36 lines
1.1 KiB
SYSTEMD
36 lines
1.1 KiB
SYSTEMD
|
[Unit]
|
||
|
|
Description=gps-ntp status dashboard
|
||
|
|
Documentation=https://git.supported.systems/time-pi
|
||
|
|
After=network-online.target gpsd.service chrony.service
|
||
|
|
Wants=network-online.target
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
Type=exec
|
||
|
|
User=gpsntp
|
||
|
|
Group=gpsntp
|
||
|
|
ExecStart=/opt/gpsntp-dashboard/.venv/bin/gpsntp-dashboard
|
||
|
|
Environment=GPSNTP_PORT=8080
|
||
|
|
Environment=GPSNTP_HOST=0.0.0.0
|
||
|
|
Restart=on-failure
|
||
|
|
RestartSec=3
|
||
|
|
|
||
|
|
# Keep the dashboard OFF cpu0. The PPS interrupt is handled on cpu0 and cannot
|
||
|
|
# be moved (Pi 4 GPIO IRQs are demuxed through pinctrl-bcm2835 and refuse an
|
||
|
|
# smp_affinity), so any load there directly adds jitter to the timestamp.
|
||
|
|
# Measured: the dashboard cost ~36% more PPS jitter before this. It is a
|
||
|
|
# monitoring tool; it must never perturb the clock it is watching.
|
||
|
|
CPUAffinity=1
|
||
|
|
Nice=10
|
||
|
|
|
||
|
|
# Hardening. NoNewPrivileges is intentionally NOT set: the served-clients
|
||
|
|
# panel shells `sudo -n chronyc -c clients`, allowed by a narrow sudoers rule.
|
||
|
|
PrivateTmp=true
|
||
|
|
ProtectHome=true
|
||
|
|
ProtectControlGroups=true
|
||
|
|
ProtectKernelTunables=true
|
||
|
|
RestrictSUIDSGID=false
|
||
|
|
LockPersonality=true
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=multi-user.target
|