HowTo configure Redmine for advanced Mercurial integration

This is mostly taken from the authors blog:

This howto assumes you're on linux and followed the HowTo to handle SVN repositories creation and access control with Redmine up to and including the mysql nss/pam integration. You should also know that this howto resorts to 2 entries in /etc/sudoers for accompanying scripts which could be a security vulnerability. They were crafted such that this should not be possible but if you find a problem, please report and try to suggest a fix!

The attached script files should be put in /usr/local/bin/.

You will want to run redmine and the webserver as it's own user, this howto assumes you choose a redmine unix user. You might consider making this https only depending on your security needs. The author chose HTTPS with lighttpd.

Lets configure and take a look at the environment.

Perform the following actions as root after you've created the redmine user.

    mkdir /home/redmineusers
    chown -R root:root /home/redmineusers
    cd /home/redmineusers
    mkdir bin projects
    chown -R root:root bin
    chown -R redmine:root projects

After following the above tutorial, make a change to the shell_column property:
users.homedir_column = "/home/redmineusers/";
users.shell_column = "/bin/rbash";

Also create the following file:


    umask 0007
    export PATH=$HOME/bin/

Symlink this file to .bashrc and .bash_login. This seemed necessary for ssh to work ok with the environment.

Make a symbolic link in /home/redmineusers/bin/hg -> /usr/local/bin/hg.wrapper

And now two additions to to your /etc/sudoers:

    redmine ALL = NOPASSWD: /usr/local/bin/createrepo
    ALL ALL = NOPASSWD: /usr/local/bin/fixrepoperms

And now you apply the attached patch. It's dirtyish code but it works ok and is much cleaner than things other things out there for this kind of stuff. It's not very large so feel free to inspect.

Make sure you rerun the create_views.sql script after you apply the patch. It should rerun just fine and now users have to be active rather than just exist.

If you've completed the above, congratulations. You now have a secure, private sandboxed environment for every project (in which you're protected by good old unix permissions) that is tied to your redmine user/group database. Each project gets it's own group on creation and you must add developers to this group to get sourcecode management access. You also have a secured / restricted environment for users to ssh into - but really only as a gateway to hg serve. You should be able to configure this to your needs for your flavor of SCM. Redmine should also have your repository entered upon project creation (it seems you must make a commit though before it looks like it works, this is understandable).

Updated by Mischa The Evil almost 14 years ago · 8 revisions