diff --git a/CHANGELOG.md b/CHANGELOG.md
index ab0d0ced..eee08070 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,9 @@ The **patch** part changes incrementally at each release.
 ## [Unreleased]
 
 ### Added
+* mysql: activate binary logs by specifying log_bin path
+* mysql: specify a custom server_id
+* mysql: option to define as read only
 
 ### Changed
 
@@ -47,8 +50,6 @@ The **patch** part changes incrementally at each release.
 * minifirewall: add a variable to force the check scripts update
 * mongodb: mongodb: compatibility with Debian 10
 * mysql-oracle: backport tasks from mysql role
-* mysql: activate binary logs by specifying log_bin path
-* mysql: specify a custom server_id
 * networkd-to-ifconfig: add variables for configuration by variables
 * packweb-apache: Deploy opcache.php to give some insights on PHP's opcache status
 * php: variable to install the mysqlnd module instead of the default mysql module
diff --git a/mysql/defaults/main.yml b/mysql/defaults/main.yml
index 49115ee9..8d8771fa 100644
--- a/mysql/defaults/main.yml
+++ b/mysql/defaults/main.yml
@@ -52,4 +52,4 @@ mysql_binlog_format: mixed
 mysql_server_id: null
 mysql_bind_address: null
 mysql_repl_password: ''
-
+mysql_read_only: 0
diff --git a/mysql/templates/evolinux-custom.cnf.j2 b/mysql/templates/evolinux-custom.cnf.j2
index d33a4f2b..63d7ea2d 100644
--- a/mysql/templates/evolinux-custom.cnf.j2
+++ b/mysql/templates/evolinux-custom.cnf.j2
@@ -38,3 +38,4 @@ lower_case_table_names = {{ mysql_lower_case_table_names }}
 {% if mysql_innodb_log_file_size %}
 innodb_log_file_size = {{ mysql_innodb_log_file_size }}
 {% endif %}
+read_only = {{ mysql_read_only }}