Lagun
A minimal, web-based MySQL/MariaDB GUI editor. Install it, run it, use it.
Features
- Web-based SQL editor with syntax highlighting, autocompletion, and multi-tab support
- Multi-statement execution — run multiple statements at once, each result shown in its own sub-tab
- Schema browser — explore databases, tables, columns, and indexes; resizable sidebar
- Schema management — create, modify, and drop tables, columns, and indexes
- In-line data editing — edit cells, insert rows, delete rows directly in the grid
- Import & export — CSV and SQL formats with streaming for large datasets; export respects active column filters
- Query history — full SQL with word wrap, copy or load any entry back into the editor
- Large write scripts — normal Execute can run 25+ writes in one backend transaction with rollback
- Bookmarks — save and organize frequently used tables
- Connection management — import and export connection configs
- Secure connections — SSL/TLS, credentials stored in OS keyring, encrypted session backup
- LDAP/AD authentication — optional, via ldapgate
Install
pip install lagun
Usage
lagun serve
Opens the GUI in your browser. Connect to any MySQL or MariaDB database from there.
Options:
--host TEXT Bind host. [default: 127.0.0.1]
--port INTEGER Bind port. [default: 8080]
--no-open Don't open the browser automatically.
--ldap-config PATH Path to ldapgate YAML config to enable LDAP authentication.
LDAP Authentication
Lagun can require users to log in via LDAP/AD before accessing the editor. This uses ldapgate as FastAPI middleware — no separate proxy process needed.
pip install 'lagun[ldap]'
lagun serve --ldap-config /path/to/ldapgate.yaml
For login bursts across at least 200 active users, size LDAPGate's bounded
connection pool and deadline in /path/to/ldapgate.yaml:
ldap:
timeout: 30
pool_size: 16
Shared connections and audit log
For LDAP deployments, an administrator can provide connections centrally and limit each one to selected LDAP usernames:
export LAGUN_DBS_PASSWORD='database-password'
lagun serve --ldap-config /etc/lagun/ldap.yaml --connections-config /etc/lagun/connections.yaml
connections:
- id: dbs-production
name: DBS Production
host: mariadb.internal
port: 3306
username: shared_mariadb_user
password_env: LAGUN_DBS_PASSWORD
default: true
selected_databases: [app, analytics]
allowed_users: [alice, bob]
Listed users can use the connection but cannot edit it. Removing it in the UI
only hides it for that user. LDAP users may also create private connections;
those are visible only to their owner. Edit this file and restart Lagun to
change shared access. Set selected_databases to limit the visible schema
browser/search scope for a managed connection; omit it or use an empty list to
show all non-system schemas the database user can access.
LDAP API activity is recorded in Lagun's local lagun.db, not in MariaDB.
By default that database is ~/.lagun/lagun.db; set LAGUN_DB to relocate the
whole local store (saved connections, settings, and audit events), for example
LAGUN_DB=/var/lib/lagun/lagun.db. Read it from the server with lagun audit and purge old entries with
lagun audit purge --older-than 90.
For direct local HTTP usage, set proxy.secure_cookies: false in the ldapgate
config. Keep secure_cookies: true in production and run Lagun behind HTTPS
with trusted_proxies configured so LDAPGate can honor X-Forwarded-Proto.
When LDAP is enabled, a logout button appears in the top-right corner of the tab bar.
Admin console
LDAP administrators can open /admin to inspect saved connection metadata,
review recent API activity, monitor live workspaces, and manage the LDAP
allowlist without restarting Lagun. Enable the screen with an explicit
administrator allowlist:
lagun serve \
--ldap-config /etc/lagun/ldap.yaml \
--admin-user alice \
--admin-user bob \
--connections-config /etc/lagun/connections.yaml
LAGUN_ADMIN_USERS=alice,bob is equivalent to repeating --admin-user.
Administrator access is LDAP-only and separate from connections.yaml
allowed_users; connection inventory never returns stored database passwords.
Access policy remains owned by LDAPGate and the server-managed connections file.
The Users & policy view atomically updates ldap.allowed_users, creates a
mode-restricted backup, revokes removed users' active LDAP sessions, and applies
changes to new logins immediately. It requires ldap.allowed_users to be an
explicit YAML list; group-only LDAP policy must be changed in its source
configuration instead.
The admin console also includes a live workspace view: authenticated browser
clients publish tab identity heartbeats, and active normal or bulk executions
are shown with session, database, tab, state, duration, and complete SQL. Live
table tabs also report the current schema/data view, database, table, row limit,
partial all-column search, and applied WHERE clause; un-applied filter drafts
are not reported. Presence is process-local and expires after 45 seconds
without a heartbeat.
Query and API audit records preserve raw request targets, including query parameters, and complete JSON request bodies. The audit form supports case-insensitive partial matching across user, method, path, SQL, filters, and raw JSON; Enter applies the current filters. Read-only admin polling is omitted so user database activity remains visible. Expanded bodies wrap and scroll vertically in the console.
See the ldapgate README for config file documentation.
Concurrent Deployments
Lagun bounds database work so bursts from many browser tabs queue instead of opening unlimited upstream connections. Defaults suit a single application instance serving a small or medium internal team:
LAGUN_DB_POOL_MAX_SIZE=10— connections per saved database session.LAGUN_DB_GLOBAL_CONNECTION_LIMIT=100— connections leased across all sessions.LAGUN_DB_ACQUIRE_TIMEOUT_SECONDS=10— maximum queue wait before HTTP 503.LAGUN_DB_POOL_IDLE_SECONDS=900— close pools unused for 15 minutes.LAGUN_QUERY_MAX_RUNTIME_SECONDS=30— normal query execution deadline.LAGUN_SQLITE_BUSY_SECONDS=10— local metadata/audit write wait.
Raise pool limits only after checking the connection ceilings and workload of
the target MySQL/MariaDB servers. Run one Lagun process per local lagun.db;
the SQLite metadata store and in-process query cancellation state are not
designed for shared multi-process deployment.
Large Write Scripts
For large write scripts (25+ INSERT, UPDATE, or DELETE statements), Lagun
can send the entire script to the backend in one request from the normal Execute
button. The backend executes all statements in order inside one transaction and
rolls back on first failure.
Set LAGUN_BULK_WRITE_THRESHOLD or VITE_LAGUN_BULK_WRITE_THRESHOLD at
frontend build time to change the UI threshold.
See docs/bulk-execution.md for API details, limits, admin configuration, and troubleshooting.
Screenshots
Development
Requires uv.
git clone https://github.com/anudeepd/lagun
cd lagun
uv sync
uv run lagun serve
License
MIT
1 maintainer
Metadata
1 maintainer
Release files for lagun 0.1.86
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| lagun-0.1.86.tar.gz | 1.4 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| lagun-0.1.86-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 2.7 MB
Release files / lagun-0.1.86.tar.gz
| Download URL | lagun-0.1.86.tar.gz |
|---|---|
| Size | 1.4 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
fc09bdc2cdc14cc158d951989fa9272cc4288b746841df7d732a1c8bb28733ba
|
|
BLAKE2b-256 checksum How to use checksums |
72d2676577b9701812067096acf8b97df62db49defe7c272806bdf24971528aa
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.23 {"installer":{"name":"uv","version":"0.11.23","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Fedora Linux","version":"44","id":"","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / lagun-0.1.86-py3-none-any.whl
| Download URL | lagun-0.1.86-py3-none-any.whl |
|---|---|
| Size | 1.4 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
933b51aa2d3ce8d79ea4cbf426fd9bc395e90e583dfd2fcae715044cfce64abe
|
|
BLAKE2b-256 checksum How to use checksums |
fe2807cdb579ad7b148eafe338ff8c5ce8dc4651467351014c9ee5a08e1cfca6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.23 {"installer":{"name":"uv","version":"0.11.23","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Fedora Linux","version":"44","id":"","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
