The Databases tool (MariaDB, PostgreSQL, MongoDB)
The engine is the thing you enter: its own band, the same menu on every engine (Overview alone; Data, Access, Cluster, Settings as folded menus), what is behind each differing by engine, and a screen that is not there yet saying so. "Writes go elsewhere" is said once at the top on every tab of a secondary, standby, arbiter or read replica, with the door to the primary; a config server or shard member takes no data writes (its banner opens a router). The database login Lens keeps on the box (/root/.lens-mongo, .lens-mongos, /root/.my.cnf, the SQL equivalents) is tested first, kept on the box, never here.
Overview and "where this box stands". The service and the three numbers; the uninstall beside the restart, away from the tab strip. Under it, the topology drawn small: nothing when the box stands alone, the set with this box outlined and the primary marked, the whole cluster with this box's piece outlined, a router with every piece of the cluster as a tile — each box's dot from what its own box said (green answered, red systemd says not running, yellow runs but did not answer, grey no shell asked). From here: "The set, maintained" (rolling restart, rolling upgrade, FCV for Mongo; the pair one member at a time, replicas first, primary last, for the SQL engines) and the servers' Linux updates walked the same safe order — config set, shards rolling, routers one at a time from a router's page.
Databases. Every database as a thing: what it holds, what it weighs, who reaches it. Opened: every collection or table with its numbers, every index with its shape and whether anything has used it, what runs against it this second, the profiler and the slow operations MongoDB kept, its backups. Verbs on the row, the engine's own: a collection made (ordinary, capped, time series with its retention), renamed, emptied, compacted, validated or dropped; an index made, hidden or dropped; a validator written; a user given the database or made for it. New database makes one with a user of its own that sees nothing else. Why a verb waits is said beside it — never a grey button and silence.
Explorer. MongoDB the Compass way: a collection, a filter in mongosh's own syntax, documents as a table or as they print, one opened and edited as text, a pipeline run, the collection sampled for its schema, the planner asked what it does, bulk actions and moving documents, a collection made from here. The SQL engines the Studio way: a table, its columns, the statement typed and run — reads free, writes behind a tick — rows as a grid with a cell changed where it is and a row added on the last line, filters as chips or a WHERE by hand, the columns edited in place, indexes, foreign keys, a table made from typed columns or from a file (its columns read off the header and the values). Export as JSON lines, CSV or Excel (which fields, which order) and import, each a job in front of everything while it runs.
Users. Every account opened: each database it may touch and at what level, locked or not, how its password is hashed, whether it must use TLS, how many connections it holds right now, and the verbs that change each. A new user gets a password made here and shown once, or a certificate minted on the box; an app gets its own database and nothing else. MongoDB by its own role names and a catalog of custom roles (collection-level access), where a user may connect from (the only thing between a leaked password and anyone using it), roles resolved into "can do"; MariaDB's grant privileges; PostgreSQL's; SQL Server's fixed roles, read.
Connect apps. The one page an app developer needs: what the apps connect to (this box, every member of the set, every router of the cluster), the URI, whether the door speaks TLS and the CA to trust it by (Download ca.pem), how to reach it from this computer (a tunnel), and the job that connects the app servers: drop the backends' boxes from the tree and one job lets each in on every door from the address it actually leaves from (ip route get), writes the CA at /etc/lens/mongo/<n>-ca.pem when the door speaks TLS, proves the wires and prints the URI per box. For the cache: URL and a snippet per driver.
Backups. Every dump of this engine on the box — mongodump archive, mysqldump, pg_dump, a SQL Server .bak — under /var/backups/lens/databases with a note saying what each is; Back up now as a job with three doors (kept on the box, brought to this computer and taken off the box, both); scheduled backups as plans on the box (the same cards and sheet as the server's Backups: which databases, collections or tables to leave out, when, keep N, where among the repositories, encrypted to the operator's key); Put back into the database it came from or into another name; download with the Files transfer; a dump uploaded from another box shows in the list and goes back the same way. The databases no plan covers are a finding. A shard member or config server is never dumped here — the cluster is backed up through a router.
Performance and Metrics. What is slow on this member from the log mongod keeps anyway (every operation over slowOpThresholdMs, on every database, profiler or no profiler), grouped by the shape of the query — same fields and operators, whatever the values — costliest first: how often, how long, what the planner did, which app sent it; a shape that scans gets the index that would stop it, checked against the indexes the collection has (exists, covered, extends, new), and one click makes it. Metrics: operations per second by kind, connections, the WiredTiger cache, what is queued, the network, and for a set the lag of every member, sampled every two seconds while on screen and drawn like Monitor; the sampler the box keeps (the last hour to the last week, from the box itself), a TRACE that keeps sampling after you leave, and a report as one HTML file with the charts drawn into it.
Security. Everything after the firewall, as verdicts in words with the switch on each row: who may authenticate and how (pg_hba.conf as PostgreSQL parsed it, MongoDB authorization), whether the wire is encrypted (the authority on the box and the engine's own certificate; certificate logins), which dangerous features are on, whether failed logins get an address banned, whether the files the engine trusts are readable by the wrong people; rows whose fix lives on another tab say which; "Lens let in" fixes the login Lens keeps on the box.
Firewall (per engine). The engine's port as THREE SEPARATE LISTS read from every member through the shells Lens opens with their saved logins (all at once): the cluster's own addresses (how the members reach each other), external addresses let in on every node (the app servers — the driver may send them to any member, so all must agree), and this node only (a read-only replica's own clients, a reporting box); a fourth, folded, for what is on other nodes and not here. Keyed by IP with an "On" column naming where each is let in; a verb on one node touches that node only, written through the same guarded change the Firewall screen uses. "Add my current IP"; on a router's page any address goes on every router. Auto-set firewall (add-only, never removes an address) on a set's band works from rs.status() and needs no filing.
Settings and Advanced settings. The engine's configuration as rows, not a file: each setting read from the engine itself, said in words for someone who does not know what innodb_buffer_pool_size is, with what the box's RAM says it should be, changed on the spot (a draft per row, applied together, restart-due read from the files). Settings is how the engine is used — where it listens, how many may connect, what gets logged; Advanced is the tuning under it — memory, durability, autovacuum, timeouts — and the file itself by hand. Lens writes ONE file of its own on the box, never the distribution's, and a restart is always the checked kind: if the engine does not come back the previous file goes back and it is restarted again. A restart on a set's primary steps it down first; on a SQL primary it asks instead of refusing.
Replication (MongoDB). The server is the door, the cluster is the thing: a replica set is a relationship filed once (members, addresses, roles) and every member's tab shows the same page with "you are here". Members are added by dragging servers onto the Members table (a box without MongoDB is offered the install at the set's version; a box on a Lens VPN is offered its private address), read in parallel. Apply makes the boxes match — keyfile, bind, port, set name, checked restarts, every wire proved from the box, then rs.initiate() from here or rs.add() from the primary; "File this set" adopts a running set Lens never saved; set identity is replicaSetId, never the name. On the page: the set as a canvas (every member a box, every pair a wire on the port in both directions, proved every half minute until Stop, red with the reason), Step down on the PRIMARY's row, Remove, Auto-set firewall, Re-apply the filing, Disband; "The set, maintained": versions per member, rolling restart, rolling upgrade, FCV, the oplog read on every member and resized on all of them, compact walked member by member. TLS between members is a MUST and is Lens's: Lens is the set's CA (private keys never leave Go, the record on the cluster), rolling allowTLS→preferTLS→requireTLS, renewal without restart, Turn off. Everything long goes through the blocking lightbox with names from the first second.
Replication (MariaDB and PostgreSQL). The same page on the same frame: one primary and its replicas (PostgreSQL says standbys) filed once with a role per member; lead (this box is the primary, pick the replicas) or follow (pick the primary, this box is a replica). Apply makes the primary ready, lets every member in on the port, and each new replica seeds itself from the primary over that port from its own box (mariadb-dump for MariaDB, pg_basebackup for PostgreSQL) — no SSH key or relay between boxes — and follows; a member gets the engine at the SAME version the pair runs. Promote as a switchover or a failover, Rejoin, Remove, Disband the pair, Auto-set firewall; TLS between the members Mongo's way (Lens the pair's CA in the vault, one job across all members, Turn on / Renew / Turn off, apps untouched); "The pair, maintained" (rolling restart, rolling upgrade within the series, replicas first, primary last). A pair built by other hands is filed from what the primary sees. A MariaDB replica restart that changes its drop-in goes STOP SLAVE + RESET SLAVE, the checked restart, CHANGE MASTER TO again, START SLAVE, polled until it follows.
Sharding (MongoDB). A sharded cluster is replica sets stacked, so the builder is drop boxes: config servers (fresh boxes), shards (servers, or a set already filed), mongos (the app boxes), each with a plain title and one hint line. Name it, Build: one job on the card — every set given the cluster's one keyfile and its role, mongos on each app box, addShard from a mongos — with every box read at once before it starts. After that the tab is the cluster's picture through a mongos on every piece: the doors and the map on the left, the shards on the right, a card per database with what is sharded and where it sits; shard a collection on a key (a blocking job with a "spread it now" tick; sharded collections as cards with per-shard bars and the balancer's verdict), chunk size, the balancer, Drain a shard (the uninstall ceremony), Grow (drop more boxes, Apply puts them in), Upgrade the set when a newer MongoDB is in the repo, Re-apply the filing, Disband. Routers: a mongos box is a "MongoDB router" engine with its own page (Overview, Databases, Explorer, Users, Backups, Sharding, Firewall, Settings, Advanced); a router's row shows address:port · up/paused with Start it (its own job that waits until config.mongos has heard from it), Pause/Resume, Detach (stopped, unit and login removed, its allow closed on every piece, its config.mongos entry cleared through another router). Cluster-wide TLS: one CA per cluster, Finish TLS skips a paused router with a line, whole-cluster rolling Restart, the Linux updates + reboots walk. The FIREWALL PASS is every box at once, one script per box per phase (on firewalld all rules in one --permanent and one runtime call, never --reload), a box with no progress named after 10 s, a held box given up on with what holds it. The canvas: mongos on the top row, the config set in the middle, the shards below wrapping three to a row, no wires among routers (a mongos never talks to a mongos); Confirm connectivity proves EVERY wire again, failed wires get five passes, yellow from the second, red on the fifth, nothing keeps checking. The log in a side lightbox: one box, a set's members by chip, or the whole cluster stitched newest first, MongoDB's JSON lines shown as words, Follow live, Ask Themis with the lines in hand.
Sharding → Backups (the cluster as one thing). A shard holds one slice of every sharded collection and the config set holds the map, so the cluster's backup is every piece taken at the same time: the balancer paused through a router and any move in flight waited out, then the config set and every shard dumped whole with --oplog on a member of its own (a secondary with room, the primary only when a set has no other), all at once, into one folder named for the cluster and the moment, a manifest beside every piece and on the router that ran it; the balancer put back the moment the dumps end, whatever happened. Check reads the board first and shows what is in the way with the fix; the pieces stay on the boxes, come to this computer into one folder, or both. A database goes back through a router — its collections sharded again on the keys the manifest kept, every shard's slice loaded from the box that holds it, all at once. The cluster on a schedule is a plan that lives on a router. A REHEARSAL runs a cluster backup from a repository into this cluster whole, for fresh boxes.
Lens Mirror (MongoDB). One database of another MongoDB copied into a database on THIS box, faithfully and one way: a snapshot to start, then the source's own change stream, seconds behind, resumable. The source is a connection string with a read-only user (tested for what it may read and for the write it cannot do, from the target box — the one that will be talking to it); the target gets lensMirror with readWrite on that database alone; both strings sealed under the key. The worker runs on the target box under systemd (Lens never in the data path) or inside this Lens; its place and its lease live on the target, so this Lens can close and another with the same record can go on, and on a replica set the primary's worker runs it and an election hands it over. A five-step wizard (the provider's door, the database and its collections, how and where, the copy as it goes, mirrored) with the copy's progress drawn; pause · resume · resync · forget; the worker's tallies on the Overview. Nothing installed on either side.
Reports (MongoDB). Every report is what Lens already reads for a tab, drawn on screen — big numbers, tables, bars, matrices — with the PDF as a button for the person who does not have Lens (the same paper the audits use). Scopes: a box (overview, databases and collections, users and roles, security, firewall, configuration, backups, slow operations, everything), a set (the set, versions, the set on the wire, everything), a cluster (the cluster, sharded collections, TLS on every piece, the cluster on the wire, versions on every piece, everything). A report reads and never writes; the most it does is prove a wire.
Uninstall ceremony and the Danger Zone. Taking a service off a box: Touch ID, the warning that says what goes and what stays (the program only with its data kept, or everything), what the package manager says would ACTUALLY go, the phrase typed by hand, Enter, and Touch ID again asked by Go, then the job in front of everything. An uninstall is this box's and nobody else's — no "every member of the set", no "every server of the group". The Danger Zone lists every product Lens knows how to take apart properly plus everything else the box collected since its disk was made, ticked by hand; "Undo everything Lens did" removes the tools it installed and every file and service it wrote, in dependency order with the firewall and Fail2Ban last so the box is never left unfiltered mid-run — and nothing else: not the kernel, not /etc, not a package Lens did not install, never an account.