Add ntp time source and browser policy

2026-06-18 09:35:58 +00:00
parent 8f8e24ac28
commit a53357216d
10 changed files with 222 additions and 10 deletions
@@ -0,0 +1,20 @@
+# Lab NTP server (serving stack). Syncs from upstream and serves the boot LAN so
+# diskless workstations get time INTERNALLY (handed out as DHCP option 42 by
+# dnsmasq) instead of egressing to the public pool. Only this host reaches the
+# internet for time; the workstations never do.
+
+# Upstream time source (this serving host has internet; the workstations don't).
+pool pool.ntp.org iburst
+
+# Serve the boot LAN. This is an isolated lab/boot network, so allow all; scope
+# to your subnet (e.g. `allow 192.168.50.0/24`) for anything less trusted.
+allow all
+
+# Serve our own clock at a high stratum if upstream is unreachable, so a diskless
+# boot never blocks waiting for time.
+local stratum 10
+
+# Step the clock on large initial offsets (containers can start far off), then
+# slew. driftfile is best-effort (container fs is ephemeral).
+makestep 1.0 3
+driftfile /var/lib/chrony/drift