fix ensure-printers service

hosts/AZ-LT-NIX/services/printing.nix

@@ -1,15 +1,40 @@
-{pkgs, ...}: {
+{pkgs, ...}: let
+  # Wait-Script für Erreichbarkeit des Druckers (IPPS-Port 443).
+  # Funktioniert sowohl im Office (direkte Route) als auch unterwegs via NetBird.
+  wait-for-printer = pkgs.writeShellScriptBin "wait-for-printer" ''
+    PRINTER_HOST="192.168.152.137"
+    PRINTER_PORT="443"
+    MAX_ATTEMPTS="120"
+    NC="${pkgs.netcat}/bin/nc"
+
+    for i in $(${pkgs.coreutils}/bin/seq 1 $MAX_ATTEMPTS); do
+      if $NC -z -w 1 "$PRINTER_HOST" "$PRINTER_PORT"; then
+        exit 0
+      fi
+      ${pkgs.coreutils}/bin/sleep 1
+    done
+
+    echo "Printer $PRINTER_HOST:$PRINTER_PORT not reachable after ''${MAX_ATTEMPTS}s" >&2
+    exit 1
+  '';
+in {
   # CUPS Druckdienst für PDF-Druck aus n8n
   # Drucker: Kyocera TASKalfa 4054ci @ 192.168.152.137
-  # Druckernetz (192.168.152.0/24) wird via NetBird geroutet – ensure-printers
-  # muss warten bis NetBird verbunden ist und die Route aktiv ist.
+  # Erreichbar im Office direkt oder unterwegs via NetBird-Tunnel.
+  # Das Wait-Script prüft IPPS-Port 443 – unabhängig vom Interface.
 
   systemd.services.ensure-printers = {
-    after = ["netbird.service"];
-    requires = ["netbird.service"];
-    serviceConfig.ExecStartPre = [
-      "${pkgs.bash}/bin/bash -c 'for i in $(seq 1 60); do ${pkgs.iproute2}/bin/ip route get 192.168.152.137 2>/dev/null | grep -q wt0 && exit 0; sleep 1; done; echo \"NetBird route to printer not available after 60s\" >&2; exit 1'"
-    ];
+    wantedBy = ["multi-user.target"];
+    wants = ["netbird.service" "network-online.target"];
+    after = ["netbird.service" "network-online.target"];
+
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStartPre = ["${wait-for-printer}/bin/wait-for-printer"];
+      Restart = "on-failure";
+      RestartSec = "30s";
+    };
   };
 
   services.printing = {