diff --git a/module/mysql/module.sh b/module/mysql/module.sh
new file mode 100644
index 0000000..11215bd
--- /dev/null
+++ b/module/mysql/module.sh
@@ -0,0 +1,223 @@
+#!/bin/bash
+#
+# module.sh - mysql
+#
+# Copyright 2019 Luigi Santivetti <luigi.santivetti@gmail.com>
+
+# Permission is hereby granted, free of charge, to any person obtaining a
+# copy of this software and associated documentation files (the "Software"),
+# to deal in the Software without restriction, including without limitation
+# the rights to use, copy, modify, merge, publish, distribute, sublicense,
+# and/or sell copies of the Software, and to permit persons to whom the
+# Software is furnished to do so, subject to the following conditions:
+
+# The above copyright notice and this permission notice (including the next
+# paragraph) shall be included in all copies or substantial portions of the
+# Software.
+
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+# ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+# IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+# CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+declare -r module="mysql"
+source $common_sh
+
+module_enable $module
+
+declare -r etc_d="$mod_rootfs_d/etc"
+declare -r initdb_d="$mod_docker_d"
+declare -r var_d="$mod_rootfs_d/var"
+
+declare -r mycnf_d="$etc_d/mysql"
+declare -r mysql_d="$var_d/lib/mysql"
+declare -r log_d="$var_d/log/mysql"
+
+declare -ir mysql_uid="999"
+
+declare -ir mysql_has_dummy_certs=1
+if [ $mysql_has_dummy_certs -eq 1 ]; then
+	declare -r certificates_d="$mod_staging_d/${module}_dummy_cert"
+	declare -r ca_key_f="$certificates_d/${module}_dummy-ca-key.pem"
+	declare -r ca_f="$certificates_d/${module}_dummy-ca.pem"
+
+	declare -r server_key_f="$certificates_d/${module}_dummy-server-key.pem"
+	declare -r server_req_f="$certificates_d/${module}_dummy-server-req.pem"
+	declare -r server_cert_f="$certificates_d/${module}_dummy-server-cert.pem"
+
+	declare -r client_key_f="$certificates_d/${module}_dummy-client-key.pem"
+	declare -r client_req_f="$certificates_d/${module}_dummy-client-req.pem"
+	declare -r client_cert_f="$certificates_d/${module}_dummy-client-cert.pem"
+
+	# Dup ca to avoid bind mounting the same file twice
+	declare -r ca_dup_f="$certificates_d/${module}_dummy-ca-dup.pem"
+else
+	lets -l -e "official CA certificates not supported"
+	exit 1
+fi
+declare -r certificates_l="$etc_d/mysql_ssl"
+
+# Output files
+declare -r dockerfile="Dockerfile"
+declare -r dockerfile_f="$mod_docker_d/$dockerfile"
+declare -r initdb_f="$initdb_d/initdb.sql"
+declare -r mycnf_f="$mycnf_d/my.cnf"
+declare -r log_error_f="$log_d/error.txt"
+declare -r log_general_f="$log_d/general.txt"
+declare -r log_query_f="$log_d/query.txt"
+declare -r mysql_cli_bang_f="$mod_docker_d/mysql-cli.sh"
+
+declare -ar mod_more_dirs=( \
+	$etc_d $initdb_d $var_d $mycnf_d $log_d $mysql_d \
+)
+
+declare -ar mod_more_files=( $mycnf_f $initdb_f $dockerfile_f $mysql_cli_bang_f )
+declare -ar mod_more_trefs=( mycnf_t initdb_t dockerfile_t mysql_cli_bang_t )
+
+function tod_watch
+{
+	__watch_module_common || return $s_err
+}
+
+function tod_doins
+{
+	__doins_module_common || return $s_err
+	__mysql_do_log_files  || return $s_err
+
+	# Use certificates provided by Apache
+	__mysql_do_dummy_cert || return $s_err
+	__mysql_do_links      || return $s_err
+}
+
+function tod_clins
+{
+	__clins_module_common  || return $s_err
+	__mysql_undo_log_files || return $s_err
+}
+
+function tod_upins
+{
+	__upins_module_common || return $s_err
+
+	# Use ceritificates provided by Apache
+	__mysql_do_dummy_cert || return $s_err
+}
+
+function tod_doall
+{
+	tod_doins
+}
+
+function tod_upall
+{
+	tod_upins
+}
+
+function __mysql_do_dummy_cert_helper
+{
+	# Credits:
+	# https://techsparx.com/software-development/docker/damp/mysql-ssl-connection.html
+
+	local -r OPENSSL_SUBJ="/C=US/ST=Utopia/L=Neverland"
+	local -r OPENSSL_CA="${OPENSSL_SUBJ}/CN=dummy-CA"
+	local -r OPENSSL_SERVER="${OPENSSL_SUBJ}/CN=dummy-server"
+	local -r OPENSSL_CLIENT="${OPENSSL_SUBJ}/CN=dummy-client"
+
+	# Generate new CA certificate ca.pem file.
+	openssl genrsa 2048 > $ca_key_f
+
+	# TODO This has interaction that must be automated
+	openssl req -new -x509 -nodes -days 3600 \
+			-subj "${OPENSSL_CA}" \
+			-key $ca_key_f -out $ca_f
+
+	# Create the server-side certificates
+	# This has more interaction that must be automated
+
+	openssl req -newkey rsa:2048 -days 3600 -nodes \
+			-subj "${OPENSSL_SERVER}" \
+			-keyout $server_key_f -out $server_req_f
+	openssl rsa -in $server_key_f -out $server_key_f
+
+	openssl x509 -req -in $server_req_f -days 3600 \
+			-CA $ca_f -CAkey $ca_key_f -set_serial 01 -out $server_cert_f
+
+	# Create the client-side certificates
+	openssl req -newkey rsa:2048 -days 3600 -nodes \
+			-subj "${OPENSSL_CLIENT}" \
+			-keyout $client_key_f -out $client_req_f
+	openssl rsa -in $client_key_f -out $client_key_f
+
+	openssl x509 -req -in $client_req_f -days 3600 \
+			-CA $ca_f -CAkey $ca_key_f -set_serial 01 -out $client_cert_f
+
+	# Verify the certificates are correct
+	openssl verify -CAfile \
+			$ca_f $server_cert_f $client_cert_f || return $s_err
+
+	# Duplicate ca as it needs to be mounted client side
+	cp -ar $ca_f $ca_dup_f
+
+	set_mode "0644" $mysql_uid \
+			 $ca_f $ca_dup_f \
+			 $server_key_f $server_req_f $server_cert_f \
+			 $client_key_f $client_req_f $client_cert_f || return $s_err
+
+	set_mode "0600" $mysql_uid $ca_key_f || return $s_err
+}
+
+function __mysql_do_dummy_cert
+{
+	if [ $mysql_has_dummy_certs -eq 1 ]; then
+		if [ ! -d $certificates_d ]; then
+			mkdir -p $certificates_d && \
+				pushd $certificates_d >/dev/null || return $s_err
+			__mysql_do_dummy_cert_helper 2>&1 | lets -l -x "openssl"
+			case "${PIPESTATUS[0]}" in
+				$s_err ) lets -l -e "failed to make dummy certificates"
+						 popd >/dev/null; return $s_err ;;
+			esac
+			popd >/dev/null
+		fi
+	fi;
+
+	lets -l -i "$module SSL cert from: ${certificates_d#$script_dir/}"
+	return $s_ok
+}
+
+function __mysql_do_links
+{
+	# NOTE: container path must match localhost path
+	#
+	# i.e.
+	#    localhost:/etc container:/etc                 OK
+	#    localhost:/home/luigi container:/home/???     NOT OK
+	#
+	ln -sf "${certificates_d}" "${certificates_l}"
+}
+
+function __mysql_do_log_files
+{
+	sudo touch $log_error_f $log_general_f $log_query_f || {
+		lets -l -e "failed to touch log files"; return $s_err
+	}
+
+	set_mode "0755" $mysql_uid $log_d || {
+		lets -l -e "failed to set mode $log_d"; return $s_err
+	}
+
+	set_mode "0644" $mysql_uid $log_error_f $log_general_f $log_query_f || {
+		lets -l -e "failed to set mode log files"; return $s_err
+	}
+}
+
+function __mysql_undo_log_files
+{
+	sudo rm -f $log_error_f $log_general_f $log_query_f || {
+		lets -l -e "failed remove log files"; return $s_err
+	}
+
+	__mysql_do_log_files
+}