Merge branch 'develop'

14 files changed, 2384 insertions, 0 deletions

diff --git a/puppet/modules/apache b/puppet/modules/apache
deleted file mode 160000
-Subproject 117bed9a9263c21d253d86b667eb165948efdc2
diff --git a/puppet/modules/apache/spec/classes/init_spec.rb b/puppet/modules/apache/spec/classes/init_spec.rb
new file mode 100644
index 00000000..baf26470
--- /dev/null
+++ b/puppet/modules/apache/spec/classes/init_spec.rb
@@ -0,0 +1,43 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache', :type => 'class' do
+  describe 'with standard' do
+    #puppet-rspec bug
+    #it { should compile.with_all_deps }
+
+    it { should contain_class('apache::base') }
+    it { should_not contain_class('apache::status') }
+    it { should_not contain_class('shorewall::rules::http') }
+    it { should_not contain_class('apache::ssl') }
+    context 'on centos' do
+      let(:facts) {
+        {
+          :operatingsystem => 'CentOS',
+        }
+      }
+      it { should contain_class('apache::centos') }
+    end
+  end
+  describe 'with params' do
+    let(:facts) {
+      {
+        :concat_basedir => '/var/lib/puppet/concat'
+      }
+    }
+    let(:params){
+      {
+        :manage_shorewall => true,
+        # there is puppet-librarian bug in using that module
+        #:manage_munin     => true,
+        :ssl              => true,
+      }
+    }
+    #puppet-rspec bug
+    #it { should compile.with_all_deps }
+
+    it { should contain_class('apache::base') }
+    it { should_not contain_class('apache::status') }
+    it { should contain_class('shorewall::rules::http') }
+    it { should contain_class('apache::ssl') }
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_file_spec.rb b/puppet/modules/apache/spec/defines/vhost_file_spec.rb
new file mode 100644
index 00000000..ed9ac5e2
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_file_spec.rb
@@ -0,0 +1,131 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::file', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+    }
+  }
+  let(:pre_condition) {
+    'include apache'
+  }
+  describe 'with standard' do
+    it { should contain_file('example.com.conf').with(
+      :ensure  => 'present',
+      :source  => [ "puppet:///modules/site_apache/vhosts.d/apache.example.com/example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d//example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/./example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d//example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/./example.com.conf",
+                  "puppet:///modules/apache/vhosts.d//example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/example.com.conf" ],
+      :path    => '/etc/apache2/vhosts.d/example.com.conf',
+      :require => 'File[vhosts_dir]',
+      :notify  => 'Service[apache]',
+      :owner   => 'root',
+      :group   => 0,
+      :mode    => '0644',
+    )}
+    it { should_not contain_file('/var/www/htpasswds/example.com') }
+    it { should_not contain_class('apache::includes') }
+    it { should_not contain_class('apache::mod_macro') }
+    it { should_not contain_class('apache::noiplog') }
+    it { should_not contain_class('apache::itk::lock') }
+    it { should_not contain_class('mod_security::itk_plus') }
+    it { should_not contain_class('mod_security') }
+  end
+  context 'on centos' do
+    let(:facts){
+      {
+        :fqdn                       => 'apache.example.com',
+        :operatingsystem            => 'CentOS',
+        :operatingsystemmajrelease  => '7',
+      }
+    }
+    it { should contain_file('example.com.conf').with(
+      :ensure  => 'present',
+      :source  => [ "puppet:///modules/site_apache/vhosts.d/apache.example.com/example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d//example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/CentOS.7/example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/CentOS/example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/CentOS.7/example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/CentOS/example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/example.com.conf" ],
+      :path    => '/etc/httpd/vhosts.d/example.com.conf',
+      :require => 'File[vhosts_dir]',
+      :notify  => 'Service[apache]',
+      :owner   => 'root',
+      :group   => 0,
+      :mode    => '0644',
+    )}
+    it { should_not contain_file('/var/www/htpasswds/example.com') }
+    it { should_not contain_class('apache::includes') }
+    it { should_not contain_class('apache::mod_macro') }
+    it { should_not contain_class('apache::noiplog') }
+    it { should_not contain_class('apache::itk::lock') }
+    it { should_not contain_class('mod_security::itk_plus') }
+    it { should_not contain_class('mod_security') }
+    context 'with params' do
+      let(:params) {
+        {
+          :vhost_destination => '/tmp/a/example.com.conf',
+          :vhost_source      => 'modules/my_module/example.com.conf',
+          :htpasswd_file     => true,
+          :do_includes       => true,
+          :mod_security      => true,
+          :use_mod_macro     => true,
+          :logmode           => 'anonym',
+        }
+      }
+      it { should contain_file('example.com.conf').with(
+        :ensure  => 'present',
+        :source  => 'puppet:///modules/my_module/example.com.conf',
+        :path    => '/tmp/a/example.com.conf',
+        :require => 'File[vhosts_dir]',
+        :notify  => 'Service[apache]',
+        :owner   => 'root',
+        :group   => 0,
+        :mode    => '0644',
+      )}
+      it { should contain_file('/var/www/htpasswds/example.com').with(
+        :source  => [ "puppet:///modules/site_apache/htpasswds/apache.example.com/example.com",
+                      "puppet:///modules/site_apache/htpasswds//example.com",
+                      "puppet:///modules/site_apache/htpasswds/example.com" ],
+        :owner   => 'root',
+        :group   => 0,
+        :mode    => '0644',
+      )}
+      it { should contain_class('apache::includes') }
+      it { should contain_class('apache::mod_macro') }
+      it { should contain_class('apache::noiplog') }
+      it { should_not contain_class('apache::itk::lock') }
+      it { should_not contain_class('mod_security::itk_plus') }
+      it { should contain_class('mod_security') }
+    end
+    context 'with content' do
+      let(:params) {
+        {
+          :content => "<VirtualHost *:80>\n  Servername example.com\n</VirtualHost>"
+        }
+      }
+      it { should contain_file('example.com.conf').with(
+        :ensure  => 'present',
+        :path    => '/etc/httpd/vhosts.d/example.com.conf',
+        :require => 'File[vhosts_dir]',
+        :notify  => 'Service[apache]',
+        :owner   => 'root',
+        :group   => 0,
+        :mode    => '0644',
+      )}
+      it { should contain_file('example.com.conf').with_content(
+"<VirtualHost *:80>
+  Servername example.com
+</VirtualHost>"
+      )}
+      it { should_not contain_file('/var/www/htpasswds/example.com') }
+    end
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_drupal_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_drupal_spec.rb
new file mode 100644
index 00000000..5256746d
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_drupal_spec.rb
@@ -0,0 +1,187 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::drupal', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    it { should contain_file('/etc/cron.d/drupal_cron_example.com').with(
+      :content => "0   *   *   *   *   apache wget -O - -q -t 1 http://example.com/cron.php\n",
+      :owner   => 'root',
+      :group   => 0,
+      :mode    => '0644',
+    )}
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :manage_directories => false,
+      :template_partial   => 'apache/vhosts/php_drupal/partial.erb',
+      :manage_config      => false,
+      :php_settings       => {
+        'magic_quotes_gpc'              => 0,
+        'register_globals'              => 0,
+        'session.auto_start'            => 0,
+        'mbstring.http_input'           => 'pass',
+        'mbstring.http_output'          => 'pass',
+        'mbstring.encoding_translation' => 0,
+      }
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value magic_quotes_gpc 0
+    php_admin_value mbstring.encoding_translation 0
+    php_admin_value mbstring.http_input pass
+    php_admin_value mbstring.http_output pass
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_value register_globals 0
+    php_admin_flag safe_mode on
+    php_admin_value session.auto_start 0
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+    # Protect files and directories from prying eyes.
+    <FilesMatch \"\\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\\.php)?|xtmpl)$|^(code-style\\.pl|Entries.*|Repository|Root|Tag|Template)$\">
+      Order allow,deny
+    </FilesMatch>
+
+    # Customized error messages.
+    ErrorDocument 404 /index.php
+
+    RewriteEngine on
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/files/\">
+    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+    Options None
+    Options +FollowSymLinks
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    it { should contain_file('/etc/cron.d/drupal_cron_example.com').with(
+      :content => "0   *   *   *   *   apache wget -O - -q -t 1 http://example.com/cron.php\n",
+      :owner   => 'root',
+      :group   => 0,
+      :mode    => '0644',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :run_mode                       => 'fcgid',
+      :run_uid                        => 'foo',
+      :run_gid                        => 'bar',
+      :manage_directories             => false,
+      :template_partial               => 'apache/vhosts/php_drupal/partial.erb',
+      :manage_config                  => false,
+      :php_settings                   => {
+        'magic_quotes_gpc'              => 0,
+        'register_globals'              => 0,
+        'session.auto_start'            => 0,
+        'mbstring.http_input'           => 'pass',
+        'mbstring.http_output'          => 'pass',
+        'mbstring.encoding_translation' => 0,
+      },
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+    # Protect files and directories from prying eyes.
+    <FilesMatch \"\\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\\.php)?|xtmpl)$|^(code-style\\.pl|Entries.*|Repository|Root|Tag|Template)$\">
+      Order allow,deny
+    </FilesMatch>
+
+    # Customized error messages.
+    ErrorDocument 404 /index.php
+
+    RewriteEngine on
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/files/\">
+    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+    Options None
+    Options +FollowSymLinks
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_gallery2_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_gallery2_spec.rb
new file mode 100644
index 00000000..9f2325e9
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_gallery2_spec.rb
@@ -0,0 +1,162 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::gallery2', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :manage_directories             => true,
+      :template_partial               => 'apache/vhosts/php_gallery2/partial.erb',
+      :php_settings                   => {
+        'safe_mode'         => 'Off',
+        'output_buffering'  => 'Off',
+      },
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'config.php',
+    )}
+    it { should contain_file('/var/www/vhosts/example.com/data/upload').with(
+      :ensure => 'directory',
+      :owner  => 'apache',
+      :group  => 0,
+      :mode   => '0660',
+    )}
+    it { should contain_file('/var/www/vhosts/example.com/data/gdata').with(
+      :ensure => 'directory',
+      :owner  => 'apache',
+      :group  => 0,
+      :mode   => '0660',
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag output_buffering off
+    php_admin_flag safe_mode off
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+
+    # Always rewrite login's
+    # Source: http://gallery.menalto.com/node/30558
+    RewriteEngine On
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+    RewriteCond %{HTTP_COOKIE} ^GALLERYSID= [OR]
+    RewriteCond %{QUERY_STRING} subView=core\\.UserLogin
+    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,R,L]
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :run_mode                       => 'fcgid',
+      :run_uid                        => 'foo',
+      :run_gid                        => 'bar',
+      :template_partial               => 'apache/vhosts/php_gallery2/partial.erb',
+      :php_settings                   => {
+        'safe_mode'         => 'Off',
+        'output_buffering'  => 'Off',
+      },
+      :manage_directories             => true,
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'config.php',
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+
+    # Always rewrite login's
+    # Source: http://gallery.menalto.com/node/30558
+    RewriteEngine On
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+    RewriteCond %{HTTP_COOKIE} ^GALLERYSID= [OR]
+    RewriteCond %{QUERY_STRING} subView=core\\.UserLogin
+    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,R,L]
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_joomla_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_joomla_spec.rb
new file mode 100644
index 00000000..000154de
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_joomla_spec.rb
@@ -0,0 +1,279 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::joomla', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    it { should contain_class('apache::include::joomla') }
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :template_partial               => 'apache/vhosts/php_joomla/partial.erb',
+      :php_settings                   => {
+        'allow_url_fopen'   => 'on',
+        'allow_url_include' => 'off',
+      },
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'configuration.php',
+      :manage_directories             => true,
+      :managed_directories            =>  [ "/var/www/vhosts/example.com/www/administrator/backups",
+                                            "/var/www/vhosts/example.com/www/administrator/components",
+                                            "/var/www/vhosts/example.com/www/administrator/language",
+                                            "/var/www/vhosts/example.com/www/administrator/modules",
+                                            "/var/www/vhosts/example.com/www/administrator/templates",
+                                            "/var/www/vhosts/example.com/www/components",
+                                            "/var/www/vhosts/example.com/www/dmdocuments",
+                                            "/var/www/vhosts/example.com/www/images",
+                                            "/var/www/vhosts/example.com/www/language",
+                                            "/var/www/vhosts/example.com/www/media",
+                                            "/var/www/vhosts/example.com/www/modules",
+                                            "/var/www/vhosts/example.com/www/plugins",
+                                            "/var/www/vhosts/example.com/www/templates",
+                                            "/var/www/vhosts/example.com/www/cache",
+                                            "/var/www/vhosts/example.com/www/tmp",
+                                            "/var/www/vhosts/example.com/www/administrator/cache" ],
+      :mod_security_additional_options => "
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"id:1199400,allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+"
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag allow_url_fopen on
+    php_admin_flag allow_url_include off
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+ 
+
+
+    Include include.d/joomla.inc
+  </Directory>
+
+  <Directory \"/var/www/vhosts/example.com/www/administrator/\">
+    RewriteEngine on
+
+    # Rewrite URLs to https that go for the admin area
+    RewriteCond %{REMOTE_ADDR} !^127\\.[0-9]+\\.[0-9]+\\.[0-9]+$
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{REQUEST_URI} (.*/administrator/.*)
+    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R]
+  </Directory>
+
+  # Deny various directories that
+  # shouldn't be webaccessible
+  <Directory \"/var/www/vhosts/example.com/www/tmp/\">
+    Deny From All
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/logs/\">
+    Deny From All
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/cli/\">
+    Deny From All
+  </Directory>
+
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+
+    
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"id:1199400,allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    it { should contain_class('apache::include::joomla') }
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :run_mode                       => 'fcgid',
+      :run_uid                        => 'foo',
+      :run_gid                        => 'bar',
+      :template_partial               => 'apache/vhosts/php_joomla/partial.erb',
+      :php_settings                   => {
+        'allow_url_fopen'   => 'on',
+        'allow_url_include' => 'off',
+      },
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'configuration.php',
+      :manage_directories             => true,
+      :managed_directories            =>  [ "/var/www/vhosts/example.com/www/administrator/backups",
+                                            "/var/www/vhosts/example.com/www/administrator/components",
+                                            "/var/www/vhosts/example.com/www/administrator/language",
+                                            "/var/www/vhosts/example.com/www/administrator/modules",
+                                            "/var/www/vhosts/example.com/www/administrator/templates",
+                                            "/var/www/vhosts/example.com/www/components",
+                                            "/var/www/vhosts/example.com/www/dmdocuments",
+                                            "/var/www/vhosts/example.com/www/images",
+                                            "/var/www/vhosts/example.com/www/language",
+                                            "/var/www/vhosts/example.com/www/media",
+                                            "/var/www/vhosts/example.com/www/modules",
+                                            "/var/www/vhosts/example.com/www/plugins",
+                                            "/var/www/vhosts/example.com/www/templates",
+                                            "/var/www/vhosts/example.com/www/cache",
+                                            "/var/www/vhosts/example.com/www/tmp",
+                                            "/var/www/vhosts/example.com/www/administrator/cache" ],
+      :mod_security_additional_options => "
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"id:1199400,allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+"
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+ 
+
+
+    Include include.d/joomla.inc
+  </Directory>
+
+  <Directory \"/var/www/vhosts/example.com/www/administrator/\">
+    RewriteEngine on
+
+    # Rewrite URLs to https that go for the admin area
+    RewriteCond %{REMOTE_ADDR} !^127\\.[0-9]+\\.[0-9]+\\.[0-9]+$
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{REQUEST_URI} (.*/administrator/.*)
+    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R]
+  </Directory>
+
+  # Deny various directories that
+  # shouldn't be webaccessible
+  <Directory \"/var/www/vhosts/example.com/www/tmp/\">
+    Deny From All
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/logs/\">
+    Deny From All
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/cli/\">
+    Deny From All
+  </Directory>
+
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+
+    
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"id:1199400,allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_standard_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_standard_spec.rb
new file mode 100644
index 00000000..159d4b81
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_standard_spec.rb
@@ -0,0 +1,534 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::standard', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should_not contain_class('mod_fcgid') }
+    it { should_not contain_class('php::mod_fcgid') }
+    it { should_not contain_class('apache::include::mod_fcgid') }
+    it { should_not contain_class('php::scl::php54') }
+    it { should_not contain_class('php::scl::php55') }
+    it { should_not contain_class('php::extensions::smarty') }
+    it { should contain_class('php') }
+    it { should_not contain_mod_fcgid__starter('example.com') }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(0) }
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'absent',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with standard and params' do
+    let(:params) {
+      {
+        :php_settings => {
+          'safe_mode' => 'Off',
+        }
+      }
+    }
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode off
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should contain_class('mod_fcgid') }
+    it { should contain_class('php::mod_fcgid') }
+    it { should contain_class('apache::include::mod_fcgid') }
+    it { should_not contain_class('php::scl::php54') }
+    it { should_not contain_class('php::scl::php55') }
+    it { should_not contain_class('php::extensions::smarty') }
+    it { should contain_mod_fcgid__starter('example.com').with(
+      :tmp_dir          => false,
+      :cgi_type         => 'php',
+      :cgi_type_options => {
+        "engine"            =>"On",
+        "upload_tmp_dir"    =>"/var/www/upload_tmp_dir/example.com",
+        "session.save_path" =>"/var/www/session.save_path/example.com",
+        "error_log"         =>"/var/www/vhosts/example.com/logs/php_error_log",
+        "safe_mode"         =>"On",
+        "safe_mode_gid"     =>"On",
+        "safe_mode_exec_dir"=>:undef,
+        "default_charset"   =>:undef,
+        "open_basedir"      =>"/var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com"
+      },
+      :owner            => 'foo',
+      :group            => 'bar',
+      :notify           => 'Service[apache]',
+    ) }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(0) }
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'absent',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid scl 5.4' do
+    let(:pre_condition){ 'include yum::prerequisites' }
+    let(:params){
+      {
+        :run_mode         => 'fcgid',
+        :run_uid          => 'foo',
+        :run_gid          => 'bar',
+        :php_installation => 'scl54',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should contain_class('mod_fcgid') }
+    it { should contain_class('php::mod_fcgid') }
+    it { should contain_class('apache::include::mod_fcgid') }
+    it { should contain_class('php::scl::php54') }
+    it { should_not contain_class('php::scl::php55') }
+    it { should_not contain_class('php::extensions::smarty') }
+    it { should contain_mod_fcgid__starter('example.com').with(
+      :tmp_dir          => false,
+      :cgi_type         => 'php',
+      :cgi_type_options => {
+        "engine"            =>"On",
+        "upload_tmp_dir"    =>"/var/www/upload_tmp_dir/example.com",
+        "session.save_path" =>"/var/www/session.save_path/example.com",
+        "error_log"         =>"/var/www/vhosts/example.com/logs/php_error_log",
+        "safe_mode"         =>:undef,
+        "safe_mode_gid"     =>:undef,
+        "safe_mode_exec_dir"=>:undef,
+        "default_charset"   =>:undef,
+        "open_basedir"      =>"/var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com"
+      },
+      :binary           => '/opt/rh/php54/root/usr/bin/php-cgi',
+      :additional_cmds  => 'source /opt/rh/php54/enable',
+      :rc               => '/opt/rh/php54/root/etc',
+      :owner            => 'foo',
+      :group            => 'bar',
+      :notify           => 'Service[apache]',
+    ) }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(0) }
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'absent',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid with scl55' do
+    let(:pre_condition){ 'include yum::prerequisites' }
+    let(:params){
+      {
+        :run_mode         => 'fcgid',
+        :run_uid          => 'foo',
+        :run_gid          => 'bar',
+        :php_installation => 'scl55',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should contain_class('mod_fcgid') }
+    it { should contain_class('php::mod_fcgid') }
+    it { should contain_class('apache::include::mod_fcgid') }
+    it { should_not contain_class('php::scl::php54') }
+    it { should contain_class('php::scl::php55') }
+    it { should_not contain_class('php::extensions::smarty') }
+    it { should contain_mod_fcgid__starter('example.com').with(
+      :tmp_dir          => false,
+      :cgi_type         => 'php',
+      :cgi_type_options => {
+        "engine"            =>"On",
+        "upload_tmp_dir"    =>"/var/www/upload_tmp_dir/example.com",
+        "session.save_path" =>"/var/www/session.save_path/example.com",
+        "error_log"         =>"/var/www/vhosts/example.com/logs/php_error_log",
+        "safe_mode"         =>:undef,
+        "safe_mode_gid"     =>:undef,
+        "safe_mode_exec_dir"=>:undef,
+        "default_charset"   =>:undef,
+        "open_basedir"      =>"/var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com"
+      },
+      :binary           => '/opt/rh/php55/root/usr/bin/php-cgi',
+      :additional_cmds  => 'source /opt/rh/php55/enable',
+      :rc               => '/opt/rh/php55/root/etc',
+      :owner            => 'foo',
+      :group            => 'bar',
+      :notify           => 'Service[apache]',
+    ) }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(0) }
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'absent',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid and params' do
+    let(:params){
+      {
+        :run_mode     => 'fcgid',
+        :run_uid      => 'foo',
+        :run_gid      => 'bar',
+        :logmode      => 'nologs',
+        :php_options  => {
+          'smarty'              => true,
+          'pear'                => true,
+          'safe_mode_exec_bins' => ['/usr/bin/cat'],
+        }
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should contain_class('mod_fcgid') }
+    it { should contain_class('php::mod_fcgid') }
+    it { should contain_class('apache::include::mod_fcgid') }
+    it { should_not contain_class('php::scl::php54') }
+    it { should_not contain_class('php::scl::php55') }
+    it { should contain_class('php::extensions::smarty') }
+    it { should contain_mod_fcgid__starter('example.com').with(
+      :tmp_dir          => false,
+      :cgi_type         => 'php',
+      :cgi_type_options => {
+        "engine"            =>"On",
+        "upload_tmp_dir"    =>"/var/www/upload_tmp_dir/example.com",
+        "session.save_path" =>"/var/www/session.save_path/example.com",
+        "error_log"         =>:undef,
+        "safe_mode"         =>"On",
+        "safe_mode_gid"     =>"On",
+        "safe_mode_exec_dir"=>"/var/www/vhosts/example.com/bin",
+        "default_charset"   =>:undef,
+        "open_basedir"      =>"/usr/share/php/Smarty/:/usr/share/pear/:/var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com"
+      },
+      :owner            => 'foo',
+      :group            => 'bar',
+      :notify           => 'Service[apache]',
+    ) }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(1) }
+    it { should contain_apache__vhost__php__safe_mode_bin('example.com@/usr/bin/cat').with(
+      :ensure => 'present',
+      :path   => '/var/www/vhosts/example.com/bin',
+    )}
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'directory',
+      :owner   => 'apache',
+      :group   => '0',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /dev/null
+  CustomLog /dev/null
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_webapp_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_webapp_spec.rb
new file mode 100644
index 00000000..bdebb14c
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_webapp_spec.rb
@@ -0,0 +1,261 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::webapp', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    let(:params){
+      {
+        :manage_config    => false,
+        :template_partial => 'apache/vhosts/php/partial.erb',
+      }
+    }
+    # only test variables that are tuned
+    it { should have_apache__file__rw_resource_count(0) }
+    it { should_not contain_apache__vhost__file__documentrootfile('configurationfile_example.com') }
+    it { should contain_apache__vhost__php__standard('example.com') }
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :manage_config    => false,
+        :template_partial => 'apache/vhosts/php/partial.erb',
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    # only test variables that are tuned
+    it { should have_apache__file__rw_resource_count(0) }
+    it { should_not contain_apache__vhost__file__documentrootfile('configurationfile_example.com') }
+    it { should contain_apache__vhost__php__standard('example.com') }
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  context 'with config file and directories' do
+    describe 'with standard' do
+      let(:params){
+        {
+          :manage_config        => true,
+          :managed_directories  => [ '/tmp/a', '/tmp/b' ],
+          :config_file          => 'config.php',
+          :template_partial     => 'apache/vhosts/php/partial.erb',
+        }
+      }
+      # only test variables that are tuned
+      it { should have_apache__file__rw_resource_count(2) }
+      it { should contain_apache__file__rw('/tmp/a').with(
+        :owner => 'apache',
+        :group => 0,
+      )}
+      it { should contain_apache__file__rw('/tmp/b').with(
+        :owner => 'apache',
+        :group => 0,
+      )}
+      it { should contain_apache__vhost__file__documentrootfile('configurationfile_example.com').with(
+        :documentroot => '/var/www/vhosts/example.com/www',
+        :filename     => 'config.php',
+        :thedomain    => 'example.com',
+        :owner        => 'apache',
+        :group        => 0,
+        :mode         => '0440',
+      ) }
+      it { should contain_apache__vhost__php__standard('example.com') }
+      # go deeper in the catalog and test the produced template
+      it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+    end
+    describe 'with standard but writable' do
+      let(:params){
+        {
+          :manage_config        => true,
+          :config_webwriteable  => true,
+          :managed_directories  => [ '/tmp/a', '/tmp/b' ],
+          :config_file          => 'config.php',
+          :template_partial     => 'apache/vhosts/php/partial.erb',
+        }
+      }
+      # only test variables that are tuned
+      it { should have_apache__file__rw_resource_count(2) }
+      it { should contain_apache__file__rw('/tmp/a').with(
+        :owner => 'apache',
+        :group => 0,
+      )}
+      it { should contain_apache__file__rw('/tmp/b').with(
+        :owner => 'apache',
+        :group => 0,
+      )}
+      it { should contain_apache__vhost__file__documentrootfile('configurationfile_example.com').with(
+        :documentroot => '/var/www/vhosts/example.com/www',
+        :filename     => 'config.php',
+        :thedomain    => 'example.com',
+        :owner        => 'apache',
+        :group        => 0,
+        :mode         => '0660',
+      ) }
+      it { should contain_apache__vhost__php__standard('example.com') }
+      # go deeper in the catalog and test the produced template
+      it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+    end
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_wordpress_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_wordpress_spec.rb
new file mode 100644
index 00000000..203f9690
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_wordpress_spec.rb
@@ -0,0 +1,171 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::wordpress', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :mod_security_rules_to_disable  => ["960010", "950018"],
+      :manage_directories             => true,
+      :managed_directories            => '/var/www/vhosts/example.com/www/wp-content',
+      :template_partial               => 'apache/vhosts/php_wordpress/partial.erb',
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'wp-config.php',
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride FileInfo
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+
+  # fixes: http://git.zx2c4.com/w3-total-fail/tree/w3-total-fail.sh
+  <Directory \"/var/www/vhosts/example.com/www/wp-content/w3tc/dbcache\">
+    Deny From All
+  </Directory>
+
+  # simple wp-login brute force protection
+  # http://www.frameloss.org/2013/04/26/even-easier-brute-force-login-protection-for-wordpress/
+  RewriteEngine On
+  RewriteCond %{HTTP_COOKIE} !359422a82c97336dc082622faf72013a8e857bfd
+  RewriteRule ^/wp-login.php /wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php [R,L]
+  <Location /wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php>
+    CookieTracking on
+    CookieExpires 30
+    CookieName 359422a82c97336dc082622faf72013a8e857bfd
+  </Location>
+  RewriteRule ^/wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php /wp-login.php [NE]
+
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+
+    SecRuleRemoveById \"960010\"
+    SecRuleRemoveById \"950018\"
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :run_mode                       => 'fcgid',
+      :run_uid                        => 'foo',
+      :run_gid                        => 'bar',
+      :template_partial               => 'apache/vhosts/php_wordpress/partial.erb',
+      :mod_security_rules_to_disable  => ["960010", "950018"],
+      :manage_directories             => true,
+      :managed_directories            => '/var/www/vhosts/example.com/www/wp-content',
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'wp-config.php',
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride FileInfo
+    Options  +ExecCGI
+
+
+  </Directory>
+
+
+  # fixes: http://git.zx2c4.com/w3-total-fail/tree/w3-total-fail.sh
+  <Directory \"/var/www/vhosts/example.com/www/wp-content/w3tc/dbcache\">
+    Deny From All
+  </Directory>
+
+  # simple wp-login brute force protection
+  # http://www.frameloss.org/2013/04/26/even-easier-brute-force-login-protection-for-wordpress/
+  RewriteEngine On
+  RewriteCond %{HTTP_COOKIE} !359422a82c97336dc082622faf72013a8e857bfd
+  RewriteRule ^/wp-login.php /wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php [R,L]
+  <Location /wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php>
+    CookieTracking on
+    CookieExpires 30
+    CookieName 359422a82c97336dc082622faf72013a8e857bfd
+  </Location>
+  RewriteRule ^/wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php /wp-login.php [NE]
+
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+
+    SecRuleRemoveById \"960010\"
+    SecRuleRemoveById \"950018\"
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_spec.rb b/puppet/modules/apache/spec/defines/vhost_spec.rb
new file mode 100644
index 00000000..051ad0d4
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_spec.rb
@@ -0,0 +1,202 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  let(:pre_condition) {
+    'include apache'
+  }
+  describe 'with standard' do
+    it { should contain_apache__vhost__template('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => false,
+      :run_mode       => 'normal',
+      :ssl_mode       => false,
+      :logmode        => 'default',
+      :mod_security   => true,
+      :htpasswd_file  => 'absent',
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    # go deeper in the catalog and the test the produced content from the template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params' do
+    let(:params){
+      {
+        :do_includes    => true,
+        :ssl_mode       => true,
+        :logmode        => 'anonym',
+        :mod_security   => false,
+        :htpasswd_file  => true,
+      }
+    }
+    it { should contain_apache__vhost__template('example.com').with(
+      :ensure                           => 'present',
+      :path                             => 'absent',
+      :path_is_webdir                   => false,
+      :logpath                          => 'absent',
+      :logmode                          => 'anonym',
+      :logprefix                        => '',
+      :domain                           => 'absent',
+      :domainalias                      => 'absent',
+      :server_admin                     => 'absent',
+      :allow_override                   => 'None',
+      :do_includes                      => true,
+      :options                          => 'absent',
+      :additional_options               => 'absent',
+      :default_charset                  => 'absent',
+      :php_settings                     => {},
+      :php_options                      => {},
+      :run_mode                         => 'normal',
+      :run_uid                          => 'absent',
+      :run_gid                          => 'absent',
+      :template_partial                 => 'apache/vhosts/static/partial.erb',
+      :ssl_mode                         => true,
+      :htpasswd_file                    => true,
+      :htpasswd_path                    => 'absent',
+      :ldap_auth                        => false,
+      :ldap_user                        => 'any',
+      :mod_security                     => false,
+      :mod_security_relevantonly        => true,
+      :mod_security_rules_to_disable    => [],
+      :mod_security_additional_options  => 'absent',
+      :use_mod_macro                    => false,
+      :passing_extension                => 'absent',
+      :gempath                          => 'absent',
+    )}
+    # go deeper in the catalog and the test the produced content from the template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+<VirtualHost *:443 >
+
+  Include include.d/defaults.inc
+  Include include.d/ssl_defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params II' do
+    let(:params){
+      {
+        :vhost_mode     => 'file',
+      }
+    }
+    it { should_not contain_apache__vhost__template('example.com') }
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure             => 'present',
+      :vhost_source       => 'absent',
+      :vhost_destination  => 'absent',
+      :do_includes        => false,
+      :run_mode       => 'normal',
+      :mod_security   => true,
+      :htpasswd_file  => 'absent',
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+  end
+  describe 'with wrong vhost_mode' do
+    let(:params){
+      {
+        :vhost_mode     => 'foo',
+      }
+    }
+    it { expect { should compile }.to raise_error(Puppet::Error, /No such vhost_mode: foo defined for example.com\./)
+    }
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_static_spec.rb b/puppet/modules/apache/spec/defines/vhost_static_spec.rb
new file mode 100644
index 00000000..37891bb5
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_static_spec.rb
@@ -0,0 +1,54 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::static', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  let(:pre_condition) {
+    'include apache'
+  }
+  describe 'with standard' do
+    # only test the relevant options
+    it { should contain_apache__vhost__webdir('example.com').with(
+      :datadir  => false,
+    )}
+    it { should contain_apache__vhost('example.com') }
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_template_spec.rb b/puppet/modules/apache/spec/defines/vhost_template_spec.rb
new file mode 100644
index 00000000..96fb9ac3
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_template_spec.rb
@@ -0,0 +1,297 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::template', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  let(:pre_condition) {
+    'include apache'
+  }
+  describe 'with standard' do
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => false,
+      :run_mode       => 'normal',
+      :ssl_mode       => false,
+      :logmode        => 'default',
+      :mod_security   => true,
+      :htpasswd_file  => 'absent',
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params' do
+    let(:params){
+      {
+        :do_includes    => true,
+        :ssl_mode       => true,
+        :logmode        => 'anonym',
+        :mod_security   => false,
+        :htpasswd_file  => true,
+      }
+    }
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => true,
+      :run_mode       => 'normal',
+      :ssl_mode       => true,
+      :logmode        => 'anonym',
+      :mod_security   => false,
+      :htpasswd_file  => true,
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+<VirtualHost *:443 >
+
+  Include include.d/defaults.inc
+  Include include.d/ssl_defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params II' do
+    let(:params){
+      {
+        :do_includes    => true,
+        :ssl_mode       => 'force',
+        :logmode        => 'semianonym',
+        :mod_security   => false,
+        :htpasswd_file  => true,
+      }
+    }
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => true,
+      :run_mode       => 'normal',
+      :ssl_mode       => 'force',
+      :logmode        => 'semianonym',
+      :mod_security   => false,
+      :htpasswd_file  => true,
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  RewriteEngine On
+  RewriteCond %{HTTPS} !=on
+  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+  RewriteRule (.*) https://%{SERVER_NAME}$1 [R=permanent,L]
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+<VirtualHost *:443 >
+
+  Include include.d/defaults.inc
+  Include include.d/ssl_defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params III' do
+    let(:params){
+      {
+        :do_includes    => false,
+        :ssl_mode       => 'only',
+        :logmode        => 'nologs',
+        :mod_security   => true,
+        :htpasswd_file  => 'absent',
+      }
+    }
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => false,
+      :run_mode       => 'normal',
+      :ssl_mode       => 'only',
+      :logmode        => 'nologs',
+      :mod_security   => true,
+      :htpasswd_file  => 'absent',
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:443 >
+
+  Include include.d/defaults.inc
+  Include include.d/ssl_defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /dev/null
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/functions/guess_apache_version.rb b/puppet/modules/apache/spec/functions/guess_apache_version.rb
new file mode 100644
index 00000000..b57a7a0f
--- /dev/null
+++ b/puppet/modules/apache/spec/functions/guess_apache_version.rb
@@ -0,0 +1,50 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'guess_apache_version function' do
+
+  #let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("guess_apache_version")).to eq("function_guess_apache_version")
+  end
+
+  context 'on debian 7.8' do
+    let(:facts) do
+      {
+        :operatingsystem => 'Debian',
+        :operatingsystemrelease => '7.8'
+      }
+    end
+    it "should return 2.2" do
+      result = scope.function_guess_apache_version([])
+      expect(result).to(eq('2.2'))
+    end
+  end
+
+  context 'on debian 8.0' do
+    let(:facts) do
+      {
+        :operatingsystem => 'Debian',
+        :operatingsystemrelease => '8.0'
+      }
+    end
+    it "should return 2.4" do
+      result = scope.function_guess_apache_version([])
+      expect(result).to(eq('2.4'))
+    end
+  end
+
+  context 'on ubuntu 15.10' do
+    let(:facts) do
+      {
+        :operatingsystem => 'Ubuntu',
+        :operatingsystemrelease => '15.10'
+      }
+    end
+    it "should return 2.4" do
+      result = scope.function_guess_apache_version([])
+      expect(result).to(eq('2.4'))
+    end
+  end
+
+end
diff --git a/puppet/modules/apache/spec/spec_helper.rb b/puppet/modules/apache/spec/spec_helper.rb
new file mode 100644
index 00000000..381f9720
--- /dev/null
+++ b/puppet/modules/apache/spec/spec_helper.rb
@@ -0,0 +1,13 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
+require 'rake'
+
+fixture_path = File.expand_path(File.join(__FILE__, '..', 'fixtures'))
+
+RSpec.configure do |c|
+  c.module_path = File.join(fixture_path, 'modules')
+  c.manifest_dir = File.join(fixture_path, 'manifests')
+  c.pattern = FileList[c.pattern].exclude(/^spec\/fixtures/)
+end
+
+Puppet::Util::Log.level = :warning
+Puppet::Util::Log.newdestination(:console)