Add MySQL database support

  Implements MySQL/MariaDB as a production database backend alongside
  SQL Server and SQLite. Uses go-sql-driver/mysql with FormatDSN for
  connection management, batched session configuration via multiStatements,
  and @PARAM to ? positional placeholder translation.

  Driver (internal/db/mysql.go):
  - Implement MySQLDriver with full Driver interface (Query, Ping, Reconnect, Close)
  - Build DSN using mysql.Config{}.FormatDSN() for safe credential handling
  - Translate @PARAM syntax to ? positional placeholders
  - Batch session SET statements into single round-trip (multiStatements=true)
  - Use ceiling division for lock_timeout_ms to seconds conversion
  - Configure connection pool with sensible defaults (5 open, 2 idle, 5min lifetime)
  - Support TLS via encrypt config field (true, false, disable, skip-verify)

  Config and Validation:
  - Add "mysql" to ValidDatabaseTypes map
  - Add MySQL-specific validation (host, port, user, password, database required)
  - Reject "snapshot" isolation level for MySQL (SQL Server-specific)
  - Make DefaultSessionConfig database-type-aware (MySQL defaults to read_committed)
  - Update error messages to include "mysql" in valid types list
  - Update OpenAPI spec description for database type field

  CI:
  - Add test-mysql job with MySQL 8.0 service container
  - Gate test-mysql on main test job (needs: [test])
  - Validate MySQL example configs in CI with running MySQL instance

  Examples:
  - Reorganize examples/ into sqlite/ and mysql/ subdirectories
  - Add examples/mysql/01-basic.yaml demonstrating MySQL connection and queries
  - Update Makefile validate-examples to use examples/sqlite/ path

  Tests:
  - Add unit tests for DSN construction, query translation, isolation mapping, pool config
  - Add integration tests for queries, params, concurrency, unicode, reconnect
  - Add TestValidateDatabase_MySQL for field and isolation validation
  - Update TestValidDatabaseTypes, TestLoad_InvalidDatabaseType, TestValidateDatabase_InvalidType
  - Update TestDatabaseConfig_DefaultSessionConfig with per-type cases

  Documentation:
  - Add MySQL safety table, user setup, configuration options, session settings
  - Add MySQL query syntax examples and operational considerations
  - Update session settings table, pagination notes, troubleshooting section
  - Mark MySQL as complete in roadmap

Author: abgoyal

.github/workflows/ci.yml

@@ -29,3 +29,49 @@ jobs:
 
       - name: Smoke test - validate config
         run: ./sql-proxy -validate -config testdata/config.ci.yaml
+
+  test-mysql:
+    needs: [test]
+    runs-on: ubuntu-latest
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: testpass
+          MYSQL_DATABASE: testdb
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping -h 127.0.0.1"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+
+      - name: Run MySQL integration tests
+        env:
+          MYSQL_HOST: 127.0.0.1
+          MYSQL_PORT: 3306
+          MYSQL_USER: root
+          MYSQL_PASSWORD: testpass
+          MYSQL_DATABASE: testdb
+        run: go test -v -run "MySQL" ./internal/db/
+
+      - name: Build
+        run: go build -o sql-proxy .
+
+      - name: Validate MySQL example configs
+        env:
+          MYSQL_PASSWORD: testpass
+        run: |
+          for f in examples/mysql/*.yaml; do
+            echo "=== $f ==="
+            ./sql-proxy -validate -config "$f" || exit 1
+          done

Makefile

@@ -316,10 +316,10 @@ test-clean:
 validate: build
 	./$(BINARY_NAME) -validate -config config.yaml
 
-# Validate all example configs
+# Validate all example configs (sqlite examples run without external dependencies)
 validate-examples: build
 	@echo "Validating example configs..."
-	@for f in examples/*.yaml; do \
+	@for f in examples/sqlite/*.yaml; do \
 		echo "=== $$f ===" && \
 		./$(BINARY_NAME) -validate -config "$$f" || exit 1; \
 	done

README.md

@@ -1,10 +1,10 @@
 # SQL Proxy Service
 
-A lightweight, production-grade Go service that exposes predefined SQL queries as HTTP endpoints. Supports **SQL Server** and **SQLite** databases. Runs as a system service on **Windows**, **Linux**, and **macOS** with **zero impact on the source database** and **zero maintenance** requirements.
+A lightweight, production-grade Go service that exposes predefined SQL queries as HTTP endpoints. Supports **SQL Server**, **MySQL**, and **SQLite** databases. Runs as a system service on **Windows**, **Linux**, and **macOS** with **zero impact on the source database** and **zero maintenance** requirements.
 
 ## Features
 
-- **Multi-Database Support** - SQL Server and SQLite (same query syntax)
+- **Multi-Database Support** - SQL Server, MySQL, and SQLite (same query syntax)
 - **Cross-Platform Service** - Windows Service, Linux systemd, macOS launchd
 - **YAML Configuration** - Easy query management, no code changes
 - **Read-only Safety** - Zero interference with production database
@@ -50,6 +50,19 @@ This service is designed to safely read from production databases without interf
 | Session | `IMPLICIT_TRANSACTIONS OFF` | No accidental open transactions |
 | Database | Read-only SQL user | Database enforces no writes possible |
 
+### MySQL Safety
+
+| Level | Setting | Purpose |
+|-------|---------|---------|
+| Connection | `parseTime=true` | Parses DATE/DATETIME as Go time.Time |
+| Connection | `collation=utf8mb4_general_ci` | Full Unicode support (utf8mb4 charset) |
+| Connection | `interpolateParams=false` | Prevents client-side parameter interpolation |
+| Connection | Max 5 connections, 5min lifetime | Conservative pool footprint |
+| Session | `innodb_lock_wait_timeout` | Fails fast (5s) if lock needed |
+| Session | `TRANSACTION READ ONLY` | Prevents writes when readonly is true |
+| Session | Configurable isolation level | Default: READ COMMITTED |
+| Database | Read-only MySQL user | Database enforces no writes possible |
+
 ### SQLite Safety
 
 | Level | Setting | Purpose |
@@ -87,6 +100,21 @@ DENY CREATE PROCEDURE TO sqlproxy_reader;
 DENY CREATE FUNCTION TO sqlproxy_reader;
 ```
 
+## MySQL User Setup (REQUIRED)
+
+Create a dedicated read-only user in MySQL. Connect as admin and run:
+
+```sql
+-- Create a user with read-only access
+CREATE USER 'sqlproxy_reader'@'%' IDENTIFIED BY 'YourSecurePassword123!';
+
+-- Grant ONLY read access to your database
+GRANT SELECT ON YourDatabaseName.* TO 'sqlproxy_reader'@'%';
+
+-- Apply changes
+FLUSH PRIVILEGES;
+```
+
 ## Building
 
 ```bash
@@ -292,7 +320,7 @@ server:
 
 databases:
   - name: "primary"
-    type: "sqlserver"             # sqlserver or sqlite (required)
+    type: "sqlserver"             # sqlserver, mysql, or sqlite (required)
     host: "your-server.rds.amazonaws.com"
     port: 1433
     user: "sqlproxy_reader"
@@ -415,6 +443,69 @@ workflows:
         template: '{"success": true}'
 ```
 
+### MySQL Support
+
+MySQL databases are supported as a production backend. Use `type: "mysql"` with standard host/port/user/password connection settings:
+
+```yaml
+databases:
+  - name: "primary"
+    type: "mysql"
+    host: "your-mysql-server.example.com"
+    port: 3306
+    user: "sqlproxy_reader"
+    password: "${DB_PASSWORD}"
+    database: "YourDB"
+    readonly: true                # Defaults to true if omitted
+    encrypt: "true"               # TLS: true, false, disable, skip-verify
+```
+
+#### MySQL Configuration Options
+
+| Setting | Default | Description |
+|---------|---------|-------------|
+| `host` | (required) | MySQL server hostname |
+| `port` | `3306` | MySQL server port |
+| `user` | (required) | MySQL username |
+| `password` | (required) | MySQL password (supports `${ENV_VAR}` syntax) |
+| `database` | (required) | Database name |
+| `readonly` | `true` | Sets session to READ ONLY transaction mode |
+| `encrypt` | `false` | TLS mode: `true`, `false`, `disable`, `skip-verify` |
+
+#### MySQL Session Settings
+
+| Setting | Default (readonly) | Default (readwrite) | Description |
+|---------|-------------------|---------------------|-------------|
+| `isolation` | `read_committed` | `read_committed` | Transaction isolation level |
+| `lock_timeout_ms` | `5000` | `5000` | InnoDB lock wait timeout (converted to seconds) |
+
+#### MySQL Query Syntax
+
+All queries use `@param` syntax (the driver translates to `?` positional placeholders for MySQL):
+
+```sql
+-- Named parameters are translated automatically
+SELECT * FROM users WHERE status = @status AND age > @age
+-- Becomes: SELECT * FROM users WHERE status = ? AND age > ?
+
+-- Use LIMIT for pagination (MySQL style)
+SELECT * FROM items ORDER BY id LIMIT @limit OFFSET @offset
+
+-- Optional filter pattern (same as other databases)
+SELECT * FROM users WHERE (@status IS NULL OR status = @status)
+```
+
+#### MySQL Operational Considerations
+
+**When to use MySQL:**
+- Production deployments with MySQL/MariaDB infrastructure
+- Read-heavy workloads with connection pooling
+- Applications already running on MySQL/Aurora
+
+**When NOT to use MySQL:**
+- If you need SQL Server-specific features (AG routing, SNAPSHOT isolation)
+- If you need embedded/serverless (use SQLite instead)
+
 ### SQLite Support
 
 SQLite databases are supported for testing and lightweight deployments. Use `type: "sqlite"` with a `path` instead of host/port/user/password:
@@ -527,13 +618,13 @@ The driver automatically configures SQLite for optimal concurrent performance:
 | In-memory | `:memory:` | Lost on restart | Testing |
 
 **Query Syntax:**
-- All queries use `@param` syntax (driver translates to `$param` for SQLite)
+- All queries use `@param` syntax (driver translates to `$param` for SQLite, `?` for MySQL)
 - Use `LIMIT` instead of `TOP` for pagination:
   ```sql
   -- SQL Server style (works on SQL Server)
   SELECT TOP (@limit) * FROM items
 
-  -- SQLite style (works on SQLite)
+  -- MySQL/SQLite style (works on MySQL and SQLite)
   SELECT * FROM items LIMIT @limit
   ```
 
@@ -543,11 +634,11 @@ Session settings control database behavior at query execution time. Settings can
 
 **Database-Specific Behavior:**
 
-| Setting | SQL Server | SQLite |
-|---------|------------|--------|
-| `isolation` | Sets transaction isolation level | Ignored (SQLite has limited isolation) |
-| `lock_timeout_ms` | `SET LOCK_TIMEOUT` | Maps to `busy_timeout` pragma |
-| `deadlock_priority` | `SET DEADLOCK_PRIORITY` | Ignored (SQLite handles differently) |
+| Setting | SQL Server | MySQL | SQLite |
+|---------|------------|-------|--------|
+| `isolation` | Sets transaction isolation level | Sets transaction isolation level | Ignored (SQLite has limited isolation) |
+| `lock_timeout_ms` | `SET LOCK_TIMEOUT` | `innodb_lock_wait_timeout` (seconds) | Maps to `busy_timeout` pragma |
+| `deadlock_priority` | `SET DEADLOCK_PRIORITY` | Ignored (InnoDB handles internally) | Ignored (SQLite handles differently) |
 
 **SQL Server Implicit Defaults (based on `readonly` flag):**
 
@@ -631,7 +722,7 @@ curl "http://localhost:8081/api/checkins?_timeout=120"
 
 Pagination is handled at the query level using database-native syntax. This is more efficient than service-level truncation because the database stops scanning once the limit is reached.
 
-> **Note:** SQL Server uses `TOP`, SQLite uses `LIMIT`. Write queries for your specific database type.
+> **Note:** SQL Server uses `TOP`, MySQL and SQLite use `LIMIT`. Write queries for your specific database type.
 
 #### Simple Limit (SQL Server: TOP, SQLite: LIMIT)
 
@@ -2317,6 +2408,16 @@ Status values:
 }
 ```
 
+MySQL example:
+```json
+{
+  "database": "analytics",
+  "status": "connected",
+  "type": "mysql",
+  "readonly": true
+}
+```
+
 Returns 404 only if the database name doesn't exist in configuration.
 
 ### OpenAPI / Swagger
@@ -2449,6 +2550,12 @@ your-domain.com {
 8. **Low deadlock priority** - Always yields to production app
 9. **ApplicationIntent=ReadOnly** - Enables AG read routing
 
+**MySQL Specific:**
+5. **Read-only MySQL user** - `SELECT` privilege only, no write grants
+6. **TLS encryption** - `encrypt: "true"` for production connections
+7. **Session READ ONLY** - `readonly: true` sets transaction to read-only mode
+8. **Lock timeout (5s)** - Fails fast via `innodb_lock_wait_timeout`
+
 **SQLite Specific:**
 5. **Read-only mode** - `readonly: true` opens DB in read-only mode
 6. **File permissions** - Ensure appropriate filesystem permissions
@@ -2482,6 +2589,13 @@ your-domain.com {
 - Verify security group allows port 1433
 - Check credentials in config
 
+### Database connection issues (MySQL)
+- Check `/_/health` endpoint for status
+- Verify security group/firewall allows port 3306
+- Check credentials and database name in config
+- Verify TLS settings match server configuration (`encrypt: "true"` or `"skip-verify"`)
+- Check `max_connections` on MySQL server if getting connection pool exhaustion
+
 ### Database issues (SQLite)
 
 **"database is locked" errors:**
@@ -2710,7 +2824,7 @@ All unit and integration tests use SQLite in-memory databases (`:memory:`) to av
 
 Planned features for future releases:
 
-- [ ] **MySQL Support** - Add MySQL/MariaDB as a database backend option alongside SQL Server and SQLite.
+- [x] **MySQL Support** - Add MySQL/MariaDB as a database backend option alongside SQL Server and SQLite.
 - [ ] **PostgreSQL Support** - Add PostgreSQL as a database backend option.
 - [ ] **TLS Support** - Native HTTPS termination without requiring a reverse proxy (Caddy/nginx). Will support configurable certificate paths and automatic Let's Encrypt integration.
 - [x] **Rate Limiting** - Per-endpoint and per-client rate limiting to protect database resources from excessive requests.

TESTS.md

@@ -22,17 +22,17 @@ Run `make test-cover` for current coverage statistics.
 - **TestLoad_InvalidTimeout**: TestLoad_InvalidTimeout checks timeout validation: positive values, max >= default
 - **TestLoad_NoDatabases**: TestLoad_NoDatabases ensures at least one database connection is required
 - **TestLoad_DuplicateDatabaseNames**: TestLoad_DuplicateDatabaseNames ensures database names must be unique across connections
-- **TestLoad_InvalidDatabaseType**: TestLoad_InvalidDatabaseType rejects unsupported database types like mysql
+- **TestLoad_InvalidDatabaseType**: TestLoad_InvalidDatabaseType rejects unsupported database types
 - **TestLoad_SQLiteMissingPath**: TestLoad_SQLiteMissingPath ensures SQLite databases require a path field
 - **TestLoad_SQLServerMissingFields**: TestLoad_SQLServerMissingFields validates SQL Server requires host, port, user, password, database
 - **TestLoad_InvalidLogLevel**: TestLoad_InvalidLogLevel rejects log levels other than debug/info/warn/error
 - **TestLoad_InvalidIsolationLevel**: TestLoad_InvalidIsolationLevel rejects invalid SQL Server isolation level names
 - **TestDatabaseConfig_IsReadOnly**: TestDatabaseConfig_IsReadOnly verifies readonly defaults to true when nil
-- **TestDatabaseConfig_DefaultSessionConfig**: TestDatabaseConfig_DefaultSessionConfig checks implicit defaults based on readonly flag
+- **TestDatabaseConfig_DefaultSessionConfig**: TestDatabaseConfig_DefaultSessionConfig checks implicit defaults based on type and readonly flag
 - **TestValidIsolationLevels**: TestValidIsolationLevels checks the ValidIsolationLevels map contains correct entries
 - **TestValidDeadlockPriorities**: TestValidDeadlockPriorities checks the ValidDeadlockPriorities map for low/normal/high
 - **TestValidJournalModes**: TestValidJournalModes checks ValidJournalModes for SQLite: wal/delete/truncate/memory/off
-- **TestValidDatabaseTypes**: TestValidDatabaseTypes checks ValidDatabaseTypes contains sqlserver and sqlite only
+- **TestValidDatabaseTypes**: TestValidDatabaseTypes checks ValidDatabaseTypes contains expected database types
 - **TestLoad_VariablesSection**: TestLoad_VariablesSection verifies the variables section with values
 - **TestLoad_VariablesDefaultValues**: TestLoad_VariablesDefaultValues verifies ${VAR:default} syntax works correctly
 - **TestLoad_VariablesEnvFileSupport**: TestLoad_VariablesEnvFileSupport verifies loading variables from env file
@@ -74,7 +74,7 @@ Run `make test-cover` for current coverage statistics.
 - **TestNewDriver_SQLite**: TestNewDriver_SQLite verifies factory creates SQLite driver with :memory: path
 - **TestNewDriver_SQLiteExplicit**: TestNewDriver_SQLiteExplicit confirms returned driver is *SQLiteDriver type
 - **TestNewDriver_EmptyTypeReturnsError**: TestNewDriver_EmptyTypeReturnsError ensures empty type is rejected
-- **TestNewDriver_MySQL_NotImplemented**: TestNewDriver_MySQL_NotImplemented confirms mysql type returns not-implemented error
+- **TestNewDriver_MySQL**: TestNewDriver_MySQL verifies factory creates MySQL driver (requires running MySQL)
 - **TestNewDriver_Postgres_NotImplemented**: TestNewDriver_Postgres_NotImplemented confirms postgres type returns not-implemented error
 - **TestNewDriver_UnknownType**: TestNewDriver_UnknownType rejects unrecognized database types like oracle
 - **TestNewDriver_SQLiteInvalidPath**: TestNewDriver_SQLiteInvalidPath ensures SQLite driver requires non-empty path
@@ -100,6 +100,33 @@ Run `make test-cover` for current coverage statistics.
 - **TestManager_ConcurrentReconnectAll**: TestManager_ConcurrentReconnectAll tests concurrent ReconnectAll calls
 - **TestManager_MixedDatabaseTypes**: TestManager_MixedDatabaseTypes manages SQLite connections with different readonly/settings
 
+### mysql_test.go
+
+- **TestBuildMySQLDSN_Default**: TestBuildMySQLDSN_Default verifies DSN construction with default port and settings
+- **TestBuildMySQLDSN_CustomPort**: TestBuildMySQLDSN_CustomPort verifies custom port is used in DSN
+- **TestBuildMySQLDSN_TLSOptions**: TestBuildMySQLDSN_TLSOptions tests all TLS/encrypt configuration variants
+- **TestBuildMySQLDSN_SpecialCharsInPassword**: TestBuildMySQLDSN_SpecialCharsInPassword verifies password with special chars is included as-is
+- **TestMySQLDriver_TranslateQuery**: TestMySQLDriver_TranslateQuery tests @param to ? positional placeholder translation
+- **TestMySQLDriver_TranslateQuery_Values**: TestMySQLDriver_TranslateQuery_Values verifies parameter values are correctly ordered
+- **TestMySQLDriver_TranslateQuery_NilValue**: TestMySQLDriver_TranslateQuery_NilValue verifies nil values are passed through
+- **TestMySQLIsolationToSQL**: TestMySQLIsolationToSQL tests conversion of config isolation strings to MySQL syntax
+- **TestMySQLDriver_ConfigurePool**: TestMySQLDriver_ConfigurePool verifies connection pool settings are applied
+- **TestMySQLDriver_ConfigValidation**: TestMySQLDriver_ConfigValidation tests that invalid configs produce errors
+- **TestNewMySQLDriver_Integration**: TestNewMySQLDriver_Integration verifies driver creation against a real MySQL instance
+- **TestNewMySQLDriver_ReadWrite**: TestNewMySQLDriver_ReadWrite confirms explicit readonly=false enables write mode
+- **TestMySQLDriver_Ping**: TestMySQLDriver_Ping confirms Ping returns nil for healthy connection
+- **TestMySQLDriver_Reconnect**: TestMySQLDriver_Reconnect tests connection re-establishment after close
+- **TestMySQLDriver_Config**: TestMySQLDriver_Config verifies Config() returns original configuration
+- **TestMySQLDriver_Query_Simple**: TestMySQLDriver_Query_Simple executes basic SELECT and validates returned columns
+- **TestMySQLDriver_Query_WithParams**: TestMySQLDriver_Query_WithParams verifies @param named parameters work correctly
+- **TestMySQLDriver_Query_NullParams**: TestMySQLDriver_Query_NullParams tests NULL parameter handling for optional filters
+- **TestMySQLDriver_Query_EmptyResult**: TestMySQLDriver_Query_EmptyResult confirms empty result set returns zero-length slice
+- **TestMySQLDriver_Query_Timeout**: TestMySQLDriver_Query_Timeout verifies context deadline expiration stops query
+- **TestMySQLDriver_Query_SpecialCharacters**: TestMySQLDriver_Query_SpecialCharacters ensures SQL injection strings are safely escaped
+- **TestMySQLDriver_Query_Unicode**: TestMySQLDriver_Query_Unicode validates CJK, Cyrillic, Arabic, and emoji preservation
+- **TestMySQLDriver_WriteOperations_RowsAffected**: TestMySQLDriver_WriteOperations_RowsAffected tests that write operations return correct rows affected
+- **TestMySQLDriver_Query_Concurrent**: TestMySQLDriver_Query_Concurrent runs parallel queries against MySQL
+
 ### sqlite_test.go
 
 - **TestNewSQLiteDriver_InMemory**: TestNewSQLiteDriver_InMemory verifies in-memory SQLite driver creation with :memory: path
@@ -148,6 +175,7 @@ Run `make test-cover` for current coverage statistics.
 - **TestValidateDatabase_InvalidType**: TestValidateDatabase_InvalidType ensures unsupported database types are rejected
 - **TestValidateDatabase_SQLite**: TestValidateDatabase_SQLite tests SQLite-specific validation: path, journal mode, timeout
 - **TestValidateDatabase_SQLServer**: TestValidateDatabase_SQLServer tests SQL Server validation: host, port, isolation, timeout
+- **TestValidateDatabase_MySQL**: TestValidateDatabase_MySQL tests MySQL-specific validation: host, port, user, password, database, isolation
 - **TestValidateDatabase_EnvVarWarning**: TestValidateDatabase_EnvVarWarning tests unresolved env vars generate warnings
 - **TestValidateLogging**: TestValidateLogging tests log level and rotation settings validation
 - **TestValidateDebug**: TestValidateDebug tests debug config validation rules