From bcf3c620230c19e4eab8013d64108b99bc55a261 Mon Sep 17 00:00:00 2001
From: Juliusz Tarnowski <juliusz.tarnowski@nosun.pl>
Date: Thu, 9 Jul 2026 10:38:33 +0200
Subject: [PATCH] Install chronyd as BlueOS tool

---
 core/Dockerfile                       |  2 +
 core/start-blueos-core                |  1 +
 core/tools/chrony/bootstrap.sh        | 62 +++++++++++++++++++++++++++
 core/tools/chrony/chrony.conf         | 32 ++++++++++++++
 core/tools/install-static-binaries.sh |  1 +
 core/tools/install-system-tools.sh    |  1 +
 6 files changed, 99 insertions(+)
 create mode 100755 core/tools/chrony/bootstrap.sh
 create mode 100644 core/tools/chrony/chrony.conf

diff --git a/core/Dockerfile b/core/Dockerfile
index 717b411919..f6d3d2bf1e 100644
--- a/core/Dockerfile
+++ b/core/Dockerfile
@@ -124,6 +124,8 @@ COPY --from=download-binaries \
     /usr/bin/blueos_startup_update.py \
     /usr/bin/blueos-recorder \
     /usr/bin/bridges \
+    /usr/bin/chronyc \
+    /usr/bin/chronyd \
     /usr/bin/disktest \
     /usr/bin/linux2rest \
     /usr/bin/machineid-cli \
diff --git a/core/start-blueos-core b/core/start-blueos-core
index 5f9b3d7338..543c1d03bb 100755
--- a/core/start-blueos-core
+++ b/core/start-blueos-core
@@ -130,6 +130,7 @@ SERVICES=(
     'beacon',250,0,0,0,"$SERVICES_PATH/beacon/main.py"
     'bridget',0,0,0,0,"nice -19 $RUN_AS_REGULAR_USER_BEGIN $SERVICES_PATH/bridget/main.py $RUN_AS_REGULAR_USER_END"
     'commander',250,0,0,0,"$SERVICES_PATH/commander/main.py"
+    'chronyd',0,0,0,0,"chronyd -d -f $TOOLS_PATH/chrony/chrony.conf"
     'nmea_injector',250,0,0,0,"nice -19 $SERVICES_PATH/nmea_injector/main.py"
     'helper',250,0,0,0,"$BLUEOS_PYTHON_BIN_SECONDARY $SERVICES_PATH/helper/main.py"
     'iperf3',250,0,0,0," iperf3 --server --port 5201"
diff --git a/core/tools/chrony/bootstrap.sh b/core/tools/chrony/bootstrap.sh
new file mode 100755
index 0000000000..b1dee564b9
--- /dev/null
+++ b/core/tools/chrony/bootstrap.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+set -e
+
+VERSION="4.8"
+SHA256="33ea8eb2a4daeaa506e8fcafd5d6d89027ed6f2f0609645c6f149b560d301706"
+PROJECT_NAME="chrony"
+SOURCE_URL="https://chrony-project.org/releases/$PROJECT_NAME-$VERSION.tar.gz"
+
+echo "Installing project $PROJECT_NAME version $VERSION"
+
+if [ -z "$RUNNING_IN_CI" ]; then
+    mkdir -p /run/chrony
+    echo "Finished configuring $PROJECT_NAME"
+    exit 0
+fi
+
+if [ -n "$VIRTUAL_ENV" ]; then
+    BIN_DIR="$VIRTUAL_ENV/bin"
+else
+    BIN_DIR="/usr/bin"
+fi
+mkdir -p "$BIN_DIR"
+
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+ARCHIVE="$TMP_DIR/$PROJECT_NAME-$VERSION.tar.gz"
+wget -q "$SOURCE_URL" -O "$ARCHIVE"
+printf "%s  %s\n" "$SHA256" "$ARCHIVE" | sha256sum -c -
+
+tar -xzf "$ARCHIVE" -C "$TMP_DIR"
+cd "$TMP_DIR/$PROJECT_NAME-$VERSION"
+
+LDFLAGS="${LDFLAGS:-} -static" ./configure \
+    --prefix=/usr \
+    --bindir=/usr/bin \
+    --sbindir=/usr/bin \
+    --sysconfdir=/etc \
+    --localstatedir=/var \
+    --chronyrundir=/run/chrony \
+    --chronyvardir=/usr/blueos/userdata/chrony \
+    --disable-nts \
+    --disable-privdrop \
+    --disable-readline \
+    --disable-sechash \
+    --with-chronyc-user=root \
+    --with-user=root \
+    --without-libcap \
+    --without-seccomp
+
+make -j"$(nproc)" chronyd chronyc
+strip chronyd chronyc
+install -m 0755 chronyd "$BIN_DIR/chronyd"
+install -m 0755 chronyc "$BIN_DIR/chronyc"
+
+if command -v file >/dev/null 2>&1; then
+    echo "Installed binary type: $(file "$BIN_DIR/chronyd")"
+    echo "Installed binary type: $(file "$BIN_DIR/chronyc")"
+fi
+
+echo "Finished installing $PROJECT_NAME"
diff --git a/core/tools/chrony/chrony.conf b/core/tools/chrony/chrony.conf
new file mode 100644
index 0000000000..d6da676e50
--- /dev/null
+++ b/core/tools/chrony/chrony.conf
@@ -0,0 +1,32 @@
+# BlueOS chrony configuration.
+#
+# chronyd is started by start-blueos-core and disciplines the shared system clock
+# (the container shares the host's clock). Other services can inspect and extend
+# this at runtime via chronyc.
+
+# Default upstream sources, used whenever the vehicle can reach them (topside /
+# internet). `iburst` speeds up the initial sync. Services can add more sources
+# at runtime.
+pool pool.ntp.org iburst
+
+# Serve NTP to devices on the vehicle network. Restrict to typical BlueOS subnets.
+# TODO(chrony): drive these from settings / detected interfaces.
+allow 192.168.2.0/24
+allow 192.168.0.0/16
+allow 10.0.0.0/8
+
+# Even with no upstream source, act as a stratum-10 server so vehicle-network
+# clients can still synchronize to a single, consistent on-board clock.
+local stratum 10
+
+# Record the rate at which the system clock gains/loses time to speed up sync
+# after a restart.
+driftfile /usr/blueos/userdata/chrony/chrony.drift
+
+# Step the clock (instead of slewing) only during the first few updates after
+# start-up, when the offset is larger than 1 second. Afterwards, only slew, to
+# avoid time jumps while the system is running.
+makestep 1.0 3
+
+# Save/restore clock from the RTC if one is present (no-op otherwise).
+rtcsync
diff --git a/core/tools/install-static-binaries.sh b/core/tools/install-static-binaries.sh
index 4593c1f096..5f8ef0f107 100755
--- a/core/tools/install-static-binaries.sh
+++ b/core/tools/install-static-binaries.sh
@@ -8,6 +8,7 @@ set -e
 TOOLS=(
     blueos_startup_update
     bridges
+    chrony
     disktest
     linux2rest
     machineid
diff --git a/core/tools/install-system-tools.sh b/core/tools/install-system-tools.sh
index 11f78db583..6cb01c64f5 100755
--- a/core/tools/install-system-tools.sh
+++ b/core/tools/install-system-tools.sh
@@ -6,6 +6,7 @@ set -e
 
 TOOLS=(
     ardupilot_tools
+    chrony
     filebrowser
     logviewer
     scripts