mirror of
https://github.com/iiab/iiab.git
synced 2025-02-12 11:12:06 +00:00
http://box/print finally works despite CUPS bug, via sneaky redirect
This commit is contained in:
root
parent
77f93e2fa3
commit
13f01d0590
5 changed files with 120 additions and 84 deletions
|
|
@ -7,26 +7,20 @@
|
|||
name: cups
|
||||
state: present
|
||||
|
||||
# 2021-07-12: LET'S STICK CLOSER TO THE DEFAULT /etc/cups/cupsd.conf SO WE CAN
|
||||
# SKIP MOST OF THE NEXT ~120 LINES, THX TO NEW NGINX (cups/templates/cups.conf)
|
||||
# WARNING: 'apt install cups' AND 'apt install --reinstall cups'
|
||||
# UNFORTUNATELY DO *NOT* RECREATE /etc/cups/cupsd.conf IF A PRIOR
|
||||
# INSTALL OF CUPS EXISTED! SO OPTION #1 OR #2 ARE NEEDED BELOW:
|
||||
|
||||
# # WARNING: 'apt install cups' AND 'apt install --reinstall cups'
|
||||
# # UNFORTUNATELY DO *NOT* RECREATE /etc/cups/cupsd.conf IF A PRIOR
|
||||
# # INSTALL OF CUPS EXISTED! SO OPTION #1 OR #2 ARE NEEDED BELOW:
|
||||
# OPTION #1: OLD WAY (BRITTLE)
|
||||
#
|
||||
# - name: Install our own /etc/cups/cupsd.conf from template, to permit local LAN admin
|
||||
# template:
|
||||
# src: cupsd.conf.j2
|
||||
# dest: /etc/cups/cupsd.conf
|
||||
|
||||
# # OPTION #1: OLD WAY (BRITTLE)
|
||||
# #
|
||||
# # - name: Install our own /etc/cups/cupsd.conf from template, to permit local LAN admin
|
||||
# # template:
|
||||
# # src: cupsd.conf.j2
|
||||
# # dest: /etc/cups/cupsd.conf
|
||||
# OPTION #2: NEW WAY (MORE FUTURE-PROOF, WE HOPE!)
|
||||
|
||||
# # OPTION #2: NEW WAY (MORE FUTURE-PROOF, WE HOPE!)
|
||||
|
||||
# # - debug:
|
||||
# # msg: FILE /etc/cups/cupsd.conf WILL BE CREATED BY THE ~5 STANZAS BELOW...
|
||||
|
||||
- name: PLEASE RUN 'sudo cupsctl' AND 'sudo cupsd -t' TO VERIFY /etc/cups/cupsd.conf IF YOU MODIFY IT! The file will now be created -- by the ~2 stanzas below.
|
||||
- name: PLEASE RUN 'sudo cupsctl' AND 'sudo cupsd -t' TO VERIFY /etc/cups/cupsd.conf IF YOU MODIFY IT! The file will now be created -- by ~4 stanzas below. Also keep an eye on /var/log/cups/error_log
|
||||
meta: noop
|
||||
|
||||
- name: Copy /usr/share/cups/cupsd.conf.default to /etc/cups/cupsd.conf (root:lp, 0640) -- a timestamped backup of the prior 'cupsd.conf' will be saved in /etc/cups
|
||||
|
|
@ -76,49 +70,43 @@
|
|||
# append: yes
|
||||
# groups: lpadmin
|
||||
|
||||
# - name: (Re)Start 'cups' and 'cups-browsed' systemd services -- CUPS DAEMON MUST BE RUNNING FOR 'cupsctl' COMMAND JUST BELOW
|
||||
# systemd:
|
||||
# daemon_reload: yes
|
||||
# name: "{{ item }}"
|
||||
# state: restarted
|
||||
# with_items:
|
||||
# - cups
|
||||
# - cups-browsed
|
||||
- name: Start 'cups' systemd service as nec -- CUPS DAEMON MUST BE RUNNING FOR 'cupsctl' COMMAND JUST BELOW
|
||||
systemd:
|
||||
#daemon_reload: yes
|
||||
name: cups
|
||||
state: started
|
||||
|
||||
# 2021-07-12: 'cupsctl --remote-admin && systemctl restart cups' enables
|
||||
# http://10.8.0.x:631 -- but this is even less useful than ever, now that
|
||||
# http://10.8.0.x/print works -- thx to the new /etc/nginx/conf.d/cups.conf
|
||||
# - name: Run 'cupsctl --remote-admin --share-printers --user-cancel-any' to enable http://192.168.0.x:631 AND http://172.18.96.1:631 (if cups_enabled) -- REPEATED USE OF 'cupsctl' COMMANDS CAN *DAMAGE* /etc/cups/cupsd.conf BY ADDING DUPLICATE LINES (AND WORSE!) -- SO PLEASE ALSO MANUALLY RUN 'sudo cupsctl' AND 'sudo cupsd -t' TO VERIFY /etc/cups/cupsd.conf
|
||||
# command: cupsctl --remote-admin --share-printers --user-cancel-any
|
||||
|
||||
# 2021-07-11: BOTH FLAGS *CANNOT* BE USED TOGETHER -- CHOOSE ONE OR THE OTHER:
|
||||
# (1) '--remote-admin' AS ABOVE, OR (2) '--remote-any' AS BELOW.
|
||||
# (RUN 'cupsctl' WITHOUT PARAMETERS TO CONFIRM THIS!)
|
||||
|
||||
- name: Run 'cupsctl --remote-any --share-printers --user-cancel-any' to enable http://192.168.0.x:631 AND http://172.18.96.1:631 AND http://10.8.0.y:631 (if cups_enabled) -- REPEATED USE OF 'cupsctl' COMMANDS CAN *DAMAGE* /etc/cups/cupsd.conf BY ADDING DUPLICATE LINES (AND WORSE!) -- SO PLEASE ALSO MANUALLY RUN 'sudo cupsctl' AND 'sudo cupsd -t' TO VERIFY /etc/cups/cupsd.conf
|
||||
command: cupsctl --remote-any --share-printers --user-cancel-any
|
||||
|
||||
# 2021-07-11: In theory 'cupsctl' stanzas could be put in enable-or-disable.yml
|
||||
# BUT LET'S AVOID THAT -- AS REPEATED USE OF 'cupsctl' COMMANDS CAN *DAMAGE*
|
||||
# /etc/cups/cupsd.conf BY ADDING DUPLICATE LINES (AND WORSE!)
|
||||
#
|
||||
# - name: Run 'cupsctl --remote-admin --share-printers --user-cancel-any --debug-logging' for /var/log/cups/error_log (if cups_enabled) -- REPEATED USE OF 'cupsctl' COMMANDS CAN *DAMAGE* /etc/cups/cupsd.conf BY ADDING DUPLICATE LINES (AND WORSE!) -- SO PLEASE ALSO MANUALLY RUN 'sudo cupsctl' AND 'sudo cupsd -t' TO VERIFY /etc/cups/cupsd.conf
|
||||
# command: cupsctl --remote-admin --share-printers --user-cancel-any --debug-logging
|
||||
# FYI repeated use of 'cupsctl' commands also removes comments and blank lines.
|
||||
#
|
||||
# - name: Run 'cupsctl --no-remote-admin --no-remote-any --no-share-printers --no-user-cancel-any --no-debug-logging' (if not cups_enabled) -- REPEATED USE OF 'cupsctl' COMMANDS CAN *DAMAGE* /etc/cups/cupsd.conf BY ADDING DUPLICATE LINES (AND WORSE!) -- SO PLEASE ALSO MANUALLY RUN 'sudo cupsctl' AND 'sudo cupsd -t' TO VERIFY /etc/cups/cupsd.conf
|
||||
# command: cupsctl --no-remote-admin --no-remote-any --no-share-printers --no-user-cancel-any --no-debug-logging
|
||||
# when: not cups_enabled
|
||||
|
||||
# # 2021-07-11: BOTH FLAGS *CANNOT* BE USED TOGETHER -- CHOOSE ONE OR THE OTHER:
|
||||
# # (1) '--remote-admin' AS ABOVE, OR (2) '--remote-any' AS BELOW.
|
||||
# # (RUN 'cupsctl' WITHOUT PARAMETERS TO CONFIRM THIS!)
|
||||
|
||||
# # - name: Run 'cupsctl --remote-any --share-printers --user-cancel-any --debug-logging' for /var/log/cups/error_log (if cups_enabled) -- REPEATED USE OF 'cupsctl' COMMANDS CAN *DAMAGE* /etc/cups/cupsd.conf BY ADDING DUPLICATE LINES (AND WORSE!) -- SO PLEASE ALSO MANUALLY RUN 'sudo cupsctl' AND 'sudo cupsd -t' TO VERIFY /etc/cups/cupsd.conf
|
||||
# # command: cupsctl --remote-any --share-printers --user-cancel-any --debug-logging
|
||||
|
||||
# # 2021-07-11: In theory 'cupsctl' stanzas could be put in enable-or-disable.yml
|
||||
# # BUT LET'S AVOID THAT -- AS REPEATED USE OF 'cupsctl' COMMANDS CAN *DAMAGE*
|
||||
# # /etc/cups/cupsd.conf BY ADDING DUPLICATE LINES (AND WORSE!)
|
||||
# #
|
||||
# # FYI repeated use of 'cupsctl' commands also removes comments and blank lines.
|
||||
# #
|
||||
# # - name: Run 'cupsctl --no-remote-admin --no-remote-any --no-share-printers --no-user-cancel-any --no-debug-logging' (if not cups_enabled) -- REPEATED USE OF 'cupsctl' COMMANDS CAN *DAMAGE* /etc/cups/cupsd.conf BY ADDING DUPLICATE LINES (AND WORSE!) -- SO PLEASE ALSO MANUALLY RUN 'sudo cupsctl' AND 'sudo cupsd -t' TO VERIFY /etc/cups/cupsd.conf
|
||||
# # command: cupsctl --no-remote-admin --no-remote-any --no-share-printers --no-user-cancel-any --no-debug-logging
|
||||
# # when: not cups_enabled
|
||||
|
||||
# - name: "2021-07-12: EXPERIMENTALLY ADD DIRECTIVES TO /etc/cups/cupsd.conf followed by 'systemctl restart cups'. As should no longer be nec thanks to NEW cups/templates/cups.conf for /etc/nginx/conf.d/cups.conf (followed by 'systemctl restart nginx'). Which FIXED URL'S LIKE: http://box/print, http://box.lan/print, http://192.168.0.x/print, http://172.18.96.1/print and http://10.8.0.x/print (WITH OR WITHOUT THE TRAILING SLASH!) RECAP: (1) So be it that these 2 URL'S STILL DON'T WORK: http://box:631, http://box.lan:631 (due to CUPS' internal web server's overly stringent hostname checks, i.e. '400 Bad Request') -- (2) While these 2 URL'S STILL DO WORK: http://localhost:631, http://127.0.0.1:631 -- (3) Whereas these 3 URL'S NO LONGER WORK: http://192.168.0.x:631, http://172.18.96.1:631, http://10.8.0.x:631 (now that we're suddenly hewing closer to the default /etc/cups/cupsd.conf)"
|
||||
# - name: "2021-07-12: EXPERIMENTALLY ADD DIRECTIVES TO /etc/cups/cupsd.conf followed by 'systemctl restart cups'. As should no longer be nec thanks to NEW cups/templates/cups.conf for /etc/nginx/conf.d/cups.conf (followed by 'systemctl restart nginx'). Which FIXED URL'S LIKE: http://box/print, http://box.lan/print, http://192.168.0.x/print, http://172.18.96.1/print and http://10.8.0.x/print (WITH OR WITHOUT THE TRAILING SLASH!) RECAP: (1) So be it that these 2 URL'S STILL DON'T WORK: http://box:631, http://box.lan:631 (due to CUPS' internal web server's overly stringent hostname checks, i.e. '400 Bad Request' and 'Request from \"localhost\" using invalid Host: field \"box[.lan]:631\".' in /var/log/cups/error_log) -- (2) While these 2 URL'S STILL DO WORK: http://localhost:631, http://127.0.0.1:631 -- (3) Whereas these 3 URL'S NO LONGER WORK: http://192.168.0.x:631, http://172.18.96.1:631, http://10.8.0.x:631 (now that we're suddenly hewing closer to the default /etc/cups/cupsd.conf)"
|
||||
# lineinfile:
|
||||
# path: /etc/cups/cupsd.conf
|
||||
# line: "{{ item }}"
|
||||
# insertbefore: '^Listen .*/run/cups/cups.sock$' # Also matches old form: '^Listen /var/run/cups/cups.sock$'
|
||||
# with_items:
|
||||
# - "#ServerAlias *"
|
||||
# - "HostNameLookups On" # More False Leads: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530027
|
||||
# - "ServerAlias *"
|
||||
# - "#ServerName {{ iiab_hostname }}.{{ iiab_domain }}" # box.lan
|
||||
# - "#Listen {{ lan_ip }}:631" # 172.18.96.1
|
||||
# - "Listen 127.0.0.1:631"
|
||||
# - "#Listen 127.0.0.1:631"
|
||||
# - "#Listen 0.0.0.0:631"
|
||||
# - "#Listen *:631"
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
- name: Enable http://box/print via NGINX, by installing {{ nginx_conf_dir }}/cups.conf from template
|
||||
template:
|
||||
src: cups.conf
|
||||
src: cups.conf.j2
|
||||
dest: "{{ nginx_conf_dir }}/cups.conf" # /etc/nginx/conf.d
|
||||
when: cups_enabled
|
||||
|
||||
|
|
|
|||
|
|
@ -1,30 +0,0 @@
|
|||
location = /print {
|
||||
return 301 /print/; # "Moved Permanently" redirect
|
||||
#rewrite /print /print/; # Faster, if links are fixed!
|
||||
}
|
||||
|
||||
location ~ /print/(.*) {
|
||||
proxy_pass http://127.0.0.1:631/$1;
|
||||
proxy_set_header Host '127.0.0.1';
|
||||
proxy_cache_bypass $http_upgrade;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
|
||||
sub_filter ' href="/' ' href="/print/';
|
||||
sub_filter ' action="/' ' action="/print/';
|
||||
sub_filter ' src="/' ' src="/print/';
|
||||
sub_filter_types *;
|
||||
sub_filter_once off;
|
||||
}
|
||||
|
||||
# location ~ /cups/(.*) {
|
||||
# proxy_pass http://127.0.0.1:631/$1;
|
||||
# proxy_set_header Host '127.0.0.1';
|
||||
# proxy_cache_bypass $http_upgrade;
|
||||
# proxy_set_header X-Real-IP $remote_addr;
|
||||
#
|
||||
# sub_filter ' href="/' ' href="/cups/';
|
||||
# sub_filter ' action="/' ' action="/cups/';
|
||||
# sub_filter ' src="/' ' src="/cups/';
|
||||
# sub_filter_types *;
|
||||
# sub_filter_once off;
|
||||
# }
|
||||
73
roles/cups/templates/cups.conf.j2
Normal file
73
roles/cups/templates/cups.conf.j2
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
# ADMINISTER CUPS AT http://box/print/admin WITH USERNAME 'Admin' AND PASSWORD
|
||||
# 'changeme' (OR ANY MEMBER OF LINUX GROUP 'lpadmin') PER cups/tasks/install.yml
|
||||
|
||||
|
||||
# 2021-07-13: Let's redirect to CUPS' own web server for now, as proxying
|
||||
# (commented out below) has many glitches, e.g. CUPS' https connections etc.
|
||||
|
||||
location ~ ^/print(|/.*)$ { # '~' -> '~*' for case-insensitive regex
|
||||
|
||||
# 2021-07-13: Work around CUPS failure to serve http://box[.lan]:631 "since
|
||||
# 2009" -- e.g. '400 Bad Request' error 'Request from "localhost" using
|
||||
# invalid Host: field "box[.lan]:631".' in /var/log/cups/error_log, DESPITE
|
||||
# adding 'HostNameLookups On', 'ServerAlias *' etc to /etc/cups/cupsd.conf
|
||||
# https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530027
|
||||
|
||||
if ($host ~ '{{ iiab_hostname }}(|.{{ iiab_domain }})') {
|
||||
return 301 http://localhost:631; # Or http://127.0.0.1:631
|
||||
}
|
||||
|
||||
if ($host ~ 'box(|.lan)') { # /etc/hosts may have BOTH above AND box.lan
|
||||
return 301 http://localhost:631;
|
||||
}
|
||||
|
||||
return 301 http://$host:631; # Can work with 192.168.0.x & 10.8.0.y ETC
|
||||
}
|
||||
|
||||
|
||||
# https://anthe.studio/blog/en/cups-nginx-reverse-proxy
|
||||
# https://toggen.com.au/it-tips/reverse-proxy-cups-in-nginx/
|
||||
# https://www.robpeck.com/2020/09/proxying-cups-ipp-using-nginx/
|
||||
|
||||
# location = /print {
|
||||
# return 301 /print/; # "Moved Permanently" redirect
|
||||
# #rewrite /print /print/; # Faster, if links are fixed!
|
||||
# }
|
||||
|
||||
## location ~ ^/print(|/.*)$ {
|
||||
## proxy_pass https://127.0.0.1:631$1; # Fails: trailing slash nec here
|
||||
# location ~ ^/print/(.*) {
|
||||
# proxy_pass https://127.0.0.1:631/$1;
|
||||
#
|
||||
# #proxy_http_version 1.1;
|
||||
# #proxy_set_header Accept-Encoding "";
|
||||
# #proxy_set_header Upgrade $http_upgrade;
|
||||
# #proxy_set_header Connection 'upgrade';
|
||||
# proxy_set_header Host '127.0.0.1';
|
||||
# proxy_cache_bypass $http_upgrade;
|
||||
#
|
||||
# proxy_set_header X-Real-IP $remote_addr;
|
||||
# #proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
|
||||
# #proxy_set_header X-Forwarded-Host $server_name;
|
||||
#
|
||||
# sub_filter ' href="/' ' href="/print/';
|
||||
# sub_filter ' action="/' ' action="/print/';
|
||||
# sub_filter ' src="/' ' src="/print/';
|
||||
# #sub_filter 'ACTION="/' 'ACTION="/print/';
|
||||
# #sub_filter 'URL=/' 'URL=/print/';
|
||||
# sub_filter_types *;
|
||||
# sub_filter_once off;
|
||||
# }
|
||||
|
||||
# location ~ /cups/(.*) {
|
||||
# proxy_pass http://127.0.0.1:631/$1;
|
||||
# proxy_set_header Host '127.0.0.1';
|
||||
# proxy_cache_bypass $http_upgrade;
|
||||
# proxy_set_header X-Real-IP $remote_addr;
|
||||
#
|
||||
# sub_filter ' href="/' ' href="/cups/';
|
||||
# sub_filter ' action="/' ' action="/cups/';
|
||||
# sub_filter ' src="/' ' src="/cups/';
|
||||
# sub_filter_types *;
|
||||
# sub_filter_once off;
|
||||
# }
|
||||
11
test.yml
11
test.yml
|
|
@ -20,11 +20,16 @@
|
|||
# name: 0-init
|
||||
|
||||
- debug:
|
||||
msg: YO!
|
||||
msg: "{{ 'changeme' | password_hash('sha512') }}"
|
||||
|
||||
#- pause:
|
||||
|
||||
- debug:
|
||||
msg: "{{ 'changeme' | password_hash('sha512') }}"
|
||||
- name: DOUBLE UP to escape single quotes... '"''"' e.g. iiab.ini Munin description
|
||||
debug:
|
||||
msg: '"''"' # FAILS: '"\'"'
|
||||
|
||||
- name: BACKSLASH to escape double quotes... "'\"'" e.g. cups/tasks/install.yml
|
||||
debug:
|
||||
msg: "'\"'" # FAILS: "'""'"
|
||||
|
||||
# TEST ANSIBLE COMMANDS/MODULES HERE!
|
||||
|
|
|
|||
Loading…
Reference in a new issue