cuckoo-escapement/dashboard/deploy/gpsntp-dashboard.sudoers

# Least-privilege: the dashboard user may run ONLY this one read-only command.
# `chronyc -c clients` is privileged (returns "501 Not authorised" otherwise),
# and this is the served-client list the dashboard displays. Nothing else.
gpsntp ALL=(root) NOPASSWD: /usr/bin/chronyc -c clients
The Cuckoo Escapement: field report, kernel patch, dashboard What the Raspberry Pi time-server guides get wrong on a Pi 4, with the measurements. The headline artifact is a four-line pps-gpio patch: PREEMPT_RT force-threads IRQ handlers, and pps-gpio takes its timestamp inside its handler, so the realtime kernel puts a scheduler between the electrical edge and the clock. IRQF_NO_THREAD takes RMS offset from 2468 ns to 199 ns. - kernel/ the patch - dashboard/ live status page (position hidden by default) - docs-site/ the write-up (Astro/Starlight, brass, no tutorial section) 2026-07-14 09:21:25 -06:00			`# Least-privilege: the dashboard user may run ONLY this one read-only command.`
			# `chronyc -c clients` is privileged (returns "501 Not authorised" otherwise),
			`# and this is the served-client list the dashboard displays. Nothing else.`
			`gpsntp ALL=(root) NOPASSWD: /usr/bin/chronyc -c clients`