lagun 0.1.33

A web-based MySQL/MariaDB GUI editor

Lagun

A minimal, web-based MySQL/MariaDB GUI editor. Install it, run it, use it.

Features

• Web-based SQL editor with syntax highlighting, autocompletion, and multi-tab support
• Multi-statement execution — run multiple statements at once, each result shown in its own sub-tab
• Schema browser — explore databases, tables, columns, and indexes; resizable sidebar
• Schema management — create, modify, and drop tables, columns, and indexes
• In-line data editing — edit cells, insert rows, delete rows directly in the grid
• Import & export — CSV and SQL formats with streaming for large datasets; export respects active column filters
• Query history — full SQL with word wrap, copy or load any entry back into the editor
• Bookmarks — save and organize frequently used tables
• Connection management — import and export connection configs
• Secure connections — SSL/TLS, credentials stored in OS keyring, encrypted session backup
• LDAP/AD authentication — optional, via ldapgate

Install

pip install lagun

Usage

lagun serve

Opens the GUI in your browser. Connect to any MySQL or MariaDB database from there.

Options:

--host TEXT          Bind host. [default: 127.0.0.1]
--port INTEGER       Bind port. [default: 8080]
--no-open            Don't open the browser automatically.
--ldap-config PATH   Path to ldapgate YAML config to enable LDAP authentication.

LDAP Authentication

Lagun can require users to log in via LDAP/AD before accessing the editor. This uses ldapgate as FastAPI middleware — no separate proxy process needed.

pip install 'lagun[ldap]'
lagun serve --ldap-config /path/to/ldapgate.yaml

Shared connections and audit log

For LDAP deployments, an administrator can provide connections centrally and limit each one to selected LDAP usernames:

export LAGUN_DBS_PASSWORD='database-password'
lagun serve --ldap-config /etc/lagun/ldap.yaml --connections-config /etc/lagun/connections.yaml

connections:
  - id: dbs-production
    name: DBS Production
    host: mariadb.internal
    port: 3306
    username: shared_mariadb_user
    password_env: LAGUN_DBS_PASSWORD
    default: true
    allowed_users: [alice, bob]

Listed users can use the connection but cannot edit it. Removing it in the UI only hides it for that user. LDAP users may also create private connections; those are visible only to their owner. Edit this file and restart Lagun to change shared access.

LDAP API activity is recorded in Lagun's local lagun.db, not in MariaDB. By default that database is ~/.lagun/lagun.db; set LAGUN_DB to relocate the whole local store (saved connections, settings, and audit events), for example LAGUN_DB=/var/lib/lagun/lagun.db. Read it from the server with lagun audit and purge old entries with lagun audit purge --older-than 90.

For direct local HTTP usage, set proxy.secure_cookies: false in the ldapgate config. Keep secure_cookies: true in production and run Lagun behind HTTPS with trusted_proxies configured so LDAPGate can honor X-Forwarded-Proto.

When LDAP is enabled, a logout button appears in the top-right corner of the tab bar.

See the ldapgate README for config file documentation.

Screenshots

Development

Requires uv.

git clone https://github.com/anudeepd/lagun
cd lagun
uv sync
uv run lagun serve

License

MIT