Safety

Safety

propq is designed to run against production MySQL/MariaDB servers. Safety is baked in — destructive operations are blocked by default, and everything defaults to fail-closed.

Destructive SQL protection

DROP, TRUNCATE, DELETE, ALTER (and UPDATE) are blocked unless you pass --force:

# Blocked with an error
propq --sql "DROP TABLE temp" -s prod

# Allowed explicitly
propq --sql "DROP TABLE temp" -s prod --force

The --force flag is the single source of truth — it overrides nothing else; without it the query never runs.

No-filter confirmation

If you run without any database filter (-d / -D), propq would target every database on the matching servers. To prevent accidents, it prompts for confirmation first:

# propq.toml — disable the prompt only if you really mean it
[defaults]
confirm_without_filter = true   # default: prompt

Skip the prompt per-run with --no-confirm.

Transactions & --ask-for-commit

By default, each target's SQL runs inside a transaction that commits on success and rolls back on error.

• --no-transaction — autocommit mode (each statement commits immediately). Use only when the SQL manages its own transactions.
• --ask-for-commit — show a summary of targets first, then ask before committing:

propq -s www6 -a -d "300" --ask-for-commit \
  --sql "DELETE FROM logs WHERE date < NOW() - INTERVAL 30 DAY"

Dry run

Preview exactly which servers/databases would be targeted — no SQL is executed:

propq --sql "DROP TABLE temp" -s prod --dry-run

Combine with --json for a CI-safe preflight:

propq --json --dry-run --sql "DROP TABLE temp" -s prod

Defensive defaults recap

Behaviour	Default
Destructive SQL	❌ blocked without --force
No DB filter	🔒 confirmation prompt (confirm_without_filter = true)
Run scope	per-server (fast), not per-database
Transactions	✅ wrapped per target
New risky behaviour	always defaults to off (fail-closed policy)

Operational hygiene

• Use a dedicated MySQL user with the least privilege needed.
• Never commit real credentials — propq.toml is gitignored; the repo only ships propq.toml.example with placeholders.
• Prefer --dry-run + --json in scripts that touch production.
• On flaky networks, --retry N retries failed databases with exponential backoff.

Next: Examples