dankserver: entropy read-only fleet-wide; jellyfin gets whole /mnt/entropy at /data

dankserver/copyparty/quadlet/copyparty.container

@@ -12,8 +12,8 @@
 # that env file exists, so a missing env file fails the unit instead of
 # creating an admin account with a garbage password.
 #
-# /w is the entropy volume: copyparty's dank admin account is the only write
-# path into it; every other service mounts the share read-only or not at all.
+# /w is the entropy volume, mounted read-only: nothing writes into /mnt/entropy
+# anymore; every consumer of the share is a read-only client.
 
 [Unit]
 Description=Copyparty file server container
@@ -25,7 +25,7 @@ Image=ghcr.io/9001/copyparty-ac:latest
 Network=dankserver_appnet
 EnvironmentFile=/home/dank/Containers/copyparty/env
 Exec=-a ${COPAY_ACCOUNT}:${COPAY_PASSWORD} -v /w::r:ra,dank
-Volume=/mnt/entropy:/w
+Volume=/mnt/entropy:/w:ro
 Volume=/home/dank/Containers/copyparty/cfg:/cfg
 PublishPort=3923:3923