Secure Multi-Tenant Print System Setup (CUPS/IPPS/Linux)

We are looking for an experienced Linux engineer to design and implement a secure, isolated print environment using CUPS.
The goal is to build a lean, reliable system that delivers the required functionality without unnecessary complexity or ongoing maintenance overhead.

Project Objectives
The system should:
Securely handle print jobs
Support automatic printing for standard queues
Allow manual release for sensitive jobs (e.g. finance)
Enable safe re-routing of jobs if a printer is unavailable
Ensure jobs are not retained longer than necessary
Operate independently without affecting other services
Key Requirement: Isolation
A critical requirement is strict separation between environments:
No visibility of other users’ printers or queues
No access to other users’ print jobs
No risk of jobs being sent to the wrong printer
Strong access control and secure handling
Technical Scope
You will be responsible for:
Setting up an isolated environment (VM preferred)
Configuring CUPS with IPPS (TLS encryption)
Creating hybrid queue logic (auto-print + hold/release)
Implementing lightweight printer health checks
Enabling manual fallback routing
Applying security hardening and access controls
Configuring automatic job cleanup policies
Devices
Printers include models similar to the following:
Toshiba e-STUDIO
Katun Arivia

(All expected to support secure IPP/IPPS where possible.)
Important Considerations
We want to avoid:
Overengineered solutions
Complex custom scripting where not required
High-maintenance or costly components
We prefer:
Native CUPS functionality
Simple, predictable behaviour
Low ongoing maintenance
What We Expect
Before full implementation, you should:
Review the scope
Recommend the most cost-effective and simplest architecture
Identify anything that may increase time or complexity
Suggest improvements where needed
Deliverables
Clear architecture outline
Implementation of the agreed setup
Documentation of configuration and approach
Ideal Candidate
Strong experience with Linux systems (AlmaLinux/RHEL-based)
Hands-on experience with CUPS and IPP/IPPS
Knowledge of secure system design and isolation
Ability to deliver simple, practical solutions