Add WebDataStudio

[fgilde]

New app: WebDataStudio

What it is: a database client that runs on the server instead of on one laptop. PostgreSQL,
MySQL/MariaDB, SQL Server, SQLite, Oracle, DuckDB, ClickHouse, MongoDB and Redis in one container:
schema explorer, SQL editor with completion and history, a visual query builder, result charts, ER
diagrams drawn from the foreign keys, schema editing, a column-by-column comparison between two
connections, saved and scheduled queries with file export, and an MCP endpoint for AI agents.

• Project: https://github.com/fgilde/WebDataStudio
• Docs: https://fgilde.github.io/WebDataStudio/
• Image: ghcr.io/fgilde/webdatastudio (GHCR, public, linux/amd64 + linux/arm64)
• Licence: MIT

What is in the PR

Apps/WebDataStudio/

File
docker-compose.yml	one service, published on 8095 → container 8080, data under /DATA/AppData/$AppID/data
icon.svg, icon.png	256×256
thumbnail.png, screenshot-1..3.png	1568×884

Metadata: id: org.gilde.webdatastudio, main: webdatastudio, category Developer, index: /,
port_map: "8095", architectures amd64 + arm64, version: 1.3.0, title, tagline and
description in en_US and de_DE, a tips.before_install, and website / repo / support /
docs.

The login screen is not optional here

With neither WDS_USER nor WDS_PASSWORD set, the studio serves without a login screen at all —
wrong default for a database client. The package therefore ships admin and a password generated
for this package, and the before_install tip asks the user to replace it in the install dialog. A
value like casaos would be the same on every install; this one is at least not shared, though it
is still in a public file. WDS_READONLY=true is documented in the env descriptions
for anyone who wants every connection read-only, enforced in the driver rather than only in the UI.

Validation

• docker compose config -q on the app: clean.
• ./scripts/build_dist.sh with the app added: builds, and dist/index.json gains
  org.gilde.webdatastudio with the expected title, tagline, category, architectures, icon,
  thumbnail and version; dist/apps/org.gilde.webdatastudio/ has the per-arch compose files and
  meta.json + meta.de_DE.json.
• The image was pulled and started from the generated compose: the UI answers on the published port
  and the login screen appears with the packaged credentials.

Multi-arch

linux/amd64 and linux/arm64 come from the project's CI, and the arm64 image is smoke-tested on a
native arm64 runner on every push.

About the SonarCloud check

SonarCloud marks the credential in the compose file as a hardcoded secret. It is right that the
value is in a public file, and there is no way around that here: CasaOS has no generator for install
time, and the app needs the value to start with a login rather than without one. The apps already in
this store solve it the same way (ArchiveBox ships ADMIN_PASSWORD=casaos, Docmost a literal
POSTGRES_PASSWORD and APP_SECRET). The before_install tip asks the user to replace it, and the
field is editable in the install dialog. Happy to change the approach if you would rather have it
some other way.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE