(r7) RedmineFlorianUhlig < Homepages

You are here: CBM Wiki>Homepages Web>HomepageFlorianUhlig>RedmineFlorianUhlig (revision 7) (raw view)~~EditAttach~~
---+ Redmine Installation Instructions

On the following page I will explain how to install Redmine together with the required packages on a virtual machine running on a normal GSI linux computer.
I will describe also which changes have to be done, to run a VM in the DMZ-Service of GSI. Since the machine runs in a different network segment there are some additional steps to be done to enable all needed access to the outside world.

If installing Redmine on a new VM in the DMZ-Service one can skip all points up to *Setup VM in DMZ-Service*, because the VM is provided by the IT department of GSI.

---++ Prerequisites

   * Root access on the host computer
   * virtualization support on the host computer
   * virtual machine image with basic Debian Wheezy system

---++ Install virtualization support on host computer

For the installation of the virtualization support please check the excellent information provided by Victor Penso. The instructions and the scripts can be found at [[https://github.com/vpenso/libvirt-shell-functions][github]]. There are also instructions how to get a virtual machine image at GSI.

---++ Adapt the virtual Debian Wheezy image

The image are missing some important features which has to be installed before you can install Redmine using the cookbook. Everything can be installed using apt.

   * lsb-release : without the package chef-solo will not work 
   * ca-certificates : allow to install the GSI specific certificates
   * ruby-dev : without the package the mysql installation fails, because it is using gems
   * GSI related certificates : Needed to connect to the GSI subversion repository.
   * locate ?
   * unzip ?

Before running apt one must copy the GSI related certificates to the correct position in the file system of the vm. In the directory with the instance of the vm use the following command to copy the required files from the host system to the correct location of the vm
<verbatim>
vm put /usr/local/share/ca-certificates/dfn_pca_global_g01.crt /usr/local/share/ca-certificates/  
vm put /usr/local/share/ca-certificates/gsi_ca_02.crt /usr/local/share/ca-certificates/
</verbatim>

After you copied the files login to the machine and run apt to install all the additional packages.

<verbatim>
sudo apt-get install lsb-release ca-certificates ruby-dev <everything else>
</verbatim>

Now you have an image which can be used as base for the redmine installation.

---++ Create a new instance of the virtual image

<verbatim>
vm clone <your image> lxdev01
</verbatim>

After some time the machine is provisioned and booted so you can login

<verbatim>
vm login
</verbatim>

If everything looks okay log out again.

---++ Setup VM in DMZ-Service

This section is only relevant if the machine is in DMZ-Service. Since in this network the connection to the outside is very limited one has to define the required proxy servers. To enable the needed acces for ruby/chef one has to set the correct environment variables in the .bashrc of root

<verbatim>
export https_proxy=140.181.64.225:8080
export http_proxy=140.181.64.225:8080
export ftp_proxy=140.181.64.225:8080
</verbatim>

If the www-proxy is defined in /etc/hosts (should be standarn with new machines but not tested) it should also be poosible to use the following definition


<verbatim>
export https_proxy=www-proxy.gsi.de:8080
export http_proxy=www-proxy.gsi.de:8080
export ftp_proxy=www-proxy.gsi.de:8080
</verbatim>

That one can download files using wget, add the proxies also in /etc/wgetrc

<verbatim>
https_proxy = http://www-proxy.gsi.de:8080/
http_proxy = http://www-proxy.gsi.de:8080/
ftp_proxy = http://www-proxy.gsi.de:8080/

# If you do not want to use proxy at all, set this to off.
use_proxy = on
</verbatim>

That svn can access files from our subversion server at GSI add the proxy settings in the global section of /etc/subversion/servers

<verbatim>
[global]
# http-proxy-exceptions = *.exception.com, www.internal-site.org
http-proxy-host = www-proxy.gsi.de
http-proxy-port = 8080
#
</verbatim> 

It is also necessary to check if the gsi and dfn certificate is installed correctly, otherwise redmine is not able to connect to the subversion server.
To test if the certificates are installed correctly (should be the case with the newest gsi-sys cookbook) try to connect to the subversion server

<verbatim>
svn ls https://subversion.gsi.de/fairroot
</verbatim>

If  the output is the listing of the directory everything is okay. If your are asked to accept the certificate of the subversion server there is a problem with the certificates.


---++ Install Redmine

Copy the required cookbooks to the directory holding the instance of the virtual machine

<verbatim>
vm config add cookbook <name>
</verbatim>

Copy and edit or create the file with the instructions for chef-solo and store in the directory of the instance of the virtual machine. An example of the file is shown below.

<verbatim>
{
  "run_list": [
    "recipe[apt]",
    "recipe[redmine]"
  ],
  "apt": {
    "packages": [
      "vim",
      "less",
      "joe",
      "apt-show-versions",
      "lynx",
      "unzip",
      "ruby-dev"
    ]
  },
  "redmine": {
    "databases": {
      "production": {
        "password": "my_secret_password"
      }
    }
  },
  "mysql": {
    "server_root_password": "another_secret_password"
  }
}
</verbatim>

Now you can start the installation using chef-solo

<verbatim>
vm config solo
</verbatim>

which will copy the information to the virtual machine and start chef-solo. The installation will crash at some point (installing libaprutil). Rerun the configuration again and the installation will run till the end. 

In case of an official machine one has to copy the files to the correct location in the filesystem which is /var/chef/. The cookbooks have go to the cookbooks subdirectory, the roles to roles and the data-bags to the subdirectories whith the same names. Beside the attributes.json file one needs additionaly the config.rb
file which went both to /var/chef. The content of config.rb is shown below.

<verbatim>
log_level         :info
log_location      STDOUT
verbose_logging   nil
cookbook_path     ["/var/chef/cookbooks"]
data_bag_path     "/var/chef/data-bags"
role_path         "/var/chef/roles"
cache_type        "BasicFile"
cache_options({   :path => "/tmp/chef/cache/checksums", :skip_expires => true })
</verbatim>

The installation procedure is started with 

<verbatim>
sudo chef-solo -c config.rb -j attributes.json
</verbatim>

After chef-solo has finished successfully one has to create the correct rules for the port forwarding from the host machine to the virtual machine. This is again done by some of Victors fantastic scripting commands.

<verbatim>
vm forward add <instance_name>:port <port of host computer>

e.g.

vm forward add lxdev02:80 80
vm forward add lxdev02:443 443
</verbatim>

Now you can login to Redmine for the first time. Use your favorite browser to navigate to the following URL

<Name of host computer>.gsi.de

If everything works you will be redirected to the https version of Redmine. 

Congratulation. You have now a running Redmine installation. Now we come to the necessary configuration of Redmine.

---++ Redmine Configuration

---+++ Change the default admin information

Now you should login and immediately change the admin password. Click on *Sign In* in the upper left corner of the web page and login with the default combination admin/admin. Click on *Administration* and *Users* and choose the admin user to change the password, the mail address and other things. After changing the items don't forget to save. To test if everything works log out and in again.


---+++ Change the general settings

Chose *Administration*, *Settings*, *General* and provide a good Name for the Redmine instance and write a nice welcome text which will be shown on the first page. Also set the host name and choose if you prefer http or https. Should make no difference since we redirect http to https anyway. Save the settings.

---+++ Sending E-Mail

*TODO: Create a template which creates the needed file during the installation procedure.*

To be able to send emails one has to set the correct information about the mail transport agent which should be used. Copy the example file, create a symbolic link and edit the file

<verbatim>
sudo cp /usr/local/share/redmine/current/config/configuration.yml.example /usr/local/share/redmine/shared/config/configuration.yml
sudo ln -s /usr/local/share/redmine/shared/config/configuration.yml /usr/local/share/redmine/current/config/configuration.yml
joe /usr/local/share/redmine/shared/config/configuration.yml
</verbatim>

In this file one finds several examples for different mail configurations. To send email at GSI one can use the smtp server at GSI. The settings are shown below.

<verbatim>
default:
  # Outgoing emails configuration (see examples above)
  email_delivery:
    delivery_method: :smtp
    smtp_settings:
      address: "smtp.gsi.de"
      port: 25
</verbatim>

<verbatim>
sudo service apache2 restart
</verbatim>

Save the file and restart apache that the changes take effect. Now log in as admin and choose *Administration*, *Settings*, *Email notification* to change the email settings. Choose a good name as sender address. Beside that chose whatever seems appropriate for you. In the text field for the email footer exchange hostname by the name of the machine.
Save the settings and the test the mail by clicking on *Send a test mail* in the lower right corner of the page. If you receive the mail everything is okay.

---+++ Enable the LDAP authentication

To use the secure ldap (sldap) connection to the GSI LDAP server one has to change the ruby ldap module. This is necessary since the GSI ldap server is picky about the used SSL protocol which has to be SSLv3. The ruby openssl module is able to define the used protocol but unfortunately the ldap module cn't pass the information to openssl. To explicitely use the correct version of the protocol change thh following line in /var/lib/gems/1.9.1/gems/net-ldap-0.3.1/lib/net/ldap.rb

<verbatim>
    ctx = OpenSSL::SSL::SSLContext.new
</verbatim>

has to become

<verbatim>
    ctx = OpenSSL::SSL::SSLContext.new("SSLv3")
</verbatim>

If you only want to authenticate against the GSI LDAP server, you have to fill in the required information which are shown in the attached screenshot. In this setup it is only tested if the user has a GSI web account and if the given password is correct. If the authentication suceed a new user is created automatically in Redmine.

To do this please choose *Administration*, *LDAP authentication*. Since there is no LDAP defined click on *new authentication mode* and fill the form with help of the attached screenshot.


If you also want to check if the user is in a distinct group you have to use an additional module which is described below. 

Due to the changes in the ruby ldap module one has to restart apache again.

<verbatim>
sudo service apache2 restart
</verbatim>


Please fill the complete form with the required information, log out and try to *Sign In* with your GSI web account. Don't use *Register*.
If the authentication works you end in the registration form which you have to fill and save.

---+++ Enable the automatic refresh procedure

In the default settings the local information about an external repository is only updated when the information is first accessed. This means if there was no usage of the repository browser for some time, but many commits to the repository, redmine will update first his local information. Depending on the ammount of commits this can be a time consuming action. For this time the application will block, which is a problem for an interactive application.
To overcome the problem one can setup a automatic procedure that redmine updates the database immediatly after each commit. In this case the data is always up to date. 

To setup this feature one has to enable the mechanism on the redmine server, create a key on the redmine server, and add/change the post-commit hook on the repository server. 
On the redmine server login as administrator and navigate to *Administration*, *Settings*, *Repositories*. On the page click on *Enable the WS for repository managment* and create a key by clicking on *Generate a key*. Don't forget to save the changes afterwards.

On the subversion server add a post-commit hook or change the existing one. In any case one has to add the following line

<verbatim>
curl "https://<webserver_adress>/sys/fetch_changesets?key=<generated key>" --capath /etc/ssl/certs/  
</verbatim>

The extra argument is necessary because the curlinstalltion (at least the one at GSI) uses its own certificates which does not know dfn and gsi. In the ssl cert directory both certificates are present.   


*TODO: Find out if there is a possibility to have different keys for different repositories or if there is another way not to check all repositories if there are changes in only one.*


---+++ Install useful plugins

Redmine is extendable by an enormous amount of plugins. A list of available plugins can be found at [[http://www.redmine.org/plugins?page=1][Redmine webpage]]. Instructions about plugin installation is [[http://www.redmine.org/projects/redmine/wiki/Plugins][here]].

In the following I will list a personal list of useful plugins and installation instructions if they differ from the normal installation procedure.

   * Redmine Ldap Sync
   * Code Review

---++++ Install and configure the Ldap Sync plugin

The info about the plugin is [[http://www.redmine.org/plugins/redmine_ldap_sync][here]]

Navigate to the plugins directory (/usr/local/share/redmine/current/plugins), clone the git repository, do the installation and restart the web server.

<verbatim>
cd /usr/local/share/redmine/current/plugins
sudo git clone https://github.com/thorin/redmine_ldap_sync.git
cd /usr/local/share/redmine/current/
sudo bundle install
sudo rake redmine:plugins:migrate RAILS_ENV=production
sudo chown -R www-data:www-data tmp/ldap_cache
sudo service apache2 restart
</verbatim>

In the *Administration* section one should see now the *LDAP synchronization* entry. Choose it and fill the form with the information of the two attached screenshots.

---++++ Install the Code Review plugin

The info about the plugin is [[http://www.redmine.org/plugins/codereview][here]]

Download the zip file, unzip it and do the installation procedure.

<verbatim>
cd /usr/local/share/redmine/current/plugins
sudo wget https://bitbucket.org/haru_iida/redmine_code_review/downloads/redmine_code_review-0.6.2.zip
sudo unzip redmine_code_review-0.6.2.zip
cd /usr/local/share/redmine/current/
sudo rake redmine:plugins:migrate RAILS_ENV=production
sudo service apache2 restart
</verbatim>

*TODO: Configuration instructions*

---+++ Install the Wiki Extensions plugin

The info about the plugin is [[http://www.redmine.org/plugins/wikiextensions][here]]

Download the zip file, unzip it and do the installation procedure.

<verbatim>
cd /usr/local/share/redmine/current/plugins
sudo wget https://bitbucket.org/haru_iida/redmine_wiki_extensions/downloads/redmine_wiki_extensions-0.6.3.zip
sudo unzip redmine_wiki_extensions-0.6.3.zip
cd /usr/local/share/redmine/current/
sudo rake redmine:plugins:migrate RAILS_ENV=production
sudo touch tmp/restart.txt
</verbatim>

Enable the module on the adminsitration setting page at *Administration*, *Settings*, *Projects* to add the module to any newly created project, and on the projects setting page at *Projects*, *<Project Name>*, *Settings*, *Projects* to add the module to already existing projects.


---++ Backup 

In case of a crash of the server and a total loss the server and the applictaion can be created from scratch using the instructions above, so no backup is needed. The relevant information abour Redmine is stored in the mysql database, so a backup of the database is an absolut must, otherwise one would start with an empty datatbase and an empty redmine application.

The backup strategy is in the moment rather simply. Cretae a git repository for a specific backup directory. Do once per day a dump of the mysql database to this backup directory. Add and commit the file to the git repository. Pull the changes of this repository from another computer which is in the normal gsi backup.

Since one has to put the mysql password in the script (which is not verry secure), create a backup user whith minimal privileges. To do so login to the mysql database as user root.

<verbatim>
mysql -u root -p
mysql> GRANT LOCK TABLES, SELECT ON redmine.* TO 'BACKUPUSER'@'localhost' IDENTIFIED BY 'secret_password';
mysql> flush privileges;
mysql> exit;
</verbatim>

Create the needed bash script in the home directory of the default user. The script is shown below.

<verbatim>
#! /bin/sh

# Settings
BACKUP_DIR="/data.local1/redmine_backup/"
DB_USER="BACKUPUSER"
DB_PASS="secret_password"
DB="redmine"
DB_DUMP="$BACKUP_DIR/$DB.sql"

# Create your backup directory if it doesn't exist
mkdir -p $BACKUP_DIR

# Dump the database
mysqldump -u $DB_USER -p$DB_PASS --skip-extended-insert $DB > $DB_DUMP

# Change to the backup directory and initialize a new Git repo if necessary
cd $BACKUP_DIR
git init

# Add the database to the repo and commit
git add $DB_DUMP
git commit -m "Update database dump"
</verbatim>

This will update the git repository on each run of the script.

On the computer which is in the GSI backup cretae the initial version of the repository using *git clone*.

  git clone ssh://uhlig@lxcbmredmine01.gsi.de/data.local1/redmine_backup

To do this without being asked for the password. put the correct keys to the webserver. After the initial version of the repository is there one can do an git pull to get the latetst ersion from the web server. To do this automatically on can use a script on the backup computer which triggers first the execution of the backup script on the web server and the pull the changes from the remote repository.

<verbatim>
#!/bin/bash

#set -xv

Backup_Dir=/u/uhlig/backup/redmine/redmine_backup

# trigger the mysqldump and git add on the remote host
/usr/bin/ssh -T uhlig@lxcbmredmine01.gsi.de /home/uhlig/mysql_backup >> /dev/null 2>&1

# pull the changes from the remote host
cd $Backup_Dir
git pull

#set +xv
</verbatim>
 
To call this script regulary create a cron job.

<verbatim>
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin
MAILTO=f.uhlig@gsi.de
HOME=/u/uhlig


15 1 * * * /u/uhlig/backup/redmine/backup_redmine.sh
</verbatim>

Now each night at 1:15 one get the last changes from the web server. This should be before the normal backup at GSI is started. With this setup one gets a simple and secure backup of Redmine.

*TODO: Describe how to restore the backup. It would be good not to search for the instructions in case of an emergency.*
  
-- Main.FlorianUhlig - 28 Jun 2013
Topic attachments
I	Attachment	Action	Size	Date	Who	Comment
tiff	Ldap_Authentication.tiff	manage	205.1 K	12 Jul 2013 - 07:40	FlorianUhlig	LDAP Authentication in Redmine
tiff	Ldap_Synchronization_1.tiff	manage	230.6 K	12 Jul 2013 - 07:41	FlorianUhlig	LDAP Synchronization in Redmine
tiff	Ldap_Synchronization_2.tiff	manage	217.7 K	12 Jul 2013 - 07:41	FlorianUhlig	LDAP Synchronization in Redmine
patch	redmine_ldap_group_auth.patch	manage	7.3 K	28 Jun 2013 - 12:25	FlorianUhlig	Redmine patch for LDAP group authentication
Topic revision: r7 - 22 Jul 2013, FlorianUhlig
Homepages
Login
Create personal sidebar
Homepages Web
Web Home | Search
Topics List | Index
Changes | Notifications
CBM Wiki Webs
edit WebLeftBar
Copyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding CBM Wiki? Send feedback
Imprint (in German)
Privacy Policy (in German)