diff --git a/plays/ntp.yml b/plays/ntp.yml
new file mode 100755
index 0000000000000000000000000000000000000000..0ba9a409da63398fbd3a638f3162040edc59c435
--- /dev/null
+++ b/plays/ntp.yml
@@ -0,0 +1,7 @@
+#!/usr/bin/env ansible-playbook
+---
+# NTP client is in root.yml
+
+- hosts: charybde.adm.crans.org
+  roles:
+    - ntp-server
diff --git a/roles/ntp-client/handlers/main.yml b/roles/ntp-client/handlers/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..ffd2754d134429a15776147da6bcc3121d88ff2d
--- /dev/null
+++ b/roles/ntp-client/handlers/main.yml
@@ -0,0 +1,5 @@
+---
+- name: Restart systemd-timesyncd
+  service:
+    name: systemd-timesyncd
+    state: restarted
diff --git a/roles/ntp-client/tasks/main.yml b/roles/ntp-client/tasks/main.yml
index 0bc25d2178fe0c9aaed6e14e4948d211c1c30539..2dac6728b2e87f24ebbbdc1ef042dfb68cc5bdb8 100644
--- a/roles/ntp-client/tasks/main.yml
+++ b/roles/ntp-client/tasks/main.yml
@@ -1,27 +1,18 @@
 ---
-- name: Install NTP
+- name: Clean up ntp
   apt:
-    update_cache: true
+    state: absent
     name: ntp
+    purge: true
   register: apt_result
   retries: 3
   until: apt_result is succeeded
-
-- name: Configure NTP daemon
-  lineinfile:
-    path: /etc/default/ntp
-    regexp: '^NTPD_OPTS'
-    line: NTPD_OPTS='-g -x'
-  check_mode: no
+  when: inventory_hostname in ntp_servers
 
 - name: Configure NTP
-  template:
-    src: ntp.conf.j2
-    dest: /etc/ntp.conf
-    mode: 0644
-
-- name: Start ntp service
-  systemd:
-    name: ntp
-    enabled: true
-    state: started
+  lineinfile:
+    path: /etc/systemd/timesyncd.conf
+    regexp: '^NTP='
+    line: "NTP={{ ntp_servers | join(' ') }}"
+  notify: Restart systemd-timesyncd
+  when: inventory_hostname in ntp_servers
diff --git a/roles/ntp-server/tasks/main.yml b/roles/ntp-server/tasks/main.yml
new file mode 100644
index 0000000000000000000000000000000000000000..0bc25d2178fe0c9aaed6e14e4948d211c1c30539
--- /dev/null
+++ b/roles/ntp-server/tasks/main.yml
@@ -0,0 +1,27 @@
+---
+- name: Install NTP
+  apt:
+    update_cache: true
+    name: ntp
+  register: apt_result
+  retries: 3
+  until: apt_result is succeeded
+
+- name: Configure NTP daemon
+  lineinfile:
+    path: /etc/default/ntp
+    regexp: '^NTPD_OPTS'
+    line: NTPD_OPTS='-g -x'
+  check_mode: no
+
+- name: Configure NTP
+  template:
+    src: ntp.conf.j2
+    dest: /etc/ntp.conf
+    mode: 0644
+
+- name: Start ntp service
+  systemd:
+    name: ntp
+    enabled: true
+    state: started
diff --git a/roles/ntp-client/templates/ntp.conf.j2 b/roles/ntp-server/templates/ntp.conf.j2
similarity index 91%
rename from roles/ntp-client/templates/ntp.conf.j2
rename to roles/ntp-server/templates/ntp.conf.j2
index 050f51c895bcd64b6425bcad74cb60736960df73..5d480582746873f90f8596abb6bc9a86e79cea06 100644
--- a/roles/ntp-client/templates/ntp.conf.j2
+++ b/roles/ntp-server/templates/ntp.conf.j2
@@ -15,7 +15,6 @@ filegen peerstats file peerstats type day enable
 filegen clockstats file clockstats type day enable
 
 
-{% if inventory_hostname in ntp_servers %}
 # pool.ntp.org maps to about 1000 low-stratum NTP servers.  Your server will
 # pick a different set every time it starts up.  Please consider joining the
 # pool: <http://www.pool.ntp.org/join.html>
@@ -23,12 +22,6 @@ pool 0.debian.pool.ntp.org iburst
 pool 1.debian.pool.ntp.org iburst
 pool 2.debian.pool.ntp.org iburst
 pool 3.debian.pool.ntp.org iburst
-{% else %}
-# You do need to talk to an NTP server or two (or three).
-{% for server in ntp_servers %}
-server {{ server }} iburst
-{% endfor %}
-{% endif %}
 
 
 # Access control configuration; see /usr/share/doc/ntp-doc/html/accopt.html for
@@ -50,6 +43,9 @@ restrict ::1
 # Needed for adding pool entries
 restrict source notrap nomodify noquery
 
+# Server on adm can sync
+restrict 172.16.10.0 mask 255.255.255.0 notrap nomodify
+
 # Clients from this (example!) subnet have unlimited access, but only if
 # cryptographically authenticated.
 #restrict 192.168.123.0 mask 255.255.255.0 notrust