[blaipr]

The app and the RTE connected as MySQL root. AnsibleForms 7 needs only ALL PRIVILEGES ON AnsibleForms.* (server/src/lib/dbPrivileges.js), and app-start.js logs a [SECURITY] warning when the database user has rights on every database.

• docker-compose.yml: MySQL creates the AnsibleForms schema and the user MYSQLDB_USER on its first start (MYSQL_DATABASE, MYSQL_USER, MYSQL_PASSWORD), which grants that user all rights on that schema only. Root keeps its own password, MYSQLDB_ROOT_PASSWORD.
• .env: MYSQLDB_USER=ansibleforms, and the new MYSQLDB_ROOT_PASSWORD.
• README: a Database section, with the two statements an install that connected as root runs once to create the user (MySQL only creates it on a new data folder).

The schema is still created by the app: Schema.isEmpty() (server/src/models/schema.model.js) treats an existing but empty AnsibleForms database as empty, and create_schema_and_tables.sql only touches that schema. Checked locally with the latest-rc app and ansibleforms-rte-full images: the app created the schema as ansibleforms, logged no privilege warning, and the demo playbook ran on the RTE.

It also drops the maintenance form "Alter user for caching sha2 password" and its playbook: ALTER USER ... IDENTIFIED WITH needs the server-wide CREATE USER privilege, which this user does not have (checked: ERROR 1227), and the user MySQL 8.4 creates already uses caching_sha2_password.