fix(time-sync): keep the internet VPS hosts on NTP #1592

2026-11-07T11:43:11Z

claude-bot commented

2026-11-07 11:43:11 +00:00

common and plays/configure-vm-time-sync.yml masked systemd-timesyncd on every KVM guest, assuming a Proxmox host supplies the time. The Proxmox VMs are gone; the only KVM guests left are the Hetzner/netcup VPS hosts (netbird.renner.uno, proxy-1, proxy-2), which have no such host. netbird.renner.uno ran without any NTP client, drifted behind authentik, and NetBird management rejected SSO logins with token used before issued.

Remove the timesyncd masking from common and delete plays/configure-vm-time-sync.yml (and its import in site.yml).
New role timesyncd: installs systemd-timesyncd on Debian-family hosts, unmasks/enables/starts it, waits for NTPSynchronized=yes.
Applied in plays/install-netbird-server.yml and plays/install-netbird-proxy.yml.

Edge hosts keep chrony (chrony-ntp-server); NAS hosts are untouched.

Refs S28-29

🤖 Generated with Claude Code

common and plays/configure-vm-time-sync.yml masked systemd-timesyncd on every KVM guest, assuming a Proxmox host supplies the time. The Proxmox VMs are gone; the only KVM guests left are the Hetzner/netcup VPS hosts (netbird.renner.uno, proxy-1, proxy-2), which have no such host. netbird.renner.uno ran without any NTP client, drifted behind authentik, and NetBird management rejected SSO logins with `token used before issued`. - Remove the timesyncd masking from `common` and delete `plays/configure-vm-time-sync.yml` (and its import in `site.yml`). - New role `timesyncd`: installs systemd-timesyncd on Debian-family hosts, unmasks/enables/starts it, waits for `NTPSynchronized=yes`. - Applied in `plays/install-netbird-server.yml` and `plays/install-netbird-proxy.yml`. Edge hosts keep chrony (`chrony-ntp-server`); NAS hosts are untouched. Refs S28-29 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit 2026-11-07 11:43:11 +00:00

fix(time-sync): keep the internet VPS hosts on NTP

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

41efcd9f91

common and plays/configure-vm-time-sync.yml masked systemd-timesyncd on
every KVM guest, assuming a Proxmox host supplies the time. The Proxmox
VMs are gone; the only KVM guests left are the Hetzner/netcup VPS hosts,
which have no such host. netbird.renner.uno ran with no NTP client since
provisioning, drifted behind authentik, and NetBird management rejected
SSO tokens with "token used before issued".

Drop both masking paths and add a timesyncd role to the netbird server
and proxy plays; it unmasks, enables and starts systemd-timesyncd and
waits for NTPSynchronized=yes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner requested review from review-bot 2026-11-07 12:17:57 +00:00

review-bot approved these changes

2026-11-07 12:18:52 +00:00

review-bot left a comment

🤖 Automated review — model claude-sonnet-5-5, commit 41efcd9f91fe3a7ae01b5310c6cef0be88c9562b.

Automated review by the review-bot: it approves only when it found nothing red or yellow, and a human still merges. Request a review from review-bot again for a fresh one.

Summary

This PR adds a timesyncd role that installs, unmasks, enables and starts systemd-timesyncd, then waits for NTPSynchronized=yes. It applies the role to the NetBird server and proxy plays. It also removes the old plan of masking timesyncd on KVM and LXC guests: the common task and plays/configure-vm-time-sync.yml are deleted, along with the site.yml import. The change is small and matches its stated goal. I found no blocking defects.

⚪ Unverified

Chrony hosts. common used to mask timesyncd on every KVM or LXC guest, including edge hosts that run chrony-ntp-server. That masking is now gone. I did not check whether those hosts have timesyncd installed. On Debian the chrony package normally conflicts with systemd-timesyncd, so this is probably harmless.
Hosts masked earlier. Hosts already masked by the old tasks stay masked, because nothing reverses it outside the new role. This only matters if other guests are meant to run timesyncd again. It is a state change, not a defect.
References to the deleted play. A search of issues and PRs found no other mention of configure-vm-time-sync. I did not grep the repository files.

🟡 Suggestions

ansible/roles/timesyncd/tasks/main.yml:19: the "Run systemd-timesyncd" task has no os_family guard, but the install task does. On a non-Debian host the task would fail because the unit is missing. Either guard it the same way or document that the role is Debian-only.
ansible/roles/timesyncd/tasks/main.yml:24: the wait task gives up after 60 seconds (12 retries at 5-second intervals). That is probably enough, but the first sync can be slow on a cold start. It would also fail in a container with no NTP access. Consider a longer delay or making the failure explicit.

Tests

There are no tests, which is normal for Ansible roles in this repo. A Molecule or check-mode run on a Debian guest would cover this role.

Recommendation

Looks reasonable — no blocking issues; comments above are optional.

🤖 **Automated review** — model `claude-sonnet-5-5`, commit `41efcd9f91fe3a7ae01b5310c6cef0be88c9562b`. > Automated review by the `review-bot`: it approves only when it found nothing red or yellow, and a human still merges. Request a review from `review-bot` again for a fresh one. --- ## Summary This PR adds a `timesyncd` role that installs, unmasks, enables and starts systemd-timesyncd, then waits for `NTPSynchronized=yes`. It applies the role to the NetBird server and proxy plays. It also removes the old plan of masking timesyncd on KVM and LXC guests: the `common` task and `plays/configure-vm-time-sync.yml` are deleted, along with the `site.yml` import. The change is small and matches its stated goal. I found no blocking defects. ## ⚪ Unverified - **Chrony hosts.** `common` used to mask timesyncd on every KVM or LXC guest, including edge hosts that run `chrony-ntp-server`. That masking is now gone. I did not check whether those hosts have timesyncd installed. On Debian the `chrony` package normally conflicts with `systemd-timesyncd`, so this is probably harmless. - **Hosts masked earlier.** Hosts already masked by the old tasks stay masked, because nothing reverses it outside the new role. This only matters if other guests are meant to run timesyncd again. It is a state change, not a defect. - **References to the deleted play.** A search of issues and PRs found no other mention of `configure-vm-time-sync`. I did not grep the repository files. ## 🟡 Suggestions - `ansible/roles/timesyncd/tasks/main.yml:19`: the "Run systemd-timesyncd" task has no `os_family` guard, but the install task does. On a non-Debian host the task would fail because the unit is missing. Either guard it the same way or document that the role is Debian-only. - `ansible/roles/timesyncd/tasks/main.yml:24`: the wait task gives up after 60 seconds (12 retries at 5-second intervals). That is probably enough, but the first sync can be slow on a cold start. It would also fail in a container with no NTP access. Consider a longer delay or making the failure explicit. ## Tests There are no tests, which is normal for Ansible roles in this repo. A Molecule or check-mode run on a Debian guest would cover this role. ## Recommendation Looks reasonable — no blocking issues; comments above are optional.

k.renner merged commit ca20206bbf into main

2026-11-07 12:33:04 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1592