The console
The console is at https://scuttle.scailabs.ai. Sign in with your ScaiLabs account. What you can
see and change depends on your role; see Tenants, realms and names
for the roles themselves.
Every change is applied in the background. A change is done only when its operation shows succeeded. If an operation fails, its message says why, and Operations lets you retry it.
Where things are#
| Task | Where | Role needed |
|---|---|---|
| Create a realm | Overview → New realm | tenant admin |
| Rename a realm or change its description | realm → Settings | realm admin |
| Delete a realm | realm → Settings → Delete realm (it must be empty) | tenant admin |
| Give people access to one realm | realm → Members | realm admin |
| Give people access to the whole tenant | Tenant → Tenant admins | tenant admin |
| Create a database | realm → Databases → New database | operator |
| Delete a database | database → Delete database | operator |
| Create an account | realm → Accounts → New account | operator |
| Change an account's grants | account → Edit grants | operator |
| Restrict networks, set limits, lock an account | account → Access and limits → Edit | operator |
| Rotate a password | account → Rotate password | operator |
| Restore a database to a point in time | database → Backups → Restore… | operator |
| Download a database as SQL | database → Backups → Export… | operator |
| Erase a deleted database's backups | database → Backups → Purge backups now | tenant admin |
| Create or revoke API tokens | Tenant → API tokens | tenant admin |
| See usage | Usage | tenant admin |
The Tenant entry in the menu appears only for tenant admins.
Realms#
A realm is a namespace inside your tenant, usually one per team or environment (prod,
staging). Its slug is part of every database and account name in it
(<tenant>_<realm>_<name>), so the slug cannot be changed later. The display name and
description can be.
A realm can only be deleted when it holds no databases or accounts.
Members#
Access is granted to a person or a group from your ScaiLabs account directory. Search for them by name, e-mail address or group name, and pick them from the list. Only people and groups with access to Scuttle can be found.
A group grant follows the group: people who join it get access, and people who leave lose it. Changes take effect at the person's next sign-in.
| Grant | Scope |
|---|---|
| realm viewer, operator or admin | one realm (realm → Members) |
| tenant admin | every realm, plus realms, tokens and usage (Tenant page) |
Accounts and grants#
An account is a MariaDB login. Its access is a list of grants, each a profile on a scope:
- Scope: one database, or the whole realm. A realm-scope grant also covers databases created in the realm later.
- Profile:
readwrite(applications),readonly(reporting) ordba(migrations and schema owners).
You never pick individual privileges. The profiles are listed in Tenants, realms and names.
Saving grants replaces the account's whole grant list with what you see in the editor. To take something away, remove its row and save.
Under Access and limits you can:
- restrict the source networks (CIDR, one per line; empty means anywhere);
- change the connection limit and the maximum statement time;
- lock the account, which refuses new logins but doesn't end sessions that are already open.
Passwords are shown once, when an account is created or its password is rotated. Scuttle doesn't store them, so copy the password before closing the dialog.
Deleting a database#
A deleted database is kept for a grace period (14 days by default) before it's dropped. Its name stays taken until then. Its backups remain restorable for their own retention window.
A database can't be deleted while an account still has a grant on it. Remove those grants first.
Backups#
Every database is backed up continuously, encrypted, in another region. The Backups section of a database shows:
- The restorable window: from the oldest point your retention covers, up to the latest backed-up change. That is usually within 15 minutes of now.
- The backups behind it:
- Full dump — the first backup;
- Rolled forward — refreshed weekly;
- Monthly check — a real dump compared with the rest. "matches the cluster" means the check passed.
Restore… rebuilds the database as it was at a moment you choose, into a new database in the same realm. The original is never touched.
- Times are entered in your local time.
- Afterwards the console shows the exact moment the restore reached. It can be a few seconds earlier than you asked, because it stops at the last change committed at or before your time.
- A restored database may have one more index than the original: an index MariaDB would have dropped by itself on the original. It's harmless.
Export… produces a plain .sql.gz of the database at a moment you choose. It's built from
the backups, so it adds no load to your database. The download link works for 24 hours. The
file names no database, so you can import it under any name.
Purge backups now appears on deleted databases only. It erases their backups immediately instead of letting them age out, for example for an erasure request. This can't be undone. The result states what could not be erased at once: shared replication logs expire within 7 days.
API tokens#
sct_… tokens let scripts and CI use the API without signing in.
- Role: each token carries one role and can be limited to one realm.
- Expiry: optional.
- Storage: only a hash is stored. The token is shown once, when you create it.
- Revoking: takes effect immediately.