Install TeamForge with Oracle Database

In this distributed setup, TeamForge, Oracle database and other services are distributed across three servers, server-01 through server-03 as illustrated in the following table.

You can install TeamForge on both RHEL/CentOS 7.4 and 6.9. In this distributed setup, all the following services are installed on RHEL/CentOS 7.4 servers.

Dos and Don’ts

Prepare the Servers for TeamForge Installation (server-01 through server-03)

1. Install RHEL/CentOS 7.4 and log on as root.

   The host must be registered with the Red Hat Network if you are using Red Hat Enterprise Linux.
   
   See the RHEL 7.4 Installation Guide for help.

2. Check your networking setup. See Set up Networking for more information.

3. Configure the TeamForge installation repository

   TeamForge Installation Repository Configuration for Sites with Internet Access

   1. Contact the CollabNet Support and download the TeamForge 18.1 installation repository package to /tmp.
   2. Install the repository package.

      yum install -y /tmp/collabnet-teamforge-repo-18.1-0-noarch.rpm
      

   3. Refresh your repository cache.

      yum clean all
      

   TeamForge Installation Repository Configuration for Sites without Internet Access

   1. Contact the CollabNet Support to get the auxiliary installer package for TeamForge 18.1 disconnected installation and save it in /tmp.
      • RHEL/CentOS 7.4 64 bit: CTF-Disconnected-media-18.1.446-1261.rhel7.x86_64.rpm
      • In addition to the above CentOS 7.4 64 bit RPM package, you must get the following CentOS 7.4 compatibility RPM, which is required for TeamForge 18.1 disconnected media installation on CentOS 7.4 profile: compat-ctf-dc-media-1.0-1.el7.centos.noarch.rpm.
   2. Unpack the disconnected installation package.

      rpm -ivh <package-name>
      

   3. Unpack the compat-ctf-dc-media-1.0-1.el7.centos.noarch.rpm package if you are installing TeamForge 18.1 on CentOS 7.4.

      rpm -ivh compat-ctf-dc-media-1.0-1.el7.centos.noarch.rpm
      

   4. If not mounted already, mount the RHEL/CentOS installation DVD.

      The DVD contains the necessary software and utilities required for installing TeamForge without internet access. In the following commands, replace “cdrom” with the identifier for your server’s CD/DVD drive, if necessary.

      cd /media/
      mkdir cdrom
      mount /dev/cdrom ./cdrom/
      

      If there are any spaces in the automount, unmount it first and mount it as a filepath, with no spaces.

   5. Create a yum configuration file that points to the RHEL/CentOS installation DVD.

      vi /etc/yum.repos.d/cdrom.repo
      

      Here’s a sample yum configuration file.

      [RHEL-CDROM]
      name=RHEL CDRom 			
      baseurl=file:///media/cdrom/Server/
      gpgfile=file:///media/cdrom/RPM-GPG-KEY-redhat-release 
      enabled=1
      gpgcheck=0
      

   6. Verify your yum configuration files.

      yum list httpd
      yum list apr
      

   You need not configure the TeamForge installation repository on the Oracle Database Server.

Install the TeamForge Services

1. Install the TeamForge application services on the TeamForge Application Server (server-01)

   yum install teamforge
   

2. Install the Review Board services on the TeamForge Application Server (server-01)

   yum install teamforge
   

3. Download the corresponding version of Oracle client and run the following command on the TeamForge Application Server (server-01).

   yum localinstall <path to oracle client rpm>
   

4. Install EventQ services on the EventQ Server (server-03)

   yum install teamforge-eventq
   

Set up the Oracle Database Server (server-02)

1. Install Oracle 12c.

   Note: Make sure your database uses UTF8 or AL32UTF8 encoding. This is needed to support users in Asian languages. See this Oracle knowledge base article.
2. Log on to the Oracle Database Server as a system administrator with SYSDG privilege and run the following query.

   alter system set parallel_threads_per_cpu=4;
   

3. Log in as an Oracle user and create the site database user and permissions.

   To use an Oracle database for your TeamForge data, set up the Oracle database and tell the TeamForge installer how to handle it.

   TeamForge Database Setup

   Note: Make sure your database uses UTF8 or AL32UTF8 encoding. This is needed to support users in Asian languages. See this Oracle knowledge base article.
   1. Connect to your Oracle database.

      SQL> connect <adminusername>@<db_name>/<adminpassword> as sysdba
      

   2. Create the database user and password you will use to connect from TeamForge to Oracle.

      SQL> create user <sf user> identified by <sf passwd> default tablespace <your tablespace> temporary tablespace <temporary tablespace>;
      

   3. Grant permissions to the user that you just created.

      SQL> grant unlimited tablespace to <sf user>;
      SQL> grant create snapshot to <sf user>;
      SQL> grant create cluster to <sf user>;
      SQL> grant create database link to <sf user>;
      SQL> grant create procedure to <sf user>;
      SQL> grant create sequence to <sf user>;
      SQL> grant create trigger to <sf user>;
      SQL> grant create type to <sf user>;
      SQL> grant create view to <sf user>;
      SQL> grant query rewrite to <sf user>;
      SQL> grant alter session to <sf user>;
      SQL> grant create table to <sf user>;
      SQL> grant create session to <sf user>;
      SQL> grant create any synonym to <sf user>;
      SQL> exit
      

   4. Create the database read-only user that you will use to connect from TeamForge.

      SQL> create user <database_readonly_user> identified by <database_readonly_password> default tablespace <your tablespace> temporary tablespace <temporary tablespace>;
      

   5. Grant the required permissions to the read-only user that you just created.

      SQL> grant create session to <database_readonly_user>;
      SQL> exit
      

   6. Connect to your Oracle database as .

      SQL> connect <sf user>@<db_name>/<sf passwd>
      

   7. Grant the ‘create synonym’ permission on TeamForge database to the read-only user that you just created.

      SQL> begin
      for i in (select table_name from user_tables) loop 
      execute immediate 'grant select on '|| i.table_name||' to <database_readonly_user>'; 
      execute immediate 'create synonym <database_readonly_user>.'||i.table_name||' for '||i.table_name||''; 
      end loop; 
      end;
            
      SQL> exit
      

   TeamForge Datamart Setup

   Note: Make sure your database uses UTF8 or AL32UTF8 encoding. This is needed to support users in Asian languages. See this Oracle knowledge base article.
   1. Connect to your Oracle database.

      SQL> connect <adminusername>@<db_name>/<adminpassword> as sysdba
      

   2. Create the datamart user you will use to connect from TeamForge.

      SQL> create user <reports_database_user> identified by <reports_database_password> default tablespace <your tablespace> temporary tablespace <temporary tablespace>;
      

   3. Grant permissions to the user that you just created.

      SQL> grant unlimited tablespace to <reports_database_user>;
      SQL> grant create snapshot to <reports_database_user>;
      SQL> grant create cluster to <reports_database_user>;
      SQL> grant create database link to <sreports_database_user>;
      SQL> grant create procedure to <reports_database_user>;
      SQL> grant create sequence to <reports_database_user>;
      SQL> grant create trigger to <reports_database_user>;
      SQL> grant create type to <reports_database_user>;
      SQL> grant create view to <reports_database_user>;
      SQL> grant query rewrite to <reports_database_user>;
      SQL> grant alter session to <reports_database_user>;
      SQL> grant create table to <reports_database_user>;
      SQL> grant create session to <reports_database_user>;
      SQL> grant create any synonym to <reports_database_user>;
      SQL> exit
      

      Note: Replace with the datamart username specified in the site-options.conf and with the database password specified in site-options.conf.
   4. Create the datamart read-only user that you will use to connect from TeamForge.

      SQL> create user <reports_readonly_user> identified by <reports_readonly_password> default tablespace <your tablespace> temporary tablespace <temporary tablespace>;
      

   5. Grant the required permissions to the read-only user that you just created.

      SQL> grant create session to <reports_readonly_user>;
      SQL> exit
      

      Note: The TeamForge installer creates the tables and default values for you.
   6. Connect to your Oracle database as .

      SQL> connect <reports_database_user>@<db_name>/<reports_database_password>
      

   7. Grant the ‘create synonym’ permission on TeamForge datamart to the read-only user that you just created. SQL> begin

      for i in (select table_name from user_tables) loop 
      execute immediate 'grant select on '|| i.table_name||' to <reports_readonly_user>'; 
      execute immediate 'create synonym <reports_readonly_user>.'||i.table_name||' for '||i.table_name||''; 
      end loop; 
      end;
      
      SQL> exit
      

4. Log on to the TeamForge Application Server and copy the Oracle Datamart setup script from /opt/collabnet/teamforge/runtime/scripts/ to the /tmp directory of the Oracle Database Server (server-02).

   scp /opt/collabnet/teamforge/runtime/scripts/datamart-oracle-setup.sh <username>@<server-02>:/tmp
   

5. Copy the Oracle Datamart setup script to /u1 directory.

   mkdir /u1
   cp /tmp/datamart-oracle-setup.sh /u1
   

6. Create the reporting user and schema.

   Tip: Skip this step if you have already set up the datamart as discussed earlier. Your responses to the datamart-oracle-setup.sh script’s prompts must match the values of the equivalent variables of the TeamForge Application Server’s site-options.conf file.

   cd /u1
   sh datamart-oracle-setup.sh
   

Set up the TeamForge Application Server (server-01)

Log on to the TeamForge Application Server (server-01), set up the site-options.conf file, and provision the services.

1. Rename the sample Oracle site configuration file in the /opt/collabnet/teamforge/etc/ directory.

   cd /opt/collabnet/teamforge/etc/
   cp site-options-oracle.conf site-options.conf
   

2. Set up your site’s master configuration file.

   vi /opt/collabnet/teamforge/etc/site-options.conf
   

   host:SERVICES Token

   server-01:SERVICES=ctfcore mail etl search subversion cvs codesearch cliserver gerrit gerrit-database  binary binary-database reviewboard reviewboard-database reviewboard-adapter
   server-02:SERVICES=ctfcore-database ctfcore-datamart
   server-03:SERVICES=eventq mongodb redis rabbitmq
   

   host:PUBLIC_FQDN Token

   server-01:PUBLIC_FQDN=my.app.domain.com
   

   Note: You cannot have a separate PUBLIC_FQDN for EventQ.

   Configure the Oracle Database Tokens

   Configure the Oracle database name, usernames and passwords as configured on the Oracle Database Server.

   • Database type is oracle (DATABASE_TYPE=oracle)
   • Database service name is the host name of the Oracle Database Server (for example, DATABASE_SERVICE_NAME=cu349.maa.collab.net)
   • Reports database service name is the host name of the server where the datamart is (for example, REPORTS_DATABASE_SERVICE_NAME=cu349.maa.collab.net)

   DATABASE_TYPE=oracle
   
   # Adjust usernames/passwords to match what has been configured on the database server.
   DATABASE_USERNAME=ctfuser
   DATABASE_PASSWORD=ctfpwd
   DATABASE_READ_ONLY_USER=ctfrouser
   DATABASE_READ_ONLY_PASSWORD=ctfropwd
   DATABASE_NAME=orcl
   DATABASE_SERVICE_NAME=
   ​
   # Adjust usernames/passwords to match what has been configured on the database server.
   REPORTS_DATABASE_USERNAME=ctfrptuser
   REPORTS_DATABASE_PASSWORD=ctfrptpwd
   REPORTS_DATABASE_NAME=orcl
   REPORTS_DATABASE_READ_ONLY_USER=ctfrptrouser
   REPORTS_DATABASE_READ_ONLY_PASSWORD=ctfrptropwd
   REPORTS_DATABASE_SERVICE_NAME=
   

   Save the site-options.conf file.

   For further customization of your site configuration (SSL settings, password policy settings, PostgreSQL settings, LDAP settings and so on): Site options configuration contd…

   SSL Tokens

   SSL is enabled by default and a self-signed certificate is auto-generated. Use the following tokens to adjust this behavior.

   SSL_CERT_FILE=
   SSL_KEY_FILE=
   SSL_CHAIN_FILE=
   

   • To generate the SSL certificates, see Generate SSL certificates.
   • Have the custom SSL certificate and private key for custom SSL certificate in place and provide their absolute paths in these tokens. SSL_CHAIN_FILE (intermediate certificate) is optional.

   Password Tokens

   • TeamForge 7.1 and later support automatic password creation. See AUTO_DATA for more information.

   • Set the REQUIRE_PASSWORD_SECURITY token to true to enforce password security policy for the site.

     If the token REQUIRE_PASSWORD_SECURITY is enabled, then set a value for the token, PASSWORD_CONTROL_EFFECTIVE_DATE.

     Warning: The Password Control Kit (PCK) disables, deletes or expires user accounts that don’t meet the password security requirements starting from the date set for the PASSWORD_CONTROL_EFFECTIVE_DATE token. If a date is not set, the PCK disables, deletes or expires user accounts immediately. See PASSWORD_CONTROL_EFFECTIVE_DATE for more information.

     You can also set the following tokens to enforce a more stricter password policy:

     • MINIMUM_PASSWORD_LENGTH
     • MAX_PASSWORD_LENGTH
     • PASSWORD_REQUIRES_NUMBER
     • PASSWORD_REQUIRES_NON_ALPHANUM
     • PASSWORD_REQUIRES_MIXED_CASE
     • REQUIRE_PASSWORD_SECURITY
     • LOGIN_ATTEMPT_LOCK
     • PASSWORD_HISTORY_AGE
     • ALLOW_PASSWORD_DICTIONARY_WORD
   • If the token REQUIRE_RANDOM_ADMIN_PASSWORD is already set to true, then set the token ADMIN_EMAIL with a valid email address.

       ADMIN_EMAIL=root@{__APPLICATION_HOST__}
     

   • If you have LDAP set up for external authentication, you must set the REQUIRE_USER_PASSWORD_CHANGE site options token to false.

   Prevent Cross-site Scripting

   An attacker could potentially upload an HTML page to TeamForge that contains active code, such as JavaScript. This active code would then be executed by clients’ browsers when they view the page, which can harm the system.

   To prevent an attack of this sort, you can specify whether or not HTML code is displayed in TeamForge. This flag applies to all documents, tracker, task, and forum attachments, and files in the file release system.

   Set the SAFE_DOWNLOAD_MODE token according to your requirements. For more information, see SAFE_DOWNLOAD_MODE.

   JAVA_OPTS

   Configure the JBOSS_JAVA_OPTS site-options.conf token. See JBOSS_JAVA_OPTS.

   Note: All JVM parameters but -Xms1024m and -Xmx2048m have been hard-coded in the TeamForge core application. You need not manually configure any other parameter (such as -XX:MaxMetaspaceSize=512m -XX:ReservedCodeCacheSize=128M -server -XX:+HeapDumpOnOutOfMemoryError -Djsse.enableSNIExtension=false -Dsun.rmi.dgc.client.gcInterval=600000 -Dsun.rmi.dgc.server.gcInterval=600000) in the site-options.conf file.

   TeamForge 18.1 (and later) supports Java 9. As a result of changes to the logging framework in Java 9, the PrintGCDetails and PrintGCTimeStamps logging options are no longer supported. Remove these options from the following tokens while upgrading to TeamForge 18.1 or later.

   • JBOSS_JAVA_OPTS
   • PHOENIX_JAVA_OPTS
   • INTEGRATION_JAVA_OPTS
   • ETL_JAVA_OPTS
   • ELASTICSEARCH_JAVA_OPTS

   TeamForge provision fails on sites that use these options post upgrade to TeamForge 18.1.

   Save the site-options.conf file.

3. Provision services.

   teamforge provision
   

   TeamForge 18.1 installer expects the system locale to be LANG=en_US.UTF-8. TeamForge create runtime (teamforge provision) fails otherwise.

Set up the EventQ Server (server-03)

Log on to the EventQ Server (server-03), set up the site-options.conf file, and provision the services.

1. Copy the /opt/collabnet/teamforge/etc/site-options.conf file from the TeamForge Application Server to the EventQ Server’s /opt/collabnet/teamforge/etc/ directory.

2. Provision services.

   teamforge provision
   

   TeamForge 18.1 installer expects the system locale to be LANG=en_US.UTF-8. TeamForge create runtime (teamforge provision) fails otherwise.

Verify TeamForge Installation

1. Verify TeamForge installation.
   1. Reboot the server and make sure all services come up automatically at startup.
   2. Log on to the TeamForge web application using the default Admin credentials.
      • Username: admin
      • Password: admin
   3. Create a sample project. See Create a TeamForge Project.
   4. Write a welcome message to your site’s users. See Create a Site-wide Broadcast.

Post Install Tasks

• Supply Your TeamForge License Key
• Run TeamForge in SELinux enabled Mode
• Install EventQ Integration Adapters
• Users are not getting email notifications for review requests and reviews. What should I do?