HowTo configure Redmine for advanced Mercurial integration¶
This is mostly taken from the authors blog: http://yasdb.blogspot.com/2009/10/configuring-redmine-to-be-your-alll-in.html
This howto assumes you're on linux and followed the HowTo to handle SVN repositories creation and access control with Redmine up to and including the mysql nss/pam integration. You should also know that this howto resorts to 2 entries in /etc/sudoers for accompanying scripts which could be a security vulnerability. They were crafted such that this should not be possible but if you find a problem, please report and try to suggest a fix!
The attached script files should be put in /usr/local/bin/.
You will want to run redmine and the webserver as it's own user, this howto assumes you choose a redmine unix user. You might consider making this https only depending on your security needs. The author chose HTTPS with lighttpd.
Lets configure and take a look at the environment.
Perform the following actions as root after you've created the redmine user.
mkdir /home/redmineusers chown -R root:root /home/redmineusers cd /home/redmineusers mkdir bin projects chown -R root:root bin chown -R redmine:root projects
After following the above tutorial, make a change to the shell_column property:
users.homedir_column = "/home/redmineusers/";
users.shell_column = "/bin/rbash";
Also create the following file:
umask 0007 export PATH=$HOME/bin/
Symlink this file to .bashrc and .bash_login. This seemed necessary for ssh to work ok with the environment.
Make a symbolic link in /home/redmineusers/bin/hg -> /usr/local/bin/hg.wrapper
And now two additions to to your /etc/sudoers:
redmine ALL = NOPASSWD: /usr/local/bin/createrepo ALL ALL = NOPASSWD: /usr/local/bin/fixrepoperms
And now you apply the attached patch. It's dirtyish code but it works ok and is much cleaner than things other things out there for this kind of stuff. It's not very large so feel free to inspect.
Make sure you rerun the create_views.sql script after you apply the patch. It should rerun just fine and now users have to be active rather than just exist.
If you've completed the above, congratulations. You now have a secure, private sandboxed environment for every project (in which you're protected by good old unix permissions) that is tied to your redmine user/group database. Each project gets it's own group on creation and you must add developers to this group to get sourcecode management access. You also have a secured / restricted environment for users to ssh into - but really only as a gateway to hg serve. You should be able to configure this to your needs for your flavor of SCM. Redmine should also have your repository entered upon project creation (it seems you must make a commit though before it looks like it works, this is understandable).