# Least-privilege: the dashboard user may run ONLY this one read-only command.
# `chronyc -c clients` is privileged (returns "501 Not authorised" otherwise),
# and this is the served-client list the dashboard displays. Nothing else.
gpsntp ALL=(root) NOPASSWD: /usr/bin/chronyc -c clients