ci: 💚 Fix CI docs

.github/workflows/docker.yml

@@ -23,7 +23,7 @@ jobs:
 
     build:
         if: ${{ success() }}
-        needs: [lint, check, tests]
+        needs: [lint, check, tests, detect-circular]
         runs-on: ubuntu-latest
         permissions:
             contents: read

.github/workflows/docs.yml

@@ -35,12 +35,12 @@ jobs:
               run: bun install
 
             - name: Build with VitePress
-              run: bun run docs:build
+              run: bun run --filter="@versia-server/api" docs:build
 
             - name: Upload artifact
               uses: actions/upload-pages-artifact@v3
               with:
-                  path: docs/.vitepress/dist
+                  path: packages/api/docs/.vitepress/dist
 
     # Deployment job
     deploy:

nix/module.nix

@@ -123,6 +123,28 @@ in {
             StandardError = "journal";
             SyslogIdentifier = "${name}";
 
+            # Hardening
+            CapabilityBoundingSet = [""];
+            LockPersonality = true;
+            PrivateMounts = true;
+            PrivateTmp = true;
+            ProcSubset = "pid";
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            ProtectSystem = "strict";
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            RemoveIPC = true;
+            NoNewPrivileges = true;
+
             Environment = [
               "CONFIG_LOCATION=${configFile}"
             ];