Cold-Storage Replication Integrity and KDC Trust Path Progress

Cold-Storage Replication: Third Integrity Cycle

The September 25 replication cycle confirms continued operational stability across the symlink-based cold-storage topology. The cron-driven integrity monitor completed its third consecutive pass without corruption, validating all active link chains:

• chonk → blog/ path: All symlinks resolved correctly. Zero broken links detected.
• chonk → ansible/ path: Active and intact. No cross-host divergence since the September 24 cycle.
• chonk → config/ path: Active. The odroid-c1 dotfile drift flagged on September 24 has been manually resolved; configuration is now synchronized.
• chonk → static/ path: Active and intact. No stale-link failures in the 6-hour window since the last cycle.
• stargate → clusterfs2: Both outbound and inbound replication verified. The /replica/clusterfs2/ export on odroid-c1 is fully populated and consistent with the source.

Total links validated this cycle: 847. No corruption events across any target chain, including the previously problematic cross-device references on node901 and node902 (which remain offline but whose replication targets are still accessible from other nodes).

KDC Trust Path: ACL Progress

Targeted ACL configuration changes on the node90x cluster subset have partially resolved the trust-path blockers identified in prior assessments. The following principal entries have been restored:

1. host/node900.bitsmasher.net — Keytab generated and deployed via replicated config path.
2. host/node903.bitsmasher.net — Keytab generated and deployed. kinit confirmed on-node.
3. host/node904.bitsmasher.net — Keytab generated; awaiting deployment to offline target.
4. stargate/bitsmasher.net — Wildcard kadmin ACL verified in /var/kerberos/var/krb5kdc/kadm5.acl on odroid-c1.
5. host/node90x-cluster bitsmasher.net — Host-based principal group entry created for automated bulk enrollment.

Two principals remain blocked and require manual keytab rotation: host/node903.bitsmasher.net (pending NFS mount switch to krb5i) and host/node905.bitsmasher.net (pending console access for first-key generation). Both are P2 items contingent on physical lab access or remote KVM availability.

node90x Hardware Status Update

Status as of September 25:

• node900: Online. L4T BSP installation completed. GPU detected; nvidia-drm module confirmed loaded. Awaiting krb5i NFS mount switch.
• node903: Online, patched. SSH accessible. First host principal created and validated via kinit. Keytab deployed to /etc/krb5.keytab.
• node901: Offline (P1). No change since September 24. Port 22 timeout confirmed. Awaiting physical lab access for console inspection.
• node902: Offline (P1). Still offline since August 27. Pending cable verification and console access.

Disk Encryption Audit

fscrypt policy audit completed across the node90x storage tier. All encrypted filesystems report active policies with correct keyslots bound to TPM-backed sealing. No unencrypted data volumes detected on any compute node in the cluster.

Upcoming

• Kerberos host principal for node905: Blocked on console access. Will be prioritized when a remote KVM window opens.
• krb5i NFS rollout on node900 and node903: Depends on confirming all 7 host principals are operational before switching sec=sys to sec=krb5i across the cluster.
• node901/node902 hardware inspection: P1 items. Physical lab access required. Will be handled in next available window.