93 lines
2.2 KiB
YAML
93 lines
2.2 KiB
YAML
---
|
|
- name: Load OS-specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- "debian.yml"
|
|
|
|
- name: Install chrony
|
|
ansible.builtin.package:
|
|
name: chrony
|
|
state: present
|
|
|
|
- name: Set system timezone
|
|
community.general.timezone:
|
|
name: "{{ ntp_timezone }}"
|
|
notify: Restart chrony
|
|
|
|
- name: Ensure chrony drift file directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ ntp_driftfile | dirname }}"
|
|
state: directory
|
|
owner: "{{ ntp_user }}"
|
|
group: "{{ ntp_group }}"
|
|
mode: "0755"
|
|
|
|
- name: Ensure chrony log directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ ntp_logdir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
when: ntp_log_backend == 'file'
|
|
|
|
- name: Disable conflicting systemd-timesyncd service
|
|
ansible.builtin.systemd:
|
|
name: systemd-timesyncd
|
|
enabled: false
|
|
state: stopped
|
|
failed_when: false
|
|
|
|
- name: Disable conflicting ntpd service
|
|
ansible.builtin.systemd:
|
|
name: ntpd
|
|
enabled: false
|
|
state: stopped
|
|
failed_when: false
|
|
|
|
- name: Deploy chrony configuration
|
|
ansible.builtin.template:
|
|
src: chrony.conf.j2
|
|
dest: "{{ ntp_config_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart chrony
|
|
|
|
- name: Deploy logrotate configuration for chrony
|
|
ansible.builtin.template:
|
|
src: logrotate.conf.j2
|
|
dest: /etc/logrotate.d/chrony
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: ntp_log_backend == 'file'
|
|
|
|
- name: Remove logrotate configuration when using journald
|
|
ansible.builtin.file:
|
|
path: /etc/logrotate.d/chrony
|
|
state: absent
|
|
when: ntp_log_backend == 'journald'
|
|
|
|
- name: Enable and start chrony service
|
|
ansible.builtin.systemd:
|
|
name: "{{ ntp_service }}"
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Setup firewall rules for NTP server
|
|
community.general.ufw:
|
|
rule: allow
|
|
port: "{{ ntp_port }}"
|
|
proto: udp
|
|
src: "{{ item }}"
|
|
direction: in
|
|
comment: "NTP server (chrony)"
|
|
loop: "{{ ntp_allowed_networks }}"
|
|
when: ntp_server_enabled and ntp_allowed_networks | length > 0
|
|
retries: 5
|
|
delay: 2
|
|
register: ufw_result
|
|
until: ufw_result is succeeded
|