diff --git a/modules/clan/personal-computer/ipp-usb.nix b/modules/clan/personal-computer/ipp-usb.nix deleted file mode 100644 index f785c57f..00000000 --- a/modules/clan/personal-computer/ipp-usb.nix +++ /dev/null @@ -1,83 +0,0 @@ -# Vendored copy of nixpkgs nixos/modules/services/printing/ipp-usb.nix. -# Upstream still sets the obsolete `services.avahi.publish.*` options, which -# emit evaluation warnings on every machine using this service. Only the -# `services.avahi` block differs. Drop once upstream migrates to -# `services.avahi.settings.publish`. -{ - config, - lib, - pkgs, - ... -}: -{ - disabledModules = [ "services/printing/ipp-usb.nix" ]; - - options = { - services.ipp-usb = { - enable = lib.mkEnableOption "ipp-usb, a daemon to turn an USB printer/scanner supporting IPP everywhere (aka AirPrint, WSD, AirScan) into a locally accessible network printer/scanner"; - }; - }; - config = lib.mkIf config.services.ipp-usb.enable { - systemd.services.ipp-usb = { - description = "Daemon for IPP over USB printer support"; - after = [ - "cups.service" - "avahi-daemon.service" - ]; - wants = [ "avahi-daemon.service" ]; - serviceConfig = { - ExecStart = [ "${pkgs.ipp-usb}/bin/ipp-usb" ]; - Type = "simple"; - Restart = "on-failure"; - StateDirectory = "ipp-usb"; - LogsDirectory = "ipp-usb"; - - # hardening. - ProtectHome = true; - PrivateTmp = true; - PrivateUsers = true; - ProtectControlGroups = true; - MemoryDenyWriteExecute = true; - # breaks the daemon, presumably because it messes with DeviceAllow - ProtectClock = false; - ProtectKernelTunables = true; - ProtectKernelLogs = true; - ProtectSystem = "strict"; - RestrictRealtime = true; - RestrictSUIDSGID = true; - SystemCallArchitectures = "native"; - PrivateMounts = true; - ProtectHostname = true; - ProtectKernelModules = true; - RemoveIPC = true; - RestrictNamespaces = true; - AmbientCapabilities = ""; - CapabilityBoundingSet = ""; - NoNewPrivileges = true; - RestrictAddressFamilies = [ - "AF_UNIX" - "AF_NETLINK" - "AF_INET" - "AF_INET6" - ]; - ProtectProc = "noaccess"; - }; - }; - - # starts the systemd service - services.udev.packages = [ pkgs.ipp-usb ]; - services.avahi = { - enable = true; - settings.publish = { - disable-publishing = false; - disable-user-service-publishing = false; - publish-addresses = true; - }; - }; - # enable printing and scanning by default, but not required. - services.printing.enable = lib.mkDefault true; - hardware.sane.enable = lib.mkDefault true; - # so that sane discovers scanners - hardware.sane.extraBackends = [ pkgs.sane-airscan ]; - }; -}