🛠️ Server Setup Guide

Introduction

The following instructions can be used to set up a public NTP/NTS server running chrony on a Raspberry Pi, with automatic SSL certificate renewals from Let’s Encrypt Certificate Authority.

Please note the following important points:

• These instructions were developed for a Raspberry Pi 5 running Raspberry Pi OS Trixie.
• These instructions can easily be adapted to a Raspberry Pi 4. The only difference is the serial device on a Pi 5 is /dev/ttyAMA0 while on a Pi 4 it is /dev/ttyS0. Therefore if you are setting this up on a Pi 4, replace all instances of ttyAMA0 with ttyS0. Everything else remains the same.
• In our setup, we use a Waveshare NEO-M8T timing HAT (Part No.: NEO-M8T GNSS TIMING HAT), which can be purchased on the Waveshare website. This circuit board conveniently attaches to the GPIO pins and receives power from the Pi.
• We configured the NEO-M8T module as follows:
  • Accept Galileo satellite navigation system signal only, but you may chose whichever GNSS that you prefer, within the limitations of the module.
  • Surveyed-in the module so that it enters the timing mode for maximum timing accuracy.
  • Set the baud rate at 9600. The serial configurations below take this into consideration so if your device’s baud rate is different, then you will need to adjust accordingly.
  • Set NMEA to version 4.10.
  • Note: Configuring the NEO-M8T module is complex and is outside the scope of this tutorial. We suggest that you consult the user manual for this module.
• It is expected that you have SSH access or terminal access and are proficient enough to execute commands and edit text files (e.g., using nano).

1. Configure the Firewall

Configure your firewall to allow ports 80, 123, and 4460 and forward them to the Raspberry Pi.

• Port 80 (TCP): Required for automated SSL certificate renewal.
• Port 123 (UDP): Required for NTP.
• Port 4460 (TCP): Required for NTS key exchange.

2. Prepare Serial Port

Start raspi-config:

1. Select option "Interface Options".
2. Select option "Serial Port".
3. At "Would you like a login shell to be accessible over serial?" Answer "No".
4. At "Would you like the serial port hardware to be enabled?" Answer "Yes".
5. Exit raspi-config and reboot the Pi.

3. Install Required Packages

4. Setup PPS

Edit /boot/firmware/cmdline.txt:

At the end of the line, add the following:

5. Setup Serial

Create the script file:

Add the following content to the script:

Make the script executable:

Create a systemd service to run this script:

Add the following configuration:

Enable and start the service:

6. Set up Modules & Overlays

Edit modules configuration:

Add at the bottom:

Edit /boot/firmware/config.txt:

Add the following at the bottom:

7. Setup gpsd

Edit gpsd defaults:

Change file to match the following:

8. Setup Chrony

Edit daemon options:

Change to:

Edit chrony configuration:

Apply the following changes (comment out default pools and default DHCP sources):

Enable services:

Reboot now:

9. Setup Network Time Security (NTS)

Obtain an SSL Certificate (replace time.yourdomain.com with your domain):

Copy certificates for chrony (replace time.yourdomain.com with your domain):

Create a renewal hook script:

Add script content:

Make executable:

Final reboot:

Maintenance & Troubleshooting

Test NTS from another machine (replace time.yourdomain.com with your domain):

Display serial settings:

Display serial output:

Test PPS:

Display GPS data:

Check service status:

Let's Encrypt management: