mrcharles
66e7843f27
Reorganize the merged KNELServerBuild + PFVCluster repo:
provisioning/ server provisioning (was ProjectCode/ +
Project-Includes/ + Project-ConfigFiles/)
tests/ test suite (was Project-Tests/)
perf/ Proxmox perf scripts (was top-level *.sh + scripts/)
docs/ all documentation (was ProjectDocs/ + PROJECT.md +
K8S.md + TODO.md)
dns-cluster-setup/ Technitium DNS cluster (unchanged)
netinfra/ netinfra audit scripts (unchanged)
switches/ switch configs (unchanged)
vendor/ vendored KNELShellFramework (unchanged)
Update all internal path references from old directory names
(ProjectCode/, Project-Includes/, Project-Tests/) to the new ones
(provisioning/, tests/) across all scripts.
🤖 Generated with [Crush](https://github.com/charmassociates/crush)
Assisted-by: GLM-5 via Crush <crush@charm.land>
22 lines
979 B
Plaintext
22 lines
979 B
Plaintext
driftfile /var/lib/ntp/ntp.drift
|
|
leapfile /usr/share/zoneinfo/leap-seconds.list
|
|
|
|
# Redundant upstream time sources: pfv-netinfra-01/02 (Technitium/Pi-hole hosts
|
|
# also serving NTP). IPs are used (not hostnames) because the knel.net name for
|
|
# these hosts resolves to a Tailscale CGNAT address, not the LAN address, and
|
|
# because NTP must come up before DNS is available. iburst speeds initial sync.
|
|
server 192.168.3.252 iburst
|
|
server 192.168.3.253 iburst
|
|
|
|
# Hardened client: sync from the configured servers but never serve time to
|
|
# anyone else. Note: `interface listen 127.0.0.1` must NOT be used here — it
|
|
# binds ntpd to loopback, making outbound queries carry a 127.0.0.1 source
|
|
# address that upstream servers cannot reply to (symptoms: peers stuck in
|
|
# .INIT. with reach 0). Use restrict rules to control access instead.
|
|
restrict default ignore
|
|
restrict 127.0.0.1
|
|
restrict ::1
|
|
restrict 192.168.3.252 nomodify notrap nopeer
|
|
restrict 192.168.3.253 nomodify notrap nopeer
|
|
|