The challenge
What the system needed to solve
Enable remote printing while keeping CUPS, native printer administration, and the printer itself off the public internet.
The build
Engineering decisions
Built a small upload gateway that validates jobs and submits them to the printer with driverless IPP/PWG Raster.
Deployed three anti-affined replicas sharing a replicated ReadWriteMany queue.
Protected the only public route with two-factor authentication and constrained egress to the reserved printer endpoint.
Added queue depth, job age, printer reachability, application health, and storage alerts with a recovery runbook.
Architecture
How the pieces connect
- 1Authenticated remote user
- 2Upload and validation gateway
- 3Replicated print queue
- 4Driverless IPP submission
- 5Home printer
Results
What changed
- Remote users can submit ordinary documents without learning printer-network details.
- A pod or node failure does not lose an accepted print job.
- The public surface is the purpose-built gateway, not a general printer administration console.
