On the flip side of this, any reasonably sized environment should be running their own ntp pool for their servers to use. Being down one stratum is usually not that big of a deal for most environments.

The warning section is a good call-out, because it’s one of the services where there’s a good chance your ISP won’t like it.

My opnsense router is configured to send itself as the local NTP server via DHCP and devices are configured to use it for NTP. I don’t have any time critical services like Kerberos auth though. That can give you a starting point for running NTP.

important to note:

This is a long‐term commitment. You can remove yourself from the pool whenever you like, but due to misbehaving NTP clients and misguided configurers resolving a singular pool IP once and hardcoding it in a fleet of devices, it can take months, years, or forever for the traffic to stop. (I e‐mailed Dave Plonka about the 2003 Netgear–University of Wisconsin incident recently, and apparently they still see a bit of traffic from these routers.) For a long time after removing yourself from the NTP Pool, you will continue to get hammered on UDP 123 for years.

Anybody experience with running a ntp server on a VPS while being bridged to other networks (e.g. via Tailscale)?

Do you run ntp outside of your bridge to prevent an error in ntp giving someone access to your other networks?