From 48d0db45d2ac05e42f6219667008bf73ea41d19d Mon Sep 17 00:00:00 2001 From: Emil Renner Berthing Date: Tue, 19 Jan 2021 13:14:10 +0100 Subject: space_server: chrony: run chrony ntp server --- roles/space_server/files/chrony.conf | 56 ++++++++++++++++++++++++++++++ roles/space_server/files/nftables.conf | 6 ++++ roles/space_server/handlers/main.yml | 6 ++++ roles/space_server/tasks/chrony.yml | 22 ++++++++++++ roles/space_server/tasks/main.yml | 2 ++ roles/space_server/templates/dhcpd.conf.j2 | 10 +++--- roles/space_server/vars/main.yml | 2 ++ 7 files changed, 99 insertions(+), 5 deletions(-) create mode 100644 roles/space_server/files/chrony.conf create mode 100644 roles/space_server/tasks/chrony.yml (limited to 'roles') diff --git a/roles/space_server/files/chrony.conf b/roles/space_server/files/chrony.conf new file mode 100644 index 0000000..a33bd23 --- /dev/null +++ b/roles/space_server/files/chrony.conf @@ -0,0 +1,56 @@ +# Set upstream servers +#server mmo1.ntp.se iburst +#server mmo2.ntp.se iburst +server nts.ntp.se iburst nts +server time.cloudflare.com iburst nts + +# Specify file containing keys for NTP authentication +keyfile /etc/chrony.keys + +# Dump measurement history here +dumpdir /var/lib/chrony + +# Dump NTS cookies here +ntsdumpdir /var/lib/chrony + +# Record the rate at which the system clock gains/losses time +driftfile /var/lib/chrony/drift + +# Use /etc/adjtime +hwclockfile /etc/adjtime + +# Make requests from space.labitat.dk public addresses +bindacqaddress 185.38.175.0 +bindacqaddress 2a01:4262:1ab:: + +# Listen to NTP on space.labitat.dk public addresses +bindaddress 185.38.175.0 +bindaddress 2a01:4262:1ab:: + +# Allow NTP access only from local network +deny all +allow 185.38.175.0/24 +allow 10.42.0.0/16 +allow 2a01:4262:1ab::/48 + +# Allow the system clock to be stepped in the first three updates +# if its offset is larger than 1 second. +makestep 1.0 3 + +# Enable kernel synchronization of the real-time clock (RTC). +rtcsync + +# Enable hardware timestamping on wan +hwtimestamp wan + +# Let the kernel handle leap seconds +leapsecmode system + +# Get TAI-UTC offset and leap seconds from the system tz database +leapsectz right/UTC + +# Specify directory for log files +#logdir /var/log/chrony + +# Select which information is logged +#log measurements statistics tracking diff --git a/roles/space_server/files/nftables.conf b/roles/space_server/files/nftables.conf index a0c17c1..066c03e 100644 --- a/roles/space_server/files/nftables.conf +++ b/roles/space_server/files/nftables.conf @@ -96,6 +96,9 @@ table ip filter { tcp dport 53 ip saddr { $int_net4, $ext_net4 } accept udp dport 53 ip saddr { $int_net4, $ext_net4 } accept + # ntp + udp dport 123 ip saddr { $int_net4, $ext_net4 } accept + # avahi ip daddr 224.0.0.251 udp dport 5353 iif $avahi_ifs accept ip protocol igmp iif $avahi_ifs accept @@ -173,6 +176,9 @@ table ip6 filter { tcp dport 53 ip6 saddr $ext_net6 accept udp dport 53 ip6 saddr $ext_net6 accept + # ntp + udp dport 123 ip6 saddr $ext_net6 accept + # avahi ip6 daddr ff02::fb udp dport 5353 iif $avahi_ifs accept diff --git a/roles/space_server/handlers/main.yml b/roles/space_server/handlers/main.yml index adf4ee9..94c48b5 100644 --- a/roles/space_server/handlers/main.yml +++ b/roles/space_server/handlers/main.yml @@ -5,6 +5,12 @@ state: reloaded when: not chroot +- name: restart chronyd + systemd: + name: chronyd.service + state: restarted + when: not chroot + - name: restart bird systemd: name: bird.service diff --git a/roles/space_server/tasks/chrony.yml b/roles/space_server/tasks/chrony.yml new file mode 100644 index 0000000..2777591 --- /dev/null +++ b/roles/space_server/tasks/chrony.yml @@ -0,0 +1,22 @@ +--- +- name: Configure chrony.conf + copy: + dest: '/etc/chrony.conf' + src: chrony.conf + owner: root + group: root + mode: 0644 + notify: restart chronyd + +- name: Enable chronyd service + systemd: + name: chronyd.service + enabled: yes + masked: no + state: started + when: not chroot +- name: '- when in chroot' + command: systemctl enable chronyd.service + when: chroot + +# vim: set ts=2 sw=2 et ft=yaml: diff --git a/roles/space_server/tasks/main.yml b/roles/space_server/tasks/main.yml index f4f89d6..112c4ce 100644 --- a/roles/space_server/tasks/main.yml +++ b/roles/space_server/tasks/main.yml @@ -17,6 +17,8 @@ tags: networkd - import_tasks: nftables.yml tags: nftables +- import_tasks: chrony.yml + tags: chrony - import_tasks: bird.yml tags: bird - import_tasks: dhcpd.yml diff --git a/roles/space_server/templates/dhcpd.conf.j2 b/roles/space_server/templates/dhcpd.conf.j2 index dbfa2b7..a2d82a7 100644 --- a/roles/space_server/templates/dhcpd.conf.j2 +++ b/roles/space_server/templates/dhcpd.conf.j2 @@ -58,7 +58,7 @@ subnet 10.42.0.0 netmask 255.255.255.0 { range 10.42.0.50 10.42.0.250; option routers 10.42.0.1; option domain-name-servers 185.38.175.0; - #option ntp-servers 90.185.0.18; + option ntp-servers 185.38.175.0; ddns-updates off; deny bootp; @@ -73,7 +73,7 @@ subnet 10.42.1.0 netmask 255.255.255.0 { range dynamic-bootp 10.42.1.50 10.42.1.250; option routers 10.42.1.1; option domain-name-servers 185.38.175.0; - #option ntp-servers 90.185.0.18; + option ntp-servers 185.38.175.0; next-server 10.42.1.1; filename "pxelinux.0"; @@ -96,7 +96,7 @@ subnet 10.42.2.0 netmask 255.255.255.0 { range dynamic-bootp 10.42.2.50 10.42.2.250; option routers 10.42.2.1; option domain-name-servers 185.38.175.0; - #option ntp-servers 90.185.0.18; + option ntp-servers 185.38.175.0; next-server 10.42.2.1; filename "pxelinux.0"; @@ -119,7 +119,7 @@ subnet 10.42.3.0 netmask 255.255.255.0 { range dynamic-bootp 10.42.3.50 10.42.3.250; option routers 10.42.3.1; option domain-name-servers 185.38.175.0; - #option ntp-servers 90.185.0.18; + option ntp-servers 185.38.175.0; if exists host-name and option host-name ~= "^[0-9A-Za-z-]*$" { ddns-hostname = option host-name; @@ -140,7 +140,7 @@ subnet 10.42.3.0 netmask 255.255.255.0 { # range dynamic-bootp 10.42.4.50 10.42.4.250; # option routers 10.42.4.1; # option domain-name-servers 185.38.175.0; -# #option ntp-servers 90.185.0.18; +# option ntp-servers 185.38.175.0; # # if exists host-name and option host-name ~= "^[0-9A-Za-z-]*$" { # ddns-hostname = option host-name; diff --git a/roles/space_server/vars/main.yml b/roles/space_server/vars/main.yml index 6cd4e38..76eff66 100644 --- a/roles/space_server/vars/main.yml +++ b/roles/space_server/vars/main.yml @@ -2,6 +2,7 @@ hostname: 'space' use_resolved: false +use_timesyncd: false locale_default: LANG: 'da_DK.UTF-8' @@ -26,6 +27,7 @@ dnf_packages_role: 'systemd-networkd': present 'systemd-container': present 'sudo': present + 'chrony': present 'nftables': present 'openssh-server': present 'openssh-clients': present -- cgit v1.2.1