# SPDX-License-Identifier: MPL-2.0
# Minimal network-shared CUPS for the outpost. Serves wired + Wi-Fi clients
# (Wi-Fi clients reach this wired Pi via your router). Tighten to taste.
#
# EDIT the @LOCAL / address rules to match your LAN if you want to be stricter.

LogLevel warn
MaxLogSize 0
PageLogFormat

# Listen on the network, not just localhost.
Listen *:631
Listen /run/cups/cups.sock

# Advertise printers over mDNS (works with Avahi -> AirPrint, Bonjour).
Browsing On
BrowseLocalProtocols dnssd
DefaultShared Yes

DefaultAuthType Basic
WebInterface Yes

<Location />
  Order allow,deny
  Allow @LOCAL
</Location>

<Location /admin>
  # Admin tasks: require auth, LAN only.
  Order allow,deny
  Allow @LOCAL
</Location>

<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
  Allow @LOCAL
</Location>

<Policy default>
  JobPrivateAccess default
  JobPrivateValues default
  SubscriptionPrivateAccess default
  SubscriptionPrivateValues default

  <Limit Create-Job Print-Job Print-URI Validate-Job>
    Order deny,allow
  </Limit>

  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>

  <Limit All>
    Order deny,allow
  </Limit>
</Policy>