Redmine Simple Maintenance Plugin

A lightweight maintenance mode plugin for Redmine without external dependencies (e.g., Deface).

日本語版はこちら

Features

• Access Control: Restrict non-admin users to a maintenance page during maintenance
• Banner Notification: Display maintenance banner on all pages including login screen
• Scheduled Maintenance: Automatically enable/disable maintenance mode at specified times
• Login Control: Only specified users can login during maintenance (configurable)
• SSO/OAuth Protection: Disable external authentication buttons (SAML, OAuth, LDAP, etc.) during maintenance
• Multi-language: Supports English, Japanese, Korean, Chinese, and German

Requirements

• Redmine 6.0 or later (6.1, 7.0 compatible)

Installation

1. Copy the plugin directory to your Redmine's plugins directory:

   cd /path/to/redmine/plugins
   git clone https://github.com/seraph3000/redmine_simple_maintenance.git
   # or copy manually

2. Restart Redmine:

   systemctl restart httpd

3. (Production) Precompile assets:

   # If running Redmine in a subdirectory
   RAILS_RELATIVE_URL_ROOT=/redmine RAILS_ENV=production bundle exec rake assets:clobber
   RAILS_RELATIVE_URL_ROOT=/redmine RAILS_ENV=production bundle exec rake assets:precompile
   
   # If not using subdirectory
   RAILS_ENV=production bundle exec rake assets:clobber
   RAILS_ENV=production bundle exec rake assets:precompile
   
   # Fix ownership if ran as non-Apache user
   chown -R apache:apache ./public/assets

Configuration

Navigate to Administration > Plugins > Simple Maintenance Plugin > Configure

Basic Settings

Setting	Description
Activate maintenance mode	Enable maintenance mode immediately
Banner Message	Short message displayed on all pages (supports Textile)
Maintenance Page Message	Detailed message shown to blocked users (supports Textile)

Schedule Settings

Setting	Description
Enable scheduled maintenance	Activate time-based maintenance
Start Date/Time	When maintenance begins
End Date/Time	When maintenance ends

Login Control

Setting	Description
Users allowed to login	Comma-separated usernames (e.g.,admin, operator)

Note: If this field is empty, defaults to admin to prevent lockout.

How It Works

During Maintenance

• Non-admin users (logged in) : See full-screen maintenance page, session preserved
• Non-admin users (login attempt) : Can attempt to log in, but are securely blocked by the server (503 page) immediately after authentication if not on the allowed list. (Designed to prevent Username Enumeration vulnerabilities).
• Admin users : See banner only, full access to system
• External auth buttons : Visually disabled via CSS

After Maintenance Ends

• Users simply reload the page to resume normal operation
• No forced logout, sessions remain valid

Supported Authentication Plugins

Note: Only redmine_saml has been tested. Other plugins are based on common CSS class naming conventions and may not work as expected. Please verify in your environment and adjust selectors as needed.

The following external authentication buttons are automatically disabled during maintenance:

• redmine_saml (#saml-login)
• redmine_omniauth_google (.google-login)
• redmine_omniauth_azure (.azure-login)
• redmine_omniauth_github (.github-login)
• redmine_openid_connect (.oidc-login)
• redmine_cas (.cas-login)
• Generic selectors (.sso-login, .oauth-login, .external-login, [class*="omniauth-"])

To add custom selectors, edit assets/stylesheets/redmine_simple_maintenance.css.

Uninstallation

1. Remove plugin settings from database:

   cd /path/to/redmine
   RAILS_ENV=production bundle exec rails runner "Setting.find_by(name: 'plugin_redmine_simple_maintenance')&.destroy"

2. Remove the plugin directory:

   rm -rf /path/to/redmine/plugins/redmine_simple_maintenance

3. Restart Redmine:

   systemctl restart httpd

Changelog

All notable changes to this project will be documented in this file.

[0.1.3] - 2026-07-11

Changed

• • Admin menu icon migrated to SVG sprite (sprite_icon).

[0.1.2] - 2026-04-01

Security

• Username Enumeration Prevention : Removed frontend JavaScript login button controls. Access control is now strictly and securely enforced on the backend to prevent attackers from guessing valid usernames based on UI behavior.

Changed

• Refactored login logic: The standard login button remains active for all users, but unauthorized users are securely blocked (redirected to the 503 Maintenance Page) immediately after authentication.
• Simplified codebase by removing complex DOM event listeners.

[0.1.1] - 2026-03-21

Added

• German translation (thanks to @teatower)
• Flatpickr datetime picker locales prepared for future translations (fr, es, it, pt, ru)

Changed

• Improved locale detection logic for flatpickr

[0.1.0] - 2025-03-13

Added

• Initial release
• Manual maintenance mode toggle
• Scheduled maintenance with start/end datetime
• Maintenance banner on all pages (Textile supported)
• Full-screen maintenance page for non-admin users
• Login control: configurable allowed usernames during maintenance
• External auth button protection (SAML, OAuth, LDAP, CAS, etc.)
• Multi-language support: English, Japanese, Korean, Chinese
• Flatpickr datetime picker with localization

License

MIT License - see LICENSE file.

Author

seraph3000