mrcharles
50c3f50d11
Port global-systemServiceConfigurationFiles() and global-postPackageConfiguration(). Manages: - Global zsh config (/etc/zshrc) - Mail aliases and postfix relay (local-only, smarthost to Cloudron) - Static DNS resolv.conf (replaces systemd-resolved symlinks) - rsyslog forwarding to LibreNMS (skipped on LibreNMS server itself) - DHCP client config (skipped on DHCP servers pfv-netinfra-01/02) - SNMP daemon config selected by host class (Pi/physical/Proxmox/VM) - NTP client config (skipped on NTP server hosts) - LLDP network discovery - Cockpit disallowed-users - Default user shells (zsh, conditional on user existence) - Process accounting (accton) - CPU governor on physical/Proxmox hosts (performance) - tuned profile on VM guests (virtual-guest) Infrastructure configs use Jinja2 templates parameterized by variables in group_vars/all.yml. 🤖 Generated with [Crush](https://github.com/charmassociates/crush) Assisted-by: GLM-5 via Crush <crush@charm.land>
23 lines
980 B
Django/Jinja
23 lines
980 B
Django/Jinja
driftfile /var/lib/ntp/ntp.drift
|
|
leapfile /usr/share/zoneinfo/leap-seconds.list
|
|
|
|
# Redundant upstream time sources: pfv-netinfra-01/02 (Technitium/Pi-hole hosts
|
|
# also serving NTP). IPs are used (not hostnames) because the knel.net name for
|
|
# these hosts resolves to a Tailscale CGNAT address, not the LAN address, and
|
|
# because NTP must come up before DNS is available. iburst speeds initial sync.
|
|
{% for srv in ntp_servers %}
|
|
server {{ srv }} iburst
|
|
{% endfor %}
|
|
|
|
# Hardened client: sync from the configured servers but never serve time to
|
|
# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
|
|
# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
|
|
# address that upstream servers cannot reply to (symptoms: peers stuck in
|
|
# .INIT. with reach 0). Use restrict rules to control access instead.
|
|
restrict default ignore
|
|
restrict 127.0.0.1
|
|
restrict ::1
|
|
{% for srv in ntp_servers %}
|
|
restrict {{ srv }} nomodify notrap nopeer
|
|
{% endfor %}
|