ansible/roles/chrony-ntp-server/defaults/main.yml

@@ -18,6 +18,18 @@ chrony_upstream_pools:
 # Local stratum if disconnected from upstream
 chrony_local_stratum: 10
 
+# Step (rather than slew) the clock when the offset exceeds the threshold, but
+# only for the first N updates after chronyd starts. Without this, chronyd only
+# ever slews, and a large offset is never closed in practice: on 2026-08-04
+# edge-1 rebooted with an RTC ~16 days in the past and chronyd sat synchronised
+# to ptbtime1 reporting "System time: 1376235s slow" while correcting nothing.
+# Every outbound TLS handshake then failed x509 NotBefore validation, taking out
+# the MQTT bridge (heating telemetry) and the Loki log shipper at once.
+# Limiting to the first few updates keeps steps confined to boot, so a
+# long-running server is never jumped out from under its workloads.
+chrony_makestep_threshold: 1.0
+chrony_makestep_limit: 3
+
 # Hardware timestamping. Fine on the PVE nodes' Intel NICs; the Wyse 3040
 # (edge-1) has a Realtek NIC that does not support it, and chronyd logs an
 # error per interface when asked for it. Overridden to false in

ansible/roles/chrony-ntp-server/templates/chrony.conf.j2

@@ -14,6 +14,11 @@ pool {{ pool }}
 # Record the rate at which the system clock gains/losses time
 driftfile /var/lib/chrony/chrony.drift
 
+# Step the clock instead of slewing it when the offset is large, limited to the
+# first few updates after start so only boot-time corrections jump. Without a
+# makestep directive chronyd slews exclusively and never closes a large gap.
+makestep {{ chrony_makestep_threshold }} {{ chrony_makestep_limit }}
+
 # Allow NTP client access from local networks
 {% for network in chrony_allowed_networks %}
 allow {{ network }}