Cold-Storage Replication and Symlink-Based Cross-Host Visibility

Cold-Storage Replication Strategy

The cold-storage topology requires consistent cross-host visibility. The current model uses bind mounts between chonk and the gaming host, but this breaks gracefully under load — stale handles linger, and file counts drift without notice. A symlink-based approach across the `/mnt/snowy` hierarchy provides a deterministic visibility layer: changes to the authoritative source on chok (/mnt/storage*) are immediately reflected for consumers without NFS lease complications.

NFS Export Hardening

chonk's NFS exports remain scoped to `10.10.8.0/21`, with sec=krb5i present in export vars but no deployed keytabs on any client host. Today's review confirmed this is a known gap, not an oversight — the krb5i security option is non-functional pending Kerberos keytab deployment across all NFS clients. The short-term remediation path: replace krb5i with `sec=krb5p` for authenticated-but-not-integrity-checked mounts while keytab infrastructure catches up, or revert to `sec=sys` until KDC replication matures.

Stargate Controller Alignment

The stargate controller role in the lab.franklin collection needs updating for the ansible-test pipeline shift. Molecule is fully deprecated; ansible-test runs natively on stargate.research.bitsmasher.net with zero external billing overhead. Roles targeting dns_master, dns_slave, ntp_server, and ntp_client are verified against this path. The controller role must drop molecule dependencies entirely before the next collection release.

Key Takeaways

• Symlink-based visibility outperforms bind mounts for cold-storage cross-host access.
• NFS krb5i security is a paper tiger — keytabs never deployed to clients.
• Stargate controller role cleanup (molecule removal) should precede collection release.