diff options
| author | Emil Renner Berthing <esmil@labitat.dk> | 2021-01-19 13:14:10 +0100 |
|---|---|---|
| committer | Emil Renner Berthing <esmil@labitat.dk> | 2021-01-19 13:14:10 +0100 |
| commit | 48d0db45d2ac05e42f6219667008bf73ea41d19d (patch) | |
| tree | 02437d4d7b6267dbe157688abeaf2c60cce9f49c /roles/space_server/files | |
| parent | c28fe3ed473a195b5d9067c8c65676b409c19ce0 (diff) | |
| download | labitat-ansible-48d0db45d2ac05e42f6219667008bf73ea41d19d.tar.gz labitat-ansible-48d0db45d2ac05e42f6219667008bf73ea41d19d.tar.xz labitat-ansible-48d0db45d2ac05e42f6219667008bf73ea41d19d.zip | |
space_server: chrony: run chrony ntp server
Diffstat (limited to 'roles/space_server/files')
| -rw-r--r-- | roles/space_server/files/chrony.conf | 56 | ||||
| -rw-r--r-- | roles/space_server/files/nftables.conf | 6 |
2 files changed, 62 insertions, 0 deletions
diff --git a/roles/space_server/files/chrony.conf b/roles/space_server/files/chrony.conf new file mode 100644 index 0000000..a33bd23 --- /dev/null +++ b/roles/space_server/files/chrony.conf @@ -0,0 +1,56 @@ +# Set upstream servers +#server mmo1.ntp.se iburst +#server mmo2.ntp.se iburst +server nts.ntp.se iburst nts +server time.cloudflare.com iburst nts + +# Specify file containing keys for NTP authentication +keyfile /etc/chrony.keys + +# Dump measurement history here +dumpdir /var/lib/chrony + +# Dump NTS cookies here +ntsdumpdir /var/lib/chrony + +# Record the rate at which the system clock gains/losses time +driftfile /var/lib/chrony/drift + +# Use /etc/adjtime +hwclockfile /etc/adjtime + +# Make requests from space.labitat.dk public addresses +bindacqaddress 185.38.175.0 +bindacqaddress 2a01:4262:1ab:: + +# Listen to NTP on space.labitat.dk public addresses +bindaddress 185.38.175.0 +bindaddress 2a01:4262:1ab:: + +# Allow NTP access only from local network +deny all +allow 185.38.175.0/24 +allow 10.42.0.0/16 +allow 2a01:4262:1ab::/48 + +# Allow the system clock to be stepped in the first three updates +# if its offset is larger than 1 second. +makestep 1.0 3 + +# Enable kernel synchronization of the real-time clock (RTC). +rtcsync + +# Enable hardware timestamping on wan +hwtimestamp wan + +# Let the kernel handle leap seconds +leapsecmode system + +# Get TAI-UTC offset and leap seconds from the system tz database +leapsectz right/UTC + +# Specify directory for log files +#logdir /var/log/chrony + +# Select which information is logged +#log measurements statistics tracking diff --git a/roles/space_server/files/nftables.conf b/roles/space_server/files/nftables.conf index a0c17c1..066c03e 100644 --- a/roles/space_server/files/nftables.conf +++ b/roles/space_server/files/nftables.conf @@ -96,6 +96,9 @@ table ip filter { tcp dport 53 ip saddr { $int_net4, $ext_net4 } accept udp dport 53 ip saddr { $int_net4, $ext_net4 } accept + # ntp + udp dport 123 ip saddr { $int_net4, $ext_net4 } accept + # avahi ip daddr 224.0.0.251 udp dport 5353 iif $avahi_ifs accept ip protocol igmp iif $avahi_ifs accept @@ -173,6 +176,9 @@ table ip6 filter { tcp dport 53 ip6 saddr $ext_net6 accept udp dport 53 ip6 saddr $ext_net6 accept + # ntp + udp dport 123 ip6 saddr $ext_net6 accept + # avahi ip6 daddr ff02::fb udp dport 5353 iif $avahi_ifs accept |