From 4ab66536b650e608039c0c3a205da897cb8bd2c5 Mon Sep 17 00:00:00 2001
From: Jason McCormick <jason@mfamily.org>
Date: Fri, 6 Nov 2026 19:10:44 -0500
Subject: new

---
 deploy/gps-clock-dash.service | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 deploy/gps-clock-dash.service

(limited to 'deploy/gps-clock-dash.service')

diff --git a/deploy/gps-clock-dash.service b/deploy/gps-clock-dash.service
new file mode 100644
index 0000000..0159595
--- /dev/null
+++ b/deploy/gps-clock-dash.service
@@ -0,0 +1,38 @@
+[Unit]
+Description=GPS + PPS chrony time server dashboard
+After=network.target chrony.service gpsd.socket
+Wants=gpsd.socket
+
+[Service]
+ExecStart=/usr/local/bin/gps-clock-dash -listen :8473
+# Once nginx fronts this, bind to loopback only:
+# ExecStart=/usr/local/bin/gps-clock-dash -listen 127.0.0.1:8473
+Restart=on-failure
+RestartSec=5
+
+# Unprivileged, sandboxed. chronyc's monitoring commands (tracking, sources,
+# sourcestats) work over chronyd's localhost UDP port without privileges.
+DynamicUser=yes
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
+RestrictNamespaces=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+
+# Optional: to show the "NTP requests" (serverstats) row, chronyc needs
+# chronyd's privileged socket in /run/chrony, which is owned by _chrony.
+# Uncomment both lines below. Note this lets the process issue any chronyc
+# command, including ones that change chronyd's behaviour.
+#DynamicUser=no
+#User=_chrony
+
+[Install]
+WantedBy=multi-user.target
-- 
cgit v1.2.3