WP_DB_SSL_MODE`: The required value is `VERIFY_IDENTITY`.
- `WP_DB_SSL_CA`: The absolute path to the approved CA certificate.

Do not store database credentials in the repository.

## Least-privilege account requirements

Use a dedicated database account.
Give the account only the grants that read operations require.
Permit only `SELECT`, `SHOW`, `DESCRIBE`, and `EXPLAIN` statements.
Do not give the account permission to change data or database objects.
The read-only account is the primary control.

## TLS requirements

Set `WP_DB_SSL_MODE=VERIFY_IDENTITY`.
Set `WP_DB_SSL_CA` to the approved CA certificate path.
Require certificate and hostname verification.
Stop if the database client cannot verify the server identity.

## Client requirements

Use a MySQL client that supports `--no-defaults` and `--no-login-paths`.
The wrapper puts these options before all other MySQL options.
The wrapper disables option files and login paths.

## Read-only verification

```bash
scripts/with-environment.sh database .env scripts/db-read.sh "SHOW TABLES"
```

The `database` mode exports only `WP_DB_*` values.

## Prohibited actions

Do not use statements that change data or database objects.
Do not include SQL comments.
Do not use MySQL client commands or backslash escapes.
Do not call stored procedures.
Do not run multi-statement queries.
Do not create database exports.
Do not bypass TLS verification.

## Production write boundary

This repository never authorizes production writes.
Operator approval does not enable writes through this template.
Use a separate access method for an approved production write.
Use a change procedure outside this scaffold for that write.

## Required approval

Get operator approval before you enable database access.
The approval must identify the account, host, database, and CA certificate.