3 files changed, 86 insertions, 13 deletions
diff --git a/databases/neo4j/files/neo4j.in b/databases/neo4j/files/neo4j.in
index 6cb20b01c3ea..a7f9e6f83cd7 100644
--- a/databases/neo4j/files/neo4j.in
+++ b/databases/neo4j/files/neo4j.in
@@ -7,6 +7,18 @@
 # Add the following line to /etc/rc.conf to enable neo4j:
 #
 # neo4j_enable=YES
+#
+# The following rc.conf variable can be set:
+#
+# For user/group to run neo4j under:
+#
+# neo4j_user	(str)	Default: neo4j
+# neo4j_group	(str)	Default: neo4j
+#
+# For service jail:
+#
+# neo4j_svcj_options	(str)	Default: net_basic
+#
 
 . /etc/rc.subr
 
@@ -17,21 +29,30 @@ desc="Graphing database"
 load_rc_config $name
 
 : ${neo4j_enable:=NO}
+: ${neo4j_user=neo4j}
+: ${neo4j_group=neo4j}
+: ${neo4j_svcj_options:=net_basic}
+: ${neo4j_env:="HOME=%%DBDIR%% NEO4J_CONF=%%ETCDIR%% JAVA_HOME=%%JAVA_HOME%%"}
 
 command=%%PREFIX%%/bin/neo4j
-start_cmd="$command start"
+procname=%%JAVA_HOME%%/bin/java
+start_cmd="su -m $neo4j_user -c \"$command start\""
 start_precmd=neo4j_prestart
-stop_cmd="$command stop"
-status_cmd="$command status"
+stop_cmd="su -m $neo4j_user -c \"$command stop\""
+status_cmd="su -m $neo4j_user -c \"$command status\""
 
 neo4j_prestart()
 {
-	NEO4J_DATA=%%DBDIR%%
+	NEO4J_DATA=%%DBDIR%%/data
+	NEO4J_METRICS=%%DBDIR%%/metrics
 	NEO4J_LIB=%%PREFIX%%/neo4j/lib
 	NEO4J_LOGS=%%LOGDIR%%
 	NEO4J_PLUGINS=${NEO4J_LIB}/plugins
 	NEO4J_RUN=%%RUNDIR%%
-	mkdir -p ${NEO4J_LOGS} ${NEO4J_RUN}
+	[ -d ${NEO4J_LOGS} ] || install -d -o ${neo4j_user} -g ${neo4j_group} -m 0750 ${NEO4J_LOGS}
+	[ -d ${NEO4J_RUN} ] || install -d -o ${neo4j_user} -g ${neo4j_group} ${NEO4J_RUN}
+	[ -d ${NEO4J_DATA} ] || install -d -o ${neo4j_user} -g ${neo4j_group} -m 0750 ${NEO4J_DATA}
+	[ -d ${NEO4J_METRICS} ] || install -d -o ${neo4j_user} -g ${neo4j_group} -m 0750 ${NEO4J_METRICS}
 }
 
 run_rc_command $1
diff --git a/databases/neo4j/files/neo4j.sh.in b/databases/neo4j/files/neo4j.sh.in
index 01a498c14583..f2704e7bc0fd 100644
--- a/databases/neo4j/files/neo4j.sh.in
+++ b/databases/neo4j/files/neo4j.sh.in
@@ -1,3 +1,3 @@
-#!/usr/bin/env bash
-
+#!/bin/sh
+export JAVA_HOME=${JAVA_HOME:-"%%JAVA_HOME%%"}
 exec %%PREFIX%%/bin/$(basename $0) ${1+"$@"}
diff --git a/databases/neo4j/files/patch-conf_neo4j.conf b/databases/neo4j/files/patch-conf_neo4j.conf
index d7a5984f2abc..7fd32a3f5f5b 100644
--- a/databases/neo4j/files/patch-conf_neo4j.conf
+++ b/databases/neo4j/files/patch-conf_neo4j.conf
@@ -1,17 +1,69 @@
---- conf/neo4j.conf.orig	2022-05-06 21:00:03 UTC
+--- conf/neo4j.conf.orig	2025-05-15 11:34:49 UTC
 +++ conf/neo4j.conf
-@@ -9,11 +9,11 @@
+@@ -9,18 +9,18 @@
  #dbms.default_database=neo4j
  
  # Paths of directories in the installation.
 -#dbms.directories.data=data
-+dbms.directories.data=/var/db/neo4j
++dbms.directories.data=%%DBDATADIR%%
  #dbms.directories.plugins=plugins
 -#dbms.directories.logs=logs
-+dbms.directories.logs=/var/log/neo4j
++dbms.directories.logs=%%LOGDIR%%
  #dbms.directories.lib=lib
 -#dbms.directories.run=run
-+dbms.directories.run=/var/run/
++dbms.directories.run=%%RUNDIR%%
  #dbms.directories.licenses=licenses
- #dbms.directories.transaction.logs.root=data/transactions
+-#dbms.directories.transaction.logs.root=data/transactions
++dbms.directories.transaction.logs.root=%%DBDIR%%/transactions
+ 
+ # This setting constrains all `LOAD CSV` import files to be under the `import` directory. Remove or comment it out to
+ # allow files to be loaded from anywhere in the filesystem; this introduces possible security problems. See the
+ # `LOAD CSV` section of the manual for details.
+-dbms.directories.import=import
++dbms.directories.import=%%DBIMPORTDIR%%
+ 
+ # Whether requests to Neo4j are authenticated.
+ # To disable authentication, uncomment this line
+@@ -118,8 +118,8 @@ dbms.connector.https.enabled=false
+ # Allowable values are 'bolt', 'https', 'cluster' or 'backup'.
+ 
+ # E.g if bolt and https connectors should use the same policy, the following could be declared
+-#   dbms.ssl.policy.bolt.base_directory=certificates/default
+-#   dbms.ssl.policy.https.base_directory=certificates/default
++#   dbms.ssl.policy.bolt.base_directory=%%CERTDIR%%/default
++#   dbms.ssl.policy.https.base_directory=%%CERTDIR%%/default
+ # However, it's strongly encouraged to not use the same key pair for multiple scopes.
+ #
+ # N.B: Note that a connector must be configured to support/require
+@@ -157,27 +157,27 @@ dbms.connector.https.enabled=false
+ 
+ # Bolt SSL configuration
+ #dbms.ssl.policy.bolt.enabled=true
+-#dbms.ssl.policy.bolt.base_directory=certificates/bolt
++#dbms.ssl.policy.bolt.base_directory=%%CERTDIR%%/bolt
+ #dbms.ssl.policy.bolt.private_key=private.key
+ #dbms.ssl.policy.bolt.public_certificate=public.crt
+ #dbms.ssl.policy.bolt.client_auth=NONE
+ 
+ # Https SSL configuration
+ #dbms.ssl.policy.https.enabled=true
+-#dbms.ssl.policy.https.base_directory=certificates/https
++#dbms.ssl.policy.https.base_directory=%%CERTDIR%%/https
+ #dbms.ssl.policy.https.private_key=private.key
+ #dbms.ssl.policy.https.public_certificate=public.crt
+ #dbms.ssl.policy.https.client_auth=NONE
+ 
+ # Cluster SSL configuration
+ #dbms.ssl.policy.cluster.enabled=true
+-#dbms.ssl.policy.cluster.base_directory=certificates/cluster
++#dbms.ssl.policy.cluster.base_directory=%%CERTDIR%%/cluster
+ #dbms.ssl.policy.cluster.private_key=private.key
+ #dbms.ssl.policy.cluster.public_certificate=public.crt
+ 
+ # Backup SSL configuration
+ #dbms.ssl.policy.backup.enabled=true
+-#dbms.ssl.policy.backup.base_directory=certificates/backup
++#dbms.ssl.policy.backup.base_directory=%%CERTDIR%%/backup
+ #dbms.ssl.policy.backup.private_key=private.key
+ #dbms.ssl.policy.backup.public_certificate=public.crt