Install Redmine 421 on Centos 7 » History » Version 3
Fletcher Johnston, 2021-08-17 23:35
1 | 3 | Fletcher Johnston | h1. Installation of Redmine 4.2.x on CentOS 7 + SELinux, Apache 2.4, Passenger |
---|---|---|---|
2 | 1 | Fletcher Johnston | |
3 | {{>toc}} |
||
4 | |||
5 | 3 | Fletcher Johnston | _Edit August 17, 2021_: This guide was originally written for Redmine 4.2.1, but shortly after publishing 4.2.2 was released. The steps in this guide should work equally well for any 4.2.x version of Redmine, but please note that it has only been tested on 4.2.1 and 4.2.2. |
6 | 1 | Fletcher Johnston | |
7 | 3 | Fletcher Johnston | This guide will walk you through the installation procedure for Redmine 4.2.x on CentOS7, including support for SELinux. Much of what follows is based off the excellent guide by Franck Michel which can be found [[Install_Redmine_346_on_Centos_75| here]]. |
8 | |||
9 | 1 | Fletcher Johnston | This guide will not cover installing and configuring a database for Redmine; that's something that is covered in many other guides and is pretty straightforward. This guide will also not cover any SCM repos, or integration with LDAP, but will cover how to go about getting Redmine working with SELinux enabled in CentOS7. Every Redmine HOWTO I've come across makes use of the Passenger GEM, however the GEM doesn't come with any SELinux policies. Though there is an SELinux HOWTO [[RedmineAndSELinuxOnCentOS| here]], following it didn't really help me. This guide represents many hours of painfully reading Redmine, Passenger, and SELinux error logs. I hope you find it useful! |
10 | |||
11 | The full configuration used in this guide is: |
||
12 | |||
13 | * CentOS Linux release 7.9.2009 (Core) |
||
14 | * Apache 2.4.6 |
||
15 | 3 | Fletcher Johnston | * Redmine 4.2.2 |
16 | 1 | Fletcher Johnston | * Ruby 2.7.3 |
17 | * Apache Passenger 6.0.8 |
||
18 | * SELinux tweaks |
||
19 | |||
20 | h2. Initial Configuration |
||
21 | |||
22 | To begin, I'd recommend a fresh CentOS install. You will, of course, have to install an RDBMS of your choice, either on the same server or on a dedicated server. |
||
23 | |||
24 | h2. Install necessary packages |
||
25 | |||
26 | We'll install all the packages necessary to install Ruby. Additionally, we're installing Apache and mod_ssl, which we'll need to serve Redmine. |
||
27 | |||
28 | <pre> |
||
29 | [As root/sudo]: |
||
30 | yum install -y gcc-c++ patch readline readline-devel zlib zlib-devel libyaml-devel libffi-devel openssl-devel make bzip2 autoconf automake libtool bison iconv-devel sqlite-devel wget mysql-devel httpd mod_ssl |
||
31 | </pre> |
||
32 | |||
33 | h2. Install Ruby 2.7.3 |
||
34 | |||
35 | Adapted directly from Franck's guide [[Install_Redmine_346_on_Centos_75 | here]]. |
||
36 | |||
37 | <pre> |
||
38 | [As root/sudo]: |
||
39 | gpg2 --keyserver hkp://pool.sks-keyservers.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB |
||
40 | curl -L get.rvm.io | bash -s stable |
||
41 | source /etc/profile.d/rvm.sh |
||
42 | rvm reload |
||
43 | rvm requirements run |
||
44 | rvm install 2.7 |
||
45 | rvm list |
||
46 | ruby --version |
||
47 | </pre> |
||
48 | |||
49 | 3 | Fletcher Johnston | h2. Install Redmine 4.2.2 |
50 | 1 | Fletcher Johnston | |
51 | 3 | Fletcher Johnston | Latest version is 4.2.2 at the time of writing. This is adapted from Frank's guide[[Install_Redmine_346_on_Centos_75| here]]. |
52 | 1 | Fletcher Johnston | I like to install Redmine in /var/www/ |
53 | |||
54 | h3. Download and untar Redmine |
||
55 | |||
56 | <pre> |
||
57 | 3 | Fletcher Johnston | wget https://redmine.org/releases/redmine-4.2.2.tar.gz |
58 | tar xvfz redmine-4.2.2.tar.gz |
||
59 | mv redmine-4.2.2 /var/www/ |
||
60 | export REDMINE=/var/www/redmine-4.2.2 |
||
61 | 1 | Fletcher Johnston | cd $REDMINE |
62 | cp config/database.yml.example config/database.yml |
||
63 | </pre> |
||
64 | |||
65 | This will install Redmine into the /var/www directory. This works well with Apache and SELinux. |
||
66 | |||
67 | Customize your `database.yml` file. You can refer to [[RedmineInstall#Step-3-Database-connection-configuration | guide]] for additional help. |
||
68 | |||
69 | <pre> |
||
70 | vi config/database.yml |
||
71 | </pre> |
||
72 | |||
73 | h3. Install Gems and Create Database Schema |
||
74 | |||
75 | <pre> |
||
76 | cd $REDMINE |
||
77 | gem install bundler |
||
78 | bundle install --without development test |
||
79 | bundle exec rake generate_secret_token |
||
80 | RAILS_ENV=production REDMINE_LANG=en bundle exec rake db:migrate |
||
81 | RAILS_ENV=production REDMINE_LANG=en bundle exec rake redmine:load_default_data |
||
82 | </pre> |
||
83 | |||
84 | h3. Install Passenger 6.0.8 |
||
85 | |||
86 | Here is where this guide will diverge considerably from Franck's guide. That guide, and all others I could find for Apache, make use of the Passenger Gem, which you'd install by doing something like this: |
||
87 | |||
88 | <pre> |
||
89 | gem install passenger |
||
90 | </pre> |
||
91 | |||
92 | However, as you work through that installation process, the installer actually warns you that the recommended method for installing Passenger on RHEL type systems is using a package manager, as that will include the SELinux policies necessary for Passenger to function properly. That's what we're going to do here. These steps are adapted from the excellent Passenger installation guide which can be found "here":https://www.phusionpassenger.com/library/install/apache/install/oss/el7/. |
||
93 | |||
94 | <pre> |
||
95 | yum install -y epel-release yum-utils |
||
96 | yum-config-manager --enable epel |
||
97 | yum clean all && sudo yum update -y |
||
98 | yum install -y pygpgme curl |
||
99 | curl --fail -sSLo /etc/yum.repos.d/passenger.repo https://oss-binaries.phusionpassenger.com/yum/definitions/el-passenger.repo |
||
100 | yum install -y mod_passenger |
||
101 | </pre> |
||
102 | |||
103 | Once Passenger is installed you can verify the installation using: |
||
104 | |||
105 | <pre> |
||
106 | /usr/bin/passenger-config validate-install |
||
107 | </pre> |
||
108 | |||
109 | Which should give you an output like this: |
||
110 | |||
111 | <pre> |
||
112 | * Checking whether this Passenger install is in PATH... ✓ |
||
113 | * Checking whether there are no other Passenger installations... ✓ |
||
114 | </pre> |
||
115 | |||
116 | Now, this is where things get a little tricky. As part of its' installation process `RVM` installs whichever version of Ruby you ask it to, but also installs the System version of Ruby (at the time of writing, this is 2.0.0.648-36.el7 for CentOS7, which is woefully out of date). When Passenger is installed, the System Ruby package is a requirement, and Passenger is "pointed" at the System version of Ruby. This will cause all sorts of problems for us as Redmine needs at least Ruby 2.4, but we'd like to use something that isn't EOL. Luckily, Passenger's documentation covers "this":https://www.phusionpassenger.com/library/indepth/ruby/multiple_rubies.html: |
||
117 | "Once installed, you can run Passenger's Ruby parts under any Ruby interpreter you want, even if that Ruby interpreter was not the one you originally installed Passenger with." |
||
118 | |||
119 | Excellent! Let's go about doing that. Before we leave this section, we need to determine where the RVM Ruby interpreter was installed. Use this command for that: |
||
120 | |||
121 | <pre> |
||
122 | /usr/bin/passenger-config --ruby-command |
||
123 | </pre> |
||
124 | |||
125 | This should return something like: |
||
126 | |||
127 | <pre> |
||
128 | passenger-config was invoked through the following Ruby interpreter: |
||
129 | Command: /usr/local/rvm/gems/ruby-2.7.2/wrappers/ruby |
||
130 | Version: ruby 2.7.2p137 (2020-10-01 revision 5445e04352) [x86_64-linux] |
||
131 | To use in Apache: PassengerRuby /usr/local/rvm/gems/ruby-2.7.2/wrappers/ruby |
||
132 | To use in Nginx : passenger_ruby /usr/local/rvm/gems/ruby-2.7.2/wrappers/ruby |
||
133 | To use with Standalone: /usr/local/rvm/gems/ruby-2.7.2/wrappers/ruby /usr/bin/passenger start |
||
134 | |||
135 | |||
136 | ## Notes for RVM users |
||
137 | Do you want to know which command to use for a different Ruby interpreter? 'rvm use' that Ruby interpreter, then re-run 'passenger-config about ruby-command'. |
||
138 | </pre> |
||
139 | |||
140 | h3. Configure Apache |
||
141 | |||
142 | Create a new virtual host config file in apache: /etc/httpd/conf.d/redmine.conf. Again, the majority of this section comes from Franck's guide, but with one key addition. This first line, comes from the output of the command in the previous section, tells Passenger which Ruby interpreter to use. |
||
143 | |||
144 | <pre> |
||
145 | PassengerRuby /usr/local/rvm/gems/ruby-2.7.2/wrappers/ruby |
||
146 | |||
147 | <VirtualHost *:80> |
||
148 | ServerName yourserver.domain.org |
||
149 | 3 | Fletcher Johnston | DocumentRoot "/var/www/redmine-4.2.2/public" |
150 | 1 | Fletcher Johnston | |
151 | ErrorLog logs/redmine_error_log |
||
152 | LogLevel warn |
||
153 | |||
154 | 3 | Fletcher Johnston | <Directory "/var/www/redmine-4.2.2/public"> |
155 | 1 | Fletcher Johnston | Options Indexes ExecCGI FollowSymLinks |
156 | Require all granted |
||
157 | AllowOverride all |
||
158 | </Directory> |
||
159 | </VirtualHost> |
||
160 | </pre> |
||
161 | |||
162 | h2. Permissions and SELinux Policies |
||
163 | |||
164 | Now the time has come to set permissions and SELinux policies. We'll begin by setting the normal Linux permissions on the entire Redmine folder. Some other guides only apply this to some sub folders, but I found that with SELinux enabled it was necessary to chown everything as apache:apache. |
||
165 | |||
166 | <pre> |
||
167 | cd $REDMINE |
||
168 | cd .. |
||
169 | 3 | Fletcher Johnston | chown -R apache:apache redmine-4.2.2 |
170 | 1 | Fletcher Johnston | </pre> |
171 | |||
172 | 2 | Fletcher Johnston | Next, we will set the SELinux policies. These were taken from this [[RedmineAndSELinuxOnCentOS| guide]]. |
173 | 1 | Fletcher Johnston | |
174 | <pre> |
||
175 | # Set SELinux permissions |
||
176 | 3 | Fletcher Johnston | chcon -R -t httpd_log_t redmine-4.2.2/log/ |
177 | chcon -R -t httpd_tmpfs_t redmine-4.2.2/tmp/ |
||
178 | chcon -R -t httpd_sys_script_rw_t redmine-4.2.2/files/ |
||
179 | chcon -R -t httpd_sys_script_rw_t redmine-4.2.2/public/plugin_assets/ |
||
180 | restorecon -Rv redmine-4.2.2/ |
||
181 | 1 | Fletcher Johnston | </pre> |
182 | |||
183 | h2. Environment Variables |
||
184 | |||
185 | Passenger might complain that it isn't able to install a native support .so file. We can suppress this warning by adding the following lines to: |
||
186 | <pre> |
||
187 | vi /etc/sysconfig/httpd |
||
188 | </pre> |
||
189 | |||
190 | <pre> |
||
191 | PASSENGER_COMPILE_NATIVE_SUPPORT_BINARY=0 |
||
192 | PASSENGER_DOWNLOAD_NATIVE_SUPPORT_BINARY=0 |
||
193 | </pre> |
||
194 | |||
195 | |||
196 | That's it! |
||
197 | |||
198 | At this point, restart Apache. |
||
199 | |||
200 | <pre> |
||
201 | systemctl restart httpd |
||
202 | </pre> |
||
203 | |||
204 | You should be able to access Redmine at the domain you entered in step X above. |
||
205 | |||
206 | h2. Additional Considerations |
||
207 | |||
208 | A few additional considerations: |
||
209 | |||
210 | 2 | Fletcher Johnston | * It would be wise to install some kind of firewall (iptables or firewalld) to protect your server. |
211 | 1 | Fletcher Johnston | * If you install themes or plugins to Redmine you will have to repeat the chown procedure above. |