Add ntp time source and browser policy

serving/docker-compose.yml

@@ -63,11 +63,24 @@ services:
       # resolve the per-environment DNS name to this serving host.
       - --address=/${NVME_HOST}/${SERVER_IP}
       - --address=/${BOOT_HOST}/${SERVER_IP}
+      # Kiosk is LOCAL-ONLY (loads boot.fleet.lab), so sinkhole Chromium's
+      # call-home to 0.0.0.0 — telemetry can't leave the lab even if the browser
+      # tries. Defense-in-depth behind the in-image Chromium policy/flags; in
+      # production this belongs in the boot-LAN firewall's egress rules. NOTE: the
+      # client still *emits* the query (you'll see it in this log answered locally,
+      # not "forwarded"); stopping the query itself is the browser policy's job.
+      - --address=/google.com/0.0.0.0
+      - --address=/googleapis.com/0.0.0.0
+      - --address=/gstatic.com/0.0.0.0
       # ---- DHCP ----
       - --dhcp-authoritative
       - --dhcp-range=${DHCP_RANGE_START},${DHCP_RANGE_END},${DHCP_LEASE}
       - --dhcp-option=option:router,${GATEWAY_IP}
       - --dhcp-option=option:dns-server,${SERVER_IP}
+      # NTP server (option 42): point diskless hosts at the lab 'ntp' service
+      # below so they sync time internally and never reach the public NTP pool.
+      # The image's NM dispatcher (10-chrony-dhcp-ntp) feeds this into chrony.
+      - --dhcp-option=option:ntp-server,${SERVER_IP}
       # ---- UEFI HTTP Boot ----
       # Firmware sends vendor-class "HTTPClient"; we must echo it back (opt 60)
       # and hand over the UKI URL (opt 67). IP in the URL avoids a DNS round-trip
@@ -96,6 +109,20 @@ services:
     # For HTTPS boot (production), terminate TLS here with the boot-infra CA's
     # cert and switch the dhcp-boot URL above to https://. Left HTTP for the lab.
 
+  # --- NTP server (serves time to the boot LAN; handed out via DHCP opt 42) ---
+  ntp:
+    build: ./chrony
+    network_mode: host        # serve NTP on udp/123 across the boot LAN
+    cap_add:
+      - SYS_TIME              # discipline the (host-shared) clock it serves
+    restart: unless-stopped
+    volumes:
+      - ./chrony/chrony.conf:/etc/chrony/chrony.conf:ro
+    # NOTE: with host networking + SYS_TIME this chronyd disciplines the Docker
+    # HOST clock (the clock isn't namespaced) — intended: the serving host is the
+    # lab time source. Drop SYS_TIME (and add `chronyd -x`) if the host already
+    # runs its own NTP and you only want this to relay.
+
   # --- NVMe/TCP target (serves rootfs.erofs, read-only) ----------------------
   nvmeof:
     # Prebuilt by CI (.gitea/workflows/spdk-image.yaml) and pulled here — no