diff options
Diffstat (limited to 'deploy')
| -rw-r--r-- | deploy/gps-clock-dash.service | 38 | ||||
| -rw-r--r-- | deploy/nginx-location.conf | 15 |
2 files changed, 53 insertions, 0 deletions
diff --git a/deploy/gps-clock-dash.service b/deploy/gps-clock-dash.service new file mode 100644 index 0000000..0159595 --- /dev/null +++ b/deploy/gps-clock-dash.service @@ -0,0 +1,38 @@ +[Unit] +Description=GPS + PPS chrony time server dashboard +After=network.target chrony.service gpsd.socket +Wants=gpsd.socket + +[Service] +ExecStart=/usr/local/bin/gps-clock-dash -listen :8473 +# Once nginx fronts this, bind to loopback only: +# ExecStart=/usr/local/bin/gps-clock-dash -listen 127.0.0.1:8473 +Restart=on-failure +RestartSec=5 + +# Unprivileged, sandboxed. chronyc's monitoring commands (tracking, sources, +# sourcestats) work over chronyd's localhost UDP port without privileges. +DynamicUser=yes +NoNewPrivileges=yes +ProtectSystem=strict +ProtectHome=yes +PrivateTmp=yes +PrivateDevices=yes +ProtectKernelTunables=yes +ProtectKernelModules=yes +ProtectControlGroups=yes +RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX +RestrictNamespaces=yes +LockPersonality=yes +MemoryDenyWriteExecute=yes +SystemCallArchitectures=native + +# Optional: to show the "NTP requests" (serverstats) row, chronyc needs +# chronyd's privileged socket in /run/chrony, which is owned by _chrony. +# Uncomment both lines below. Note this lets the process issue any chronyc +# command, including ones that change chronyd's behaviour. +#DynamicUser=no +#User=_chrony + +[Install] +WantedBy=multi-user.target diff --git a/deploy/nginx-location.conf b/deploy/nginx-location.conf new file mode 100644 index 0000000..b198d4e --- /dev/null +++ b/deploy/nginx-location.conf @@ -0,0 +1,15 @@ +# Example: serve the dashboard at https://<host>/clock/ +# The page uses relative URLs, so any sub-path works. +location /clock/ { + proxy_pass http://yttrium.mfamily.org:8473/; # or 127.0.0.1:8473 if nginx runs on yttrium + proxy_http_version 1.1; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + # Server-Sent Events: no buffering, long-lived connection + proxy_set_header Connection ""; + proxy_buffering off; + proxy_cache off; + proxy_read_timeout 1h; +} |