1. Start gDown

Docker is the quickest path: the image is signed, runs as a non-root user and has no default password (the command creates one in secrets/admin_password). A server install, a cluster and OpenShift are on the installation page.

mkdir gdown && cd gdown
curl -fsSLO https://gdown.gluonify.io/docker/docker-compose.yml
mkdir -p secrets && openssl rand -base64 24 | tr -d '\n' > secrets/admin_password && chmod 644 secrets/admin_password
docker compose up -d && docker compose ps      # wait for "healthy"

2. A first query over HTTP

POST /db/{database}/query takes a JSON body: statement and parameters (written $name in Cypher). The reply lists columns, one array per row, and stats. The default database is neo4j; Basic authentication with the administrator account is fine for this first try, and the OpenAPI contract is at /q/openapi (Swagger UI at /rest).

PASSWORD="$(cat secrets/admin_password)"
curl -s -u "neo4j:$PASSWORD" -H 'Content-Type: application/json' localhost:8080/db/neo4j/query \
  -d '{"statement":"CREATE (a:Person {name: $name})-[:KNOWS]->(:Person {name: \"Bob\"}) RETURN a.name","parameters":{"name":"Ann"}}'
curl -s -u "neo4j:$PASSWORD" -H 'Content-Type: application/json' localhost:8080/db/neo4j/query \
  -d '{"statement":"MATCH (p:Person)-[:KNOWS]->(f) RETURN p.name, f.name"}'
# {"columns":["p.name","f.name"],"rows":[["Ann","Bob"]],"stats":{...}}

3. An account and a token for your application

Do not ship the administrator password. Create a local user with the writer role (or reader), then a revocable API token: it is shown once, is accepted as a bearer token over HTTP, MCP and Bolt, and as the password of that same user in the drivers. Run these statements in the web console (http://localhost:8080) or with cypher-shell.

CREATE USER app SET PASSWORD 'change-me' CHANGE NOT REQUIRED;
GRANT ROLE writer TO app;
CREATE API TOKEN app_token FOR USER app EXPIRES IN '90d';   -- shown once: gdt_… ; later: SHOW API TOKENS, DROP API TOKEN app_token

4. Java with the official Neo4j driver

gDown speaks Bolt 5.0 to 5.4: the official drivers work unchanged (Java, Python, JavaScript, Go, .NET), and so do Neo4j-OGM and Spring Data Neo4j. neo4j:// routes writes to the leader and reads to the followers; bolt:// talks to one member. Managed transactions are retried across a leader change.

Maven

<dependency>
  <groupId>org.neo4j.driver</groupId>
  <artifactId>neo4j-java-driver</artifactId>
  <version>5.28.15</version>
</dependency>

Gradle (Kotlin DSL)

implementation("org.neo4j.driver:neo4j-java-driver:5.28.15")

Java: GDOWN_TOKEN holds the token of step 3, never written in the code

import org.neo4j.driver.*;
import java.util.Map;

try (Driver driver = GraphDatabase.driver("neo4j://localhost:7687", AuthTokens.basic("app", System.getenv("GDOWN_TOKEN")))) {
    driver.verifyConnectivity();
    try (Session session = driver.session(SessionConfig.forDatabase("neo4j"))) {
        session.executeWrite(tx -> tx.run("CREATE (:Person {name: $n})", Map.of("n", "Ada")).consume());
        var names = session.executeRead(tx -> tx.run("MATCH (p:Person) RETURN p.name AS name ORDER BY name").list(r -> r.get("name").asString()));
        System.out.println(names);
    }
}

5. Python

The same driver API from Python: the neo4j package is enough, with the user and token of step 3.

pip install neo4j
python3 - <<'PY'
import os
from neo4j import GraphDatabase
with GraphDatabase.driver("neo4j://localhost:7687", auth=("app", os.environ["GDOWN_TOKEN"])) as driver:
    driver.verify_connectivity()
    with driver.session(database="neo4j") as s:
        s.execute_write(lambda tx: tx.run("CREATE (:Person {name: $n})", n="Ada").consume())
        print(s.execute_read(lambda tx: [r["name"] for r in tx.run("MATCH (p:Person) RETURN p.name AS name ORDER BY name")]))
PY

On the Gluonify platform

An application deployed on Gluonify does not configure gDown. Declare gdown in uses (or let the build infer it from the Neo4j driver on the runtime classpath): the platform injects GLUONIFY_GDOWN_BOLT_URL and GLUONIFY_GDOWN_CA_FILE before start, Bolt over TLS on the internal network, and the account comes from the application's secrets.

gluonify.json (only when the driver is not on the runtime classpath)

{ "uses": ["gdown"] }

Reading the injected variables (Java driver)

// On Gluonify, the platform sets GLUONIFY_GDOWN_BOLT_URL (bolt+s://…:7687) and GLUONIFY_GDOWN_CA_FILE (the internal CA, PEM) before start.
Config config = Config.builder().withTrustStrategy(Config.TrustStrategy.trustCustomCertificateSignedBy(new java.io.File(System.getenv("GLUONIFY_GDOWN_CA_FILE")))).build();
Driver driver = GraphDatabase.driver(System.getenv("GLUONIFY_GDOWN_BOLT_URL"), AuthTokens.basic(user, password), config);

From your workstation, the Gluonify CLI signs you in to your zone in the browser; the SDK then resolves the platform services for a local run.

java -jar gluonify-plasma-cli-0.7.0.jar login <your-zone>   # once, in the browser (PKCE); then: mvn quarkus:dev

Next steps

Web console: queries, graph view, data model and cluster state, at http://localhost:8080.
AI assistants: the MCP server at /mcp, vector and full-text indexes, and the memory of your repositories.
A cluster of three members, mutual TLS, OpenShift and Microsoft Entra ID: the installation page.
What is supported: openCypher coverage, Bolt and HTTP features, limits, on the comparison page.
Image documentation on Docker Hub: variables, volumes, upgrades, limits.

Ports: 8080 for HTTP (API, console, Swagger UI) and 7687 for Bolt. A token never goes in a URL, a log or a repository.