Project

General

Profile

HowTo configure Redmine for advanced Mercurial integration » History » Version 5

Jason Newton, 2009-10-15 01:07

1 1 Jason Newton
h1. Howto advanced mercurial integration
2
3
This is mostly taken from the authors blog: http://yasdb.blogspot.com/2009/10/configuring-redmine-to-be-your-alll-in.html
4
5 5 Jason Newton
This howto assumes you're on linux and followed the [[HowTo to handle SVN repositories creation and access control with Redmine]] up to and including the mysql nss/pam integration.  You should also know that this howto resorts to 2 entries in /etc/sudoers for accompanying scripts which could be a security vulnerability.  They were crafted such that this should not be possible but if you find a problem, please report and try to suggest a fix!
6 1 Jason Newton
7 2 Jason Newton
The attached script files should be put in /usr/local/bin/.
8 1 Jason Newton
9
You will want to run redmine and the webserver as it's own user, this howto assumes you choose a redmine unix user.  You might consider making this https only depending on your security needs.
10
Lets configure and take a look at the environment.
11
12
Perform the following actions as root after you've created the redmine user.
13
14
<pre>
15
    mkdir /home/redmineusers
16
    chown -R root:root /home/redmineusers
17
    cd /home/redmineusers
18
    mkdir bin projects
19
    chown -R root:root bin
20
    chown -R redmine:root projects
21
</pre>
22
23
24
After following the above tutorial, make a change to the shell_column property:
25
    users.homedir_column = "/home/redmineusers/";
26
    users.shell_column = "/bin/rbash";
27
28
Also create the following file:
29
30
/home/redmineusers/.profile
31
<pre>
32
    umask 0007
33
    export PATH=$HOME/bin/
34
</pre>
35
Symlink this file to .bashrc and .bash_login. This seemed necessary for ssh to work ok with the environment.
36
37
Make a symbolic link in /home/redmineusers/bin/hg -> /usr/local/bin/hg.wrapper
38
39
And now two additions to to your /etc/sudoers:
40
<pre>
41
    redmine ALL = NOPASSWD: /usr/local/bin/createrepo
42
    ALL ALL = NOPASSWD: /usr/local/bin/fixrepoperms
43
</pre>
44
45 3 Jason Newton
And now you apply the attached patch. It's dirtyish code but it works ok and is much cleaner than things other things out there for this kind of stuff.  It's not very large so feel free to inspect.
46 1 Jason Newton
47
48
Make sure you rerun the create_views.sql script after you apply the patch. It should rerun just fine and now users have to be active rather than just exist.
49
50
51
If you've completed the above, congratulations. You now have a secure, private sandboxed environment for every project (in which you're protected by good old unix permissions) that is tied to your redmine user/group database. Each project gets it's own group on creation and you must add developers to this group to get sourcecode management access. You also have a secured / restricted environment for users to ssh into - but really only as a gateway to hg serve. You should be able to configure this to your needs for your flavor of SCM. Redmine should also have your repository entered upon project creation (it seems you must make a commit though before it looks like it works, this is understandable).