{pkgs, ...}: {
  # CUPS Druckdienst für PDF-Druck aus n8n
  # Drucker: Kyocera TASKalfa 4054ci @ 192.168.152.137
  # Druckernetz (192.168.152.0/24) wird via NetBird geroutet – ensure-printers
  # muss warten bis NetBird verbunden ist und die Route aktiv ist.
  systemd.services.ensure-printers = {
    after = ["netbird.service"];
    requires = ["netbird.service"];
    serviceConfig.ExecStartPre = [
      "${pkgs.bash}/bin/bash -c 'for i in $(seq 1 60); do ${pkgs.iproute2}/bin/ip route get 192.168.152.137 2>/dev/null | grep -q wt0 && exit 0; sleep 1; done; echo \"NetBird route to printer not available after 60s\" >&2; exit 1'"
    ];
  };

  services.printing = {
    enable = true;
    drivers = with pkgs; [
      cups-filters # driverless IPP Everywhere Support
    ];
  };

  # Avahi für mDNS/IPP-Druckererkennung
  services.avahi = {
    enable = true;
    nssmdns4 = true;
    openFirewall = true;
  };

  # Kyocera TASKalfa 4054ci deklarativ einrichten
  hardware.printers = {
    ensurePrinters = [
      {
        name = "JW2OG";
        location = "Buero";
        description = "Kyocera TASKalfa 4054ci";
        deviceUri = "ipps://192.168.152.137:443/ipp/print";
        model = "everywhere";
        ppdOptions = {
          PageSize = "A4";
        };
      }
    ];
    ensureDefaultPrinter = "JW2OG";
  };
}