Updates and base packages#

Why#

Before installing anything project-specific, two things need to happen: upgrade the system, and remove packages that would conflict with the real-time and NTP setup we’re aiming for. A competing NTP daemon running in the background, for instance, will silently fight chrony over disciplining the clock, a bug that’s very hard to diagnose without checking that only one time synchronization service is active.

How#

Full upgrade#

apt update && apt full-upgrade -y
apt autoremove --purge -y

Removing conflicting packages#

# Competing NTP daemon: strictly forbidden
apt purge -y ntpsec ntp openntpd systemd-timesyncd 2>/dev/null

# IRQ redistribution daemon: incompatible with the static affinity
# we'll set up later (IRQ affinity chapter)
apt purge -y irqbalance

# Leftover graphical components (Lite shouldn't have any, purge as a safety net)
apt purge -y xserver-* lightdm 2>/dev/null
apt autoremove --purge -y

Required packages#

apt install -y \
    pps-tools setserial ethtool \
    gpsd gpsd-clients \
    chrony \
    linuxptp \
    nginx \
    fail2ban nftables \
    auditd \
    unattended-upgrades apt-listchanges \
    bc curl jq

Pitfalls to avoid#

Only one time synchronization daemon at a time. ntp, ntpsec, openntpd and systemd-timesyncd are all alternatives to chrony, keeping one active alongside chrony doesn’t double precision, it introduces a silent competition to discipline the same system clock, with unpredictable results.

  • irqbalance active alongside manual IRQ affinity. irqbalance dynamically redistributes interrupts across cores to balance load, exactly the opposite of what we want here (permanently isolating the PPS IRQ on a dedicated core, see the IRQ affinity chapter). The two mechanisms will keep fighting each other if irqbalance stays installed.
  • A chrony version too old for NTS. NTS (RFC 8915) requires chrony ≥ 4.0. Not an issue on recent Debian releases, but the version must be checked when starting from an older image.

Verify#

# No other time daemon active
systemctl list-units --type=service | grep -iE 'ntp|timesync'
# Should list ONLY chrony (not yet configured at this stage, that's fine)

# Chrony version (must be >= 4.0 for NTS)
chronyd -v

# irqbalance properly absent
dpkg -l irqbalance 2>&1 | grep -q "no packages found" && echo "OK: irqbalance absent"

📚 Going further

chrony (R. Curnow, then M. Lichvar, maintained since 1997) is the recommended NTP implementation on modern Linux, for several project-documented reasons: faster convergence than ntpd under off-nominal conditions, a notably smaller codebase (~30,000 lines vs ~120,000 for ntpd, hence more auditable), and native NTS support since version 4.0 (2020). Full details in the Chrony chapter.