Adding secure NTP

serving/docker-compose.yml

@@ -108,6 +108,9 @@ services:
       # Fleet-manager AGENT plane (:9600) — baked into the image so enrolled hosts
       # dial the control plane by name; resolved here like the other fleet names.
       - --address=/${MGMT_HOST}/${SERVER_IP}
+      # NTS-authenticated NTP server name (secure_ntp): baked into the image's
+      # chrony.conf; must match the NTS server cert SAN. Resolved to this host.
+      - --address=/${NTP_HOST}/${SERVER_IP}
       # Kiosk is LOCAL-ONLY (loads boot.fleet.lab), so sinkhole Chromium's
       # call-home to 0.0.0.0 — telemetry can't leave the lab even if the browser
       # tries. Defense-in-depth behind the in-image Chromium policy/flags; in
@@ -122,9 +125,14 @@ services:
       - --dhcp-range=${DHCP_RANGE_START},${DHCP_RANGE_END},${DHCP_LEASE}
       - --dhcp-option=option:router,${GATEWAY_IP}
       - --dhcp-option=option:dns-server,${SERVER_IP}
-      # NTP server (option 42): point diskless hosts at the lab 'ntp' service
-      # below so they sync time internally and never reach the public NTP pool.
-      # The image's NM dispatcher (10-chrony-dhcp-ntp) feeds this into chrony.
+      # Domain name (option 15): the image derives its NTS NTP server name at
+      # runtime as ntp.<this-domain> (secure_ntp — no baked FQDN), so hosts MUST
+      # receive the domain. NM exports it to the dispatcher as $DHCP4_DOMAIN_NAME.
+      # Explicit (not just --domain) so the option is reliably sent + matches the
+      # NTS cert SAN (ntp.${BOOT_DOMAIN}) and the dnsmasq --address for NTP_HOST.
+      - --dhcp-option=option:domain-name,${BOOT_DOMAIN}
+      # NTP server (option 42): used only in the LEGACY unauthenticated path
+      # (secure_ntp=false). With NTS the image ignores this and dials ntp.<domain>.
       - --dhcp-option=option:ntp-server,${SERVER_IP}
       # ---- Per-host names (creative starship hostnames, server-assigned) ----
       # The workstation image is hostname-neutral; naming is done HERE. fleet-namer
@@ -255,15 +263,20 @@ services:
     environment:
       HASS_URL: ${HASS_URL}
       HASS_TOKEN: ${HASS_TOKEN}
-  # --- NTP server (serves time to the boot LAN; handed out via DHCP opt 42) ---
+  # --- NTP server (serves time to the boot LAN; NTS-authenticated for secure_ntp) ---
   ntp:
     build: ./chrony
-    network_mode: host        # serve NTP on udp/123 across the boot LAN
+    network_mode: host        # serve NTP on udp/123 (+ NTS-KE tcp/4460) across the boot LAN
     cap_add:
       - SYS_TIME              # discipline the (host-shared) clock it serves
     restart: unless-stopped
     volumes:
       - ./chrony/chrony.conf:/etc/chrony/chrony.conf:ro
+      # NTS-KE server cert/key (fleet-signed) so booted hosts CA-AUTHENTICATE the
+      # time source (secure_ntp; F-03/P-18). Issue with ./chrony/nts-cert.sh.
+      # If the dir is empty the server still answers plain NTP; NTS clients then
+      # fail the KE handshake — so run nts-cert.sh before shipping secure_ntp images.
+      - ./chrony/nts:/etc/chrony/nts:ro
     # NOTE: with host networking + SYS_TIME this chronyd disciplines the Docker
     # HOST clock (the clock isn't namespaced) — intended: the serving host is the
     # lab time source. Drop SYS_TIME (and add `chronyd -x`) if the host already
@@ -271,11 +284,14 @@ services:
     #
     # FIREWALL (easy to miss — same trap as the audit collector's 514/tcp): host
     # networking means Docker does NOT open the port; the serving host's own
-    # firewall governs 123/udp. Without a rule, workstations get 192.168.50.10 as
-    # their NTP server (DHCP opt 42) but their packets are dropped — chrony logs
-    # "Added source … / unreachable" and never syncs. Open it on the boot-LAN NIC:
+    # firewall governs the NTP ports. Without a rule, workstations get 192.168.50.10
+    # as their NTP server but their packets are dropped — chrony logs
+    # "Added source … / unreachable" and never syncs. Open BOTH on the boot-LAN NIC:
+    #   udp/123  = NTP;  tcp/4460 = NTS-KE (secure_ntp key establishment)
     #   ufw:       sudo ufw allow in on <boot-nic> to any port 123 proto udp comment 'fleet NTP'
-    #   firewalld: sudo firewall-cmd --permanent --add-service=ntp && sudo firewall-cmd --reload
+    #              sudo ufw allow in on <boot-nic> to any port 4460 proto tcp comment 'fleet NTS-KE'
+    #   firewalld: sudo firewall-cmd --permanent --add-service=ntp \
+    #              && sudo firewall-cmd --permanent --add-port=4460/tcp && sudo firewall-cmd --reload
 
   # --- Remote audit / log collector (RECEIVE side) ---------------------------
   # rsyslog receiver: booted diskless hosts (whose RAM-only overlay root loses