For some reason TCSD is configured to use the nginx uid/gid. Use the newly created tss uid/gid instead.
cupsd.service
cups.service