User-configurable NTP servers (timesyncd) — setting with precedence over DHCP

[stupleb]

Problem

Which NTP servers a StartOS box uses is decided by exactly two things the user cannot reach:

1. the image default — debian/postinst rewrites Debian's fallback list to FallbackNTP=0.pool.ntp.org … 3.pool.ntp.org;
2. DHCP option 42 from the router — collected per gateway in net/gateway.rs and reconciled into the NTP= line of /etc/systemd/timesyncd.conf (with a systemd-timesyncd restart on change).

There is no RPC, no start-cli command, and no UI field. Worse, the reconciler enforces the DHCP view: whenever the DHCP-derived set differs from the file's current NTP= line, it rewrites the line — so even an SSH-savvy user who sets NTP= by hand is silently reverted on the next reconcile. The only durable escape is a /etc/systemd/timesyncd.conf.d/ drop-in, which is an undocumented accident of implementation (the reconciler happens to touch only the main file).

Motivating case (0.4.0-beta.9 field report): a network where the regional pool.ntp.org zone hands out dead/filtered servers, so timesyncd never completes an exchange and the Clock sync failure warning is permanent — while Google/Cloudflare NTP work fine from the same network. The user has no supported way to point StartOS at servers that work. Related robustness fix for the warning's error handling: #3520.

Proposed design

A user-configurable ntpServers list in the server database, exposed as a server-settings RPC (which makes it a start-cli command for free), consumed by the existing reconciler with precedence, not union:

1. user-configured servers set → write exactly those to NTP=;
2. otherwise DHCP-provided servers → today's behavior;
3. otherwise leave the line empty and the image FallbackNTP pool applies.

Precedence matters because a user escaping broken DHCP-advertised servers must be able to exclude them, not merely outrank them.

Scope beyond the backend, for discussion:

• UI: a System settings field is what actually serves GUI-only users (the motivating reporter is behind a locked ISP router and would never find a CLI); it roughly doubles the work (Angular + web i18n ×5 locales) and could ship as a follow-up.
• Docs: the FAQ's Clock Sync Failure section should point at the setting once it exists (interim docs teaching the drop-in workaround are being handled separately).

Alternative considered

A reconciler-only fix — StartOS writes its own drop-in for DHCP-derived servers and stops touching the main file, making manual configuration durable and supported. Cheaper, but leaves GUI-only users with no recourse, so it treats the symptom (the revert footgun) rather than the gap (no setting).

🤖 Generated with Claude Code