Add ntp time source and browser policy

serving/chrony/Dockerfile

@@ -0,0 +1,9 @@
+# Minimal chrony NTP server for the lab boot LAN. Diskless workstations get this
+# host as their time source via DHCP option 42 (dnsmasq), so they never reach the
+# public NTP pool (no workstation egress). Config is bind-mounted from
+# chrony.conf in docker-compose.yml. Build our own so the version is pinned.
+FROM alpine:3.20
+RUN apk add --no-cache chrony
+# -d: run in the foreground (don't daemonise) so the container stays up and logs
+# to stdout for `docker compose logs`.
+ENTRYPOINT ["chronyd", "-d", "-f", "/etc/chrony/chrony.conf"]

serving/chrony/chrony.conf

@@ -0,0 +1,20 @@
+# Lab NTP server (serving stack). Syncs from upstream and serves the boot LAN so
+# diskless workstations get time INTERNALLY (handed out as DHCP option 42 by
+# dnsmasq) instead of egressing to the public pool. Only this host reaches the
+# internet for time; the workstations never do.
+
+# Upstream time source (this serving host has internet; the workstations don't).
+pool pool.ntp.org iburst
+
+# Serve the boot LAN. This is an isolated lab/boot network, so allow all; scope
+# to your subnet (e.g. `allow 192.168.50.0/24`) for anything less trusted.
+allow all
+
+# Serve our own clock at a high stratum if upstream is unreachable, so a diskless
+# boot never blocks waiting for time.
+local stratum 10
+
+# Step the clock on large initial offsets (containers can start far off), then
+# slew. driftfile is best-effort (container fs is ephemeral).
+makestep 1.0 3
+driftfile /var/lib/chrony/drift