Redmine

h1. Howto advanced mercurial integration

This is mostly taken from the authors blog: http://yasdb.blogspot.com/2009/10/configuring-redmine-to-be-your-alll-in.html

This howto assumes you're on linux and followed the tutorial on advanced subversion integration up to and including the mysql nss/pam integration.  You should also know that this howto resorts to 2 entries in /etc/sudoers for accompanying scripts which could be a security vulnerability.  They were crafted such that this should not be possible but if you find a problem, please report and try to suggest a fix!

The attached and should be put in /usr/local/bin/.

You will want to run redmine and the webserver as it's own user, this howto assumes you choose a redmine unix user.  You might consider making this https only depending on your security needs.

Lets configure and take a look at the environment.

Perform the following actions as root after you've created the redmine user.

<pre>

    mkdir /home/redmineusers

    chown -R root:root /home/redmineusers

    cd /home/redmineusers

    mkdir bin projects

    chown -R root:root bin

    chown -R redmine:root projects

</pre>

After following the above tutorial, make a change to the shell_column property:

    users.homedir_column = "/home/redmineusers/";

    users.shell_column = "/bin/rbash";

Also create the following file:

/home/redmineusers/.profile

<pre>

    umask 0007

    export PATH=$HOME/bin/

</pre>

Symlink this file to .bashrc and .bash_login. This seemed necessary for ssh to work ok with the environment.

Make a symbolic link in /home/redmineusers/bin/hg -> /usr/local/bin/hg.wrapper

And now two additions to to your /etc/sudoers:

<pre>

    redmine ALL = NOPASSWD: /usr/local/bin/createrepo

    ALL ALL = NOPASSWD: /usr/local/bin/fixrepoperms

</pre>

And now you apply the attached patch. Its dirtyish code but it works ok and is much cleaner than things I've seen in the past for this stuff - for instance when you create your project, you won't have to wait x minutes for the repo to show up!

    Index: app/controllers/projects_controller.rb

    ===================================================================

    --- app/controllers/projects_controller.rb (revision 2924)

    +++ app/controllers/projects_controller.rb (working copy)

    @@ -74,6 +74,13 @@

    @project.enabled_module_names = Redmine::AccessControl.available_project_modules

    else

    @project.enabled_module_names = params[:enabled_modules]

    + r = Repository.factory("Mercurial",:root_url => "/home/redmineusers/projects/#{@project.identifier}",

    + :url => "/home/redmineusers/projects/#{@project.identifier}")

    + @project.repository = r

    + g = Group.new({ "lastname" => @project.identifier} ) #blidly create a new accompanying group

    + gr = Role.givable.find_by_name("Developer")

    + gm = Member.new(:principal => g, :roles => [gr], :project => @project)

    + @project.members << m =" Member.new(:user"> User.current, :roles => [r])

    @project.members << controller =""> 'projects', :action => 'settings', :id => @project

    end

    end

    +

    +

    end

    def copy

    Index: extra/svn/create_views.sql

    ===================================================================

    --- extra/svn/create_views.sql (revision 2924)

    +++ extra/svn/create_views.sql (working copy)

    @@ -13,7 +13,7 @@

    from projects;

    CREATE OR REPLACE VIEW nss_users AS

    -select login AS username, CONCAT_WS(' ', firstname, lastname) as realname, (id + 5000) AS uid, 'x' AS password

    +select login AS username, CONCAT_WS(' ', firstname, lastname) as realname, (id + 5000) AS uid, 'x' AS password,

    from users

    where status = 1;

Make sure you rerun the create_views.sql script after you apply the patch. It should rerun just fine and now users have to be active rather than just exist.

If you've completed the above, congratulations. You now have a secure, private sandboxed environment for every project (in which you're protected by good old unix permissions) that is tied to your redmine user/group database. Each project gets it's own group on creation and you must add developers to this group to get sourcecode management access. You also have a secured / restricted environment for users to ssh into - but really only as a gateway to hg serve. You should be able to configure this to your needs for your flavor of SCM. Redmine should also have your repository entered upon project creation (it seems you must make a commit though before it looks like it works, this is understandable).