Fix Neo4j auth: use NEO4J_AUTH env var (Neo4j 5.x standard), remove broken cypher-shell bootstrap

Dockerfile

@@ -113,6 +113,8 @@ ENV NEO4J_URI=bolt://127.0.0.1:7687
 ENV NEO4J_USERNAME=neo4j
 ENV NEO4J_PASSWORD=clinicalmatch2024
 ENV NEO4J_DATABASE=neo4j
+# NEO4J_AUTH tells Neo4j 5.x to set this password on first boot (format: user/pass)
+ENV NEO4J_AUTH=neo4j/clinicalmatch2024
 
 # LLM — OpenAI-compatible (set real values via HF Spaces secrets)
 ENV OPENAI_API_KEY=""

docker/Dockerfile

@@ -113,6 +113,8 @@ ENV NEO4J_URI=bolt://127.0.0.1:7687
 ENV NEO4J_USERNAME=neo4j
 ENV NEO4J_PASSWORD=clinicalmatch2024
 ENV NEO4J_DATABASE=neo4j
+# NEO4J_AUTH tells Neo4j 5.x to set this password on first boot (format: user/pass)
+ENV NEO4J_AUTH=neo4j/clinicalmatch2024
 
 # LLM — OpenAI-compatible (set real values via HF Spaces secrets)
 ENV OPENAI_API_KEY=""

docker/entrypoint.sh

@@ -4,9 +4,9 @@ set -e
 log() { echo "[entrypoint] $*"; }
 
 # ── Persistent data dirs (HF Spaces mounts /data) ─────────────────────────────
-mkdir -p /data/neo4j/data /data/neo4j/logs /data/neo4j/plugins
+mkdir -p /data/neo4j/data /data/neo4j/logs /data/neo4j/plugins /tmp/nginx-cache /tmp/nginx-body /tmp/nginx-run
 
-# Symlink Neo4j data dir to persistent volume
+# Symlink Neo4j dirs to persistent volume
 if [ ! -L /opt/neo4j/data ]; then
     rm -rf /opt/neo4j/data
     ln -sf /data/neo4j/data /opt/neo4j/data
@@ -16,48 +16,9 @@ if [ ! -L /opt/neo4j/logs ]; then
     ln -sf /data/neo4j/logs /opt/neo4j/logs
 fi
 
-# ── Neo4j password bootstrap (first-boot only) ────────────────────────────────
-NEO4J_PASS="${NEO4J_PASSWORD:-clinicalmatch2024}"
-
-if [ ! -f /data/.neo4j_ready ]; then
-    log "First boot — initialising Neo4j password..."
-    # Start Neo4j with default password, change it, stop cleanly
-    /opt/neo4j/bin/neo4j start
-    log "Waiting for Neo4j to accept connections..."
-    for i in $(seq 1 30); do
-        if /opt/neo4j/bin/cypher-shell -u neo4j -p neo4j \
-            "RETURN 1;" >/dev/null 2>&1; then
-            break
-        fi
-        sleep 2
-    done
-    /opt/neo4j/bin/cypher-shell -u neo4j -p neo4j \
-        "ALTER CURRENT USER SET PASSWORD FROM 'neo4j' TO '$NEO4J_PASS';" 2>/dev/null || true
-    /opt/neo4j/bin/neo4j stop
-    sleep 3
-
-    # Run schema + sample data seeding
-    log "Seeding schema and sample data..."
-    cd /app/backend
-    NEO4J_URI=bolt://127.0.0.1:7687 \
-    NEO4J_USERNAME=neo4j \
-    NEO4J_PASSWORD="$NEO4J_PASS" \
-    python3 -c "
-from neo4j_setup import setup_schema
-from data_ingestion import ingest_sample_data
-setup_schema()
-ingest_sample_data()
-print('Schema and sample data ready.')
-" 2>/dev/null || log "Seeding deferred — Neo4j not yet ready (will retry via /setup endpoint)"
-
-    touch /data/.neo4j_ready
-    log "Neo4j initialisation complete."
-fi
-
-# ── Nginx tmp dirs (runs as non-root) ─────────────────────────────────────────
-mkdir -p /tmp/nginx-cache /tmp/nginx-body
+# Neo4j 5.x reads NEO4J_AUTH=neo4j/<password> on first boot to set credentials.
+# No manual cypher-shell bootstrap needed.
+export NEO4J_AUTH="neo4j/clinicalmatch2024"
 
 log "Starting all services via supervisord..."
-# nginx needs its tmp dirs writable
-mkdir -p /tmp/nginx-cache /tmp/nginx-body /tmp/nginx-run
 exec /usr/bin/supervisord -c /app/docker/supervisord.conf

docker/supervisord.conf

@@ -16,25 +16,27 @@ serverurl=unix:///tmp/supervisor.sock
 # ── Neo4j Community ────────────────────────────────────────────────────────────
 [program:neo4j]
 command=/opt/neo4j/bin/neo4j console
-environment=NEO4J_HOME=/opt/neo4j,JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64
+environment=
+    NEO4J_HOME=/opt/neo4j,
+    JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64,
+    NEO4J_AUTH="neo4j/clinicalmatch2024"
 autostart=true
 autorestart=true
 startsecs=45
 startretries=3
 stdout_logfile=/tmp/neo4j.log
-stderr_logfile=/tmp/neo4j.log
 redirect_stderr=true
 priority=10
 
-# ── FastAPI backend (starts after Neo4j is ready via retry logic in neo4j_setup.py) ──
+# ── FastAPI backend ────────────────────────────────────────────────────────────
 [program:backend]
-command=bash -c "sleep 50 && python3 -m uvicorn main:app --host 127.0.0.1 --port 8000 --workers 1"
+command=bash -c "sleep 60 && python3 -m uvicorn main:app --host 127.0.0.1 --port 8000 --workers 1"
 directory=/app/backend
 environment=
     NEO4J_URI="bolt://127.0.0.1:7687",
-    NEO4J_USERNAME="%(ENV_NEO4J_USERNAME)s",
-    NEO4J_PASSWORD="%(ENV_NEO4J_PASSWORD)s",
-    NEO4J_DATABASE="%(ENV_NEO4J_DATABASE)s",
+    NEO4J_USERNAME="neo4j",
+    NEO4J_PASSWORD="clinicalmatch2024",
+    NEO4J_DATABASE="neo4j",
     OPENAI_API_KEY="%(ENV_OPENAI_API_KEY)s",
     OPENAI_BASE_URL="%(ENV_OPENAI_BASE_URL)s",
     OPENAI_MODEL="%(ENV_OPENAI_MODEL)s"
@@ -43,7 +45,6 @@ autorestart=true
 startsecs=15
 startretries=5
 stdout_logfile=/tmp/backend.log
-stderr_logfile=/tmp/backend.log
 redirect_stderr=true
 priority=30
 
@@ -56,7 +57,6 @@ autostart=true
 autorestart=true
 startsecs=5
 stdout_logfile=/tmp/frontend.log
-stderr_logfile=/tmp/frontend.log
 redirect_stderr=true
 priority=40
 
@@ -67,6 +67,5 @@ autostart=true
 autorestart=true
 startsecs=3
 stdout_logfile=/tmp/nginx.log
-stderr_logfile=/tmp/nginx.log
 redirect_stderr=true
 priority=50