Secure, Isolated, Print Stack (CUPS / IPPS / AlmaLinux 9)

Overview

We are looking for an experienced Linux engineer to advise and implement the most efficient way to build a secure, isolated print environment.

The priority is achieving the required functionality without unnecessary complexity or cost. This is not just a build task — we want input on the smartest, leanest way to deliver this architecture.

What We’re Trying to Achieve

A print system where:

Jobs are held securely on submission
Automatically released only when the correct printer is available
Can be manually re-routed if needed
Are not retained longer than necessary
Run in a way that does not impact other services (web, mail, Nextcloud)
Key Question (Critical)

Before proceeding with full implementation, we want you to review the scope and answer:

What is the most cost-effective way to achieve this?
Are there simpler alternatives to any part of the design?
Which elements (if any) will significantly increase time or cost?
What would you change, remove, or simplify while maintaining the outcome?
Proposed Scope (For Review & Optimisation)

You will assess and (if appropriate) implement:

Core Areas
Isolated environment (VM preferred, container acceptable if justified)
CUPS with IPPS (TLS enforced)
Logical hold queues (jobs do not auto-print)
Default printer routing with health checks
Manual fallback routing
Lightweight admin-only release interface
Automatic job cleanup and no long-term retention
Resource limits to protect other services
Security hardening (spool access, user isolation)
Important Considerations

We are specifically cautious about:

Overengineering (e.g. unnecessary portals or complex routing logic)
High-maintenance components
Features that look good on paper but add real-world overhead
Anything that introduces ongoing cost or operational burden
What We Want From You
Assessment first
Identify what is essential vs optional
Highlight cost/time-heavy components
Suggest a lean architecture
Then implementation (if aligned)
Provide:
Clear explanation of approach
Any trade-offs
What needs to be standardised if rolled out further
Key Requirement

We are not looking for a “full spec build at any cost.”
We are looking for the best practical solution that delivers:

Security
Reliability
Predictable behaviour

…without unnecessary expense or complexity.

We are not looking for indicative pricing; feel free to ask questions.