Deb: Clean up default configs for 10.5 era

- Recommend max_allowed_packet=1G which is the same as the default client
  value.
- Remove thread_concurrency removed in 10.5.
- Remove query cache, not recommended practice anymore.
- Remove binlog_*, should not recommend those too easily but rather require
  the database administrator to read up on those themselves.
- Remove chroot setting, not relevant in modern container era.
- Show explicitly innodb_buffer_pool_size example as the most likely thing
  a database administrator should change.
- Don't recommend rate limiting in slow log, logging once in a 1000
  would not be optimal for the basic case, hence bad example.
- Install the example configs in /usr/share/mysql.
- Use correct path /run/ instead of /var/run/.

debian/additions/mariadb.conf.d/50-client.cnf

@@ -8,7 +8,7 @@
 default-character-set = utf8mb4
 
 # socket location
-socket = /var/run/mysqld/mysqld.sock
+socket = /run/mysqld/mysqld.sock
 
 # Example of client certificate usage
 # ssl-cert=/etc/mysql/client-cert.pem

debian/additions/mariadb.conf.d/50-mysqld_safe.cnf

 # NOTE: This file is read only by the traditional SysV init script, not systemd.
 # MariaDB systemd does _not_ utilize mysqld_safe nor read this file.
 #
-# For similar behaviour, systemd users should create the following file:
+# For similar behavior, systemd users should create the following file:
 # /etc/systemd/system/mariadb.service.d/migrated-from-my.cnf-settings.conf
 #
 # To achieve the same result as the default 50-mysqld_safe.cnf, please create
@@ -17,14 +17,13 @@
 # SyslogIdentifier=mysqld
 #
 # For more information, please read https://mariadb.com/kb/en/mariadb/systemd/
-#
 
 [mysqld_safe]
 # This will be passed to all mysql clients
 # It has been reported that passwords should be enclosed with ticks/quotes
 # especially if they contain "#" chars...
 # Remember to edit /etc/mysql/debian.cnf when changing the socket location.
-socket		= /var/run/mysqld/mysqld.sock
+socket = /run/mysqld/mysqld.sock
 nice   = 0
 skip_log_error
 syslog

debian/additions/mariadb.conf.d/50-server.cnf

 #
 # These groups are read by MariaDB server.
 # Use it for options that only the server (but not clients) should see
-#
-# See the examples of server my.cnf files in /usr/share/mysql
 
 # this is read by the standalone daemon and embedded servers
 [server]
@@ -13,6 +11,7 @@
 #
 # * Basic Settings
 #
+
 user                    = mysql
 pid-file                = /run/mysqld/mysqld.pid
 socket                  = /run/mysqld/mysqld.sock
@@ -21,7 +20,12 @@ basedir                 = /usr
 datadir                 = /var/lib/mysql
 tmpdir                  = /tmp
 lc-messages-dir         = /usr/share/mysql
-#skip-external-locking
+lc-messages             = en_US
+skip-external-locking
+
+# Broken reverse DNS slows down connections considerably and name resolve is
+# safe to skip if there are no "host by domain name" access grants
+#skip-name-resolve
 
 # Instead of skip-networking the default is now to listen only on
 # localhost which is more compatible and is not less secure.
@@ -30,8 +34,9 @@ bind-address            = 127.0.0.1
 #
 # * Fine Tuning
 #
-#key_buffer_size        = 16M
-#max_allowed_packet     = 16M
+
+#key_buffer_size        = 128M
+#max_allowed_packet     = 1G
 #thread_stack           = 192K
 #thread_cache_size      = 8
 # This replaces the startup script and checks MyISAM tables if needed
@@ -39,34 +44,29 @@ bind-address            = 127.0.0.1
 #myisam_recover_options = BACKUP
 #max_connections        = 100
 #table_cache            = 64
-#thread_concurrency     = 10
-
-#
-# * Query Cache Configuration
-#
-#query_cache_limit      = 1M
-query_cache_size        = 16M
 
 #
 # * Logging and Replication
 #
+
 # Both location gets rotated by the cronjob.
 # Be aware that this log type is a performance killer.
-# As of 5.1 you can enable the log at runtime!
+# Recommend only changing this at runtime for short testing periods if needed!
 #general_log_file       = /var/log/mysql/mysql.log
 #general_log            = 1
-#
-# Error log - should be very few entries.
-#
-log_error = /var/log/mysql/error.log
-#
+
+# When running under systemd, error logging goes via stdout/stderr to journald
+# and when running legacy init error logging goes to syslog due to
+# /etc/mysql/conf.d/mariadb.conf.d/50-mysqld_safe.cnf
+# Enable this if you want to have error logging into a separate file
+#log_error = /var/log/mysql/error.log
 # Enable the slow query log to see queries with especially long duration
 #slow_query_log_file    = /var/log/mysql/mariadb-slow.log
 #long_query_time        = 10
-#log_slow_rate_limit    = 1000
-#log_slow_verbosity     = query_plan
+#log_slow_verbosity     = query_plan,explain
 #log-queries-not-using-indexes
-#
+#min_examined_row_limit = 1000
+
 # The following can be used as easy to replay backup logs or for replication.
 # note: if you are setting up a replication slave, see README.Debian about
 #       other settings you may need to change.
@@ -74,50 +74,35 @@ log_error = /var/log/mysql/error.log
 #log_bin                = /var/log/mysql/mysql-bin.log
 expire_logs_days        = 10
 #max_binlog_size        = 100M
-#binlog_do_db           = include_database_name
-#binlog_ignore_db       = exclude_database_name
 
 #
-# * Security Features
-#
-# Read the manual, too, if you want chroot!
-#chroot = /var/lib/mysql/
-#
-# For generating SSL certificates you can use for example the GUI tool "tinyca".
+# * SSL/TLS
 #
+
+# For documentation, please read
+# https://mariadb.com/kb/en/securing-connections-for-client-and-server/
 #ssl-ca = /etc/mysql/cacert.pem
 #ssl-cert = /etc/mysql/server-cert.pem
 #ssl-key = /etc/mysql/server-key.pem
-#
-# Accept only connections using the latest and most secure TLS protocol version.
-# ..when MariaDB is compiled with OpenSSL:
-#ssl-cipher = TLSv1.2
-# ..when MariaDB is compiled with YaSSL (default in Debian):
-#ssl = on
 
 #
 # * Character sets
 #
+
 # MySQL/MariaDB default is Latin1, but in Debian we rather default to the full
 # utf8 4-byte character set. See also client.cnf
-#
 character-set-server  = utf8mb4
 collation-server      = utf8mb4_general_ci
 
 #
 # * InnoDB
 #
+
 # InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
 # Read the manual for more InnoDB related options. There are many!
-
-#
-# * Unix socket authentication plugin is built-in since 10.0.22-6
-#
-# Needed so the root database user can authenticate without a password but
-# only when running as the unix root user.
-#
-# Also available for other users if required.
-# See https://mariadb.com/kb/en/unix_socket-authentication-plugin/
+# Most important is to give InnoDB 80 % of the system RAM for buffer use:
+# https://mariadb.com/kb/en/innodb-system-variables/#innodb_buffer_pool_size
+#innodb_buffer_pool_size = 8G
 
 # this is only for embedded server
 [embedded]

debian/additions/mariadb.conf.d/60-galera.cnf

 #
 # * Galera-related settings
 #
+# See the examples of server wsrep.cnf files in /usr/share/mysql
+
 [galera]
 # Mandatory settings
 #wsrep_on=ON
@@ -9,11 +11,10 @@
 #binlog_format=row
 #default_storage_engine=InnoDB
 #innodb_autoinc_lock_mode=2
-#
+
 # Allow server to accept connections on all interfaces.
-#
 #bind-address=0.0.0.0
-#
-# Optional setting
+
+# Optional settings
 #wsrep_slave_threads=1
 #innodb_flush_log_at_trx_commit=0

debian/mariadb-server-10.5.install

@@ -104,4 +104,5 @@ usr/share/man/man1/wsrep_sst_mysqldump.1
 usr/share/man/man1/wsrep_sst_rsync.1
 usr/share/man/man1/wsrep_sst_rsync_wan.1
 usr/share/mysql/errmsg-utf8.txt
+usr/share/mysql/wsrep.cnf
 usr/share/mysql/wsrep_notify