From a978d1c95b9351e4a9564fdae43e7b45711c15ad Mon Sep 17 00:00:00 2001
From: 12ww1160 <12ww1160@confdroid.com>
Date: Fri, 2 Oct 2026 15:37:23 +0200
Subject: [PATCH] OP#830 finalize default config values

---
 manifests/params.pp       |  7 +++-
 templates/chrony.conf.erb | 74 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+), 1 deletion(-)

diff --git a/manifests/params.pp b/manifests/params.pp
index 0e82d8e..c445fd0 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -9,6 +9,9 @@
 #   If the fqdn of the host matches this value, a time server will be 
 #   configured, else a client.
 # @param [Array] cy_conf_servers List of NTP servers to point to as time source
+# @param [String] cy_min_sources Minimum number of selectable sources required 
+#   to adjust the system clock. Primarily used for servers.
+# @param [String] cy_client_allow CIDR notation for allowed client networks
 ###############################################################################
 class confdroid_ntp::params (
 
@@ -19,13 +22,15 @@ class confdroid_ntp::params (
 # configuration
   String $cy_server_fqdn    = 'ntp.example.local',
   Array $cy_conf_servers    = ['0.pool.ntp.org', '1.pool.ntp.org', '2.pool.ntp.org', '3.pool.ntp.org'],
+  String $cy_min_sources    = '3',
+  String $cy_client_allow   = '192.168.1.0/24',
 
 ) {
 # facts
   $fqdn                     = $facts['networking']['fqdn']
   $domain                   = $facts['networking']['domain']
   $os_name                  = $facts['os']['name']
-  $os_release               y= $facts['os']['release']['major']
+  $os_release               = $facts['os']['release']['major']
 
 # dirs
 
diff --git a/templates/chrony.conf.erb b/templates/chrony.conf.erb
index 13866b2..b17ca0f 100644
--- a/templates/chrony.conf.erb
+++ b/templates/chrony.conf.erb
@@ -21,6 +21,43 @@ driftfile /var/lib/chrony/drift
 # if its offset is larger than 1 second.
 makestep 1.0 3
 
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on all interfaces that support it.
+hwtimestamp *
+
+# Increase the minimum number of selectable sources required to adjust
+# the system clock.
+minsources <%= @cy_min_sources %>
+
+# Allow NTP client access from local network.
+allow <%= @cy_client_allow %>
+
+# Serve time even if not synchronized to a time source.
+local stratum 10
+
+# Require authentication (nts or key option) for all NTP sources.
+#authselectmode require
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+#leapsecmode slew
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz right/UTC
+
+# Specify directory for log files.
+logdir /var/log/chrony
+
+# Select which information is logged.
+#log measurements statistics tracking
+
 <% end %>
 
 
@@ -38,4 +75,41 @@ driftfile /var/lib/chrony/drift
 # if its offset is larger than 1 second.
 makestep 1.0 3
 
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on all interfaces that support it.
+hwtimestamp *
+
+# Increase the minimum number of selectable sources required to adjust
+# the system clock. Primarily for servers.
+#minsources 2
+
+# Allow NTP client access from local network.
+#allow 192.168.0.0/16
+
+# Serve time even if not synchronized to a time source.
+#local stratum 10
+
+# Require authentication (nts or key option) for all NTP sources.
+#authselectmode require
+
+# Specify file containing keys for NTP authentication.
+keyfile /etc/chrony.keys
+
+# Save NTS keys and cookies.
+ntsdumpdir /var/lib/chrony
+
+# Insert/delete leap seconds by slewing instead of stepping.
+#leapsecmode slew
+
+# Get TAI-UTC offset and leap seconds from the system tz database.
+leapsectz right/UTC
+
+# Specify directory for log files.
+logdir /var/log/chrony
+
+# Select which information is logged.
+#log measurements statistics tracking
+
 <% end %>