-<% when /(albeniz|goetz).debian.org/: -%>
-server smetana.debian.org iburst dynamic
-server geo1.debian.org iburst dynamic
-server geo2.debian.org iburst dynamic
-server geo3.debian.org iburst dynamic
-<% else -%>
-server geo1.debian.org iburst dynamic
-server geo2.debian.org iburst dynamic
-server geo3.debian.org iburst dynamic
+<% elsif nodeinfo['misc']['natted'] -%>
+# autokey doesn't work behind nat
+server merikanto.debian.org iburst
+server orff.debian.org iburst
+server ravel.debian.org iburst
+server busoni.debian.org iburst
+<% else -%>
+server merikanto.debian.org iburst autokey
+server orff.debian.org iburst autokey
+server ravel.debian.org iburst autokey
+server busoni.debian.org iburst autokey
+restrict merikanto.debian.org notrust nomodify notrap ntpport
+restrict orff.debian.org notrust nomodify notrap ntpport
+restrict ravel.debian.org notrust nomodify notrap ntpport
+restrict busoni.debian.org notrust nomodify notrap ntpport