--- /dev/null
+++ b/docs/configuration/inbound/mysql.md
@@ -0,0 +1,56 @@
+// OMV
+
+### Structure
+
+```json
+{
+  "type": "mysql",
+  "tag": "mysql-in",
+
+  ... // Listen Fields
+
+  "users": [
+    {
+      "user": "root",
+      "password": "my_password"
+    }
+  ],
+  "tls": {},
+  "multiplex": {}
+}
+```
+
+### Listen Fields
+
+See [Listen Fields](/configuration/shared/listen/) for details.
+
+### Fields
+
+#### users
+
+MySQL users for authentication during the handshake.
+
+#### tls
+
+==Required==
+
+TLS configuration, see [TLS](/configuration/shared/tls/#inbound).
+
+TLS must be enabled because the MySQL protocol uses TLS negotiation during the handshake phase.
+
+#### multiplex
+
+See [Multiplex](/configuration/shared/multiplex#inbound) for details.
+
+### Description
+
+The MySQL inbound uses the MySQL protocol handshake for TLS negotiation, then runs smux multiplexing over the encrypted connection.
+
+The connection flow is:
+
+1. Client connects and performs a standard MySQL handshake (using [go-mysql](https://github.com/go-mysql-org/go-mysql))
+2. TLS is negotiated as part of the MySQL handshake
+3. After handshake, smux sessions are multiplexed over the TLS connection
+4. Each smux stream carries a 1-byte command (`0x01` for TCP, `0x03` for UDP) followed by a SOCKS address header
+
+This makes the traffic appear as a normal MySQL TLS connection to network observers.