Add ntp time source and browser policy

2026-06-18 09:35:58 +00:00
parent 8f8e24ac28
commit a53357216d
10 changed files with 222 additions and 10 deletions
@@ -0,0 +1,36 @@
+#!/bin/bash
+# NetworkManager dispatcher: feed DHCP option 42 (NTP servers) into chrony.
+#
+# Replaces the old dhclient.d/chrony.sh bridge — we use NetworkManager's internal
+# DHCP now (the network-manager dracut port), and NM exports the lease's NTP
+# servers to dispatcher scripts as $DHCP4_NTP_SERVERS. chrony.conf carries
+# `sourcedir /run/chrony-dhcp`, so writing <iface>.sources there and reloading
+# makes chronyd use the DHCP-provided server. The image's baked public pool is
+# stripped (see the provisioner), so the host syncs ONLY from the lab NTP server
+# — no time egress from the workstation.
+#
+# Installed 0755 root:root at /etc/NetworkManager/dispatcher.d/. Lenient on
+# purpose: a hiccup here must never break networking.
+
+interface="$1"
+action="$2"
+
+case "$action" in
+    up|dhcp4-change|reapply) ;;
+    *) exit 0 ;;
+esac
+
+dir=/run/chrony-dhcp
+file="$dir/${interface}.sources"
+mkdir -p "$dir"
+
+if [ -n "${DHCP4_NTP_SERVERS:-}" ]; then
+    : > "$file"
+    for s in $DHCP4_NTP_SERVERS; do
+        printf 'server %s iburst\n' "$s" >> "$file"
+    done
+    # Pick up the new sources without restarting chronyd.
+    chronyc reload sources >/dev/null 2>&1 || true
+fi
+
+exit 0