Bottom Line: Log Into Adminer With a MariaDB Administrative Account, Then Create a Least-Privilege Sensor User
The normal CasaOS user is not automatically a MariaDB administrator. Database privileges live inside MariaDB. Use the MariaDB root/admin credentials defined for the container, then create a separate database and a sensor account that can insert only where needed.
Create the Database and Restricted User
CREATE DATABASE sensor_data
CHARACTER SET utf8mb4
COLLATE utf8mb4_unicode_ci;
CREATE USER 'sensor_writer'@'192.168.1.%'
IDENTIFIED BY 'REPLACE_WITH_A_STRONG_PASSWORD';
GRANT INSERT ON sensor_data.readings
TO 'sensor_writer'@'192.168.1.%';
SHOW GRANTS FOR 'sensor_writer'@'192.168.1.%';MariaDB's CREATE USER and GRANT documentation define the privilege model.
Use a Host Scope Narrower Than %
MariaDB accounts are 'user'@'host'. Restrict the account to the sensor subnet or specific IPs instead of allowing every host. The remote-access guide covers host grants and bind/listen behavior.
Adminer Is Only the Management UI
Adminer does not create privileges outside what the logged-in MariaDB account already has. If “Access denied” appears while logged in as a low-privilege application account, switch to the database admin account for schema/user administration. The Adminer hardware and deployment guide and MariaDB hardware guide separate the UI from the database server.
Expose Port 3306 Only to the LAN Segment That Needs It
Remote sensors need TCP access to MariaDB, but that does not mean the database belongs on the public internet. Bind/publish it only on the trusted LAN, use a firewall where appropriate, and test from one sensor host before widening access.
Back Up Before the Sensor Project Becomes Important
Once readings matter, back up the database—not just the container. Persistent storage, SQL dumps and restore testing are more important than the Adminer UI itself. The ZimaOS App Store hardware directory helps size the broader stack.
