security(M3): enable Neo4j TLS for non-local deployments

[SimplicityGuy]

Finding

From the comprehensive security review in #71 (M3 — Medium severity).

Files: api/api.py, curator/curator.py

encrypted=False

All Neo4j traffic (including user graph data) travels unencrypted over the Docker network.

Impact

Any traffic between services and Neo4j (graph queries, writes) is transmitted in plaintext. In a shared or cloud network environment this exposes user graph data to network-level interception.

Proposed Fix

• Enable TLS on the Neo4j Bolt connection (encrypted=True) for any non-local deployment
• Add a NEO4J_TLS_ENABLED env var (default false for local dev, true for production)
• Document in operator setup that TLS must be enabled in production

Notes

Not addressed in #73 (infrastructure concern — requires TLS certificate setup on the Neo4j side, not just application code).

[SimplicityGuy]

Status Update (2026-03-10)

Architecture note: This issue references curator/curator.py which has been deleted (commit 4b45831). The curator service was removed — sync logic was migrated to api/routers/sync.py + api/syncer.py.

The relevant files with encrypted=False Neo4j connections are now:

• api/api.py
• graphinator/graphinator.py
• explore/explore.py
• Any other service connecting to Neo4j

The fix scope remains the same — add NEO4J_TLS_ENABLED env var support.

[SimplicityGuy]

Update: The curator/curator.py file referenced in this issue no longer exists. Services that connect to Neo4j are: api/api.py, graphinator/graphinator.py, insights/insights.py, dashboard/dashboard.py, and schema-init/schema_init.py. The api/syncer.py file replaced curator's Neo4j usage.

[SimplicityGuy]

Status Update (2026-03-18)

Still not addressed. The Neo4j driver in common/config.py connects via bolt://{host}:7687 with no TLS/encrypted configuration. No NEO4J_TLS_ENABLED env var exists. All Neo4j traffic remains unencrypted.

[SimplicityGuy]

Status Update — 2026-03-25

Not started. Neo4j connections still use unencrypted bolt protocol. No TLS configuration has been added for non-local deployments.