<p align="center">
  <img src="https://raw.githubusercontent.com/anudeepd/lagun/main/assets/logo.svg" alt="Lagun" width="120"/>
</p>

<h1 align="center">Lagun</h1>

<p align="center">A minimal, web-based MySQL/MariaDB GUI editor. Install it, run it, use it.</p>

## Features

- **Web-based SQL editor** with syntax highlighting, autocompletion, and multi-tab support
- **Multi-statement execution** — run multiple statements at once, each result shown in its own sub-tab
- **Schema browser** — explore databases, tables, columns, and indexes; resizable sidebar
- **Schema management** — create, modify, and drop tables, columns, and indexes
- **In-line data editing** — edit cells, insert rows, delete rows directly in the grid
- **Import & export** — CSV and SQL formats with streaming for large datasets; export respects active column filters
- **Query history** — full SQL with word wrap, copy or load any entry back into the editor
- **Large write scripts** — normal Execute can run 25+ writes in one backend transaction with rollback
- **Bookmarks** — save and organize frequently used tables
- **Connection management** — import and export connection configs
- **Secure connections** — SSL/TLS, credentials stored in OS keyring, encrypted session backup
- **LDAP/AD authentication** — optional, via [ldapgate](https://github.com/anudeepd/ldapgate)

## Install

```bash
pip install lagun
```

## Usage

```bash
lagun serve
```

Opens the GUI in your browser. Connect to any MySQL or MariaDB database from there.

Options:

```
--host TEXT          Bind host. [default: 127.0.0.1]
--port INTEGER       Bind port. [default: 8080]
--no-open            Don't open the browser automatically.
--ldap-config PATH   Path to ldapgate YAML config to enable LDAP authentication.
```

## LDAP Authentication

Lagun can require users to log in via LDAP/AD before accessing the editor. This uses [ldapgate](https://github.com/anudeepd/ldapgate) as FastAPI middleware — no separate proxy process needed.

```bash
pip install 'lagun[ldap]'
lagun serve --ldap-config /path/to/ldapgate.yaml
```

### Shared connections and audit log

For LDAP deployments, an administrator can provide connections centrally and
limit each one to selected LDAP usernames:

```bash
export LAGUN_DBS_PASSWORD='database-password'
lagun serve --ldap-config /etc/lagun/ldap.yaml --connections-config /etc/lagun/connections.yaml
```

```yaml
connections:
  - id: dbs-production
    name: DBS Production
    host: mariadb.internal
    port: 3306
    username: shared_mariadb_user
    password_env: LAGUN_DBS_PASSWORD
    default: true
    selected_databases: [app, analytics]
    allowed_users: [alice, bob]
```

Listed users can use the connection but cannot edit it. Removing it in the UI
only hides it for that user. LDAP users may also create private connections;
those are visible only to their owner. Edit this file and restart Lagun to
change shared access. Set `selected_databases` to limit the visible schema
browser/search scope for a managed connection; omit it or use an empty list to
show all non-system schemas the database user can access.

LDAP API activity is recorded in Lagun's local `lagun.db`, not in MariaDB.
By default that database is `~/.lagun/lagun.db`; set `LAGUN_DB` to relocate the
whole local store (saved connections, settings, and audit events), for example
`LAGUN_DB=/var/lib/lagun/lagun.db`. Read it from the server with `lagun audit` and purge old entries with
`lagun audit purge --older-than 90`.

For direct local HTTP usage, set `proxy.secure_cookies: false` in the ldapgate
config. Keep `secure_cookies: true` in production and run Lagun behind HTTPS
with `trusted_proxies` configured so LDAPGate can honor `X-Forwarded-Proto`.

When LDAP is enabled, a logout button appears in the top-right corner of the tab bar.

See the [ldapgate README](https://github.com/anudeepd/ldapgate) for config file documentation.

## Large Write Scripts

For large write scripts (25+ `INSERT`, `UPDATE`, or `DELETE` statements), Lagun
can send the entire script to the backend in one request from the normal Execute
button. The backend executes all statements in order inside one transaction and
rolls back on first failure.
Set `LAGUN_BULK_WRITE_THRESHOLD` or `VITE_LAGUN_BULK_WRITE_THRESHOLD` at
frontend build time to change the UI threshold.

See [docs/bulk-execution.md](docs/bulk-execution.md) for API details, limits,
admin configuration, and troubleshooting.

## Screenshots

<p align="center">
  <img src="https://raw.githubusercontent.com/anudeepd/lagun/main/assets/img_1.png" alt="SQL Editor" width="100%"/>
  <img src="https://raw.githubusercontent.com/anudeepd/lagun/main/assets/img_2.png" alt="Schema View" width="100%"/>
  <img src="https://raw.githubusercontent.com/anudeepd/lagun/main/assets/img_3.png" alt="Data View with Search" width="100%"/>
  <img src="https://raw.githubusercontent.com/anudeepd/lagun/main/assets/img_4.png" alt="Data View with Filter" width="100%"/>
</p>

## Development

Requires [uv](https://github.com/astral-sh/uv).

```bash
git clone https://github.com/anudeepd/lagun
cd lagun
uv sync
uv run lagun serve
```

## License

MIT
