# Lab NTP server (serving stack). Syncs from upstream and serves the boot LAN so
# diskless workstations get time INTERNALLY (handed out as DHCP option 42 by
# dnsmasq) instead of egressing to the public pool. Only this host reaches the
# internet for time; the workstations never do.

# Upstream time source (this serving host has internet; the workstations don't).
pool pool.ntp.org iburst

# Serve the boot LAN. This is an isolated lab/boot network, so allow all; scope
# to your subnet (e.g. `allow 192.168.50.0/24`) for anything less trusted.
allow all

# Serve our own clock at a high stratum if upstream is unreachable, so a diskless
# boot never blocks waiting for time.
local stratum 10

# Step the clock on large initial offsets (containers can start far off), then
# slew. driftfile is best-effort (container fs is ephemeral).
makestep 1.0 3
driftfile /var/lib/chrony/drift