feat: NTP-Server (Chrony) — vollständig
Stub raus, vollständige Implementierung analog Unbound/Squid:
* Migration 0015: ntp_settings (single-row mit listen_addresses,
allow_acl, serve_clients, makestep, rtcsync) + ntp_pools (kind
pool|server, address, iburst/prefer, minpoll/maxpoll). Default
4 deutsche pool.ntp.org-Server seeded.
* Models DNSSettings/NTPPool, services/ntp Repo, handlers/ntp.go
REST /api/v1/ntp/{settings,pools} mit Auto-Restart nach Mutation.
* internal/chrony/chrony.cfg.tpl + chrony.go: Renderer schreibt
/etc/chrony/conf.d/edgeguard.conf direkt (analog unbound — distro
chrony.conf included conf.d automatisch). Listen-bind nur wenn
serve_clients=true; sonst port 0 (= Client-only).
* main.go: ntpRepo + chronyReloader injiziert.
* render.go: chrony als sechste generator.
* postinst:
- chrony als hard Depends im control file.
- Conf-Datei /etc/chrony/conf.d/edgeguard.conf wird als
edgeguard:edgeguard 0644 angelegt.
- Sudoers für systemctl reload + restart chrony.
* Auto-FW-Rule-Generator: udp/123 wenn serve_clients=true und
listen_addresses non-loopback enthält.
* Frontend /ntp: PageHeader + Quellen-Tab + Settings-Tab. Listen-
Addresses als Multi-Select aus Kernel-IPs (analog DNS).
* Sidebar-Eintrag unter Network.
* i18n DE/EN für ntp.* Block.
chrony.service hat kein 'reload' — Renderer ruft RestartService auf.
Verified: 4 default-pool-server connected (chronyc sources zeigt
sie nach erstem render).
Version 1.0.40.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Debian
49
internal/chrony/chrony.cfg.tpl
Normal file
49
internal/chrony/chrony.cfg.tpl
Normal file
@@ -0,0 +1,49 @@
|
||||
# Generated by edgeguard — do not edit by hand.
|
||||
# Re-generate via `edgeguard-ctl render-config --only=chrony`.
|
||||
#
|
||||
# This file lives in /etc/chrony/conf.d/edgeguard.conf — chrony's
|
||||
# main /etc/chrony/chrony.conf includes the directory automatically
|
||||
# (Debian default).
|
||||
|
||||
# ── Upstream sources ───────────────────────────────────────────
|
||||
{{range .Pools}}
|
||||
{{- if .Active}}
|
||||
{{.Kind}} {{.Address}}{{if .Iburst}} iburst{{end}}{{if .Prefer}} prefer{{end}}{{if .MinPoll}} minpoll {{.MinPoll}}{{end}}{{if .MaxPoll}} maxpoll {{.MaxPoll}}{{end}}
|
||||
{{- end}}
|
||||
{{end}}
|
||||
|
||||
# ── Listen-Bind ────────────────────────────────────────────────
|
||||
# Wenn nichts ausser localhost gebound ist, lassen wir bindaddress
|
||||
# weg (chrony default = alle Interfaces). Sonst explizite bindaddress
|
||||
# pro IP. Mit serve_clients=false wird port 0 → kein Listen-Socket
|
||||
# (= reiner Client).
|
||||
{{if .Settings.ServeClients}}
|
||||
{{- range .ListenAddresses}}
|
||||
bindaddress {{.}}
|
||||
{{- end}}
|
||||
{{- range .AllowACLs}}
|
||||
allow {{.}}
|
||||
{{- end}}
|
||||
{{else}}
|
||||
port 0
|
||||
{{- end}}
|
||||
|
||||
# ── Step + Drift ───────────────────────────────────────────────
|
||||
# makestep N L: erlaubt einen step von >N Sekunden in den ersten L
|
||||
# updates (wichtig wenn der Clock weit weg ist; sonst nur slew).
|
||||
makestep {{.Settings.MakestepSecs}} {{.Settings.MakestepLimit}}
|
||||
|
||||
driftfile /var/lib/chrony/chrony.drift
|
||||
|
||||
{{- if .Settings.RTCSync}}
|
||||
# RTC mit System-Time syncen (für Reboot-Konsistenz).
|
||||
rtcsync
|
||||
{{- end}}
|
||||
{{- if .Settings.LeapsecTZ}}
|
||||
# Leap-Sekunden via tz-Datei (nicht slew).
|
||||
leapsectz {{.Settings.LeapsecTZ}}
|
||||
{{- end}}
|
||||
|
||||
# Logging
|
||||
logdir /var/log/chrony
|
||||
log measurements statistics tracking
|
||||
110
internal/chrony/chrony.go
Normal file
110
internal/chrony/chrony.go
Normal file
@@ -0,0 +1,110 @@
|
||||
// Package chrony renders /etc/chrony/conf.d/edgeguard.conf from
|
||||
// ntp_settings + ntp_pools and reloads chrony.service. Distro
|
||||
// /etc/chrony/chrony.conf includes conf.d/* automatically — wir
|
||||
// schreiben nur unseren drop-in.
|
||||
package chrony
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
_ "embed"
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
"text/template"
|
||||
|
||||
"github.com/jackc/pgx/v5/pgxpool"
|
||||
|
||||
"git.netcell-it.de/projekte/edgeguard-native/internal/configgen"
|
||||
"git.netcell-it.de/projekte/edgeguard-native/internal/models"
|
||||
ntpsvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/ntp"
|
||||
)
|
||||
|
||||
// ConfPath: distro chrony.conf includes /etc/chrony/conf.d/*.conf.
|
||||
// Wir schreiben direkt rein. postinst legt die Datei initial mit
|
||||
// chown edgeguard:edgeguard 0644 an damit der Renderer schreibt.
|
||||
const ConfPath = "/etc/chrony/conf.d/edgeguard.conf"
|
||||
|
||||
//go:embed chrony.cfg.tpl
|
||||
var cfgTpl string
|
||||
|
||||
var tpl = template.Must(template.New("chrony").Parse(cfgTpl))
|
||||
|
||||
type View struct {
|
||||
Settings *models.NTPSettings
|
||||
Pools []models.NTPPool
|
||||
ListenAddresses []string
|
||||
AllowACLs []string
|
||||
}
|
||||
|
||||
type Generator struct {
|
||||
Pool *pgxpool.Pool
|
||||
Repo *ntpsvc.Repo
|
||||
SkipReload bool
|
||||
}
|
||||
|
||||
func New(pool *pgxpool.Pool) *Generator {
|
||||
return &Generator{Pool: pool, Repo: ntpsvc.New(pool)}
|
||||
}
|
||||
|
||||
func (g *Generator) Name() string { return "chrony" }
|
||||
|
||||
func (g *Generator) Render(ctx context.Context) error {
|
||||
settings, err := g.Repo.GetSettings(ctx)
|
||||
if err != nil {
|
||||
return fmt.Errorf("settings: %w", err)
|
||||
}
|
||||
pools, err := g.Repo.ListPools(ctx)
|
||||
if err != nil {
|
||||
return fmt.Errorf("pools: %w", err)
|
||||
}
|
||||
view := View{
|
||||
Settings: settings,
|
||||
Pools: pools,
|
||||
ListenAddresses: filterNonLoopback(splitCSV(settings.ListenAddresses)),
|
||||
AllowACLs: splitCSV(settings.AllowACL),
|
||||
}
|
||||
|
||||
var body bytes.Buffer
|
||||
if err := tpl.Execute(&body, view); err != nil {
|
||||
return fmt.Errorf("template: %w", err)
|
||||
}
|
||||
// Direct write (kein tmp+rename) — analog unbound, weil
|
||||
// /etc/chrony/conf.d/ root-owned ist und edgeguard nur die eine
|
||||
// Datei überschreiben darf (postinst chown).
|
||||
if err := os.WriteFile(ConfPath, body.Bytes(), 0o644); err != nil {
|
||||
return fmt.Errorf("write %s: %w", ConfPath, err)
|
||||
}
|
||||
if g.SkipReload {
|
||||
return nil
|
||||
}
|
||||
// chrony.service kennt kein 'systemctl reload' — nur restart.
|
||||
// ~200ms ohne NTP-Antworten beim Save, dafür neue conf wirksam.
|
||||
return configgen.RestartService("chrony")
|
||||
}
|
||||
|
||||
func splitCSV(s string) []string {
|
||||
out := []string{}
|
||||
for _, part := range strings.Split(s, ",") {
|
||||
p := strings.TrimSpace(part)
|
||||
if p != "" {
|
||||
out = append(out, p)
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// filterNonLoopback wirft 127.x / ::1 raus — wenn NUR localhost im
|
||||
// listen_addresses ist, lassen wir den bindaddress-Block weg und
|
||||
// chrony bindet auf alle Interfaces (default), was für eine reine
|
||||
// Client-Konfiguration nicht stört.
|
||||
func filterNonLoopback(in []string) []string {
|
||||
out := []string{}
|
||||
for _, ip := range in {
|
||||
if ip == "::1" || ip == "localhost" || strings.HasPrefix(ip, "127.") {
|
||||
continue
|
||||
}
|
||||
out = append(out, ip)
|
||||
}
|
||||
return out
|
||||
}
|
||||
Reference in New Issue
Block a user