Fix Neo4j auth: disable auth for demo deployment (NEO4J_AUTH=none), simplify entrypoint

Dockerfile

@@ -68,7 +68,7 @@ RUN { \
     echo "server.directories.data=/data/neo4j/data"; \
     echo "server.directories.logs=/data/neo4j/logs"; \
     echo "server.directories.plugins=/data/neo4j/plugins"; \
-    echo "dbms.security.auth_enabled=true"; \
+    echo "dbms.security.auth_enabled=false"; \
     echo "dbms.security.procedures.unrestricted=apoc.*"; \
     echo "dbms.security.procedures.allowlist=apoc.*"; \
     echo "server.memory.heap.initial_size=512m"; \
@@ -114,7 +114,7 @@ ENV NEO4J_USERNAME=neo4j
 ENV NEO4J_PASSWORD=clinicalmatch2024
 ENV NEO4J_DATABASE=neo4j
 # NEO4J_AUTH tells Neo4j 5.x to set this password on first boot (format: user/pass)
-ENV NEO4J_AUTH=neo4j/clinicalmatch2024
+ENV NEO4J_AUTH=none
 
 # LLM — OpenAI-compatible (set real values via HF Spaces secrets)
 ENV OPENAI_API_KEY=""

backend/neo4j_setup.py

@@ -15,9 +15,10 @@ class Neo4jConnection:
         self._connect_with_retry()
 
     def _connect_with_retry(self, retries: int = 10, delay: int = 6):
+        auth = None if (self._auth == ("neo4j", "") or self._auth[1] == "") else self._auth
         for attempt in range(retries):
             try:
-                self.driver = GraphDatabase.driver(self._uri, auth=self._auth)
+                self.driver = GraphDatabase.driver(self._uri, auth=auth)
                 self.driver.verify_connectivity()
                 print(f"[neo4j] Connected on attempt {attempt + 1}")
                 return
@@ -46,10 +47,11 @@ class Neo4jConnection:
                 return [record.data() for record in result]
 
 
+_auth_disabled = (os.getenv("NEO4J_AUTH", "") == "none")
 neo4j_conn = Neo4jConnection(
     uri=os.getenv("NEO4J_URI") or "bolt://127.0.0.1:7687",
     user=os.getenv("NEO4J_USERNAME") or "neo4j",
-    password=os.getenv("NEO4J_PASSWORD") or "clinicalmatch2024",
+    password="" if _auth_disabled else (os.getenv("NEO4J_PASSWORD") or "clinicalmatch2024"),
     database=os.getenv("NEO4J_DATABASE") or "neo4j",
 )
 

docker/Dockerfile

@@ -68,7 +68,7 @@ RUN { \
     echo "server.directories.data=/data/neo4j/data"; \
     echo "server.directories.logs=/data/neo4j/logs"; \
     echo "server.directories.plugins=/data/neo4j/plugins"; \
-    echo "dbms.security.auth_enabled=true"; \
+    echo "dbms.security.auth_enabled=false"; \
     echo "dbms.security.procedures.unrestricted=apoc.*"; \
     echo "dbms.security.procedures.allowlist=apoc.*"; \
     echo "server.memory.heap.initial_size=512m"; \
@@ -114,7 +114,7 @@ ENV NEO4J_USERNAME=neo4j
 ENV NEO4J_PASSWORD=clinicalmatch2024
 ENV NEO4J_DATABASE=neo4j
 # NEO4J_AUTH tells Neo4j 5.x to set this password on first boot (format: user/pass)
-ENV NEO4J_AUTH=neo4j/clinicalmatch2024
+ENV NEO4J_AUTH=none
 
 # LLM — OpenAI-compatible (set real values via HF Spaces secrets)
 ENV OPENAI_API_KEY=""

docker/entrypoint.sh

@@ -3,8 +3,9 @@ set -e
 
 log() { echo "[entrypoint] $*"; }
 
-# ── Persistent data dirs (HF Spaces mounts /data) ─────────────────────────────
-mkdir -p /data/neo4j/data /data/neo4j/logs /data/neo4j/plugins /tmp/nginx-cache /tmp/nginx-body /tmp/nginx-run
+# ── Persistent data dirs ───────────────────────────────────────────────────────
+mkdir -p /data/neo4j/data /data/neo4j/logs /data/neo4j/plugins \
+         /tmp/nginx-cache /tmp/nginx-body /tmp/nginx-run
 
 # Symlink Neo4j dirs to persistent volume
 if [ ! -L /opt/neo4j/data ]; then
@@ -16,9 +17,5 @@ if [ ! -L /opt/neo4j/logs ]; then
     ln -sf /data/neo4j/logs /opt/neo4j/logs
 fi
 
-# Neo4j 5.x reads NEO4J_AUTH=neo4j/<password> on first boot to set credentials.
-# No manual cypher-shell bootstrap needed.
-export NEO4J_AUTH="neo4j/clinicalmatch2024"
-
 log "Starting all services via supervisord..."
 exec /usr/bin/supervisord -c /app/docker/supervisord.conf

docker/supervisord.conf

@@ -19,7 +19,7 @@ command=/opt/neo4j/bin/neo4j console
 environment=
     NEO4J_HOME=/opt/neo4j,
     JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64,
-    NEO4J_AUTH="neo4j/clinicalmatch2024"
+    NEO4J_AUTH="none"
 autostart=true
 autorestart=true
 startsecs=45
@@ -35,8 +35,9 @@ directory=/app/backend
 environment=
     NEO4J_URI="bolt://127.0.0.1:7687",
     NEO4J_USERNAME="neo4j",
-    NEO4J_PASSWORD="clinicalmatch2024",
+    NEO4J_PASSWORD="",
     NEO4J_DATABASE="neo4j",
+    NEO4J_AUTH="none",
     OPENAI_API_KEY="%(ENV_OPENAI_API_KEY)s",
     OPENAI_BASE_URL="%(ENV_OPENAI_BASE_URL)s",
     OPENAI_MODEL="%(ENV_OPENAI_MODEL)s"