Hi, I’m trying to write an init script to call BusyBox ntpd to set the clock as early as possible in the boot process, related to the much-discussed chicken-and-egg issue with Wireguard interfaces not coming up when the clock is set sufficiently far off from the true time.
The command line for this if run manually would look something like
ntpd -n -q -N -p ntp.example.com -p ntp.domain.com -p ntp.time.com
I note when examining /etc/init.d/sysntpd that it makes use of procd to do things like run ntpd in a jail, set the user and group to ntp, and so forth.
I’d like to do this in my own script, but I don’t need any process monitoring or respawn features as I will strictly be running ntpd as a one-shot.
Does anyone know of an example of a one-shot service managed by procd, or is this a bad idea?
Alternatively: I’ve seen it suggested to use a hotplug script to only bring any Wireguard interface up after an ntpd stratum change event. I am open to being persuaded that this is a better approach.
Either way, I don’t know how to allow traffic to/from ntpd across the WAN interface while disallowing all other traffic (to prevent leaks while Wireguard is not up). I’ve seen it suggested to set up a static route to the IP addresses (/32) of some NTP servers, but I’d much rather allow traffic from ntpd in a manner which doesn’t depend on the IP address of the peers. If anybody has any pointers on how to do this, I’d love to hear it.