Redmine

System users

• "git": owns the git repositories.
  • Home directory: /opt/gitolite
• "redmine": owns the redmine-related files in /opt/redmine.
  • home directory: /opt/redmine (should be changed to make upgrade easier)

Gitolite integration

• Since redmine can't manage git repositories , we installed the redmine_git_hosting plugin. Its configuration can be modified using the corresponding tab in the redmine settings.

• In order to manage the git repos the redmine user has admin access to gitolite, using its "~/.ssh/redmine_gitolite_admin_id_rsa" key

• Using sudo rules, redmine and git are allowed to run arbitrary commands with the privileges of each other

SElinux configuration

activated booleans:

• httpd_setrlimit (Allow httpd to setrlimit)
• httpd_can_network_connect (Allow httpd to can network connect)
• httpd_mod_auth_pam (Allow httpd to mod auth pam)
• httpd_run_stickshift (Allow httpd to run stickshift)
• httpd_can_sendmail (Allow httpd to can sendmail)

custom policies:

#============= httpd_t ==============
allow httpd_t configfs_t:dir getattr;

There are more custom policies needed for the interaction between git and apache. This is hacked together, though, so I'm not documenting it yet

Upgrade procedure

Since redmine is not installed using yum (the version offered by CentOS was too old), it needs to be upgraded manually. Unfortunately, there is no real "security upgrades" mailing list of any sort. Instead, we use a crude website-diff cronjob on the Redmine security announcement website

Upgrading itself is rather straightforward: Download the new redmine version, copy the modifiable data from the old redmine instance (files subdirectory, database, plugins subdirectory) and redirect the symbolic link in /var/www/redmine.

Make sure to follow the redmine_git_hosting upgrade guide after you copied the plugins directory. There might be some "access denied" problem - the /var/lib/gems directory should belong to "redmine" as far as I can see, but sometimes the files are owned by root nevertheless. Since I don't really see what magic the bundle tool does I just fixed this by hand during upgrades.

Important: updating gitolite3 breaks the current setup! The issue is that the centos rpm package sets the ownership of /var/lib/gitolite3 and /var/lib/gitolite3/.ssh to gitolite3:gitolite3. We do however still use the legacy configuration inherited from debian, where the gitolite user is "git", not "gitolite3". The short term workaround is to locate all files that, after the update, are owned by gitolite3 with "find / -user gitolite3" and chage these to "git:git". Two possible long term solutions are either figuring out how to change the user used duringteh update, or to change the whole system to systematically use gitolite3 which is the centos standard. While better, this requires to change a lot of settings (sudo, redmine, etc ...) and it will also change all the redmine clone URLs which will affect all users on a large scale.

Installation history

• installed MariaDB (instead of MySQL - it should work anyway)
  • CentOS 7 replaced MySQL by MariaDB. I think there is no need to deviate from the distro standard.
• called mysql_secure_installation
• added a redmine user and extracted the 3.1.0 version of redmine
• installed the required gems
• added a redmine table in the database and loaded the state from the old redmine machine into it
• copied the files directory from the old redmine machine
• installed apache

• installed passenger as described here https://www.phusionpassenger.com/library/install/apache/install/oss/el7/

  • note that this includes adding a new repo to the system. Since the website is explicitly mentioned by the passenger-installation I got through the gem system I deemed it trustworthy

Issues

Wrong push URL on commit

It has happened twice now that pushing to certain repositories fails with a message like this:

remote:
remote: Notifying Redmine about changes to this repository :
'constructive_completeness/constructive-completeness' ...
remote: Redmine URL :
'https://redmine.ps.uni-saarland.de/redmine/githooks/post-receive/redmine/constructive_completeness'
remote: Error contacting Redmine about changes to this repo.
remote:
remote: Looking for additional global post-receive hooks...
remote:   - Found folder: hooks/post-receive.d
remote:   - Found executable file:
hooks/post-receive.d/mail_notifications ... [added]
remote:
remote: Looking for additional local post-receive hooks...
remote:   - Folder not found: hooks/post-receive.local.d
remote:   - No local hooks found
remote:
remote: Calling additional post-receive hooks...
remote:   - Executing extra hook 'hooks/post-receive.d/mail_notifications'
remote:     multimailhook is disabled
remote:

The issue is, that we changed the redmine URL from redmine.ps.uni-saarland.de/redmine/* to redmine.ps.uni-saarland.de/* at some point. This should be fixed, but some old repositories might have the old URL stored somewhere we didn't look. In case this issue appears again, fix the respective URL in the /opt/gitolite/.gitconfig (and find out who overwrote the URL there!)

empty repositories

The following empty repos were created during the upgrading process (due to misconfiguration on my part). We should be able to simply delete them.

Initialized empty Git repository in /var/lib/gitolite3/repositories/a-syntactic-theory-of-finitary-sets/ba-dmueller.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/ba-anisimov_project/ba-anisimov.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/ba-hofmann_project/ba-hofmann.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/ba-kunze_project/ba-kunze.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/ba-schneidewind_project/ba-schneidewind.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/browgen_project/browgen.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/cc2-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/constructive-reg-lang/constructive-reg-lang-scm.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/constructive_completeness/constructive-completeness.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/cpp2015/cpp-2015.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/formal-unification_project/formalizing-unification.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/formalization-of-undecidability_project/formalized-undecidability.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/formalization-wo-theorem-project/formalization-wo-theorem-git.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/fti/fti-git.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/icl-2015/icl-2015-git.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/jk-memos-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/jkcl-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/jonas-kaiser-project/coqdev-tgmod/tgmod-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/jonas-kaiser-project/coqlib-jkcl/jkcl-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/jonas-kaiser-project/libtex-core/tex-core-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/jonas-kaiser-project/memos-jonas-kaiser/jk-memos-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/jonas-kaiser-project/proj-cc2/cc2-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/lattice-tower_project/general-tower.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/lecture-fp-ss15/fp-ss15.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/ma-smith_project/ma-smith.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/memos_gs/memos-gs.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/migration-test-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/project-finite-sets-in-ssreflect_project/ssr-finmap.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/ril-dominik-kirst_project/ril-domink-kirst.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/termination-proofs-with-intersection-types_project/termination-with-intersection.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/tex-core-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/tgmod-repo.git/
Initialized empty Git repository in /var/lib/gitolite3/repositories/trace-semantics-in-cps/trace-semantics.git/