Fix time drift for private operator

Author: caroline-ttd

scripts/aws/config-server/app.py

@@ -1,4 +1,5 @@
 from flask import Flask
+from datetime import datetime, timezone
 import json
 import os
 
@@ -14,5 +15,12 @@ def get_config():
     except Exception as e:
         return str(e), 500
 
+@app.route('/getCurrentTime', methods=['GET'])
+def get_time():
+    try:
+        return datetime.now(timezone.utc).isoformat(timespec="seconds")
+    except Exception as e:
+        return str(e), 500
+
 if __name__ == '__main__':
     app.run(processes=8)

scripts/aws/entrypoint.sh

@@ -22,6 +22,33 @@ ifconfig lo 127.0.0.1
 echo "Starting vsock proxy..."
 /app/vsockpx --config /app/proxies.nitro.yaml --daemon --workers $(( ( $(nproc) + 3 ) / 4 )) --log-level 3
 
+TIME_SYNC_URL="http://127.0.0.1:27015/getCurrentTime"
+TIME_SYNC_INTERVAL_SECONDS="${TIME_SYNC_INTERVAL_SECONDS:-300}"
+
+sync_enclave_time() {
+  local current_time
+  if current_time=$(curl -s -f -x socks5h://127.0.0.1:3305 "${TIME_SYNC_URL}"); then
+    if ! date -u -s "${current_time}"; then
+      echo "Time sync: failed to set enclave time from '${current_time}'"
+      return 1
+    fi
+    echo "Time sync: updated enclave time to ${current_time}"
+  else
+    echo "Time sync: failed to fetch time from parent instance"
+    return 1
+  fi
+}
+
+start_time_sync_loop() {
+  while true; do
+    sync_enclave_time || true
+    sleep "${TIME_SYNC_INTERVAL_SECONDS}"
+  done
+}
+
+sync_enclave_time || true
+start_time_sync_loop &
+
 build_parameterized_config() {
   curl -s -f -o "${PARAMETERIZED_CONFIG}" -x socks5h://127.0.0.1:3305 http://127.0.0.1:27015/getConfig
   REQUIRED_KEYS=("optout_base_url" "core_base_url" "core_api_token" "optout_api_token" "environment" "uid_instance_id_prefix")

scripts/aws/uid2-operator-ami/ansible/playbook.yml

@@ -19,6 +19,44 @@
       name: nmap-ncat
       state: latest
 
+  - name: Install chrony for time sync
+    ansible.builtin.dnf:
+      name: chrony
+      state: latest
+
+  - name: Comment out default chrony pool servers
+    ansible.builtin.replace:
+      path: /etc/chrony.conf
+      regexp: '^pool\s+'
+      replace: '# pool '
+
+  - name: Configure AWS Time Sync Service in chrony
+    ansible.builtin.lineinfile:
+      path: /etc/chrony.conf
+      line: 'server 169.254.169.123 prefer iburst'
+      state: present
+      insertafter: EOF
+
+  - name: Enable RTC sync in chrony
+    ansible.builtin.lineinfile:
+      path: /etc/chrony.conf
+      line: 'rtcsync'
+      state: present
+      insertafter: EOF
+
+  - name: Allow chrony to step clock at startup
+    ansible.builtin.lineinfile:
+      path: /etc/chrony.conf
+      line: 'makestep 1.0 3'
+      state: present
+      insertafter: EOF
+
+  - name: Ensure chronyd is enabled at boot
+    ansible.builtin.systemd:
+      name: chronyd
+      state: started
+      enabled: true
+
   - name: Install python
     ansible.builtin.dnf:
       name: