Skip to main content

Give read-only access

Neo4j Community has no read-only users: everyone who can sign in can also change the graph or delete it. The bundle therefore offers a read-only copy: a second Neo4j, with a password of its own, that refuses every write.

Set it up​

  1. In .env, choose the copy's password:

    NEO4J_READONLY_PASSWORD=a-password-to-give-to-people

  2. Fill the copy:

    ./refresh-readonly.sh

    It makes a backup (Neo4j stops for the length of the dump), loads it into the copy and starts the copy read-only.

  3. People open the copy's Neo4j Browser at http://localhost:7475 and sign in as neo4j with NEO4J_READONLY_PASSWORD. Any write is refused with "No write operations are allowed on this database".

What the copy leaves out​

Hop stores, with every run, the project's metadata (metadataJson) and the whole pipeline or workflow (executorXml). Both include the project's database connections, passwords in Hop's "Encrypted" form, which anyone with Hop can turn back into the password. The refresh removes these two properties from the copy. Everything else is there; the original keeps everything.

Keep it fresh​

The copy shows the data of its last refresh. Run ./refresh-readonly.sh as often as people need, for example nightly from cron, at a time when no runs are expected: Neo4j stops for the dump.

Ports​

NEO4J_READONLY_HTTP_PORT (7475) and NEO4J_READONLY_BOLT_PORT (7688), on NEO4J_BIND_ADDR. If you change the Bolt port or publish it under another name, set NEO4J_READONLY_BOLT_ADVERTISED to match, or the Browser opens but cannot connect.