mrcharles
39bb855a98
Archive the non-ported remainder of the legacy KNELServerBuild repo
under archive/KNELServerBuild/ with its original structure intact,
completing the legacy repo merge for everything except the live
LibreNMS patterns (ported in the previous commit).
Exclusions:
- .git history (superseded; legacy repo remains at its original path)
- ported files (Agents/librenms, Modules/OAM/oam-librenms.sh,
ConfigFiles/SNMP/snmp-sudo.conf)
- vendored KNELShellFramework tree (byte-identical duplicate of the
copy already vendored at vendor/ in this repo)
- SSH authorized-keys files (live access-control material; carrying
them in an archive invites drift — key policy lives elsewhere)
The whole tree is skip-listed in tests/shellcheck.sh (archived legacy
code, not maintained — same standing as vendor/); check-rules.sh
already prunes archive/. Rule 9 (conflict markers) now also excludes
archive/ staged files: preserved-verbatim legacy scripts contain
decorative "====" banners that false-positive as conflict markers
(same archive exclusion precedent as rule 11).
AGENTS.md: note archive/KNELServerBuild and oam/librenms-agent in the
Repository Layout, and fix the stale KNELIAC path to
/home/reachableceo/projects/KNEL/KNELIAC.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
22 lines
979 B
Plaintext
22 lines
979 B
Plaintext
driftfile /var/lib/ntp/ntp.drift
|
|
leapfile /usr/share/zoneinfo/leap-seconds.list
|
|
|
|
# Redundant upstream time sources: pfv-netinfra-01/02 (Technitium/Pi-hole hosts
|
|
# also serving NTP). IPs are used (not hostnames) because the knel.net name for
|
|
# these hosts resolves to a Tailscale CGNAT address, not the LAN address, and
|
|
# because NTP must come up before DNS is available. iburst speeds initial sync.
|
|
server 192.168.3.252 iburst
|
|
server 192.168.3.253 iburst
|
|
|
|
# Hardened client: sync from the configured servers but never serve time to
|
|
# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
|
|
# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
|
|
# address that upstream servers cannot reply to (symptoms: peers stuck in
|
|
# .INIT. with reach 0). Use restrict rules to control access instead.
|
|
restrict default ignore
|
|
restrict 127.0.0.1
|
|
restrict ::1
|
|
restrict 192.168.3.252 nomodify notrap nopeer
|
|
restrict 192.168.3.253 nomodify notrap nopeer
|
|
|