Chrony: Difference between revisions
IFreilicht (talk | contribs) Add instructions to configure chrony as an NTP server |
|||
| Line 1: | Line 1: | ||
Chrony is an NTP and NTS client and server implementation. This means it can synchronize the time of your local machine, as well as provide services to clients on the attached network segments. | Chrony is an NTP and NTS client and server implementation. This means it can synchronize the time of your local machine, as well as provide services to clients on the attached network segments. | ||
== NTP == | == NTP == | ||
This protocol is slowly being phased out due it security concerns, using a more secure method like NTS is recommended. To enable NTP, enable the chrony service and add whichever NTP servers you wish to use | This protocol is slowly being phased out due it security concerns, using a more secure method like NTS is recommended. To enable NTP, enable the chrony service and add whichever NTP servers you wish to use. If you don't set a serverlist here, the value of <code>networking.timeServers</code> will be used. | ||
<syntaxhighlight lang="nix"> | <syntaxhighlight lang="nix"> | ||
| Line 32: | Line 32: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
You can verify that NTS is being used via observing the output of <code>sudo chronyc -N authdata</code> and reading the value under mode, it should read NTS. | You can verify that NTS is being used via observing the output of <code>sudo chronyc -N authdata</code> and reading the value under mode, it should read NTS. | ||
This will not work with the default timeservers of NixOS, as they do not support NTS! | |||
=== Troubleshooting === | === Troubleshooting === | ||
| Line 66: | Line 68: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
== Hosting an NTP server == | |||
The simplest config to make chrony act as an NTP server is this configuration:<syntaxhighlight lang="nix"> | |||
{ ... }: | |||
{ | |||
services.chrony = { | |||
enable = true; | |||
extraConfig = '' | |||
allow | |||
''; | |||
}; | |||
networking.firewall.allowedUDPPorts = [ 123 ]; | |||
} | |||
</syntaxhighlight>This allows any external client to request time via NTP. You can also limit the allowed clients to certain subnets like so:<syntaxhighlight lang="nix"> | |||
{ ... }: | |||
{ | |||
services.chrony = { | |||
enable = true; | |||
extraConfig = '' | |||
allow 10.100.0.0/24 | |||
allow 192.168.178.0/24 | |||
''; | |||
}; | |||
networking.firewall.allowedUDPPorts = [ 123 ]; | |||
} | |||
</syntaxhighlight> | |||
=== NTS while hosting === | |||
If you want to enable NTS, you need to also add <code>networking.firewall.allowedTCPPorts = [ 4460 ];</code> as this port is used for the NTS key-exchange before the encrypted connection via port 123. | |||
Currently (as of NixOS 24.05), <code>enableNTS</code> is an all-or-nothing setting; it will require all servers to support NTS as well as all clients. If you need more granularity, use <code>extraConfig</code>and refer to [https://chrony-project.org/documentation.html the chrony documentation]. | |||
[[Category:Applications]] | [[Category:Applications]] | ||
[[Category:Server]] | [[Category:Server]] | ||