Switch ntpd to systemd-timesyncd

[Donald Buczek (donald)]

Use systemd-timesyncd on all systems but wtf, because it uses less resources and generally does the right thing even in case the RTC is broken. Fall back to external ntp services if time.molgen.mpg.de is not available.

On wtf, continue to run ntpd for time.molgen.mpg.de. Make it more robust and simplify configuration. Maintain /var/lib/systemd/timesync/clock for a timestamp to be used after boot if the RTC is broken.

Update on running systems after make install:

systemctl daemon-reload
systemctl disable --now ntp.service
rm /etc/systemd/system/ntp.service
rm /etc/ntp.conf
rm /etc/ntp.time.conf
rm /usr/lib/ntpd-switch
systemctl enable --now systemd-timesyncd ntpd-time ntp-clock-stamp

[Paul Menzel (pmenzel)]

@dose:~$ systemctl status systemd-timesyncd
● systemd-timesyncd.service - Network Time Synchronization
     Loaded: loaded (/usr/lib/systemd/system/systemd-timesyncd.service; enabled; preset: enabled)
    Drop-In: /etc/systemd/system/systemd-timesyncd.service.d
             └─not-on-wtf.conf
     Active: active (running) since Sat 2026-10-03 21:12:19 CEST; 2h 59min ago
 Invocation: 0df89f0d57b04a02a3292e5070baed59
       Docs: man:systemd-timesyncd.service(8)
   Main PID: 263 (systemd-timesyn)
     Status: "Contacted time server 89.163.176.12:123 (0.de.pool.ntp.org)."
      Tasks: 2 (limit: 4915)
     Memory: 1.9M (peak: 2.5M)
        CPU: 154ms
     CGroup: /system.slice/systemd-timesyncd.service
             └─263 /usr/lib/systemd/systemd-timesyncd

Warning: some journal files were not opened due to insufficient permissions.
@dose:~$ systemctl cat systemd-timesyncd
# /usr/lib/systemd/system/systemd-timesyncd.service
#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Network Time Synchronization
Documentation=man:systemd-timesyncd.service(8)
ConditionCapability=CAP_SYS_TIME
ConditionVirtualization=!container
DefaultDependencies=no
After=systemd-sysusers.service
Before=time-set.target sysinit.target shutdown.target
Conflicts=shutdown.target
Wants=time-set.target

[Service]
AmbientCapabilities=CAP_SYS_TIME
BusName=org.freedesktop.timesync1
CapabilityBoundingSet=CAP_SYS_TIME
# Turn off DNSSEC validation for hostname look-ups, since those need the
# correct time to work, but we likely won't acquire that without NTP. Let's
# break this chicken-and-egg cycle here.
Environment=SYSTEMD_NSS_RESOLVE_VALIDATE=0
ExecStart=/usr/lib/systemd/systemd-timesyncd
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=disconnected
ProtectProc=invisible
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectSystem=strict
Restart=always
RestartSec=0
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
RuntimeDirectory=systemd/timesync
StateDirectory=systemd/timesync
SystemCallArchitectures=native
SystemCallErrorNumber=EPERM
SystemCallFilter=@system-service @clock
Type=notify
User=systemd-timesync
WatchdogSec=3min

[Install]
WantedBy=sysinit.target
Alias=dbus-org.freedesktop.timesync1.service

# /etc/systemd/system/systemd-timesyncd.service.d/not-on-wtf.conf
# Don't start systemd-timesyncd on wtf, because on this host we start
# ntpd-time.service which regulates the kernel real time clock.

[Unit]

ConditionHost=!wtf.molgen.mpg.de

Overrides, at least for me, are easy to miss, when I just look into /etc/systemd/system/, so systemctl cat … is good to get used to.

[Donald Buczek (donald)]

Note, that the kernel writes its clock to the hardware clock every 11 minutes if the kernel clock is synchronized (flag set by ntpd or systemd-timesyncd) and CONFIG_RTC_SYSTOHC is set (true on Mariux64).