Redmine - Hardened Project Management & Issue Tracker

What is Redmine

Redmine is a mature, flexible open-source project management and issue-tracking web application written in Ruby on Rails (Rails 7.2), served by the Puma application server behind nginx and backed by PostgreSQL. A single instance manages multiple projects and subprojects with per-project role-based access control, issue tracking with fully customizable trackers, statuses and workflows, Gantt charts and a calendar, time tracking, per-project wikis, forums and document management, news and file repositories, multiple SCM integration (Git, Subversion, Mercurial), email notifications, a REST API, LDAP-ready authentication, and multi-language support. Project data, issues, attachments and history persist in the bundled PostgreSQL database within your own tenant. GPL-2.0 license, no vendor lock-in.

Why self-host Redmine

Running Redmine on a VM you control keeps every project, issue, attachment and the identities of your contributors inside your own tenant rather than a hosted project-tracking service. Self-hosting suits teams under GDPR, HIPAA or ISO 27001, and any workload where roadmaps, tickets and customer-reported defects must stay within your own perimeter with no per-seat fees.

What this VM image adds

Security hardening:

• Default admin password rotated - the well-known admin/admin login is replaced with a unique random value at first boot and written to /root/redmine-credentials.txt (mode 0600); no shared admin is baked into the image
• Per-instance secrets - the PostgreSQL password and the Rails secret key base are generated at first boot, unique to every deployment
• PostgreSQL bound to loopback - the database listens on 127.0.0.1 only and the Puma application server listens on a localhost socket; neither is exposed externally
• nginx TLS reverse proxy on 443 - HTTP on 80 redirects to HTTPS; a self-signed certificate is generated at build and replaceable with your own CA-signed certificate (certbot is pre-installed)
• UFW firewall - TCP 443 and TCP 80 for the web UI, TCP 22 for SSH; all other inbound dropped
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control
• CVE scan - every image is scanned with Trivy before release

OS hardening (CIS Level 1):

• CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access, PermitRootLogin no, LoginGraceTime 60
• Kernel hardening - SYN cookies, ASLR, rp_filter, IPv6 off
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report at /etc/lynxroute/cis-report.html (OpenSCAP, Azure tailoring profile, 0 FAIL rules)
• Tailored CIS profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
• Operator credentials file at /root/redmine-credentials.txt (mode 0600) with the rotated admin password and the PostgreSQL password

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 or larger recommended)
2. Open NSG: TCP 443 from your trusted sources, TCP 22 from your management IPs only
3. SSH: ssh -i key.pem azureuser@<PUBLIC_IP>, then sudo cat /root/redmine-credentials.txt for the rotated admin password
4. Open https://<PUBLIC_IP>/, accept the self-signed certificate warning, and log in as admin with the rotated password
5. For production, point a domain at the instance and run sudo certbot --nginx -d your.domain.com for a trusted certificate

Wait 1-3 minutes after first boot for the database setup to complete before logging in. The REST API is disabled by default; enable it under Administration > Settings > API. Restrict NSG port 443 to your own IP until you have changed the admin password. "Redmine" is a registered trademark of Jean-Philippe Lang. This is an independently hardened build, not affiliated with or endorsed by the Redmine project.