From 1ea1aa4189c3c738640f3d2d0768c44c94f525d7 Mon Sep 17 00:00:00 2001
From: Julian Cuni <julian.cuni@microservices.al>
Date: Sat, 27 Jun 2026 14:11:51 +0200
Subject: [PATCH] fix(deploy): pass the USB printer (usblp) into the host-net
 server container
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The USB ESC/POS printer is the host's /dev/usb/lpN (usblp char device, major 180),
but the container has its own /dev — `docker exec server ls /dev/usb` → "No such
file or directory", so probeUsb's open() ENOENTs and the printer is always offline
regardless of the path set in setup. Containerization isolates host hardware (same
root cause as the network fix); USB needs explicit passthrough:

- volumes: /dev/usb:/dev/usb  → the lpN NODES appear inside the container
- device_cgroup_rules: 'c 180:* rmw'  → permit the usblp char major (180), and the
  `:*` minor wildcard survives lp0/lp1/lp2 renumbering across replug/boot-order.

Binding the /dev/usb DIR (not a single `devices:` node) is what survives renumber.
Merge verified: parking-data ledger volume preserved (lists append), host net intact,
config valid. Booth prereq: `usblp` loaded at boot + printer attached before start,
else /dev/usb is absent.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
---
 docker-compose.prod.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index bb098be..7127349 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -51,6 +51,19 @@ services:
     # there is no separate namespace, and runc REFUSES it ("not allowed in host network
     # namespace"). Reader liveness ping uses the HOST's setting instead — the booth host must
     # set net.ipv4.ping_group_range (see appliance-provisioning §7 / disk-os-hardening).
+    #
+    # USB PRINTER PASSTHROUGH. A USB ESC/POS printer (Rongta/Cashino) is the kernel `usblp` char
+    # device /dev/usb/lpN on the HOST — the container has its own /dev and can't see it (probeUsb
+    # open() → ENOENT → printer always "offline"). Two parts, both needed:
+    #   - bind-mount /dev/usb so the lpN NODES appear inside the container, and
+    #   - a device-cgroup rule permitting the usblp char major (180) so the kernel allows the
+    #     open(). `180:*` covers lp0/lp1/lp2… so a USB replug/boot-order renumber still works
+    #     (the printer's path can move; set Connection=USB + the matching /dev/usb/lpN in setup).
+    # (Bind-mounting the dir, not a single `devices:` node, is what survives renumbering.)
+    volumes:
+      - /dev/usb:/dev/usb
+    device_cgroup_rules:
+      - "c 180:* rmw"
     logging:
       driver: json-file
       options: