migrate printhost to nix

[BNH440]

migrates the whiteout config with some MAJOR CHANGES:

• replacing tea4cups with a new drop-in backend
• drop all custom ocf postscript filters and replace the filter stack with the official hp and epson drivers
• replaced enforcer-pc (page counter) with a very similar python implementation
• removed enforcer-size (A5 / non-letter print blocker) as the clients now understand the printer's supported page sizes
• fixed clients not understanding printer capabilities (SEE BELOW)
  • now that clients understand the options the printers provide, we can have TWO classes, OCF-BW for black&white, and OCF-Color for color
• use socket for all printers (including epson, epson used ipp on whiteout)
  • why? turns out socket is just way faster, it causes the printers to queue a set of prints locally which allows them to print multiple documents in a row without spooling down and back up again. (as opposed to the jobs all queuing in the cups queue before being sent after the printer is confirmed finished printing the last doc)
  • what about tls? with ipps (which we weren't actually using on epson with whiteout) we can have an encrypted connection, but due to what I mentioned above, the extra security of ipps is just not worth the speed difference
• basically the entire printing pipeline is just different now (SEE BELOW)

note: I did NOT go with the approach I mentioned a few days ago about having a client side cups server that did the filtering (driver stack / postscript conversion) and then sent to a remote cups server. I ended up having a lot of problems with double filtering, but the main reason was that I discovered I could create basically the same pipeline without any of the downsides by using a fake printer in front of the class. (which is what the client did but just more complicated) So we are NOT using cups-browsed or anything related to it anymore (compared to the double cups server approach).

note: we are still billing by sides of paper because counting physical pages before sending to the printer is very difficult. more details:

you can either wait until the job finishes and check the cups variables for how many physical sheets the printer printed (which doesn't work for a quota check pre-hook)
or you can calculate the physical pages yourself by dividing by 2 if duplex is enabled. the only issue is that I couldn't find a good way to get whether duplex was enabled when I was testing earlier

Why did clients not understand the printer capabilities (page size, double sided, etc)

• we previously needed to have a queue for every double sided option (-double, -single), which is no longer required because the client now receives more detailed information about the printer from the server, which makes the double sided dialogue show up as the client knows it's supported
• the main difference is we used to advertise cups classes from the server, and cups classes send minimal information on the capabilities of the printers the contain
• now we still use classes as the load balancer (for B&W), but we put a "fake" printer in front of the class, which points to the class's ipp url. the big difference is that a printer in cups can advertise a ppd / printer driver that contains the printer's capabilities.

New Pipeline

What changes for the user?

the user will now see OCF-BW and OCF-Color, they will choose between those as usual, but for double sided they can change the two-sided setting on the print dialog.

The black and white default is double sided and the color default is single sided. I think this best represents what most people use the two modes for (B&W for documents, Color for fliers).

TODO in the future

• modify dns to point printhost.ocf.berkeley.edu to tule (and modify client to point to printhost again)
  new color printer installation
• add new color printer
  • due to new color printer being HP, we can basically just duplicate the method we used for the BW printers (but just have one printer in the color class), this is preferable over keeping the current 1 stage print pipeline that we have for the epson because it will have the correct printer destination name in wayout and the db
• OAuth for management operations: we tried to get kerberos working before realizing it's now deprecated in favor of OAuth. We plan on integrating OAuth with auth.ocf.berkeley.edu (which will also auto login on desktops with a kerberos ticket). Except OAuth is added in CUPS 2.5, which is currently in beta. We can update and configure this once cups is updated in nixpkgs.
• rewrite enforcer and the new tea4cups compatible backend to make things simpler

ongoing issues

• wayout notifications get cut off (was also a problem before, not a regression)
• goodnotes issue still exists :( (seems to be a firefox problem?)
• TLS has to be set to IfRequested until this change gets into a release: CUPS sometimes hangs for 10 seconds when a client connects to it via TLS OpenPrinting/cups#1128 OpenPrinting/cups@cdd7cf4

fixed issues:
- need to check printing from servers (lp works)
- need to check print failure emails (works!)
- need to check A5 printing (it auto scales to letter 🎉)
- billing seems to be incorrect for copies (at least on BW) (FIXED)
- color printing broken (filter failed) (FIXED)
- the user.js change didn't work d1607ac (FIXED)
QUOTA IS NOT CHECKED!!! - need to add back the postscript filter for page count and remove epson support (FIXED 🎉)

[BNH440]

ok I actually decided to change the server url from printhost-dev to tule on the desktops so when we move dns printhost-dev to printhost it won't interrupt lab operations

[BNH440]

I plan on changing dns on monday after we've proved tule works well in a normal day of lab operations

[BNH440]

ok TLS is broken from the client to server and idk why, I set encryption to IfRequested which masked the issue, but that should preferably be fixed, although idk if it should be a requirement tbh

[BNH440]

ok the TLS issue we're having has been fixed and will be in a later update
OpenPrinting/cups#1128

[BNH440]

disabled auto merge so this doesn't get auto deployed during lab hours on Monday if approved

[BNH440]

oh I didn't realize that would cancel the review 😭