aboutsummaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
Diffstat (limited to 'roles')
-rw-r--r--roles/space_server/files/chrony.conf56
-rw-r--r--roles/space_server/files/nftables.conf6
-rw-r--r--roles/space_server/handlers/main.yml6
-rw-r--r--roles/space_server/tasks/chrony.yml22
-rw-r--r--roles/space_server/tasks/main.yml2
-rw-r--r--roles/space_server/templates/dhcpd.conf.j210
-rw-r--r--roles/space_server/vars/main.yml2
7 files changed, 99 insertions, 5 deletions
diff --git a/roles/space_server/files/chrony.conf b/roles/space_server/files/chrony.conf
new file mode 100644
index 0000000..a33bd23
--- /dev/null
+++ b/roles/space_server/files/chrony.conf
@@ -0,0 +1,56 @@
+# Set upstream servers
+#server mmo1.ntp.se iburst
+#server mmo2.ntp.se iburst
+server nts.ntp.se iburst nts
+server time.cloudflare.com iburst nts
+
+# Specify file containing keys for NTP authentication
+keyfile /etc/chrony.keys
+
+# Dump measurement history here
+dumpdir /var/lib/chrony
+
+# Dump NTS cookies here
+ntsdumpdir /var/lib/chrony
+
+# Record the rate at which the system clock gains/losses time
+driftfile /var/lib/chrony/drift
+
+# Use /etc/adjtime
+hwclockfile /etc/adjtime
+
+# Make requests from space.labitat.dk public addresses
+bindacqaddress 185.38.175.0
+bindacqaddress 2a01:4262:1ab::
+
+# Listen to NTP on space.labitat.dk public addresses
+bindaddress 185.38.175.0
+bindaddress 2a01:4262:1ab::
+
+# Allow NTP access only from local network
+deny all
+allow 185.38.175.0/24
+allow 10.42.0.0/16
+allow 2a01:4262:1ab::/48
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on wan
+hwtimestamp wan
+
+# Let the kernel handle leap seconds
+leapsecmode system
+
+# Get TAI-UTC offset and leap seconds from the system tz database
+leapsectz right/UTC
+
+# Specify directory for log files
+#logdir /var/log/chrony
+
+# Select which information is logged
+#log measurements statistics tracking
diff --git a/roles/space_server/files/nftables.conf b/roles/space_server/files/nftables.conf
index a0c17c1..066c03e 100644
--- a/roles/space_server/files/nftables.conf
+++ b/roles/space_server/files/nftables.conf
@@ -96,6 +96,9 @@ table ip filter {
tcp dport 53 ip saddr { $int_net4, $ext_net4 } accept
udp dport 53 ip saddr { $int_net4, $ext_net4 } accept
+ # ntp
+ udp dport 123 ip saddr { $int_net4, $ext_net4 } accept
+
# avahi
ip daddr 224.0.0.251 udp dport 5353 iif $avahi_ifs accept
ip protocol igmp iif $avahi_ifs accept
@@ -173,6 +176,9 @@ table ip6 filter {
tcp dport 53 ip6 saddr $ext_net6 accept
udp dport 53 ip6 saddr $ext_net6 accept
+ # ntp
+ udp dport 123 ip6 saddr $ext_net6 accept
+
# avahi
ip6 daddr ff02::fb udp dport 5353 iif $avahi_ifs accept
diff --git a/roles/space_server/handlers/main.yml b/roles/space_server/handlers/main.yml
index adf4ee9..94c48b5 100644
--- a/roles/space_server/handlers/main.yml
+++ b/roles/space_server/handlers/main.yml
@@ -5,6 +5,12 @@
state: reloaded
when: not chroot
+- name: restart chronyd
+ systemd:
+ name: chronyd.service
+ state: restarted
+ when: not chroot
+
- name: restart bird
systemd:
name: bird.service
diff --git a/roles/space_server/tasks/chrony.yml b/roles/space_server/tasks/chrony.yml
new file mode 100644
index 0000000..2777591
--- /dev/null
+++ b/roles/space_server/tasks/chrony.yml
@@ -0,0 +1,22 @@
+---
+- name: Configure chrony.conf
+ copy:
+ dest: '/etc/chrony.conf'
+ src: chrony.conf
+ owner: root
+ group: root
+ mode: 0644
+ notify: restart chronyd
+
+- name: Enable chronyd service
+ systemd:
+ name: chronyd.service
+ enabled: yes
+ masked: no
+ state: started
+ when: not chroot
+- name: '- when in chroot'
+ command: systemctl enable chronyd.service
+ when: chroot
+
+# vim: set ts=2 sw=2 et ft=yaml:
diff --git a/roles/space_server/tasks/main.yml b/roles/space_server/tasks/main.yml
index f4f89d6..112c4ce 100644
--- a/roles/space_server/tasks/main.yml
+++ b/roles/space_server/tasks/main.yml
@@ -17,6 +17,8 @@
tags: networkd
- import_tasks: nftables.yml
tags: nftables
+- import_tasks: chrony.yml
+ tags: chrony
- import_tasks: bird.yml
tags: bird
- import_tasks: dhcpd.yml
diff --git a/roles/space_server/templates/dhcpd.conf.j2 b/roles/space_server/templates/dhcpd.conf.j2
index dbfa2b7..a2d82a7 100644
--- a/roles/space_server/templates/dhcpd.conf.j2
+++ b/roles/space_server/templates/dhcpd.conf.j2
@@ -58,7 +58,7 @@ subnet 10.42.0.0 netmask 255.255.255.0 {
range 10.42.0.50 10.42.0.250;
option routers 10.42.0.1;
option domain-name-servers 185.38.175.0;
- #option ntp-servers 90.185.0.18;
+ option ntp-servers 185.38.175.0;
ddns-updates off;
deny bootp;
@@ -73,7 +73,7 @@ subnet 10.42.1.0 netmask 255.255.255.0 {
range dynamic-bootp 10.42.1.50 10.42.1.250;
option routers 10.42.1.1;
option domain-name-servers 185.38.175.0;
- #option ntp-servers 90.185.0.18;
+ option ntp-servers 185.38.175.0;
next-server 10.42.1.1;
filename "pxelinux.0";
@@ -96,7 +96,7 @@ subnet 10.42.2.0 netmask 255.255.255.0 {
range dynamic-bootp 10.42.2.50 10.42.2.250;
option routers 10.42.2.1;
option domain-name-servers 185.38.175.0;
- #option ntp-servers 90.185.0.18;
+ option ntp-servers 185.38.175.0;
next-server 10.42.2.1;
filename "pxelinux.0";
@@ -119,7 +119,7 @@ subnet 10.42.3.0 netmask 255.255.255.0 {
range dynamic-bootp 10.42.3.50 10.42.3.250;
option routers 10.42.3.1;
option domain-name-servers 185.38.175.0;
- #option ntp-servers 90.185.0.18;
+ option ntp-servers 185.38.175.0;
if exists host-name and option host-name ~= "^[0-9A-Za-z-]*$" {
ddns-hostname = option host-name;
@@ -140,7 +140,7 @@ subnet 10.42.3.0 netmask 255.255.255.0 {
# range dynamic-bootp 10.42.4.50 10.42.4.250;
# option routers 10.42.4.1;
# option domain-name-servers 185.38.175.0;
-# #option ntp-servers 90.185.0.18;
+# option ntp-servers 185.38.175.0;
#
# if exists host-name and option host-name ~= "^[0-9A-Za-z-]*$" {
# ddns-hostname = option host-name;
diff --git a/roles/space_server/vars/main.yml b/roles/space_server/vars/main.yml
index 6cd4e38..76eff66 100644
--- a/roles/space_server/vars/main.yml
+++ b/roles/space_server/vars/main.yml
@@ -2,6 +2,7 @@
hostname: 'space'
use_resolved: false
+use_timesyncd: false
locale_default:
LANG: 'da_DK.UTF-8'
@@ -26,6 +27,7 @@ dnf_packages_role:
'systemd-networkd': present
'systemd-container': present
'sudo': present
+ 'chrony': present
'nftables': present
'openssh-server': present
'openssh-clients': present
generated by cgit v1.2.1 (git 2.18.0) at 2024-11-22 09:52:09 +0000