HowTo configure Redmine for advanced Mercurial integration » History » Revision 3
Revision 2 (Jason Newton, 2009-10-15 00:57) → Revision 3/8 (Jason Newton, 2009-10-15 00:58)
h1. Howto advanced mercurial integration
This is mostly taken from the authors blog: http://yasdb.blogspot.com/2009/10/configuring-redmine-to-be-your-alll-in.html
This howto assumes you're on linux and followed the tutorial on advanced subversion integration up to and including the mysql nss/pam integration. You should also know that this howto resorts to 2 entries in /etc/sudoers for accompanying scripts which could be a security vulnerability. They were crafted such that this should not be possible but if you find a problem, please report and try to suggest a fix!
The attached script files should be put in /usr/local/bin/.
You will want to run redmine and the webserver as it's own user, this howto assumes you choose a redmine unix user. You might consider making this https only depending on your security needs.
Lets configure and take a look at the environment.
Perform the following actions as root after you've created the redmine user.
<pre>
mkdir /home/redmineusers
chown -R root:root /home/redmineusers
cd /home/redmineusers
mkdir bin projects
chown -R root:root bin
chown -R redmine:root projects
</pre>
After following the above tutorial, make a change to the shell_column property:
users.homedir_column = "/home/redmineusers/";
users.shell_column = "/bin/rbash";
Also create the following file:
/home/redmineusers/.profile
<pre>
umask 0007
export PATH=$HOME/bin/
</pre>
Symlink this file to .bashrc and .bash_login. This seemed necessary for ssh to work ok with the environment.
Make a symbolic link in /home/redmineusers/bin/hg -> /usr/local/bin/hg.wrapper
And now two additions to to your /etc/sudoers:
<pre>
redmine ALL = NOPASSWD: /usr/local/bin/createrepo
ALL ALL = NOPASSWD: /usr/local/bin/fixrepoperms
</pre>
And now you apply the attached patch. It's Its dirtyish code but it works ok and is much cleaner than things other things out there I've seen in the past for this kind of stuff. It's not very large so feel free stuff - for instance when you create your project, you won't have to inspect.
wait x minutes for the repo to show up!
Index: app/controllers/projects_controller.rb
===================================================================
--- app/controllers/projects_controller.rb (revision 2924)
+++ app/controllers/projects_controller.rb (working copy)
@@ -74,6 +74,13 @@
@project.enabled_module_names = Redmine::AccessControl.available_project_modules
else
@project.enabled_module_names = params[:enabled_modules]
+ r = Repository.factory("Mercurial",:root_url => "/home/redmineusers/projects/#{@project.identifier}",
+ :url => "/home/redmineusers/projects/#{@project.identifier}")
+ @project.repository = r
+ g = Group.new({ "lastname" => @project.identifier} ) #blidly create a new accompanying group
+ gr = Role.givable.find_by_name("Developer")
+ gm = Member.new(:principal => g, :roles => [gr], :project => @project)
+ @project.members << m =" Member.new(:user"> User.current, :roles => [r])
@project.members << controller =""> 'projects', :action => 'settings', :id => @project
end
end
+
+
end
def copy
Index: extra/svn/create_views.sql
===================================================================
--- extra/svn/create_views.sql (revision 2924)
+++ extra/svn/create_views.sql (working copy)
@@ -13,7 +13,7 @@
from projects;
CREATE OR REPLACE VIEW nss_users AS
-select login AS username, CONCAT_WS(' ', firstname, lastname) as realname, (id + 5000) AS uid, 'x' AS password
+select login AS username, CONCAT_WS(' ', firstname, lastname) as realname, (id + 5000) AS uid, 'x' AS password,
from users
where status = 1;
Make sure you rerun the create_views.sql script after you apply the patch. It should rerun just fine and now users have to be active rather than just exist.
If you've completed the above, congratulations. You now have a secure, private sandboxed environment for every project (in which you're protected by good old unix permissions) that is tied to your redmine user/group database. Each project gets it's own group on creation and you must add developers to this group to get sourcecode management access. You also have a secured / restricted environment for users to ssh into - but really only as a gateway to hg serve. You should be able to configure this to your needs for your flavor of SCM. Redmine should also have your repository entered upon project creation (it seems you must make a commit though before it looks like it works, this is understandable).