thread_id: 01a059f4-cead-704b-b857-fad89ebde42b
updated_at: 1788224497

Dankserver copyparty read-only hardening: changed copyparty volume perms from `-v /w::A` to `-v /w::r:ra,dank`, deployed with podman-compose recreate, verified reads work and writes/deletes fail. Important discovery: copyparty bare `A` grants everyone full access, not anonymous-deny; authentik-protected traffic reaches copyparty unauthenticated, so anonymous must retain `r` for web reads.