The docker-compose.yml file they use for this post uses the official Neo4j Enterprise docker image.

This may be a problem for you as Neo4j’s official docker images use the commercial license and requires you to accept a license agreement which includes the following statement:

You learn more about what Neo4j Inc did here.

I simply forked the quick start GitHub repository and updated the docker-compose.yml file to use the free open source binaries that we compile from the official Neo4j GitHub repository for US government agencies.

You can view the changes I made to the file here.

Simply use this docker-compose.yml instead of the one referenced in the article and you are good to go!

Checkout the GraphAware blog for more great posts.

I would like to point out that my company iGov Inc, does not have any relationship with Neo4j Inc or GraphAware.

Enjoy the post!

Here is the link to the causal clustering docker post. https://graphaware.com/neo4j/2018/01/03/casual-cluster-quickstart.html

Neo4j Inc keeps it’s pricing information under close guard and only releases it under the close 'guidance' of a sales person.

To understand why this is the case, you have to understand a few things about Neo4j Enterprise.

Neo4j Enterprise is available under a dual license model. You have the choice of using it with either a commercial or the open source AGPLv3 license

The commercial license is included when you purchase a paid commercial annual subscription.

If you don’t have a commercial license, then Neo4j Enterprise simply defaults to the standard open source AGPLv3 license.

You can use Neo4j Enterprise with it’s open source license in any environment , including production, and yes you CAN use it in closed source projects!

There are no core or instance limitations when you use Neo4j Enterprise with it’s open source license. Commercial subscriptions place limits on cores and instances, just look at the pricing to see.

My next post will address a lot of Neo4j AGPL mis-information that has been circulating.

The US Federal government is already using Neo4j Enterprise in production, closed source projects with the AGPLv3 license.

The commercial license is actually more restrictive in most scenarios, so what are you really paying for when you purchase a Neo4j Enterprise commercial subscription?

You are basically paying for production email and phone support for Neo4j.

It is very important to understand that Neo4j production support only covers Neo4j. It does not cover any of the other software you use in your project such as ElasticSearch, Kafka, Postgresql, client side UI apps, micro-services, or custom applications. I.E. It only covers a single component of your technology stack.

If you need production support for your project, it makes no sense to only purchase production support for Neo4j while leaving all the other software unsupported.

This would be like only buying support for the alternator of a new custom car you had built. If its transmission fails - good luck! You want support to cover the entire car.

Finally, before jumping into the prices.

I want to point out that in most scenarios, purchasing a Neo4j Enterprise commercial subscription makes no sense if you are in development.

Why would you need production support for something that has not yet been built.

Don’t waste your budget on production support for something not yet even built or in production.

Use your budget to develop your solution.

Of course, we would be happy to help you build and support your graph solution.

So where does this pricing information come from?

A while back, Neo4j Inc allowed one of it’s partners, a company I highly respect, to add Neo4j commercial subscriptions to their GSA schedule 70 contract.

This made the pricing information public , which is why I can post it.

The pricing information below has been copied directly from the GSA Schedule contract mentioned above.

I just formatted it to make it easier to read.

GSA Schedule 70 pricing for SIN 132-32 is discounted for the first year at a percentage off of the commercial list price. All future price increases shall adhere to the EPA clause GSAR 552.216-70 Economic Price Adjustment for compliance with the GSA terms and conditions of this Schedule 70 Contract Award.

Neo4j Bundles are available by Annual Subscription. All prices are Annual Subscription prices.

The Neo4j database runtime is called an “Instance”. Clusters comprise multiple instances: normally three or more. Instances normally run on different machines / OSs, although multiple instances can be run on a single machine / OS. Each Neo4j instance runs inside of a corresponding Java Virtual Machine (JVM) instance.

For Neo4j instances running in virtualized environments, only the number of cores allotted to the virtual OS in which Neo4j is running need be licensed. For virtual machines running in EC2 and other virtualized Cloud platforms (such as SoftLayer, Oracle Cloud, et al.), “virtual cores” and “virtual CPUs” (vCPUs) each count as one core.

All Neo4j Bundles include a commercial license for Neo4j Enterprise Edition. The commercial license grants rights to the use of Neo4j Enterprise in commercial and/or federal and government projects on an annual / renewable basis, and includes Support in the GSA purchase price.

Standard cluster for enterprise applications that are used by more than one department (or by a larger department), or by customer-facing applications. Neo4j Enterprise Bundle basic configuration includes:

A small cluster for use by a single department, for internal employee-facing applications. Neo4j Business Bundles – Premium Support include:

A small cluster for use by a single department, for internal employee-facing applications. Neo4j Business Bundles – Standard Support include:

A small single-instance configuration for internal departmental applications. Neo4j Discovery Bundle basic configuration includes:

Feel free to contact me directly via email at jmsuhy@igovsol.com if you have questions, comments, or just want to talk about Neo4j in general.

Neo4j Enterprise 'binaries’ are simply the compiled and packaged Neo4j distributions you download and run on your computer, server, container, etc.

For the 3.3.0 release the enterprise binary package file names would be neo4j-enterprise-3.3.0-unix.tar.gz for the linux package and neo4j-enterprise-3.3.0-windows.zip for the windows package. (The links above point to the binaries iGov Inc compiled and packaged using the source code found at the Neo4j Github repository. By default it is packaged with the AGPLv3 license.)

Why has Neo4j Inc made it harder to access the open source enterprise binaries?

If they are going to take the trouble to make Neo4j Enterprise more inaccessible to the public, why not just take Neo4j closed source before releasing 3.3.0?

Only Neo4j Inc can answer these questions, and I feel they owe an explanation to the open source community which has made Neo4j what it is today.

With ambitions of an IPO, it would be an extremely risky maneuver to attempt taking Neo4j closed source. It could backfire and be disastrous if the community revolted and creates a more successful Neo4j fork. Even the perceived threat of this sort of behavior could trigger a revolt and fork.

As a reference, look no further than MySQL and MariaDB , the more popular fork of MySQL, and you can see what could happen.

It looks like Neo4j Inc does not want to tempt fate with a closed source move just yet. Instead another path was taken which makes it very hard to get ahold of the enterprise packaged binaries with the free AGPLv3 license. As a passionate advocate of both open source software and Neo4j, this does not sit well with me.

Federal agencies have already invested in the adoption and use of Neo4j Enterprise and many are using it’s free AGPLv3 license. Luckily, iGov Inc builds the Neo4j binaries from the source code and makes it available via a distribution site we setup.

Back to the core of this post. So what has Neo4j Inc done to limit your access to Neo4j Enterprise binaries packaged with the free open source AGPLv3 license?

Action 1: The enterprise packaging build instructions were removed from the code base. Until the 3.3.0 release, anyone could have checked out the Neo4j source code from github, and run a few simple commands to build the Neo4j Enterprise binaries complete with the AGPLv3 license. That’s not the case anymore. If you run the build commands on the 3.3.0 branch you will notice that only the Neo4j Community Edition binary is present after the build process completes. Who really uses Neo4j Community Edition once they realized Neo4j Enterprise edition is also free?

The packaging system simply provides the instructions on how to ‘build’ the Neo4j Enterprise distribution binary, much like the instructions you get with furniture purchased at IKEA. All the artifacts that are used to build the Neo4j Enterprise binary are all open source, but the instructions explaining how to put together these artifacts have disappeared.

Action 2: Neo4j Inc slipped a commercial license into the official binaries found on their distribution site that is used for docker images. Until now, if you wanted to download the Neo4j Enterprise binary from Neo4j Inc directly, you could have done so using the distribution site which is publically available. It just isn’t advertised for obvious reasons.

Those who were using the official docker images or downloading the enterprise binary directly from dist.neo4j.org were in for a surprise when they were forced to accept commercial terms in order to access the distributions.

Want to see for yourself - download the Neo4j Enterprise binary which Neo4j Inc packages and take a look at the LICENSE.txt file.

Instead of the standard AGPLv3 license which used to be there, the LICENSE.txt file now says:

As copyright holders, Neo4j Inc has the right to add any license they want for the binary distributions they build, package, and make available for download themselves. If anyone else packages the enterprise binary distribution like we do, you must simply make sure the LICENSE.txt file is the AGPLv3 license. That is exactly what we do.

Action 3: Neo4j Inc kept causal cluster communication encryption (Intra-cluster encryption) off by default. They then created a ‘proprietary module’ that turns it on.

Of course you can get intra-cluster encryption turned back on by purchasing a costly commercial package.

This move was referenced in the 3.3.0 release changelog. They justified this change with the following blurb:

Of course Neo4j Enterprise can still be distributed under the AGPLv3 license. Simply provide a binary download without the 'proprietary add-ons' that turn on intra-cluster encryption. The Neo4j Enterprise binaries we make available to the public are proof that this can be done.

I believe that security critical components of Neo4j should remain open source, security by obscurity has proven not to be a good strategy in the past. Currently, the security components of Neo4j Enterprise are still open source. In the case of intra-cluster encryption (causal clustering) - it is just not initialized.

Right now the only difference between the paid Neo4j Enterprise (commercial) binary and Neo4j Enterprise (open source) binary (we compile from source) is that intra-cluster encryption is still off by default in the AGPLv3 version.

We turn it back on for our federal customers via a new component in our FISMA framework, which will be available on github for everyone to use soon.

How many of you are actually using causal clustering in production? Well - if you upgrade to 3.3.0 and don’t turn it back on yourself , you may be a little less secure assuming you aren’t using encrypted tunnels / vpn, etc between your cluster nodes.

Look for yourself:

3.2 release code : The sslPolicy initialized in the code.

3.3 release code : The sslPolicy initialization has disappeared.

These three actions effectively made it impossible to get Neo4j Enterprise binaries with the open source AGPLv3 license from Neo4j Inc starting with the 3.3.0 release.

As a consulting company offering software development and support for Neo4j Enterprise open source licenses to the US federal government, we have been building the binaries ourselves for some time.

As part of the Neo4j open source community, we’ve decided to absorb the hosting costs and make these distributions available to the general public, not just US federal agencies. We’ve setup a distribution site that can be used to download Neo4j Enterprise directly, or use use with docker compose.

We will have docker images up as well complete with the AGPLv3 licensed packages.

We will also have the FISMA framework modules on GitHub soon, one of which turns back on intra-cluster encryption.

You can download the Neo4j Enterprise binaries with the open source license from our website at https://igovsol.com/downloads.html.

We compile and package these using the source code from the official Neo4j GitHub repositories.

Federal agencies should email us at support@igovsol.com to get their AWS GovCloud download links which should be whitelisted for most agencies.

If you would were not aware that Neo4j Enterprise is open source just like it’s sibling 'Neo4j Community Edition', you can learn more here.

If you are not happy with Neo4j Inc’s behavior, then please reach out to Neo4j Inc and voice your concerns.

Feel free to contact me directly via email at jmsuhy@igovsol.com if you have questions, comments, or just want to talk about Neo4j in general. We are always available.