lagun 0.1.36

A web-based MySQL/MariaDB GUI editor

Lagun

A minimal, web-based MySQL/MariaDB GUI editor. Install it, run it, use it.

Features

• Web-based SQL editor with syntax highlighting, autocompletion, and multi-tab support
• Multi-statement execution — run multiple statements at once, each result shown in its own sub-tab
• Schema browser — explore databases, tables, columns, and indexes; resizable sidebar
• Schema management — create, modify, and drop tables, columns, and indexes
• In-line data editing — edit cells, insert rows, delete rows directly in the grid
• Import & export — CSV and SQL formats with streaming for large datasets; export respects active column filters
• Query history — full SQL with word wrap, copy or load any entry back into the editor
• Bookmarks — save and organize frequently used tables
• Connection management — import and export connection configs
• Secure connections — SSL/TLS, credentials stored in OS keyring, encrypted session backup
• LDAP/AD authentication — optional, via ldapgate

Install

pip install lagun

Usage

lagun serve

Opens the GUI in your browser. Connect to any MySQL or MariaDB database from there.

Options:

--host TEXT          Bind host. [default: 127.0.0.1]
--port INTEGER       Bind port. [default: 8080]
--no-open            Don't open the browser automatically.
--ldap-config PATH   Path to ldapgate YAML config to enable LDAP authentication.

LDAP Authentication

Lagun can require users to log in via LDAP/AD before accessing the editor. This uses ldapgate as FastAPI middleware — no separate proxy process needed.

pip install 'lagun[ldap]'
lagun serve --ldap-config /path/to/ldapgate.yaml

Shared connections and audit log

For LDAP deployments, an administrator can provide connections centrally and limit each one to selected LDAP usernames:

export LAGUN_DBS_PASSWORD='database-password'
lagun serve --ldap-config /etc/lagun/ldap.yaml --connections-config /etc/lagun/connections.yaml

connections:
  - id: dbs-production
    name: DBS Production
    host: mariadb.internal
    port: 3306
    username: shared_mariadb_user
    password_env: LAGUN_DBS_PASSWORD
    default: true
    selected_databases: [app, analytics]
    allowed_users: [alice, bob]

Listed users can use the connection but cannot edit it. Removing it in the UI only hides it for that user. LDAP users may also create private connections; those are visible only to their owner. Edit this file and restart Lagun to change shared access. Set selected_databases to limit the visible schema browser/search scope for a managed connection; omit it or use an empty list to show all non-system schemas the database user can access.

LDAP API activity is recorded in Lagun's local lagun.db, not in MariaDB. By default that database is ~/.lagun/lagun.db; set LAGUN_DB to relocate the whole local store (saved connections, settings, and audit events), for example LAGUN_DB=/var/lib/lagun/lagun.db. Read it from the server with lagun audit and purge old entries with lagun audit purge --older-than 90.

For direct local HTTP usage, set proxy.secure_cookies: false in the ldapgate config. Keep secure_cookies: true in production and run Lagun behind HTTPS with trusted_proxies configured so LDAPGate can honor X-Forwarded-Proto.

When LDAP is enabled, a logout button appears in the top-right corner of the tab bar.

See the ldapgate README for config file documentation.

Screenshots

Development

Requires uv.

git clone https://github.com/anudeepd/lagun
cd lagun
uv sync
uv run lagun serve

License

MIT