mysql_secure_installation
# /etc/mysql/mariadb.conf.d/99-security.cnf
# bind-address = 127.0.0.1
# local-infile = 0
CREATE USER 'webapp'@'localhost' IDENTIFIED BY 'StrongPass!';
GRANT SELECT, INSERT, UPDATE, DELETE ON myapp.* TO 'webapp'@'localhost';
Check bind-address! MariaDB may listen on 0.0.0.0 by default. Set it to 127.0.0.1 if external access is not needed.