mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

module-eval: pin ProcSubset all and ProtectProc invisible on forgejo and openbao

Browse source
This commit is contained in:
atlas 2026-11-07 18:33:36 +01:00 • committed by mara
commit c217301e80
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
nix/module-eval/forge-placement.nix
View file

@ -598,6 +598,16 @@ let
&&
h.systemd.services.swarm-bao-ci-runner.environment.BAO_CLIENT_CERT == "/etc/pki/bao-ci-runner.pem";
}
{
# `/proc/stat` is what the Go process collector's start time comes
# from; `ProtectProc` is the sibling that keeps other processes hidden.
name = "forgejo can read /proc/stat while other processes stay hidden";
ok =
let
s = forgeHere.containers.hive-forge.config.systemd.services.forgejo.serviceConfig;
in
s.ProcSubset == "all" && s.ProtectProc == "invisible";
}
{
name = "the CI runner forwarder's metrics port is loopback";
ok =