Adding secure NTP

serving/chrony/chrony.conf

@@ -1,7 +1,8 @@
 # Lab NTP server (serving stack). Syncs from upstream and serves the boot LAN so
-# diskless workstations get time INTERNALLY (handed out as DHCP option 42 by
-# dnsmasq) instead of egressing to the public pool. Only this host reaches the
-# internet for time; the workstations never do.
+# diskless workstations get time INTERNALLY instead of egressing to the public
+# pool. Only this host reaches the internet for time; the workstations never do.
+# With secure_ntp=true the workstations use NTS (below) and authenticate this
+# server's identity before trusting its time.
 
 # Upstream time source (this serving host has internet; the workstations don't).
 pool pool.ntp.org iburst
@@ -10,6 +11,20 @@ pool pool.ntp.org iburst
 # to your subnet (e.g. `allow 192.168.50.0/24`) for anything less trusted.
 allow all
 
+# ---- NTS (RFC 8915): CA-AUTHENTICATED time for the fleet -------------------
+# The workstations verify THIS server's identity before trusting its time
+# (secure_ntp=true in the image; closes F-03/P-18). The NTS-KE TLS cert is signed
+# by the FLEET CA (step-ca), so it chains to the same radius-ca.pem the hosts
+# already trust; its SAN must be the name the hosts use (ntp_server / NTP_HOST,
+# default ntp.fleet.lab). Issue it with ./nts-cert.sh (mounted at /etc/chrony/nts).
+# Without these files the server still answers plain NTP, but NTS clients get an
+# "NTS-KE handshake" failure. NTS-KE listens on tcp/4460 — open it on the boot-LAN
+# NIC (see docker-compose.yml), same trap as 123/udp. docs/secure-ntp-design.md.
+ntsservercert /etc/chrony/nts/nts.crt
+ntsserverkey  /etc/chrony/nts/nts.key
+# Persist NTS server keys/cookies across restarts (best-effort on the container fs).
+ntsdumpdir /var/lib/chrony
+
 # Serve our own clock at a high stratum if upstream is unreachable, so a diskless
 # boot never blocks waiting for time.
 local stratum 10