From c217301e80d4b6e01c87bd8ffec262ede6934fd4 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Sat, 7 Nov 2026 18:33:36 +0100
Subject: [PATCH] module-eval: pin ProcSubset all and ProtectProc invisible on
 forgejo and openbao

---
 nix/module-eval/forge-placement.nix | 10 ++++++++++
 nix/module-eval/hive-tls.nix        | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/nix/module-eval/forge-placement.nix b/nix/module-eval/forge-placement.nix
index 79322fdc..6473953f 100644
--- a/nix/module-eval/forge-placement.nix
+++ b/nix/module-eval/forge-placement.nix
@@ -598,6 +598,16 @@ let
         &&
           h.systemd.services.swarm-bao-ci-runner.environment.BAO_CLIENT_CERT == "/etc/pki/bao-ci-runner.pem";
     }
+    {
+      # `/proc/stat` is what the Go process collector's start time comes
+      # from; `ProtectProc` is the sibling that keeps other processes hidden.
+      name = "forgejo can read /proc/stat while other processes stay hidden";
+      ok =
+        let
+          s = forgeHere.containers.hive-forge.config.systemd.services.forgejo.serviceConfig;
+        in
+        s.ProcSubset == "all" && s.ProtectProc == "invisible";
+    }
     {
       name = "the CI runner forwarder's metrics port is loopback";
       ok =
diff --git a/nix/module-eval/hive-tls.nix b/nix/module-eval/hive-tls.nix
index 92a95f61..a66c34d6 100644
--- a/nix/module-eval/hive-tls.nix
+++ b/nix/module-eval/hive-tls.nix
@@ -867,6 +867,16 @@ let
         && inner.TimeoutStartSec == 240
         && lib.hasInfix "TimeoutStartSec=300s" unit;
     }
+    {
+      # `/proc/stat` is what the Go process collector's start time comes
+      # from; `ProtectProc` is the sibling that keeps other processes hidden.
+      name = "openbao can read /proc/stat while other processes stay hidden";
+      ok =
+        let
+          inner = allLocal.containers.swarm-bao.config.systemd.services.openbao.serviceConfig;
+        in
+        inner.ProcSubset == "all" && inner.ProtectProc == "invisible";
+    }
     {
       name = "hive-priv is told the cache's address by the host's configuration";
       ok =