# 配置文件版本控制
cd /etc/cups
git init
git add .
git commit -m "Initial CUPS configuration"

# 每次修改前提交
git add cupsd.conf printers.conf
git commit -m "Add new printer: HP-M404"

# 配置备份脚本
#!/bin/bash
# /usr/local/bin/backup-cups-config

BACKUP_DIR="/backup/cups/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"

cp -a /etc/cups/* "$BACKUP_DIR/"
cp /var/log/cups/access_log "$BACKUP_DIR/"
cp /var/log/cups/error_log "$BACKUP_DIR/"
cp /var/log/cups/page_log "$BACKUP_DIR/"

echo "Backup completed: $BACKUP_DIR"

# CUPS 运维文档模板

## 1. 系统概述
- 服务器 IP: 
- CUPS 版本: 
- 打印机数量: 
- 用户规模: 

## 2. 打印机清单
| 打印机名称 | IP 地址 | 型号 | 位置 | 负责人 |
|-----------|---------|------|------|--------|
| HP-001 | 192.168.1.100 | HP M404 | 3楼 | 张三 |

## 3. 用户权限
| 用户/组 | 权限 | 可用打印机 |
|---------|------|-----------|
| @finance | 打印 | HP-001, HP-002 |
| @hr | 打印 | HP-003 |

## 4. 变更记录
| 日期 | 变更内容 | 操作人 | 审批人 |
|------|---------|--------|--------|
| 2026-05-10 | 添加 HP-001 | 李四 | 王五 |

## 5. 故障记录
| 日期 | 故障现象 | 原因 | 解决方案 |
|------|---------|------|---------|
| 2026-05-10 | 打印队列卡住 | 驱动问题 | 更换驱动 |

#!/bin/bash
# cups-health-check.sh - CUPS 健康检查脚本

# 配置
CUPS_HOST="localhost"
CUPS_PORT="631"
ALERT_EMAIL="admin@example.com"
QUEUE_THRESHOLD=20
ERROR_THRESHOLD=10

# 检查函数
check_service() {
    if ! systemctl is-active cups > /dev/null 2>&1; then
        echo "CRITICAL: CUPS service is down"
        return 1
    fi
    echo "OK: CUPS service is running"
    return 0
}

check_port() {
    if ! ss -tlnp | grep -q ":${CUPS_PORT}"; then
        echo "CRITICAL: Port ${CUPS_PORT} is not listening"
        return 1
    fi
    echo "OK: Port ${CUPS_PORT} is listening"
    return 0
}

check_web_interface() {
    response=$(curl -s -o /dev/null -w "%{http_code}" "http://${CUPS_HOST}:${CUPS_PORT}/" 2>/dev/null)
    if [ "$response" != "200" ] && [ "$response" != "401" ]; then
        echo "WARNING: Web interface returned HTTP $response"
        return 1
    fi
    echo "OK: Web interface is accessible"
    return 0
}

check_queue() {
    queue_count=$(lpstat -o 2>/dev/null | wc -l)
    if [ "$queue_count" -gt "$QUEUE_THRESHOLD" ]; then
        echo "WARNING: Print queue has $queue_count jobs (threshold: $QUEUE_THRESHOLD)"
        return 1
    fi
    echo "OK: Print queue has $queue_count jobs"
    return 0
}

check_errors() {
    if [ -f /var/log/cups/error_log ]; then
        recent_errors=$(tail -100 /var/log/cups/error_log | grep -ic "error")
        if [ "$recent_errors" -gt "$ERROR_THRESHOLD" ]; then
            echo "WARNING: $recent_errors errors in last 100 log entries"
            return 1
        fi
    fi
    echo "OK: Error rate is acceptable"
    return 0
}

check_disk() {
    usage=$(df /var/spool/cups 2>/dev/null | tail -1 | awk '{print $5}' | sed 's/%//')
    if [ "$usage" -gt 90 ]; then
        echo "CRITICAL: Spool disk usage at ${usage}%"
        return 1
    fi
    echo "OK: Spool disk usage at ${usage}%"
    return 0
}

# 执行检查
echo "=== CUPS Health Check - $(date) ==="
echo ""

errors=0

check_service || ((errors++))
check_port || ((errors++))
check_web_interface || ((errors++))
check_queue || ((errors++))
check_errors || ((errors++))
check_disk || ((errors++))

echo ""
if [ "$errors" -gt 0 ]; then
    echo "RESULT: $errors issue(s) detected"
    exit 1
else
    echo "RESULT: All checks passed"
    exit 0
fi

# prometheus.yml
scrape_configs:
  - job_name: 'cups'
    static_configs:
      - targets: ['cups-server:9102']
    metrics_path: /metrics
    scrape_interval: 30s

# cups-exporter.py (示例)
#!/usr/bin/env python3
"""CUPS Prometheus Exporter"""

from http.server import HTTPServer, BaseHTTPRequestHandler
import subprocess
import re

class MetricsHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path == '/metrics':
            metrics = self.collect_metrics()
            self.send_response(200)
            self.send_header('Content-Type', 'text/plain')
            self.end_headers()
            self.wfile.write(metrics.encode())
        else:
            self.send_response(404)
            self.end_headers()
    
    def collect_metrics(self):
        lines = []
        
        # 服务状态
        status = subprocess.run(['systemctl', 'is-active', 'cups'], 
                              capture_output=True, text=True)
        lines.append(f'cups_service_active {1 if status.stdout.strip() == "active" else 0}')
        
        # 队列长度
        queue = subprocess.run(['lpstat', '-o'], capture_output=True, text=True)
        queue_count = len(queue.stdout.strip().split('\n')) if queue.stdout.strip() else 0
        lines.append(f'cups_queue_length {queue_count}')
        
        # 打印机数量
        printers = subprocess.run(['lpstat', '-p'], capture_output=True, text=True)
        printer_count = len(printers.stdout.strip().split('\n')) if printers.stdout.strip() else 0
        lines.append(f'cups_printer_count {printer_count}')
        
        return '\n'.join(lines) + '\n'

if __name__ == '__main__':
    server = HTTPServer(('', 9102), MetricsHandler)
    print('CUPS Exporter running on port 9102')
    server.serve_forever()

#!/bin/bash
# cups-security-baseline.sh - CUPS 安全基线检查

echo "=== CUPS 安全基线检查 ==="
echo "检查时间: $(date)"
echo ""

PASS=0
FAIL=0
WARN=0

check() {
    local description="$1"
    local result="$2"
    
    if [ "$result" = "PASS" ]; then
        echo "✅ PASS: $description"
        ((PASS++))
    elif [ "$result" = "FAIL" ]; then
        echo "❌ FAIL: $description"
        ((FAIL++))
    else
        echo "⚠️  WARN: $description"
        ((WARN++))
    fi
}

# 1. 服务配置
echo "1. 服务配置"
echo "----------------------------------------"

# 检查 CUPS 版本
version=$(cups-config --version)
check "CUPS 版本 ($version)" "PASS"

# 检查监听地址
listen=$(grep "^Listen" /etc/cups/cupsd.conf | head -1)
if echo "$listen" | grep -q "0.0.0.0"; then
    check "监听所有接口" "WARN"
else
    check "监听地址限制" "PASS"
fi

echo ""

# 2. 认证配置
echo "2. 认证配置"
echo "----------------------------------------"

auth_type=$(grep "DefaultAuthType" /etc/cups/cupsd.conf | awk '{print $2}')
if [ "$auth_type" = "Basic" ]; then
    check "认证类型 (Basic - 应使用 Digest 或更强)" "WARN"
elif [ "$auth_type" = "Digest" ] || [ "$auth_type" = "Negotiate" ]; then
    check "认证类型 ($auth_type)" "PASS"
else
    check "认证类型 ($auth_type)" "FAIL"
fi

echo ""

# 3. TLS 配置
echo "3. TLS 配置"
echo "----------------------------------------"

if grep -q "ServerCertificate" /etc/cups/cupsd.conf; then
    check "TLS 证书配置" "PASS"
else
    check "TLS 证书配置" "FAIL"
fi

if grep -q "DefaultEncryption Required" /etc/cups/cupsd.conf; then
    check "强制加密" "PASS"
elif grep -q "DefaultEncryption" /etc/cups/cupsd.conf; then
    check "加密配置" "WARN"
else
    check "加密配置" "FAIL"
fi

echo ""

# 4. 访问控制
echo "4. 访问控制"
echo "----------------------------------------"

if grep -q "Require user @SYSTEM" /etc/cups/cupsd.conf; then
    check "管理界面认证" "PASS"
else
    check "管理界面认证" "FAIL"
fi

echo ""

# 5. 文件权限
echo "5. 文件权限"
echo "----------------------------------------"

cupsd_conf_perm=$(stat -c %a /etc/cups/cupsd.conf 2>/dev/null)
if [ "$cupsd_conf_perm" = "640" ] || [ "$cupsd_conf_perm" = "600" ]; then
    check "cupsd.conf 权限 ($cupsd_conf_perm)" "PASS"
else
    check "cupsd.conf 权限 ($cupsd_conf_perm)" "FAIL"
fi

echo ""

# 6. 日志配置
echo "6. 日志配置"
echo "----------------------------------------"

log_level=$(grep "LogLevel" /etc/cups/cupsd.conf | awk '{print $2}')
if [ "$log_level" = "info" ] || [ "$log_level" = "debug" ]; then
    check "日志级别 ($log_level)" "PASS"
else
    check "日志级别 ($log_level)" "WARN"
fi

echo ""

# 汇总
echo "========================================"
echo "检查结果: PASS=$PASS, FAIL=$FAIL, WARN=$WARN"
if [ "$FAIL" -gt 0 ]; then
    echo "❌ 存在安全问题需要修复"
    exit 1
elif [ "$WARN" -gt 0 ]; then
    echo "⚠️  存在潜在安全风险"
    exit 0
else
    echo "✅ 安全基线检查通过"
    exit 0
fi

#!/bin/bash
# cups-hardening.sh - CUPS 安全加固脚本

echo "=== CUPS 安全加固 ==="

# 备份当前配置
BACKUP_DIR="/backup/cups/hardening_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"
cp -a /etc/cups/* "$BACKUP_DIR/"

# 1. 配置强认证
echo "1. 配置强认证..."
sed -i 's/DefaultAuthType Basic/DefaultAuthType Digest/' /etc/cups/cupsd.conf

# 2. 限制监听地址
echo "2. 限制监听地址..."
sed -i 's/Listen 0.0.0.0:631/Listen localhost:631/' /etc/cups/cupsd.conf

# 3. 启用访问日志
echo "3. 启用访问日志..."
if ! grep -q "AccessLog" /etc/cups/cupsd.conf; then
    echo "AccessLog /var/log/cups/access_log" >> /etc/cups/cupsd.conf
fi

# 4. 限制管理访问
echo "4. 限制管理访问..."
cat >> /etc/cups/cupsd.conf << 'EOF'

# 安全加固 - 管理界面限制
<Location /admin>
  AuthType Digest
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
</Location>
EOF

# 5. 修复文件权限
echo "5. 修复文件权限..."
chmod 640 /etc/cups/cupsd.conf
chmod 640 /etc/cups/cups-files.conf
chown -R root:lp /etc/cups/

# 6. 重启服务
echo "6. 重启 CUPS 服务..."
systemctl restart cups

echo "=== 安全加固完成 ==="
echo "备份位置: $BACKUP_DIR"

# 1. VLAN 隔离
# 将打印机放在独立的 VLAN 中

# 2. 防火墙规则
# 只允许必要的端口和协议
sudo iptables -A INPUT -p tcp --dport 631 -s 192.168.1.0/24 -j ACCEPT  # IPP
sudo iptables -A INPUT -p tcp --dport 9100 -s 192.168.1.0/24 -j ACCEPT # Socket
sudo iptables -A INPUT -p udp --dport 5353 -s 192.168.1.0/24 -j ACCEPT # mDNS
sudo iptables -A INPUT -p tcp --dport 631 -j DROP

# 3. QoS 策略
# 为打印流量设置优先级
sudo tc qdisc add dev eth0 root handle 1: prio
sudo tc filter add dev eth0 protocol ip parent 1: prio 1 u32 \
  match ip dport 631 0xffff flowid 1:1

# 4. DNS 配置
# 为打印机配置 DNS 记录
# printer1.example.com -> 192.168.1.100
# printer2.example.com -> 192.168.1.101

# 使用 CUPS 打印机组实现负载均衡

# 创建打印机组
sudo lpadmin -p Pool-Printer -c Printer1 -c Printer2 -c Printer3

# 或使用 cups-browsed 自动负载均衡
# /etc/cups/cups-browsed.conf
LoadBalancing on

# 配置故障转移
# 使用 beh 后端
sudo lpadmin -p HA-Printer -E \
  -v "beh:/3/5/ipp/ipp://primary-server/printers/printer" \
  -m "everywhere"

#!/bin/bash
# cups-backup.sh - CUPS 完整备份脚本

BACKUP_ROOT="/backup/cups"
DATE=$(date +%Y%m%d_%H%M%S)
BACKUP_DIR="$BACKUP_ROOT/$DATE"
RETENTION_DAYS=30

# 创建备份目录
mkdir -p "$BACKUP_DIR"

# 1. 备份配置文件
echo "备份配置文件..."
cp -a /etc/cups/ "$BACKUP_DIR/config/"

# 2. 备份 PPD 文件
echo "备份 PPD 文件..."
cp -a /etc/cups/ppd/ "$BACKUP_DIR/ppd/"

# 3. 备份打印队列
echo "备份打印队列..."
cp -a /var/spool/cups/ "$BACKUP_DIR/spool/" 2>/dev/null

# 4. 备份日志
echo "备份日志..."
cp /var/log/cups/access_log "$BACKUP_DIR/" 2>/dev/null
cp /var/log/cups/error_log "$BACKUP_DIR/" 2>/dev/null
cp /var/log/cups/page_log "$BACKUP_DIR/" 2>/dev/null

# 5. 导出打印机配置
echo "导出打印机配置..."
lpstat -p -l > "$BACKUP_DIR/printer_status.txt"
lpstat -d > "$BACKUP_DIR/default_printer.txt"
lpstat -v > "$BACKUP_DIR/printer_uris.txt"

# 6. 压缩备份
echo "压缩备份..."
tar -czf "$BACKUP_ROOT/cups_backup_$DATE.tar.gz" -C "$BACKUP_ROOT" "$DATE"
rm -rf "$BACKUP_DIR"

# 7. 清理旧备份
echo "清理旧备份..."
find "$BACKUP_ROOT" -name "cups_backup_*.tar.gz" -mtime +$RETENTION_DAYS -delete

echo "备份完成: $BACKUP_ROOT/cups_backup_$DATE.tar.gz"

#!/bin/bash
# cups-restore.sh - CUPS 恢复脚本

BACKUP_FILE="$1"
RESTORE_DIR="/tmp/cups_restore"

if [ -z "$BACKUP_FILE" ]; then
    echo "用法: $0 <backup_file.tar.gz>"
    exit 1
fi

if [ ! -f "$BACKUP_FILE" ]; then
    echo "错误: 备份文件不存在: $BACKUP_FILE"
    exit 1
fi

echo "=== CUPS 恢复 ==="
echo "备份文件: $BACKUP_FILE"

# 停止 CUPS 服务
echo "停止 CUPS 服务..."
systemctl stop cups

# 解压备份
echo "解压备份..."
mkdir -p "$RESTORE_DIR"
tar -xzf "$BACKUP_FILE" -C "$RESTORE_DIR"

# 恢复配置
echo "恢复配置..."
RESTORE_CONFIG="$RESTORE_DIR/*/config"
if [ -d "$RESTORE_CONFIG" ]; then
    cp -a "$RESTORE_CONFIG/"* /etc/cups/
fi

# 恢复 PPD
echo "恢复 PPD..."
RESTORE_PPD="$RESTORE_DIR/*/ppd"
if [ -d "$RESTORE_PPD" ]; then
    cp -a "$RESTORE_PPD/"* /etc/cups/ppd/
fi

# 恢复队列
echo "恢复打印队列..."
RESTORE_SPOOL="$RESTORE_DIR/*/spool"
if [ -d "$RESTORE_SPOOL" ]; then
    cp -a "$RESTORE_SPOOL/"* /var/spool/cups/
fi

# 修复权限
echo "修复权限..."
chown -R root:lp /etc/cups/
chmod 640 /etc/cups/cupsd.conf
chmod 755 /etc/cups/ppd/

# 启动 CUPS 服务
echo "启动 CUPS 服务..."
systemctl start cups

# 清理
rm -rf "$RESTORE_DIR"

echo "=== 恢复完成 ==="

# ansible/cups-playbook.yml
---
- name: CUPS Server Setup
  hosts: cups_servers
  become: yes
  vars:
    cups_admin: admin
    cups_password: "{{ vault_cups_password }}"
    cups_share_printers: yes
    cups_encryption: ifRequested
    
  tasks:
    - name: Install CUPS packages
      apt:
        name:
          - cups
          - cups-client
          - cups-bsd
          - cups-filters
          - printer-driver-gutenprint
          - hplip
        state: present
        update_cache: yes
      
    - name: Configure CUPS
      template:
        src: templates/cupsd.conf.j2
        dest: /etc/cups/cupsd.conf
        owner: root
        group: lp
        mode: '0640'
      notify: restart cups
      
    - name: Enable CUPS service
      systemd:
        name: cups
        enabled: yes
        state: started
        
    - name: Configure firewall
      ufw:
        rule: allow
        port: '631'
        proto: tcp
        src: '{{ item }}'
      loop:
        - 192.168.1.0/24
        - 10.0.0.0/8
        
    - name: Add printers
      command: >
        lpadmin -p {{ item.name }} -E
        -v {{ item.uri }}
        -m {{ item.model | default('everywhere') }}
        -D "{{ item.description }}"
        -L "{{ item.location }}"
      loop: '{{ printers }}'
      when: printers is defined
      
  handlers:
    - name: restart cups
      systemd:
        name: cups
        state: restarted

# terraform/cups-server.tf

resource "docker_container" "cups" {
  name  = "cups-server"
  image = "cups-server:latest"
  
  ports {
    internal = 631
    external = 631
  }
  
  volumes {
    container_path = "/etc/cups"
    host_path      = "/data/cups/config"
  }
  
  volumes {
    container_path = "/var/log/cups"
    host_path      = "/data/cups/logs"
  }
  
  env = [
    "CUPS_ADMIN=admin",
    "CUPS_PASSWORD=${var.cups_password}",
    "TZ=Asia/Shanghai"
  ]
  
  restart = "unless-stopped"
  
  healthcheck {
    test         = ["CMD", "curl", "-f", "http://localhost:631/"]
    interval     = "30s"
    timeout      = "5s"
    retries      = 3
    start_period = "10s"
  }
}

# .gitlab-ci.yml
stages:
  - test
  - build
  - deploy

test-cups-config:
  stage: test
  script:
    - cupsd -t
    - cups-check-security.sh

build-cups-image:
  stage: build
  script:
    - docker build -t cups-server:$CI_COMMIT_SHA .
    - docker push cups-server:$CI_COMMIT_SHA
  only:
    - main

deploy-cups:
  stage: deploy
  script:
    - docker-compose pull
    - docker-compose up -d
  only:
    - main
  environment:
    name: production

# 计算所需磁盘空间
# 配置文件: ~10MB
# PPD 文件: ~500MB (取决于驱动)
# 打印队列: 平均每个任务 10MB
# 日志文件: 每天 ~100MB (高负载)

# 示例计算:
# 200 用户，平均每人每天 10 个打印任务
# 每天打印队列: 200 × 10 × 10MB = 20GB
# 保留 7 天: 20GB × 7 = 140GB
# 加上配置和日志: 140GB + 1GB = 141GB

# 建议: 至少 200GB 磁盘空间

# 水平扩展 - 添加更多 CUPS 服务器
# 1. 部署新的 CUPS 服务器
# 2. 配置 cups-browsed 同步
# 3. 配置负载均衡器

# 垂直扩展 - 升级现有服务器
# 1. 增加 CPU/内存
# 2. 使用 SSD 存储
# 3. 优化网络配置

# CUPS 灾难恢复计划

## 1. 恢复目标
- RTO (恢复时间目标): 4 小时
- RPO (恢复点目标): 24 小时

## 2. 备份策略
- 每日增量备份
- 每周完整备份
- 异地备份 (每 24 小时)

## 3. 恢复步骤

### 场景 A: 服务器硬件故障
1. 启动备用服务器
2. 从备份恢复配置
3. 配置网络
4. 启动 CUPS 服务
5. 验证打印机连接
6. 通知用户

### 场景 B: 配置损坏
1. 停止 CUPS 服务
2. 从备份恢复配置
3. 验证配置语法
4. 启动 CUPS 服务
5. 测试打印功能

### 场景 C: 数据丢失
1. 停止 CUPS 服务
2. 恢复打印队列
3. 恢复日志文件
4. 启动 CUPS 服务
5. 验证数据完整性

## 4. 联系信息
- 系统管理员: admin@example.com
- 硬件供应商: vendor@example.com
- 网络管理员: network@example.com

# 主备 CUPS 服务器配置

# 主服务器配置
# /etc/cups/cupsd.conf
ServerName cups-primary.example.com
Listen 0.0.0.0:631
DefaultShared Yes

# 备用服务器配置
# /etc/cups/cups-browsed.conf
BrowsePoll cups-primary.example.com:631
BrowseRemoteProtocols cups

# 自动故障转移脚本
#!/bin/bash
# cups-failover.sh

PRIMARY_SERVER="cups-primary.example.com"
BACKUP_SERVER="cups-backup.example.com"

# 检查主服务器状态
if ! curl -sf "http://$PRIMARY_SERVER:631/" > /dev/null; then
    echo "主服务器不可用，切换到备用服务器"
    
    # 更新 DNS 记录
    # 或更新负载均衡器配置
    
    # 通知管理员
    echo "CUPS 主服务器故障，已切换到备用服务器" | \
      mail -s "CUPS Failover Alert" admin@example.com
fi

# 需求：1000+ 用户，20+ 打印机，高可用

# 架构设计
# - 2 台 CUPS 主服务器（Active-Active）
# - 1 台数据库服务器（配置同步）
# - 2 台负载均衡器（HAProxy）
# - 多台打印服务器（区域部署）

# 配置要点
# 1. LDAP/AD 集成认证
# 2. TLS 加密所有通信
# 3. 打印配额管理
# 4. 集中日志收集
# 5. 自动化监控告警

# 需求：50-200 用户，5-10 打印机

# 架构设计
# - 1 台 CUPS 服务器
# - 1 台备份服务器（可选）
# - 本地打印机 + 网络打印机

# 配置要点
# 1. 简单的用户认证
# 2. 基本的访问控制
# 3. 定期备份
# 4. 简单监控

# 需求：支持远程员工打印到公司打印机

# 方案 1: VPN + CUPS
# - 员工通过 VPN 连接公司网络
# - 通过 VPN 访问 CUPS 服务器
# - 安全性高，但需要 VPN 基础设施

# 方案 2: 云打印服务
# - 使用云打印解决方案
# - 无需 VPN，但需要第三方服务

# 方案 3: 远程桌面打印
# - 通过远程桌面会话打印
# - 打印任务在服务器端处理