kurogeek
a48f1c75c5
nixpkgs' services/printing/ipp-usb.nix still sets the obsolete
services.avahi.publish.{enable,userServices}, warning on every machine
that enables ipp-usb. Disable the upstream module and carry a copy that
uses services.avahi.settings.publish; only that block differs.
84 lines
2.6 KiB
Nix
84 lines
2.6 KiB
Nix
# Vendored copy of nixpkgs nixos/modules/services/printing/ipp-usb.nix.
|
|
# Upstream still sets the obsolete `services.avahi.publish.*` options, which
|
|
# emit evaluation warnings on every machine using this service. Only the
|
|
# `services.avahi` block differs. Drop once upstream migrates to
|
|
# `services.avahi.settings.publish`.
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
disabledModules = [ "services/printing/ipp-usb.nix" ];
|
|
|
|
options = {
|
|
services.ipp-usb = {
|
|
enable = lib.mkEnableOption "ipp-usb, a daemon to turn an USB printer/scanner supporting IPP everywhere (aka AirPrint, WSD, AirScan) into a locally accessible network printer/scanner";
|
|
};
|
|
};
|
|
config = lib.mkIf config.services.ipp-usb.enable {
|
|
systemd.services.ipp-usb = {
|
|
description = "Daemon for IPP over USB printer support";
|
|
after = [
|
|
"cups.service"
|
|
"avahi-daemon.service"
|
|
];
|
|
wants = [ "avahi-daemon.service" ];
|
|
serviceConfig = {
|
|
ExecStart = [ "${pkgs.ipp-usb}/bin/ipp-usb" ];
|
|
Type = "simple";
|
|
Restart = "on-failure";
|
|
StateDirectory = "ipp-usb";
|
|
LogsDirectory = "ipp-usb";
|
|
|
|
# hardening.
|
|
ProtectHome = true;
|
|
PrivateTmp = true;
|
|
PrivateUsers = true;
|
|
ProtectControlGroups = true;
|
|
MemoryDenyWriteExecute = true;
|
|
# breaks the daemon, presumably because it messes with DeviceAllow
|
|
ProtectClock = false;
|
|
ProtectKernelTunables = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectSystem = "strict";
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
SystemCallArchitectures = "native";
|
|
PrivateMounts = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelModules = true;
|
|
RemoveIPC = true;
|
|
RestrictNamespaces = true;
|
|
AmbientCapabilities = "";
|
|
CapabilityBoundingSet = "";
|
|
NoNewPrivileges = true;
|
|
RestrictAddressFamilies = [
|
|
"AF_UNIX"
|
|
"AF_NETLINK"
|
|
"AF_INET"
|
|
"AF_INET6"
|
|
];
|
|
ProtectProc = "noaccess";
|
|
};
|
|
};
|
|
|
|
# starts the systemd service
|
|
services.udev.packages = [ pkgs.ipp-usb ];
|
|
services.avahi = {
|
|
enable = true;
|
|
settings.publish = {
|
|
disable-publishing = false;
|
|
disable-user-service-publishing = false;
|
|
publish-addresses = true;
|
|
};
|
|
};
|
|
# enable printing and scanning by default, but not required.
|
|
services.printing.enable = lib.mkDefault true;
|
|
hardware.sane.enable = lib.mkDefault true;
|
|
# so that sane discovers scanners
|
|
hardware.sane.extraBackends = [ pkgs.sane-airscan ];
|
|
};
|
|
}
|