personal-computer: vendor ipp-usb module with fixed avahi options

nixpkgs' services/printing/ipp-usb.nix still sets the obsolete
services.avahi.publish.{enable,userServices}, warning on every machine
that enables ipp-usb. Disable the upstream module and carry a copy that
uses services.avahi.settings.publish; only that block differs.

modules/clan/personal-computer/ipp-usb.nix

@@ -0,0 +1,83 @@
+# Vendored copy of nixpkgs nixos/modules/services/printing/ipp-usb.nix.
+# Upstream still sets the obsolete `services.avahi.publish.*` options, which
+# emit evaluation warnings on every machine using this service. Only the
+# `services.avahi` block differs. Drop once upstream migrates to
+# `services.avahi.settings.publish`.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  disabledModules = [ "services/printing/ipp-usb.nix" ];
+
+  options = {
+    services.ipp-usb = {
+      enable = lib.mkEnableOption "ipp-usb, a daemon to turn an USB printer/scanner supporting IPP everywhere (aka AirPrint, WSD, AirScan) into a locally accessible network printer/scanner";
+    };
+  };
+  config = lib.mkIf config.services.ipp-usb.enable {
+    systemd.services.ipp-usb = {
+      description = "Daemon for IPP over USB printer support";
+      after = [
+        "cups.service"
+        "avahi-daemon.service"
+      ];
+      wants = [ "avahi-daemon.service" ];
+      serviceConfig = {
+        ExecStart = [ "${pkgs.ipp-usb}/bin/ipp-usb" ];
+        Type = "simple";
+        Restart = "on-failure";
+        StateDirectory = "ipp-usb";
+        LogsDirectory = "ipp-usb";
+
+        # hardening.
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectControlGroups = true;
+        MemoryDenyWriteExecute = true;
+        # breaks the daemon, presumably because it messes with DeviceAllow
+        ProtectClock = false;
+        ProtectKernelTunables = true;
+        ProtectKernelLogs = true;
+        ProtectSystem = "strict";
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        PrivateMounts = true;
+        ProtectHostname = true;
+        ProtectKernelModules = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_NETLINK"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        ProtectProc = "noaccess";
+      };
+    };
+
+    # starts the systemd service
+    services.udev.packages = [ pkgs.ipp-usb ];
+    services.avahi = {
+      enable = true;
+      settings.publish = {
+        disable-publishing = false;
+        disable-user-service-publishing = false;
+        publish-addresses = true;
+      };
+    };
+    # enable printing and scanning by default, but not required.
+    services.printing.enable = lib.mkDefault true;
+    hardware.sane.enable = lib.mkDefault true;
+    # so that sane discovers scanners
+    hardware.sane.extraBackends = [ pkgs.sane-airscan ];
+  };
+}