Only set a long expiry on assets which exist

[chef.git] / cookbooks / ntp / templates / default / chrony.conf.erb

diff --git a/cookbooks/ntp/templates/default/chrony.conf.erb b/cookbooks/ntp/templates/default/chrony.conf.erb
index 9fc9393bc9953eabcecf45cf3d58eea957f52d41..b3948809db4add73ed8bd03dad2f45a7c19d0f88 100644 (file)
--- a/cookbooks/ntp/templates/default/chrony.conf.erb
+++ b/cookbooks/ntp/templates/default/chrony.conf.erb
@@ -1,5 +1,10 @@
 # DO NOT EDIT - This file is being maintained by Chef
 
+<% if node[:lsb][:release].to_f >= 22.04 -%>
+# Include configuration files found in /etc/chrony/conf.d.
+confdir /etc/chrony/conf.d
+<% end -%>
+
 # Servers
 <% node[:ntp][:servers].each do |server| -%>
 pool <%= server %> iburst
@@ -9,8 +14,18 @@ pool <%= server %> iburst
 pool time.cloudflare.com iburst
 pool time.google.com iburst
 
+# Allow local queries for monitoring
+allow 127.0.0.1/32
+allow ::1/128
+
 # Run an initial NTP sync on daemon startup
-initstepslew 30 time.cloudflare.com time.google.com <%= node[:ntp][:servers].join(" ") %>
+# Use a few IPs here to workaround DNSSEC failure if time is wrong: https://github.com/openstreetmap/operations/issues/654
+initstepslew 30 216.239.35.0 216.239.35.4 216.239.35.8 216.239.35.12 time.google.com time.cloudflare.com <%= node[:ntp][:servers].join(" ") %>
+
+<% if node[:lsb][:release].to_f >= 22.04 -%>
+# Use NTP sources found in /etc/chrony/sources.d.
+sourcedir /etc/chrony/sources.d
+<% end -%>
 
 # This directive specify the location of the file containing ID/key pairs for
 # NTP authentication.
@@ -20,6 +35,11 @@ keyfile /etc/chrony/chrony.keys
 # information.
 driftfile /var/lib/chrony/chrony.drift
 
+<% if node[:lsb][:release].to_f >= 22.04 -%>
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+<% end -%>
+
 # Uncomment the following line to turn logging on.
 #log tracking measurements statistics