mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: pin ProcSubset all and ProtectProc invisible on forgejo and openbao

Browse source
This commit is contained in:
atlas 2026-11-07 18:33:36 +01:00 • committed by mara
commit c217301e80
2 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/module-eval/forge-placement.nix
View file

@ -598,6 +598,16 @@ let
&&
h.systemd.services.swarm-bao-ci-runner.environment.BAO_CLIENT_CERT == "/etc/pki/bao-ci-runner.pem";
}
{
# `/proc/stat` is what the Go process collector's start time comes
# from; `ProtectProc` is the sibling that keeps other processes hidden.
name = "forgejo can read /proc/stat while other processes stay hidden";
ok =
let
s = forgeHere.containers.hive-forge.config.systemd.services.forgejo.serviceConfig;
in
s.ProcSubset == "all" && s.ProtectProc == "invisible";
}
{
name = "the CI runner forwarder's metrics port is loopback";
ok =

10
nix/module-eval/hive-tls.nix
View file

@ -867,6 +867,16 @@ let
&& inner.TimeoutStartSec == 240
&& lib.hasInfix "TimeoutStartSec=300s" unit;
}
{
# `/proc/stat` is what the Go process collector's start time comes
# from; `ProtectProc` is the sibling that keeps other processes hidden.
name = "openbao can read /proc/stat while other processes stay hidden";
ok =
let
inner = allLocal.containers.swarm-bao.config.systemd.services.openbao.serviceConfig;
in
inner.ProcSubset == "all" && inner.ProtectProc == "invisible";
}
{
name = "hive-priv is told the cache's address by the host's configuration";
ok =