{pkgs, ...}: let
  # Wait-Script für Erreichbarkeit des Druckers (IPPS-Port 443).
  # Funktioniert sowohl im Office (direkte Route) als auch unterwegs via NetBird.
  wait-for-printer = pkgs.writeShellScriptBin "wait-for-printer" ''
    PRINTER_HOST="192.168.152.137"
    PRINTER_PORT="443"
    MAX_ATTEMPTS="120"
    NC="${pkgs.netcat}/bin/nc"

    for i in $(${pkgs.coreutils}/bin/seq 1 $MAX_ATTEMPTS); do
      if $NC -z -w 1 "$PRINTER_HOST" "$PRINTER_PORT"; then
        exit 0
      fi
      ${pkgs.coreutils}/bin/sleep 1
    done

    echo "Printer $PRINTER_HOST:$PRINTER_PORT not reachable after ''${MAX_ATTEMPTS}s" >&2
    exit 1
  '';
in {
  # CUPS Druckdienst für PDF-Druck aus n8n
  # Drucker: Kyocera TASKalfa 4054ci @ 192.168.152.137
  # Erreichbar im Office direkt oder unterwegs via NetBird-Tunnel.
  # Das Wait-Script prüft IPPS-Port 443 – unabhängig vom Interface.

  systemd.services.ensure-printers = {
    wantedBy = ["multi-user.target"];
    wants = ["netbird.service" "network-online.target"];
    after = ["netbird.service" "network-online.target"];

    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      ExecStartPre = ["${wait-for-printer}/bin/wait-for-printer"];
      Restart = "on-failure";
      RestartSec = "30s";
    };
  };

  services.printing = {
    enable = true;
    drivers = with pkgs; [
      cups-filters # driverless IPP Everywhere Support
    ];
  };

  # Avahi für mDNS/IPP-Druckererkennung
  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
  };

  # Kyocera TASKalfa 4054ci deklarativ einrichten
  hardware.printers = {
    ensurePrinters = [
      {
        name = "JW2OG";
        location = "Buero";
        description = "Kyocera TASKalfa 4054ci";
        deviceUri = "ipps://192.168.152.137:443/ipp/print";
        model = "everywhere";
        ppdOptions = {
          PageSize = "A4";
        };
      }
    ];
    ensureDefaultPrinter = "JW2OG";
  };
}