From 3DN

Contents 1 Trac setup 1.1 Configuring Apache 1.2 Rethinking this: Secure servers 1.3 Trac AuthOpenId 1.4 AuthZ

Trac setup

For bugtracking purposes that are closely linked to my Subversion servers I decided to use [Trac]. Installing this was easy as there is a Debian package for it:

fredl@positron:~$ sudo apt-get install trac

However, now comes the configuration part. From the README.Debian.gz:

Trac uses SQLite (python-pysqlite2) as an embedded database, but 
can be configured to use PostgreSQL or MySQL instead.

That's good to know. So first I created an Apache virtual host, [trac.dutchie.org]; Not knowing yet what to specify in the documentroot I left this blank and continued reading the README.Debian.gz. Trac closely cooperates with Subversion so I decided to initialize it to run with our opensource Subversion first since there's no data worth mentioning in it yet:

positron:~# trac-admin /web/prd/trac.dutchie.org initenv
Creating a new Trac environment at /web/prd/trac.dutchie.org

Trac will first ask a few questions about your environment 
in order to initialize and prepare the project database.

 Please enter the name of your project.
 This name will be used in page titles and descriptions.

Project Name [My Project]> Dutchie
 
 Please specify the connection string for the database to use.
 By default, a local SQLite database is created in the environment
 directory. It is also possible to use an already existing
 PostgreSQL database (check the Trac documentation for the exact
 connection string syntax).

Database connection string [sqlite:db/trac.db]> ...

After filling out the questions that are quite simple to answer, the database was populated (I chose MySQL so I created a database and database user first, then entered mysql://username:password@localhost/databasename) and everything seemed alright with the exception of an error message:

/usr/lib/python2.5/site-packages/trac/db/util.py:50: Warning: Incorrect string value: '\xE2\x86\x92 Ex...' for column 'text' at row 0
  return self.cursor.execute(sql_escape_percent(sql), args)

I'll have to check into that later on.

UPDATE: Well several years later I finally found the fix (I didn't use Trac all that often :). Turns out there was a [Trac Bug] that was triggered by having filenames in the repository with case sensitive filenames. Had to fix this by:

mysql> alter table node_change convert to character set binary;
Query OK, 11080 rows affected (0.15 sec)

followed by a resync:

omega:/web/prd/dutchie# trac-admin /web/prd/trac.3dn.nl/ resync 

Configuring Apache

Since I already had mod_python installed and configured I decided to use that. All I had to do to get it going was to add:

  ServerName trac.dutchie.org
  DocumentRoot /web/prd/trac.dutchie.org
  Alias /trac/ /usr/share/pyshared/trac/htdocs
  <Directory "/usr/share/pyshared/trac/htdocs">
      Options Indexes MultiViews
      AllowOverride None
      Order allow,deny
      Allow from all
  </Directory>
  <Location />
      SetHandler mod_python
      PythonHandler trac.web.modpython_frontend
      PythonInterpreter main_interpreter
      PythonOption TracEnv /web/prd/trac.dutchie.org
      PythonOption TracUriRoot /
      AuthType Basic
      AuthName "trac.dutchie.org"
      # Use the SVN password file.
      AuthUserFile /prj/opensource/access/users
      Require valid-user
  </Location>
  ErrorLog /var/log/apache2/prd-trac.dutchie.org-error.log
  CustomLog /var/log/apache2/prd-trac.dutchie.org-access.log combined

To the virtual host config file, so that wasn't so bad. Repeating the trac-init for the 3DN repository (that holds a bunch of projects already) was more problematic:

Initenv for '/web/prd/trac.3dn.nl' failed. 
 (1062, "Duplicate entry '431-trunk/Tracy/lukas.html-A' for key 1")
Traceback (most recent call last):

Fortunately this did not seem to break the whole setup as the [trac.3dn.nl] server seems to work properly.

Rethinking this: Secure servers

The Trac servers set up like above have a Subversion [file browser]. Since we decided to keep our proprietary source behind a closed TCP port this would not be a very clever idea :) So instead we make trac.3dn.nl secure and make it listen on port 442. The Dutchie Trac server we'll keep on port 80 and we'll keep it insecure as it's opensource code anyway and everybody may see what's in there.

Trac AuthOpenId

I don't really fancy adding useraccounts all the time so I'll be setting up an OpenID login on the [3DN Opensource Trac] as well using this [plugin] later.

AuthZ

Both subversion servers use an AuthZ mechanism to determine who's allowed to see something or commit something.

• https://secure.3dn.nl:442/svn uses /etc/apache2/svn_access_3dn_control
• https://secure.dutchie.org:444/svn uses /prj/opensource/access/control

Since Trac does not use the HTTP method to access SVN, it is not aware of the authz mechanism. We add this behaviour by adding:

• /web/prd/trac.3dn.nl/conf/trac.ini: authz_file = /etc/apache2/svn_access_3dn_control
• /web/prd/trac.dutchie.org/conf/trac.ini: /prj/opensource/access/control