DozerDB on a synology NAS

[mdelambilly]

Hi All,

First of all, many thanks for your work and offering us DozerDB !
I'm installing it on my Synology NAS using container manager (docker). As it is reacable from internet it is secured and I struggle a bit to make the bolt+s connectivity work. Do you have a doc somewhere I could use ?

Michel

[mdelambilly]

I eventually reached to make the dozedb-browser work in http mode, but I would rather prefer it to work in https. How to activate this ?

[mdelambilly]

up !

[jmsuhy]

DozerDB is just a plugin that adds enterprise features into Neo4j Community, so you can follow the official Neo4j documentation to enable TLS/HTTPS:

Neo4j SSL/TLS Framework Documentation

If the Neo4j docs feel too complex, let us know and we can plan to put together a simplified step-by-step guide.

Let me know if the link above helped you.

[mdelambilly]

Hi @jmsuhy,

Thanks for the link. I'll first try to do that by myself.
I already use a acme docker image to automatically generate and install certificates I need on my NAS. I'll just amend the script to also copy them to neo4j and restart the project.

As I am using this docker image: graphstack/dozerdb:5.26.3.0 I assume I need a netty-tcnative plugin for a debian arm64.
How to get it is unclear to me.

with this explained, I think I'll be able to make it work. In all cases I'll let you know if I succeeded or not.

[mdelambilly]

I'm needing some help. As you said this is a neo4j feature, I'm using the neo4j image. See the compose file:

services:
  neo4j:
    image: neo4j:5.26.3
    network_mode: bridge
    container_name: neo4j
    volumes:
        - ./logs:/logs
        - ./config:/config
        - ./data:/data
        - ./plugins:/plugins
        - ./import:/var/lib/neo4j/import
    environment:
      - NEO4J_AUTH_FILE=/run/secrets/neo4j_auth_file
      - NEO4J_PLUGINS=["apoc"] 
      - NEO4J_apoc_export_file_enabled=true
      - NEO4J_apoc_import_file_enabled=true
      - NEO4J_dbms_security_procedures_unrestricted='*' 
      # for SSL/TLS (https)
      - NEO4J_dbms_netty_ssl_provider=OPENSSL
      - NEO4J_server_https_enabled=true
      - NEO4J_server_bolt_tls__level=OPTIONAL
      # neo4j browser https
      - NEO4J_dbms_ssl_policy_https_enabled=true
      - NEO4J_dbms_ssl_policy_https_base__directory=/data/certificates/https
      - NEO4J_dbms_ssl_policy_https_private__key=mydomain.com.key
      - NEO4J_dbms_ssl_policy_https_public__certificate=mydomain.com.cer
      - NEO4J_dbms_ssl_policy_https_client_auth=NONE
      # bolt+s
      - NEO4J_dbms_ssl_policy_bolt_enabled=true
      - NEO4J_dbms_ssl_policy_bolt_base__directory=/data/certificates/bolt
      - NEO4J_dbms_ssl_policy_bolt_private__key=mydomain.com.key
      - NEO4J_dbms_ssl_policy_bolt_public__certificate=mydomain.com.cer
      - NEO4J_dbms_ssl_policy_bolt_client_auth=NONE
      - NEO4J_server_bolt_tls__level=OPTIONAL
    ports:
      - 7687:7687
      # for SSL/TLS (https)
      - 7473:7473
      # for non-SSL/non-TLS (http)
      - 7474:7474
    restart: unless-stopped
    secrets:
      - neo4j_auth_file
      
secrets:
  neo4j_auth_file:
    file: neo4j_auth.txt

I found the netty-tcnative jar here : https://repo1.maven.org/maven2/io/netty/netty-tcnative/2.0.72.Final/netty-tcnative-2.0.72.Final-linux-x86_64.jar, renamed it to netty-tcnative-linux-x86_64.jar and copy it to the plugin directory. I copied my certificate cer and key file in /data/certificates/bolt and /data/certificates/https. I copied the cer file in /data/certificates/bolt/trusted and /data/certificates/https/trusted

It is properly loaded, I see it in the debug.log file:

[classpath] /plugins/netty_tcnative_linux_x86_64.jar

but the neo4j.log file contains this error:

java.lang.RuntimeException: Error starting Neo4j database server at /data/databases
at org.neo4j.graphdb.facade.DatabaseManagementServiceFactory.startDatabaseServer(DatabaseManagementServiceFactory.java:288) ~[neo4j-5.26.3.jar:5.26.3]
at org.neo4j.graphdb.facade.DatabaseManagementServiceFactory.build(DatabaseManagementServiceFactory.java:223) ~[neo4j-5.26.3.jar:5.26.3]
at org.neo4j.server.CommunityBootstrapper.createNeo(CommunityBootstrapper.java:38) ~[neo4j-5.26.3.jar:5.26.3]
at org.neo4j.server.NeoBootstrapper.start(NeoBootstrapper.java:185) [neo4j-5.26.3.jar:5.26.3]
at org.neo4j.server.NeoBootstrapper.start(NeoBootstrapper.java:100) [neo4j-5.26.3.jar:5.26.3]
at org.neo4j.server.CommunityEntryPoint.main(CommunityEntryPoint.java:30) [neo4j-5.26.3.jar:5.26.3]
Caused by: org.neo4j.kernel.lifecycle.LifecycleException: Component 'org.neo4j.bolt.BoltServer@733534f9' failed to initialize. Please see the attached cause exception "Failed to load any of the given libraries: [netty_tcnative_linux_x86_64, netty_tcnative_linux_x86_64_fedora, netty_tcnative_x86_64, netty_tcnative]".
at org.neo4j.kernel.lifecycle.LifeSupport$LifecycleInstance.init(LifeSupport.java:334) ~[neo4j-common-5.26.3.jar:5.26.3]
at org.neo4j.kernel.lifecycle.LifeSupport.init(LifeSupport.java:56) ~[neo4j-common-5.26.3.jar:5.26.3]
at org.neo4j.kernel.lifecycle.LifeSupport.start(LifeSupport.java:85) ~[neo4j-common-5.26.3.jar:5.26.3]
at org.neo4j.graphdb.facade.DatabaseManagementServiceFactory.startDatabaseServer(DatabaseManagementServiceFactory.java:279) ~[neo4j-5.26.3.jar:5.26.3]
... 5 more
Caused by: java.lang.UnsatisfiedLinkError: failed to load the required native library
at io.netty.handler.ssl.OpenSsl.ensureAvailability(OpenSsl.java:587) ~[netty-handler-4.1.115.Final.jar:4.1.115.Final]
at io.netty.handler.ssl.ReferenceCountedOpenSslContext.(ReferenceCountedOpenSslContext.java:223) ~[netty-handler-4.1.115.Final.jar:4.1.115.Final]

I assume I did something the wrong way with the netty-tcnative jar but I do not reach to pinpoint it.

Can you help ?

[mdelambilly]

From neo4j community forum, it looks neo4j self install does not support TLS yet ...