newHEADmain

2 files changed, 53 insertions, 0 deletions

diff --git a/deploy/gps-clock-dash.service b/deploy/gps-clock-dash.service
new file mode 100644
index 0000000..0159595
--- /dev/null
+++ b/deploy/gps-clock-dash.service
@@ -0,0 +1,38 @@
+[Unit]
+Description=GPS + PPS chrony time server dashboard
+After=network.target chrony.service gpsd.socket
+Wants=gpsd.socket
+
+[Service]
+ExecStart=/usr/local/bin/gps-clock-dash -listen :8473
+# Once nginx fronts this, bind to loopback only:
+# ExecStart=/usr/local/bin/gps-clock-dash -listen 127.0.0.1:8473
+Restart=on-failure
+RestartSec=5
+
+# Unprivileged, sandboxed. chronyc's monitoring commands (tracking, sources,
+# sourcestats) work over chronyd's localhost UDP port without privileges.
+DynamicUser=yes
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+
+# Optional: to show the "NTP requests" (serverstats) row, chronyc needs
+# chronyd's privileged socket in /run/chrony, which is owned by _chrony.
+# Uncomment both lines below. Note this lets the process issue any chronyc
+# command, including ones that change chronyd's behaviour.
+#DynamicUser=no
+#User=_chrony
+
+[Install]
+WantedBy=multi-user.target
diff --git a/deploy/nginx-location.conf b/deploy/nginx-location.conf
new file mode 100644
index 0000000..b198d4e
--- /dev/null
+++ b/deploy/nginx-location.conf
@@ -0,0 +1,15 @@
+# Example: serve the dashboard at https://<host>/clock/
+# The page uses relative URLs, so any sub-path works.
+location /clock/ {
+    proxy_pass http://yttrium.mfamily.org:8473/;   # or 127.0.0.1:8473 if nginx runs on yttrium
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # Server-Sent Events: no buffering, long-lived connection
+    proxy_set_header Connection "";
+    proxy_buffering off;
+    proxy_cache off;
+    proxy_read_timeout 1h;
+}