feat(copyparty): add read-only root volume

configs/nixos/hosts/pikachu/default.nix

@@ -158,6 +158,12 @@
       trustedSources = [ "${registry.address.${config.networking.hostName}."reverse-proxy"}/32" ];
     };
     volumes = {
+      "/" = {
+        hostPath = "/pikachu/data/copyparty/root";
+        path = "/srv";
+        access.r = [ "alexion" ];
+        readOnly = true;
+      };
       "/inbox" = {
         hostPath = "/pikachu/__inbox";
         path = "/srv/inbox";