# /etc/chrony/chrony.conf
# See chrony.conf(5)

{% for pool in ntp_opts.pools %}
pool {{ pool }} iburst maxsources 5
{% endfor %}

{% for server in ntp_opts.servers %}
server {{ server }} iburst {%- if ntp_opts.nts_enabled | bool %} nts
{% endif %}
{% endfor %}

# 3 are always more trustworthy than 1
minsources 3

# Disable all non-NTS sources if at least 1 source has NTS enabled
authselectmode prefer

# Cache NTS keys and cookies, so NTS-KE session doesn't need to be repeated on each start
ntsdumpdir /var/lib/chrony

driftfile /var/lib/chrony/chrony.drift

# Jump off at boot
makestep 1.0 3

# Occationally copy system time to RTC
rtcsync

# Don't open any ports for monitoring
cmdport 0
