From e35fca3d367a6294123a0d9a2c077f4db7dfe809 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 12 May 2016 13:59:13 +0200
Subject: [feat] catch abnormal proc termination in syslog

Sometimes a floating point exception or segfault of
a process results in systemd restarting it, we want
to recognize this from the syslog
i.e.:

  systemd[1]: pixelated-server.service: main process exited,
  code=killed, status=8/FPE
  systemd[1]: Unit pixelated-server.service entered failed state.

- Related: https://github.com/pixelated/pixelated-user-agent/issues/683
---
 puppet/modules/site_check_mk/files/agent/logwatch/syslog_tail.cfg | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog_tail.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog_tail.cfg
index 71395c50..7daf0cac 100644
--- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog_tail.cfg
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/syslog_tail.cfg
@@ -15,3 +15,7 @@
 # 401 Unauthorized error logged by webapp and possible other
 # applications
  C Unauthorized
+# catch abnormal termination of processes (due to segfault/fpe
+# signals etc).
+# see https://github.com/pixelated/pixelated-user-agent/issues/683
+ C systemd.*: main process exited, code=killed, status=
-- 
cgit v1.2.3


From 112e8e98bca4a11a068cc771e41d4b819da4ef52 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 28 Apr 2016 13:48:06 +0200
Subject: [lint] make future parser happy

---
 puppet/modules/site_nagios/manifests/server.pp         | 2 +-
 puppet/modules/site_openvpn/manifests/server_config.pp | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index aa9b956e..6537124d 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -59,7 +59,7 @@ class site_nagios::server inherits nagios::base {
   include site_webapp::common_vhost
   include apache::module::headers
 
-  File ['nagios_htpasswd'] {
+  File['nagios_htpasswd'] {
     source  => undef,
     content => "nagiosadmin:${nagiosadmin_pw}",
     mode    => '0640',
diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index 6decc665..15e6fb38 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -30,7 +30,7 @@
 # auth SHA1
 #
 #   dkg: For HMAC digest to authenticate packets, we just want SHA256. OpenVPN lists
-#   a number of “digest” with names like “RSA-SHA256”, but this are legacy and
+#   a number of "digest" with names like "RSA-SHA256", but this are legacy and
 #   should be avoided.
 #
 #   elijah: i am not so sure that the digest algo matters for 'auth' option, because
@@ -40,14 +40,14 @@
 # cipher AES-128-CBC
 #
 #   dkg: For the choice of cipher, we need to select an algorithm and a
-#   cipher mode. OpenVPN defaults to Blowfish, which is a fine algorithm — but
+#   cipher mode. OpenVPN defaults to Blowfish, which is a fine algorithm - but
 #   our control channel is already relying on AES not being broken; if the
 #   control channel is cracked, then the key material for the tunnel is exposed,
 #   and the choice of algorithm is moot. So it makes more sense to me to rely on
 #   the same cipher here: AES128. As for the cipher mode, OFB seems cleaner to
 #   me, but CBC is more well-tested, and the OpenVPN man page (at least as of
-#   version 2.2.1) says “CBC is recommended and CFB and OFB should be considered
-#   advanced modes.”
+#   version 2.2.1) says "CBC is recommended and CFB and OFB should be considered
+#   advanced modes."
 #
 #   note: the default is BF-CBC (blowfish)
 #
-- 
cgit v1.2.3


From 3e63ce3c71620433dc135959b2743aa010b28fe1 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 17 May 2016 12:52:57 +0200
Subject: update submodules so "rake test" doesnt complain anymore

---
 puppet/modules/apache      | 2 +-
 puppet/modules/backupninja | 2 +-
 puppet/modules/bundler     | 2 +-
 puppet/modules/couchdb     | 2 +-
 puppet/modules/nagios      | 2 +-
 puppet/modules/rubygems    | 2 +-
 puppet/modules/tor         | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/apache b/puppet/modules/apache
index 117bed9a..415e9504 160000
--- a/puppet/modules/apache
+++ b/puppet/modules/apache
@@ -1 +1 @@
-Subproject commit 117bed9a9263c21d253d86b667eb165948efdc24
+Subproject commit 415e9504f99dca3ccaa4dfd389dde24ad9d0e01c
diff --git a/puppet/modules/backupninja b/puppet/modules/backupninja
index 49751354..5268a87c 160000
--- a/puppet/modules/backupninja
+++ b/puppet/modules/backupninja
@@ -1 +1 @@
-Subproject commit 497513547be79f9d3c8e96f1650ec43ee634b277
+Subproject commit 5268a87c329f895017f8ea6c6abc377a4f9a6a77
diff --git a/puppet/modules/bundler b/puppet/modules/bundler
index b4a4a843..bacec3e0 160000
--- a/puppet/modules/bundler
+++ b/puppet/modules/bundler
@@ -1 +1 @@
-Subproject commit b4a4a8434616247156e59b860b47cc6256ead8d1
+Subproject commit bacec3e072649be4ade56f7df8506b46ae9c5166
diff --git a/puppet/modules/couchdb b/puppet/modules/couchdb
index 40d2289f..76ff149a 160000
--- a/puppet/modules/couchdb
+++ b/puppet/modules/couchdb
@@ -1 +1 @@
-Subproject commit 40d2289f8e10625cd45fdccdf492b5fb6490e66d
+Subproject commit 76ff149a095023611c05bbb00157d06f87b07c05
diff --git a/puppet/modules/nagios b/puppet/modules/nagios
index 68dab01a..e6fee3c7 160000
--- a/puppet/modules/nagios
+++ b/puppet/modules/nagios
@@ -1 +1 @@
-Subproject commit 68dab01a85996e14efcccf856b623a2caf257823
+Subproject commit e6fee3c731f68ccf8b6add8ada2162c7ad2b8407
diff --git a/puppet/modules/rubygems b/puppet/modules/rubygems
index e704c9fe..510a3693 160000
--- a/puppet/modules/rubygems
+++ b/puppet/modules/rubygems
@@ -1 +1 @@
-Subproject commit e704c9fe1c40fea5b10fe3ca2b4f5de825341cc6
+Subproject commit 510a3693eab5dc78ed27d3728ee4d3b12334ea12
diff --git a/puppet/modules/tor b/puppet/modules/tor
index 8c936c16..9981a70f 160000
--- a/puppet/modules/tor
+++ b/puppet/modules/tor
@@ -1 +1 @@
-Subproject commit 8c936c166b6da1ebd0e8d95e56ceee5167357d63
+Subproject commit 9981a70f7ba1f9e4fe33e4eb46654295287c1fc1
-- 
cgit v1.2.3


From 18a3a1953802021afccf7105876de7839f152189 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 20 May 2016 08:13:11 +0200
Subject: [feat] Automatic couchdb db compaction

Automatic background couchdb db compaction frees a huge
amount of diskspace.

- Resolves: #8118
---
 puppet/modules/site_couchdb/files/local.ini | 89 +----------------------------
 1 file changed, 3 insertions(+), 86 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_couchdb/files/local.ini b/puppet/modules/site_couchdb/files/local.ini
index 22aa0177..b921a927 100644
--- a/puppet/modules/site_couchdb/files/local.ini
+++ b/puppet/modules/site_couchdb/files/local.ini
@@ -1,91 +1,8 @@
-; CouchDB Configuration Settings
+; Puppet modified file !!
 
 ; Custom settings should be made in this file. They will override settings
 ; in default.ini, but unlike changes made to default.ini, this file won't be
 ; overwritten on server upgrade.
 
-[couchdb]
-;max_document_size = 4294967296 ; bytes
-
-[httpd]
-;port = 5984
-;bind_address = 127.0.0.1
-; Options for the MochiWeb HTTP server.
-;server_options = [{backlog, 128}, {acceptor_pool_size, 16}]
-; For more socket options, consult Erlang's module 'inet' man page.
-;socket_options = [{recbuf, 262144}, {sndbuf, 262144}, {nodelay, true}]
-
-; Uncomment next line to trigger basic-auth popup on unauthorized requests.
-;WWW-Authenticate = Basic realm="administrator"
-
-; Uncomment next line to set the configuration modification whitelist. Only
-; whitelisted values may be changed via the /_config URLs. To allow the admin
-; to change this value over HTTP, remember to include {httpd,config_whitelist}
-; itself. Excluding it from the list would require editing this file to update
-; the whitelist.
-;config_whitelist = [{httpd,config_whitelist}, {log,level}, {etc,etc}]
-
-[httpd_global_handlers]
-;_google = {couch_httpd_proxy, handle_proxy_req, <<"http://www.google.com">>}
-
-# futon is enabled by default on bigcouch in default.ini
-# we need to find another way to disable futon, it won't work disabling it here
-# enable futon
-#_utils = {couch_httpd_misc_handlers, handle_utils_dir_req, "/usr/share/couchdb/www"}
-# disable futon
-#_utils =  {couch_httpd_misc_handlers, handle_welcome_req, <<"Welcome, Futon is disabled!">>}
-
-[couch_httpd_auth]
-; If you set this to true, you should also uncomment the WWW-Authenticate line
-; above. If you don't configure a WWW-Authenticate header, CouchDB will send
-; Basic realm="server" in order to prevent you getting logged out.
-; require_valid_user = false
-
-[log]
-;level = debug
-
-[os_daemons]
-; For any commands listed here, CouchDB will attempt to ensure that
-; the process remains alive while CouchDB runs as well as shut them
-; down when CouchDB exits.
-;foo = /path/to/command -with args
-
-[daemons]
-; enable SSL support by uncommenting the following line and supply the PEM's below.
-; the default ssl port CouchDB listens on is 6984
-;httpsd = {couch_httpd, start_link, [https]}
-
-[ssl]
-;cert_file = /etc/couchdb/server_cert.pem
-;key_file  = /etc/couchdb/server_key.pem
-;password = somepassword
-; set to true to validate peer certificates
-;verify_ssl_certificates = false
-; Path to file containing PEM encoded CA certificates (trusted
-; certificates used for verifying a peer certificate). May be omitted if
-; you do not want to verify the peer.
-;cacert_file = /full/path/to/cacertf
-; The verification fun (optionnal) if not specidied, the default
-; verification fun will be used.
-;verify_fun = {Module, VerifyFun}
-;ssl_certificate_max_depth = 1
-; To enable Virtual Hosts in CouchDB, add a vhost = path directive. All requests to
-; the Virual Host will be redirected to the path. In the example below all requests
-; to http://example.com/ are redirected to /database.
-; If you run CouchDB on a specific port, include the port number in the vhost:
-; example.com:5984 = /database
-
-[vhosts]
-;example.com = /database/
-
-[update_notification]
-;unique notifier name=/full/path/to/exe -with "cmd line arg"
-
-; To create an admin account uncomment the '[admins]' section below and add a
-; line in the format 'username = password'. When you next start CouchDB, it
-; will change the password to a hash (so that your passwords don't linger
-; around in plain-text files). You can add more admin accounts with more
-; 'username = password' lines. Don't forget to restart CouchDB after
-; changing this.
-;[admins]
-;admin = mysecretpassword
+[compactions]
+_default = [{db_fragmentation, "70%"}, {view_fragmentation, "60%"}, {from, "03:00"}, {to, "05:00"}]
-- 
cgit v1.2.3


From 46af641b65a530a6afc238d554d0b71e5d99f9d5 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 31 May 2016 13:45:36 -0400
Subject: Disable puppet-agent daemon from running.

The agent wakes up every two minutes and tries to connect to the default
server, failing with a certificate warning. We don't use the agent, so
we can safely disable it (#8032)

Change-Id: I707f42b59205993325431aba283552b1b73a0ad1
---
 puppet/modules/site_config/manifests/default.pp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index 256de1a1..9bc8c30d 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -7,8 +7,9 @@ class site_config::default {
   include site_config::params
   include site_config::setup
 
-  # default class, used by all hosts
+  service { 'puppet': ensure => stopped }
 
+  # default class, used by all hosts
   include lsb, git
 
   # configure sysctl parameters
-- 
cgit v1.2.3


From 4d92b3a758e16fa2c7ee34a06272bd64a5c038ad Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 31 May 2016 15:39:59 -0400
Subject: Reduce check_mk timeouts (#7807).

check_mk operations can take a long time (such as when doing a
re-inventory using "check_mk -II") when multiple hosts are down. This
decreases the connect timeout to 5 seconds.

Change-Id: I1eac5f14bad2afc2ffc4cbf8c950c24b052a0d6e
---
 puppet/modules/site_check_mk/templates/use_ssh.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/templates/use_ssh.mk b/puppet/modules/site_check_mk/templates/use_ssh.mk
index 55269536..25f951e0 100644
--- a/puppet/modules/site_check_mk/templates/use_ssh.mk
+++ b/puppet/modules/site_check_mk/templates/use_ssh.mk
@@ -1,6 +1,6 @@
 # http://mathias-kettner.de/checkmk_datasource_programs.html
 datasource_programs = [
 <% @nagios_hosts.sort.each do |name,config| %>
- ( "ssh -l root -i /etc/check_mk/.ssh/id_rsa -p <%=config['ssh_port']%> <%=config['domain_internal']%> check_mk_agent", [ "<%=config['domain_internal']%>" ], ),<%- end -%>
+ ( "ssh -o ConnectTimeout=5 -l root -i /etc/check_mk/.ssh/id_rsa -p <%=config['ssh_port']%> <%=config['domain_internal']%> check_mk_agent", [ "<%=config['domain_internal']%>" ], ),<%- end -%>
 
 ]
-- 
cgit v1.2.3


From 8ce5fe27d53e0e1f5f36a9de812069a823d59222 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 1 Jun 2016 13:08:38 -0700
Subject: ensure soledad server has access to x509::variables

---
 puppet/modules/soledad/manifests/server.pp | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/soledad/manifests/server.pp b/puppet/modules/soledad/manifests/server.pp
index 8674f421..6cf806d0 100644
--- a/puppet/modules/soledad/manifests/server.pp
+++ b/puppet/modules/soledad/manifests/server.pp
@@ -17,6 +17,7 @@ class soledad::server {
 
   $sources      = hiera('sources')
 
+  include x509::variables
   include site_config::x509::cert
   include site_config::x509::key
   include site_config::x509::ca
-- 
cgit v1.2.3


From 5b2cb9a14bf5735e61e148c21496677c8458bd63 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 1 Jun 2016 13:08:38 -0700
Subject: ensure soledad server has access to x509::variables

---
 puppet/modules/soledad/manifests/server.pp | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/soledad/manifests/server.pp b/puppet/modules/soledad/manifests/server.pp
index 8674f421..6cf806d0 100644
--- a/puppet/modules/soledad/manifests/server.pp
+++ b/puppet/modules/soledad/manifests/server.pp
@@ -17,6 +17,7 @@ class soledad::server {
 
   $sources      = hiera('sources')
 
+  include x509::variables
   include site_config::x509::cert
   include site_config::x509::key
   include site_config::x509::ca
-- 
cgit v1.2.3


From 954a746947b7395fe3252e9df371da30546ee762 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 2 Jun 2016 12:42:10 -0400
Subject: Fix opendkim milter location (#8163).

The unix socket method for connecting to the milter was incorrectly
reverted, this puts it back to how it should be.

Change-Id: Ifde669c920a249c782f577a112f4d45e60a889a2
---
 puppet/modules/site_postfix/manifests/mx.pp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp
index c269946b..e743118e 100644
--- a/puppet/modules/site_postfix/manifests/mx.pp
+++ b/puppet/modules/site_postfix/manifests/mx.pp
@@ -69,10 +69,10 @@ class site_postfix::mx {
       value => '$alias_maps';
     # setup clamav and opendkim on smtpd
     'smtpd_milters':
-      value => 'unix:/run/clamav/milter.ctl,inet:localhost:8891';
+      value => 'unix:/run/clamav/milter.ctl,unix:/run/opendkim/opendkim.sock';
     # setup opendkim for smtp (non-smtpd) outgoing mail
     'non_smtpd_milters':
-      value => 'inet:localhost:8891';
+      value => 'unix:/run/opendkim/opendkim.sock';
     'milter_default_action':
       value => 'accept';
     # Make sure that the right values are set, these could be set to different
-- 
cgit v1.2.3


From 2e5657647ed790eec8bd679c47eb57bd4eaed621 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Fri, 3 Jun 2016 12:02:09 -0700
Subject: auto run bundler when needed for site_static

---
 puppet/modules/site_static/manifests/location.pp | 13 +++++++++++++
 1 file changed, 13 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_static/manifests/location.pp b/puppet/modules/site_static/manifests/location.pp
index d116de2f..ab2b7494 100644
--- a/puppet/modules/site_static/manifests/location.pp
+++ b/puppet/modules/site_static/manifests/location.pp
@@ -23,6 +23,19 @@ define site_static::location($path, $format, $source) {
     }
   }
 
+  if ($format == 'rack') {
+    # Run bundler if there is a Gemfile
+    exec { 'bundler_update':
+      cwd     => $file_path,
+      command => '/bin/bash -c "/usr/bin/bundle check --path vendor/bundle || /usr/bin/bundle install --path vendor/bundle --without test development debug"',
+      unless  => '/usr/bin/bundle check --path vendor/bundle',
+      onlyif  => 'test -f Gemfile',
+      user    => 'www-data',
+      timeout => 600,
+      require => [Class['bundler::install'], Class['site_config::ruby::dev']];
+    }
+  }
+
   vcsrepo { $file_path:
     ensure   => present,
     force    => true,
-- 
cgit v1.2.3


From edde26f34f7fea1756fdf58b352329e61787b882 Mon Sep 17 00:00:00 2001
From: Christoph Kluenter <ckluente@thoughtworks.com>
Date: Mon, 6 Jun 2016 10:14:50 +0200
Subject: debian packages don't know AllowSupplementaryGroups

if this is set in the config, the deamons do not
start anymore. From the debian changelog:

  clamav (0.99.2+dfsg-0+deb8u1) stable; urgency=medium
  * Import new Upstream.
  * Drop AllowSupplementaryGroups option which is default now
    (Closes: #822444).
---
 puppet/modules/clamav/templates/clamav-milter.conf.erb | 1 -
 1 file changed, 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/clamav/templates/clamav-milter.conf.erb b/puppet/modules/clamav/templates/clamav-milter.conf.erb
index 9bf7099e..50b4c620 100644
--- a/puppet/modules/clamav/templates/clamav-milter.conf.erb
+++ b/puppet/modules/clamav/templates/clamav-milter.conf.erb
@@ -4,7 +4,6 @@ FixStaleSocket true
 User clamav
 MilterSocketGroup clamav
 MilterSocketMode 666
-AllowSupplementaryGroups true
 ReadTimeout 120
 Foreground false
 PidFile /var/run/clamav/clamav-milter.pid
-- 
cgit v1.2.3


From c0cbf928c057d299f533a2a8b61bb54cc6ba5974 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 7 Jun 2016 15:26:01 -0400
Subject: refresh_stunnel sometimes doesn't run (#8168).

It turns out that in some corner-cases, the script is not called:

 (1) start the deploy, create files in /var/lib/puppet/stunnel4/config
 (2) halt puppet before apply finishes
 (3) re-run deploy

in this scenario, next time you run deploy, refresh_stunnel will never
get called to populate /etc/stunnel, because the files in
/var/lib/puppet/stunnel4/config haven't changed.

This problem can be really confusing when it happens.

To fix this, we just run refresh_stunnel every, it is pretty fast and
the script has more complete logic for what to do than puppet, which has
only an asymmetrical view on the situation.

Change-Id: I9e5fad1d081c2fe07f3ac8f07cfb87d86b88f7c9
---
 puppet/modules/stunnel | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/stunnel b/puppet/modules/stunnel
index 79e874c1..008777bd 160000
--- a/puppet/modules/stunnel
+++ b/puppet/modules/stunnel
@@ -1 +1 @@
-Subproject commit 79e874c1a86ad5c48c4e726a5d4c68bd879ce454
+Subproject commit 008777bd9837c87a8f501f36dbf2bd4f79c8c868
-- 
cgit v1.2.3


From 543e5108d6b50928cac3c7e031e6a96d5f664ee1 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sat, 11 Jun 2016 15:27:45 +0200
Subject: Move custom functions to site_config module

---
 .../parser/functions/create_resources_hash_from.rb | 116 ++++++
 .../lib/puppet/parser/functions/sorted_json.rb     |  47 +++
 .../lib/puppet/parser/functions/sorted_yaml.rb     | 400 +++++++++++++++++++++
 3 files changed, 563 insertions(+)
 create mode 100644 puppet/modules/site_config/lib/puppet/parser/functions/create_resources_hash_from.rb
 create mode 100644 puppet/modules/site_config/lib/puppet/parser/functions/sorted_json.rb
 create mode 100644 puppet/modules/site_config/lib/puppet/parser/functions/sorted_yaml.rb

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_config/lib/puppet/parser/functions/create_resources_hash_from.rb b/puppet/modules/site_config/lib/puppet/parser/functions/create_resources_hash_from.rb
new file mode 100644
index 00000000..47d0df9c
--- /dev/null
+++ b/puppet/modules/site_config/lib/puppet/parser/functions/create_resources_hash_from.rb
@@ -0,0 +1,116 @@
+#
+# create_resources_hash_from.rb
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module Puppet::Parser::Functions
+  newfunction(:create_resources_hash_from, :type => :rvalue, :doc => <<-EOS
+Given:
+    A formatted string (to use as the resource name)
+    An array to loop through (because puppet cannot loop)
+    A hash defining the parameters for a resource
+    And optionally an hash of parameter names to add to the resource and an
+      associated formatted string that should be configured with the current
+      element of the loop array
+
+This function will return a hash of hashes that can be used with the
+create_resources function.
+
+*Examples:*
+    $allowed_hosts = ['10.0.0.0/8', '192.168.0.0/24']
+    $resource_name = "100 allow %s to apache on ports 80"
+    $my_resource_hash = {
+      'proto'  => 'tcp',
+      'action' => 'accept',
+      'dport'  => 80
+    }
+    $dynamic_parameters = {
+      'source' => '%s'
+    }
+
+    $created_resource_hash = create_resources_hash_from($resource_name, $allowed_hosts, $my_resource_hash, $dynamic_parameters)
+
+$created_resource_hash would equal:
+    {
+      '100 allow 10.0.0.0/8 to apache on ports 80' => {
+        'proto' => 'tcp',
+        'action' => 'accept',
+        'dport' => 80,
+        'source' => '10.0.0.0/8'
+      },
+      '100 allow 192.168.0.0/24 to apache on ports 80' => {
+        'proto' => 'tcp',
+        'action' => 'accept',
+        'dport' => 80,
+        'source' => '192.168.0.0/24'
+      }
+    }
+
+$created_resource_hash could then be used with create_resources
+
+    create_resources(firewall, $created_resource_hash)
+
+To create a bunch of resources in a way that would only otherwise be possible
+with a loop of some description.
+    EOS
+  ) do |arguments|
+
+    raise Puppet::ParseError, "create_resources_hash_from(): Wrong number of arguments " +
+      "given (#{arguments.size} for 3 or 4)" if arguments.size < 3 or arguments.size > 4
+
+    formatted_string = arguments[0]
+
+    unless formatted_string.is_a?(String)
+      raise(Puppet::ParseError, 'create_resources_hash_from(): first argument must be a string')
+    end
+
+    loop_array = arguments[1]
+
+    unless loop_array.is_a?(Array)
+      raise(Puppet::ParseError, 'create_resources_hash_from(): second argument must be an array')
+    end
+
+    resource_hash = arguments[2]
+    unless resource_hash.is_a?(Hash)
+      raise(Puppet::ParseError, 'create_resources_hash_from(): third argument must be a hash')
+    end
+
+    if arguments.size == 4
+      dynamic_parameters = arguments[3]
+      unless dynamic_parameters.is_a?(Hash)
+        raise(Puppet::ParseError, 'create_resources_hash_from(): fourth argument must be a hash')
+      end
+    end
+
+    result = {}
+
+    loop_array.each do |i|
+      my_resource_hash = resource_hash.clone
+      if dynamic_parameters
+        dynamic_parameters.each do |param, value|
+          if my_resource_hash.member?(param)
+            raise(Puppet::ParseError, "create_resources_hash_from(): dynamic_parameter '#{param}' already exists in resource hash")
+          end
+          my_resource_hash[param] = sprintf(value,[i])
+        end
+      end
+      result[sprintf(formatted_string,[i])] = my_resource_hash
+    end
+
+    result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
+# encoding: utf-8
diff --git a/puppet/modules/site_config/lib/puppet/parser/functions/sorted_json.rb b/puppet/modules/site_config/lib/puppet/parser/functions/sorted_json.rb
new file mode 100644
index 00000000..605da00e
--- /dev/null
+++ b/puppet/modules/site_config/lib/puppet/parser/functions/sorted_json.rb
@@ -0,0 +1,47 @@
+#
+# Written by Gavin Mogan, from https://gist.github.com/halkeye/2287885
+# Put in the public domain by the author.
+#
+
+require 'json'
+
+def sorted_json(obj)
+  case obj
+    when String, Fixnum, Float, TrueClass, FalseClass, NilClass
+      return obj.to_json
+    when Array
+      arrayRet = []
+      obj.each do |a|
+        arrayRet.push(sorted_json(a))
+      end
+      return "[" << arrayRet.join(',') << "]";
+    when Hash
+      ret = []
+      obj.keys.sort.each do |k|
+        ret.push(k.to_json << ":" << sorted_json(obj[k]))
+      end
+      return "{" << ret.join(",") << "}";
+    else
+      raise Exception("Unable to handle object of type <%s>" % obj.class.to_s)
+  end
+end
+
+module Puppet::Parser::Functions
+  newfunction(:sorted_json, :type => :rvalue, :doc => <<-EOS
+This function takes data, outputs making sure the hash keys are sorted
+
+*Examples:*
+
+    sorted_json({'key'=>'value'})
+
+Would return: {'key':'value'}
+    EOS
+  ) do |arguments|
+    raise(Puppet::ParseError, "sorted_json(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size != 1
+
+    json = arguments[0]
+    return sorted_json(json)
+  end
+end
+
diff --git a/puppet/modules/site_config/lib/puppet/parser/functions/sorted_yaml.rb b/puppet/modules/site_config/lib/puppet/parser/functions/sorted_yaml.rb
new file mode 100644
index 00000000..46cd46ce
--- /dev/null
+++ b/puppet/modules/site_config/lib/puppet/parser/functions/sorted_yaml.rb
@@ -0,0 +1,400 @@
+# encoding: UTF-8
+#
+# provides sorted_yaml() function, using Ya2YAML.
+# see https://github.com/afunai/ya2yaml
+#
+
+class Ya2YAML
+  #
+  # Author::    Akira FUNAI
+  # Copyright:: Copyright (c) 2006-2010 Akira FUNAI
+  # License::   MIT License
+  #
+
+  def initialize(opts = {})
+    options = opts.dup
+    options[:indent_size] = 2          if options[:indent_size].to_i <= 0
+    options[:minimum_block_length] = 0 if options[:minimum_block_length].to_i <= 0
+    options.update(
+      {
+        :printable_with_syck  => true,
+        :escape_b_specific    => true,
+        :escape_as_utf8       => true,
+      }
+    ) if options[:syck_compatible]
+
+    @options = options
+  end
+
+  def _ya2yaml(obj)
+    #raise 'set $KCODE to "UTF8".' if (RUBY_VERSION < '1.9.0') && ($KCODE != 'UTF8')
+    if (RUBY_VERSION < '1.9.0')
+      $KCODE = 'UTF8'
+    end
+    '--- ' + emit(obj, 1) + "\n"
+  rescue SystemStackError
+    raise ArgumentError, "ya2yaml can't handle circular references"
+  end
+
+  private
+
+  def emit(obj, level)
+    case obj
+      when Array
+        if (obj.length == 0)
+          '[]'
+        else
+          indent = "\n" + s_indent(level - 1)
+          ###
+          ### NOTE: a minor modification to normal Ya2YAML...
+          ### We want arrays to be output in sorted order, not just
+          ### Hashes.
+          ###
+          #obj.collect {|o|
+          #  indent + '- ' + emit(o, level + 1)
+          #}.join('')
+          obj.sort {|a,b| a.to_s <=> b.to_s}.collect {|o|
+            indent + '- ' + emit(o, level + 1)
+          }.join('')
+        end
+      when Hash
+        if (obj.length == 0)
+          '{}'
+        else
+          indent = "\n" + s_indent(level - 1)
+          hash_order = @options[:hash_order]
+          if (hash_order && level == 1)
+            hash_keys = obj.keys.sort {|x, y|
+              x_order = hash_order.index(x) ? hash_order.index(x) : Float::MAX
+              y_order = hash_order.index(y) ? hash_order.index(y) : Float::MAX
+              o = (x_order <=> y_order)
+              (o != 0) ? o : (x.to_s <=> y.to_s)
+            }
+          elsif @options[:preserve_order]
+            hash_keys = obj.keys
+          else
+            hash_keys = obj.keys.sort {|x, y| x.to_s <=> y.to_s }
+          end
+          hash_keys.collect {|k|
+            key = emit(k, level + 1)
+            if (
+              is_one_plain_line?(key) ||
+              key =~ /\A(#{REX_BOOL}|#{REX_FLOAT}|#{REX_INT}|#{REX_NULL})\z/x
+            )
+              indent + key + ': ' + emit(obj[k], level + 1)
+            else
+              indent + '? ' + key +
+              indent + ': ' + emit(obj[k], level + 1)
+            end
+          }.join('')
+        end
+      when NilClass
+        '~'
+      when String
+        emit_string(obj, level)
+      when TrueClass, FalseClass
+        obj.to_s
+      when Fixnum, Bignum, Float
+        obj.to_s
+      when Date
+        obj.to_s
+      when Time
+        offset = obj.gmtoff
+        off_hm = sprintf(
+          '%+.2d:%.2d',
+          (offset / 3600.0).to_i,
+          (offset % 3600.0) / 60
+        )
+        u_sec = (obj.usec != 0) ? sprintf(".%.6d", obj.usec) : ''
+        obj.strftime("%Y-%m-%d %H:%M:%S#{u_sec} #{off_hm}")
+      when Symbol
+        '!ruby/symbol ' + emit_string(obj.to_s, level)
+      when Range
+        '!ruby/range ' + obj.to_s
+      when Regexp
+        '!ruby/regexp ' + obj.inspect
+      else
+        case
+          when obj.is_a?(Struct)
+            struct_members = {}
+            obj.each_pair{|k, v| struct_members[k.to_s] = v }
+            '!ruby/struct:' + obj.class.to_s.sub(/^(Struct::(.+)|.*)$/, '\2') + ' ' +
+            emit(struct_members, level + 1)
+          else
+            # serialized as a generic object
+            object_members = {}
+            obj.instance_variables.each{|k, v|
+              object_members[k.to_s.sub(/^@/, '')] = obj.instance_variable_get(k)
+            }
+            '!ruby/object:' + obj.class.to_s + ' ' +
+            emit(object_members, level + 1)
+        end
+    end
+  end
+
+  def emit_string(str, level)
+    (is_string, is_printable, is_one_line, is_one_plain_line) = string_type(str)
+    if is_string
+      if is_printable
+        if is_one_plain_line
+          emit_simple_string(str, level)
+        else
+          (is_one_line || str.length < @options[:minimum_block_length]) ?
+            emit_quoted_string(str, level) :
+            emit_block_string(str, level)
+        end
+      else
+        emit_quoted_string(str, level)
+      end
+    else
+      emit_base64_binary(str, level)
+    end
+  end
+
+  def emit_simple_string(str, level)
+    str
+  end
+
+  def emit_block_string(str, level)
+    str = normalize_line_break(str)
+
+    indent = s_indent(level)
+    indentation_indicator = (str =~ /\A /) ? indent.size.to_s : ''
+    str =~ /(#{REX_NORMAL_LB}*)\z/
+    chomping_indicator = case $1.length
+      when 0
+        '-'
+      when 1
+        ''
+      else
+        '+'
+    end
+
+    str.chomp!
+    str.gsub!(/#{REX_NORMAL_LB}/) {
+      $1 + indent
+    }
+    '|' + indentation_indicator + chomping_indicator + "\n" + indent + str
+  end
+
+  def emit_quoted_string(str, level)
+    str = yaml_escape(normalize_line_break(str))
+    if (str.length < @options[:minimum_block_length])
+      str.gsub!(/#{REX_NORMAL_LB}/) { ESCAPE_SEQ_LB[$1] }
+    else
+      str.gsub!(/#{REX_NORMAL_LB}$/) { ESCAPE_SEQ_LB[$1] }
+      str.gsub!(/(#{REX_NORMAL_LB}+)(.)/) {
+        trail_c = $3
+        $1 + trail_c.sub(/([\t ])/) { ESCAPE_SEQ_WS[$1] }
+      }
+      indent = s_indent(level)
+      str.gsub!(/#{REX_NORMAL_LB}/) {
+        ESCAPE_SEQ_LB[$1] + "\\\n" + indent
+      }
+    end
+    '"' + str + '"'
+  end
+
+  def emit_base64_binary(str, level)
+    indent = "\n" + s_indent(level)
+    base64 = [str].pack('m')
+    '!binary |' + indent + base64.gsub(/\n(?!\z)/, indent)
+  end
+
+  def string_type(str)
+    if str.respond_to?(:encoding) && (!str.valid_encoding? || str.encoding == Encoding::ASCII_8BIT)
+      return false, false, false, false
+    end
+    (ucs_codes = str.unpack('U*')) rescue (
+      # ArgumentError -> binary data
+      return false, false, false, false
+    )
+    if (
+      @options[:printable_with_syck] &&
+      str =~ /\A#{REX_ANY_LB}* | #{REX_ANY_LB}*\z|#{REX_ANY_LB}{2}\z/
+    )
+      # detour Syck bug
+      return true, false, nil, false
+    end
+    ucs_codes.each {|ucs_code|
+      return true, false, nil, false unless is_printable?(ucs_code)
+    }
+    return true, true, is_one_line?(str), is_one_plain_line?(str)
+  end
+
+  def is_printable?(ucs_code)
+    # YAML 1.1 / 4.1.1.
+    (
+      [0x09, 0x0a, 0x0d, 0x85].include?(ucs_code)   ||
+      (ucs_code <=     0x7e && ucs_code >=    0x20) ||
+      (ucs_code <=   0xd7ff && ucs_code >=    0xa0) ||
+      (ucs_code <=   0xfffd && ucs_code >=  0xe000) ||
+      (ucs_code <= 0x10ffff && ucs_code >= 0x10000)
+    ) &&
+    !(
+      # treat LS/PS as non-printable characters
+      @options[:escape_b_specific] &&
+      (ucs_code == 0x2028 || ucs_code == 0x2029)
+    )
+  end
+
+  def is_one_line?(str)
+    str !~ /#{REX_ANY_LB}(?!\z)/
+  end
+
+  def is_one_plain_line?(str)
+    # YAML 1.1 / 4.6.11.
+    str !~ /^([\-\?:,\[\]\{\}\#&\*!\|>'"%@`\s]|---|\.\.\.)/    &&
+    str !~ /[:\#\s\[\]\{\},]/                                  &&
+    str !~ /#{REX_ANY_LB}/                                     &&
+    str !~ /^(#{REX_BOOL}|#{REX_FLOAT}|#{REX_INT}|#{REX_MERGE}
+      |#{REX_NULL}|#{REX_TIMESTAMP}|#{REX_VALUE})$/x
+  end
+
+  def s_indent(level)
+    # YAML 1.1 / 4.2.2.
+    ' ' * (level * @options[:indent_size])
+  end
+
+  def normalize_line_break(str)
+    # YAML 1.1 / 4.1.4.
+    str.gsub(/(#{REX_CRLF}|#{REX_CR}|#{REX_NEL})/, "\n")
+  end
+
+  def yaml_escape(str)
+    # YAML 1.1 / 4.1.6.
+    str.gsub(/[^a-zA-Z0-9]/u) {|c|
+      ucs_code, = (c.unpack('U') rescue [??])
+      case
+        when ESCAPE_SEQ[c]
+          ESCAPE_SEQ[c]
+        when is_printable?(ucs_code)
+          c
+        when @options[:escape_as_utf8]
+          c.respond_to?(:bytes) ?
+            c.bytes.collect {|b| '\\x%.2x' % b }.join :
+            '\\x' + c.unpack('H2' * c.size).join('\\x')
+        when ucs_code == 0x2028 || ucs_code == 0x2029
+          ESCAPE_SEQ_LB[c]
+        when ucs_code <= 0x7f
+          sprintf('\\x%.2x', ucs_code)
+        when ucs_code <= 0xffff
+          sprintf('\\u%.4x', ucs_code)
+        else
+          sprintf('\\U%.8x', ucs_code)
+      end
+    }
+  end
+
+  module Constants
+    UCS_0X85   = [0x85].pack('U')   #   c285@UTF8 Unicode next line
+    UCS_0XA0   = [0xa0].pack('U')   #   c2a0@UTF8 Unicode non-breaking space
+    UCS_0X2028 = [0x2028].pack('U') # e280a8@UTF8 Unicode line separator
+    UCS_0X2029 = [0x2029].pack('U') # e280a9@UTF8 Unicode paragraph separator
+
+    # non-break characters
+    ESCAPE_SEQ = {
+      "\x00" => '\\0',
+      "\x07" => '\\a',
+      "\x08" => '\\b',
+      "\x0b" => '\\v',
+      "\x0c" => '\\f',
+      "\x1b" => '\\e',
+      "\""   => '\\"',
+      "\\"   => '\\\\',
+    }
+
+    # non-breaking space
+    ESCAPE_SEQ_NS = {
+      UCS_0XA0 => '\\_',
+    }
+
+    # white spaces
+    ESCAPE_SEQ_WS = {
+      "\x09" => '\\t',
+      " "    => '\\x20',
+    }
+
+    # line breaks
+    ESCAPE_SEQ_LB ={
+      "\x0a"     => '\\n',
+      "\x0d"     => '\\r',
+      UCS_0X85   => '\\N',
+      UCS_0X2028 => '\\L',
+      UCS_0X2029 => '\\P',
+    }
+
+    # regexps for line breaks
+    REX_LF   = Regexp.escape("\x0a")
+    REX_CR   = Regexp.escape("\x0d")
+    REX_CRLF = Regexp.escape("\x0d\x0a")
+    REX_NEL  = Regexp.escape(UCS_0X85)
+    REX_LS   = Regexp.escape(UCS_0X2028)
+    REX_PS   = Regexp.escape(UCS_0X2029)
+
+    REX_ANY_LB    = /(#{REX_LF}|#{REX_CR}|#{REX_NEL}|#{REX_LS}|#{REX_PS})/
+    REX_NORMAL_LB = /(#{REX_LF}|#{REX_LS}|#{REX_PS})/
+
+    # regexps for language-Independent types for YAML1.1
+    REX_BOOL = /
+       y|Y|yes|Yes|YES|n|N|no|No|NO
+      |true|True|TRUE|false|False|FALSE
+      |on|On|ON|off|Off|OFF
+    /x
+    REX_FLOAT = /
+       [-+]?([0-9][0-9_]*)?\.[0-9.]*([eE][-+][0-9]+)? # (base 10)
+      |[-+]?[0-9][0-9_]*(:[0-5]?[0-9])+\.[0-9_]*      # (base 60)
+      |[-+]?\.(inf|Inf|INF)                           # (infinity)
+      |\.(nan|NaN|NAN)                                # (not a number)
+    /x
+    REX_INT = /
+       [-+]?0b[0-1_]+                   # (base 2)
+      |[-+]?0[0-7_]+                    # (base 8)
+      |[-+]?(0|[1-9][0-9_]*)            # (base 10)
+      |[-+]?0x[0-9a-fA-F_]+             # (base 16)
+      |[-+]?[1-9][0-9_]*(:[0-5]?[0-9])+ # (base 60)
+    /x
+    REX_MERGE = /
+      <<
+    /x
+    REX_NULL = /
+       ~              # (canonical)
+      |null|Null|NULL # (English)
+      |               # (Empty)
+    /x
+    REX_TIMESTAMP = /
+       [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9] # (ymd)
+      |[0-9][0-9][0-9][0-9]                       # (year)
+       -[0-9][0-9]?                               # (month)
+       -[0-9][0-9]?                               # (day)
+       ([Tt]|[ \t]+)[0-9][0-9]?                   # (hour)
+       :[0-9][0-9]                                # (minute)
+       :[0-9][0-9]                                # (second)
+       (\.[0-9]*)?                                # (fraction)
+       (([ \t]*)Z|[-+][0-9][0-9]?(:[0-9][0-9])?)? # (time zone)
+    /x
+    REX_VALUE = /
+      =
+    /x
+  end
+
+  include Constants
+end
+
+module Puppet::Parser::Functions
+  newfunction(:sorted_yaml,
+    :type => :rvalue,
+    :doc => "This function outputs yaml, but ensures the keys are sorted."
+    ) do |arguments|
+
+    if arguments.is_a?(Array)
+      if arguments.size != 1
+        raise(Puppet::ParseError, "sorted_yaml(): Wrong number of arguments given (#{arguments.size} for 1)")
+      end
+      yaml = arguments.first
+    else
+      yaml = arguments
+    end
+    return Ya2YAML.new()._ya2yaml(yaml)
+  end
+end
-- 
cgit v1.2.3


From f4f278ea62751220790dfc7fae58ecdc5756c4b5 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 14 Jun 2016 10:02:40 -0400
Subject: update stunnel module for refresh_stunnel fixes

Change-Id: I7675dbaba4d896a62dab9fcf4817092ea69f1298
---
 puppet/modules/stunnel | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/stunnel b/puppet/modules/stunnel
index 008777bd..421c8e52 160000
--- a/puppet/modules/stunnel
+++ b/puppet/modules/stunnel
@@ -1 +1 @@
-Subproject commit 008777bd9837c87a8f501f36dbf2bd4f79c8c868
+Subproject commit 421c8e527d57fd4d1221dbd341394d954cd38314
-- 
cgit v1.2.3


From 3aba84e808035a02c35bb64a04daccc5ab03e5db Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Tue, 14 Jun 2016 10:46:20 -0400
Subject: Ensure stunnel package, service and default ordering.

---
 puppet/modules/stunnel | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/stunnel b/puppet/modules/stunnel
index 421c8e52..4056d79a 160000
--- a/puppet/modules/stunnel
+++ b/puppet/modules/stunnel
@@ -1 +1 @@
-Subproject commit 421c8e527d57fd4d1221dbd341394d954cd38314
+Subproject commit 4056d79a2e07b7178cbbdb1576aa6f5ccd1d9e83
-- 
cgit v1.2.3


From bf6d0fe1b74910026d577b80e5894f22c6edfde7 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 14 Jun 2016 12:37:10 -0400
Subject: make sure required x509 bits are there before stunnel is started

Change-Id: I772c3b6e489e3c1848c45c6bcaa240324fc88928
---
 puppet/modules/site_stunnel/manifests/client.pp  | 6 +++++-
 puppet/modules/site_stunnel/manifests/servers.pp | 6 +++++-
 puppet/modules/stunnel                           | 2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_stunnel/manifests/client.pp b/puppet/modules/site_stunnel/manifests/client.pp
index c9e034f1..de9febd4 100644
--- a/puppet/modules/site_stunnel/manifests/client.pp
+++ b/puppet/modules/site_stunnel/manifests/client.pp
@@ -39,7 +39,11 @@ define site_stunnel::client (
     debuglevel => $debuglevel,
     sslversion => 'TLSv1',
     syslog     => 'no',
-    output     => $logfile;
+    output     => $logfile,
+    require    => [
+                   Class['Site_config::X509::Key'],
+                   Class['Site_config::X509::Cert'],
+                   Class['Site_config::X509::Ca'] ];
   }
 
   # define the log files so that we can purge the
diff --git a/puppet/modules/site_stunnel/manifests/servers.pp b/puppet/modules/site_stunnel/manifests/servers.pp
index e76d1e9d..3dc5dce6 100644
--- a/puppet/modules/site_stunnel/manifests/servers.pp
+++ b/puppet/modules/site_stunnel/manifests/servers.pp
@@ -39,7 +39,11 @@ define site_stunnel::servers (
     debuglevel => $debuglevel,
     sslversion => 'TLSv1',
     syslog     => 'no',
-    output     => $logfile;
+    output     => $logfile,
+    require    => [
+                   Class['Site_config::X509::Key'],
+                   Class['Site_config::X509::Cert'],
+                   Class['Site_config::X509::Ca'] ];
   }
 
   # allow incoming connections on $accept_port
diff --git a/puppet/modules/stunnel b/puppet/modules/stunnel
index 4056d79a..523612fb 160000
--- a/puppet/modules/stunnel
+++ b/puppet/modules/stunnel
@@ -1 +1 @@
-Subproject commit 4056d79a2e07b7178cbbdb1576aa6f5ccd1d9e83
+Subproject commit 523612fb6daff51837423619f5014e62dc835559
-- 
cgit v1.2.3


From 05c8afd886e31f7f46b07387ac8346b071f43e50 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 14 Jun 2016 12:51:08 -0400
Subject: switch to two-space soft tabs to fix lint error

Change-Id: Ic12b243b195e40482a70dd70219212c3697899ba
---
 puppet/modules/site_stunnel/manifests/client.pp  | 7 +++----
 puppet/modules/site_stunnel/manifests/servers.pp | 7 +++----
 2 files changed, 6 insertions(+), 8 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_stunnel/manifests/client.pp b/puppet/modules/site_stunnel/manifests/client.pp
index de9febd4..7c431c50 100644
--- a/puppet/modules/site_stunnel/manifests/client.pp
+++ b/puppet/modules/site_stunnel/manifests/client.pp
@@ -40,10 +40,9 @@ define site_stunnel::client (
     sslversion => 'TLSv1',
     syslog     => 'no',
     output     => $logfile,
-    require    => [
-                   Class['Site_config::X509::Key'],
-                   Class['Site_config::X509::Cert'],
-                   Class['Site_config::X509::Ca'] ];
+    require    => [ Class['Site_config::X509::Key'],
+                    Class['Site_config::X509::Cert'],
+                    Class['Site_config::X509::Ca'] ];
   }
 
   # define the log files so that we can purge the
diff --git a/puppet/modules/site_stunnel/manifests/servers.pp b/puppet/modules/site_stunnel/manifests/servers.pp
index 3dc5dce6..37aaf5a6 100644
--- a/puppet/modules/site_stunnel/manifests/servers.pp
+++ b/puppet/modules/site_stunnel/manifests/servers.pp
@@ -40,10 +40,9 @@ define site_stunnel::servers (
     sslversion => 'TLSv1',
     syslog     => 'no',
     output     => $logfile,
-    require    => [
-                   Class['Site_config::X509::Key'],
-                   Class['Site_config::X509::Cert'],
-                   Class['Site_config::X509::Ca'] ];
+    require    => [ Class['Site_config::X509::Key'],
+                    Class['Site_config::X509::Cert'],
+                    Class['Site_config::X509::Ca'] ];
   }
 
   # allow incoming connections on $accept_port
-- 
cgit v1.2.3


From 12b00fbf578d88281d3a00f268ffeda460d383d8 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 16 Jun 2016 11:39:11 -0400
Subject: Fix matching for cleanup check.

The onlyif check was incorrectly specified in the original implementation in
commit id: 15b83d88dcedab496a19cef57f11c5c8e091dd4a this inverts it so it
is properly detected.

Change-Id: I531e206fff1ca61780adcd195e1f917011e50fb4
---
 puppet/modules/site_postfix/manifests/mx.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp
index e743118e..0b760eb4 100644
--- a/puppet/modules/site_postfix/manifests/mx.pp
+++ b/puppet/modules/site_postfix/manifests/mx.pp
@@ -96,7 +96,7 @@ class site_postfix::mx {
   # access the opendkim milter socket (#8020)
   exec { 'unset_cleanup_chroot':
     command => '/usr/sbin/postconf -F "cleanup/unix/chroot=n"',
-    onlyif  => '/usr/sbin/postconf -h -F "cleanup/unix/chroot" | egrep -q ^n',
+    onlyif  => '/usr/sbin/postconf -h -F "cleanup/unix/chroot" | egrep -qv ^n',
     notify  => Service['postfix'],
     require => File['/etc/postfix/master.cf']
   }
-- 
cgit v1.2.3


From 293cdaee6db4a4d0b13a56fcd047819d60f38ce2 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 16 Jun 2016 12:24:01 -0400
Subject: Disable the Trace method (#8195)

The Trace method is enabled because of the Apache module, but it is not the
default in Debian, and it should not be enabled, for more information see the
following:

https://www.kb.cert.org/vuls/id/867593

Change-Id: I06a06ae679dbf7049f26a017125b61e5e38f6268
---
 puppet/modules/site_apache/files/conf.d/security | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/files/conf.d/security b/puppet/modules/site_apache/files/conf.d/security
index a5ae5bdc..fdcf6270 100644
--- a/puppet/modules/site_apache/files/conf.d/security
+++ b/puppet/modules/site_apache/files/conf.d/security
@@ -45,8 +45,8 @@ ServerSignature Off
 #
 # Set to one of:  On | Off | extended
 #
-#TraceEnable Off
-TraceEnable On
+TraceEnable Off
+#TraceEnable On
 
 # Setting this header will prevent other sites from embedding pages from this
 # site as frames. This defends against clickjacking attacks.
-- 
cgit v1.2.3


From 3df7a57d866cf1e6eda9bb9e3fe19c7387ec6c1d Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 21 Jun 2016 09:50:27 -0400
Subject: Fix hidden service static template (#8203).

Change-Id: Iab9597f5f0336f66df9b73fea9d79c789cbb8302
---
 puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
index 232b1577..697a7ff3 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
@@ -41,7 +41,7 @@
   DocumentRoot "/srv/static/root/public"
   <% if scope.function_guess_apache_version([]) == '2.4' %>
   <Directory /srv/static/root/public>
-    AllowOverride None
+    AllowOverride FileInfo Indexes Options=All,MultiViews
     Require all granted
   </Directory>
   <% end %>
-- 
cgit v1.2.3


From 8b69bebad7fe00886705f0402d542c1f11fba7b0 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 27 Jun 2016 13:32:21 +0200
Subject: Lint and Document site_webapp::hidden_service

---
 puppet/modules/site_webapp/manifests/hidden_service.pp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_webapp/manifests/hidden_service.pp b/puppet/modules/site_webapp/manifests/hidden_service.pp
index 72a2ce95..da2a5607 100644
--- a/puppet/modules/site_webapp/manifests/hidden_service.pp
+++ b/puppet/modules/site_webapp/manifests/hidden_service.pp
@@ -1,3 +1,4 @@
+# Configure tor hidden service for webapp
 class site_webapp::hidden_service {
   $tor              = hiera('tor')
   $hidden_service   = $tor['hidden_service']
@@ -8,7 +9,7 @@ class site_webapp::hidden_service {
   include apache::module::alias
   include apache::module::expires
   include apache::module::removeip
-  
+
   include tor::daemon
   tor::daemon::hidden_service { 'webapp': ports => [ '80 127.0.0.1:80'] }
 
@@ -40,7 +41,7 @@ class site_webapp::hidden_service {
   apache::module { 'status': ensure => present, conf_content => ' ' }
   # the access_compat module is required to enable Allow directives
   apache::module { 'access_compat': ensure => present }
-  
+
   apache::vhost::file {
     'hidden_service':
       content => template('site_apache/vhosts.d/hidden_service.conf.erb');
-- 
cgit v1.2.3


From b21a3e9126a1734b2cea975e57b5c9e8206f12fa Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Mon, 27 Jun 2016 15:49:30 -0700
Subject: Fix the permissions on the DOMAIN/provider.json file for static
 sites.

---
 .../templates/vhosts.d/hidden_service.conf.erb     |  2 +-
 .../modules/site_config/manifests/remove/files.pp  | 11 +++++++++++
 puppet/modules/site_static/manifests/init.pp       | 22 ++++++++++++++++++----
 .../modules/site_static/templates/apache.conf.erb  |  8 ++++++--
 4 files changed, 36 insertions(+), 7 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
index 697a7ff3..b34bd189 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
@@ -47,7 +47,7 @@
   <% end %>
   AccessFileName .htaccess
 
-  Alias /provider.json /srv/leap/provider.json
+  Alias /provider.json /srv/static/public/provider.json
   <Location /provider.json>
     Header set X-Minimum-Client-Version 0.5
   </Location>
diff --git a/puppet/modules/site_config/manifests/remove/files.pp b/puppet/modules/site_config/manifests/remove/files.pp
index 41d6462e..3de8d695 100644
--- a/puppet/modules/site_config/manifests/remove/files.pp
+++ b/puppet/modules/site_config/manifests/remove/files.pp
@@ -11,7 +11,18 @@
 
 class site_config::remove::files {
 
+  #
+  # Platform X removals
+  #
+
+  tidy {
+    '/srv/leap/provider.json':;
+  }
+
+  #
   # Platform 0.8 removals
+  #
+
   tidy {
     '/etc/default/leap_mx':;
     '/etc/logrotate.d/mx':;
diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 4a722d62..8063d432 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -13,20 +13,34 @@ class site_static {
   $bootstrap     = $static['bootstrap_files']
   $tor           = hiera('tor', false)
 
+  file {
+    '/srv/static/':
+      ensure => 'directory',
+      owner => 'root',
+      group => 'root',
+      mode  => '0744';
+    '/srv/static/public':
+      ensure => 'directory',
+      owner => 'root',
+      group => 'root',
+      mode  => '0744';
+  }
+
   if $bootstrap['enabled'] {
     $bootstrap_domain  = $bootstrap['domain']
     $bootstrap_client  = $bootstrap['client_version']
-    file { '/srv/leap/provider.json':
+    file { '/srv/static/public/provider.json':
       content => $bootstrap['provider_json'],
       owner   => 'www-data',
       group   => 'www-data',
-      mode    => '0444';
+      mode    => '0444',
+      notify  => Service[apache];
     }
     # It is important to always touch provider.json: the client needs to check x-min-client-version header,
     # but this is only sent when the file has been modified (otherwise 304 is sent by apache). The problem
     # is that changing min client version won't alter the content of provider.json, so we must touch it.
-    exec { '/bin/touch /srv/leap/provider.json':
-      require => File['/srv/leap/provider.json'];
+    exec { '/bin/touch /srv/static/public/provider.json':
+      require => File['/srv/static/public/provider.json'];
     }
   }
 
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index 6b969d1c..b3e5fc09 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -23,6 +23,10 @@
   bootstrap_client = scope.lookupvar('site_static::bootstrap_client')
 -%>
 
+<Directory "/srv/static/public/">
+  Require all granted
+</Directory>
+
 <VirtualHost *:80>
   ServerName <%= @domain %>
   ServerAlias www.<%= @domain %>
@@ -46,7 +50,7 @@
   #RewriteLogLevel 3
 
   Include include.d/ssl_common.inc
-  
+
 <%- if @tls_only -%>
   Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
 <%- end -%>
@@ -63,7 +67,7 @@
   AccessFileName .htaccess
 
 <%- if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) -%>
-  Alias /provider.json /srv/leap/provider.json
+  Alias /provider.json /srv/static/public/provider.json
   <Location /provider.json>
     Header set X-Minimum-Client-Version <%= bootstrap_client['min'] %>
   </Location>
-- 
cgit v1.2.3


From c7e0864ccb00c67f2dfe7cd8d5a1665c08dd6033 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 23 Jun 2016 14:05:20 -0400
Subject: Make sure bind9 doesn't take over unbound (#8213).

Change-Id: Icaab817870d005b7a854a3fb8c402705d0b2d77f
---
 puppet/modules/site_config/manifests/caching_resolver.pp | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_config/manifests/caching_resolver.pp b/puppet/modules/site_config/manifests/caching_resolver.pp
index 8bf465c1..59b135a3 100644
--- a/puppet/modules/site_config/manifests/caching_resolver.pp
+++ b/puppet/modules/site_config/manifests/caching_resolver.pp
@@ -2,10 +2,22 @@
 class site_config::caching_resolver {
   tag 'leap_base'
 
+  # We need to make sure Package['bind9'] isn't installed because when it is, it
+  # keeps unbound from running. Some base debian installs will install bind9,
+  # and then start it, so unbound will never get properly started. So this will
+  # make sure bind9 is removed before.
+  package { 'bind9':
+    ensure => absent
+  }
+  file { [ '/etc/default/bind9', '/etc/bind/named.conf.options' ]:
+    ensure => absent
+  }
+
   class { 'unbound':
     root_hints => false,
     anchor     => false,
     ssl        => false,
+    require    => Package['bind9'],
     settings   => {
       server => {
         verbosity      => '1',
-- 
cgit v1.2.3


From 9f2a4f859f42895969d96c25ac9941ff95a28d1f Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 23 Jun 2016 11:36:00 -0400
Subject: Reload tor if config or key is changed (#8210).

Change-Id: I3d733b6645c804a5fb337ad4b8edc59a66ad50b5
---
 puppet/modules/site_webapp/manifests/hidden_service.pp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_webapp/manifests/hidden_service.pp b/puppet/modules/site_webapp/manifests/hidden_service.pp
index da2a5607..ffc9888d 100644
--- a/puppet/modules/site_webapp/manifests/hidden_service.pp
+++ b/puppet/modules/site_webapp/manifests/hidden_service.pp
@@ -25,14 +25,16 @@ class site_webapp::hidden_service {
       source  => "/srv/leap/files/nodes/${::hostname}/tor.key",
       owner   => 'debian-tor',
       group   => 'debian-tor',
-      mode    => '0600';
+      mode    => '0600',
+      notify  => Service['tor'];
 
     '/var/lib/tor/webapp/hostname':
       ensure  => present,
       content => $tor_domain,
       owner   => 'debian-tor',
       group   => 'debian-tor',
-      mode    => '0600';
+      mode    => '0600',
+      notify  => Service['tor'];
   }
 
   # it is necessary to zero out the config of the status module
-- 
cgit v1.2.3


From 4cf9b7d34fce1c37d3b4bb16e62f078df642263b Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 23 Jun 2016 12:05:29 -0400
Subject: Stop tor from restarting on every deploy (#8211).

We were creating the hidden service name without a newline, and then tor
would be restarted and change the hidden service hostname file to have a
newline, which would then require that the next deploy would change that
file to not have a newline again.

This fixes that problem by making the hostname have a newline so it
matches what tor wants.

Change-Id: I38f450684d557cf943ec94f2f8e19cda3aefdf66
---
 puppet/modules/site_webapp/manifests/hidden_service.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_webapp/manifests/hidden_service.pp b/puppet/modules/site_webapp/manifests/hidden_service.pp
index ffc9888d..d2662b65 100644
--- a/puppet/modules/site_webapp/manifests/hidden_service.pp
+++ b/puppet/modules/site_webapp/manifests/hidden_service.pp
@@ -30,7 +30,7 @@ class site_webapp::hidden_service {
 
     '/var/lib/tor/webapp/hostname':
       ensure  => present,
-      content => $tor_domain,
+      content => "${tor_domain}\n",
       owner   => 'debian-tor',
       group   => 'debian-tor',
       mode    => '0600',
-- 
cgit v1.2.3


From 29d6b7dbbc3b9d8b11f0b215cad894fcfca9989c Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 23 Jun 2016 12:08:54 -0400
Subject: Make static tor hidden services work (#8212).

When tor hidden services were enabled for static sites, only a very
basic configuration was setup and it didn't take into account the
different location configurations that can be configured for a
static site.

This commit resolves that by making a site_static::hidden_service class
similar to the site_webapp::hidden_service class, and fixes up the
apache vhost template to properly create the location blocks for the
hidden service vhost.

Change-Id: Ice3586f4173bd2d1bd3defca29d21c7403d5a03a
---
 .../templates/vhosts.d/hidden_service.conf.erb     | 15 --------
 .../site_static/manifests/hidden_service.pp        | 37 ++++++++++++++++++
 puppet/modules/site_static/manifests/init.pp       | 20 +++++-----
 .../modules/site_static/templates/apache.conf.erb  | 45 +++++++++++++++++++++-
 4 files changed, 91 insertions(+), 26 deletions(-)
 create mode 100644 puppet/modules/site_static/manifests/hidden_service.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
index b34bd189..1d19094e 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
@@ -37,19 +37,4 @@
   </Location>
 <% end -%>
 
-<% if (defined? @services) and (@services.include? 'static') -%>
-  DocumentRoot "/srv/static/root/public"
-  <% if scope.function_guess_apache_version([]) == '2.4' %>
-  <Directory /srv/static/root/public>
-    AllowOverride FileInfo Indexes Options=All,MultiViews
-    Require all granted
-  </Directory>
-  <% end %>
-  AccessFileName .htaccess
-
-  Alias /provider.json /srv/static/public/provider.json
-  <Location /provider.json>
-    Header set X-Minimum-Client-Version 0.5
-  </Location>
-<% end -%>
 </VirtualHost>
diff --git a/puppet/modules/site_static/manifests/hidden_service.pp b/puppet/modules/site_static/manifests/hidden_service.pp
new file mode 100644
index 00000000..f1f15f8e
--- /dev/null
+++ b/puppet/modules/site_static/manifests/hidden_service.pp
@@ -0,0 +1,37 @@
+# create hidden service for static sites
+class site_static::hidden_service {
+
+  include tor::daemon
+  tor::daemon::hidden_service { 'static': ports => [ '80 127.0.0.1:80'] }
+  file {
+    '/var/lib/tor/webapp/':
+      ensure  => directory,
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '2700';
+
+    '/var/lib/tor/static/private_key':
+      ensure  => present,
+      source  => "/srv/leap/files/nodes/${::hostname}/tor.key",
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '0600',
+      notify  => Service['tor'];
+
+    '/var/lib/tor/static/hostname':
+      ensure  => present,
+      content => "${::site_static::tor_domain}\n",
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '0600',
+      notify  => Service['tor'];
+  }
+
+  # it is necessary to zero out the config of the status module
+  # because we are configuring our own version that is unavailable
+  # over the hidden service (see: #7456 and #7776)
+  apache::module { 'status': ensure => present, conf_content => ' ' }
+
+  include site_shorewall::tor
+}
+
diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 8063d432..4912fbab 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -7,11 +7,14 @@ class site_static {
   include site_config::x509::key
   include site_config::x509::ca_bundle
 
-  $static        = hiera('static')
-  $domains       = $static['domains']
-  $formats       = $static['formats']
-  $bootstrap     = $static['bootstrap_files']
-  $tor           = hiera('tor', false)
+  $static         = hiera('static')
+  $domains        = $static['domains']
+  $formats        = $static['formats']
+  $bootstrap      = $static['bootstrap_files']
+
+  $tor            = hiera('tor', false)
+  $hidden_service = $tor['hidden_service']
+  $tor_domain     = "${hidden_service['address']}.onion"
 
   file {
     '/srv/static/':
@@ -71,15 +74,14 @@ class site_static {
     }
   }
 
-  create_resources(site_static::domain, $domains)
-
   if $tor {
-    $hidden_service = $tor['hidden_service']
     if $hidden_service['active'] {
-      include site_webapp::hidden_service
+      include site_static::hidden_service
     }
   }
 
+  create_resources(site_static::domain, $domains)
+
   include site_shorewall::defaults
   include site_shorewall::service::http
   include site_shorewall::service::https
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index b3e5fc09..2013e5ee 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -27,12 +27,52 @@
   Require all granted
 </Directory>
 
+<%- if @tor -%>
+<VirtualHost 127.0.0.1:80>
+  ServerName <%= @tor_domain %>
+  ServerAlias www.<%= @tor_domain %>
+
+  <IfModule mod_headers.c>
+    Header set X-Frame-Options "deny"
+    Header always unset X-Powered-By
+    Header always unset X-Runtime
+  </IfModule>
+
+  DocumentRoot "/<%= @document_root %>/"
+  AccessFileName .htaccess
+
+<%- if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) -%>
+  Alias /provider.json /srv/leap/provider.json
+  <Location /provider.json>
+    Header set X-Minimum-Client-Version <%= bootstrap_client['min'] %>
+  </Location>
+<%- end -%>
+
+<%- if @apache_config -%>
+<%=   @apache_config.gsub(':percent:','%') %>
+<%- end -%>
+
+<%- @locations && @locations.each do |name, location| -%>
+<%-   location_path = location['path'].gsub(%r{^/|/$}, '') -%>
+<%-   directory = location_directory(name, location) -%>
+<%-   local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name} -%>
+<%-   template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb' -%>
+<%-   break unless File.exists?(template_path) -%>
+  ##
+  ## <%= name %> (<%= location['format'] %>)
+  ##
+<%=   scope.function_templatewlv([template_path, local_vars]) %>
+<%- end -%>
+<%- end -%>
+</VirtualHost>
+
 <VirtualHost *:80>
   ServerName <%= @domain %>
   ServerAlias www.<%= @domain %>
 <%- @aliases && @aliases.each do |domain_alias| -%>
   ServerAlias <%= domain_alias %>
 <%- end -%>
+
 <%- if @tls_only -%>
   RewriteEngine On
   RewriteRule ^.*$ https://<%= @domain -%>%{REQUEST_URI} [R=permanent,L]
@@ -50,13 +90,15 @@
   #RewriteLogLevel 3
 
   Include include.d/ssl_common.inc
-
+  
+  <IfModule mod_headers.c>
 <%- if @tls_only -%>
   Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
 <%- end -%>
   Header set X-Frame-Options "deny"
   Header always unset X-Powered-By
   Header always unset X-Runtime
+  </IfModule>
 
   SSLCertificateKeyFile    /etc/x509/keys/<%= @domain %>.key
   SSLCertificateFile       /etc/x509/certs/<%= @domain %>.crt
@@ -88,5 +130,4 @@
   ##
 <%=   scope.function_templatewlv([template_path, local_vars]) %>
 <%- end -%>
-
 </VirtualHost>
-- 
cgit v1.2.3


From 8e0fdbb46761505b9188c9ea2a6c0df0c55ac458 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 28 Jun 2016 21:56:31 -0400
Subject: Fix for when tor is not an array.

When tor is not configured, then its possible to get this error on
deploy:

Error: tor is not a hash or array when accessing it with hidden_service
at /srv/leap/puppet/modules/site_static/manifests/init.pp:16 on node
rewdevstatic1.rewire.org

This commit only accesses the array when its enabled.

Change-Id: Ia75ac7a51179da980966adba0cc614b9cd642b0c
---
 puppet/modules/site_static/manifests/init.pp | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 4912fbab..0acfc223 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -11,10 +11,7 @@ class site_static {
   $domains        = $static['domains']
   $formats        = $static['formats']
   $bootstrap      = $static['bootstrap_files']
-
   $tor            = hiera('tor', false)
-  $hidden_service = $tor['hidden_service']
-  $tor_domain     = "${hidden_service['address']}.onion"
 
   file {
     '/srv/static/':
@@ -75,6 +72,8 @@ class site_static {
   }
 
   if $tor {
+    $hidden_service = $tor['hidden_service']
+    $tor_domain     = "${hidden_service['address']}.onion"
     if $hidden_service['active'] {
       include site_static::hidden_service
     }
-- 
cgit v1.2.3


From d0ff379fe2a43d7968b8828c8b31af5254f6f85b Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 28 Jun 2016 13:16:47 -0400
Subject: Remove bigcouch (#8056)

Change-Id: I0c6e27298c63bd37de1410985d054799818c22a4
---
 .../files/agent/logwatch/bigcouch.cfg              |  28 --
 .../agent/nagios_plugins/check_unix_open_fds.pl    | 322 ---------------------
 .../site_check_mk/manifests/agent/couchdb.pp       |  20 +-
 .../manifests/agent/couchdb/bigcouch.pp            |  49 ----
 .../site_check_mk/manifests/agent/couchdb/plain.pp |  23 --
 .../site_config/manifests/remove/bigcouch.pp       |  27 ++
 puppet/modules/site_couchdb/files/runit_config     |   6 -
 puppet/modules/site_couchdb/manifests/bigcouch.pp  |  50 ----
 .../site_couchdb/manifests/bigcouch/add_nodes.pp   |   8 -
 .../site_couchdb/manifests/bigcouch/compaction.pp  |   8 -
 .../manifests/bigcouch/settle_cluster.pp           |  11 -
 puppet/modules/site_couchdb/manifests/init.pp      |   9 +-
 puppet/modules/site_couchdb/manifests/logrotate.pp |  14 -
 puppet/modules/site_couchdb/manifests/plain.pp     |   2 -
 puppet/modules/site_couchdb/manifests/setup.pp     |   7 -
 15 files changed, 29 insertions(+), 555 deletions(-)
 delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/bigcouch.cfg
 delete mode 100755 puppet/modules/site_check_mk/files/agent/nagios_plugins/check_unix_open_fds.pl
 delete mode 100644 puppet/modules/site_check_mk/manifests/agent/couchdb/bigcouch.pp
 delete mode 100644 puppet/modules/site_check_mk/manifests/agent/couchdb/plain.pp
 delete mode 100644 puppet/modules/site_couchdb/files/runit_config
 delete mode 100644 puppet/modules/site_couchdb/manifests/bigcouch.pp
 delete mode 100644 puppet/modules/site_couchdb/manifests/bigcouch/add_nodes.pp
 delete mode 100644 puppet/modules/site_couchdb/manifests/bigcouch/compaction.pp
 delete mode 100644 puppet/modules/site_couchdb/manifests/bigcouch/settle_cluster.pp
 delete mode 100644 puppet/modules/site_couchdb/manifests/logrotate.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/bigcouch.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/bigcouch.cfg
deleted file mode 100644
index 0f378a5a..00000000
--- a/puppet/modules/site_check_mk/files/agent/logwatch/bigcouch.cfg
+++ /dev/null
@@ -1,28 +0,0 @@
-/opt/bigcouch/var/log/bigcouch.log nocontext=1
-# ignore requests that are fine
- I undefined - -.*200$
- I undefined - -.*201$
- I 127.0.0.1 undefined.* ok
- I 127.0.0.1 localhost:5984 .* ok
- # https://leap.se/code/issues/5246
- I Shutting down group server
- # ignore bigcouch conflict errors
- I Error in process.*{{nocatch,conflict}
- # ignore "Uncaught error in HTTP request: {exit, normal}" error
- # it's suppressed in later versions of bigcouch anhow
- # see https://leap.se/code/issues/5226
- I Uncaught error in HTTP request: {exit,normal}
- I Uncaught error in HTTP request: {exit,
- # Ignore rexi_EXIT bigcouch error (Bug #6512) 
- I Error in process <[0-9.]+> on node .* with exit value: {{rexi_EXIT,{(killed|noproc|shutdown),\[{couch_db,collect_results
- # Ignore "Generic server terminating" bigcouch message (Feature #6544)
- I Generic server <.*> terminating
- I {error_report,<.*>,
- I {error_info,
- C Uncaught error in HTTP request: {error,
- C Response abnormally terminated: {nodedown,
- C rexi_DOWN,noproc
- C rexi_DOWN,noconnection
- C error
- C Connection attempt from disallowed node
- W Apache CouchDB has started
diff --git a/puppet/modules/site_check_mk/files/agent/nagios_plugins/check_unix_open_fds.pl b/puppet/modules/site_check_mk/files/agent/nagios_plugins/check_unix_open_fds.pl
deleted file mode 100755
index 06163d49..00000000
--- a/puppet/modules/site_check_mk/files/agent/nagios_plugins/check_unix_open_fds.pl
+++ /dev/null
@@ -1,322 +0,0 @@
-#!/usr/bin/perl -w
-
-# check_unix_open_fds Nagios Plugin
-#
-# TComm - Carlos Peris Pla
-#
-# This nagios plugin is free software, and comes with ABSOLUTELY 
-# NO WARRANTY. It may be used, redistributed and/or modified under 
-# the terms of the GNU General Public Licence (see 
-# http://www.fsf.org/licensing/licenses/gpl.txt).
-
-
-# MODULE DECLARATION
-
-use strict;
-use Nagios::Plugin;
-
-
-# FUNCTION DECLARATION
-
-sub CreateNagiosManager ();
-sub CheckArguments ();
-sub PerformCheck ();
-
-
-# CONSTANT DEFINITION
-
-use constant NAME => 	'check_unix_open_fds';
-use constant VERSION => '0.1b';
-use constant USAGE => 	"Usage:\ncheck_unix_open_fds -w <process_threshold,application_threshold> -c <process_threshold,application_threshold>\n".
-						"\t\t[-V <version>]\n";
-use constant BLURB => 	"This plugin checks, in UNIX systems with the command lsof installed and with its SUID bit activated, the number\n".
-						"of file descriptors opened by an application and its processes.\n";
-use constant LICENSE => "This nagios plugin is free software, and comes with ABSOLUTELY\n".
-						"no WARRANTY. It may be used, redistributed and/or modified under\n".
-						"the terms of the GNU General Public Licence\n".
-						"(see http://www.fsf.org/licensing/licenses/gpl.txt).\n";
-use constant EXAMPLE => "\n\n".
-						"Example:\n".
-						"\n".
-						"check_unix_open_fds -a /usr/local/nagios/bin/ndo2db -w 20,75 -c 25,85\n".
-						"\n".
-						"It returns CRITICAL if number of file descriptors opened by ndo2db is higher than 85,\n".
-						"if not it returns WARNING if number of file descriptors opened by ndo2db is higher \n".
-						"than 75, if not it returns CRITICAL if number of file descriptors opened by any process\n".
-						"of ndo2db is higher than 25, if not it returns WARNING if number of file descriptors \n".
-						"opened by any process of ndo2db is higher than 20.\n".
-						"In other cases it returns OK if check has been performed succesfully.\n\n";
-
-								
-# VARIABLE DEFINITION
-
-my $Nagios;
-my $Error;
-my $PluginResult;
-my $PluginOutput;
-my @WVRange;
-my @CVRange;
-
-
-# MAIN FUNCTION
-
-# Get command line arguments
-$Nagios = &CreateNagiosManager(USAGE, VERSION, BLURB, LICENSE, NAME, EXAMPLE);
-eval {$Nagios->getopts};
-
-if (!$@) {
-	# Command line parsed
-	if (&CheckArguments($Nagios, \$Error, \@WVRange, \@CVRange)) {
-		# Argument checking passed
-		$PluginResult = &PerformCheck($Nagios, \$PluginOutput, \@WVRange, \@CVRange)
-	}
-	else {
-		# Error checking arguments
-		$PluginOutput = $Error;
-		$PluginResult = UNKNOWN;
-	}
-	$Nagios->nagios_exit($PluginResult,$PluginOutput);
-}
-else {
-	# Error parsing command line
-	$Nagios->nagios_exit(UNKNOWN,$@);
-}
-
-		
-	
-# FUNCTION DEFINITIONS
-
-# Creates and configures a Nagios plugin object
-# Input: strings (usage, version, blurb, license, name and example) to configure argument parsing functionality
-# Return value: reference to a Nagios plugin object
-
-sub CreateNagiosManager() {
-	# Create GetOpt object
-	my $Nagios = Nagios::Plugin->new(usage => $_[0], version =>  $_[1], blurb =>  $_[2], license =>  $_[3], plugin =>  $_[4], extra =>  $_[5]);
-	
-	# Add argument units
-	$Nagios->add_arg(spec => 'application|a=s',
-				help => 'Application path for which you want to check the number of open file descriptors',
-				required => 1);				
-	
-	# Add argument warning
-	$Nagios->add_arg(spec => 'warning|w=s',
-				help => "Warning thresholds. Format: <process_threshold,application_threshold>",
-				required => 1);
-	# Add argument critical
-	$Nagios->add_arg(spec => 'critical|c=s',
-				help => "Critical thresholds. Format: <process_threshold,application_threshold>",
-				required => 1);
-								
-	# Return value
-	return $Nagios;
-}
-
-
-# Checks argument values and sets some default values
-# Input: Nagios Plugin object
-# Output: reference to Error description string, Memory Unit, Swap Unit, reference to WVRange ($_[4]), reference to CVRange ($_[5])
-# Return value: True if arguments ok, false if not
-
-sub CheckArguments() {
-	my ($Nagios, $Error, $WVRange, $CVRange) = @_;
-	my $commas;
-	my $units;
-	my $i;
-	my $firstpos;
-	my $secondpos;
-	
-	# Check Warning thresholds list
-	$commas = $Nagios->opts->warning =~ tr/,//; 
-	if ($commas !=1){
-		${$Error} = "Invalid Warning list format. One comma is expected.";
-		return 0;
-	}
-	else{
-		$i=0;
-		$firstpos=0;
-		my $warning=$Nagios->opts->warning;
-		while ($warning =~ /[,]/g) {
-			$secondpos=pos $warning;
-			if ($secondpos - $firstpos==1){
-				@{$WVRange}[$i] = "~:";
-			}		
-			else{
-				@{$WVRange}[$i] = substr $Nagios->opts->warning, $firstpos, ($secondpos-$firstpos-1);
-			}
-			$firstpos=$secondpos;
-			$i++
-		}
-		if (length($Nagios->opts->warning) - $firstpos==0){#La coma es el ultimo elemento del string
-			@{$WVRange}[$i] = "~:";
-		}
-		else{
-			@{$WVRange}[$i] = substr $Nagios->opts->warning, $firstpos, (length($Nagios->opts->warning)-$firstpos);
-		}	
-		
-		if (@{$WVRange}[0] !~/^(@?(\d+|(\d+|~):(\d+)?))?$/){
-			${$Error} = "Invalid Process Warning threshold in ${$WVRange[0]}";
-			return 0;
-		}if (@{$WVRange}[1] !~/^(@?(\d+|(\d+|~):(\d+)?))?$/){
-			${$Error} = "Invalid Application Warning threshold in ${$WVRange[1]}";
-			return 0;
-		}
-	}
-	
-	# Check Critical thresholds list
-	$commas = $Nagios->opts->critical =~ tr/,//; 
-	if ($commas !=1){
-		${$Error} = "Invalid Critical list format. One comma is expected.";
-		return 0;
-	}
-	else{
-		$i=0;
-		$firstpos=0;
-		my $critical=$Nagios->opts->critical;
-		while ($critical  =~ /[,]/g) {
-			$secondpos=pos $critical ;
-			if ($secondpos - $firstpos==1){
-				@{$CVRange}[$i] = "~:";
-			}		
-			else{
-				@{$CVRange}[$i] =substr $Nagios->opts->critical, $firstpos, ($secondpos-$firstpos-1);
-			}
-			$firstpos=$secondpos;
-			$i++
-		}
-		if (length($Nagios->opts->critical) - $firstpos==0){#La coma es el ultimo elemento del string
-			@{$CVRange}[$i] = "~:";
-		}
-		else{
-			@{$CVRange}[$i] = substr $Nagios->opts->critical, $firstpos, (length($Nagios->opts->critical)-$firstpos);
-		}		
-
-		if (@{$CVRange}[0] !~/^(@?(\d+|(\d+|~):(\d+)?))?$/) {
-			${$Error} = "Invalid Process Critical threshold in @{$CVRange}[0]";
-			return 0;
-		}
-		if (@{$CVRange}[1] !~/^(@?(\d+|(\d+|~):(\d+)?))?$/) {
-			${$Error} = "Invalid Application Critical threshold in @{$CVRange}[1]";
-			return 0;
-		}
-	}
-	
-	return 1;
-}
-
-
-# Performs whole check: 
-# Input: Nagios Plugin object, reference to Plugin output string, Application, referece to WVRange, reference to CVRange
-# Output: Plugin output string
-# Return value: Plugin return value
-
-sub PerformCheck() {
-	my ($Nagios, $PluginOutput, $WVRange, $CVRange) = @_;
-	my $Application;
-	my @AppNameSplitted;
-	my $ApplicationName;
-	my $PsCommand;
-	my $PsResult;
-	my @PsResultLines;
-	my $ProcLine;
-	my $ProcPid;
-	my $LsofCommand;
-	my $LsofResult;
-	my $ProcCount = 0;
-	my $FDCount = 0;
-	my $ProcFDAvg = 0;
-	my $PerProcMaxFD = 0;
-	my $ProcOKFlag = 0;
-	my $ProcWarningFlag = 0;
-	my $ProcCriticalFlag = 0;
-	my $OKFlag = 0;
-	my $WarningFlag = 0;
-	my $CriticalFlag = 0;
-	my $LastWarningProcFDs = 0;
-	my $LastWarningProc = -1;
-	my $LastCriticalProcFDs = 0;
-	my $LastCriticalProc = -1;
-	my $ProcPluginReturnValue = UNKNOWN;
-	my $AppPluginReturnValue = UNKNOWN;
- 	my $PluginReturnValue = UNKNOWN;
- 	my $PerformanceData = "";
-	my $PerfdataUnit = "FDs";
-	
-	$Application = $Nagios->opts->application;
-	$PsCommand = "ps -eaf | grep $Application";
-	$PsResult = `$PsCommand`;
-	@AppNameSplitted = split(/\//, $Application);
-	$ApplicationName = $AppNameSplitted[$#AppNameSplitted];
-	@PsResultLines = split(/\n/, $PsResult);
-	if ( $#PsResultLines > 1 ) {
-	    foreach my $Proc (split(/\n/, $PsResult)) {
-		if ($Proc !~ /check_unix_open_fds/ && $Proc !~ / grep /) {
-				$ProcCount += 1;
-			    $ProcPid = (split(/\s+/, $Proc))[1];
-			    $LsofCommand = "lsof -p $ProcPid | wc -l";
-			    $LsofResult = `$LsofCommand`;
-			    $LsofResult = ($LsofResult > 0 ) ? ($LsofResult - 1) : 0;
-			    $FDCount += $LsofResult;
-			    if ($LsofResult >= $PerProcMaxFD) { $PerProcMaxFD = $LsofResult; }
-			    $ProcPluginReturnValue = $Nagios->check_threshold(check => $LsofResult,warning => @{$WVRange}[0],critical => @{$CVRange}[0]);
-			    if ($ProcPluginReturnValue eq OK) {
-			    	$ProcOKFlag = 1;
-			    }
-			    elsif ($ProcPluginReturnValue eq WARNING) {
-					$ProcWarningFlag = 1;
-					if ($LsofResult >= $LastWarningProcFDs) {
-					    $LastWarningProcFDs = $LsofResult;
-					    $LastWarningProc = $ProcPid;
-					}
-			    }
-				#if ($LsofResult >= $PCT) {
-				elsif ($ProcPluginReturnValue eq CRITICAL) {
-				    $ProcCriticalFlag = 1;
-				    if ($LsofResult >= $LastCriticalProcFDs) {
-						$LastCriticalProcFDs = $LsofResult;
-						$LastCriticalProc = $ProcPid;
-				    }
-				}
-		    }
-	    }
-	    if ($ProcCount) { $ProcFDAvg = int($FDCount / $ProcCount); }
-	    $AppPluginReturnValue = $Nagios->check_threshold(check => $FDCount,warning => @{$WVRange}[1],critical => @{$CVRange}[1]);
-	    #if ($FDCount >= $TWT) {
-	    if ($AppPluginReturnValue eq OK) { $OKFlag = 1; }
-	    elsif ($AppPluginReturnValue eq WARNING) { $WarningFlag = 1; }
-	    elsif ($AppPluginReturnValue eq CRITICAL) { $CriticalFlag = 1; }
-	
-	    # PluginReturnValue and PluginOutput
-	    if ($CriticalFlag) {
-	    	$PluginReturnValue = CRITICAL;
-			${$PluginOutput} .= "$ApplicationName handling $FDCount files (critical threshold set to @{$CVRange}[1])";
-	    }
-	    elsif ($WarningFlag) {
-	    	$PluginReturnValue = WARNING;
-			${$PluginOutput} .= "$ApplicationName handling $FDCount files (warning threshold set to @{$WVRange}[1])";
-	    }
-	    elsif ($ProcCriticalFlag) {
-	    	$PluginReturnValue = CRITICAL;
-			${$PluginOutput} .= "Process ID $LastCriticalProc handling $LastCriticalProcFDs files (critical threshold set to @{$CVRange}[0])";
-	    }
-	    elsif ($ProcWarningFlag) {
-	    	$PluginReturnValue = WARNING;
-			${$PluginOutput} .= "Process ID $LastWarningProc handling $LastWarningProcFDs files (warning threshold set to @{$WVRange}[0])";
-	    }
-	    elsif ($OKFlag && $ProcOKFlag) {
-	    	$PluginReturnValue = OK;
-			${$PluginOutput} .= "$ApplicationName handling $FDCount files";
-	    }
-	}
-	else {
-	    ${$PluginOutput} .= "No existe la aplicacion $ApplicationName";
-	}
-
-     
-	$PerformanceData .= "ProcCount=$ProcCount$PerfdataUnit FDCount=$FDCount$PerfdataUnit ProcFDAvg=$ProcFDAvg$PerfdataUnit PerProcMaxFD=$PerProcMaxFD$PerfdataUnit";
-
-	# Output with performance data:
-	${$PluginOutput} .= " | $PerformanceData";
-
- 	return $PluginReturnValue;
-}
diff --git a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
index 1554fd3c..9fc771e0 100644
--- a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
@@ -1,5 +1,4 @@
-# configure logwatch and nagios checks for couchdb (both bigcouch and plain
-# couchdb installations)
+# configure logwatch and nagios checks for couchdb
 class site_check_mk::agent::couchdb {
 
   concat::fragment { 'syslog_couchdb':
@@ -14,21 +13,4 @@ class site_check_mk::agent::couchdb {
     mode    => '0755',
     require => Package['check_mk-agent']
   }
-
-  # check open files for bigcouch proc
-  include site_check_mk::agent::package::perl_plugin
-  file { '/srv/leap/nagios/plugins/check_unix_open_fds.pl':
-    source => 'puppet:///modules/site_check_mk/agent/nagios_plugins/check_unix_open_fds.pl',
-    mode   => '0755'
-  }
-  augeas {
-    'Couchdb_open_files':
-      incl    => '/etc/check_mk/mrpe.cfg',
-      lens    => 'Spacevars.lns',
-      changes => [
-        'rm /files/etc/check_mk/mrpe.cfg/Couchdb_open_files',
-        'set Couchdb_open_files \'/srv/leap/nagios/plugins/check_unix_open_fds.pl -a beam -w 28672,28672 -c 30720,30720\'' ],
-      require => File['/etc/check_mk/mrpe.cfg'];
-  }
-
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/couchdb/bigcouch.pp b/puppet/modules/site_check_mk/manifests/agent/couchdb/bigcouch.pp
deleted file mode 100644
index 82c3ac72..00000000
--- a/puppet/modules/site_check_mk/manifests/agent/couchdb/bigcouch.pp
+++ /dev/null
@@ -1,49 +0,0 @@
-# configure logwatch and nagios checks for bigcouch
-class site_check_mk::agent::couchdb::bigcouch {
-
-  # watch bigcouch logs
-  # currently disabled because bigcouch is too noisy
-  # see https://leap.se/code/issues/7375 for more details
-  # and site_config::remove_files for removing leftovers
-  #file { '/etc/check_mk/logwatch.d/bigcouch.cfg':
-  #  source => 'puppet:///modules/site_check_mk/agent/logwatch/bigcouch.cfg',
-  #}
-
-  # check syslog msg from:
-  # - empd
-  # - /usr/local/bin/couch-doc-update
-  concat::fragment { 'syslog_bigcouch':
-    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/bigcouch.cfg',
-    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
-    order   => '02';
-  }
-
-  # check bigcouch processes
-  augeas {
-    'Bigcouch_epmd_procs':
-      incl    => '/etc/check_mk/mrpe.cfg',
-      lens    => 'Spacevars.lns',
-      changes => [
-        'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_epmd_procs',
-        'set Bigcouch_epmd_procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/epmd\'' ],
-      require => File['/etc/check_mk/mrpe.cfg'];
-    'Bigcouch_beam_procs':
-      incl    => '/etc/check_mk/mrpe.cfg',
-      lens    => 'Spacevars.lns',
-      changes => [
-        'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_beam_procs',
-        'set Bigcouch_beam_procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/beam\'' ],
-      require => File['/etc/check_mk/mrpe.cfg'];
-  }
-
-  augeas {
-    'Bigcouch_open_files':
-      incl    => '/etc/check_mk/mrpe.cfg',
-      lens    => 'Spacevars.lns',
-      changes => [
-        'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_open_files',
-        'set Bigcouch_open_files \'/srv/leap/nagios/plugins/check_unix_open_fds.pl -a beam -w 28672,28672 -c 30720,30720\'' ],
-      require => File['/etc/check_mk/mrpe.cfg'];
-  }
-
-}
diff --git a/puppet/modules/site_check_mk/manifests/agent/couchdb/plain.pp b/puppet/modules/site_check_mk/manifests/agent/couchdb/plain.pp
deleted file mode 100644
index 3ec2267b..00000000
--- a/puppet/modules/site_check_mk/manifests/agent/couchdb/plain.pp
+++ /dev/null
@@ -1,23 +0,0 @@
-# configure logwatch and nagios checks for plain single couchdb master
-class site_check_mk::agent::couchdb::plain {
-
-  # remove bigcouch leftovers
-  augeas {
-    'Bigcouch_epmd_procs':
-      incl    => '/etc/check_mk/mrpe.cfg',
-      lens    => 'Spacevars.lns',
-      changes => 'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_epmd_procs',
-      require => File['/etc/check_mk/mrpe.cfg'];
-    'Bigcouch_beam_procs':
-      incl    => '/etc/check_mk/mrpe.cfg',
-      lens    => 'Spacevars.lns',
-      changes => 'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_beam_procs',
-      require => File['/etc/check_mk/mrpe.cfg'];
-    'Bigcouch_open_files':
-      incl    => '/etc/check_mk/mrpe.cfg',
-      lens    => 'Spacevars.lns',
-      changes => 'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_open_files',
-      require => File['/etc/check_mk/mrpe.cfg'];
-  }
-
-}
diff --git a/puppet/modules/site_config/manifests/remove/bigcouch.pp b/puppet/modules/site_config/manifests/remove/bigcouch.pp
index 3535c3c1..9fd3e7ee 100644
--- a/puppet/modules/site_config/manifests/remove/bigcouch.pp
+++ b/puppet/modules/site_config/manifests/remove/bigcouch.pp
@@ -10,6 +10,33 @@ class site_config::remove::bigcouch {
     ]
   }
 
+  tidy {
+    '/etc/logrotate/bigcouch':;
+    '/srv/leap/nagios/plugins/check_unix_open_fds.pl':;
+  }
+
+  augeas {
+    'Couchdb_open_files':
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => [
+                  'rm /files/etc/check_mk/mrpe.cfg/Couchdb_open_files',
+                  'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_epmd_procs',
+                  'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_beam_procs',
+                  'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_open_files' ],
+      require => File['/etc/check_mk/mrpe.cfg'];
+  }
+
+  # check syslog msg from:
+  # - empd
+  # - /usr/local/bin/couch-doc-update
+  concat::fragment { 'syslog_bigcouch':
+    ensure  => absent,
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/bigcouch.cfg',
+    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
+    order   => '02';
+  }
+
   exec { 'remove_bigcouch_logwatch_stateline':
     command     => "sed -i '/bigcouch.log/d' /etc/check_mk/logwatch.state",
     refreshonly => true,
diff --git a/puppet/modules/site_couchdb/files/runit_config b/puppet/modules/site_couchdb/files/runit_config
deleted file mode 100644
index 169b4832..00000000
--- a/puppet/modules/site_couchdb/files/runit_config
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/bash
-exec 2>&1
-export HOME=/home/bigcouch
-ulimit -H -n 32768
-ulimit -S -n 32768
-exec chpst -u bigcouch /opt/bigcouch/bin/bigcouch
diff --git a/puppet/modules/site_couchdb/manifests/bigcouch.pp b/puppet/modules/site_couchdb/manifests/bigcouch.pp
deleted file mode 100644
index 2de3d4d0..00000000
--- a/puppet/modules/site_couchdb/manifests/bigcouch.pp
+++ /dev/null
@@ -1,50 +0,0 @@
-# sets up bigcouch on couchdb node
-class site_couchdb::bigcouch {
-
-  $config         = $::site_couchdb::couchdb_config['bigcouch']
-  $cookie         = $config['cookie']
-  $ednp_port      = $config['ednp_port']
-
-  class { 'couchdb':
-    admin_pw            => $::site_couchdb::couchdb_admin_pw,
-    admin_salt          => $::site_couchdb::couchdb_admin_salt,
-    bigcouch            => true,
-    bigcouch_cookie     => $cookie,
-    ednp_port           => $ednp_port,
-    chttpd_bind_address => '127.0.0.1'
-  }
-
-  #
-  # stunnel must running correctly before bigcouch dbs can be set up.
-  #
-  Class['site_config::default']
-    -> Class['site_config::resolvconf']
-    -> Class['couchdb::bigcouch::package::cloudant']
-    -> Service['shorewall']
-    -> Exec['refresh_stunnel']
-    -> Class['site_couchdb::setup']
-    -> Class['site_couchdb::bigcouch::add_nodes']
-    -> Class['site_couchdb::bigcouch::settle_cluster']
-    -> Class['site_couchdb::create_dbs']
-
-  include site_couchdb::bigcouch::add_nodes
-  include site_couchdb::bigcouch::settle_cluster
-  include site_couchdb::bigcouch::compaction
-
-  file { '/var/log/bigcouch':
-    ensure => directory
-  }
-
-  file { '/etc/sv/bigcouch/run':
-    ensure  => present,
-    source  => 'puppet:///modules/site_couchdb/runit_config',
-    owner   => root,
-    group   => root,
-    mode    => '0755',
-    require => Package['couchdb'],
-    notify  => Service['couchdb']
-  }
-
-  include site_check_mk::agent::couchdb::bigcouch
-
-}
diff --git a/puppet/modules/site_couchdb/manifests/bigcouch/add_nodes.pp b/puppet/modules/site_couchdb/manifests/bigcouch/add_nodes.pp
deleted file mode 100644
index c8c43275..00000000
--- a/puppet/modules/site_couchdb/manifests/bigcouch/add_nodes.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-class site_couchdb::bigcouch::add_nodes {
-  # loop through neighbors array and add nodes
-  $nodes = $::site_couchdb::bigcouch::config['neighbors']
-
-  couchdb::bigcouch::add_node { $nodes:
-    require => Couchdb::Query::Setup['localhost']
-  }
-}
diff --git a/puppet/modules/site_couchdb/manifests/bigcouch/compaction.pp b/puppet/modules/site_couchdb/manifests/bigcouch/compaction.pp
deleted file mode 100644
index 84aab4ef..00000000
--- a/puppet/modules/site_couchdb/manifests/bigcouch/compaction.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-class site_couchdb::bigcouch::compaction {
-  cron {
-    'compact_all_shards':
-      command     => '/srv/leap/couchdb/scripts/bigcouch_compact_all_shards.sh >> /var/log/bigcouch/compaction.log',
-      hour        => 3,
-      minute      => 17;
-  }
-}
diff --git a/puppet/modules/site_couchdb/manifests/bigcouch/settle_cluster.pp b/puppet/modules/site_couchdb/manifests/bigcouch/settle_cluster.pp
deleted file mode 100644
index 820b5be2..00000000
--- a/puppet/modules/site_couchdb/manifests/bigcouch/settle_cluster.pp
+++ /dev/null
@@ -1,11 +0,0 @@
-class site_couchdb::bigcouch::settle_cluster {
-
-  exec { 'wait_for_couch_nodes':
-    command => '/srv/leap/bin/run_tests --test CouchDB/Are_configured_nodes_online? --retry 12 --wait 10'
-  }
-
-  exec { 'settle_cluster_membership':
-    command => '/srv/leap/bin/run_tests --test CouchDB/Is_cluster_membership_ok? --retry 12 --wait 10',
-    require => Exec['wait_for_couch_nodes']
-  }
-}
diff --git a/puppet/modules/site_couchdb/manifests/init.pp b/puppet/modules/site_couchdb/manifests/init.pp
index c4fe6277..554bf813 100644
--- a/puppet/modules/site_couchdb/manifests/init.pp
+++ b/puppet/modules/site_couchdb/manifests/init.pp
@@ -1,4 +1,4 @@
-# entry class for configuring couchdb/bigcouch node
+# entry class for configuring couchdb node
 # couchdb node
 class site_couchdb {
   tag 'leap_service'
@@ -39,12 +39,6 @@ class site_couchdb {
   $couchdb_backup           = $couchdb_config['backup']
   $couchdb_mode             = $couchdb_config['mode']
 
-  # ensure bigcouch has been purged from the system:
-  # TODO: remove this check in 0.9 release
-  if file('/opt/bigcouch/bin/bigcouch', '/dev/null') != '' {
-    fail 'ERROR: BigCouch appears to be installed. Make sure you have migrated to CouchDB before proceeding. See https://leap.se/upgrade-0-8'
-  }
-
   include site_couchdb::plain
 
   Class['site_config::default']
@@ -60,7 +54,6 @@ class site_couchdb {
   include site_couchdb::create_dbs
   include site_couchdb::add_users
   include site_couchdb::designs
-  include site_couchdb::logrotate
 
   if $couchdb_backup   { include site_couchdb::backup }
 
diff --git a/puppet/modules/site_couchdb/manifests/logrotate.pp b/puppet/modules/site_couchdb/manifests/logrotate.pp
deleted file mode 100644
index bb8843bb..00000000
--- a/puppet/modules/site_couchdb/manifests/logrotate.pp
+++ /dev/null
@@ -1,14 +0,0 @@
-# configure couchdb logrotation
-class site_couchdb::logrotate {
-
-  augeas {
-    'logrotate_bigcouch':
-      context => '/files/etc/logrotate.d/bigcouch/rule',
-      changes => [
-        'set file /opt/bigcouch/var/log/*.log', 'set rotate 7',
-        'set schedule daily', 'set compress compress',
-        'set missingok missingok', 'set ifempty notifempty',
-        'set copytruncate copytruncate' ]
-  }
-
-}
diff --git a/puppet/modules/site_couchdb/manifests/plain.pp b/puppet/modules/site_couchdb/manifests/plain.pp
index b40fc100..710ff7ca 100644
--- a/puppet/modules/site_couchdb/manifests/plain.pp
+++ b/puppet/modules/site_couchdb/manifests/plain.pp
@@ -6,8 +6,6 @@ class site_couchdb::plain {
     chttpd_bind_address => '127.0.0.1'
   }
 
-  include site_check_mk::agent::couchdb::plain
-
   # remove bigcouch leftovers from previous installations
   include ::site_config::remove::bigcouch
 
diff --git a/puppet/modules/site_couchdb/manifests/setup.pp b/puppet/modules/site_couchdb/manifests/setup.pp
index 710d3c1c..7477d24c 100644
--- a/puppet/modules/site_couchdb/manifests/setup.pp
+++ b/puppet/modules/site_couchdb/manifests/setup.pp
@@ -3,13 +3,6 @@
 #
 class site_couchdb::setup {
 
-  # ensure that we don't have leftovers from previous installations
-  # where we installed the cloudant bigcouch package
-  # https://leap.se/code/issues/4971
-  class { 'couchdb::bigcouch::package::cloudant':
-    ensure => absent
-  }
-
   $user = $site_couchdb::couchdb_admin_user
 
   # setup /etc/couchdb/couchdb-admin.netrc for couchdb admin access
-- 
cgit v1.2.3


From 8b4547d844ef904d9591a2a9fe71989e85197714 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 23 Jun 2016 14:05:20 -0400
Subject: Make sure bind9 doesn't take over unbound (#8213).

Change-Id: Icaab817870d005b7a854a3fb8c402705d0b2d77f
---
 puppet/modules/site_config/manifests/caching_resolver.pp | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_config/manifests/caching_resolver.pp b/puppet/modules/site_config/manifests/caching_resolver.pp
index 59b135a3..5541472d 100644
--- a/puppet/modules/site_config/manifests/caching_resolver.pp
+++ b/puppet/modules/site_config/manifests/caching_resolver.pp
@@ -7,10 +7,7 @@ class site_config::caching_resolver {
   # and then start it, so unbound will never get properly started. So this will
   # make sure bind9 is removed before.
   package { 'bind9':
-    ensure => absent
-  }
-  file { [ '/etc/default/bind9', '/etc/bind/named.conf.options' ]:
-    ensure => absent
+    ensure => purged
   }
 
   class { 'unbound':
-- 
cgit v1.2.3


From cfb91a199c8c205b99c4424df77b0b6ed20e4288 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 30 Jun 2016 12:15:39 -0700
Subject: fix static site apache config

---
 puppet/modules/site_static/templates/amber.erb     |   8 +-
 .../modules/site_static/templates/apache.conf.erb  | 122 ++++++++++++---------
 puppet/modules/site_static/templates/rack.erb      |   6 +-
 3 files changed, 79 insertions(+), 57 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_static/templates/amber.erb b/puppet/modules/site_static/templates/amber.erb
index 694f1136..b34458c3 100644
--- a/puppet/modules/site_static/templates/amber.erb
+++ b/puppet/modules/site_static/templates/amber.erb
@@ -4,10 +4,10 @@
 <%- end -%>
   <Directory "<%=@directory%>/">
     AllowOverride FileInfo Indexes Options=All,MultiViews
-<% if scope.function_guess_apache_version([]) == '2.4' %>
+<%- if scope.function_guess_apache_version([]) == '2.4' -%>
     Require all granted
-<% else %>
+<%- else -%>
     Order deny,allow
     Allow from all
-<% end %>
-  </Directory>
+<%- end -%>
+  </Directory>
\ No newline at end of file
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index 2013e5ee..af9a520d 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -11,6 +11,9 @@
     end
   end
 
+  #
+  # document root
+  #
   @document_root = begin
     root = '/var/www'
     @locations && @locations.each do |name, location|
@@ -19,8 +22,52 @@
     root.gsub(%r{^/|/$}, '')
   end
 
+  #
+  # provider.json
+  #
+  # if the domain is a bootstrap domain, we need to expose
+  # a /provider.json file.
+  #
   bootstrap_domain = scope.lookupvar('site_static::bootstrap_domain')
   bootstrap_client = scope.lookupvar('site_static::bootstrap_client')
+  if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain)
+    provider_json = \
+%(
+  Alias /provider.json /srv/static/public/provider.json
+  <Location /provider.json>
+    Header set X-Minimum-Client-Version #{bootstrap_client['min']}
+  </Location>
+)
+  else
+    provider_json = ""
+  end
+
+  #
+  # locations
+  #
+  locations = ""
+  @locations && @locations.each do |name, location|
+    location_path = location['path'].gsub(%r{^/|/$}, '')
+    directory = location_directory(name, location)
+    local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name}
+    template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb'
+    break unless File.exists?(template_path)
+    locations += \
+%(
+  #
+  # #{name} (#{location['format']})
+  #
+#{scope.function_templatewlv([template_path, local_vars])}
+)
+  end
+
+  #
+  # allow custom apache config
+  #
+  custom_apache_config = if @apache_config
+    @apache_config.gsub(':percent:','%')
+  end
+
 -%>
 
 <Directory "/srv/static/public/">
@@ -28,6 +75,9 @@
 </Directory>
 
 <%- if @tor -%>
+##
+## Tor
+##
 <VirtualHost 127.0.0.1:80>
   ServerName <%= @tor_domain %>
   ServerAlias www.<%= @tor_domain %>
@@ -41,31 +91,15 @@
   DocumentRoot "/<%= @document_root %>/"
   AccessFileName .htaccess
 
-<%- if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) -%>
-  Alias /provider.json /srv/leap/provider.json
-  <Location /provider.json>
-    Header set X-Minimum-Client-Version <%= bootstrap_client['min'] %>
-  </Location>
-<%- end -%>
-
-<%- if @apache_config -%>
-<%=   @apache_config.gsub(':percent:','%') %>
-<%- end -%>
-
-<%- @locations && @locations.each do |name, location| -%>
-<%-   location_path = location['path'].gsub(%r{^/|/$}, '') -%>
-<%-   directory = location_directory(name, location) -%>
-<%-   local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name} -%>
-<%-   template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb' -%>
-<%-   break unless File.exists?(template_path) -%>
-  ##
-  ## <%= name %> (<%= location['format'] %>)
-  ##
-<%=   scope.function_templatewlv([template_path, local_vars]) %>
-<%- end -%>
-<%- end -%>
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
 </VirtualHost>
+<%- end -%>
 
+##
+## HTTP
+##
 <VirtualHost *:80>
   ServerName <%= @domain %>
   ServerAlias www.<%= @domain %>
@@ -76,9 +110,16 @@
 <%- if @tls_only -%>
   RewriteEngine On
   RewriteRule ^.*$ https://<%= @domain -%>%{REQUEST_URI} [R=permanent,L]
+<%- else -%>
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
 <%- end -%>
 </VirtualHost>
 
+##
+## HTTPS
+##
 <VirtualHost *:443>
   ServerName <%= @domain %>
   ServerAlias www.<%= @domain %>
@@ -90,14 +131,14 @@
   #RewriteLogLevel 3
 
   Include include.d/ssl_common.inc
-  
+
   <IfModule mod_headers.c>
 <%- if @tls_only -%>
-  Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
+    Header always set Strict-Transport-Security: "max-age=15768000;includeSubdomains"
 <%- end -%>
-  Header set X-Frame-Options "deny"
-  Header always unset X-Powered-By
-  Header always unset X-Runtime
+    Header set X-Frame-Options "deny"
+    Header always unset X-Powered-By
+    Header always unset X-Runtime
   </IfModule>
 
   SSLCertificateKeyFile    /etc/x509/keys/<%= @domain %>.key
@@ -108,26 +149,7 @@
   DocumentRoot "/<%= @document_root %>/"
   AccessFileName .htaccess
 
-<%- if ([@aliases]+[@domain]).flatten.include?(bootstrap_domain) -%>
-  Alias /provider.json /srv/static/public/provider.json
-  <Location /provider.json>
-    Header set X-Minimum-Client-Version <%= bootstrap_client['min'] %>
-  </Location>
-<%- end -%>
-
-<%- if @apache_config -%>
-<%=   @apache_config.gsub(':percent:','%') %>
-<%- end -%>
-
-<%- @locations && @locations.each do |name, location| -%>
-<%-   location_path = location['path'].gsub(%r{^/|/$}, '') -%>
-<%-   directory = location_directory(name, location) -%>
-<%-   local_vars = {'location_path'=>location_path, 'directory'=>directory, 'location'=>location, 'name'=>name} -%>
-<%-   template_path = File.join(File.dirname(__FILE__), location['format']) + '.erb' -%>
-<%-   break unless File.exists?(template_path) -%>
-  ##
-  ## <%= name %> (<%= location['format'] %>)
-  ##
-<%=   scope.function_templatewlv([template_path, local_vars]) %>
-<%- end -%>
+<%= provider_json %>
+<%= custom_apache_config %>
+<%= locations %>
 </VirtualHost>
diff --git a/puppet/modules/site_static/templates/rack.erb b/puppet/modules/site_static/templates/rack.erb
index 431778bb..1cbf84d2 100644
--- a/puppet/modules/site_static/templates/rack.erb
+++ b/puppet/modules/site_static/templates/rack.erb
@@ -10,10 +10,10 @@
 <%- end -%>
   <Directory "<%=@directory%>">
     Options -MultiViews
-<% if scope.function_guess_apache_version([]) == '2.4' %>
+<%- if scope.function_guess_apache_version([]) == '2.4' -%>
     Require all granted
-<% else %>
+<%- else -%>
     Order deny,allow
     Allow from all
-<% end %>
+<%- end -%>
   </Directory>
-- 
cgit v1.2.3


From 10602f677edc113b64f6a8fde6e9d0b87460967d Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 5 Jul 2016 13:01:21 -0400
Subject: Remove duplicate syslog entry (#8021).

In an attempt to resolve #8021, a template error was made, causing
duplicated entries to appear in the rsyslog template.

Change-Id: Ic41d6ef9aec9865cf64312c1eb96e408b39d441c
---
 puppet/modules/site_rsyslog/templates/client.conf.erb | 1 -
 1 file changed, 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_rsyslog/templates/client.conf.erb b/puppet/modules/site_rsyslog/templates/client.conf.erb
index 7f94759d..553b8373 100644
--- a/puppet/modules/site_rsyslog/templates/client.conf.erb
+++ b/puppet/modules/site_rsyslog/templates/client.conf.erb
@@ -93,7 +93,6 @@ auth,authpriv.*                 /var/log/secure
 <% if scope.lookupvar('rsyslog::log_style') == 'debian' -%>
 # First some standard log files.  Log by facility.
 #
-*.*;auth,authpriv.none         -/var/log/syslog
 cron.*                          /var/log/cron.log
 daemon.*                       -/var/log/daemon.log
 kern.*                         -/var/log/kern.log
-- 
cgit v1.2.3


From 428f5c4f839650dac8898746ff395fcf50b658bb Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 23 Jun 2016 16:21:02 -0400
Subject: Enable DNSSEC validation in unbound (#8214).

Change-Id: Ibdf39a721162b4a5663ef27c27b2db0261c6e8a5
---
 puppet/modules/site_config/manifests/caching_resolver.pp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_config/manifests/caching_resolver.pp b/puppet/modules/site_config/manifests/caching_resolver.pp
index 5541472d..2b08ab4c 100644
--- a/puppet/modules/site_config/manifests/caching_resolver.pp
+++ b/puppet/modules/site_config/manifests/caching_resolver.pp
@@ -23,7 +23,8 @@ class site_config::caching_resolver {
         hide-identity  => 'yes',
         hide-version   => 'yes',
         harden-glue    => 'yes',
-        access-control => [ '127.0.0.0/8 allow', '::1 allow' ]
+        access-control => [ '127.0.0.0/8 allow', '::1 allow' ],
+        module-config  => '"validator iterator"'
       }
     }
   }
-- 
cgit v1.2.3


From 2cfcb6d073973025f73f37183a0fa21570a922df Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 5 Jul 2016 11:43:59 -0400
Subject: set domain-secure to internal domain.

Without this set, dnssec will fail validation for internal domains,
which should not be validated

Change-Id: I8589332598fe97ad5218dd23825ac77af2d8def6
---
 .../modules/site_config/manifests/caching_resolver.pp | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_config/manifests/caching_resolver.pp b/puppet/modules/site_config/manifests/caching_resolver.pp
index 2b08ab4c..4da13d9c 100644
--- a/puppet/modules/site_config/manifests/caching_resolver.pp
+++ b/puppet/modules/site_config/manifests/caching_resolver.pp
@@ -1,6 +1,8 @@
 # deploy local caching resolver
 class site_config::caching_resolver {
   tag 'leap_base'
+  $domain          = hiera('domain')
+  $internal_domain = $domain['internal_suffix']
 
   # We need to make sure Package['bind9'] isn't installed because when it is, it
   # keeps unbound from running. Some base debian installs will install bind9,
@@ -17,14 +19,15 @@ class site_config::caching_resolver {
     require    => Package['bind9'],
     settings   => {
       server => {
-        verbosity      => '1',
-        interface      => [ '127.0.0.1', '::1' ],
-        port           => '53',
-        hide-identity  => 'yes',
-        hide-version   => 'yes',
-        harden-glue    => 'yes',
-        access-control => [ '127.0.0.0/8 allow', '::1 allow' ],
-        module-config  => '"validator iterator"'
+        verbosity       => '1',
+        interface       => [ '127.0.0.1', '::1' ],
+        port            => '53',
+        hide-identity   => 'yes',
+        hide-version    => 'yes',
+        harden-glue     => 'yes',
+        access-control  => [ '127.0.0.0/8 allow', '::1 allow' ],
+        module-config   => '"validator iterator"',
+        domain-insecure => $internal_domain
       }
     }
   }
-- 
cgit v1.2.3


From f294ddcca7fbe20de788053bfba1cc9c8417ddd8 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 5 Jul 2016 11:50:41 -0400
Subject: Use DANE/TLSA validation in postfix (#8141).

Configure DNSSEC validation for client verification, giving us a
stronger form of opportunistic TLS

Change-Id: Iab92d4f593c4a5a44e3b694295096b0d7f687a37
---
 puppet/modules/site_postfix/manifests/mx.pp | 33 +++++++++++++++++++++++++----
 1 file changed, 29 insertions(+), 4 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp
index 0b760eb4..2dac85f5 100644
--- a/puppet/modules/site_postfix/manifests/mx.pp
+++ b/puppet/modules/site_postfix/manifests/mx.pp
@@ -57,10 +57,6 @@ class site_postfix::mx {
       value => 'sha1';
     'relay_clientcerts':
       value => 'tcp:localhost:2424';
-    # Note: we are setting this here, instead of in site_postfix::mx::smtp_tls
-    # because the satellites need to have a different value
-    'smtp_tls_security_level':
-      value => 'may';
     # reject inbound mail to system users
     # see https://leap.se/code/issues/6829
     # this blocks *only* mails to system users, that don't appear in the
@@ -90,6 +86,35 @@ class site_postfix::mx {
       value => 'permit_mynetworks';
     'postscreen_greet_action':
       value => 'enforce';
+    # Level of DNS support in the Postfix SMTP client.  Enable DNS lookups
+    # (default: empty). When empty, then the legacy "disable_dns_lookups"
+    # (default: no) parameter is used. Setting 'smtp_dns_support_level' to
+    # enabled sets the previous behavior with the new parameter.  When set to
+    # 'dnssec" this enables DNSSEC lookups.
+    'smtp_dns_support_level':
+      value => 'dnssec';
+
+    # http://www.postfix.org/TLS_README.html#client_tls_dane The "dane" level is
+    # a stronger form of opportunistic TLS that is resistant to man in the
+    # middle and downgrade attacks when the destination domain uses DNSSEC to
+    # publish DANE TLSA records for its MX hosts. If a remote SMTP server has
+    # "usable" (see RFC 6698) DANE TLSA records, the server connection will be
+    # authenticated. When DANE authentication fails, there is no fallback to
+    # unauthenticated or plaintext delivery.
+    #
+    # If TLSA records are published for a given remote SMTP server (implying TLS
+    # support), but are all "unusable" due to unsupported parameters or
+    # malformed data, the Postfix SMTP client will use mandatory unauthenticated
+    # TLS. Otherwise, when no TLSA records are published, the Postfix SMTP
+    # client behavior is the same as with may.
+    #
+    # This requires postfix to be able to send its DNS queries to a recursive
+    # DNS nameserver that is able to validate the signed records
+    #
+    # Note: we are setting this here, instead of in site_postfix::mx::smtp_tls
+    # because the satellites need to have a different value
+    'smtp_tls_security_level':
+      value => 'dane';
   }
 
   # Make sure that the cleanup serivce is not chrooted, otherwise it cannot
-- 
cgit v1.2.3


From 7ce3190986cf8e5fe037a7ccd4c1076505b117f4 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:41:59 -0400
Subject: remove submodules in preparation for move to subrepos

Change-Id: Ia7655153b556337f676e3d909559c4a7306bedd6
---
 puppet/modules/apache          | 1 -
 puppet/modules/apt             | 1 -
 puppet/modules/augeas          | 1 -
 puppet/modules/backupninja     | 1 -
 puppet/modules/bundler         | 1 -
 puppet/modules/check_mk        | 1 -
 puppet/modules/common          | 1 -
 puppet/modules/concat          | 1 -
 puppet/modules/couchdb         | 1 -
 puppet/modules/git             | 1 -
 puppet/modules/haproxy         | 1 -
 puppet/modules/lsb             | 1 -
 puppet/modules/nagios          | 1 -
 puppet/modules/ntp             | 1 -
 puppet/modules/openvpn         | 1 -
 puppet/modules/passenger       | 1 -
 puppet/modules/postfix         | 1 -
 puppet/modules/resolvconf      | 1 -
 puppet/modules/rsyslog         | 1 -
 puppet/modules/ruby            | 1 -
 puppet/modules/rubygems        | 1 -
 puppet/modules/shorewall       | 1 -
 puppet/modules/squid_deb_proxy | 1 -
 puppet/modules/sshd            | 1 -
 puppet/modules/stdlib          | 1 -
 puppet/modules/stunnel         | 1 -
 puppet/modules/sysctl          | 1 -
 puppet/modules/systemd         | 1 -
 puppet/modules/tor             | 1 -
 puppet/modules/unbound         | 1 -
 puppet/modules/vcsrepo         | 1 -
 puppet/modules/x509            | 1 -
 32 files changed, 32 deletions(-)
 delete mode 160000 puppet/modules/apache
 delete mode 160000 puppet/modules/apt
 delete mode 160000 puppet/modules/augeas
 delete mode 160000 puppet/modules/backupninja
 delete mode 160000 puppet/modules/bundler
 delete mode 160000 puppet/modules/check_mk
 delete mode 160000 puppet/modules/common
 delete mode 160000 puppet/modules/concat
 delete mode 160000 puppet/modules/couchdb
 delete mode 160000 puppet/modules/git
 delete mode 160000 puppet/modules/haproxy
 delete mode 160000 puppet/modules/lsb
 delete mode 160000 puppet/modules/nagios
 delete mode 160000 puppet/modules/ntp
 delete mode 160000 puppet/modules/openvpn
 delete mode 160000 puppet/modules/passenger
 delete mode 160000 puppet/modules/postfix
 delete mode 160000 puppet/modules/resolvconf
 delete mode 160000 puppet/modules/rsyslog
 delete mode 160000 puppet/modules/ruby
 delete mode 160000 puppet/modules/rubygems
 delete mode 160000 puppet/modules/shorewall
 delete mode 160000 puppet/modules/squid_deb_proxy
 delete mode 160000 puppet/modules/sshd
 delete mode 160000 puppet/modules/stdlib
 delete mode 160000 puppet/modules/stunnel
 delete mode 160000 puppet/modules/sysctl
 delete mode 160000 puppet/modules/systemd
 delete mode 160000 puppet/modules/tor
 delete mode 160000 puppet/modules/unbound
 delete mode 160000 puppet/modules/vcsrepo
 delete mode 160000 puppet/modules/x509

(limited to 'puppet/modules')

diff --git a/puppet/modules/apache b/puppet/modules/apache
deleted file mode 160000
index 415e9504..00000000
--- a/puppet/modules/apache
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 415e9504f99dca3ccaa4dfd389dde24ad9d0e01c
diff --git a/puppet/modules/apt b/puppet/modules/apt
deleted file mode 160000
index 33c61e8d..00000000
--- a/puppet/modules/apt
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 33c61e8df59db1abbed379a9e9790946060a8f1e
diff --git a/puppet/modules/augeas b/puppet/modules/augeas
deleted file mode 160000
index 58ab2b90..00000000
--- a/puppet/modules/augeas
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 58ab2b90c52a5d951fa41596827bc3b6f52310e7
diff --git a/puppet/modules/backupninja b/puppet/modules/backupninja
deleted file mode 160000
index 5268a87c..00000000
--- a/puppet/modules/backupninja
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 5268a87c329f895017f8ea6c6abc377a4f9a6a77
diff --git a/puppet/modules/bundler b/puppet/modules/bundler
deleted file mode 160000
index bacec3e0..00000000
--- a/puppet/modules/bundler
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit bacec3e072649be4ade56f7df8506b46ae9c5166
diff --git a/puppet/modules/check_mk b/puppet/modules/check_mk
deleted file mode 160000
index aa025715..00000000
--- a/puppet/modules/check_mk
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit aa02571537af90ac73309e6e216c9417802548c3
diff --git a/puppet/modules/common b/puppet/modules/common
deleted file mode 160000
index ae149624..00000000
--- a/puppet/modules/common
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit ae149624f9bc551865b93b9b7155af2de8deeb71
diff --git a/puppet/modules/concat b/puppet/modules/concat
deleted file mode 160000
index abce1280..00000000
--- a/puppet/modules/concat
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit abce1280e07b544d8455f1572dd870bbd2f14892
diff --git a/puppet/modules/couchdb b/puppet/modules/couchdb
deleted file mode 160000
index 76ff149a..00000000
--- a/puppet/modules/couchdb
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 76ff149a095023611c05bbb00157d06f87b07c05
diff --git a/puppet/modules/git b/puppet/modules/git
deleted file mode 160000
index ba5dd8d5..00000000
--- a/puppet/modules/git
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit ba5dd8d5c8e09d521ff49f1ebc753601e449f828
diff --git a/puppet/modules/haproxy b/puppet/modules/haproxy
deleted file mode 160000
index af322a73..00000000
--- a/puppet/modules/haproxy
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit af322a73c013f80a958ab7d5d31d0c75cf6d0523
diff --git a/puppet/modules/lsb b/puppet/modules/lsb
deleted file mode 160000
index 3742c1a0..00000000
--- a/puppet/modules/lsb
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 3742c1a00c5602154a81834443ec5b0ca32c4ca0
diff --git a/puppet/modules/nagios b/puppet/modules/nagios
deleted file mode 160000
index e6fee3c7..00000000
--- a/puppet/modules/nagios
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit e6fee3c731f68ccf8b6add8ada2162c7ad2b8407
diff --git a/puppet/modules/ntp b/puppet/modules/ntp
deleted file mode 160000
index 27f2bc72..00000000
--- a/puppet/modules/ntp
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 27f2bc72110b1001233eb0907aa07e06cdf33194
diff --git a/puppet/modules/openvpn b/puppet/modules/openvpn
deleted file mode 160000
index 25f1fe8d..00000000
--- a/puppet/modules/openvpn
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 25f1fe8d813f6128068d890a40f5e24be78fb47c
diff --git a/puppet/modules/passenger b/puppet/modules/passenger
deleted file mode 160000
index d1b46de8..00000000
--- a/puppet/modules/passenger
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit d1b46de84acf4d9e3582b64e019935fb1125f9bb
diff --git a/puppet/modules/postfix b/puppet/modules/postfix
deleted file mode 160000
index cce918f7..00000000
--- a/puppet/modules/postfix
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit cce918f784ebf8a8875f43c79bc3a1f39ab9456b
diff --git a/puppet/modules/resolvconf b/puppet/modules/resolvconf
deleted file mode 160000
index c7eca077..00000000
--- a/puppet/modules/resolvconf
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit c7eca077fdda063edc96d3bea02c4774569e4b10
diff --git a/puppet/modules/rsyslog b/puppet/modules/rsyslog
deleted file mode 160000
index b8ef11c2..00000000
--- a/puppet/modules/rsyslog
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit b8ef11c23949d12732ad5cdaebb3023ff39a297a
diff --git a/puppet/modules/ruby b/puppet/modules/ruby
deleted file mode 160000
index 9ccd853c..00000000
--- a/puppet/modules/ruby
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 9ccd853c49af7d0b57ebd9c2ea7673b193fce24b
diff --git a/puppet/modules/rubygems b/puppet/modules/rubygems
deleted file mode 160000
index 510a3693..00000000
--- a/puppet/modules/rubygems
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 510a3693eab5dc78ed27d3728ee4d3b12334ea12
diff --git a/puppet/modules/shorewall b/puppet/modules/shorewall
deleted file mode 160000
index e4a54e30..00000000
--- a/puppet/modules/shorewall
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit e4a54e30bf2ad7fa45c73cc544e1da4524a287a4
diff --git a/puppet/modules/squid_deb_proxy b/puppet/modules/squid_deb_proxy
deleted file mode 160000
index e796aac4..00000000
--- a/puppet/modules/squid_deb_proxy
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit e796aac43aa9781069e167459253d040504c2092
diff --git a/puppet/modules/sshd b/puppet/modules/sshd
deleted file mode 160000
index 76f4f872..00000000
--- a/puppet/modules/sshd
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 76f4f872f81209a52df2205fd88b5619df58f003
diff --git a/puppet/modules/stdlib b/puppet/modules/stdlib
deleted file mode 160000
index 71123634..00000000
--- a/puppet/modules/stdlib
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 71123634744b9fe2ec7d6a3e38e9789fd84801e3
diff --git a/puppet/modules/stunnel b/puppet/modules/stunnel
deleted file mode 160000
index 523612fb..00000000
--- a/puppet/modules/stunnel
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 523612fb6daff51837423619f5014e62dc835559
diff --git a/puppet/modules/sysctl b/puppet/modules/sysctl
deleted file mode 160000
index 975852b7..00000000
--- a/puppet/modules/sysctl
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 975852b7acc1125b4cd9d4d490b9abd8d31217e6
diff --git a/puppet/modules/systemd b/puppet/modules/systemd
deleted file mode 160000
index 6d47fd49..00000000
--- a/puppet/modules/systemd
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 6d47fd4999fe03eba6fb11c4490dcbb90d937900
diff --git a/puppet/modules/tor b/puppet/modules/tor
deleted file mode 160000
index 9981a70f..00000000
--- a/puppet/modules/tor
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 9981a70f7ba1f9e4fe33e4eb46654295287c1fc1
diff --git a/puppet/modules/unbound b/puppet/modules/unbound
deleted file mode 160000
index a26b91df..00000000
--- a/puppet/modules/unbound
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit a26b91dfea3189e6777629fa00d54f51dc41f4d4
diff --git a/puppet/modules/vcsrepo b/puppet/modules/vcsrepo
deleted file mode 160000
index 4e23209e..00000000
--- a/puppet/modules/vcsrepo
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 4e23209eaccf1ab504d35158f4141b3053327c2f
diff --git a/puppet/modules/x509 b/puppet/modules/x509
deleted file mode 160000
index 19254a38..00000000
--- a/puppet/modules/x509
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 19254a38c1c372ae7912ea9f15500b9b1cbffe81
-- 
cgit v1.2.3


From da37dd95c39f3f100020164473eed53a317fb53f Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:26 -0400
Subject: git subrepo clone https://leap.se/git/puppet_openvpn
 puppet/modules/openvpn

subrepo:
  subdir:   "puppet/modules/openvpn"
  merged:   "26d4edc"
upstream:
  origin:   "https://leap.se/git/puppet_openvpn"
  branch:   "master"
  commit:   "26d4edc"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I596766ccfb806b3ca2d1c755c4e24c5ad3d997f9
---
 puppet/modules/openvpn/.fixtures.yml               |   6 +
 puppet/modules/openvpn/.gitignore                  |   3 +
 puppet/modules/openvpn/.gitrepo                    |  11 +
 puppet/modules/openvpn/.rvmrc                      |  38 ++++
 puppet/modules/openvpn/.travis.yml                 |  29 +++
 puppet/modules/openvpn/Gemfile                     |   7 +
 puppet/modules/openvpn/Gemfile.lock                |  36 ++++
 puppet/modules/openvpn/LICENSE                     | 177 ++++++++++++++++
 puppet/modules/openvpn/Modulefile                  |  11 +
 puppet/modules/openvpn/Rakefile                    |   2 +
 puppet/modules/openvpn/Readme.markdown             |  54 +++++
 puppet/modules/openvpn/Vagrantfile                 |  42 ++++
 puppet/modules/openvpn/manifests/client.pp         | 187 +++++++++++++++++
 .../openvpn/manifests/client_specific_config.pp    |  79 +++++++
 puppet/modules/openvpn/manifests/config.pp         |  52 +++++
 puppet/modules/openvpn/manifests/init.pp           |  43 ++++
 puppet/modules/openvpn/manifests/install.pp        |  46 ++++
 puppet/modules/openvpn/manifests/params.pp         |  37 ++++
 puppet/modules/openvpn/manifests/server.pp         | 233 +++++++++++++++++++++
 puppet/modules/openvpn/manifests/service.pp        |  36 ++++
 .../openvpn/spec/classes/openvpn_config_spec.rb    |  15 ++
 .../openvpn/spec/classes/openvpn_init_spec.rb      |   9 +
 .../openvpn/spec/classes/openvpn_install_spec.rb   |  11 +
 .../openvpn/spec/classes/openvpn_service_spec.rb   |  13 ++
 .../openvpn/spec/defines/openvpn_client_spec.rb    |  88 ++++++++
 .../defines/openvpn_client_specific_config_spec.rb |  40 ++++
 .../openvpn/spec/defines/openvpn_server_spec.rb    | 165 +++++++++++++++
 puppet/modules/openvpn/spec/spec_helper.rb         |   2 +
 puppet/modules/openvpn/templates/client.erb        |  26 +++
 .../openvpn/templates/client_specific_config.erb   |  10 +
 .../openvpn/templates/etc-default-openvpn.erb      |  20 ++
 puppet/modules/openvpn/templates/server.erb        |  37 ++++
 puppet/modules/openvpn/templates/vars.erb          |  68 ++++++
 puppet/modules/openvpn/vagrant/client.pp           |   5 +
 puppet/modules/openvpn/vagrant/server.pp           |  23 ++
 35 files changed, 1661 insertions(+)
 create mode 100644 puppet/modules/openvpn/.fixtures.yml
 create mode 100644 puppet/modules/openvpn/.gitignore
 create mode 100644 puppet/modules/openvpn/.gitrepo
 create mode 100644 puppet/modules/openvpn/.rvmrc
 create mode 100644 puppet/modules/openvpn/.travis.yml
 create mode 100644 puppet/modules/openvpn/Gemfile
 create mode 100644 puppet/modules/openvpn/Gemfile.lock
 create mode 100644 puppet/modules/openvpn/LICENSE
 create mode 100644 puppet/modules/openvpn/Modulefile
 create mode 100644 puppet/modules/openvpn/Rakefile
 create mode 100644 puppet/modules/openvpn/Readme.markdown
 create mode 100644 puppet/modules/openvpn/Vagrantfile
 create mode 100644 puppet/modules/openvpn/manifests/client.pp
 create mode 100644 puppet/modules/openvpn/manifests/client_specific_config.pp
 create mode 100644 puppet/modules/openvpn/manifests/config.pp
 create mode 100644 puppet/modules/openvpn/manifests/init.pp
 create mode 100644 puppet/modules/openvpn/manifests/install.pp
 create mode 100644 puppet/modules/openvpn/manifests/params.pp
 create mode 100644 puppet/modules/openvpn/manifests/server.pp
 create mode 100644 puppet/modules/openvpn/manifests/service.pp
 create mode 100644 puppet/modules/openvpn/spec/classes/openvpn_config_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/classes/openvpn_install_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/classes/openvpn_service_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/defines/openvpn_client_specific_config_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/spec_helper.rb
 create mode 100644 puppet/modules/openvpn/templates/client.erb
 create mode 100644 puppet/modules/openvpn/templates/client_specific_config.erb
 create mode 100644 puppet/modules/openvpn/templates/etc-default-openvpn.erb
 create mode 100644 puppet/modules/openvpn/templates/server.erb
 create mode 100644 puppet/modules/openvpn/templates/vars.erb
 create mode 100644 puppet/modules/openvpn/vagrant/client.pp
 create mode 100644 puppet/modules/openvpn/vagrant/server.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/openvpn/.fixtures.yml b/puppet/modules/openvpn/.fixtures.yml
new file mode 100644
index 00000000..1125ecca
--- /dev/null
+++ b/puppet/modules/openvpn/.fixtures.yml
@@ -0,0 +1,6 @@
+fixtures:
+  repositories:
+    concat: git://github.com/ripienaar/puppet-concat.git
+  symlinks:
+    openvpn: "#{source_dir}"
+
diff --git a/puppet/modules/openvpn/.gitignore b/puppet/modules/openvpn/.gitignore
new file mode 100644
index 00000000..6fd248b3
--- /dev/null
+++ b/puppet/modules/openvpn/.gitignore
@@ -0,0 +1,3 @@
+pkg
+spec/fixtures
+.vagrant
diff --git a/puppet/modules/openvpn/.gitrepo b/puppet/modules/openvpn/.gitrepo
new file mode 100644
index 00000000..0c191cd8
--- /dev/null
+++ b/puppet/modules/openvpn/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_openvpn
+	branch = master
+	commit = 26d4edc669853a268a65d2cbbfb42c19f1333de7
+	parent = 7ce3190986cf8e5fe037a7ccd4c1076505b117f4
+	cmdver = 0.3.0
diff --git a/puppet/modules/openvpn/.rvmrc b/puppet/modules/openvpn/.rvmrc
new file mode 100644
index 00000000..6fbfb7f1
--- /dev/null
+++ b/puppet/modules/openvpn/.rvmrc
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# This is an RVM Project .rvmrc file, used to automatically load the ruby
+# development environment upon cd'ing into the directory
+
+# First we specify our desired <ruby>[@<gemset>], the @gemset name is optional,
+# Only full ruby name is supported here, for short names use:
+#     echo "rvm use 1.9.3" > .rvmrc
+environment_id="ruby-1.9.3-p194@puppet"
+
+# Uncomment the following lines if you want to verify rvm version per project
+# rvmrc_rvm_version="1.15.8 (stable)" # 1.10.1 seams as a safe start
+# eval "$(echo ${rvm_version}.${rvmrc_rvm_version} | awk -F. '{print "[[ "$1*65536+$2*256+$3" -ge "$4*65536+$5*256+$6" ]]"}' )" || {
+#   echo "This .rvmrc file requires at least RVM ${rvmrc_rvm_version}, aborting loading."
+#   return 1
+# }
+
+# First we attempt to load the desired environment directly from the environment
+# file. This is very fast and efficient compared to running through the entire
+# CLI and selector. If you want feedback on which environment was used then
+# insert the word 'use' after --create as this triggers verbose mode.
+if [[ -d "${rvm_path:-$HOME/.rvm}/environments"
+  && -s "${rvm_path:-$HOME/.rvm}/environments/$environment_id" ]]
+then
+  \. "${rvm_path:-$HOME/.rvm}/environments/$environment_id"
+  [[ -s "${rvm_path:-$HOME/.rvm}/hooks/after_use" ]] &&
+    \. "${rvm_path:-$HOME/.rvm}/hooks/after_use" || true
+  if [[ $- == *i* ]] # check for interactive shells
+  then echo "Using: $(tput setaf 2)$GEM_HOME$(tput sgr0)" # show the user the ruby and gemset they are using in green
+  else echo "Using: $GEM_HOME" # don't use colors in non-interactive shells
+  fi
+else
+  # If the environment file has not yet been created, use the RVM CLI to select.
+  rvm --create use  "$environment_id" || {
+    echo "Failed to create RVM environment '${environment_id}'."
+    return 1
+  }
+fi
diff --git a/puppet/modules/openvpn/.travis.yml b/puppet/modules/openvpn/.travis.yml
new file mode 100644
index 00000000..da5c389d
--- /dev/null
+++ b/puppet/modules/openvpn/.travis.yml
@@ -0,0 +1,29 @@
+language: ruby
+bundler_args: --without development
+script: "bundle exec rake spec SPEC_OPTS='--format documentation'"
+rvm:
+  - 1.8.7
+  - 1.9.3
+  - 2.0.0
+script:
+  - "rake lint"
+  - "rake spec SPEC_OPTS='--format documentation'"
+env:
+  - PUPPET_VERSION="~> 2.7.0"
+  - PUPPET_VERSION="~> 3.0.0"
+  - PUPPET_VERSION="~> 3.1.0"
+  - PUPPET_VERSION="~> 3.2.0"
+matrix:
+  exclude:
+    - rvm: 1.9.3
+      env: PUPPET_VERSION="~> 2.7.0"
+    - rvm: 2.0.0
+      env: PUPPET_VERSION="~> 2.7.0"
+    - rvm: 2.0.0
+      env: PUPPET_VERSION="~> 3.0.0"
+    - rvm: 2.0.0
+      env: PUPPET_VERSION="~> 3.1.0"
+notifications:
+  email: false
+  on_success: always
+  on_failure: always
diff --git a/puppet/modules/openvpn/Gemfile b/puppet/modules/openvpn/Gemfile
new file mode 100644
index 00000000..68e10e7d
--- /dev/null
+++ b/puppet/modules/openvpn/Gemfile
@@ -0,0 +1,7 @@
+source :rubygems
+
+puppetversion = ENV['PUPPET_VERSION']
+gem 'puppet', puppetversion, :require => false
+gem 'puppet-lint'
+gem 'rspec-puppet'
+gem 'puppetlabs_spec_helper'
diff --git a/puppet/modules/openvpn/Gemfile.lock b/puppet/modules/openvpn/Gemfile.lock
new file mode 100644
index 00000000..9fce3f98
--- /dev/null
+++ b/puppet/modules/openvpn/Gemfile.lock
@@ -0,0 +1,36 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    diff-lcs (1.1.3)
+    facter (1.6.17)
+    hiera (1.0.0)
+    metaclass (0.0.1)
+    mocha (0.13.1)
+      metaclass (~> 0.0.1)
+    puppet (3.0.2)
+      facter (~> 1.6.11)
+      hiera (~> 1.0.0)
+    puppetlabs_spec_helper (0.4.0)
+      mocha (>= 0.10.5)
+      rake
+      rspec (>= 2.9.0)
+      rspec-puppet (>= 0.1.1)
+    rake (10.0.3)
+    rspec (2.12.0)
+      rspec-core (~> 2.12.0)
+      rspec-expectations (~> 2.12.0)
+      rspec-mocks (~> 2.12.0)
+    rspec-core (2.12.2)
+    rspec-expectations (2.12.1)
+      diff-lcs (~> 1.1.3)
+    rspec-mocks (2.12.1)
+    rspec-puppet (0.1.5)
+      rspec
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  puppet
+  puppetlabs_spec_helper
+  rspec-puppet
diff --git a/puppet/modules/openvpn/LICENSE b/puppet/modules/openvpn/LICENSE
new file mode 100644
index 00000000..f433b1a5
--- /dev/null
+++ b/puppet/modules/openvpn/LICENSE
@@ -0,0 +1,177 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
diff --git a/puppet/modules/openvpn/Modulefile b/puppet/modules/openvpn/Modulefile
new file mode 100644
index 00000000..679e7e64
--- /dev/null
+++ b/puppet/modules/openvpn/Modulefile
@@ -0,0 +1,11 @@
+name    'luxflux-openvpn'
+version '2.1.0'
+source 'https://github.com/luxflux/puppet-openvpn'
+author 'luxflux'
+license 'Apache 2.0'
+summary 'OpenVPN server puppet module'
+description 'Puppet module to manage OpenVPN servers'
+project_page 'https://github.com/luxflux/puppet-openvpn'
+
+## Add dependencies, if any:
+dependency 'ripienaar/concat', '0.2.0'
diff --git a/puppet/modules/openvpn/Rakefile b/puppet/modules/openvpn/Rakefile
new file mode 100644
index 00000000..14f1c246
--- /dev/null
+++ b/puppet/modules/openvpn/Rakefile
@@ -0,0 +1,2 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/rake_tasks'
diff --git a/puppet/modules/openvpn/Readme.markdown b/puppet/modules/openvpn/Readme.markdown
new file mode 100644
index 00000000..6bcf49ea
--- /dev/null
+++ b/puppet/modules/openvpn/Readme.markdown
@@ -0,0 +1,54 @@
+# OpenVPN Puppet module
+
+Puppet module to manage OpenVPN servers
+
+## Features:
+
+* Client-specific rules and access policies
+* Generated client configurations and SSL-Certificates
+* Downloadable client configurations and SSL-Certificates for easy client configuration
+* Support for multiple server instances
+
+Tested on Ubuntu Precise Pangolin, CentOS 6, RedHat 6.
+
+
+## Dependencies
+  - [puppet-concat](https://github.com/ripienaar/puppet-concat)
+
+
+## Example
+
+```puppet
+  # add a server instance
+  openvpn::server { 'winterthur':
+    country      => 'CH',
+    province     => 'ZH',
+    city         => 'Winterthur',
+    organization => 'example.org',
+    email        => 'root@example.org',
+    server       => '10.200.200.0 255.255.255.0'
+  }
+
+  # define clients
+  openvpn::client { 'client1':
+    server => 'winterthur'
+  }
+  openvpn::client { 'client2':
+    server   => 'winterthur'
+  }
+
+  openvpn::client_specific_config { 'client1':
+    server => 'winterthur',
+    ifconfig => '10.200.200.50 255.255.255.0'
+  }
+```
+
+Don't forget the [sysctl](https://github.com/luxflux/puppet-sysctl) directive ```net.ipv4.ip_forward```!
+
+
+# Contributors
+
+These fine folks helped to get this far with this module:
+* [@jlambert121](https://github.com/jlambert121)
+* [@jlk](https://github.com/jlk)
+* [@elisiano](https://github.com/elisiano)
diff --git a/puppet/modules/openvpn/Vagrantfile b/puppet/modules/openvpn/Vagrantfile
new file mode 100644
index 00000000..88875ff8
--- /dev/null
+++ b/puppet/modules/openvpn/Vagrantfile
@@ -0,0 +1,42 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+def server_config(config)
+  config.vm.provision :puppet, :module_path => '..' do |puppet|
+    puppet.manifests_path = "vagrant"
+    puppet.manifest_file  = "server.pp"
+  end
+end
+
+def client_config(config)
+  config.vm.provision :puppet, :module_path => '..' do |puppet|
+    puppet.manifests_path = "vagrant"
+    puppet.manifest_file  = "client.pp"
+  end
+end
+
+Vagrant::Config.run do |config|
+
+  config.vm.define :server_ubuntu do |c|
+    c.vm.box = 'precise64'
+    server_config c
+    c.vm.network :hostonly, '10.255.255.10'
+  end
+
+  config.vm.define :server_centos do |c|
+    c.vm.box = 'centos63'
+
+    c.vm.provision :shell, :inline => 'if [ ! -f rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm ]; then wget -q http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm; fi'
+    c.vm.provision :shell, :inline => 'yum install -y rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm || exit 0'
+
+    server_config c
+    c.vm.network :hostonly, '10.255.255.11'
+  end
+
+  config.vm.define :client_ubuntu do |c|
+    c.vm.box = 'precise64'
+    client_config c
+    c.vm.network :hostonly, '10.255.255.20'
+  end
+
+end
diff --git a/puppet/modules/openvpn/manifests/client.pp b/puppet/modules/openvpn/manifests/client.pp
new file mode 100644
index 00000000..92c6aa4e
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/client.pp
@@ -0,0 +1,187 @@
+# == Define: openvpn::client
+#
+# This define creates the client certs for a specified openvpn server as well
+# as creating a tarball that can be directly imported into openvpn clients
+#
+#
+# === Parameters
+#
+# [*server*]
+#   String.  Name of the corresponding openvpn endpoint
+#   Required
+#
+# [*compression*]
+#   String.  Which compression algorithim to use
+#   Default: comp-lzo
+#   Options: comp-lzo or '' (disable compression)
+#
+# [*dev*]
+#   String.  Device method
+#   Default: tun
+#   Options: tun (routed connections), tap (bridged connections)
+#
+# [*mute*]
+#   Integer.  Set log mute level
+#   Default: 20
+#
+# [*mute_replay_warnings*]
+#   Boolean.  Silence duplicate packet warnings (common on wireless networks)
+#   Default: true
+#
+# [*nobind*]
+#   Boolean.  Whether or not to bind to a specific port number
+#   Default: true
+#
+# [*persist_key*]
+#   Boolean.  Try to retain access to resources that may be unavailable
+#     because of privilege downgrades
+#   Default: true
+#
+# [*persist_tun*]
+#   Boolean.  Try to retain access to resources that may be unavailable
+#     because of privilege downgrades
+#   Default: true
+#
+# [*port*]
+#   Integer.  The port the openvpn server service is running on
+#   Default: 1194
+#
+# [*proto*]
+#   String.  What IP protocol is being used.
+#   Default: tcp
+#   Options: tcp or udp
+#
+# [*remote_host*]
+#   String.  The IP or hostname of the openvpn server service
+#   Default: FQDN
+#
+# [*resolv_retry*]
+#   Integer/String. How many seconds should the openvpn client try to resolve
+#     the server's hostname
+#   Default: infinite
+#   Options: Integer or infinite
+#
+# [*verb*]
+#   Integer.  Level of logging verbosity
+#   Default: 3
+#
+#
+# === Examples
+#
+#   openvpn::client {
+#     'my_user':
+#       server      => 'contractors',
+#       remote_host => 'vpn.mycompany.com'
+#    }
+#
+# * Removal:
+#     Manual process right now, todo for the future
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+# === License
+#
+# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+define openvpn::client(
+  $server,
+  $compression = 'comp-lzo',
+  $dev = 'tun',
+  $mute = '20',
+  $mute_replay_warnings = true,
+  $nobind = true,
+  $persist_key = true,
+  $persist_tun = true,
+  $port = '1194',
+  $proto = 'tcp',
+  $remote_host = $::fqdn,
+  $resolv_retry = 'infinite',
+  $verb = '3',
+) {
+
+  Openvpn::Server[$server] ->
+  Openvpn::Client[$name]
+
+  exec {
+    "generate certificate for ${name} in context of ${server}":
+      command  => ". ./vars && ./pkitool ${name}",
+      cwd      => "/etc/openvpn/${server}/easy-rsa",
+      creates  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.crt",
+      provider => 'shell';
+  }
+
+  file {
+    [ "/etc/openvpn/${server}/download-configs/${name}",
+      "/etc/openvpn/${server}/download-configs/${name}/keys"]:
+        ensure  => directory;
+
+    "/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt":
+      ensure  => link,
+      target  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.crt",
+      require => Exec["generate certificate for ${name} in context of ${server}"];
+
+    "/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key":
+      ensure  => link,
+      target  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.key",
+      require => Exec["generate certificate for ${name} in context of ${server}"];
+
+    "/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt":
+      ensure  => link,
+      target  => "/etc/openvpn/${server}/easy-rsa/keys/ca.crt",
+      require => Exec["generate certificate for ${name} in context of ${server}"];
+
+    "/etc/openvpn/${server}/download-configs/${name}/${name}.conf":
+      owner   => root,
+      group   => root,
+      mode    => '0444',
+      content => template('openvpn/client.erb'),
+      notify  => Exec["tar the thing ${server} with ${name}"];
+  }
+
+  exec {
+    "tar the thing ${server} with ${name}":
+      cwd         => "/etc/openvpn/${server}/download-configs/",
+      command     => "/bin/rm ${name}.tar.gz; tar --exclude=\\*.conf.d -chzvf ${name}.tar.gz ${name}",
+      refreshonly => true,
+      require     => [  File["/etc/openvpn/${server}/download-configs/${name}/${name}.conf"],
+                        File["/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt"],
+                        File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key"],
+                        File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt"]
+                      ],
+      notify      => Exec["generate ${name}.ovpn in ${server}"];
+  }
+
+  exec {
+    "generate ${name}.ovpn in ${server}":
+      cwd         => "/etc/openvpn/${server}/download-configs/",
+      command     => "/bin/rm ${name}.ovpn; cat  ${name}/${name}.conf|perl -lne 'if(m|^ca keys/ca.crt|){ chomp(\$ca=`cat ${name}/keys/ca.crt`); print \"<ca>\n\$ca\n</ca>\"} elsif(m|^cert keys/${name}.crt|) { chomp(\$crt=`cat ${name}/keys/${name}.crt`); print \"<cert>\n\$crt\n</cert>\"} elsif(m|^key keys/${name}.key|){ chomp(\$key=`cat ${name}/keys/${name}.key`); print \"<key>\n\$key\n</key>\"} else { print} ' > ${name}.ovpn",
+      refreshonly => true,
+      require     => [  File["/etc/openvpn/${server}/download-configs/${name}/${name}.conf"],
+                        File["/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt"],
+                        File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key"],
+                        File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt"],
+                      ],
+  }
+
+  file { "/etc/openvpn/${server}/download-configs/${name}.ovpn":
+    mode    => '0400',
+    require => Exec["generate ${name}.ovpn in ${server}"],
+  }
+}
diff --git a/puppet/modules/openvpn/manifests/client_specific_config.pp b/puppet/modules/openvpn/manifests/client_specific_config.pp
new file mode 100644
index 00000000..4287421a
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/client_specific_config.pp
@@ -0,0 +1,79 @@
+# == Define: openvpn::client_specific_config
+#
+# This define configures options which will be pushed by the server to a
+# specific client only. This feature is explained here:
+#  http://openvpn.net/index.php/open-source/documentation/howto.html#policy
+#
+# === Parameters
+#
+# All the parameters are explained in the openvpn documentation:
+#   http://openvpn.net/index.php/open-source/documentation/howto.html#policy
+#
+# [*server*]
+#   String.  Name of the corresponding openvpn endpoint
+#   Required
+#
+# [*iroute*]
+#   Array.  Array of iroute combinations.
+#   Default: []
+#
+# [*ifconfig*]
+#   String.  IP configuration to push to the client.
+#   Default: false
+#
+# [*dhcp_options]
+#   Array.  DHCP options to push to the client.
+#   Default: []
+#
+#
+# === Examples
+#
+#   openvpn::client_specific_config {
+#     'vpn_client':
+#       server       => 'contractors',
+#       iroute       => ['10.0.1.0 255.255.255.0'],
+#       ifconfig     => '10.10.10.1 10.10.10.2',
+#       dhcp_options => ['DNS 8.8.8.8']
+#    }
+#
+# * Removal:
+#     Manual process right now, todo for the future
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+#
+# === License
+#
+# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+define openvpn::client_specific_config(
+  $server,
+  $iroute       = [],
+  $ifconfig     = false,
+  $dhcp_options = []
+) {
+
+  Openvpn::Server[$server] ->
+  Openvpn::Client[$name] ->
+  Openvpn::Client_specific_config[$name]
+
+  file { "/etc/openvpn/${server}/client-configs/${name}":
+    ensure  => present,
+    content => template('openvpn/client_specific_config.erb')
+  }
+
+}
diff --git a/puppet/modules/openvpn/manifests/config.pp b/puppet/modules/openvpn/manifests/config.pp
new file mode 100644
index 00000000..32b32094
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/config.pp
@@ -0,0 +1,52 @@
+# == Class: openvpn::config
+#
+# This class sets up the openvpn enviornment as well as the default config file
+#
+#
+# === Examples
+#
+# This class should not be directly invoked
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+# === License
+#
+# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+class openvpn::config {
+
+  if $::osfamily == 'Debian' {
+    include concat::setup
+
+    concat {
+      '/etc/default/openvpn':
+        owner  => root,
+        group  => root,
+        mode   => 644,
+        warn   => true;
+    }
+
+    concat::fragment {
+      'openvpn.default.header':
+        content => template('openvpn/etc-default-openvpn.erb'),
+        target  => '/etc/default/openvpn',
+        order   => 01;
+    }
+  }
+}
diff --git a/puppet/modules/openvpn/manifests/init.pp b/puppet/modules/openvpn/manifests/init.pp
new file mode 100644
index 00000000..7e07f025
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/init.pp
@@ -0,0 +1,43 @@
+# == Class: openvpn
+#
+# This module installs the openvpn service, configures vpn endpoints, generates
+# client certificates, and generates client config files
+#
+#
+# === Examples
+#
+# * Installation:
+#     class { 'openvpn': }
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+# === License
+#
+# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+class openvpn {
+
+  class {'openvpn::params': } ->
+  class {'openvpn::install': } ->
+  class {'openvpn::config': } ~>
+  class {'openvpn::service': } ->
+  Class['openvpn']
+
+}
diff --git a/puppet/modules/openvpn/manifests/install.pp b/puppet/modules/openvpn/manifests/install.pp
new file mode 100644
index 00000000..a230373a
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/install.pp
@@ -0,0 +1,46 @@
+# == Class: openvpn
+#
+# This module installs the openvpn service, configures vpn endpoints, generates
+# client certificates, and generates client config files
+#
+#
+# === Examples
+#
+# This class should not be directly invoked
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+# === License
+#
+# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+class openvpn::install {
+
+  package {
+    'openvpn':
+      ensure => installed;
+  }
+
+  file {
+    [ '/etc/openvpn', '/etc/openvpn/keys' ]:
+      ensure  => directory,
+      require => Package['openvpn'];
+  }
+}
diff --git a/puppet/modules/openvpn/manifests/params.pp b/puppet/modules/openvpn/manifests/params.pp
new file mode 100644
index 00000000..33495270
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/params.pp
@@ -0,0 +1,37 @@
+# === License
+#
+# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+class openvpn::params {
+
+  $group = $::osfamily ? {
+    'RedHat' => 'nobody',
+    default  => 'nogroup'
+  }
+
+  $easyrsa_source = $::osfamily ? {
+    'RedHat'  => $::operatingsystemmajrelease ? {
+      6 => '/usr/share/openvpn/easy-rsa/2.0',
+      default => '/usr/share/doc/openvpn-2.2.2/easy-rsa/2.0'
+    },
+    default   => '/usr/share/doc/openvpn/examples/easy-rsa/2.0'
+  }
+
+  $link_openssl_cnf = $::osfamily ? {
+    /(Debian|RedHat)/ => true,
+    default           => false
+  }
+
+}
diff --git a/puppet/modules/openvpn/manifests/server.pp b/puppet/modules/openvpn/manifests/server.pp
new file mode 100644
index 00000000..649048c4
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/server.pp
@@ -0,0 +1,233 @@
+# == Define: openvpn::server
+#
+# This define creates the openvpn server instance and ssl certificates
+#
+#
+# === Parameters
+#
+# [*country*]
+#   String.  Country to be used for the SSL certificate
+#
+# [*province*]
+#   String.  Province to be used for the SSL certificate
+#
+# [*city*]
+#   String.  City to be used for the SSL certificate
+#
+# [*organization*]
+#   String.  Organization to be used for the SSL certificate
+#
+# [*email*]
+#   String.  Email address to be used for the SSL certificate
+#
+# [*compression*]
+#   String.  Which compression algorithim to use
+#   Default: comp-lzo
+#   Options: comp-lzo or '' (disable compression)
+#
+# [*dev*]
+#   String.  Device method
+#   Default: tun
+#   Options: tun (routed connections), tap (bridged connections)
+#
+# [*user*]
+#   String.  Group to drop privileges to after startup
+#   Default: nobody
+#
+# [*group*]
+#   String.  User to drop privileges to after startup
+#   Default: depends on your $::osfamily
+#
+# [*ipp*]
+#   Boolean.  Persist ifconfig information to a file to retain client IP
+#     addresses between sessions
+#   Default: false
+#
+# [*local*]
+#   String.  Interface for openvpn to bind to.
+#   Default: $::ipaddress_eth0
+#   Options: An IP address or '' to bind to all ip addresses
+#
+# [*logfile*]
+#   String.  Logfile for this openvpn server
+#   Default: false
+#   Options: false (syslog) or log file name
+#
+# [*port*]
+#   Integer.  The port the openvpn server service is running on
+#   Default: 1194
+#
+# [*proto*]
+#   String.  What IP protocol is being used.
+#   Default: tcp
+#   Options: tcp or udp
+#
+# [*status_log*]
+#   String.  Logfile for periodic dumps of the vpn service status
+#   Default: "${name}/openvpn-status.log"
+#
+# [*server*]
+#   String.  Network to assign client addresses out of
+#   Default: None.  Required in tun mode, not in tap mode
+#
+# [*push*]
+#   Array.  Options to push out to the client.  This can include routes, DNS
+#     servers, DNS search domains, and many other options.
+#   Default: []
+#
+#
+# === Examples
+#
+#   openvpn::client {
+#     'my_user':
+#       server      => 'contractors',
+#       remote_host => 'vpn.mycompany.com'
+#    }
+#
+# * Removal:
+#     Manual process right now, todo for the future
+#
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+# === License
+#
+# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+define openvpn::server(
+  $country,
+  $province,
+  $city,
+  $organization,
+  $email,
+  $compression = 'comp-lzo',
+  $dev = 'tun0',
+  $user = 'nobody',
+  $group = false,
+  $ipp = false,
+  $ip_pool = [],
+  $local = $::ipaddress_eth0,
+  $logfile = false,
+  $port = '1194',
+  $proto = 'tcp',
+  $status_log = "${name}/openvpn-status.log",
+  $server = '',
+  $push = []
+) {
+
+  include openvpn
+  Class['openvpn::install'] ->
+  Openvpn::Server[$name] ~>
+  Class['openvpn::service']
+
+  $tls_server = $proto ? {
+    /tcp/   => true,
+    default => false
+  }
+
+  $group_to_set = $group ? {
+    false   => $openvpn::params::group,
+    default => $group
+  }
+
+  file {
+    ["/etc/openvpn/${name}", "/etc/openvpn/${name}/client-configs", "/etc/openvpn/${name}/download-configs" ]:
+      ensure  => directory;
+  }
+
+  exec {
+    "copy easy-rsa to openvpn config folder ${name}":
+      command => "/bin/cp -r ${openvpn::params::easyrsa_source} /etc/openvpn/${name}/easy-rsa",
+      creates => "/etc/openvpn/${name}/easy-rsa",
+      notify  => Exec["fix_easyrsa_file_permissions_${name}"],
+      require => File["/etc/openvpn/${name}"];
+  }
+
+  exec {
+    "fix_easyrsa_file_permissions_${name}":
+      refreshonly => true,
+      command     => "/bin/chmod 755 /etc/openvpn/${name}/easy-rsa/*";
+  }
+
+  file {
+    "/etc/openvpn/${name}/easy-rsa/vars":
+      ensure  => present,
+      content => template('openvpn/vars.erb'),
+      require => Exec["copy easy-rsa to openvpn config folder ${name}"];
+  }
+
+  file {
+    "/etc/openvpn/${name}/easy-rsa/openssl.cnf":
+      require => Exec["copy easy-rsa to openvpn config folder ${name}"];
+  }
+
+  if $openvpn::params::link_openssl_cnf == true {
+    File["/etc/openvpn/${name}/easy-rsa/openssl.cnf"] {
+      ensure => link,
+      target => "/etc/openvpn/${name}/easy-rsa/openssl-1.0.0.cnf"
+    }
+  }
+
+  exec {
+    "generate dh param ${name}":
+      command  => '. ./vars && ./clean-all && ./build-dh',
+      cwd      => "/etc/openvpn/${name}/easy-rsa",
+      creates  => "/etc/openvpn/${name}/easy-rsa/keys/dh1024.pem",
+      provider => 'shell',
+      require  => File["/etc/openvpn/${name}/easy-rsa/vars"];
+
+    "initca ${name}":
+      command  => '. ./vars && ./pkitool --initca',
+      cwd      => "/etc/openvpn/${name}/easy-rsa",
+      creates  => "/etc/openvpn/${name}/easy-rsa/keys/ca.key",
+      provider => 'shell',
+      require  => [ Exec["generate dh param ${name}"], File["/etc/openvpn/${name}/easy-rsa/openssl.cnf"] ];
+
+    "generate server cert ${name}":
+      command  => '. ./vars && ./pkitool --server server',
+      cwd      => "/etc/openvpn/${name}/easy-rsa",
+      creates  => "/etc/openvpn/${name}/easy-rsa/keys/server.key",
+      provider => 'shell',
+      require  => Exec["initca ${name}"];
+  }
+
+  file {
+    "/etc/openvpn/${name}/keys":
+      ensure  => link,
+      target  => "/etc/openvpn/${name}/easy-rsa/keys",
+      require => Exec["copy easy-rsa to openvpn config folder ${name}"];
+  }
+
+  if $::osfamily == 'Debian' {
+    concat::fragment {
+      "openvpn.default.autostart.${name}":
+        content => "AUTOSTART=\"\$AUTOSTART ${name}\"\n",
+        target  => '/etc/default/openvpn',
+        order   => 10;
+    }
+  }
+
+  file {
+    "/etc/openvpn/${name}.conf":
+      owner   => root,
+      group   => root,
+      mode    => '0444',
+      content => template('openvpn/server.erb');
+  }
+}
diff --git a/puppet/modules/openvpn/manifests/service.pp b/puppet/modules/openvpn/manifests/service.pp
new file mode 100644
index 00000000..54e8db7d
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/service.pp
@@ -0,0 +1,36 @@
+# == Class: openvpn::config
+#
+# This class maintains the openvpn service
+#
+#
+# === Examples
+#
+# This class should not be directly invoked
+#
+# === Authors
+#
+# * Raffael Schmid <mailto:raffael@yux.ch>
+# * John Kinsella <mailto:jlkinsel@gmail.com>
+# * Justin Lambert <mailto:jlambert@letsevenup.com>
+#
+# === License
+#
+# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# lied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+class openvpn::service {
+  service {
+    'openvpn':
+      ensure     => running,
+      enable     => true,
+      hasrestart => true,
+      hasstatus  => true;
+  }
+}
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_config_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_config_spec.rb
new file mode 100644
index 00000000..bbb63a77
--- /dev/null
+++ b/puppet/modules/openvpn/spec/classes/openvpn_config_spec.rb
@@ -0,0 +1,15 @@
+require 'spec_helper'
+ 
+describe 'openvpn::config', :type => :class do
+  
+  it { should create_class('openvpn::config') }
+  
+  context "on Debian based machines" do
+    let (:facts) { { :osfamily => 'Debian', :concat_basedir => '/var/lib/puppet/concat' } }
+
+    it { should contain_class('concat::setup') }
+    it { should contain_concat('/etc/default/openvpn') }
+    it { should contain_concat__fragment('openvpn.default.header') }
+  end
+
+end
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
new file mode 100644
index 00000000..45dcc9bf
--- /dev/null
+++ b/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
@@ -0,0 +1,9 @@
+require 'spec_helper'
+ 
+describe 'openvpn', :type => :class do
+
+  let (:facts) { { :concat_basedir => '/var/lib/puppet/concat' } }
+
+  it { should create_class('openvpn') }
+
+end
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_install_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_install_spec.rb
new file mode 100644
index 00000000..cdb31358
--- /dev/null
+++ b/puppet/modules/openvpn/spec/classes/openvpn_install_spec.rb
@@ -0,0 +1,11 @@
+require 'spec_helper'
+ 
+describe 'openvpn::install', :type => :class do
+
+  it { should create_class('openvpn::install') }
+  it { should contain_package('openvpn') }
+
+  it { should contain_file('/etc/openvpn').with('ensure' => 'directory') }
+  it { should contain_file('/etc/openvpn/keys').with('ensure' => 'directory') }
+
+end
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_service_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_service_spec.rb
new file mode 100644
index 00000000..f427e7f1
--- /dev/null
+++ b/puppet/modules/openvpn/spec/classes/openvpn_service_spec.rb
@@ -0,0 +1,13 @@
+require 'spec_helper'
+ 
+describe 'openvpn::service', :type => :class do
+
+  let (:facts) { { :concat_basedir => '/var/lib/puppet/concat' } }
+
+  it { should create_class('openvpn::service') }
+  it { should contain_service('openvpn').with(
+    'ensure'  => 'running',
+    'enable'  => true
+  ) }
+
+end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
new file mode 100644
index 00000000..a4b580e8
--- /dev/null
+++ b/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
@@ -0,0 +1,88 @@
+require 'spec_helper'
+ 
+describe 'openvpn::client', :type => :define do
+  let(:title) { 'test_client' }
+  let(:params) { { 'server' => 'test_server' } }
+  let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
+  let(:pre_condition) do
+    'openvpn::server { "test_server":
+      country       => "CO",
+      province      => "ST",
+      city          => "Some City",
+      organization  => "example.org",
+      email         => "testemail@example.org"
+    }'
+  end
+
+  it { should contain_exec('generate certificate for test_client in context of test_server') }
+
+  [ 'test_client', 'test_client/keys'].each do |directory|
+    it { should contain_file("/etc/openvpn/test_server/download-configs/#{directory}") }
+  end
+
+  [ 'test_client.crt', 'test_client.key', 'ca.crt' ].each do |file|
+    it { should contain_file("/etc/openvpn/test_server/download-configs/test_client/keys/#{file}").with(
+      'ensure'  => 'link',
+      'target'  => "/etc/openvpn/test_server/easy-rsa/keys/#{file}"
+    )}
+  end
+  
+  it { should contain_exec('tar the thing test_server with test_client').with(
+    'cwd'     => '/etc/openvpn/test_server/download-configs/',
+    'command' => '/bin/rm test_client.tar.gz; tar --exclude=\*.conf.d -chzvf test_client.tar.gz test_client'
+  ) }
+
+  context "setting the minimum parameters" do
+    let(:params) { { 'server' => 'test_server' } }
+    let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
+
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^client$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^ca\s+keys\/ca\.crt$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^cert\s+keys\/test_client.crt$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^key\s+keys\/test_client\.key$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^dev\s+tun$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^proto\s+tcp$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^remote\s+somehost\s+1194$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^comp-lzo$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^resolv-retry\s+infinite$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^nobind$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^persist-key$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^persist-tun$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^mute-replay-warnings$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^ns\-cert\-type\s+server$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^verb\s+3$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^mute\s+20$/)}
+  end
+
+  context "setting all of the parameters" do
+    let(:params) { { 
+      'server'                => 'test_server',
+      'compression'           => 'comp-something',
+      'dev'                   => 'tap',
+      'mute'                  => 10,
+      'mute_replay_warnings'  => false,
+      'nobind'                => false,
+      'persist_key'           => false,
+      'persist_tun'           => false,
+      'port'                  => '123',
+      'proto'                 => 'udp',
+      'remote_host'           => 'somewhere',
+      'resolv_retry'          => '2m',
+      'verb'                  => '1'
+    } }
+    let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
+
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^client$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^ca\s+keys\/ca\.crt$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^cert\s+keys\/test_client.crt$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^key\s+keys\/test_client\.key$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^dev\s+tap$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^proto\s+udp$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^remote\s+somewhere\s+123$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^comp-something$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^resolv-retry\s+2m$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^verb\s+1$/)}
+    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^mute\s+10$/)}
+  end
+
+end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_client_specific_config_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_client_specific_config_spec.rb
new file mode 100644
index 00000000..cfdab389
--- /dev/null
+++ b/puppet/modules/openvpn/spec/defines/openvpn_client_specific_config_spec.rb
@@ -0,0 +1,40 @@
+require 'spec_helper'
+
+describe 'openvpn::client_specific_config', :type => :define do
+  let(:title) { 'test_client' }
+  let(:params) { { 'server' => 'test_server' } }
+  let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
+  let(:pre_condition) do
+    [
+      'openvpn::server { "test_server":
+        country       => "CO",
+        province      => "ST",
+        city          => "Some City",
+        organization  => "example.org",
+        email         => "testemail@example.org"
+      }',
+      'openvpn::client { "test_client":
+        server => "test_server"
+      }'
+    ].join
+  end
+
+  it { should contain_file('/etc/openvpn/test_server/client-configs/test_client') }
+
+  describe "setting no paramter at all" do
+    it { should contain_file('/etc/openvpn/test_server/client-configs/test_client').with_content(/\A\n\z/) }
+  end
+
+  describe "setting all parameters" do
+    let(:params) do
+      {:server       => 'test_server',
+       :iroute       => ['10.0.1.0 255.255.255.0'],
+       :ifconfig     => '10.10.10.2 255.255.255.0',
+       :dhcp_options => ['DNS 8.8.8.8']}
+    end
+
+    it { should contain_file('/etc/openvpn/test_server/client-configs/test_client').with_content(/^iroute 10.0.1.0 255.255.255.0$/) }
+    it { should contain_file('/etc/openvpn/test_server/client-configs/test_client').with_content(/^ifconfig-push 10.10.10.2 255.255.255.0$/) }
+    it { should contain_file('/etc/openvpn/test_server/client-configs/test_client').with_content(/^push dhcp-option DNS 8.8.8.8$/) }
+  end
+end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
new file mode 100644
index 00000000..467be6aa
--- /dev/null
+++ b/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
@@ -0,0 +1,165 @@
+require 'spec_helper'
+
+describe 'openvpn::server', :type => :define do
+
+  let(:title) { 'test_server' }
+
+  context "creating a server with the minimum parameters" do
+    let(:params) { {
+      'country'       => 'CO',
+      'province'      => 'ST',
+      'city'          => 'Some City',
+      'organization'  => 'example.org',
+      'email'         => 'testemail@example.org'
+    } }
+
+    let (:facts) { {
+      :ipaddress_eth0 => '1.2.3.4',
+      :network_eth0   => '1.2.3.0',
+      :netmask_eth0   => '255.255.255.0',
+      :concat_basedir => '/var/lib/puppet/concat',
+      :osfamily       => 'anything_else'
+    } }
+
+    # Files associated with a server config
+    it { should contain_file('/etc/openvpn/test_server').with('ensure' => 'directory')}
+    it { should contain_file('/etc/openvpn/test_server/client-configs').with('ensure' => 'directory')}
+    it { should contain_file('/etc/openvpn/test_server/download-configs').with('ensure' => 'directory')}
+    it { should contain_file('/etc/openvpn/test_server/easy-rsa/vars')}
+    it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf')}
+    it { should contain_file('/etc/openvpn/test_server/keys').with(
+      'ensure'  => 'link',
+      'target'  => '/etc/openvpn/test_server/easy-rsa/keys'
+    )}
+
+    # Execs to working with certificates
+    it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
+      'command' => '/bin/cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
+    )}
+    it { should contain_exec('generate dh param test_server') }
+    it { should contain_exec('initca test_server') }
+    it { should contain_exec('generate server cert test_server') }
+
+    # VPN server config file itself
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^mode\s+server$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^client\-config\-dir\s+\/etc\/openvpn\/test_server\/client\-configs$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^ca\s+\/etc\/openvpn\/test_server\/keys\/ca.crt$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^cert\s+\/etc\/openvpn\/test_server\/keys\/server.crt$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^key\s+\/etc\/openvpn\/test_server\/keys\/server.key$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^dh\s+\/etc\/openvpn\/test_server\/keys\/dh1024.pem$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^proto\s+tcp-server$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^tls-server$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^port\s+1194$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^comp-lzo$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^group\s+nogroup$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^user\s+nobody$/) }
+    it { should_not contain_file('/etc/openvpn/test_server.conf').with_content(/^log\-append\s+test_server\/openvpn\.log$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^status\s+test_server\/openvpn\-status\.log$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^dev\s+tun0$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^local\s+1\.2\.3\.4$/) }
+    it { should_not contain_file('/etc/openvpn/test_server.conf').with_content(/^ifconfig-pool-persist/) }
+  end
+
+  context "creating a server setting all parameters" do
+    let(:params) { {
+      'country'       => 'CO',
+      'province'      => 'ST',
+      'city'          => 'Some City',
+      'organization'  => 'example.org',
+      'email'         => 'testemail@example.org',
+      'compression'   => 'fake_compression',
+      'port'          => '123',
+      'proto'         => 'udp',
+      'group'         => 'someone',
+      'user'          => 'someone',
+      'logfile'       => '/var/log/openvpn/test_server.log',
+      'status_log'    => '/var/log/openvpn/test_server_status.log',
+      'dev'           => 'tun1',
+      'local'         => '2.3.4.5',
+      'ipp'           => true,
+      'server'        => '2.3.4.0 255.255.0.0',
+      'push'          => [ 'dhcp-option DNS 172.31.0.30', 'route 172.31.0.0 255.255.0.0' ]
+    } }
+
+    let (:facts) { {
+      :ipaddress_eth0 => '1.2.3.4',
+      :network_eth0   => '1.2.3.0',
+      :netmask_eth0   => '255.255.255.0',
+      :concat_basedir => '/var/lib/puppet/concat'
+    } }
+
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^mode\s+server$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^client\-config\-dir\s+\/etc\/openvpn\/test_server\/client\-configs$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^ca\s+\/etc\/openvpn\/test_server\/keys\/ca.crt$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^cert\s+\/etc\/openvpn\/test_server\/keys\/server.crt$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^key\s+\/etc\/openvpn\/test_server\/keys\/server.key$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^dh\s+\/etc\/openvpn\/test_server\/keys\/dh1024.pem$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^proto\s+udp$/) }
+    it { should_not contain_file('/etc/openvpn/test_server.conf').with_content(/^proto\s+tls-server$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^port\s+123$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^fake_compression$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^group\s+someone$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^user\s+someone$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^log\-append\s+\/var\/log\/openvpn\/test_server\.log$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^status\s+\/var\/log\/openvpn\/test_server_status\.log$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^dev\s+tun1$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^local\s+2\.3\.4\.5$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^server\s+2\.3\.4\.0\s+255\.255\.0\.0$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^push\s+dhcp-option\s+DNS\s+172\.31\.0\.30$/) }
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^push\s+route\s+172\.31\.0\.0\s+255\.255\.0\.0$/) }
+  end
+
+  context "when RedHat based machine" do
+    let(:params) { {
+      'country'       => 'CO',
+      'province'      => 'ST',
+      'city'          => 'Some City',
+      'organization'  => 'example.org',
+      'email'         => 'testemail@example.org'
+    } }
+
+    let(:facts) { { :osfamily => 'RedHat', :concat_basedir => '/var/lib/puppet/concat' } }
+
+    it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf').with(
+      'ensure'  => 'link',
+      'target'  => '/etc/openvpn/test_server/easy-rsa/openssl-1.0.0.cnf'
+    )}
+
+    it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
+      'command' => '/bin/cp -r /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
+    )}
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^group\s+nobody$/) }
+
+  end
+
+  context "when Debian based machine" do
+    let(:params) { {
+      'country'       => 'CO',
+      'province'      => 'ST',
+      'city'          => 'Some City',
+      'organization'  => 'example.org',
+      'email'         => 'testemail@example.org'
+    } }
+
+    let(:facts) { { :osfamily => 'Debian', :concat_basedir => '/var/lib/puppet/concat' } }
+
+    it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf').with(
+      'ensure'  => 'link',
+      'target'  => '/etc/openvpn/test_server/easy-rsa/openssl-1.0.0.cnf'
+    )}
+
+    it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
+      'command' => '/bin/cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
+    )}
+
+    # Configure to start vpn session
+    it { should contain_concat__fragment('openvpn.default.autostart.test_server').with(
+      'content' => "AUTOSTART=\"$AUTOSTART test_server\"\n",
+      'target'  => '/etc/default/openvpn'
+    )}
+
+    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^group\s+nogroup$/) }
+
+  end
+
+end
diff --git a/puppet/modules/openvpn/spec/spec_helper.rb b/puppet/modules/openvpn/spec/spec_helper.rb
new file mode 100644
index 00000000..dc7e9f4a
--- /dev/null
+++ b/puppet/modules/openvpn/spec/spec_helper.rb
@@ -0,0 +1,2 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/module_spec_helper'
diff --git a/puppet/modules/openvpn/templates/client.erb b/puppet/modules/openvpn/templates/client.erb
new file mode 100644
index 00000000..021ed617
--- /dev/null
+++ b/puppet/modules/openvpn/templates/client.erb
@@ -0,0 +1,26 @@
+client
+ca keys/ca.crt
+cert keys/<%= scope.lookupvar('name') %>.crt
+key keys/<%= scope.lookupvar('name') %>.key
+dev <%= scope.lookupvar('dev') %>
+proto <%= scope.lookupvar('proto') %>
+remote <%= scope.lookupvar('remote_host') %> <%= scope.lookupvar('port') %>
+<% if scope.lookupvar('compression') != '' -%>
+<%= scope.lookupvar('compression') %>
+<% end -%>
+resolv-retry <%= scope.lookupvar('resolv_retry') %>
+<% if scope.lookupvar('nobind') -%>
+nobind
+<% end -%>
+<% if scope.lookupvar('persist_key') -%>
+persist-key
+<% end -%>
+<% if scope.lookupvar('persist_tun') -%>
+persist-tun
+<% end -%>
+<% if scope.lookupvar('mute_replay_warnings') -%>
+mute-replay-warnings
+<% end -%>
+ns-cert-type server
+verb <%= scope.lookupvar('verb') %>
+mute <%= scope.lookupvar('mute') %>
diff --git a/puppet/modules/openvpn/templates/client_specific_config.erb b/puppet/modules/openvpn/templates/client_specific_config.erb
new file mode 100644
index 00000000..62cc0e7a
--- /dev/null
+++ b/puppet/modules/openvpn/templates/client_specific_config.erb
@@ -0,0 +1,10 @@
+<% scope.lookupvar('iroute').each do |route| -%>
+iroute <%= route %>
+<% end -%>
+<% if ifconfig = scope.lookupvar('ifconfig') -%>
+ifconfig-push <%= ifconfig %>
+<% end -%>
+<% scope.lookupvar('dhcp_options').each do |option| -%>
+push dhcp-option <%= option %>
+<% end -%>
+
diff --git a/puppet/modules/openvpn/templates/etc-default-openvpn.erb b/puppet/modules/openvpn/templates/etc-default-openvpn.erb
new file mode 100644
index 00000000..310e462e
--- /dev/null
+++ b/puppet/modules/openvpn/templates/etc-default-openvpn.erb
@@ -0,0 +1,20 @@
+# This is the configuration file for /etc/init.d/openvpn
+
+#
+# Start only these VPNs automatically via init script.
+# Allowed values are "all", "none" or space separated list of
+# names of the VPNs. If empty, "all" is assumed.
+#
+#AUTOSTART="all"
+#AUTOSTART="none"
+#AUTOSTART="home office"
+#
+# Refresh interval (in seconds) of default status files
+# located in /var/run/openvpn.$NAME.status
+# Defaults to 10, 0 disables status file generation
+#
+#STATUSREFRESH=10
+#STATUSREFRESH=0
+# Optional arguments to openvpn's command line
+OPTARGS=""
+AUTOSTART=""
diff --git a/puppet/modules/openvpn/templates/server.erb b/puppet/modules/openvpn/templates/server.erb
new file mode 100644
index 00000000..6ef13263
--- /dev/null
+++ b/puppet/modules/openvpn/templates/server.erb
@@ -0,0 +1,37 @@
+mode server
+client-config-dir /etc/openvpn/<%= scope.lookupvar('name') %>/client-configs
+ca /etc/openvpn/<%= scope.lookupvar('name') %>/keys/ca.crt
+cert /etc/openvpn/<%= scope.lookupvar('name') %>/keys/server.crt
+key /etc/openvpn/<%= scope.lookupvar('name') %>/keys/server.key
+dh /etc/openvpn/<%= scope.lookupvar('name') %>/keys/dh1024.pem
+<% if scope.lookupvar('proto') == 'tcp' -%>
+proto <%= scope.lookupvar('proto') %>-server
+<% else -%>
+proto <%= scope.lookupvar('proto') %>
+<% end -%>
+port <%= scope.lookupvar('port') %>
+<% if scope.lookupvar('tls_server') -%>
+tls-server
+<% end -%>
+<% if scope.lookupvar('compression') != '' -%>
+<%= scope.lookupvar('compression') %>
+<% end -%>
+group <%= scope.lookupvar('group_to_set') %>
+user <%= scope.lookupvar('user') %>
+<% if scope.lookupvar('logfile') -%>
+log-append <%= scope.lookupvar('logfile') %>
+<% end -%>
+status <%= scope.lookupvar('status_log') %>
+dev <%= scope.lookupvar('dev') %>
+<% if scope.lookupvar('local') != '' -%>
+local <%= scope.lookupvar('local') %>
+<% end -%>
+<% if scope.lookupvar('ipp') -%>
+ifconfig-pool-persist <%= scope.lookupvar('name') %>/vpn-ipp.txt
+<% end -%>
+<% if scope.lookupvar('server') != '' -%>
+server <%= scope.lookupvar('server') %>
+<% end -%>
+<% scope.lookupvar('push').each do |item| -%>
+push <%= item %>
+<% end -%>
diff --git a/puppet/modules/openvpn/templates/vars.erb b/puppet/modules/openvpn/templates/vars.erb
new file mode 100644
index 00000000..20448b8b
--- /dev/null
+++ b/puppet/modules/openvpn/templates/vars.erb
@@ -0,0 +1,68 @@
+# easy-rsa parameter settings
+
+# NOTE: If you installed from an RPM,
+# don't edit this file in place in
+# /usr/share/openvpn/easy-rsa --
+# instead, you should copy the whole
+# easy-rsa directory to another location
+# (such as /etc/openvpn) so that your
+# edits will not be wiped out by a future
+# OpenVPN package upgrade.
+
+# This variable should point to
+# the top level of the easy-rsa
+# tree.
+export EASY_RSA="/etc/openvpn/<%= @name %>/easy-rsa"
+
+#
+# This variable should point to
+# the requested executables
+#
+export OPENSSL="openssl"
+export PKCS11TOOL="pkcs11-tool"
+export GREP="grep"
+
+
+# This variable should point to
+# the openssl.cnf file included
+# with easy-rsa.
+export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
+
+# Edit this variable to point to
+# your soon-to-be-created key
+# directory.
+#
+# WARNING: clean-all will do
+# a rm -rf on this directory
+# so make sure you define
+# it correctly!
+export KEY_DIR="$EASY_RSA/keys"
+
+# Issue rm -rf warning
+echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
+
+# PKCS11 fixes
+export PKCS11_MODULE_PATH="dummy"
+export PKCS11_PIN="dummy"
+
+# Increase this to 2048 if you
+# are paranoid.  This will slow
+# down TLS negotiation performance
+# as well as the one-time DH parms
+# generation process.
+export KEY_SIZE=1024
+
+# In how many days should the root CA key expire?
+export CA_EXPIRE=3650
+
+# In how many days should certificates expire?
+export KEY_EXPIRE=3650
+
+# These are the default values for fields
+# which will be placed in the certificate.
+# Don't leave any of these fields blank.
+export KEY_COUNTRY="<%= @country %>"
+export KEY_PROVINCE="<%= @province %>"
+export KEY_CITY="<%= @city %>"
+export KEY_ORG="<%= @organization %>"
+export KEY_EMAIL="<%= @email %>"
diff --git a/puppet/modules/openvpn/vagrant/client.pp b/puppet/modules/openvpn/vagrant/client.pp
new file mode 100644
index 00000000..7ebeb1d7
--- /dev/null
+++ b/puppet/modules/openvpn/vagrant/client.pp
@@ -0,0 +1,5 @@
+node default {
+
+  package { 'openvpn': ensure => installed; }
+
+}
diff --git a/puppet/modules/openvpn/vagrant/server.pp b/puppet/modules/openvpn/vagrant/server.pp
new file mode 100644
index 00000000..a95def06
--- /dev/null
+++ b/puppet/modules/openvpn/vagrant/server.pp
@@ -0,0 +1,23 @@
+node default {
+  openvpn::server { 'winterthur':
+    country      => 'CH',
+    province     => 'ZH',
+    city         => 'Winterthur',
+    organization => 'example.org',
+    email        => 'root@example.org',
+    server       => '10.200.200.0 255.255.255.0'
+  }
+
+  openvpn::client { 'client1':
+    server => 'winterthur';
+  }
+
+  openvpn::client_specific_config { 'client1':
+    server   => 'winterthur',
+    ifconfig => '10.200.200.100 255.255.255.0'
+  }
+
+  openvpn::client { 'client2':
+    server => 'winterthur';
+  }
+}
-- 
cgit v1.2.3


From b85f8c1b914a09b6001d4c1b5c7d07ef17ac766f Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:27 -0400
Subject: git subrepo clone https://leap.se/git/puppet_concat
 puppet/modules/concat

subrepo:
  subdir:   "puppet/modules/concat"
  merged:   "abce128"
upstream:
  origin:   "https://leap.se/git/puppet_concat"
  branch:   "master"
  commit:   "abce128"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ic28e31bdc5b32fd6c55636bc35d9ca2967daf997
---
 puppet/modules/concat/.gitrepo                     |  11 ++
 puppet/modules/concat/CHANGELOG                    |  29 ++++
 puppet/modules/concat/LICENSE                      |  14 ++
 puppet/modules/concat/Modulefile                   |   8 +
 puppet/modules/concat/README.markdown              | 112 +++++++++++++
 puppet/modules/concat/Rakefile                     |  13 ++
 puppet/modules/concat/files/concatfragments.sh     | 129 +++++++++++++++
 puppet/modules/concat/files/null/.gitignore        |   0
 puppet/modules/concat/lib/facter/concat_basedir.rb |   5 +
 puppet/modules/concat/manifests/fragment.pp        |  49 ++++++
 puppet/modules/concat/manifests/init.pp            | 178 +++++++++++++++++++++
 puppet/modules/concat/manifests/setup.pp           |  49 ++++++
 puppet/modules/concat/spec/defines/init_spec.rb    |  20 +++
 puppet/modules/concat/spec/spec_helper.rb          |   9 ++
 14 files changed, 626 insertions(+)
 create mode 100644 puppet/modules/concat/.gitrepo
 create mode 100644 puppet/modules/concat/CHANGELOG
 create mode 100644 puppet/modules/concat/LICENSE
 create mode 100644 puppet/modules/concat/Modulefile
 create mode 100644 puppet/modules/concat/README.markdown
 create mode 100644 puppet/modules/concat/Rakefile
 create mode 100755 puppet/modules/concat/files/concatfragments.sh
 create mode 100644 puppet/modules/concat/files/null/.gitignore
 create mode 100644 puppet/modules/concat/lib/facter/concat_basedir.rb
 create mode 100644 puppet/modules/concat/manifests/fragment.pp
 create mode 100644 puppet/modules/concat/manifests/init.pp
 create mode 100644 puppet/modules/concat/manifests/setup.pp
 create mode 100644 puppet/modules/concat/spec/defines/init_spec.rb
 create mode 100644 puppet/modules/concat/spec/spec_helper.rb

(limited to 'puppet/modules')

diff --git a/puppet/modules/concat/.gitrepo b/puppet/modules/concat/.gitrepo
new file mode 100644
index 00000000..89eb24da
--- /dev/null
+++ b/puppet/modules/concat/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_concat
+	branch = master
+	commit = abce1280e07b544d8455f1572dd870bbd2f14892
+	parent = da37dd95c39f3f100020164473eed53a317fb53f
+	cmdver = 0.3.0
diff --git a/puppet/modules/concat/CHANGELOG b/puppet/modules/concat/CHANGELOG
new file mode 100644
index 00000000..c506cf1a
--- /dev/null
+++ b/puppet/modules/concat/CHANGELOG
@@ -0,0 +1,29 @@
+KNOWN ISSUES:
+- In 0.24.8 you will see inintended notifies, if you build a file
+  in a run, the next run will also see it as changed.  This is due
+  to how 0.24.8 does the purging of unhandled files, this is improved
+  in 0.25.x and we cannot work around it in our code.
+
+CHANGELOG:
+- 2010/02/19 - initial release
+- 2010/03/12 - add support for 0.24.8 and newer
+             - make the location of sort configurable
+             - add the ability to add shell comment based warnings to
+               top of files
+             - add the ablity to create empty files
+- 2010/04/05 - fix parsing of WARN and change code style to match rest
+               of the code
+             - Better and safer boolean handling for warn and force
+             - Don't use hard coded paths in the shell script, set PATH
+               top of the script
+             - Use file{} to copy the result and make all fragments owned
+               by root.  This means we can chnage the ownership/group of the
+               resulting file at any time.
+             - You can specify ensure => "/some/other/file" in concat::fragment
+               to include the contents of a symlink into the final file.
+- 2010/04/16 - Add more cleaning of the fragment name - removing / from the $name
+- 2010/05/22 - Improve documentation and show the use of ensure =>
+- 2010/07/14 - Add support for setting the filebucket behavior of files
+- 2010/10/04 - Make the warning message configurable
+- 2010/12/03 - Add flags to make concat work better on Solaris - thanks Jonathan Boyett
+- 2011/02/03 - Make the shell script more portable and add a config option for root group
diff --git a/puppet/modules/concat/LICENSE b/puppet/modules/concat/LICENSE
new file mode 100644
index 00000000..6a9e9a19
--- /dev/null
+++ b/puppet/modules/concat/LICENSE
@@ -0,0 +1,14 @@
+   Copyright 2012 R.I.Pienaar
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/puppet/modules/concat/Modulefile b/puppet/modules/concat/Modulefile
new file mode 100644
index 00000000..d6ab2bb0
--- /dev/null
+++ b/puppet/modules/concat/Modulefile
@@ -0,0 +1,8 @@
+name 'puppet-concat'
+version '0.1.0'
+source 'git://github.com/ripienaar/puppet-concat.git'
+author 'R.I.Pienaar'
+license 'Apache'
+summary 'Concat module'
+description 'Concat module'
+project_page 'http://github.com/ripienaar/puppet-concat'
diff --git a/puppet/modules/concat/README.markdown b/puppet/modules/concat/README.markdown
new file mode 100644
index 00000000..8736d57a
--- /dev/null
+++ b/puppet/modules/concat/README.markdown
@@ -0,0 +1,112 @@
+What is it?
+===========
+
+A Puppet module that can construct files from fragments.
+
+Please see the comments in the various .pp files for details
+as well as posts on my blog at http://www.devco.net/
+
+Released under the Apache 2.0 licence
+
+Usage:
+------
+
+Before you can use any of the concat features you should include the class
+concat::setup somewhere on your node first.
+
+If you wanted a /etc/motd file that listed all the major modules
+on the machine.  And that would be maintained automatically even
+if you just remove the include lines for other modules you could
+use code like below, a sample /etc/motd would be:
+
+<pre>
+Puppet modules on this server:
+
+    -- Apache
+    -- MySQL
+</pre>
+
+Local sysadmins can also append to the file by just editing /etc/motd.local
+their changes will be incorporated into the puppet managed motd.
+
+<pre>
+# class to setup basic motd, include on all nodes
+class motd {
+   include concat::setup
+   $motd = "/etc/motd"
+
+   concat{$motd:
+      owner => root,
+      group => root,
+      mode  => 644
+   }
+
+   concat::fragment{"motd_header":
+      target => $motd,
+      content => "\nPuppet modules on this server:\n\n",
+      order   => 01,
+   }
+
+   # local users on the machine can append to motd by just creating
+   # /etc/motd.local
+   concat::fragment{"motd_local":
+      target => $motd,
+      ensure  => "/etc/motd.local",
+      order   => 15
+   }
+}
+
+# used by other modules to register themselves in the motd
+define motd::register($content="", $order=10) {
+   if $content == "" {
+      $body = $name
+   } else {
+      $body = $content
+   }
+
+   concat::fragment{"motd_fragment_$name":
+      target  => "/etc/motd",
+      content => "    -- $body\n"
+   }
+}
+
+# a sample apache module
+class apache {
+   include apache::install, apache::config, apache::service
+
+   motd::register{"Apache": }
+}
+</pre>
+
+Known Issues:
+-------------
+* In 0.24.8 you will see inintended notifies, if you build a file
+  in a run, the next run will also see it as changed.  This is due
+  to how 0.24.8 does the purging of unhandled files, this is improved
+  in 0.25.x and we cannot work around it in our code.
+* Since puppet-concat now relies on a fact for the concat directory,
+  you will need to set up pluginsync = true for at least the first run.
+  You have this issue if puppet fails to run on the client and you have
+  a message similar to
+  "err: Failed to apply catalog: Parameter path failed: File
+  paths must be fully qualified, not 'undef' at [...]/concat/manifests/setup.pp:44".
+
+Contributors:
+-------------
+**Paul Elliot**
+
+ * Provided 0.24.8 support, shell warnings and empty file creation support.
+
+**Chad Netzer**
+
+ * Various patches to improve safety of file operations
+ * Symlink support
+
+**David Schmitt**
+
+ * Patch to remove hard coded paths relying on OS path
+ * Patch to use file{} to copy the resulting file to the final destination.  This means Puppet client will show diffs and that hopefully we can change file ownerships now
+
+Contact:
+--------
+You can contact me on rip@devco.net or follow my blog at http://www.devco.net I am also on twitter as ripienaar
diff --git a/puppet/modules/concat/Rakefile b/puppet/modules/concat/Rakefile
new file mode 100644
index 00000000..764aebd2
--- /dev/null
+++ b/puppet/modules/concat/Rakefile
@@ -0,0 +1,13 @@
+require 'rake'
+require 'rspec/core/rake_task'
+
+task :default => [:spec]
+
+desc "Run all module spec tests (Requires rspec-puppet gem)"
+RSpec::Core::RakeTask.new(:spec)
+
+desc "Build package"
+task :build do
+  system("puppet-module build")
+end
+
diff --git a/puppet/modules/concat/files/concatfragments.sh b/puppet/modules/concat/files/concatfragments.sh
new file mode 100755
index 00000000..c9397975
--- /dev/null
+++ b/puppet/modules/concat/files/concatfragments.sh
@@ -0,0 +1,129 @@
+#!/bin/sh
+
+# Script to concat files to a config file.
+#
+# Given a directory like this:
+# /path/to/conf.d
+# |-- fragments
+# |   |-- 00_named.conf
+# |   |-- 10_domain.net
+# |   `-- zz_footer
+#
+# The script supports a test option that will build the concat file to a temp location and 
+# use /usr/bin/cmp to verify if it should be run or not.  This would result in the concat happening
+# twice on each run but gives you the option to have an unless option in your execs to inhibit rebuilds.
+# 
+# Without the test option and the unless combo your services that depend on the final file would end up 
+# restarting on each run, or in other manifest models some changes might get missed.
+#
+# OPTIONS:
+#  -o	The file to create from the sources
+#  -d	The directory where the fragments are kept
+#  -t	Test to find out if a build is needed, basically concats the files to a temp
+#       location and compare with what's in the final location, return codes are designed
+#       for use with unless on an exec resource
+#  -w   Add a shell style comment at the top of the created file to warn users that it 
+#       is generated by puppet
+#  -f   Enables the creation of empty output files when no fragments are found
+#  -n	Sort the output numerically rather than the default alpha sort
+#
+# the command: 
+#
+#   concatfragments.sh -o /path/to/conffile.cfg -d /path/to/conf.d
+#
+# creates /path/to/conf.d/fragments.concat and copies the resulting 
+# file to /path/to/conffile.cfg.  The files will be sorted alphabetically
+# pass the -n switch to sort numerically.
+# 
+# The script does error checking on the various dirs and files to make
+# sure things don't fail.
+
+OUTFILE=""
+WORKDIR=""
+TEST=""
+FORCE=""
+WARN=""
+SORTARG=""
+
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+
+## Well, if there's ever a bad way to do things, Nexenta has it.
+## http://nexenta.org/projects/site/wiki/Personalities
+unset SUN_PERSONALITY
+
+while getopts "o:s:d:tnw:f" options; do
+	case $options in
+		o ) OUTFILE=$OPTARG;;
+		d ) WORKDIR=$OPTARG;;
+		n ) SORTARG="-n";;
+		w ) WARNMSG="$OPTARG";;
+		f ) FORCE="true";;
+		t ) TEST="true";;
+		* ) echo "Specify output file with -o and fragments directory with -d"
+		    exit 1;;
+	esac
+done
+
+# do we have -o?
+if [ x${OUTFILE} = "x" ]; then
+	echo "Please specify an output file with -o"
+	exit 1
+fi
+
+# do we have -d?
+if [ x${WORKDIR} = "x" ]; then
+	echo "Please fragments directory with -d"
+	exit 1
+fi
+
+# can we write to -o?
+if [ -f ${OUTFILE} ]; then
+	if [ ! -w ${OUTFILE} ]; then
+		echo "Cannot write to ${OUTFILE}"
+		exit 1
+	fi
+else
+	if [ ! -w `dirname ${OUTFILE}` ]; then
+		echo "Cannot write to `dirname ${OUTFILE}` to create ${OUTFILE}"
+		exit 1
+	fi
+fi
+
+# do we have a fragments subdir inside the work dir?
+if [ ! -d "${WORKDIR}/fragments" ]  && [ ! -x "${WORKDIR}/fragments" ]; then
+	echo "Cannot access the fragments directory"
+	exit 1
+fi
+
+# are there actually any fragments?
+if [ ! "$(ls -A ${WORKDIR}/fragments)" ]; then
+	if [ x${FORCE} = "x" ]; then
+		echo "The fragments directory is empty, cowardly refusing to make empty config files"
+		exit 1
+	fi
+fi
+
+cd ${WORKDIR}
+
+if [ x${WARNMSG} = "x" ]; then
+	: > "fragments.concat"
+else
+	printf '%s\n' "$WARNMSG" > "fragments.concat"
+fi
+
+# find all the files in the fragments directory, sort them numerically and concat to fragments.concat in the working dir
+find fragments/ -type f -follow | sort ${SORTARG} | while read fragfile; do
+	cat "$fragfile" >> "fragments.concat"
+done
+
+if [ x${TEST} = "x" ]; then
+	# This is a real run, copy the file to outfile
+	cp fragments.concat ${OUTFILE}
+	RETVAL=$?
+else
+	# Just compare the result to outfile to help the exec decide
+	cmp ${OUTFILE} fragments.concat
+	RETVAL=$?
+fi
+
+exit $RETVAL
diff --git a/puppet/modules/concat/files/null/.gitignore b/puppet/modules/concat/files/null/.gitignore
new file mode 100644
index 00000000..e69de29b
diff --git a/puppet/modules/concat/lib/facter/concat_basedir.rb b/puppet/modules/concat/lib/facter/concat_basedir.rb
new file mode 100644
index 00000000..02e9c5bf
--- /dev/null
+++ b/puppet/modules/concat/lib/facter/concat_basedir.rb
@@ -0,0 +1,5 @@
+Facter.add("concat_basedir") do
+    setcode do
+        File.join(Puppet[:vardir],"concat")
+    end
+end
diff --git a/puppet/modules/concat/manifests/fragment.pp b/puppet/modules/concat/manifests/fragment.pp
new file mode 100644
index 00000000..943bf671
--- /dev/null
+++ b/puppet/modules/concat/manifests/fragment.pp
@@ -0,0 +1,49 @@
+# Puts a file fragment into a directory previous setup using concat
+# 
+# OPTIONS:
+#   - target    The file that these fragments belong to
+#   - content   If present puts the content into the file
+#   - source    If content was not specified, use the source
+#   - order     By default all files gets a 10_ prefix in the directory
+#               you can set it to anything else using this to influence the
+#               order of the content in the file
+#   - ensure    Present/Absent or destination to a file to include another file
+#   - mode      Mode for the file
+#   - owner     Owner of the file
+#   - group     Owner of the file
+#   - backup    Controls the filebucketing behavior of the final file and
+#               see File type reference for its use.  Defaults to 'puppet'
+define concat::fragment($target, $content='', $source='', $order=10, $ensure = 'present', $mode = '0644', $owner = $::id, $group = $concat::setup::root_group, $backup = 'puppet') {
+  $safe_name = regsubst($name, '/', '_', 'G')
+  $safe_target_name = regsubst($target, '/', '_', 'G')
+  $concatdir = $concat::setup::concatdir
+  $fragdir = "${concatdir}/${safe_target_name}"
+
+  # if content is passed, use that, else if source is passed use that
+  # if neither passed, but $ensure is in symlink form, make a symlink
+  case $content {
+    '': {
+      case $source {
+        '': {
+          case $ensure {
+            '', 'absent', 'present', 'file', 'directory': {
+              crit('No content, source or symlink specified')
+            }
+          }
+        }
+        default: { File{ source => $source } }
+      }
+    }
+    default: { File{ content => $content } }
+  }
+
+  file{"${fragdir}/fragments/${order}_${safe_name}":
+    ensure => $ensure,
+    mode   => $mode,
+    owner  => $owner,
+    group  => $group,
+    backup => $backup,
+    alias  => "concat_fragment_${name}",
+    notify => Exec["concat_${target}"]
+  }
+}
diff --git a/puppet/modules/concat/manifests/init.pp b/puppet/modules/concat/manifests/init.pp
new file mode 100644
index 00000000..0b3ed564
--- /dev/null
+++ b/puppet/modules/concat/manifests/init.pp
@@ -0,0 +1,178 @@
+# A system to construct files using fragments from other files or templates.
+#
+# This requires at least puppet 0.25 to work correctly as we use some
+# enhancements in recursive directory management and regular expressions
+# to do the work here.
+#
+# USAGE:
+# The basic use case is as below:
+#
+# concat{"/etc/named.conf":
+#    notify => Service["named"]
+# }
+#
+# concat::fragment{"foo.com_config":
+#    target  => "/etc/named.conf",
+#    order   => 10,
+#    content => template("named_conf_zone.erb")
+# }
+#
+# # add a fragment not managed by puppet so local users
+# # can add content to managed file
+# concat::fragment{"foo.com_user_config":
+#    target  => "/etc/named.conf",
+#    order   => 12,
+#    ensure  => "/etc/named.conf.local"
+# }
+#
+# This will use the template named_conf_zone.erb to build a single
+# bit of config up and put it into the fragments dir.  The file
+# will have an number prefix of 10, you can use the order option
+# to control that and thus control the order the final file gets built in.
+#
+# SETUP:
+# The class concat::setup uses the fact concat_basedir to define the variable
+# $concatdir, where all the temporary files and fragments will be
+# durably stored. The fact concat_basedir will be set up on the client to
+# <Puppet[:vardir]>/concat, so you will be able to run different setup/flavours
+# of puppet clients.
+# However, since this requires the file lib/facter/concat_basedir.rb to be
+# deployed on the clients, so you will have to set "pluginsync = true" on
+# both the master and client, at least for the first run.
+#
+# There's some regular expression magic to figure out the puppet version but
+# if you're on an older 0.24 version just set $puppetversion = 24
+#
+# Before you can use any of the concat features you should include the
+# class concat::setup somewhere on your node first.
+#
+# DETAIL:
+# We use a helper shell script called concatfragments.sh that gets placed
+# in <Puppet[:vardir]>/concat/bin to do the concatenation.  While this might
+# seem more complex than some of the one-liner alternatives you might find on
+# the net we do a lot of error checking and safety checks in the script to avoid
+# problems that might be caused by complex escaping errors etc.
+#
+# LICENSE:
+# Apache Version 2
+#
+# LATEST:
+# http://github.com/ripienaar/puppet-concat/
+#
+# CONTACT:
+# R.I.Pienaar <rip@devco.net>
+# Volcane on freenode
+# @ripienaar on twitter
+# www.devco.net
+
+
+# Sets up so that you can use fragments to build a final config file,
+#
+# OPTIONS:
+#  - mode       The mode of the final file
+#  - owner      Who will own the file
+#  - group      Who will own the file
+#  - force      Enables creating empty files if no fragments are present
+#  - warn       Adds a normal shell style comment top of the file indicating
+#               that it is built by puppet
+#  - backup     Controls the filebucketing behavior of the final file and
+#               see File type reference for its use.  Defaults to 'puppet'
+#
+# ACTIONS:
+#  - Creates fragment directories if it didn't exist already
+#  - Executes the concatfragments.sh script to build the final file, this script will create
+#    directory/fragments.concat.   Execution happens only when:
+#    * The directory changes
+#    * fragments.concat != final destination, this means rebuilds will happen whenever
+#      someone changes or deletes the final file.  Checking is done using /usr/bin/cmp.
+#    * The Exec gets notified by something else - like the concat::fragment define
+#  - Copies the file over to the final destination using a file resource
+#
+# ALIASES:
+#  - The exec can notified using Exec["concat_/path/to/file"] or Exec["concat_/path/to/directory"]
+#  - The final file can be referened as File["/path/to/file"] or File["concat_/path/to/file"]
+define concat($mode = '0644', $owner = $::id, $group = $concat::setup::root_group, $warn = false, $force = false, $backup = 'puppet', $gnu = undef, $order='alpha') {
+  $safe_name   = regsubst($name, '/', '_', 'G')
+  $concatdir   = $concat::setup::concatdir
+  $version     = $concat::setup::majorversion
+  $fragdir     = "${concatdir}/${safe_name}"
+  $concat_name = 'fragments.concat.out'
+  $default_warn_message = '# This file is managed by Puppet. DO NOT EDIT.'
+
+  case $warn {
+    'true',true,yes,on:   { $warnmsg = $default_warn_message }
+    'false',false,no,off: { $warnmsg = '' }
+    default:              { $warnmsg = $warn }
+  }
+
+  $warnmsg_escaped = regsubst($warnmsg, "'", "'\\\\''", 'G')
+  $warnflag = $warnmsg_escaped ? {
+    ''      => '',
+    default => "-w '${warnmsg_escaped}'"
+  }
+
+  case $force {
+    'true',true,yes,on: { $forceflag = '-f' }
+    'false',false,no,off: { $forceflag = '' }
+    default: { fail("Improper 'force' value given to concat: ${force}") }
+  }
+
+  case $order {
+    numeric: { $orderflag = '-n' }
+    alpha: { $orderflag = '' }
+    default: { fail("Improper 'order' value given to concat: ${order}") }
+  }
+
+  File{
+    owner  => $::id,
+    group  => $group,
+    mode   => $mode,
+    backup => $backup
+  }
+
+  file{$fragdir:
+    ensure   => directory;
+
+  "${fragdir}/fragments":
+    ensure   => directory,
+    recurse  => true,
+    purge    => true,
+    force    => true,
+    ignore   => ['.svn', '.git', '.gitignore'],
+    source   => $version ? {
+      24      => 'puppet:///concat/null',
+      default => undef,
+    },
+    notify   => Exec["concat_${name}"];
+
+  "${fragdir}/fragments.concat":
+    ensure   => present;
+
+  "${fragdir}/${concat_name}":
+    ensure   => present;
+
+  $name:
+    ensure   => present,
+    source   => "${fragdir}/${concat_name}",
+    owner    => $owner,
+    group    => $group,
+    checksum => md5,
+    mode     => $mode,
+    alias    => "concat_${name}";
+  }
+
+  exec{"concat_${name}":
+    notify    => File[$name],
+    subscribe => File[$fragdir],
+    alias     => "concat_${fragdir}",
+    require   => [ File[$fragdir], File["${fragdir}/fragments"], File["${fragdir}/fragments.concat"] ],
+    unless    => "${concat::setup::concatdir}/bin/concatfragments.sh -o ${fragdir}/${concat_name} -d ${fragdir} -t ${warnflag} ${forceflag} ${orderflag}",
+    command   => "${concat::setup::concatdir}/bin/concatfragments.sh -o ${fragdir}/${concat_name} -d ${fragdir} ${warnflag} ${forceflag} ${orderflag}",
+  }
+  if $::id == 'root' {
+    Exec["concat_${name}"]{
+      user      => root,
+      group     => $group,
+    }
+  }
+}
diff --git a/puppet/modules/concat/manifests/setup.pp b/puppet/modules/concat/manifests/setup.pp
new file mode 100644
index 00000000..38aeb964
--- /dev/null
+++ b/puppet/modules/concat/manifests/setup.pp
@@ -0,0 +1,49 @@
+# Sets up the concat system.
+#
+# $concatdir is where the fragments live and is set on the fact concat_basedir.
+# Since puppet should always manage files in $concatdir and they should
+# not be deleted ever, /tmp is not an option.
+#
+# $puppetversion should be either 24 or 25 to enable a 24 compatible
+# mode, in 24 mode you might see phantom notifies this is a side effect
+# of the method we use to clear the fragments directory.
+#
+# The regular expression below will try to figure out your puppet version
+# but this code will only work in 0.24.8 and newer.
+#
+# It also copies out the concatfragments.sh file to ${concatdir}/bin
+class concat::setup {
+  $id = $::id
+  $root_group = $id ? {
+    root    => 0,
+    default => $id
+  }
+
+  if $::concat_basedir {
+    $concatdir = $::concat_basedir
+  } else {
+    fail ("\$concat_basedir not defined. Try running again with pluginsync enabled")
+  }
+
+  $majorversion = regsubst($::puppetversion, '^[0-9]+[.]([0-9]+)[.][0-9]+$', '\1')
+
+  file{"${concatdir}/bin/concatfragments.sh":
+    owner  => $id,
+    group  => $root_group,
+    mode   => '0755',
+    source => $majorversion ? {
+      24      => 'puppet:///concat/concatfragments.sh',
+      default => 'puppet:///modules/concat/concatfragments.sh'
+    };
+
+  [ $concatdir, "${concatdir}/bin" ]:
+    ensure => directory,
+    owner  => $id,
+    group  => $root_group,
+    mode   => '0750';
+
+  ## Old versions of this module used a different path.
+  '/usr/local/bin/concatfragments.sh':
+    ensure => absent;
+  }
+}
diff --git a/puppet/modules/concat/spec/defines/init_spec.rb b/puppet/modules/concat/spec/defines/init_spec.rb
new file mode 100644
index 00000000..d968a26c
--- /dev/null
+++ b/puppet/modules/concat/spec/defines/init_spec.rb
@@ -0,0 +1,20 @@
+require 'spec_helper'
+
+describe 'concat' do
+  basedir = '/var/lib/puppet/concat'
+  let(:title) { '/etc/foo.bar' }
+  let(:facts) { { :concat_basedir => '/var/lib/puppet/concat' } }
+  let :pre_condition do
+    'include concat::setup'
+  end
+  it { should contain_file("#{basedir}/_etc_foo.bar").with('ensure' => 'directory') }
+  it { should contain_file("#{basedir}/_etc_foo.bar/fragments").with('ensure' => 'directory') }
+
+  it { should contain_file("#{basedir}/_etc_foo.bar/fragments.concat").with('ensure' => 'present') }
+  it { should contain_file("/etc/foo.bar").with('ensure' => 'present') }
+  it { should contain_exec("concat_/etc/foo.bar").with_command(
+                                        "#{basedir}/bin/concatfragments.sh "+
+                                        "-o #{basedir}/_etc_foo.bar/fragments.concat.out "+
+                                        "-d #{basedir}/_etc_foo.bar   ")
+  }
+end
diff --git a/puppet/modules/concat/spec/spec_helper.rb b/puppet/modules/concat/spec/spec_helper.rb
new file mode 100644
index 00000000..e6e9309b
--- /dev/null
+++ b/puppet/modules/concat/spec/spec_helper.rb
@@ -0,0 +1,9 @@
+require 'puppet'
+require 'rspec'
+require 'rspec-puppet'
+
+RSpec.configure do |c|
+  c.module_path = File.expand_path(File.join(File.dirname(__FILE__), 'fixtures/modules/'))
+  # Using an empty site.pp file to avoid: https://github.com/rodjek/rspec-puppet/issues/15
+  c.manifest_dir = File.expand_path(File.join(File.dirname(__FILE__), 'fixtures/manifests'))
+end
-- 
cgit v1.2.3


From 4ccae8700fb136bfbc6b7ef7bb0ab482e632139f Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:28 -0400
Subject: git subrepo clone https://leap.se/git/puppet_sshd puppet/modules/sshd

subrepo:
  subdir:   "puppet/modules/sshd"
  merged:   "76f4f87"
upstream:
  origin:   "https://leap.se/git/puppet_sshd"
  branch:   "master"
  commit:   "76f4f87"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Icf616796837cdbe40deb188d2b72f1c726c9e807
---
 puppet/modules/sshd/.fixtures.yml                  |   3 +
 puppet/modules/sshd/.gitignore                     |   4 +
 puppet/modules/sshd/.gitrepo                       |  11 +
 puppet/modules/sshd/.rspec                         |   4 +
 puppet/modules/sshd/.travis.yml                    |  27 +
 puppet/modules/sshd/Gemfile                        |  14 +
 puppet/modules/sshd/Gemfile.lock                   | 116 ++++
 puppet/modules/sshd/LICENSE                        | 674 +++++++++++++++++++++
 puppet/modules/sshd/Modulefile                     |  10 +
 puppet/modules/sshd/Puppetfile                     |   3 +
 puppet/modules/sshd/Puppetfile.lock                |   8 +
 puppet/modules/sshd/README.md                      | 247 ++++++++
 puppet/modules/sshd/Rakefile                       |  16 +
 puppet/modules/sshd/files/autossh.init.d           | 164 +++++
 puppet/modules/sshd/lib/facter/ssh_version.rb      |   5 +
 .../sshd/lib/puppet/parser/functions/ssh_keygen.rb |  30 +
 puppet/modules/sshd/manifests/autossh.pp           |  40 ++
 puppet/modules/sshd/manifests/base.pp              |  41 ++
 puppet/modules/sshd/manifests/client.pp            |  22 +
 puppet/modules/sshd/manifests/client/base.pp       |  15 +
 puppet/modules/sshd/manifests/client/debian.pp     |   5 +
 puppet/modules/sshd/manifests/client/linux.pp      |   5 +
 puppet/modules/sshd/manifests/debian.pp            |  13 +
 puppet/modules/sshd/manifests/gentoo.pp            |   5 +
 puppet/modules/sshd/manifests/init.pp              |  92 +++
 puppet/modules/sshd/manifests/libssh2.pp           |   7 +
 puppet/modules/sshd/manifests/libssh2/devel.pp     |   7 +
 puppet/modules/sshd/manifests/linux.pp             |   8 +
 puppet/modules/sshd/manifests/nagios.pp            |  24 +
 puppet/modules/sshd/manifests/openbsd.pp           |   8 +
 puppet/modules/sshd/manifests/redhat.pp            |   5 +
 .../modules/sshd/manifests/ssh_authorized_key.pp   |  85 +++
 puppet/modules/sshd/manifests/sshkey.pp            |  21 +
 puppet/modules/sshd/spec/classes/client_spec.rb    |  42 ++
 puppet/modules/sshd/spec/classes/init_spec.rb      | 122 ++++
 .../sshd/spec/defines/ssh_authorized_key_spec.rb   |  45 ++
 .../modules/sshd/spec/functions/ssh_keygen_spec.rb | 116 ++++
 puppet/modules/sshd/spec/spec_helper.rb            |  21 +
 puppet/modules/sshd/spec/spec_helper_system.rb     |  25 +
 .../sshd/templates/sshd_config/CentOS_5.erb        |   1 +
 .../sshd/templates/sshd_config/CentOS_6.erb        | 172 ++++++
 .../sshd/templates/sshd_config/CentOS_7.erb        | 186 ++++++
 .../sshd/templates/sshd_config/Debian_jessie.erb   | 124 ++++
 .../sshd/templates/sshd_config/Debian_sid.erb      | 124 ++++
 .../sshd/templates/sshd_config/Debian_squeeze.erb  | 127 ++++
 .../sshd/templates/sshd_config/Debian_wheezy.erb   | 132 ++++
 .../modules/sshd/templates/sshd_config/FreeBSD.erb | 168 +++++
 .../modules/sshd/templates/sshd_config/Gentoo.erb  | 164 +++++
 .../modules/sshd/templates/sshd_config/OpenBSD.erb | 144 +++++
 .../modules/sshd/templates/sshd_config/Ubuntu.erb  | 133 ++++
 .../sshd/templates/sshd_config/Ubuntu_lucid.erb    | 136 +++++
 .../sshd/templates/sshd_config/Ubuntu_oneiric.erb  |   1 +
 .../sshd/templates/sshd_config/Ubuntu_precise.erb  |   1 +
 .../sshd_config/XenServer_xenenterprise.erb        |   1 +
 54 files changed, 3724 insertions(+)
 create mode 100644 puppet/modules/sshd/.fixtures.yml
 create mode 100644 puppet/modules/sshd/.gitignore
 create mode 100644 puppet/modules/sshd/.gitrepo
 create mode 100644 puppet/modules/sshd/.rspec
 create mode 100644 puppet/modules/sshd/.travis.yml
 create mode 100644 puppet/modules/sshd/Gemfile
 create mode 100644 puppet/modules/sshd/Gemfile.lock
 create mode 100644 puppet/modules/sshd/LICENSE
 create mode 100644 puppet/modules/sshd/Modulefile
 create mode 100644 puppet/modules/sshd/Puppetfile
 create mode 100644 puppet/modules/sshd/Puppetfile.lock
 create mode 100644 puppet/modules/sshd/README.md
 create mode 100644 puppet/modules/sshd/Rakefile
 create mode 100644 puppet/modules/sshd/files/autossh.init.d
 create mode 100644 puppet/modules/sshd/lib/facter/ssh_version.rb
 create mode 100644 puppet/modules/sshd/lib/puppet/parser/functions/ssh_keygen.rb
 create mode 100644 puppet/modules/sshd/manifests/autossh.pp
 create mode 100644 puppet/modules/sshd/manifests/base.pp
 create mode 100644 puppet/modules/sshd/manifests/client.pp
 create mode 100644 puppet/modules/sshd/manifests/client/base.pp
 create mode 100644 puppet/modules/sshd/manifests/client/debian.pp
 create mode 100644 puppet/modules/sshd/manifests/client/linux.pp
 create mode 100644 puppet/modules/sshd/manifests/debian.pp
 create mode 100644 puppet/modules/sshd/manifests/gentoo.pp
 create mode 100644 puppet/modules/sshd/manifests/init.pp
 create mode 100644 puppet/modules/sshd/manifests/libssh2.pp
 create mode 100644 puppet/modules/sshd/manifests/libssh2/devel.pp
 create mode 100644 puppet/modules/sshd/manifests/linux.pp
 create mode 100644 puppet/modules/sshd/manifests/nagios.pp
 create mode 100644 puppet/modules/sshd/manifests/openbsd.pp
 create mode 100644 puppet/modules/sshd/manifests/redhat.pp
 create mode 100644 puppet/modules/sshd/manifests/ssh_authorized_key.pp
 create mode 100644 puppet/modules/sshd/manifests/sshkey.pp
 create mode 100644 puppet/modules/sshd/spec/classes/client_spec.rb
 create mode 100644 puppet/modules/sshd/spec/classes/init_spec.rb
 create mode 100644 puppet/modules/sshd/spec/defines/ssh_authorized_key_spec.rb
 create mode 100644 puppet/modules/sshd/spec/functions/ssh_keygen_spec.rb
 create mode 100644 puppet/modules/sshd/spec/spec_helper.rb
 create mode 100644 puppet/modules/sshd/spec/spec_helper_system.rb
 create mode 120000 puppet/modules/sshd/templates/sshd_config/CentOS_5.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/CentOS_6.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/CentOS_7.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/Debian_jessie.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/Debian_sid.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/Debian_squeeze.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/Debian_wheezy.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/FreeBSD.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/Gentoo.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/OpenBSD.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/Ubuntu.erb
 create mode 100644 puppet/modules/sshd/templates/sshd_config/Ubuntu_lucid.erb
 create mode 120000 puppet/modules/sshd/templates/sshd_config/Ubuntu_oneiric.erb
 create mode 120000 puppet/modules/sshd/templates/sshd_config/Ubuntu_precise.erb
 create mode 120000 puppet/modules/sshd/templates/sshd_config/XenServer_xenenterprise.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/sshd/.fixtures.yml b/puppet/modules/sshd/.fixtures.yml
new file mode 100644
index 00000000..42598a65
--- /dev/null
+++ b/puppet/modules/sshd/.fixtures.yml
@@ -0,0 +1,3 @@
+fixtures:
+  symlinks:
+    sshd: "#{source_dir}"
\ No newline at end of file
diff --git a/puppet/modules/sshd/.gitignore b/puppet/modules/sshd/.gitignore
new file mode 100644
index 00000000..5ebb01fb
--- /dev/null
+++ b/puppet/modules/sshd/.gitignore
@@ -0,0 +1,4 @@
+.librarian/*
+.tmp/*
+*.log
+spec/fixtures/*
diff --git a/puppet/modules/sshd/.gitrepo b/puppet/modules/sshd/.gitrepo
new file mode 100644
index 00000000..70f55711
--- /dev/null
+++ b/puppet/modules/sshd/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_sshd
+	branch = master
+	commit = 76f4f872f81209a52df2205fd88b5619df58f003
+	parent = b85f8c1b914a09b6001d4c1b5c7d07ef17ac766f
+	cmdver = 0.3.0
diff --git a/puppet/modules/sshd/.rspec b/puppet/modules/sshd/.rspec
new file mode 100644
index 00000000..f07c903a
--- /dev/null
+++ b/puppet/modules/sshd/.rspec
@@ -0,0 +1,4 @@
+--format documentation
+--color
+--pattern "spec/*/*_spec.rb"
+#--backtrace
diff --git a/puppet/modules/sshd/.travis.yml b/puppet/modules/sshd/.travis.yml
new file mode 100644
index 00000000..7bd2a2bc
--- /dev/null
+++ b/puppet/modules/sshd/.travis.yml
@@ -0,0 +1,27 @@
+before_install:
+  - gem update --system 2.1.11
+  - gem --version
+rvm:
+  - 1.8.7
+  - 1.9.3
+  - 2.0.0
+script: 'bundle exec rake spec'
+env:
+  - PUPPET_VERSION="~> 2.7.0"
+  - PUPPET_VERSION="~> 3.0.0"
+  - PUPPET_VERSION="~> 3.1.0"
+  - PUPPET_VERSION="~> 3.2.0"
+  - PUPPET_VERSION="~> 3.3.0"
+  - PUPPET_VERSION="~> 3.4.0"
+matrix:
+  exclude:
+    # No support for Ruby 1.9 before Puppet 2.7
+    - rvm: 1.9.3
+      env: PUPPET_VERSION=2.6.0
+    # No support for Ruby 2.0 before Puppet 3.2
+    - rvm: 2.0.0
+      env: PUPPET_VERSION="~> 2.7.0"
+    - rvm: 2.0.0
+      env: PUPPET_VERSION="~> 3.0.0"
+    - rvm: 2.0.0
+      env: PUPPET_VERSION="~> 3.1.0"
diff --git a/puppet/modules/sshd/Gemfile b/puppet/modules/sshd/Gemfile
new file mode 100644
index 00000000..ef74f90e
--- /dev/null
+++ b/puppet/modules/sshd/Gemfile
@@ -0,0 +1,14 @@
+source 'https://rubygems.org'
+
+group :development, :test do
+  gem 'puppet',  '>= 2.7.0'
+  gem 'puppet-lint', '>=0.3.2'
+  gem 'puppetlabs_spec_helper', '>=0.2.0'
+  gem 'rake',         '>=0.9.2.2'
+  gem 'librarian-puppet', '>=0.9.10'
+  gem 'rspec-system-puppet',     :require => false
+  gem 'serverspec',              :require => false
+  gem 'rspec-system-serverspec', :require => false
+  gem 'rspec-hiera-puppet'
+  gem 'rspec-puppet', :git => 'https://github.com/rodjek/rspec-puppet.git'
+end
\ No newline at end of file
diff --git a/puppet/modules/sshd/Gemfile.lock b/puppet/modules/sshd/Gemfile.lock
new file mode 100644
index 00000000..0c2c58e9
--- /dev/null
+++ b/puppet/modules/sshd/Gemfile.lock
@@ -0,0 +1,116 @@
+GIT
+  remote: https://github.com/rodjek/rspec-puppet.git
+  revision: c44381a240ec420d4ffda7bffc55ee4d9c08d682
+  specs:
+    rspec-puppet (1.0.1)
+      rspec
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    builder (3.2.2)
+    diff-lcs (1.2.5)
+    excon (0.31.0)
+    facter (1.7.4)
+    fog (1.19.0)
+      builder
+      excon (~> 0.31.0)
+      formatador (~> 0.2.0)
+      mime-types
+      multi_json (~> 1.0)
+      net-scp (~> 1.1)
+      net-ssh (>= 2.1.3)
+      nokogiri (~> 1.5)
+      ruby-hmac
+    formatador (0.2.4)
+    hiera (1.3.1)
+      json_pure
+    hiera-puppet (1.0.0)
+      hiera (~> 1.0)
+    highline (1.6.20)
+    json (1.8.1)
+    json_pure (1.8.1)
+    kwalify (0.7.2)
+    librarian-puppet (0.9.10)
+      json
+      thor (~> 0.15)
+    metaclass (0.0.2)
+    mime-types (1.25.1)
+    mocha (1.0.0)
+      metaclass (~> 0.0.1)
+    multi_json (1.8.4)
+    net-scp (1.1.2)
+      net-ssh (>= 2.6.5)
+    net-ssh (2.7.0)
+    nokogiri (1.5.11)
+    puppet (3.4.2)
+      facter (~> 1.6)
+      hiera (~> 1.0)
+      rgen (~> 0.6.5)
+    puppet-lint (0.3.2)
+    puppetlabs_spec_helper (0.4.1)
+      mocha (>= 0.10.5)
+      rake
+      rspec (>= 2.9.0)
+      rspec-puppet (>= 0.1.1)
+    rake (10.1.1)
+    rbvmomi (1.8.1)
+      builder
+      nokogiri (>= 1.4.1)
+      trollop
+    rgen (0.6.6)
+    rspec (2.14.1)
+      rspec-core (~> 2.14.0)
+      rspec-expectations (~> 2.14.0)
+      rspec-mocks (~> 2.14.0)
+    rspec-core (2.14.7)
+    rspec-expectations (2.14.4)
+      diff-lcs (>= 1.1.3, < 2.0)
+    rspec-hiera-puppet (1.0.0)
+      hiera (>= 1.0)
+      hiera-puppet (>= 1.0)
+      puppet (>= 3.0)
+      rspec
+      rspec-puppet
+    rspec-mocks (2.14.4)
+    rspec-system (2.8.0)
+      fog (~> 1.18)
+      kwalify (~> 0.7.2)
+      mime-types (~> 1.16)
+      net-scp (~> 1.1)
+      net-ssh (~> 2.7)
+      nokogiri (~> 1.5.10)
+      rbvmomi (~> 1.6)
+      rspec (~> 2.14)
+      systemu (~> 2.5)
+    rspec-system-puppet (2.2.1)
+      rspec-system (~> 2.0)
+    rspec-system-serverspec (2.0.1)
+      rspec-system (~> 2.0)
+      serverspec (~> 0.0)
+      specinfra (~> 0.0)
+    ruby-hmac (0.4.0)
+    serverspec (0.14.4)
+      highline
+      net-ssh
+      rspec (>= 2.13.0)
+      specinfra (>= 0.1.0)
+    specinfra (0.4.1)
+    systemu (2.6.0)
+    thor (0.18.1)
+    trollop (2.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  librarian-puppet (>= 0.9.10)
+  puppet (>= 2.7.0)
+  puppet-lint (>= 0.3.2)
+  puppetlabs_spec_helper (>= 0.2.0)
+  rake (>= 0.9.2.2)
+  rspec-hiera-puppet
+  rspec-puppet!
+  rspec-system-puppet
+  rspec-system-serverspec
+  serverspec
diff --git a/puppet/modules/sshd/LICENSE b/puppet/modules/sshd/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/sshd/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/sshd/Modulefile b/puppet/modules/sshd/Modulefile
new file mode 100644
index 00000000..5e4f92d6
--- /dev/null
+++ b/puppet/modules/sshd/Modulefile
@@ -0,0 +1,10 @@
+name    'puppet-sshd'
+version '0.1.0'
+source 'https://github.com/duritong/puppet-sshd'
+author 'duritong'
+license 'Apache License, Version 2.0'
+summary 'ssh daemon configuration'
+description 'Manages sshd_config'
+project_page 'https://github.com/duritong/puppet-sshd'
+
+dependency 'puppetlabs/stdlib', '>= 2.0.0'
\ No newline at end of file
diff --git a/puppet/modules/sshd/Puppetfile b/puppet/modules/sshd/Puppetfile
new file mode 100644
index 00000000..166d3b4d
--- /dev/null
+++ b/puppet/modules/sshd/Puppetfile
@@ -0,0 +1,3 @@
+forge 'http://forge.puppetlabs.com'
+
+mod 'puppetlabs/stdlib', '>=2.0.0'
\ No newline at end of file
diff --git a/puppet/modules/sshd/Puppetfile.lock b/puppet/modules/sshd/Puppetfile.lock
new file mode 100644
index 00000000..f9381858
--- /dev/null
+++ b/puppet/modules/sshd/Puppetfile.lock
@@ -0,0 +1,8 @@
+FORGE
+  remote: http://forge.puppetlabs.com
+  specs:
+    puppetlabs/stdlib (4.1.0)
+
+DEPENDENCIES
+  puppetlabs/stdlib (>= 2.0.0)
+
diff --git a/puppet/modules/sshd/README.md b/puppet/modules/sshd/README.md
new file mode 100644
index 00000000..77e4d29b
--- /dev/null
+++ b/puppet/modules/sshd/README.md
@@ -0,0 +1,247 @@
+# Puppet SSH Module
+
+[![Build Status](https://travis-ci.org/duritong/puppet-sshd.png?branch=master)](https://travis-ci.org/duritong/puppet-sshd)
+
+This puppet module manages OpenSSH configuration and services.
+
+**!! Upgrade Notice (05/2015) !!**
+
+The hardened_ssl parameter name was changed to simply 'hardened'.
+
+**!! Upgrade Notice (01/2013) !!**
+
+This module now uses parameterized classes, where it used global variables
+before. So please whatch out before pulling, you need to change the
+class declarations in your manifest !
+
+
+### Dependencies
+
+This module requires puppet => 2.6, and the following modules are required
+pre-dependencies:
+
+- [puppetlabs/stdlib](https://github.com/puppetlabs/puppetlabs-stdlib) >= 2.x
+
+## OpenSSH Server
+
+On a node where you wish to have an openssh server installed, you should
+include
+
+```puppet
+class { 'sshd': }
+```
+
+on that node. If you need to configure any aspects of sshd_config, set the variables before the include. Or you can adjust many parameters:
+
+```puppet
+class { 'sshd':
+  ports             => [ 20002 ],
+  permit_root_login => 'no',
+}
+```
+
+See Configurable Variables below for what you can set.
+
+### Nagios
+
+To have nagios checks setup automatically for sshd services, simply set
+`manage_nagios` to `true` for that class. If you want to disable ssh
+nagios checking for a particular node (such as when ssh is firewalled), then you
+can set the class parameter `nagios_check_ssh` to `false` and that node will not be
+monitored.
+
+Nagios will automatically check the ports defined in `ports`, and the
+hostname specified by `nagios_check_ssh_hostname`.
+
+Note that if you need to use some specific logic to decide whether or not to
+create a nagios service check, you should set $manage_nagios to false, and
+use sshd::nagios from within your own manifests. You'll also need to manually
+specify the port to that define. By default, if the $port parameter is not
+specified, it will use the resource name as the port (e.g. if you call it like
+this: `sshd::nagios { '22': }` )
+
+NOTE: this requires that you are using the shared-nagios puppet module which
+supports the nagios native types via `nagios::service`:
+
+https://gitlab.com/shared-puppet-modules-group/sshd
+
+### Firewall
+
+If you wish to have firewall rules setup automatically for you, using shorewall,
+you will need to set: `use_shorewall => true`. The `ports` that you have
+specified will automatically be used.
+
+NOTE: This requires that you are using the shared-shorewall puppet module:
+git://labs.riseup.net/shared-shorewall
+
+
+### Configurable variables
+
+Configuration of sshd is strict, and may not fit all needs, however there are a
+number of variables that you can consider configuring. The defaults are set to
+the distribution shipped sshd_config file defaults.
+
+To set any of these variables, simply set them as variables in your manifests,
+before the class is included, for example:
+
+```puppet
+class {'sshd':
+  listen_address => ['10.0.0.1', '192.168.0.1'],
+  use_pam        => yes
+}
+```
+
+If you need to install a version of the ssh daemon or client package other than
+the default one that would be installed by `ensure => installed`, then you can
+set the following variables:
+
+```puppet
+class {'sshd':
+  ensure_version => "1:5.2p2-6"
+}
+```
+
+The following is a list of the currently available variables:
+
+  - `listen_address`
+        specify the addresses sshd should listen on set this to `['10.0.0.1', '192.168.0.1']` to have it listen on both addresses, or leave it unset to listen on all Default: empty -> results in listening on `0.0.0.0`
+  - `allowed_users`
+    list of usernames separated by spaces.  set this for example to `"foobar
+    root"` to ensure that only user foobar and root might login.  Default: empty
+    -> no restriction is set
+  - `allowed_groups`
+    list of groups separated by spaces. set this for example to `"wheel sftponly"`
+    to ensure that only users in the groups wheel and sftponly might login.
+    Default: empty -> no restriction is set Note: This is set after
+    `allowed_users`, take care of the behaviour if you use these 2 options
+    together.
+  - `use_pam` if you want to use pam or not for authenticaton. Values:
+    - `no` (default)
+    - `yes`
+  - `permit_root_login` If you want to allow root logins or not. Valid values:
+    - `yes`
+    - `no`
+    - `without-password` (default)
+    - `forced-commands-only`
+  - `password_authentication`
+    If you want to enable password authentication or not. Valid values:
+    - `yes`
+    - `no` (default)
+  - `kerberos_authentication`
+    If you want the password that is provided by the user to be validated
+    through the Kerberos KDC. To use this option the server needs a Kerberos
+    servtab which allows the verification of the KDC's identity. Valid values:
+    - `yes`
+    - `no` (default)
+  - `kerberos_orlocalpasswd` If password authentication through Kerberos fails, then the password will be validated via any additional local mechanism.  Valid values:
+    - `yes` (default)
+    - `no`
+  - `kerberos_ticketcleanup` Destroy the user's ticket cache file on logout?  Valid values:
+    - `yes` (default)
+    - `no`
+  - `gssapi_authentication` Authenticate users based on GSSAPI? Valid values:
+    - `yes`
+    - `no` (default)
+  - `gssapi_cleanupcredentials` Destroy user's credential cache on logout? Valid values:
+    - `yes` (default)
+    - `no`
+  - `challenge_response_authentication` If you want to enable ChallengeResponseAuthentication or not When disabled, s/key passwords are disabled. Valid values:
+    - `yes`
+    - `no` (default)
+  - `tcp_forwarding` If you want to enable TcpForwarding. Valid values:
+    - `yes`
+    - `no` (default)
+  - `x11_forwarding` If you want to enable x11 forwarding. Valid values:
+    - `yes`
+    - `no` (default)
+  - `agent_forwarding` If you want to allow ssh-agent forwarding. Valid values:
+    - `yes`
+    - `no` (default)
+  - `pubkey_authentication` If you want to enable public key authentication. Valid values:
+    - `yes` (default)
+    - `no`
+  - `rsa_authentication` If you want to enable RSA Authentication. Valid values:
+    - `yes`
+    - `no` (default)
+  - `rhosts_rsa_authentication`
+    If you want to enable rhosts RSA Authentication. Valid values:
+    - `yes`
+    - `no` (default)
+  - `hostbased_authentication` If you want to enable `HostbasedAuthentication`. Valid values:
+    - `yes`
+    - `no` (default)
+  - `strict_modes` If you want to set `StrictModes` (check file modes/ownership before accepting login). Valid values:
+    - `yes` (default)
+    - `no`
+  - `permit_empty_passwords`
+    If you want enable PermitEmptyPasswords to allow empty passwords. Valid
+    Values:
+    - `yes`
+    - `no` (default)
+  - `ports` If you want to specify a list of ports other than the default `22`; Default: `[22]`
+  - `authorized_keys_file`
+    Set this to the location of the AuthorizedKeysFile
+    (e.g. `/etc/ssh/authorized_keys/%u`). Default: `AuthorizedKeysFile
+    %h/.ssh/authorized_keys`
+  - `hardened`
+    Use only strong ciphers, MAC, KexAlgorithms, etc.
+    Values:
+    - `no` (default)
+    - `yes`
+  - `print_motd`
+    Show the Message of the day when a user logs in.
+  - `sftp_subsystem`
+    Set a different sftp-subystem than the default one. Might be interesting for
+    sftponly usage. Default: empty -> no change of the default
+  - `head_additional_options`
+    Set this to any additional sshd_options which aren't listed above. Anything
+    set here will be added to the beginning of the sshd_config file. This option
+    might be useful to define complicated Match Blocks. This string is going to
+    be included, like it is defined. So take care! Default: empty -> not added.
+  - `tail_additional_options` Set this to any additional sshd_options which aren't listed above. Anything set here will be added to the end of the sshd_config file. This option might be useful to define complicated Match Blocks. This string is going to be included, like it is defined. So take care! Default: empty -> not added.
+  - `shared_ip` Whether the server uses a shared network IP address. If it does, then we don't want it to export an rsa key for its IP address. Values:
+  - `no` (default)
+  - `yes`
+
+
+### Defines and functions
+
+Deploy authorized_keys file with the define `authorized_key`.
+
+Generate a public/private keypair with the ssh_keygen function. For example, the
+following will generate ssh keys and put the different parts of the key into
+variables:
+
+```puppet
+$ssh_keys = ssh_keygen("${$ssh_key_basepath}/backup/keys/${::fqdn}/${backup_host}")
+$public_key = split($ssh_keys[1],' ')
+$sshkey_type => $public_key[0]
+$sshkey => $public_key[1]
+```
+
+## Client
+
+
+On a node where you wish to have the ssh client managed, you can do:
+
+```puppet
+class{'sshd::client':
+
+}
+```
+
+in the node definition. This will install the appropriate package.
+
+## License
+
+ - Copyright 2008-2011, Riseup Labs micah@riseup.net
+ - Copyright 2008, admin(at)immerda.ch
+ - Copyright 2008, Puzzle ITC GmbH
+ - Marcel Härry haerry+puppet(at)puzzle.ch
+ - Simon Josi josi+puppet(at)puzzle.ch
+
+This program is free software; you can redistribute
+it and/or modify it under the terms of the GNU
+General Public License version 3 as published by
+the Free Software Foundation.
+
diff --git a/puppet/modules/sshd/Rakefile b/puppet/modules/sshd/Rakefile
new file mode 100644
index 00000000..e3213518
--- /dev/null
+++ b/puppet/modules/sshd/Rakefile
@@ -0,0 +1,16 @@
+require 'bundler'
+Bundler.require(:rake)
+
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+require 'rspec-system/rake_task'
+
+PuppetLint.configuration.log_format = '%{path}:%{linenumber}:%{KIND}: %{message}'
+PuppetLint.configuration.send("disable_80chars")
+
+puppet_module='sshd'
+task :librarian_spec_prep do
+  sh 'librarian-puppet install --path=spec/fixtures/modules/'
+end
+task :spec_prep => :librarian_spec_prep
+task :default => [:spec, :lint]
diff --git a/puppet/modules/sshd/files/autossh.init.d b/puppet/modules/sshd/files/autossh.init.d
new file mode 100644
index 00000000..92bd5f43
--- /dev/null
+++ b/puppet/modules/sshd/files/autossh.init.d
@@ -0,0 +1,164 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          AutoSSH
+# Required-Start:    $local_fs $network $remote_fs $syslog
+# Required-Stop:     $local_fs $network $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: start the autossh daemon
+# Description:       start the autossh daemon
+### END INIT INFO
+
+# Author: Antoine Beaupré <anarcat@koumbit.org>
+
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin
+DESC="autossh"
+NAME=autossh
+USER=$NAME
+DAEMON=/usr/bin/autossh
+DAEMON_ARGS="-f"
+PIDFILE=/var/run/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+AUTOSSH_PIDFILE=$PIDFILE
+export AUTOSSH_PIDFILE
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
+# and status_of_proc is working.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+        start-stop-daemon --start --quiet --user $USER --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --user $USER --chuid $USER --pidfile $PIDFILE --exec $DAEMON -- \
+		$DAEMON_ARGS \
+		|| return 2
+	# The above code will not work for interpreted scripts, use the next
+	# six lines below instead (Ref: #643337, start-stop-daemon(8) )
+	#start-stop-daemon --start --quiet --pidfile $PIDFILE --startas $DAEMON \
+	#	--name $NAME --test > /dev/null \
+	#	|| return 1
+	#start-stop-daemon --start --quiet --pidfile $PIDFILE --startas $DAEMON \
+	#	--name $NAME -- $DAEMON_ARGS \
+	#	|| return 2
+
+	# Add code here, if necessary, that waits for the process to be ready
+	# to handle requests from services started subsequently which depend
+	# on this one.  As a last resort, sleep for some time.
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --user $USER --name $NAME
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --user $USER --exec $DAEMON
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+#
+# Function that sends a SIGHUP to the daemon/service
+#
+do_reload() {
+	#
+	# If the daemon can reload its configuration without
+	# restarting (for example, when it is sent a SIGHUP),
+	# then implement that here.
+	#
+	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
+	return 0
+}
+
+case "$1" in
+  start)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  status)
+	status_of_proc -p "$PIDFILE" "$DAEMON" "$NAME" && exit 0 || exit $?
+	;;
+  reload|force-reload)
+        log_daemon_msg "Reloading $DESC" "$NAME"
+	do_reload
+	log_end_msg $?
+	;;
+  restart)
+	#
+	# If the "reload" option is implemented then remove the
+	# 'force-reload' alias
+	#
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+		# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	#echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
+	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+	exit 3
+	;;
+esac
+
+:
diff --git a/puppet/modules/sshd/lib/facter/ssh_version.rb b/puppet/modules/sshd/lib/facter/ssh_version.rb
new file mode 100644
index 00000000..51d8a00f
--- /dev/null
+++ b/puppet/modules/sshd/lib/facter/ssh_version.rb
@@ -0,0 +1,5 @@
+Facter.add("ssh_version") do
+  setcode do
+    ssh_version = Facter::Util::Resolution.exec('ssh -V 2>&1 1>/dev/null').chomp.split(' ')[0].split('_')[1]
+  end
+end
diff --git a/puppet/modules/sshd/lib/puppet/parser/functions/ssh_keygen.rb b/puppet/modules/sshd/lib/puppet/parser/functions/ssh_keygen.rb
new file mode 100644
index 00000000..e304f242
--- /dev/null
+++ b/puppet/modules/sshd/lib/puppet/parser/functions/ssh_keygen.rb
@@ -0,0 +1,30 @@
+Puppet::Parser::Functions::newfunction(:ssh_keygen, :type => :rvalue, :doc =>
+  "Returns an array containing the ssh private and public (in this order) key
+  for a certain private key path.
+  It will generate the keypair if both do not exist. It will also generate
+  the directory hierarchy if required.
+  It accepts only fully qualified paths, everything else will fail.") do |args|
+    raise Puppet::ParseError, "Wrong number of arguments" unless args.to_a.length == 1
+    private_key_path = args.to_a[0]
+    raise Puppet::ParseError, "Only fully qualified paths are accepted (#{private_key_path})" unless private_key_path =~ /^\/.+/
+    public_key_path = "#{private_key_path}.pub"
+    raise Puppet::ParseError, "Either only the private or only the public key exists" if File.exists?(private_key_path) ^ File.exists?(public_key_path)
+    [private_key_path,public_key_path].each do |path|
+      raise Puppet::ParseError, "#{path} is a directory" if File.directory?(path)
+    end
+
+    dir = File.dirname(private_key_path)
+    unless File.directory?(dir)
+      require 'fileutils'
+      FileUtils.mkdir_p(dir, :mode => 0700)
+    end
+    unless [private_key_path,public_key_path].all?{|path| File.exists?(path) }
+      executor = (Facter.value(:puppetversion).to_i < 3) ? Puppet::Util : Puppet::Util::Execution
+      output = executor.execute(
+        ['/usr/bin/ssh-keygen','-t', 'rsa', '-b', '4096', 
+         '-f', private_key_path, '-P', '', '-q'])
+      raise Puppet::ParseError, "Something went wrong during key generation! Output: #{output}" unless output.empty?
+    end
+    [File.read(private_key_path),File.read(public_key_path)]
+end
+
diff --git a/puppet/modules/sshd/manifests/autossh.pp b/puppet/modules/sshd/manifests/autossh.pp
new file mode 100644
index 00000000..5650584a
--- /dev/null
+++ b/puppet/modules/sshd/manifests/autossh.pp
@@ -0,0 +1,40 @@
+class sshd::autossh($host,
+                    $port = undef, # this should be a remote->local hash
+                    $remote_user = undef,
+                    $user = 'root',
+                    $pidfile = '/var/run/autossh.pid',
+) {
+  if $port {
+    $port_ensure = $port
+  }
+  else {
+    # random port between 10000 and 20000
+    $port_ensure = fqdn_rand(10000) + 10000
+  }
+  if $remote_user {
+    $remote_user_ensure = $remote_user
+  }
+  else {
+    $remote_user_ensure = "host-$fqdn"
+  }
+  file {
+    '/etc/init.d/autossh':
+      mode   => '0555',
+      source => 'puppet:///modules/sshd/autossh.init.d';
+    '/etc/default/autossh':
+      mode    => '0444',
+      content => "USER=$user\nPIDFILE=$pidfile\nDAEMON_ARGS='-M0 -f -o ServerAliveInterval=15 -o ServerAliveCountMax=4 -q -N -R $port_ensure:localhost:22 $remote_user_ensure@$host'\n";
+  }
+  package { 'autossh':
+    ensure => present,
+  }
+  service { 'autossh':
+    ensure    => running,
+    enable    => true,
+    subscribe => [
+                  File['/etc/init.d/autossh'],
+                  File['/etc/default/autossh'],
+                  Package['autossh'],
+                  ],
+  }
+}
diff --git a/puppet/modules/sshd/manifests/base.pp b/puppet/modules/sshd/manifests/base.pp
new file mode 100644
index 00000000..dda9f26c
--- /dev/null
+++ b/puppet/modules/sshd/manifests/base.pp
@@ -0,0 +1,41 @@
+# The base class to setup the common things.
+# This is a private class and will always be used
+# throught the sshd class itself.
+class sshd::base {
+
+  $sshd_config_content = $::operatingsystem ? {
+    'CentOS'  => template("sshd/sshd_config/${::operatingsystem}_${::operatingsystemmajrelease}.erb"),
+    default   => $::lsbdistcodename ? {
+      ''      => template("sshd/sshd_config/${::operatingsystem}.erb"),
+      default => template("sshd/sshd_config/${::operatingsystem}_${::lsbdistcodename}.erb")
+    }
+  }
+
+  file { 'sshd_config':
+    ensure  => present,
+    path    => '/etc/ssh/sshd_config',
+    content => $sshd_config_content,
+    notify  => Service[sshd],
+    owner   => root,
+    group   => 0,
+    mode    => '0600';
+  }
+
+  # Now add the key, if we've got one
+  case $::sshrsakey {
+    '': { info("no sshrsakey on ${::fqdn}") }
+    default: {
+      # only export sshkey when storedconfigs is enabled
+      if $::sshd::use_storedconfigs {
+        include ::sshd::sshkey
+      }
+    }
+  }
+  service{'sshd':
+    ensure    => running,
+    name      => 'sshd',
+    enable    => true,
+    hasstatus => true,
+    require   => File[sshd_config],
+  }
+}
diff --git a/puppet/modules/sshd/manifests/client.pp b/puppet/modules/sshd/manifests/client.pp
new file mode 100644
index 00000000..84dd7abc
--- /dev/null
+++ b/puppet/modules/sshd/manifests/client.pp
@@ -0,0 +1,22 @@
+# manifests/client.pp
+
+class sshd::client(
+  $shared_ip = 'no',
+  $ensure_version = 'installed',
+  $manage_shorewall = false
+) {
+
+  case $::operatingsystem {
+    debian,ubuntu: { include sshd::client::debian }
+    default: {
+      case $::kernel {
+        linux: { include sshd::client::linux }
+        default: { include sshd::client::base }
+      }
+    }
+  }
+
+  if $manage_shorewall{
+    include shorewall::rules::out::ssh
+  }
+}
diff --git a/puppet/modules/sshd/manifests/client/base.pp b/puppet/modules/sshd/manifests/client/base.pp
new file mode 100644
index 00000000..4925c2d0
--- /dev/null
+++ b/puppet/modules/sshd/manifests/client/base.pp
@@ -0,0 +1,15 @@
+class sshd::client::base {
+  # this is needed because the gid might have changed
+  file { '/etc/ssh/ssh_known_hosts':
+    ensure => present,
+    mode   => '0644',
+    owner  => root,
+    group  => 0;
+  }
+
+  # Now collect all server keys
+  case $sshd::client::shared_ip {
+    no:  { Sshkey <<||>> }
+    yes: { Sshkey <<| tag == fqdn |>> }
+  }
+}
diff --git a/puppet/modules/sshd/manifests/client/debian.pp b/puppet/modules/sshd/manifests/client/debian.pp
new file mode 100644
index 00000000..2aaf3fb1
--- /dev/null
+++ b/puppet/modules/sshd/manifests/client/debian.pp
@@ -0,0 +1,5 @@
+class sshd::client::debian inherits sshd::client::linux {
+  Package['openssh-clients']{
+    name => 'openssh-client',
+  }
+}
diff --git a/puppet/modules/sshd/manifests/client/linux.pp b/puppet/modules/sshd/manifests/client/linux.pp
new file mode 100644
index 00000000..0c420be2
--- /dev/null
+++ b/puppet/modules/sshd/manifests/client/linux.pp
@@ -0,0 +1,5 @@
+class sshd::client::linux inherits sshd::client::base {
+  package {'openssh-clients':
+    ensure => $sshd::client::ensure_version,
+  }
+}
diff --git a/puppet/modules/sshd/manifests/debian.pp b/puppet/modules/sshd/manifests/debian.pp
new file mode 100644
index 00000000..d827078a
--- /dev/null
+++ b/puppet/modules/sshd/manifests/debian.pp
@@ -0,0 +1,13 @@
+class sshd::debian inherits sshd::linux {
+
+  Package[openssh]{
+    name => 'openssh-server',
+  }
+
+  Service[sshd]{
+    name       => 'ssh',
+    pattern    => 'sshd',
+    hasstatus  => true,
+    hasrestart => true,
+  }
+}
diff --git a/puppet/modules/sshd/manifests/gentoo.pp b/puppet/modules/sshd/manifests/gentoo.pp
new file mode 100644
index 00000000..631f3d19
--- /dev/null
+++ b/puppet/modules/sshd/manifests/gentoo.pp
@@ -0,0 +1,5 @@
+class sshd::gentoo inherits sshd::linux {
+  Package[openssh]{
+    category => 'net-misc',
+  }
+}
diff --git a/puppet/modules/sshd/manifests/init.pp b/puppet/modules/sshd/manifests/init.pp
new file mode 100644
index 00000000..b4157418
--- /dev/null
+++ b/puppet/modules/sshd/manifests/init.pp
@@ -0,0 +1,92 @@
+# manage an sshd installation
+class sshd(
+  $manage_nagios = false,
+  $nagios_check_ssh_hostname = 'absent',
+  $ports = [ 22 ],
+  $shared_ip = 'no',
+  $ensure_version = 'installed',
+  $listen_address = [ '0.0.0.0', '::' ],
+  $allowed_users = '',
+  $allowed_groups = '',
+  $use_pam = 'no',
+  $permit_root_login = 'without-password',
+  $password_authentication = 'no',
+  $kerberos_authentication = 'no',
+  $kerberos_orlocalpasswd = 'yes',
+  $kerberos_ticketcleanup = 'yes',
+  $gssapi_authentication = 'no',
+  $gssapi_cleanupcredentials = 'yes',
+  $tcp_forwarding = 'no',
+  $x11_forwarding = 'no',
+  $agent_forwarding = 'no',
+  $challenge_response_authentication = 'no',
+  $pubkey_authentication = 'yes',
+  $rsa_authentication = 'no',
+  $strict_modes = 'yes',
+  $ignore_rhosts = 'yes',
+  $rhosts_rsa_authentication = 'no',
+  $hostbased_authentication = 'no',
+  $permit_empty_passwords = 'no',
+  $authorized_keys_file = $::osfamily ? {
+    Debian => $::lsbmajdistrelease ? {
+      6       => '%h/.ssh/authorized_keys',
+      default => '%h/.ssh/authorized_keys %h/.ssh/authorized_keys2',
+    },
+    RedHat => $::operatingsystemmajrelease ? {
+      5       => '%h/.ssh/authorized_keys',
+      6       => '%h/.ssh/authorized_keys',
+      default => '%h/.ssh/authorized_keys %h/.ssh/authorized_keys2',
+    },
+    OpenBSD => '%h/.ssh/authorized_keys',
+    default => '%h/.ssh/authorized_keys %h/.ssh/authorized_keys2',
+  },
+  $hardened = 'no',
+  $sftp_subsystem = '',
+  $head_additional_options = '',
+  $tail_additional_options = '',
+  $print_motd = 'yes',
+  $manage_shorewall = false,
+  $shorewall_source = 'net',
+  $sshkey_ipaddress = $::ipaddress,
+  $manage_client = true,
+  $hostkey_type = versioncmp($::ssh_version, '6.5') ? {
+    /(^1|0)/ => [ 'rsa', 'ed25519' ],
+    /-1/    => [ 'rsa', 'dsa' ]
+  },
+  $use_storedconfigs = true
+) {
+
+  validate_bool($manage_shorewall)
+  validate_bool($manage_client)
+  validate_array($listen_address)
+  validate_array($ports)
+
+  if $manage_client {
+    class{'sshd::client':
+      shared_ip        => $shared_ip,
+      ensure_version   => $ensure_version,
+      manage_shorewall => $manage_shorewall,
+    }
+  }
+
+  case $::operatingsystem {
+    gentoo: { include sshd::gentoo }
+    redhat,centos: { include sshd::redhat }
+    openbsd: { include sshd::openbsd }
+    debian,ubuntu: { include sshd::debian }
+    default: { include sshd::base }
+  }
+
+  if $manage_nagios {
+    sshd::nagios{$ports:
+      check_hostname => $nagios_check_ssh_hostname
+    }
+  }
+
+  if $manage_shorewall {
+    class{'shorewall::rules::ssh':
+      ports  => $ports,
+      source => $shorewall_source
+    }
+  }
+}
diff --git a/puppet/modules/sshd/manifests/libssh2.pp b/puppet/modules/sshd/manifests/libssh2.pp
new file mode 100644
index 00000000..403ac7be
--- /dev/null
+++ b/puppet/modules/sshd/manifests/libssh2.pp
@@ -0,0 +1,7 @@
+# manifests/libssh2.pp
+
+class sshd::libssh2 {
+  package{'libssh2':
+    ensure => present,
+  }
+}
diff --git a/puppet/modules/sshd/manifests/libssh2/devel.pp b/puppet/modules/sshd/manifests/libssh2/devel.pp
new file mode 100644
index 00000000..261e34c8
--- /dev/null
+++ b/puppet/modules/sshd/manifests/libssh2/devel.pp
@@ -0,0 +1,7 @@
+# manifests/libssh2/devel.pp
+
+class sshd::libssh2::devel inherits sshd::libssh2 {
+  package{"libssh2-devel.${::architecture}":
+    ensure => installed,
+  }
+}
diff --git a/puppet/modules/sshd/manifests/linux.pp b/puppet/modules/sshd/manifests/linux.pp
new file mode 100644
index 00000000..8628ff5e
--- /dev/null
+++ b/puppet/modules/sshd/manifests/linux.pp
@@ -0,0 +1,8 @@
+class sshd::linux inherits sshd::base {
+  package{'openssh':
+    ensure => $sshd::ensure_version,
+  }
+  File[sshd_config]{
+    require +> Package[openssh],
+  }
+}
diff --git a/puppet/modules/sshd/manifests/nagios.pp b/puppet/modules/sshd/manifests/nagios.pp
new file mode 100644
index 00000000..6921de91
--- /dev/null
+++ b/puppet/modules/sshd/manifests/nagios.pp
@@ -0,0 +1,24 @@
+define sshd::nagios(
+  $port = 'absent',
+  $ensure = 'present',
+  $check_hostname = 'absent'
+) {
+  $real_port = $port ? {
+    'absent' => $name,
+    default  => $port,
+  }
+  case $check_hostname {
+    'absent': {
+      nagios::service{"ssh_port_${name}":
+        ensure        => $ensure,
+        check_command => "check_ssh_port!${real_port}"
+      }
+    }
+    default: {
+      nagios::service{"ssh_port_host_${name}":
+        ensure        => $ensure,
+        check_command => "check_ssh_port_host!${real_port}!${check_hostname}"
+      }
+    }
+  }
+}
diff --git a/puppet/modules/sshd/manifests/openbsd.pp b/puppet/modules/sshd/manifests/openbsd.pp
new file mode 100644
index 00000000..cb6dbba6
--- /dev/null
+++ b/puppet/modules/sshd/manifests/openbsd.pp
@@ -0,0 +1,8 @@
+class sshd::openbsd inherits sshd::base {
+  Service[sshd]{
+    restart => '/bin/kill -HUP `/bin/cat /var/run/sshd.pid`',
+    stop    => '/bin/kill `/bin/cat /var/run/sshd.pid`',
+    start   => '/usr/sbin/sshd',
+    status  => '/usr/bin/pgrep -f /usr/sbin/sshd',
+  }
+}
diff --git a/puppet/modules/sshd/manifests/redhat.pp b/puppet/modules/sshd/manifests/redhat.pp
new file mode 100644
index 00000000..d7201774
--- /dev/null
+++ b/puppet/modules/sshd/manifests/redhat.pp
@@ -0,0 +1,5 @@
+class sshd::redhat inherits sshd::linux {
+    Package[openssh]{
+        name => 'openssh-server',
+    }
+}
diff --git a/puppet/modules/sshd/manifests/ssh_authorized_key.pp b/puppet/modules/sshd/manifests/ssh_authorized_key.pp
new file mode 100644
index 00000000..80cb3b70
--- /dev/null
+++ b/puppet/modules/sshd/manifests/ssh_authorized_key.pp
@@ -0,0 +1,85 @@
+# wrapper to have some defaults.
+define sshd::ssh_authorized_key(
+    $ensure = 'present',
+    $type = 'ssh-dss',
+    $key = 'absent',
+    $user = '',
+    $target = undef,
+    $options = 'absent',
+    $override_builtin = undef
+){
+
+  if ($ensure=='present') and ($key=='absent') {
+    fail("You have to set \$key for Sshd::Ssh_authorized_key[${name}]!")
+  }
+
+  $real_user = $user ? {
+    false   => $name,
+    ''      => $name,
+    default => $user,
+  }
+
+  case $target {
+    undef,'': {
+      case $real_user {
+        'root': { $real_target = '/root/.ssh/authorized_keys' }
+        default: { $real_target = "/home/${real_user}/.ssh/authorized_keys" }
+      }
+    }
+    default: {
+      $real_target = $target
+    }
+  }
+
+  # The ssh_authorized_key built-in function (in 2.7.23 at least)
+  # will not write an authorized_keys file for a mortal user to
+  # a directory they don't have write permission to, puppet attempts to
+  # create the file as the user specified with the user parameter and fails.
+  # Since ssh will refuse to use authorized_keys files not owned by the
+  # user, or in files/directories that allow other users to write, this
+  # behavior is deliberate in order to prevent typical non-working
+  # configurations. However, it also prevents the case of puppet, running
+  # as root, writing a file owned by a mortal user to a common
+  # authorized_keys directory such as one might specify in sshd_config with
+  # something like
+  #  'AuthorizedKeysFile /etc/ssh/authorized_keys/%u'
+  # So we provide a way to override the built-in and instead just install
+  # via a file resource. There is no additional security risk here, it's
+  # nothing a user can't already do by writing their own file resources,
+  # we still depend on the filesystem permissions to keep things safe.
+  if $override_builtin {
+    $header = "# HEADER: This file is managed by Puppet.\n"
+
+    if $options == 'absent' {
+      info("not setting any option for ssh_authorized_key: ${name}")
+      $content = "${header}${type} ${key}\n"
+    } else {
+      $content = "${header}${options} ${type} ${key}\n"
+    }
+
+    file { $real_target:
+      ensure  => $ensure,
+      content => $content,
+      owner   => $real_user,
+      mode    => '0600',
+    }
+
+  } else {
+
+    if $options == 'absent' {
+      info("not setting any option for ssh_authorized_key: ${name}")
+    } else {
+      $real_options = $options
+    }
+
+    ssh_authorized_key{$name:
+      ensure  => $ensure,
+      type    => $type,
+      key     => $key,
+      user    => $real_user,
+      target  => $real_target,
+      options => $real_options,
+    }
+  }
+
+}
diff --git a/puppet/modules/sshd/manifests/sshkey.pp b/puppet/modules/sshd/manifests/sshkey.pp
new file mode 100644
index 00000000..df37a66c
--- /dev/null
+++ b/puppet/modules/sshd/manifests/sshkey.pp
@@ -0,0 +1,21 @@
+# deploys the
+class sshd::sshkey {
+
+  @@sshkey{$::fqdn:
+    ensure => present,
+    tag    => 'fqdn',
+    type   => 'ssh-rsa',
+    key    => $::sshrsakey,
+  }
+
+  # In case the node has uses a shared network address,
+  # we don't define a sshkey resource using an IP address
+  if $sshd::shared_ip == 'no' {
+    @@sshkey{$::sshd::sshkey_ipaddress:
+      ensure => present,
+      tag    => 'ipaddress',
+      type   => 'ssh-rsa',
+      key    => $::sshrsakey,
+    }
+  }
+}
diff --git a/puppet/modules/sshd/spec/classes/client_spec.rb b/puppet/modules/sshd/spec/classes/client_spec.rb
new file mode 100644
index 00000000..bd3e35af
--- /dev/null
+++ b/puppet/modules/sshd/spec/classes/client_spec.rb
@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+describe 'sshd::client' do
+
+  shared_examples "a Linux OS" do
+    it { should contain_file('/etc/ssh/ssh_known_hosts').with(
+      {
+        'ensure'  => 'present',
+        'owner'   => 'root',
+        'group'   => '0',
+        'mode'    => '0644',
+      }
+    )}
+  end
+
+  context "Debian OS" do
+    let :facts do
+      {
+        :operatingsystem => 'Debian',
+        :osfamily        => 'Debian',
+        :lsbdistcodename => 'wheezy',
+      }
+    end
+    it_behaves_like "a Linux OS"
+    it { should contain_package('openssh-clients').with({
+      'name' => 'openssh-client'
+    }) }
+  end
+
+  context "CentOS" do
+    it_behaves_like "a Linux OS" do
+      let :facts do
+        {
+        :operatingsystem => 'CentOS',
+        :osfamily        => 'RedHat',
+        :lsbdistcodename => 'Final',
+       }
+      end
+    end
+  end
+
+end
\ No newline at end of file
diff --git a/puppet/modules/sshd/spec/classes/init_spec.rb b/puppet/modules/sshd/spec/classes/init_spec.rb
new file mode 100644
index 00000000..e3003d14
--- /dev/null
+++ b/puppet/modules/sshd/spec/classes/init_spec.rb
@@ -0,0 +1,122 @@
+require 'spec_helper'
+
+describe 'sshd' do
+
+  shared_examples "a Linux OS" do
+    it { should compile.with_all_deps }
+    it { should contain_class('sshd') }
+    it { should contain_class('sshd::client') }
+
+    it { should contain_service('sshd').with({
+      :ensure     => 'running',
+      :enable     => true,
+      :hasstatus  => true
+    })}
+
+    it { should contain_file('sshd_config').with(
+      {
+        'ensure'  => 'present',
+        'owner'   => 'root',
+        'group'   => '0',
+        'mode'    => '0600',
+      }
+    )}
+
+    context 'change ssh port' do
+      let(:params){{
+       :ports => [ 22222],
+      }}
+      it { should contain_file(
+          'sshd_config'
+      ).with_content(/Port 22222/)}
+    end
+  end
+
+  context "Debian OS" do
+    let :facts do
+      {
+        :operatingsystem => 'Debian',
+        :osfamily        => 'Debian',
+        :lsbdistcodename => 'wheezy',
+      }
+    end
+    it_behaves_like "a Linux OS"
+    it { should contain_package('openssh') }
+    it { should contain_class('sshd::debian') }
+    it { should contain_service('sshd').with(
+      :hasrestart => true
+    )}
+
+    context "Ubuntu" do
+      let :facts do
+        {
+          :operatingsystem => 'Ubuntu',
+          :lsbdistcodename => 'precise',
+        }
+      end
+      it_behaves_like "a Linux OS"
+      it { should contain_package('openssh') }
+      it { should contain_service('sshd').with({
+        :hasrestart => true
+      })}
+    end
+  end
+
+
+#  context "RedHat OS" do
+#    it_behaves_like "a Linux OS" do
+#      let :facts do
+#        {
+#          :operatingsystem => 'RedHat',
+#          :osfamily        => 'RedHat',
+#        }
+#      end
+#    end
+#  end
+
+  context "CentOS" do
+    it_behaves_like "a Linux OS" do
+      let :facts do
+        {
+        :operatingsystem => 'CentOS',
+        :osfamily        => 'RedHat',
+        :lsbdistcodename => 'Final',
+       }
+      end
+    end
+  end
+
+  context "Gentoo" do
+    let :facts do
+    {
+      :operatingsystem => 'Gentoo',
+      :osfamily        => 'Gentoo',
+    }
+    end
+    it_behaves_like "a Linux OS"
+    it { should contain_class('sshd::gentoo') }
+  end
+
+  context "OpenBSD" do
+    let :facts do
+      {
+      :operatingsystem => 'OpenBSD',
+      :osfamily        => 'OpenBSD',
+     }
+    end
+    it_behaves_like "a Linux OS"
+    it { should contain_class('sshd::openbsd') }
+  end
+
+#  context "FreeBSD" do
+#    it_behaves_like "a Linux OS" do
+#      let :facts do
+#        {
+#        :operatingsystem => 'FreeBSD',
+#        :osfamily        => 'FreeBSD',
+#       }
+#      end
+#    end
+#  end
+
+end
\ No newline at end of file
diff --git a/puppet/modules/sshd/spec/defines/ssh_authorized_key_spec.rb b/puppet/modules/sshd/spec/defines/ssh_authorized_key_spec.rb
new file mode 100644
index 00000000..c73a91cc
--- /dev/null
+++ b/puppet/modules/sshd/spec/defines/ssh_authorized_key_spec.rb
@@ -0,0 +1,45 @@
+require 'spec_helper'
+
+describe 'sshd::ssh_authorized_key' do
+
+  context 'manage authorized key' do
+    let(:title) { 'foo' }
+    let(:ssh_key) { 'some_secret_ssh_key' }
+
+    let(:params) {{
+        :key => ssh_key,
+    }}
+
+    it { should contain_ssh_authorized_key('foo').with({
+        'ensure' => 'present',
+        'type'   => 'ssh-dss',
+        'user'   => 'foo',
+        'target' => '/home/foo/.ssh/authorized_keys',
+        'key'    => ssh_key,
+      })
+    }
+  end
+  context 'manage authoried key with options' do
+    let(:title) { 'foo2' }
+    let(:ssh_key) { 'some_secret_ssh_key' }
+
+    let(:params) {{
+        :key      => ssh_key,
+        :options  => ['command="/usr/bin/date"',
+                      'no-pty','no-X11-forwarding','no-agent-forwarding',
+                      'no-port-forwarding']
+    }}
+
+    it { should contain_ssh_authorized_key('foo2').with({
+        'ensure'  => 'present',
+        'type'    => 'ssh-dss',
+        'user'    => 'foo2',
+        'target'  => '/home/foo2/.ssh/authorized_keys',
+        'key'     => ssh_key,
+        'options' => ['command="/usr/bin/date"',
+                      'no-pty','no-X11-forwarding','no-agent-forwarding',
+                      'no-port-forwarding']
+      })
+    }
+  end
+end
diff --git a/puppet/modules/sshd/spec/functions/ssh_keygen_spec.rb b/puppet/modules/sshd/spec/functions/ssh_keygen_spec.rb
new file mode 100644
index 00000000..a6b51173
--- /dev/null
+++ b/puppet/modules/sshd/spec/functions/ssh_keygen_spec.rb
@@ -0,0 +1,116 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'rspec-puppet'
+require 'mocha'
+require 'fileutils'
+
+describe 'ssh_keygen' do
+
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it 'should exist' do
+    Puppet::Parser::Functions.function("ssh_keygen").should == "function_ssh_keygen"
+  end
+
+  it 'should raise a ParseError if no argument is passed' do
+    lambda {
+      scope.function_ssh_keygen([])
+    }.should(raise_error(Puppet::ParseError))
+  end
+
+  it 'should raise a ParseError if there is more than 1 arguments' do
+    lambda {
+      scope.function_ssh_keygen(["foo", "bar"])
+    }.should( raise_error(Puppet::ParseError))
+  end
+
+  it 'should raise a ParseError if the argument is not fully qualified' do
+    lambda {
+      scope.function_ssh_keygen(["foo"])
+    }.should( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if the private key path is a directory" do
+    File.stubs(:directory?).with("/some_dir").returns(true)
+    lambda {
+      scope.function_ssh_keygen(["/some_dir"])
+    }.should( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if the public key path is a directory" do
+    File.stubs(:directory?).with("/some_dir.pub").returns(true)
+    lambda {
+      scope.function_ssh_keygen(["/some_dir.pub"])
+    }.should( raise_error(Puppet::ParseError))
+  end
+
+  describe 'when executing properly' do
+    before do
+      File.stubs(:directory?).with('/tmp/a/b/c').returns(false)
+      File.stubs(:directory?).with('/tmp/a/b/c.pub').returns(false)
+      File.stubs(:read).with('/tmp/a/b/c').returns('privatekey')
+      File.stubs(:read).with('/tmp/a/b/c.pub').returns('publickey')
+    end
+
+    it 'should fail if the public but not the private key exists' do
+      File.stubs(:exists?).with('/tmp/a/b/c').returns(true)
+      File.stubs(:exists?).with('/tmp/a/b/c.pub').returns(false)
+      lambda {
+        scope.function_ssh_keygen(['/tmp/a/b/c'])
+      }.should( raise_error(Puppet::ParseError))
+    end
+
+    it "should fail if the private but not the public key exists" do
+      File.stubs(:exists?).with("/tmp/a/b/c").returns(false)
+      File.stubs(:exists?).with("/tmp/a/b/c.pub").returns(true)
+      lambda {
+        scope.function_ssh_keygen(["/tmp/a/b/c"])
+      }.should( raise_error(Puppet::ParseError))
+    end
+
+
+    it "should return an array of size 2 with the right conent if the keyfiles exists" do
+      File.stubs(:exists?).with("/tmp/a/b/c").returns(true)
+      File.stubs(:exists?).with("/tmp/a/b/c.pub").returns(true)
+      File.stubs(:directory?).with('/tmp/a/b').returns(true)
+      Puppet::Util.expects(:execute).never
+      result = scope.function_ssh_keygen(['/tmp/a/b/c'])
+      result.length.should == 2
+      result[0].should == 'privatekey'
+      result[1].should == 'publickey'
+    end
+
+    it "should create the directory path if it does not exist" do
+      File.stubs(:exists?).with("/tmp/a/b/c").returns(false)
+      File.stubs(:exists?).with("/tmp/a/b/c.pub").returns(false)
+      File.stubs(:directory?).with("/tmp/a/b").returns(false)
+      FileUtils.expects(:mkdir_p).with("/tmp/a/b", :mode => 0700)
+      Puppet::Util::Execution.expects(:execute).returns("")
+      result = scope.function_ssh_keygen(['/tmp/a/b/c'])
+      result.length.should == 2
+      result[0].should == 'privatekey'
+      result[1].should == 'publickey'
+    end
+
+    it "should generate the key if the keyfiles do not exist" do
+      File.stubs(:exists?).with("/tmp/a/b/c").returns(false)
+      File.stubs(:exists?).with("/tmp/a/b/c.pub").returns(false)
+      File.stubs(:directory?).with("/tmp/a/b").returns(true)
+      Puppet::Util::Execution.expects(:execute).with(['/usr/bin/ssh-keygen','-t', 'rsa', '-b', '4096', '-f', '/tmp/a/b/c', '-P', '', '-q']).returns("")
+      result = scope.function_ssh_keygen(['/tmp/a/b/c'])
+      result.length.should == 2
+      result[0].should == 'privatekey'
+      result[1].should == 'publickey'
+    end
+
+    it "should fail if something goes wrong during generation" do
+      File.stubs(:exists?).with("/tmp/a/b/c").returns(false)
+      File.stubs(:exists?).with("/tmp/a/b/c.pub").returns(false)
+      File.stubs(:directory?).with("/tmp/a/b").returns(true)
+      Puppet::Util::Execution.expects(:execute).with(['/usr/bin/ssh-keygen','-t', 'rsa', '-b', '4096', '-f', '/tmp/a/b/c', '-P', '', '-q']).returns("something is wrong")
+      lambda {
+        scope.function_ssh_keygen(["/tmp/a/b/c"])
+      }.should( raise_error(Puppet::ParseError))
+    end
+  end
+end
diff --git a/puppet/modules/sshd/spec/spec_helper.rb b/puppet/modules/sshd/spec/spec_helper.rb
new file mode 100644
index 00000000..b4123fde
--- /dev/null
+++ b/puppet/modules/sshd/spec/spec_helper.rb
@@ -0,0 +1,21 @@
+dir = File.expand_path(File.dirname(__FILE__))
+$LOAD_PATH.unshift File.join(dir, 'lib')
+require 'puppet'
+require 'rspec'
+require 'puppetlabs_spec_helper/module_spec_helper'
+#require 'rspec-hiera-puppet'
+require 'rspec-puppet/coverage'
+require 'rspec/autorun'
+
+fixture_path = File.expand_path(File.join(__FILE__, '..', 'fixtures'))
+
+RSpec.configure do |c|
+  c.module_path = File.join(fixture_path, 'modules')
+  c.manifest_dir = File.join(fixture_path, 'manifests')
+  c.pattern = "spec/*/*_spec.rb"
+end
+
+Puppet::Util::Log.level = :warning
+Puppet::Util::Log.newdestination(:console)
+
+at_exit { RSpec::Puppet::Coverage.report! }
\ No newline at end of file
diff --git a/puppet/modules/sshd/spec/spec_helper_system.rb b/puppet/modules/sshd/spec/spec_helper_system.rb
new file mode 100644
index 00000000..2c6812fc
--- /dev/null
+++ b/puppet/modules/sshd/spec/spec_helper_system.rb
@@ -0,0 +1,25 @@
+require 'rspec-system/spec_helper'
+require 'rspec-system-puppet/helpers'
+require 'rspec-system-serverspec/helpers'
+include Serverspec::Helper::RSpecSystem
+include Serverspec::Helper::DetectOS
+include RSpecSystemPuppet::Helpers
+
+RSpec.configure do |c|
+  # Project root
+  proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+
+  # Enable colour
+  c.tty = true
+
+  c.include RSpecSystemPuppet::Helpers
+
+  # This is where we 'setup' the nodes before running our tests
+  c.before :suite do
+    # Install puppet
+    puppet_install
+    # Install modules and dependencies
+    puppet_module_install(:source => proj_root, :module_name => 'sshd')
+    shell('puppet module install puppetlabs-stdlib')
+  end
+end
diff --git a/puppet/modules/sshd/templates/sshd_config/CentOS_5.erb b/puppet/modules/sshd/templates/sshd_config/CentOS_5.erb
new file mode 120000
index 00000000..71b767a5
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/CentOS_5.erb
@@ -0,0 +1 @@
+CentOS_6.erb
\ No newline at end of file
diff --git a/puppet/modules/sshd/templates/sshd_config/CentOS_6.erb b/puppet/modules/sshd/templates/sshd_config/CentOS_6.erb
new file mode 100644
index 00000000..4593a91a
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/CentOS_6.erb
@@ -0,0 +1,172 @@
+#	$OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+
+# Disable legacy (protocol version 1) support in the server for new
+# installations. In future the default will change to require explicit
+# activation of protocol 1
+Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+SyslogFacility AUTHPRIV
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+#MaxAuthTries 6
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandRunAs nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to no to disable s/key passwords
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+#KerberosUseKuserok yes
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+# Set this to 'yes' to enable PAM authentication, account processing, 
+# and session processing. If this is enabled, PAM authentication will 
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+#UsePAM no
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+# Accept locale-related environment variables
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
+AcceptEnv XMODIFIERS
+
+#AllowAgentForwarding yes
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+#GatewayPorts no
+#X11Forwarding no
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#ShowPatchLevel no
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+
+# no default banner path
+#Banner /some/path
+
+# override default of no subsystems
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/libexec/openssh/sftp-server' : s %> 
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% else -%>
+Ciphers aes256-ctr
+MACs hmac-sha1
+<% end -%>
+<% end -%>
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#      X11Forwarding no
+#      AllowTcpForwarding no
+#      ForceCommand cvs server
+#
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/CentOS_7.erb b/puppet/modules/sshd/templates/sshd_config/CentOS_7.erb
new file mode 100644
index 00000000..f55fb9d0
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/CentOS_7.erb
@@ -0,0 +1,186 @@
+# $OpenBSD: sshd_config,v 1.90 2013/05/16 04:09:14 dtucker Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/local/bin:/bin:/usr/bin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+# If you want to change the port on a SELinux system, you have to tell
+# SELinux about this change.
+# semanage port -a -t ssh_port_t -p tcp #PORTNUMBER
+#
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+
+# The default requires explicit activation of protocol 1
+#Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+<% scope.lookupvar('::sshd::hostkey_type').to_a.each do |hostkey_type| -%>
+HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
+<% end -%>
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Ciphers and keying
+#RekeyLimit default none
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+SyslogFacility AUTHPRIV
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+#MaxAuthTries 6
+#MaxSessions 10
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+#AuthorizedPrincipalsFile none
+#AuthorizedKeysCommand none
+#AuthorizedKeysCommandRunAs nobody
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to no to disable s/key passwords
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+#KerberosUseKuserok yes
+
+# GSSAPI options
+GSSAPIAuthentication no
+GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing, 
+# and session processing. If this is enabled, PAM authentication will 
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+# WARNING: 'UsePAM no' is not supported in Red Hat Enterprise Linux and may cause several
+# problems.
+#UsePAM no
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+#AllowAgentForwarding yes
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+#GatewayPorts no
+#X11Forwarding no
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+UsePrivilegeSeparation sandbox    # Default for new installations.
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#ShowPatchLevel no
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10:30:100
+#PermitTunnel no
+#ChrootDirectory none
+#VersionAddendum none
+
+# no default banner path
+#Banner none
+
+# Accept locale-related environment variables
+AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
+AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
+AcceptEnv LC_IDENTIFICATION LC_ALL LANGUAGE
+AcceptEnv XMODIFIERS
+
+
+# override default of no subsystems
+Subsystem sftp  <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/libexec/openssh/sftp-server' : s %> 
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+# Uncomment this if you want to use .local domain
+#Host *.local
+#  CheckHostIP no
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% else -%>
+Ciphers aes256-ctr
+MACs hmac-sha1
+<% end -%>
+<% end -%>
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+# X11Forwarding no
+# AllowTcpForwarding no
+# ForceCommand cvs server
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/Debian_jessie.erb b/puppet/modules/sshd/templates/sshd_config/Debian_jessie.erb
new file mode 100644
index 00000000..91dbfff0
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Debian_jessie.erb
@@ -0,0 +1,124 @@
+# This file is managed by Puppet, all local modifications will be overwritten
+#
+# Package generated configuration file
+# See the sshd_config(5) manpage for details
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+# What ports, IPs and protocols we listen for
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+Protocol 2
+# HostKeys for protocol version 2
+<% scope.lookupvar('::sshd::hostkey_type').to_a.each do |hostkey_type| -%>
+HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
+<% end -%>
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 1024
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# Change to no to disable tunnelled clear text passwords
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# Kerberos options
+KerberosAuthentication <%= scope.lookupvar('::sshd::kerberos_authentication') %>
+#KerberosGetAFSToken no
+KerberosOrLocalPasswd <%= scope.lookupvar('::sshd::kerberos_orlocalpasswd') %>
+KerberosTicketCleanup <%= scope.lookupvar('::sshd::kerberos_ticketcleanup') %>
+
+# GSSAPI options
+GSSAPIAuthentication <%= scope.lookupvar('::sshd::gssapi_authentication') %>
+GSSAPICleanupCredentials <%= scope.lookupvar('::sshd::gssapi_cleanupcredentials') %>
+
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+X11DisplayOffset 10
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+PrintLastLog yes
+TCPKeepAlive yes
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+# do not reveal debian version (default is yes)
+DebianBanner no
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/lib/openssh/sftp-server' : s %>
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+AllowAgentForwarding <%= scope.lookupvar('::sshd::agent_forwarding') %>
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/Debian_sid.erb b/puppet/modules/sshd/templates/sshd_config/Debian_sid.erb
new file mode 100644
index 00000000..91dbfff0
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Debian_sid.erb
@@ -0,0 +1,124 @@
+# This file is managed by Puppet, all local modifications will be overwritten
+#
+# Package generated configuration file
+# See the sshd_config(5) manpage for details
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+# What ports, IPs and protocols we listen for
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+Protocol 2
+# HostKeys for protocol version 2
+<% scope.lookupvar('::sshd::hostkey_type').to_a.each do |hostkey_type| -%>
+HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
+<% end -%>
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 1024
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# Change to no to disable tunnelled clear text passwords
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# Kerberos options
+KerberosAuthentication <%= scope.lookupvar('::sshd::kerberos_authentication') %>
+#KerberosGetAFSToken no
+KerberosOrLocalPasswd <%= scope.lookupvar('::sshd::kerberos_orlocalpasswd') %>
+KerberosTicketCleanup <%= scope.lookupvar('::sshd::kerberos_ticketcleanup') %>
+
+# GSSAPI options
+GSSAPIAuthentication <%= scope.lookupvar('::sshd::gssapi_authentication') %>
+GSSAPICleanupCredentials <%= scope.lookupvar('::sshd::gssapi_cleanupcredentials') %>
+
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+X11DisplayOffset 10
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+PrintLastLog yes
+TCPKeepAlive yes
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+# do not reveal debian version (default is yes)
+DebianBanner no
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/lib/openssh/sftp-server' : s %>
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+AllowAgentForwarding <%= scope.lookupvar('::sshd::agent_forwarding') %>
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/Debian_squeeze.erb b/puppet/modules/sshd/templates/sshd_config/Debian_squeeze.erb
new file mode 100644
index 00000000..649b320a
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Debian_squeeze.erb
@@ -0,0 +1,127 @@
+# This file is managed by Puppet, all local modifications will be overwritten
+#
+# Package generated configuration file
+# See the sshd(8) manpage for details
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+# What ports, IPs and protocols we listen for
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+Protocol 2
+# HostKeys for protocol version 2
+<% scope.lookupvar('::sshd::hostkey_type').to_a.each do |hostkey_type| -%>
+HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
+<% end -%>
+
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 768
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# Kerberos options
+KerberosAuthentication <%= scope.lookupvar('::sshd::kerberos_authentication') %>
+KerberosOrLocalPasswd <%= scope.lookupvar('::sshd::kerberos_orlocalpasswd') %>
+KerberosTicketCleanup <%= scope.lookupvar('::sshd::kerberos_ticketcleanup') %>
+
+# GSSAPI options
+GSSAPIAuthentication <%= scope.lookupvar('::sshd::gssapi_authentication') %>
+GSSAPICleanupCredentials <%= scope.lookupvar('::sshd::gssapi_cleanupcredentials') %>
+
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+X11DisplayOffset 10
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+PrintLastLog yes
+TCPKeepAlive yes
+
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+# do not reveal debian version (default is yes)
+DebianBanner no
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/lib/openssh/sftp-server' : s %>
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+AllowAgentForwarding <%= scope.lookupvar('::sshd::agent_forwarding') %>
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+Ciphers aes256-ctr
+MACs hmac-sha2-512
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/Debian_wheezy.erb b/puppet/modules/sshd/templates/sshd_config/Debian_wheezy.erb
new file mode 100644
index 00000000..bcb15286
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Debian_wheezy.erb
@@ -0,0 +1,132 @@
+# This file is managed by Puppet, all local modifications will be overwritten
+#
+# Package generated configuration file
+# See the sshd(8) manpage for details
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+# What ports, IPs and protocols we listen for
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+Protocol 2
+# HostKeys for protocol version 2
+<% scope.lookupvar('::sshd::hostkey_type').to_a.each do |hostkey_type| -%>
+HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
+<% end -%>
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 768
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# Kerberos options
+KerberosAuthentication <%= scope.lookupvar('::sshd::kerberos_authentication') %>
+KerberosOrLocalPasswd <%= scope.lookupvar('::sshd::kerberos_orlocalpasswd') %>
+KerberosTicketCleanup <%= scope.lookupvar('::sshd::kerberos_ticketcleanup') %>
+
+# GSSAPI options
+GSSAPIAuthentication <%= scope.lookupvar('::sshd::gssapi_authentication') %>
+GSSAPICleanupCredentials <%= scope.lookupvar('::sshd::gssapi_cleanupcredentials') %>
+
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+X11DisplayOffset 10
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+PrintLastLog yes
+TCPKeepAlive yes
+
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+# do not reveal debian version (default is yes)
+DebianBanner no
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/lib/openssh/sftp-server' : s %>
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+AllowAgentForwarding <%= scope.lookupvar('::sshd::agent_forwarding') %>
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% else -%>
+Ciphers aes256-ctr
+MACs hmac-sha2-512
+<% end -%>
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/FreeBSD.erb b/puppet/modules/sshd/templates/sshd_config/FreeBSD.erb
new file mode 100644
index 00000000..5298ade9
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/FreeBSD.erb
@@ -0,0 +1,168 @@
+#	$OpenBSD: sshd_config,v 1.81 2009/10/08 14:03:41 markus Exp $
+#	$FreeBSD: src/crypto/openssh/sshd_config,v 1.49.2.2.2.1 2010/06/14 02:09:06 kensmith Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+
+# Note that some of FreeBSD's defaults differ from OpenBSD's, and
+# FreeBSD has a few additional options.
+
+#VersionAddendum FreeBSD-20100308
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+# What ports, IPs and protocols we listen for
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+#AddressFamily any
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+
+# The default requires explicit activation of protocol 1
+Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+<% scope.lookupvar('::sshd::hostkey_type').to_a.each do |hostkey_type| -%>
+HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
+<% end -%>
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 1024
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+
+LoginGraceTime 600
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+#MaxAuthTries 6
+#MaxSessions 10
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+# Don't read the user's ~/.rhosts and ~/.shosts files
+#IgnoreRhosts yes
+
+# Change to yes to enable built-in password authentication.
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to no to disable PAM authentication
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# Kerberos options
+KerberosAuthentication <%= scope.lookupvar('::sshd::kerberos_authentication') %>
+KerberosOrLocalPasswd <%= scope.lookupvar('::sshd::kerberos_orlocalpasswd') %>
+KerberosTicketCleanup <%= scope.lookupvar('::sshd::kerberos_ticketcleanup') %>
+
+# GSSAPI options
+GSSAPIAuthentication <%= scope.lookupvar('::sshd::gssapi_authentication') %>
+GSSAPICleanupCredentials <%= scope.lookupvar('::sshd::gssapi_cleanupcredentials') %>
+
+# Set this to 'no' to disable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will 
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+AllowAgentForwarding <%= scope.lookupvar('::sshd::agent_forwarding') %>
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+#GatewayPorts no
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+
+X11DisplayOffset 10
+#X11UseLocalhost yes
+PrintMotd <%= sshd_print_motd %>
+#PrintLastLog yes
+TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10
+#PermitTunnel no
+#ChrootDirectory none
+
+# no default banner path
+#Banner none
+
+# override default of no subsystems
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/libexec/sftp-server' : s %>
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	ForceCommand cvs server
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% else -%>
+Ciphers aes256-ctr
+MACs hmac-sha1
+<% end -%>
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/Gentoo.erb b/puppet/modules/sshd/templates/sshd_config/Gentoo.erb
new file mode 100644
index 00000000..022a26e7
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Gentoo.erb
@@ -0,0 +1,164 @@
+#	$OpenBSD: sshd_config,v 1.75 2007/03/19 01:01:29 djm Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+#AddressFamily any
+
+# Disable legacy (protocol version 1) support in the server for new
+# installations. In future the default will change to require explicit
+# activation of protocol 1
+Protocol 2
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 768
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+#MaxAuthTries 6
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to no to disable s/key passwords
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+#GSSAPIStrictAcceptorCheck yes
+#GSSAPIKeyExchange no
+
+# Set this to 'yes' to enable PAM authentication, account processing, 
+# and session processing. If this is enabled, PAM authentication will 
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+#GatewayPorts no
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10
+#PermitTunnel no
+
+# no default banner path
+#Banner /some/path
+
+# override default of no subsystems
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/lib/misc/sftp-server' : s %>
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	ForceCommand cvs server
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% else -%>
+Ciphers aes256-ctr
+MACs hmac-sha1
+<% end -%>
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
diff --git a/puppet/modules/sshd/templates/sshd_config/OpenBSD.erb b/puppet/modules/sshd/templates/sshd_config/OpenBSD.erb
new file mode 100644
index 00000000..db730300
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/OpenBSD.erb
@@ -0,0 +1,144 @@
+#	$OpenBSD: sshd_config,v 1.74 2006/07/19 13:07:10 dtucker Exp $
+
+# This is the sshd server system-wide configuration file.  See
+# sshd_config(5) for more information.
+
+# The strategy used for options in the default sshd_config shipped with
+# OpenSSH is to specify options with their default value where
+# possible, but leave them commented.  Uncommented options change a
+# default value.
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+#Protocol 2,1
+#AddressFamily any
+
+# HostKey for protocol version 1
+#HostKey /etc/ssh/ssh_host_key
+# HostKeys for protocol version 2
+#HostKey /etc/ssh/ssh_host_rsa_key
+#HostKey /etc/ssh/ssh_host_dsa_key
+
+# Lifetime and size of ephemeral version 1 server key
+#KeyRegenerationInterval 1h
+#ServerKeyBits 768
+
+# Logging
+# obsoletes QuietMode and FascistLogging
+#SyslogFacility AUTH
+#LogLevel INFO
+
+# Authentication:
+
+#LoginGraceTime 2m
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+#MaxAuthTries 6
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+
+# Change to yes if you don't trust ~/.ssh/known_hosts for
+# RhostsRSAAuthentication and HostbasedAuthentication
+#IgnoreUserKnownHosts no
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to no to disable s/key passwords
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#KerberosTicketCleanup yes
+#KerberosGetAFSToken no
+
+# GSSAPI options
+#GSSAPIAuthentication no
+#GSSAPICleanupCredentials yes
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+#GatewayPorts no
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+#X11DisplayOffset 10
+#X11UseLocalhost yes
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+#PrintLastLog yes
+#TCPKeepAlive yes
+#UseLogin no
+#UsePrivilegeSeparation yes
+#PermitUserEnvironment no
+#Compression delayed
+#ClientAliveInterval 0
+#ClientAliveCountMax 3
+#UseDNS yes
+#PidFile /var/run/sshd.pid
+#MaxStartups 10
+#PermitTunnel no
+
+# no default banner path
+#Banner /some/path
+
+# override default of no subsystems
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/libexec/sftp-server' : s %>
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+# Example of overriding settings on a per-user basis
+#Match User anoncvs
+#	X11Forwarding no
+#	AllowTcpForwarding no
+#	ForceCommand cvs server
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% else -%>
+Ciphers aes256-ctr
+MACs hmac-sha1
+<% end -%>
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/Ubuntu.erb b/puppet/modules/sshd/templates/sshd_config/Ubuntu.erb
new file mode 100644
index 00000000..a326ab87
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Ubuntu.erb
@@ -0,0 +1,133 @@
+# This file is managed by Puppet, all local modifications will be overwritten
+#
+# Package generated configuration file
+# See the sshd(8) manpage for details
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+# What ports, IPs and protocols we listen for
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+Protocol 2
+# HostKeys for protocol version 2
+<% scope.lookupvar('::sshd::hostkey_type').to_a.each do |hostkey_type| -%>
+HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
+<% end -%>
+
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 768
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 120
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to yes to enable challenge-response passwords (beware issues with
+# some PAM modules and threads)
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# Kerberos options
+KerberosAuthentication <%= scope.lookupvar('::sshd::kerberos_authentication') %>
+KerberosOrLocalPasswd <%= scope.lookupvar('::sshd::kerberos_orlocalpasswd') %>
+KerberosTicketCleanup <%= scope.lookupvar('::sshd::kerberos_ticketcleanup') %>
+
+# GSSAPI options
+GSSAPIAuthentication <%= scope.lookupvar('::sshd::gssapi_authentication') %>
+GSSAPICleanupCredentials <%= scope.lookupvar('::sshd::gssapi_cleanupcredentials') %>
+
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+X11DisplayOffset 10
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+PrintLastLog yes
+TCPKeepAlive yes
+
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+# do not reveal debian version (default is yes)
+DebianBanner no
+
+# Allow client to pass locale environment variables
+AcceptEnv LANG LC_*
+
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/lib/openssh/sftp-server' : s %>
+
+# Set this to 'yes' to enable PAM authentication, account processing,
+# and session processing. If this is enabled, PAM authentication will
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+AllowAgentForwarding <%= scope.lookupvar('::sshd::agent_forwarding') %>
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% else -%>
+Ciphers aes256-ctr
+MACs hmac-sha1
+<% end -%>
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/Ubuntu_lucid.erb b/puppet/modules/sshd/templates/sshd_config/Ubuntu_lucid.erb
new file mode 100644
index 00000000..be7c56d0
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Ubuntu_lucid.erb
@@ -0,0 +1,136 @@
+# Package generated configuration file
+# See the sshd(8) manpage for details
+
+<% unless (s=scope.lookupvar('::sshd::head_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
+
+# What ports, IPs and protocols we listen for
+<% scope.lookupvar('::sshd::ports').to_a.each do |port| -%>
+<% if port == 'off' -%>
+#Port -- disabled by puppet
+<% else -%>
+Port <%= port %>
+<% end -%>
+<% end -%>
+
+# Use these options to restrict which interfaces/protocols sshd will bind to
+<% scope.lookupvar('::sshd::listen_address').to_a.each do |address| -%>
+ListenAddress <%= address %>
+<% end -%>
+Protocol 2
+# HostKeys for protocol version 2
+<% scope.lookupvar('::sshd::hostkey_type').to_a.each do |hostkey_type| -%>
+HostKey /etc/ssh/ssh_host_<%=hostkey_type %>_key
+<% end -%>
+
+#Privilege Separation is turned on for security
+UsePrivilegeSeparation yes
+
+# ...but breaks Pam auth via kbdint, so we have to turn it off
+# Use PAM authentication via keyboard-interactive so PAM modules can
+# properly interface with the user (off due to PrivSep)
+#PAMAuthenticationViaKbdInt no
+# Lifetime and size of ephemeral version 1 server key
+KeyRegenerationInterval 3600
+ServerKeyBits 768
+
+# Logging
+SyslogFacility AUTH
+LogLevel INFO
+
+# Authentication:
+LoginGraceTime 600
+PermitRootLogin <%= scope.lookupvar('::sshd::permit_root_login') %>
+
+StrictModes <%= scope.lookupvar('::sshd::strict_modes') %>
+
+RSAAuthentication <%= scope.lookupvar('::sshd::rsa_authentication') %>
+
+PubkeyAuthentication <%= scope.lookupvar('::sshd::pubkey_authentication') %>
+
+AuthorizedKeysFile <%= scope.lookupvar('::sshd::authorized_keys_file') %>
+
+# For this to work you will also need host keys in /etc/ssh_known_hosts
+RhostsRSAAuthentication <%= scope.lookupvar('::sshd::rhosts_rsa_authentication') %>
+
+# Don't read the user's ~/.rhosts and ~/.shosts files
+IgnoreRhosts <%= scope.lookupvar('::sshd::ignore_rhosts') %>
+
+# similar for protocol version 2
+HostbasedAuthentication <%= scope.lookupvar('::sshd::hostbased_authentication') %>
+
+# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
+#IgnoreUserKnownHosts yes
+
+# To enable empty passwords, change to yes (NOT RECOMMENDED)
+PermitEmptyPasswords <%= scope.lookupvar('::sshd::permit_empty_passwords') %>
+
+# Change to no to disable s/key passwords
+ChallengeResponseAuthentication <%= scope.lookupvar('::sshd::challenge_response_authentication') %>
+
+# To disable tunneled clear text passwords, change to no here!
+PasswordAuthentication <%= scope.lookupvar('::sshd::password_authentication') %>
+
+# To change Kerberos options
+#KerberosAuthentication no
+#KerberosOrLocalPasswd yes
+#AFSTokenPassing no
+#KerberosTicketCleanup no
+
+# Kerberos TGT Passing does only work with the AFS kaserver
+#KerberosTgtPassing yes
+
+X11Forwarding <%= scope.lookupvar('::sshd::x11_forwarding') %>
+X11DisplayOffset 10
+KeepAlive yes
+#UseLogin no
+
+#MaxStartups 10:30:60
+#Banner /etc/issue.net
+# do not reveal debian version (default is yes)
+DebianBanner no
+#ReverseMappingCheck yes
+
+Subsystem      sftp    <%= (s=scope.lookupvar('::sshd::sftp_subsystem')).empty? ? '/usr/lib/openssh/sftp-server' : s %>
+
+# Set this to 'yes' to enable PAM authentication, account processing, 
+# and session processing. If this is enabled, PAM authentication will 
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
+UsePAM <%= scope.lookupvar('::sshd::use_pam') %>
+
+HostbasedUsesNameFromPacketOnly yes
+
+AllowTcpForwarding <%= scope.lookupvar('::sshd::tcp_forwarding') %>
+
+AllowAgentForwarding <%= scope.lookupvar('::sshd::agent_forwarding') %>
+
+<% unless (s=scope.lookupvar('::sshd::allowed_users')).empty? -%>
+AllowUsers <%= s %>
+<% end -%>
+<% unless (s=scope.lookupvar('::sshd::allowed_groups')).empty? -%>
+AllowGroups <%= s %>
+<%- end -%>
+
+PrintMotd <%= scope.lookupvar('::sshd::print_motd') %>
+
+<% if scope.lookupvar('::sshd::hardened') == 'yes' -%>
+<% if (scope.function_versioncmp([scope.lookupvar('::ssh_version'),'6.5'])) >= 0 -%>
+KexAlgorithms curve25519-sha256@libssh.org
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com
+<% else -%>
+Ciphers aes256-ctr
+MACs hmac-sha1
+<% end -%>
+<% end -%>
+
+<% unless (s=scope.lookupvar('::sshd::tail_additional_options')).empty? -%>
+<%= s %>
+<% end -%>
diff --git a/puppet/modules/sshd/templates/sshd_config/Ubuntu_oneiric.erb b/puppet/modules/sshd/templates/sshd_config/Ubuntu_oneiric.erb
new file mode 120000
index 00000000..ccfb67c8
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Ubuntu_oneiric.erb
@@ -0,0 +1 @@
+Ubuntu_lucid.erb
\ No newline at end of file
diff --git a/puppet/modules/sshd/templates/sshd_config/Ubuntu_precise.erb b/puppet/modules/sshd/templates/sshd_config/Ubuntu_precise.erb
new file mode 120000
index 00000000..6502bfce
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/Ubuntu_precise.erb
@@ -0,0 +1 @@
+Ubuntu.erb
\ No newline at end of file
diff --git a/puppet/modules/sshd/templates/sshd_config/XenServer_xenenterprise.erb b/puppet/modules/sshd/templates/sshd_config/XenServer_xenenterprise.erb
new file mode 120000
index 00000000..71b767a5
--- /dev/null
+++ b/puppet/modules/sshd/templates/sshd_config/XenServer_xenenterprise.erb
@@ -0,0 +1 @@
+CentOS_6.erb
\ No newline at end of file
-- 
cgit v1.2.3


From 2e384e68fb867d8ba7178c4398e35653ab567538 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:30 -0400
Subject: git subrepo clone https://leap.se/git/puppet_apt puppet/modules/apt

subrepo:
  subdir:   "puppet/modules/apt"
  merged:   "33c61e8"
upstream:
  origin:   "https://leap.se/git/puppet_apt"
  branch:   "master"
  commit:   "33c61e8"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I6515ec49bbacdffd9f3729d486d2868162f9ac78
---
 puppet/modules/apt/.gitignore                      |  12 +
 puppet/modules/apt/.gitlab-ci.yml                  |  12 +
 puppet/modules/apt/.gitrepo                        |  11 +
 puppet/modules/apt/Gemfile                         |  13 +
 puppet/modules/apt/LICENSE                         | 674 +++++++++++++++++++++
 puppet/modules/apt/README                          | 602 ++++++++++++++++++
 puppet/modules/apt/Rakefile                        |  19 +
 puppet/modules/apt/files/02show_upgraded           |   4 +
 puppet/modules/apt/files/03clean                   |   4 +
 puppet/modules/apt/files/03clean_vserver           |   4 +
 puppet/modules/apt/files/upgrade_initiator         |   1 +
 puppet/modules/apt/lib/facter/apt_running.rb       |   7 +
 puppet/modules/apt/lib/facter/debian_codename.rb   |  42 ++
 puppet/modules/apt/lib/facter/debian_lts.rb        |  16 +
 .../modules/apt/lib/facter/debian_nextcodename.rb  |  23 +
 .../modules/apt/lib/facter/debian_nextrelease.rb   |  23 +
 puppet/modules/apt/lib/facter/debian_release.rb    |  38 ++
 puppet/modules/apt/lib/facter/ubuntu_codename.rb   |   8 +
 .../modules/apt/lib/facter/ubuntu_nextcodename.rb  |  20 +
 puppet/modules/apt/lib/facter/util/debian.rb       |  18 +
 puppet/modules/apt/lib/facter/util/ubuntu.rb       |  21 +
 puppet/modules/apt/manifests/apt_conf.pp           |  45 ++
 puppet/modules/apt/manifests/apticron.pp           |  24 +
 puppet/modules/apt/manifests/cron/base.pp          |  20 +
 puppet/modules/apt/manifests/cron/dist_upgrade.pp  |  29 +
 puppet/modules/apt/manifests/cron/download.pp      |  27 +
 puppet/modules/apt/manifests/dist_upgrade.pp       |   9 +
 .../apt/manifests/dist_upgrade/initiator.pp        |  23 +
 puppet/modules/apt/manifests/dot_d_directories.pp  |  15 +
 puppet/modules/apt/manifests/dselect.pp            |  11 +
 puppet/modules/apt/manifests/init.pp               | 150 +++++
 puppet/modules/apt/manifests/key.pp                |  13 +
 puppet/modules/apt/manifests/key/plain.pp          |  13 +
 puppet/modules/apt/manifests/listchanges.pp        |  19 +
 puppet/modules/apt/manifests/params.pp             |  22 +
 puppet/modules/apt/manifests/preferences.pp        |  20 +
 puppet/modules/apt/manifests/preferences/absent.pp |   7 +
 .../modules/apt/manifests/preferences_snippet.pp   |  59 ++
 puppet/modules/apt/manifests/preseeded_package.pp  |  21 +
 puppet/modules/apt/manifests/proxy_client.pp       |   9 +
 .../apt/manifests/reboot_required_notify.pp        |  21 +
 puppet/modules/apt/manifests/sources_list.pp       |  40 ++
 .../modules/apt/manifests/unattended_upgrades.pp   |  34 ++
 puppet/modules/apt/manifests/update.pp             |   7 +
 puppet/modules/apt/manifests/upgrade_package.pp    |  31 +
 puppet/modules/apt/spec/spec_helper.rb             |  12 +
 puppet/modules/apt/spec/unit/custom_facts_spec.rb  |  86 +++
 puppet/modules/apt/templates/20proxy.erb           |   5 +
 .../apt/templates/50unattended-upgrades.erb        |  38 ++
 .../apt/templates/Debian/apticron_jessie.erb       |   1 +
 .../apt/templates/Debian/apticron_lenny.erb        |  50 ++
 .../modules/apt/templates/Debian/apticron_sid.erb  |   1 +
 .../apt/templates/Debian/apticron_squeeze.erb      |  82 +++
 .../apt/templates/Debian/apticron_wheezy.erb       |  80 +++
 .../apt/templates/Debian/listchanges_jessie.erb    |   1 +
 .../apt/templates/Debian/listchanges_lenny.erb     |   7 +
 .../apt/templates/Debian/listchanges_sid.erb       |   1 +
 .../apt/templates/Debian/listchanges_squeeze.erb   |   1 +
 .../apt/templates/Debian/listchanges_wheezy.erb    |   1 +
 .../apt/templates/Debian/preferences_jessie.erb    |  14 +
 .../apt/templates/Debian/preferences_lenny.erb     |  25 +
 .../apt/templates/Debian/preferences_sid.erb       |  10 +
 .../apt/templates/Debian/preferences_squeeze.erb   |  30 +
 .../apt/templates/Debian/preferences_wheezy.erb    |  20 +
 .../modules/apt/templates/Debian/sources.list.erb  |  76 +++
 .../apt/templates/Ubuntu/preferences_lucid.erb     |   1 +
 .../apt/templates/Ubuntu/preferences_maverick.erb  |  30 +
 .../apt/templates/Ubuntu/preferences_oneiric.erb   |   1 +
 .../apt/templates/Ubuntu/preferences_precise.erb   |   1 +
 .../apt/templates/Ubuntu/preferences_utopic.erb    |   1 +
 .../apt/templates/Ubuntu/preferences_vivid.erb     |   1 +
 .../apt/templates/Ubuntu/preferences_wily.erb      |   1 +
 .../apt/templates/Ubuntu/preferences_xenial.erb    |   1 +
 .../modules/apt/templates/Ubuntu/sources.list.erb  |  22 +
 .../modules/apt/templates/preferences_snippet.erb  |   4 +
 .../apt/templates/preferences_snippet_release.erb  |   4 +
 76 files changed, 2849 insertions(+)
 create mode 100644 puppet/modules/apt/.gitignore
 create mode 100644 puppet/modules/apt/.gitlab-ci.yml
 create mode 100644 puppet/modules/apt/.gitrepo
 create mode 100644 puppet/modules/apt/Gemfile
 create mode 100644 puppet/modules/apt/LICENSE
 create mode 100644 puppet/modules/apt/README
 create mode 100644 puppet/modules/apt/Rakefile
 create mode 100644 puppet/modules/apt/files/02show_upgraded
 create mode 100644 puppet/modules/apt/files/03clean
 create mode 100644 puppet/modules/apt/files/03clean_vserver
 create mode 100644 puppet/modules/apt/files/upgrade_initiator
 create mode 100644 puppet/modules/apt/lib/facter/apt_running.rb
 create mode 100644 puppet/modules/apt/lib/facter/debian_codename.rb
 create mode 100644 puppet/modules/apt/lib/facter/debian_lts.rb
 create mode 100644 puppet/modules/apt/lib/facter/debian_nextcodename.rb
 create mode 100644 puppet/modules/apt/lib/facter/debian_nextrelease.rb
 create mode 100644 puppet/modules/apt/lib/facter/debian_release.rb
 create mode 100644 puppet/modules/apt/lib/facter/ubuntu_codename.rb
 create mode 100644 puppet/modules/apt/lib/facter/ubuntu_nextcodename.rb
 create mode 100644 puppet/modules/apt/lib/facter/util/debian.rb
 create mode 100644 puppet/modules/apt/lib/facter/util/ubuntu.rb
 create mode 100644 puppet/modules/apt/manifests/apt_conf.pp
 create mode 100644 puppet/modules/apt/manifests/apticron.pp
 create mode 100644 puppet/modules/apt/manifests/cron/base.pp
 create mode 100644 puppet/modules/apt/manifests/cron/dist_upgrade.pp
 create mode 100644 puppet/modules/apt/manifests/cron/download.pp
 create mode 100644 puppet/modules/apt/manifests/dist_upgrade.pp
 create mode 100644 puppet/modules/apt/manifests/dist_upgrade/initiator.pp
 create mode 100644 puppet/modules/apt/manifests/dot_d_directories.pp
 create mode 100644 puppet/modules/apt/manifests/dselect.pp
 create mode 100644 puppet/modules/apt/manifests/init.pp
 create mode 100644 puppet/modules/apt/manifests/key.pp
 create mode 100644 puppet/modules/apt/manifests/key/plain.pp
 create mode 100644 puppet/modules/apt/manifests/listchanges.pp
 create mode 100644 puppet/modules/apt/manifests/params.pp
 create mode 100644 puppet/modules/apt/manifests/preferences.pp
 create mode 100644 puppet/modules/apt/manifests/preferences/absent.pp
 create mode 100644 puppet/modules/apt/manifests/preferences_snippet.pp
 create mode 100644 puppet/modules/apt/manifests/preseeded_package.pp
 create mode 100644 puppet/modules/apt/manifests/proxy_client.pp
 create mode 100644 puppet/modules/apt/manifests/reboot_required_notify.pp
 create mode 100644 puppet/modules/apt/manifests/sources_list.pp
 create mode 100644 puppet/modules/apt/manifests/unattended_upgrades.pp
 create mode 100644 puppet/modules/apt/manifests/update.pp
 create mode 100644 puppet/modules/apt/manifests/upgrade_package.pp
 create mode 100644 puppet/modules/apt/spec/spec_helper.rb
 create mode 100644 puppet/modules/apt/spec/unit/custom_facts_spec.rb
 create mode 100644 puppet/modules/apt/templates/20proxy.erb
 create mode 100644 puppet/modules/apt/templates/50unattended-upgrades.erb
 create mode 120000 puppet/modules/apt/templates/Debian/apticron_jessie.erb
 create mode 100644 puppet/modules/apt/templates/Debian/apticron_lenny.erb
 create mode 120000 puppet/modules/apt/templates/Debian/apticron_sid.erb
 create mode 100644 puppet/modules/apt/templates/Debian/apticron_squeeze.erb
 create mode 100644 puppet/modules/apt/templates/Debian/apticron_wheezy.erb
 create mode 120000 puppet/modules/apt/templates/Debian/listchanges_jessie.erb
 create mode 100644 puppet/modules/apt/templates/Debian/listchanges_lenny.erb
 create mode 120000 puppet/modules/apt/templates/Debian/listchanges_sid.erb
 create mode 120000 puppet/modules/apt/templates/Debian/listchanges_squeeze.erb
 create mode 120000 puppet/modules/apt/templates/Debian/listchanges_wheezy.erb
 create mode 100644 puppet/modules/apt/templates/Debian/preferences_jessie.erb
 create mode 100644 puppet/modules/apt/templates/Debian/preferences_lenny.erb
 create mode 100644 puppet/modules/apt/templates/Debian/preferences_sid.erb
 create mode 100644 puppet/modules/apt/templates/Debian/preferences_squeeze.erb
 create mode 100644 puppet/modules/apt/templates/Debian/preferences_wheezy.erb
 create mode 100644 puppet/modules/apt/templates/Debian/sources.list.erb
 create mode 120000 puppet/modules/apt/templates/Ubuntu/preferences_lucid.erb
 create mode 100644 puppet/modules/apt/templates/Ubuntu/preferences_maverick.erb
 create mode 120000 puppet/modules/apt/templates/Ubuntu/preferences_oneiric.erb
 create mode 120000 puppet/modules/apt/templates/Ubuntu/preferences_precise.erb
 create mode 120000 puppet/modules/apt/templates/Ubuntu/preferences_utopic.erb
 create mode 120000 puppet/modules/apt/templates/Ubuntu/preferences_vivid.erb
 create mode 120000 puppet/modules/apt/templates/Ubuntu/preferences_wily.erb
 create mode 120000 puppet/modules/apt/templates/Ubuntu/preferences_xenial.erb
 create mode 100644 puppet/modules/apt/templates/Ubuntu/sources.list.erb
 create mode 100644 puppet/modules/apt/templates/preferences_snippet.erb
 create mode 100644 puppet/modules/apt/templates/preferences_snippet_release.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/apt/.gitignore b/puppet/modules/apt/.gitignore
new file mode 100644
index 00000000..a54aa971
--- /dev/null
+++ b/puppet/modules/apt/.gitignore
@@ -0,0 +1,12 @@
+/pkg/
+/Gemfile.lock
+/vendor/
+/spec/fixtures/manifests/*
+/spec/fixtures/modules/*
+!/spec/fixtures/modules/apt
+!/spec/fixtures/modules/apt/*
+/.vagrant/
+/.bundle/
+/coverage/
+/.idea/
+*.iml
diff --git a/puppet/modules/apt/.gitlab-ci.yml b/puppet/modules/apt/.gitlab-ci.yml
new file mode 100644
index 00000000..f7b8ecad
--- /dev/null
+++ b/puppet/modules/apt/.gitlab-ci.yml
@@ -0,0 +1,12 @@
+before_script:
+  - ruby -v
+  - gem install bundler --no-ri --no-rdoc
+  - bundle install --jobs $(nproc)  "${FLAGS[@]}"
+
+# don't fail on lint warnings
+rspec:
+  script:
+    - bundle exec rake lint || /bin/true
+    - bundle exec rake syntax
+    - bundle exec rake validate
+    - bundle exec rake spec
diff --git a/puppet/modules/apt/.gitrepo b/puppet/modules/apt/.gitrepo
new file mode 100644
index 00000000..1dd57eb5
--- /dev/null
+++ b/puppet/modules/apt/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_apt
+	branch = master
+	commit = 33c61e8df59db1abbed379a9e9790946060a8f1e
+	parent = 4ccae8700fb136bfbc6b7ef7bb0ab482e632139f
+	cmdver = 0.3.0
diff --git a/puppet/modules/apt/Gemfile b/puppet/modules/apt/Gemfile
new file mode 100644
index 00000000..8925a904
--- /dev/null
+++ b/puppet/modules/apt/Gemfile
@@ -0,0 +1,13 @@
+source "https://rubygems.org"
+
+group :test do
+  gem "rake"
+  gem "rspec", '< 3.2.0'
+  gem "puppet", ENV['PUPPET_VERSION'] || ENV['GEM_PUPPET_VERSION'] || ENV['PUPPET_GEM_VERSION'] || '~> 3.7.0'
+  gem "facter", ENV['FACTER_VERSION'] || ENV['GEM_FACTER_VERSION'] || ENV['FACTER_GEM_VERSION'] || '~> 2.2.0'
+  gem "rspec-puppet"
+  gem "puppetlabs_spec_helper"
+  gem "metadata-json-lint"
+  gem "rspec-puppet-facts"
+  gem "mocha"
+end
diff --git a/puppet/modules/apt/LICENSE b/puppet/modules/apt/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/apt/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/apt/README b/puppet/modules/apt/README
new file mode 100644
index 00000000..00db7d8e
--- /dev/null
+++ b/puppet/modules/apt/README
@@ -0,0 +1,602 @@
+
+Overview
+========
+
+This module manages apt on Debian.
+
+It keeps dpkg's and apt's databases as well as the keyrings for securing
+package download current.
+
+backports.debian.org is added.
+
+/etc/apt/sources.list and /etc/apt/preferences are managed. More
+recent Debian releases are pinned to very low values by default to
+prevent accidental upgrades.
+
+Ubuntu support is lagging behind but not absent either.
+
+! Upgrade Notice !
+
+ * The `disable_update` parameter has been removed. The main apt class
+   defaults to *not* run an `apt-get update` on every run anyway so this
+   parameter seems useless.
+   You can include the `apt::update` class if you want it to be run every time.
+
+ * The `apt::upgrade_package` now doesn't automatically call an Exec['apt_updated']
+   anymore, so you would need to include `apt::update` now by hand.
+
+ * The apt::codename parameter has been removed. In its place, the
+   debian_codename fact may be overridden via an environment variable. This
+   will affect all other debian_* facts, and achieve the same result.
+
+     FACTER_debian_codename=jessie puppet agent -t
+
+ * If you were using custom 50unattended-upgrades.${::lsbdistcodename} in your
+   site_apt, these are no longer supported. You should migrate to passing
+   $blacklisted_packages to the apt::unattended_upgrades class.
+
+ * the apt class has been moved to a paramterized class. if you were including
+   this class before, after passing some variables, you will need to move to
+   instantiating the class with those variables instead. For example, if you 
+   had the following in your manifests:
+
+    $apt_debian_url = 'http://localhost:9999/debian/'
+    $apt_use_next_release = true
+    include apt
+ 
+   you will need to remove the variables, and the include and instead do
+   the following:
+
+    class { 'apt': debian_url => 'http://localhost:9999/debian/', use_next_release => true }
+
+   previously, you could manually set $lsbdistcodename which would enable forced
+   upgrades, but because this is a top-level facter variable, and newer puppet
+   versions do not let you assign variables to other namespaces, this is no
+   longer possible. However, there is a way to obtain this functionality, and
+   that is to pass the 'codename' parameter to the apt class, which will change
+   the sources.list and preferences files to be the codename you set, allowing
+   you to trigger upgrades:
+
+   include apt::dist_upgrade
+   class { 'apt': codename => 'wheezy', notify => Exec['apt_dist-upgrade'] }
+
+ * the apticron class has been moved to a parameterized class.  if you were
+   including this class before, you will need to move to instantiating the
+   class instead. For example, if you had the following in your manifests:
+
+    $apticron_email = 'foo@example.com'
+    $apticron_notifynew = '1'
+    ... any $apticron_* variables
+    include apticron
+
+   you will need to remove the variables, and the include and instead do the
+   following:
+
+    class { 'apt::apticron': email => 'foo@example.com', notifynew => '1' }
+
+ * the apt::listchanges class has been moved to a paramterized class. if you
+   were including this class before, after passing some variables, you will need
+   to move to instantiating the class with those variables instead. For example,
+   if you had the following in your manifests:
+
+    $apt_listchanges_email = 'foo@example.com'
+    ... any $apt_listchanges_* variables
+    include apt::listchanges
+
+   you will need to remove the variables, and the include and instead do the
+   following:
+ 
+    class { 'apt::listchanges': email => 'foo@example.com' }
+   
+ * the apt::proxy_client class has been moved to a paramterized class. if you
+   were including this class before, after passing some variables, you will need
+   to move to instantiating the class with those variables instead. For example,
+   if you had the following in your manifests:
+
+    $apt_proxy = 'http://proxy.domain'
+    $apt_proxy_port = 666
+    include apt::proxy_client
+
+   you will need to remove the variables, and the include and instead do the
+   following:
+
+    class { 'apt::proxy_client': proxy => 'http://proxy.domain', port => '666' }
+
+Requirements
+============
+
+This module needs:
+
+- the lsb-release package should be installed on the server prior to running
+  puppet. otherwise, all of the $::lsb* facts will be empty during runs.
+- the common module: https://gitlab.com/shared-puppet-modules-group/common
+
+By default, on normal hosts, this module sets the configuration option
+DSelect::Clean to 'auto'. On virtual servers, the value is set by default to
+'pre-auto', because virtual servers are usually more space-bound and have better
+recovery mechanisms via the host:
+
+From apt.conf(5), 0.7.2:
+     "Cache Clean mode; this value may be one of always, prompt, auto,
+     pre-auto and never. always and prompt will remove all packages
+     from the cache after upgrading, prompt (the default) does so
+     conditionally.  auto removes only those packages which are no
+     longer downloadable (replaced with a new version for
+     instance). pre-auto performs this action before downloading new
+     packages."
+
+To change the default setting for DSelect::Clean, you can create a file named
+"03clean" or "03clean_vserver" in your site_apt module's files directory. You
+can also define this for a specific host by creating a file in a subdirectory of
+the site_apt modules' files directory that is named the same as the
+host. (example: site_apt/files/some.host.com/03clean, or
+site_apt/files/some.host.com/03clean_vserver)
+
+Classes
+=======
+
+apt
+---
+
+The apt class sets up most of the documented functionality. To use functionality
+that is not enabled by default, you must set one of the following parameters.
+
+Example usage:
+
+ class { 'apt': use_next_release => true, debian_url => 'http://localhost:9999/debian/' }
+
+Class parameters:
+
+* use_lts
+
+  If this variable is set to true the CODENAME-lts sources (such as
+  squeeze-lts) are added.
+
+  By default this is false for backward compatibility with older
+  versions of this module.
+
+* use_volatile
+
+  If this variable is set to true the CODENAME-updates sources (such as
+  squeeze-updates) are added.
+
+  By default this is false for backward compatibility with older
+  versions of this module.
+
+* include_src
+
+  If this variable is set to true a deb-src source is added for every
+  added binary archive source.
+
+  By default this is false for backward compatibility with older
+  versions of this module.
+
+* use_next_release
+
+  If this variable is set to true the sources for the next Debian
+  release are added. The default pinning configuration pins it to very
+  low values.
+
+  By default this is false for backward compatibility with older
+  versions of this module.
+
+* debian_url, security_url, backports_url, volatile_url
+
+  These variables allow to override the default APT mirrors respectively
+  used for the standard Debian archives, the Debian security archive,
+  the Debian official backports and the Debian Volatile archive.
+
+* ubuntu_url
+
+  These variables allows to override the default APT mirror used for all
+  standard Ubuntu archives (including updates, security, backports).
+
+* repos
+
+  If this variable is set the default repositories list ("main contrib non-free")
+  is overriden.
+
+* disable_update
+
+  Disable "apt-get update" which is normally triggered by apt::upgrade_package 
+  and apt::dist_upgrade. 
+
+  Note that nodes can be updated once a day by using 
+    APT::Periodic::Update-Package-Lists "1";
+  in i.e. /etc/apt/apt.conf.d/80_apt_update_daily.
+
+* custom_preferences
+
+  For historical reasons (Debian Lenny's version of APT did not support the use
+  of the preferences.d directory for putting fragments of 'preferences'), this
+  module will manage a default generic apt/preferences file with more
+  recent releases pinned to very low values so that any package
+  installation will not accidentally pull in packages from those suites
+  unless you explicitly specify the version number. This file will be
+  complemented with all of the preferences_snippet calls (see below).
+
+  If the default preferences template doesn't suit your needs, you can create a
+  template located in your site_apt module, and set custom_preferences with the
+  content (eg. custom_preferences => template('site_apt/preferences') )
+
+  Setting this variable to false before including this class will force the
+  apt/preferences file to be absent:
+
+    class { 'apt': custom_preferences => false }
+  
+* custom_sources_list
+
+  By default this module will use a basic apt/sources.list template with
+  a generic Debian mirror. If you need to set more specific sources,
+  e.g. changing the sections included in the source, etc. you can set
+  this variable to the content that you desire to use instead.
+
+  For example, setting this variable will pull in the
+  templates/site_apt/sources.list file:
+
+  class { 'apt': custom_sources_list => template('site_apt/sources.list') }
+
+* custom_key_dir
+
+  If you have different apt-key files that you want to get added to your
+  apt keyring, you can set this variable to a path in your fileserver
+  where individual key files can be placed. If this is set and keys
+  exist there, this module will 'apt-key add' each key.
+
+  The debian-archive-keyring package is installed and kept current up to the
+  latest revision (this includes the backports archive keyring).
+
+apt::apticron
+-------------
+
+When you instantiate this class, apticron will be installed, with the following
+defaults, which you are free to change:
+
+  $ensure_version = 'installed',
+  $config = "apt/${::operatingsystem}/apticron_${::lsbdistcodename}.erb",
+  $email = 'root',
+  $diff_only = '1',
+  $listchanges_profile = 'apticron',
+  $system = false,
+  $ipaddressnum = false,
+  $ipaddresses = false,
+  $notifyholds = '0',
+  $notifynew = '0',
+  $customsubject = ''
+
+Example usage:
+
+ class { 'apt::apticron': email => 'foo@example.com', notifynew => '1' }
+
+apt::cron::download
+-------------------
+
+This class sets up cron-apt so that it downloads upgradable packages, does not
+actually do any upgrade and emails when the output changes.
+
+cron-apt defaults to run at 4 AM. You may want to set the
+$apt_cron_hours variable before you include the class: its value will
+be passed as the "hours" parameter of a cronjob. Example:
+
+ # Run cron-apt every three hours
+ $apt_cron_hours = '*/3'
+
+Note that the default 4 AM cronjob won't be disabled.
+
+apt::cron::dist_upgrade
+-----------------------
+
+This class sets up cron-apt so that it dist-upgrades the system and
+emails when upgrades are performed.
+
+See apt::cron::download above if you need to run cron-apt more often
+than once a day.
+
+apt::dist_upgrade
+-----------------
+
+This class provides the Exec['apt_dist-upgrade'] resource that
+dist-upgrade's the system.
+
+This exec is set as refreshonly so including this class does not
+trigger any action per-se: other resources may notify it, other
+classes may inherit from this one and add to its subscription list
+using the plusignment ('+>') operator. A real-world example can be
+seen in the apt::dist_upgrade::initiator source.
+
+apt::dist_upgrade::initiator
+----------------------------
+
+This class automatically dist-upgrade's the system when an initiator
+file's content changes. The initiator file is copied from the first
+available source amongst the following ones, in decreasing priority
+order:
+
+- puppet:///modules/site_apt/${::fqdn}/upgrade_initiator
+- puppet:///modules/site_apt/upgrade_initiator
+- puppet:///modules/apt/upgrade_initiator
+
+This is useful when one does not want to setup a fully automated
+upgrade process but still needs a way to manually trigger full
+upgrades of any number of systems at scheduled times.
+
+Beware: a dist-upgrade is triggered the first time Puppet runs after
+this class has been included. This is actually the single reason why
+this class is not enabled by default.
+
+When this class is included the APT indexes are updated on every
+Puppet run due to the author's lack of Puppet wizardry.
+
+apt::dselect
+------------
+
+This class, when included, installs dselect and switches it to expert mode to
+suppress superfluous help screens.
+
+apt::listchanges
+----------------
+
+This class, when instantiated, installs apt-listchanges and configures it using
+the following parameterized variables, which can be changed:
+
+ version = 'present'
+ config = "apt/${::operatingsystem}/listchanges_${::lsbrelease}.erb"
+ frontend = 'pager'
+ email = 'root'
+ confirm = 0
+ saveseen = '/var/lib/apt/listchanges.db'
+ which = 'both'
+
+ Example usage:
+  class { 'apt::listchanges': email => 'foo@example.com' }
+ 
+apt::proxy_client
+-----------------
+
+This class adds the right configuration to apt to make it fetch packages via a
+proxy. The class parameters apt_proxy and apt_proxy_port need to be set:
+
+You can set the 'proxy' class parameter variable to the URL of the proxy that
+will be used.  By default, the proxy will be queried on port 3142, but you can
+change the port number by setting the 'port' class parameter.
+
+Example:
+
+ class { 'apt::proxy_client': proxy => 'http://proxy.domain', port => '666' }
+
+apt::reboot_required_notify
+---------------------------
+
+This class installs a daily cronjob that checks if a package upgrade
+requires the system to be rebooted; if so, cron sends a notification
+email to root.
+
+apt::unattended_upgrades
+------------------------
+
+If this class is included, it will install the package 'unattended-upgrades'
+and configure it to daily upgrade the system.
+
+The class has the following parameters that you can use to change the contents
+of the configuration file. The values shown here are the default values:
+
+ * $config_content = undef
+ * $config_template = 'apt/50unattended-upgrades.erb'
+ * $mailonlyonerror = true
+ * $mail_recipient = 'root'
+ * $blacklisted_packages = []
+
+Note that using $config_content actually specifies all of the configuration
+contents and thus makes the other parameters useless.
+
+example:
+
+    class { 'apt::unattended_upgrades':
+      config_template      => 'site_apt/50unattended-upgrades.jessie',
+      blacklisted_packages => [
+       'libc6', 'libc6-dev', 'libc6-i686', 'mysql-server', 'redmine', 'nodejs',
+       'bird'
+      ],
+    }
+
+Defines
+=======
+
+apt::apt_conf
+-------------
+
+Creates a file in the apt/apt.conf.d directory to easily add configuration
+components. One can use either the 'source' meta-parameter to specify a list of
+static files to include from the puppet fileserver or the 'content'
+meta-parameter to define content inline or with the help of a template.
+
+Example:
+
+  apt::apt_conf { '80download-only':
+    source => 'puppet:///modules/site_apt/80download-only',
+  }
+
+apt::preferences_snippet
+------------------------
+
+A way to add pinning information to files in /etc/apt/preferences.d/
+
+Example:
+
+  apt::preferences_snippet {
+    'irssi-plugin-otr':
+      release => 'squeeze-backports',
+      priority => 999;
+  }
+
+  apt::preferences_snippet {
+    'unstable_fallback':
+      package => '*',
+      release => 'unstable',
+      priority => 1;
+  }
+
+  apt::preferences_snippet {
+    'ttdnsd':
+      pin => 'origin deb.torproject.org',
+      priority => 999;
+  }
+
+The names of the resources will be used as the names of the files in the
+preferences.d directory, so you should ensure that resource names follow the
+prescribed naming scheme.
+
+From apt_preferences(5):
+     Note that the files in the /etc/apt/preferences.d directory are parsed in
+     alphanumeric ascending order and need to obey the following naming
+     convention: The files have no or "pref" as filename extension and which
+     only contain alphanumeric, hyphen (-), underscore (_) and period (.)
+     characters - otherwise they will be silently ignored.
+
+apt::preseeded_package
+----------------------
+
+This simplifies installation of packages for which you wish to preseed the
+answers to debconf. For example, if you wish to provide a preseed file for the
+locales package, you would place the locales.seed file in
+'site_apt/templates/${::lsbdistcodename}/locales.seeds' and then include the
+following in your manifest:
+
+  apt::preseeded_package { locales: }
+
+You can also specify the content of the seed via the content parameter, 
+for example:
+
+  apt::preseeded_package { 'apticron':
+    content => 'apticron   apticron/notification   string  root@example.com',
+  }
+
+apt::sources_list
+-----------------
+
+Creates a file in the apt/sources.list.d directory to easily add additional apt
+sources. One can use either the 'source' meta-parameter to specify a list of
+static files to include from the puppet fileserver or the 'content'
+meta-parameter to define content inline or with the help of a template. Ending
+the resource name in '.list' is optional: it will be automatically added to the
+file name if not present in the resource name.
+
+Example:
+
+  apt::sources_list { 'company_internals':
+    source => [ "puppet:///modules/site_apt/${::fqdn}/company_internals.list",
+                'puppet:///modules/site_apt/company_internals.list' ],
+  }
+
+apt::key
+--------
+
+Deploys a secure apt OpenPGP key. This usually accompanies the
+sources.list snippets above for third party repositories. For example,
+you would do:
+
+  apt::key { 'neurodebian.gpg':
+    ensure => present,
+    source => 'puppet:///modules/site_apt/neurodebian.gpg',
+  }
+
+This deploys the key in the `/etc/apt/trusted.gpg.d` directory, which
+is assumed by secure apt to be binary OpenPGP keys and *not*
+"ascii-armored" or "plain text" OpenPGP key material. For the latter,
+use `apt::key::plain`.
+
+The `.gpg` extension is compulsory for `apt` to pickup the key properly.
+
+apt::key::plain
+---------------
+
+Deploys a secure apt OpenPGP key. This usually accompanies the
+sources.list snippets above for third party repositories. For example,
+you would do:
+
+  apt::key::plain { 'neurodebian.asc':
+    source => 'puppet:///modules/site_apt/neurodebian.asc',
+  }
+
+This deploys the key in the `${apt_base_dir}/keys` directory (as
+opposed to `$custom_key_dir` which deploys it in `keys.d`). The reason
+this exists on top of `$custom_key_dir` is to allow a more
+decentralised distribution of those keys, without having all modules
+throw their keys in the same directory in the manifests.
+
+Note that this model does *not* currently allow keys to be removed!
+Use `apt::key` instead for a more practical, revokable approach, but
+that needs binary keys.
+
+apt::upgrade_package
+--------------------
+
+This simplifies upgrades for DSA security announcements or point-releases. This
+will ensure that the named package is upgraded to the version specified, only if
+the package is installed, otherwise nothing happens. If the specified version
+is 'latest' (the default), then the package is ensured to be upgraded to the
+latest package revision when it becomes available.
+
+For example, the following upgrades the perl package to version 5.8.8-7etch1
+(if it is installed), it also upgrades the syslog-ng and perl-modules packages
+to their latest (also, only if they are installed):
+
+upgrade_package { 'perl':
+			version => '5.8.8-7etch1';
+		  'syslog-ng':
+			version => latest;
+		  'perl-modules':
+}
+
+Resources
+=========
+
+File['apt_config']
+------------------
+
+Use this resource to depend on or add to a completed apt configuration
+
+Exec['apt_updated']
+-------------------
+
+After this point the APT indexes are up-to-date.
+This resource is set to `refreshonly => true` so it is not run on
+every puppetrun. To run this every time, you can include the `apt::update`
+class.
+
+This resource is usually used like this to ensure current packages are
+installed by Package resources:
+
+    include apt::update
+    Package { require => Exec['apt_updated'] }
+
+Note that nodes can be updated once a day by using
+
+    APT::Periodic::Update-Package-Lists "1";
+
+in i.e. /etc/apt/apt.conf.d/80_apt_update_daily.
+
+
+Tests
+=====
+
+To run pupept rspec tests:
+
+    bundle install --path vendor/bundle
+    bundle exec rake spec
+
+Using different facter/puppet versions:
+
+    FACTER_GEM_VERSION=1.6.10 PUPPET_GEM_VERSION=2.7.23 bundle install --path vendor/bundle
+    bundle exec rake spec
+
+Licensing
+=========
+
+This puppet module is licensed under the GPL version 3 or later. Redistribution
+and modification is encouraged.
+
+The GPL version 3 license text can be found in the "LICENSE" file accompanying
+this puppet module, or at the following URL:
+
+http://www.gnu.org/licenses/gpl-3.0.html
diff --git a/puppet/modules/apt/Rakefile b/puppet/modules/apt/Rakefile
new file mode 100644
index 00000000..85326bb4
--- /dev/null
+++ b/puppet/modules/apt/Rakefile
@@ -0,0 +1,19 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
+
+desc "Validate manifests, templates, and ruby files"
+task :validate do
+  Dir['manifests/**/*.pp'].each do |manifest|
+    sh "puppet parser validate --noop #{manifest}"
+  end
+  Dir['spec/**/*.rb','lib/**/*.rb'].each do |ruby_file|
+    sh "ruby -c #{ruby_file}" unless ruby_file =~ /spec\/fixtures/
+  end
+  Dir['templates/**/*.erb'].each do |template|
+    sh "erb -P -x -T '-' #{template} | ruby -c"
+  end
+end
+
+task :test => [:lint, :syntax , :validate, :spec]
diff --git a/puppet/modules/apt/files/02show_upgraded b/puppet/modules/apt/files/02show_upgraded
new file mode 100644
index 00000000..bb127d41
--- /dev/null
+++ b/puppet/modules/apt/files/02show_upgraded
@@ -0,0 +1,4 @@
+// This file is managed by Puppet
+// all local modifications will be overwritten
+
+APT::Get::Show-Upgraded true;
diff --git a/puppet/modules/apt/files/03clean b/puppet/modules/apt/files/03clean
new file mode 100644
index 00000000..3d20924a
--- /dev/null
+++ b/puppet/modules/apt/files/03clean
@@ -0,0 +1,4 @@
+// This file is managed by Puppet
+// all local modifications will be overwritten
+
+DSelect::Clean auto;
diff --git a/puppet/modules/apt/files/03clean_vserver b/puppet/modules/apt/files/03clean_vserver
new file mode 100644
index 00000000..6bb84e58
--- /dev/null
+++ b/puppet/modules/apt/files/03clean_vserver
@@ -0,0 +1,4 @@
+// This file is managed by Puppet
+// all local modifications will be overwritten
+
+DSelect::Clean pre-auto;
diff --git a/puppet/modules/apt/files/upgrade_initiator b/puppet/modules/apt/files/upgrade_initiator
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/puppet/modules/apt/files/upgrade_initiator
@@ -0,0 +1 @@
+
diff --git a/puppet/modules/apt/lib/facter/apt_running.rb b/puppet/modules/apt/lib/facter/apt_running.rb
new file mode 100644
index 00000000..e8f2156e
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/apt_running.rb
@@ -0,0 +1,7 @@
+Facter.add("apt_running") do
+  setcode do
+    #Facter::Util::Resolution.exec('/usr/bin/dpkg -s mysql-server >/dev/null 2>&1 && echo true || echo false')
+    Facter::Util::Resolution.exec('pgrep apt-get >/dev/null 2>&1 && echo true || echo false')
+  end
+end
+
diff --git a/puppet/modules/apt/lib/facter/debian_codename.rb b/puppet/modules/apt/lib/facter/debian_codename.rb
new file mode 100644
index 00000000..254877aa
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/debian_codename.rb
@@ -0,0 +1,42 @@
+begin
+  require 'facter/util/debian'
+rescue LoadError
+  require "#{File.dirname(__FILE__)}/util/debian"
+end
+
+def version_to_codename(version)
+  if Facter::Util::Debian::CODENAMES.has_key?(version)
+    return Facter::Util::Debian::CODENAMES[version]
+  else
+    Facter.warn("Could not determine codename from version '#{version}'")
+  end
+end
+
+Facter.add(:debian_codename) do
+  has_weight 99
+  confine :operatingsystem => 'Debian'
+  setcode do
+    Facter.value('lsbdistcodename')
+  end
+end
+
+Facter.add(:debian_codename) do
+  has_weight 66
+  confine :operatingsystem => 'Debian'
+  setcode do
+    version_to_codename(Facter.value('operatingsystemmajrelease'))
+  end
+end
+
+Facter.add(:debian_codename) do
+  has_weight 33
+  confine :operatingsystem => 'Debian'
+  setcode do
+    debian_version = File.open('/etc/debian_version', &:readline)
+    if debian_version.match(/^\d+/)
+      version_to_codename(debian_version.scan(/^(\d+)/)[0][0])
+    elsif debian_version.match(/^[a-z]+\/(sid|unstable)/)
+      debian_version.scan(/^([a-z]+)\//)[0][0]
+    end
+  end
+end
diff --git a/puppet/modules/apt/lib/facter/debian_lts.rb b/puppet/modules/apt/lib/facter/debian_lts.rb
new file mode 100644
index 00000000..f53a9eb8
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/debian_lts.rb
@@ -0,0 +1,16 @@
+begin
+  require 'facter/util/debian'
+rescue LoadError
+  require "#{File.dirname(__FILE__)}/util/debian"
+end
+
+Facter.add(:debian_lts) do
+  confine :operatingsystem => 'Debian'
+  setcode do
+    if Facter::Util::Debian::LTS.include? Facter.value('debian_codename')
+      true
+    else
+      false
+    end
+  end
+end
diff --git a/puppet/modules/apt/lib/facter/debian_nextcodename.rb b/puppet/modules/apt/lib/facter/debian_nextcodename.rb
new file mode 100644
index 00000000..c4c569b2
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/debian_nextcodename.rb
@@ -0,0 +1,23 @@
+begin
+  require 'facter/util/debian'
+rescue LoadError
+  require "#{File.dirname(__FILE__)}/util/debian"
+end
+
+def debian_codename_to_next(codename)
+  if codename == "sid"
+    return "experimental"
+  else
+    codenames = Facter::Util::Debian::CODENAMES
+    versions  = Facter::Util::Debian::CODENAMES.invert
+    current_version = versions[codename]
+    return codenames[(current_version.to_i + 1).to_s]
+  end
+end
+
+Facter.add(:debian_nextcodename) do
+  confine :operatingsystem => 'Debian'
+  setcode do
+    debian_codename_to_next(Facter.value('debian_codename'))
+  end
+end
diff --git a/puppet/modules/apt/lib/facter/debian_nextrelease.rb b/puppet/modules/apt/lib/facter/debian_nextrelease.rb
new file mode 100644
index 00000000..2a9c4f5f
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/debian_nextrelease.rb
@@ -0,0 +1,23 @@
+def debian_release_to_next(release)
+  releases = [
+    'oldoldoldstable',
+    'oldoldstable',
+    'oldstable',
+    'stable',
+    'testing',
+    'unstable',
+    'experimental',
+  ]
+  if releases.include? release
+    if releases.index(release)+1 < releases.count
+      return releases[releases.index(release)+1]
+    end
+  end
+end
+
+Facter.add(:debian_nextrelease) do
+  confine :operatingsystem => 'Debian'
+  setcode do
+    debian_release_to_next(Facter.value('debian_release'))
+  end
+end
diff --git a/puppet/modules/apt/lib/facter/debian_release.rb b/puppet/modules/apt/lib/facter/debian_release.rb
new file mode 100644
index 00000000..2c334ccd
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/debian_release.rb
@@ -0,0 +1,38 @@
+begin
+  require 'facter/util/debian'
+rescue LoadError
+  require "#{File.dirname(__FILE__)}/util/debian"
+end
+
+def debian_codename_to_release(codename)
+  stable = Facter::Util::Debian::STABLE
+  versions = Facter::Util::Debian::CODENAMES.invert
+  release = nil
+  if codename == "sid"
+    release = "unstable"
+  elsif versions.has_key? codename
+    version = versions[codename].to_i
+    if version == stable
+      release = "stable"
+    elsif version < stable
+      release = "stable"
+      for i in version..stable - 1
+        release = "old" + release
+      end
+    elsif version == stable + 1
+      release = "testing"
+    end
+  end
+  if release.nil?
+    Facter.warn("Could not determine release from codename #{codename}!")
+  end
+  return release
+end
+
+Facter.add(:debian_release) do
+  has_weight 99
+  confine :operatingsystem => 'Debian'
+  setcode do
+    debian_codename_to_release(Facter.value('debian_codename'))
+  end
+end
diff --git a/puppet/modules/apt/lib/facter/ubuntu_codename.rb b/puppet/modules/apt/lib/facter/ubuntu_codename.rb
new file mode 100644
index 00000000..814fd942
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/ubuntu_codename.rb
@@ -0,0 +1,8 @@
+Facter.add(:ubuntu_codename) do
+  confine :operatingsystem => 'Ubuntu'
+  setcode do
+    Facter.value('lsbdistcodename')
+  end
+end
+
+
diff --git a/puppet/modules/apt/lib/facter/ubuntu_nextcodename.rb b/puppet/modules/apt/lib/facter/ubuntu_nextcodename.rb
new file mode 100644
index 00000000..dcd1d426
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/ubuntu_nextcodename.rb
@@ -0,0 +1,20 @@
+begin
+  require 'facter/util/ubuntu'
+rescue LoadError
+  require "#{File.dirname(__FILE__)}/util/ubuntu"
+end
+
+def ubuntu_codename_to_next(codename)
+  codenames = Facter::Util::Ubuntu::CODENAMES
+  i = codenames.index(codename)
+  if i and i+1 < codenames.count
+    return codenames[i+1]
+  end
+end
+
+Facter.add(:ubuntu_nextcodename) do
+  confine :operatingsystem => 'Ubuntu'
+  setcode do
+    ubuntu_codename_to_next(Facter.value('ubuntu_codename'))
+  end
+end
diff --git a/puppet/modules/apt/lib/facter/util/debian.rb b/puppet/modules/apt/lib/facter/util/debian.rb
new file mode 100644
index 00000000..290c17b5
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/util/debian.rb
@@ -0,0 +1,18 @@
+module Facter
+  module Util
+    module Debian
+      STABLE = 8
+      CODENAMES = {
+        "5" => "lenny",
+        "6" => "squeeze",
+        "7" => "wheezy",
+        "8" => "jessie",
+        "9" => "stretch",
+        "10" => "buster",
+      }
+      LTS = [
+        "squeeze",
+      ]
+    end
+  end
+end
diff --git a/puppet/modules/apt/lib/facter/util/ubuntu.rb b/puppet/modules/apt/lib/facter/util/ubuntu.rb
new file mode 100644
index 00000000..52c15e80
--- /dev/null
+++ b/puppet/modules/apt/lib/facter/util/ubuntu.rb
@@ -0,0 +1,21 @@
+module Facter
+  module Util
+    module Ubuntu
+      CODENAMES = [
+        "lucid",
+        "maverick",
+        "natty",
+        "oneiric",
+        "precise",
+        "quantal",
+        "raring",
+        "saucy",
+        "trusty",
+        "utopic",
+        "vivid",
+        "wily",
+        "xenial"
+      ]
+    end
+  end
+end
diff --git a/puppet/modules/apt/manifests/apt_conf.pp b/puppet/modules/apt/manifests/apt_conf.pp
new file mode 100644
index 00000000..949f6157
--- /dev/null
+++ b/puppet/modules/apt/manifests/apt_conf.pp
@@ -0,0 +1,45 @@
+define apt::apt_conf(
+  $ensure = 'present',
+  $source = '',
+  $content = undef,
+  $refresh_apt = true )
+{
+
+  if $source == '' and $content == undef {
+    fail("One of \$source or \$content must be specified for apt_conf ${name}")
+  }
+
+  if $source != '' and $content != undef {
+    fail("Only one of \$source or \$content must specified for apt_conf ${name}")
+  }
+
+  include apt::dot_d_directories
+
+  # One would expect the 'file' resource on sources.list.d to trigger an
+  # apt-get update when files are added or modified in the directory, but it
+  # apparently doesn't.
+  file { "/etc/apt/apt.conf.d/${name}":
+    ensure => $ensure,
+    owner  => root,
+    group  => 0,
+    mode   => '0644',
+  }
+
+  if $source {
+    File["/etc/apt/apt.conf.d/${name}"] {
+      source => $source,
+    }
+  }
+  else {
+    File["/etc/apt/apt.conf.d/${name}"] {
+      content => $content,
+    }
+  }
+
+  if $refresh_apt {
+    File["/etc/apt/apt.conf.d/${name}"] {
+      notify => Exec['apt_updated'],
+    }
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/apticron.pp b/puppet/modules/apt/manifests/apticron.pp
new file mode 100644
index 00000000..9c94f9c9
--- /dev/null
+++ b/puppet/modules/apt/manifests/apticron.pp
@@ -0,0 +1,24 @@
+class apt::apticron(
+  $ensure_version = 'installed',
+  $config = "apt/${::operatingsystem}/apticron_${::debian_codename}.erb",
+  $email = 'root',
+  $diff_only = '1',
+  $listchanges_profile = 'apticron',
+  $system = false,
+  $ipaddressnum = false,
+  $ipaddresses = false,
+  $notifyholds = '0',
+  $notifynew = '0',
+  $customsubject = ''
+) {
+
+  package { 'apticron': ensure => $ensure_version }
+
+  file { '/etc/apticron/apticron.conf':
+    content => template($apt::apticron::config),
+    owner   => root,
+    group   => root,
+    mode    => '0644',
+    require => Package['apticron'];
+  }
+}
diff --git a/puppet/modules/apt/manifests/cron/base.pp b/puppet/modules/apt/manifests/cron/base.pp
new file mode 100644
index 00000000..39fc3061
--- /dev/null
+++ b/puppet/modules/apt/manifests/cron/base.pp
@@ -0,0 +1,20 @@
+class apt::cron::base {
+
+  package { 'cron-apt': ensure => installed }
+
+  case $apt_cron_hours {
+    '': {}
+    default: {
+      # cron-apt defaults to run every night at 4 o'clock
+      # so we try not to run at the same time.
+      cron { 'apt_cron_every_N_hours':
+        command => 'test -x /usr/sbin/cron-apt && /usr/sbin/cron-apt',
+        user    => root,
+        hour    => "${apt_cron_hours}",
+        minute  => 10,
+        require => Package['cron-apt'],
+      }
+    }
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/cron/dist_upgrade.pp b/puppet/modules/apt/manifests/cron/dist_upgrade.pp
new file mode 100644
index 00000000..74403bb7
--- /dev/null
+++ b/puppet/modules/apt/manifests/cron/dist_upgrade.pp
@@ -0,0 +1,29 @@
+class apt::cron::dist_upgrade inherits apt::cron::base {
+
+  $action = "autoclean -y
+dist-upgrade -y -o APT::Get::Show-Upgraded=true -o 'DPkg::Options::=--force-confold'
+"
+
+  file { '/etc/cron-apt/action.d/3-download':
+    ensure => absent,
+  }
+
+  package { 'apt-listbugs': ensure => absent }
+
+  file { '/etc/cron-apt/action.d/4-dist-upgrade':
+    content => $action,
+    owner   => root,
+    group   => 0,
+    mode    => '0644',
+    require => Package[cron-apt];
+  }
+
+  file { '/etc/cron-apt/config.d/MAILON':
+    content => "MAILON=upgrade\n",
+    owner   => root,
+    group   => 0,
+    mode    => '0644',
+    require => Package[cron-apt];
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/cron/download.pp b/puppet/modules/apt/manifests/cron/download.pp
new file mode 100644
index 00000000..4a19fec1
--- /dev/null
+++ b/puppet/modules/apt/manifests/cron/download.pp
@@ -0,0 +1,27 @@
+class apt::cron::download inherits apt::cron::base {
+
+  $action = "autoclean -y
+dist-upgrade -d -y -o APT::Get::Show-Upgraded=true
+"
+
+  file { '/etc/cron-apt/action.d/4-dist-upgrade':
+    ensure => absent,
+  }
+
+  file { '/etc/cron-apt/action.d/3-download':
+    content => $action,
+    require => Package[cron-apt],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+
+  file { '/etc/cron-apt/config.d/MAILON':
+    content => "MAILON=changes\n",
+    require => Package[cron-apt],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/dist_upgrade.pp b/puppet/modules/apt/manifests/dist_upgrade.pp
new file mode 100644
index 00000000..19c031e0
--- /dev/null
+++ b/puppet/modules/apt/manifests/dist_upgrade.pp
@@ -0,0 +1,9 @@
+class apt::dist_upgrade {
+
+  exec { 'apt_dist-upgrade':
+    command     => '/usr/bin/apt-get -q -y -o \'DPkg::Options::=--force-confold\' dist-upgrade',
+    refreshonly => true,
+    before      => Exec['apt_updated']
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/dist_upgrade/initiator.pp b/puppet/modules/apt/manifests/dist_upgrade/initiator.pp
new file mode 100644
index 00000000..d2389883
--- /dev/null
+++ b/puppet/modules/apt/manifests/dist_upgrade/initiator.pp
@@ -0,0 +1,23 @@
+class apt::dist_upgrade::initiator inherits apt::dist_upgrade {
+
+  $initiator = 'upgrade_initiator'
+  $initiator_abs = "${apt::apt_base_dir}/${initiator}"
+
+  file { 'apt_upgrade_initiator':
+    mode     => '0644',
+    owner    => root,
+    group    => 0,
+    path     => $initiator_abs,
+    checksum => md5,
+    source   => [
+                  "puppet:///modules/site_apt/${::fqdn}/${initiator}",
+                  "puppet:///modules/site_apt/${initiator}",
+                  "puppet:///modules/apt/${initiator}",
+                ],
+  }
+
+  Exec['apt_dist-upgrade'] {
+    subscribe +> File['apt_upgrade_initiator'],
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/dot_d_directories.pp b/puppet/modules/apt/manifests/dot_d_directories.pp
new file mode 100644
index 00000000..0ace8630
--- /dev/null
+++ b/puppet/modules/apt/manifests/dot_d_directories.pp
@@ -0,0 +1,15 @@
+class apt::dot_d_directories {
+
+  # watch .d directories and ensure they are present
+  file {
+    '/etc/apt/apt.conf.d':
+      ensure   => directory,
+      checksum => mtime,
+      notify   => Exec['apt_updated'];
+    '/etc/apt/sources.list.d':
+      ensure   => directory,
+      checksum => mtime,
+      notify   => Exec['apt_updated'];
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/dselect.pp b/puppet/modules/apt/manifests/dselect.pp
new file mode 100644
index 00000000..2b99a43d
--- /dev/null
+++ b/puppet/modules/apt/manifests/dselect.pp
@@ -0,0 +1,11 @@
+# manage dselect, like
+# suppressing the annoying help texts
+class apt::dselect {
+
+  file_line { 'dselect_expert':
+    path => '/etc/dpkg/dselect.cfg',
+    line => 'expert',
+  }
+
+  package { 'dselect': ensure => installed }
+}
diff --git a/puppet/modules/apt/manifests/init.pp b/puppet/modules/apt/manifests/init.pp
new file mode 100644
index 00000000..4c44af2a
--- /dev/null
+++ b/puppet/modules/apt/manifests/init.pp
@@ -0,0 +1,150 @@
+# apt.pp - common components and defaults for handling apt
+# Copyright (C) 2008 Micah Anerson <micah@riseup.net>
+# Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+# See LICENSE for the full license granted to you.
+
+class apt(
+  $use_lts = $apt::params::use_lts,
+  $use_volatile = $apt::params::use_volatile,
+  $use_backports = $apt::params::use_backports,
+  $include_src = $apt::params::include_src,
+  $use_next_release = $apt::params::use_next_release,
+  $debian_url = $apt::params::debian_url,
+  $security_url = $apt::params::security_url,
+  $backports_url = $apt::params::backports_url,
+  $lts_url = $apt::params::lts_url,
+  $volatile_url = $apt::params::volatile_url,
+  $ubuntu_url = $apt::params::ubuntu_url,
+  $repos = $apt::params::repos,
+  $custom_preferences = $apt::params::custom_preferences,
+  $custom_sources_list = '',
+  $custom_key_dir = $apt::params::custom_key_dir
+) inherits apt::params {
+  case $::operatingsystem {
+    'debian': {
+      $real_repos = $repos ? {
+        'auto'  => 'main contrib non-free',
+        default => $repos,
+      }
+    }
+    'ubuntu': {
+      $real_repos = $repos ? {
+        'auto'  => 'main restricted universe multiverse',
+        default => $repos,
+      }
+    }
+  }
+
+  package { 'apt':
+    ensure  => installed,
+    require => undef,
+  }
+
+  $sources_content = $custom_sources_list ? {
+    ''      => template( "apt/${::operatingsystem}/sources.list.erb"),
+    default => $custom_sources_list
+  }
+  file {
+    # include main and security
+    # additional sources should be included via the apt::sources_list define
+    '/etc/apt/sources.list':
+      content => $sources_content,
+      notify  => Exec['apt_updated'],
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+  }
+
+  apt_conf { '02show_upgraded':
+    source => [ "puppet:///modules/site_apt/${::fqdn}/02show_upgraded",
+                'puppet:///modules/site_apt/02show_upgraded',
+                'puppet:///modules/apt/02show_upgraded' ]
+  }
+
+  if ( $::virtual == 'vserver' ) {
+    apt_conf { '03clean_vserver':
+      source => [ "puppet:///modules/site_apt/${::fqdn}/03clean_vserver",
+                  'puppet:///modules/site_apt/03clean_vserver',
+                  'puppet:///modules/apt/03clean_vserver' ],
+      alias => '03clean';
+    }
+  }
+  else {
+    apt_conf { '03clean':
+      source => [ "puppet:///modules/site_apt/${::fqdn}/03clean",
+                  'puppet:///modules/site_apt/03clean',
+                  'puppet:///modules/apt/03clean' ]
+    }
+  }
+
+  case $custom_preferences {
+    false: {
+      include apt::preferences::absent
+    }
+    default: {
+      # When squeeze becomes the stable branch, transform this file's header
+      # into a preferences.d file
+      include apt::preferences
+    }
+  }
+
+  include apt::dot_d_directories
+
+  ## This package should really always be current
+  package { 'debian-archive-keyring': ensure => latest }
+
+  # backports uses the normal archive key now
+  package { 'debian-backports-keyring': ensure => absent }
+
+  if ($use_backports and !($::debian_release in ['testing', 'unstable', 'experimental'])) {
+    apt::sources_list {
+      'backports':
+        content => "deb $backports_url ${::debian_codename}-backports ${apt::real_repos}",
+    }
+    if $include_src {
+      apt::sources_list {
+        'backports-src':
+          content => "deb-src $backports_url ${::debian_codename}-backports ${apt::real_repos}",
+      }
+    }
+  }
+
+  include common::moduledir
+  common::module_dir { 'apt': }
+  $apt_base_dir = "${common::moduledir::module_dir_path}/apt"
+
+  if $custom_key_dir {
+    file { "${apt_base_dir}/keys.d":
+      source  => $custom_key_dir,
+      recurse => true,
+      owner   => root,
+      group   => root,
+      mode    => '0755',
+    }
+    exec { 'custom_keys':
+      command     => "find ${apt_base_dir}/keys.d -type f -exec apt-key add '{}' \\;",
+      subscribe   => File["${apt_base_dir}/keys.d"],
+      refreshonly => true,
+      notify      => Exec[refresh_apt]
+    }
+    if $custom_preferences != false {
+      Exec['custom_keys'] {
+        before => File['apt_config']
+      }
+    }
+  }
+
+  # workaround for preseeded_package component
+  file { [ '/var/cache', '/var/cache/local', '/var/cache/local/preseeding' ]: ensure => directory }
+
+  exec { 'update_apt':
+    command     => '/usr/bin/apt-get update',
+    require     => [
+      File['/etc/apt/apt.conf.d', '/etc/apt/preferences' ],
+      File['/etc/apt/sources.list'] ],
+    refreshonly => true,
+    # Another Semaphor for all packages to reference
+    alias       => [ 'apt_updated', 'refresh_apt']
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/key.pp b/puppet/modules/apt/manifests/key.pp
new file mode 100644
index 00000000..cb70ec6a
--- /dev/null
+++ b/puppet/modules/apt/manifests/key.pp
@@ -0,0 +1,13 @@
+define apt::key ($source, $ensure = 'present') {
+  validate_re(
+    $name, '\.gpg$',
+    'An apt::key resource name must have the .gpg extension',
+  )
+
+  file {
+    "/etc/apt/trusted.gpg.d/${name}":
+      ensure => $ensure,
+      source => $source,
+      notify => Exec['apt_updated'],
+  }
+}
diff --git a/puppet/modules/apt/manifests/key/plain.pp b/puppet/modules/apt/manifests/key/plain.pp
new file mode 100644
index 00000000..dff8b51b
--- /dev/null
+++ b/puppet/modules/apt/manifests/key/plain.pp
@@ -0,0 +1,13 @@
+define apt::key::plain ($source) {
+  file {
+    "${apt::apt_base_dir}/keys/${name}":
+      source  => $source;
+    "${apt::apt_base_dir}/keys":
+      ensure  => directory;
+  }
+  exec { "apt-key add '${apt::apt_base_dir}/keys/${name}'":
+    subscribe   => File["${apt::apt_base_dir}/keys/${name}"],
+    refreshonly => true,
+    notify      => Exec['apt_updated'],
+  }
+}
diff --git a/puppet/modules/apt/manifests/listchanges.pp b/puppet/modules/apt/manifests/listchanges.pp
new file mode 100644
index 00000000..e64bb1b7
--- /dev/null
+++ b/puppet/modules/apt/manifests/listchanges.pp
@@ -0,0 +1,19 @@
+class apt::listchanges(
+  $ensure_version = 'installed',
+  $config = "apt/${::operatingsystem}/listchanges_${::debian_codename}.erb",
+  $frontend = 'mail',
+  $email = 'root',
+  $confirm = '0',
+  $saveseen = '/var/lib/apt/listchanges.db',
+  $which = 'both'
+){
+  package { 'apt-listchanges': ensure => $ensure_version }
+
+  file { '/etc/apt/listchanges.conf':
+    content => template($apt::listchanges::config),
+    owner   => root,
+    group   => root,
+    mode    => '0644',
+    require => Package['apt-listchanges'];
+  }
+}
diff --git a/puppet/modules/apt/manifests/params.pp b/puppet/modules/apt/manifests/params.pp
new file mode 100644
index 00000000..28af06eb
--- /dev/null
+++ b/puppet/modules/apt/manifests/params.pp
@@ -0,0 +1,22 @@
+class apt::params () {
+  $use_lts = false
+  $use_volatile = false
+  $use_backports = true
+  $include_src = false
+  $use_next_release = false
+  $debian_url = 'http://httpredir.debian.org/debian/'
+  $security_url = 'http://security.debian.org/'
+  $ubuntu_url = 'http://archive.ubuntu.com/ubuntu'
+  $backports_url = $::debian_codename ? {
+    'squeeze'  => 'http://backports.debian.org/debian-backports/',
+    default => $::operatingsystem ? {
+      'Ubuntu' => $ubuntu_url,
+      default  => $debian_url,
+    }
+  }
+  $lts_url = $debian_url
+  $volatile_url = 'http://volatile.debian.org/debian-volatile/'
+  $repos = 'auto'
+  $custom_preferences = ''
+  $custom_key_dir = false
+}
diff --git a/puppet/modules/apt/manifests/preferences.pp b/puppet/modules/apt/manifests/preferences.pp
new file mode 100644
index 00000000..6982ca05
--- /dev/null
+++ b/puppet/modules/apt/manifests/preferences.pp
@@ -0,0 +1,20 @@
+class apt::preferences {
+
+  $pref_contents = $apt::custom_preferences ? {
+    ''      => $::operatingsystem ? {
+      'debian' => template("apt/${::operatingsystem}/preferences_${::debian_codename}.erb"),
+      'ubuntu' => template("apt/${::operatingsystem}/preferences_${::ubuntu_codename}.erb"),
+    },
+    default => $apt::custom_preferences
+  }
+
+  file { '/etc/apt/preferences':
+    ensure  => present,
+    alias   => 'apt_config',
+    # only update together
+    content => $pref_contents,
+    require => File['/etc/apt/sources.list'],
+    owner   => root, group => 0, mode => '0644';
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/preferences/absent.pp b/puppet/modules/apt/manifests/preferences/absent.pp
new file mode 100644
index 00000000..f32e0307
--- /dev/null
+++ b/puppet/modules/apt/manifests/preferences/absent.pp
@@ -0,0 +1,7 @@
+class apt::preferences::absent {
+
+  file { '/etc/apt/preferences':
+    ensure => absent,
+    alias  => 'apt_config',
+  }
+}
diff --git a/puppet/modules/apt/manifests/preferences_snippet.pp b/puppet/modules/apt/manifests/preferences_snippet.pp
new file mode 100644
index 00000000..b7dba0d8
--- /dev/null
+++ b/puppet/modules/apt/manifests/preferences_snippet.pp
@@ -0,0 +1,59 @@
+define apt::preferences_snippet (
+  $priority = undef,
+  $package = false,
+  $ensure = 'present',
+  $source = '',
+  $release = '',
+  $pin = ''
+) {
+
+  $real_package = $package ? {
+    false   => $name,
+    default => $package,
+  }
+
+  if $ensure == 'present' {
+    if $apt::custom_preferences == false {
+      fail('Trying to define a preferences_snippet with $custom_preferences set to false.')
+    }
+
+    if $priority == undef {
+      fail('apt::preferences_snippet requires the \'priority\' argument to be set')
+    }
+
+    if !$pin and !$release {
+      fail('apt::preferences_snippet requires one of the \'pin\' or \'release\' argument to be set')
+    }
+    if $pin and $release {
+      fail('apt::preferences_snippet requires either a \'pin\' or \'release\' argument, not both')
+    }
+  }
+
+  file { "/etc/apt/preferences.d/${name}":
+    ensure => $ensure,
+    owner  => root, group => 0, mode => '0644',
+    before => Exec['apt_updated'];
+  }
+
+  case $source {
+    '': {
+      case $release {
+        '': {
+          File["/etc/apt/preferences.d/${name}"]{
+            content => template('apt/preferences_snippet.erb')
+          }
+        }
+        default: {
+          File["/etc/apt/preferences.d/${name}"]{
+            content => template('apt/preferences_snippet_release.erb')
+          }
+        }
+      }
+    }
+    default: {
+      File["/etc/apt/preferences.d/${name}"]{
+        source => $source
+      }
+    }
+  }
+}
diff --git a/puppet/modules/apt/manifests/preseeded_package.pp b/puppet/modules/apt/manifests/preseeded_package.pp
new file mode 100644
index 00000000..3ef06879
--- /dev/null
+++ b/puppet/modules/apt/manifests/preseeded_package.pp
@@ -0,0 +1,21 @@
+define apt::preseeded_package (
+  $ensure = 'installed',
+  $content = ''
+) {
+  $seedfile = "/var/cache/local/preseeding/${name}.seeds"
+  $real_content = $content ? {
+    ''      => template ( "site_apt/${::debian_codename}/${name}.seeds" ),
+    default => $content
+  }
+
+  file { $seedfile:
+    content => $real_content,
+    mode    => '0600', owner => root, group => root,
+  }
+
+  package { $name:
+    ensure       => $ensure,
+    responsefile => $seedfile,
+    require      => File[$seedfile],
+  }
+}
diff --git a/puppet/modules/apt/manifests/proxy_client.pp b/puppet/modules/apt/manifests/proxy_client.pp
new file mode 100644
index 00000000..9ba79f23
--- /dev/null
+++ b/puppet/modules/apt/manifests/proxy_client.pp
@@ -0,0 +1,9 @@
+class apt::proxy_client(
+  $proxy = 'http://localhost',
+  $port = '3142',
+){
+
+  apt_conf { '20proxy':
+    content => template('apt/20proxy.erb'),
+  }
+}
diff --git a/puppet/modules/apt/manifests/reboot_required_notify.pp b/puppet/modules/apt/manifests/reboot_required_notify.pp
new file mode 100644
index 00000000..722e8a5e
--- /dev/null
+++ b/puppet/modules/apt/manifests/reboot_required_notify.pp
@@ -0,0 +1,21 @@
+class apt::reboot_required_notify {
+
+  # This package installs the script that created /var/run/reboot-required*.
+  # This script (/usr/share/update-notifier/notify-reboot-required) is
+  # triggered e.g. by kernel packages.
+  package { 'update-notifier-common':
+    ensure => installed,
+  }
+
+  # cron-apt defaults to run every night at 4 o'clock
+  # plus some random time <1h.
+  # so we check if a reboot is required a bit later.
+  cron { 'apt_reboot_required_notify':
+    command => 'if [ -f /var/run/reboot-required ]; then echo "Reboot required\n" ; cat /var/run/reboot-required.pkgs ; fi',
+    user    => root,
+    hour    => 5,
+    minute  => 20,
+    require => Package['update-notifier-common'],
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/sources_list.pp b/puppet/modules/apt/manifests/sources_list.pp
new file mode 100644
index 00000000..0ee068d1
--- /dev/null
+++ b/puppet/modules/apt/manifests/sources_list.pp
@@ -0,0 +1,40 @@
+define apt::sources_list (
+  $ensure = 'present',
+  $source = '',
+  $content = undef
+) {
+
+  if $ensure == 'present' {
+    if $source == '' and $content == undef {
+      fail("One of \$source or \$content must be specified for apt_sources_snippet ${name}")
+    }
+    if $source != '' and $content != undef {
+      fail("Only one of \$source or \$content must specified for apt_sources_snippet ${name}")
+    }
+  }
+
+  include apt::dot_d_directories
+
+  $realname = regsubst($name, '\.list$', '')
+
+  # One would expect the 'file' resource on sources.list.d to trigger an
+  # apt-get update when files are added or modified in the directory, but it
+  # apparently doesn't.
+  file { "/etc/apt/sources.list.d/${realname}.list":
+    ensure => $ensure,
+    owner  => root, group => 0, mode => '0644',
+    notify => Exec['apt_updated'],
+  }
+
+  if $source {
+    File["/etc/apt/sources.list.d/${realname}.list"] {
+      source => $source,
+    }
+  }
+  else {
+    File["/etc/apt/sources.list.d/${realname}.list"] {
+      content => $content,
+    }
+  }
+}
+
diff --git a/puppet/modules/apt/manifests/unattended_upgrades.pp b/puppet/modules/apt/manifests/unattended_upgrades.pp
new file mode 100644
index 00000000..52d75425
--- /dev/null
+++ b/puppet/modules/apt/manifests/unattended_upgrades.pp
@@ -0,0 +1,34 @@
+class apt::unattended_upgrades (
+  $config_content = undef,
+  $config_template = 'apt/50unattended-upgrades.erb',
+  $mailonlyonerror = true,
+  $mail_recipient = 'root',
+  $blacklisted_packages = [],
+  $ensure_version = present
+) {
+
+  package { 'unattended-upgrades':
+    ensure  => $ensure_version
+  }
+
+  # For some reason, this directory is sometimes absent, which causes
+  # unattended-upgrades to crash.
+  file { '/var/log/unattended-upgrades':
+    ensure  => directory,
+    owner   => 'root',
+    group   => 0,
+    mode    => '0755',
+    require => Package['unattended-upgrades'],
+  }
+
+  $file_content = $config_content ? {
+    undef   => template($config_template),
+    default => $config_content
+  }
+
+  apt_conf { '50unattended-upgrades':
+    content     => $file_content,
+    require     => Package['unattended-upgrades'],
+    refresh_apt => false
+  }
+}
diff --git a/puppet/modules/apt/manifests/update.pp b/puppet/modules/apt/manifests/update.pp
new file mode 100644
index 00000000..dde83200
--- /dev/null
+++ b/puppet/modules/apt/manifests/update.pp
@@ -0,0 +1,7 @@
+class apt::update inherits ::apt {
+
+  Exec['update_apt'] {
+    refreshonly => false
+  }
+
+}
diff --git a/puppet/modules/apt/manifests/upgrade_package.pp b/puppet/modules/apt/manifests/upgrade_package.pp
new file mode 100644
index 00000000..30572c96
--- /dev/null
+++ b/puppet/modules/apt/manifests/upgrade_package.pp
@@ -0,0 +1,31 @@
+define apt::upgrade_package (
+  $version = ''
+) {
+
+  $version_suffix = $version ? {
+    ''       => '',
+    'latest' => '',
+    default  => "=${version}",
+  }
+
+  if !defined(Package['apt-show-versions']) {
+    package { 'apt-show-versions':
+      ensure  => installed,
+      require => undef,
+    }
+  }
+
+  if !defined(Package['dctrl-tools']) {
+    package { 'dctrl-tools':
+      ensure  => installed,
+      require => undef,
+    }
+  }
+
+  exec { "apt-get -q -y -o 'DPkg::Options::=--force-confold' install ${name}${version_suffix}":
+    onlyif  => [ "grep-status -F Status installed -a -P $name -q", "apt-show-versions -u $name | grep -q upgradeable" ],
+    require => Package['apt-show-versions', 'dctrl-tools'],
+    before  => Exec['apt_updated']
+  }
+
+}
diff --git a/puppet/modules/apt/spec/spec_helper.rb b/puppet/modules/apt/spec/spec_helper.rb
new file mode 100644
index 00000000..21d1a988
--- /dev/null
+++ b/puppet/modules/apt/spec/spec_helper.rb
@@ -0,0 +1,12 @@
+# https://puppetlabs.com/blog/testing-modules-in-the-puppet-forge
+require 'rspec-puppet'
+require 'mocha/api'
+
+RSpec.configure do |c|
+
+  c.module_path = File.expand_path(File.join(File.dirname(__FILE__), '..', '..'))
+  c.color = true
+
+  #Puppet.features.stubs(:root? => true)
+
+end
diff --git a/puppet/modules/apt/spec/unit/custom_facts_spec.rb b/puppet/modules/apt/spec/unit/custom_facts_spec.rb
new file mode 100644
index 00000000..9a28d92e
--- /dev/null
+++ b/puppet/modules/apt/spec/unit/custom_facts_spec.rb
@@ -0,0 +1,86 @@
+require "spec_helper"
+
+describe "Facter::Util::Fact" do
+  before {
+    Facter.clear
+  }
+
+  describe 'custom facts' do
+
+    context 'Debian 7' do
+      before do
+        Facter.fact(:operatingsystem).stubs(:value).returns("Debian")
+        Facter.fact(:operatingsystemrelease).stubs(:value).returns("7.8")
+        Facter.fact(:lsbdistcodename).stubs(:value).returns("wheezy")
+      end
+
+      it "debian_release = oldstable" do
+        expect(Facter.fact(:debian_release).value).to eq('oldstable')
+      end
+
+      it "debian_codename = wheezy" do
+        expect(Facter.fact(:debian_codename).value).to eq('wheezy')
+      end
+
+      it "debian_nextcodename = jessie" do
+        expect(Facter.fact(:debian_nextcodename).value).to eq('jessie')
+      end
+
+      it "debian_nextrelease = stable" do
+        expect(Facter.fact(:debian_nextrelease).value).to eq('stable')
+      end
+    end
+
+    context 'Debian 8' do
+      before do
+        Facter.fact(:operatingsystem).stubs(:value).returns("Debian")
+        Facter.fact(:operatingsystemrelease).stubs(:value).returns("8.0")
+        Facter.fact(:lsbdistcodename).stubs(:value).returns("jessie")
+      end
+
+      it "debian_release = stable" do
+        expect(Facter.fact(:debian_release).value).to eq('stable')
+      end
+
+      it "debian_codename = jessie" do
+        expect(Facter.fact(:debian_codename).value).to eq('jessie')
+      end
+
+      it "debian_nextcodename = stretch" do
+        expect(Facter.fact(:debian_nextcodename).value).to eq('stretch')
+      end
+
+      it "debian_nextrelease = testing" do
+        expect(Facter.fact(:debian_nextrelease).value).to eq('testing')
+      end
+    end
+
+    context 'Ubuntu 15.10' do
+      before do
+        Facter.fact(:operatingsystem).stubs(:value).returns("Ubuntu")
+        Facter.fact(:operatingsystemrelease).stubs(:value).returns("15.10")
+        Facter.fact(:lsbdistcodename).stubs(:value).returns("wily")
+      end
+
+      it "ubuntu_codename = wily" do
+        expect(Facter.fact(:ubuntu_codename).value).to eq('wily')
+      end
+
+      it "ubuntu_nextcodename = xenial" do
+        expect(Facter.fact(:ubuntu_nextcodename).value).to eq('xenial')
+      end
+    end
+  end
+
+  describe "Test 'apt_running' fact" do
+    it "should return true when apt-get is running" do
+      Facter::Util::Resolution.stubs(:exec).with("pgrep apt-get >/dev/null 2>&1 && echo true || echo false").returns("true")
+      expect(Facter.fact(:apt_running).value).to eq('true')
+    end
+    it "should return false when apt-get is not running" do
+      Facter::Util::Resolution.stubs(:exec).with("pgrep apt-get >/dev/null 2>&1 && echo true || echo false").returns("false")
+      expect(Facter.fact(:apt_running).value).to eq('false')
+    end
+  end
+
+end
diff --git a/puppet/modules/apt/templates/20proxy.erb b/puppet/modules/apt/templates/20proxy.erb
new file mode 100644
index 00000000..520e7b1b
--- /dev/null
+++ b/puppet/modules/apt/templates/20proxy.erb
@@ -0,0 +1,5 @@
+// This file is managed by Puppet
+// all local modifications will be overwritten
+
+Acquire::http { Proxy "<%= @proxy %>:<%= @port %>"; };
+Acquire::HTTP::Proxy::bugs.debian.org "DIRECT";
diff --git a/puppet/modules/apt/templates/50unattended-upgrades.erb b/puppet/modules/apt/templates/50unattended-upgrades.erb
new file mode 100644
index 00000000..7c65d102
--- /dev/null
+++ b/puppet/modules/apt/templates/50unattended-upgrades.erb
@@ -0,0 +1,38 @@
+// this file is managed by puppet !
+
+<% if scope.lookupvar('::operatingsystem') == 'Ubuntu' -%>
+Unattended-Upgrade::Allowed-Origins {
+  "${distro_id}:${distro_codename}-security";
+  "${distro_id}:${distro_codename}-updates";
+  "${distro_id}:${distro_codename}-backports";
+<% elsif scope.lookupvar('::operatingsystem') == 'Debian' and scope.lookupvar('::debian_codename') == 'squeeze' -%>
+Unattended-Upgrade::Allowed-Origins {
+  "${distro_id}:<%= scope.lookupvar('::debian_release') %>";
+  "${distro_id}:squeeze-lts";
+<% elsif scope.lookupvar('::operatingsystem') == 'Debian' and scope.lookupvar('::debian_codename') == 'wheezy' -%>
+Unattended-Upgrade::Origins-Pattern {
+  "origin=Debian,archive=<%= scope.lookupvar('::debian_release') %>,label=Debian-Security";
+  "origin=Debian,archive=${distro_codename}-lts";
+<% else -%>
+Unattended-Upgrade::Origins-Pattern {
+  "origin=Debian,codename=${distro_codename},label=Debian";
+  "origin=Debian,codename=${distro_codename},label=Debian-Security";
+<% end -%>
+};
+
+<% if not @blacklisted_packages.empty?  -%>
+Unattended-Upgrade::Package-Blacklist {
+<% @blacklisted_packages.each do |pkg| -%>
+  "<%= pkg %>";
+<% end -%>
+};
+<% end -%>
+
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::Unattended-Upgrade "1";
+
+Unattended-Upgrade::Mail "<%= @mail_recipient -%>";
+<% if @mailonlyonerror -%>
+Unattended-Upgrade::MailOnlyOnError "true";
+<% end -%>
diff --git a/puppet/modules/apt/templates/Debian/apticron_jessie.erb b/puppet/modules/apt/templates/Debian/apticron_jessie.erb
new file mode 120000
index 00000000..a9a3a6fd
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/apticron_jessie.erb
@@ -0,0 +1 @@
+apticron_wheezy.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Debian/apticron_lenny.erb b/puppet/modules/apt/templates/Debian/apticron_lenny.erb
new file mode 100644
index 00000000..86b09977
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/apticron_lenny.erb
@@ -0,0 +1,50 @@
+# apticron.conf
+#
+# set EMAIL to a list of addresses which will be notified of impending updates
+#
+EMAIL="<%= scope.lookupvar('apt::apticron::email') %>"
+
+#
+# Set DIFF_ONLY to "1" to only output the difference of the current run
+# compared to the last run (ie. only new upgrades since the last run). If there
+# are no differences, no output/email will be generated. By default, apticron
+# will output everything that needs to be upgraded.
+#
+DIFF_ONLY="<%= scope.lookupvar('apt::apticron::diff_only') %>"
+
+#
+# Set LISTCHANGES_PROFILE if you would like apticron to invoke apt-listchanges
+# with the --profile option. You should add a corresponding profile to
+# /etc/apt/listchanges.conf
+#
+LISTCHANGES_PROFILE="<%= scope.lookupvar('apt::apticron::listchanges_profile') %>"
+
+#
+# Set SYSTEM if you would like apticron to use something other than the output
+# of "hostname -f" for the system name in the mails it generates
+#
+# SYSTEM="foobar.example.com"
+<% unless (v=scope.lookupvar('apt::apticron::system')).to_s == "false" -%>
+SYSTEM="<%= v %>"
+<% end -%>
+
+#
+# Set IPADDRESSNUM if you would like to configure the maximal number of IP
+# addresses apticron displays. The default is to display 1 address of each
+# family type (inet, inet6), if available.
+#
+# IPADDRESSNUM="1"
+<% unless (v=scope.lookupvar('apt::apticron::ipaddressnum')).to_s == "false" -%>
+IPADDRESSNUM="<%= v %>"
+<% end -%>
+
+#
+# Set IPADDRESSES to a whitespace seperated list of reachable addresses for
+# this system. By default, apticron will try to work these out using the
+# "ip" command
+#
+# IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1"
+<% unless (v=scope.lookupvar('apt::apticron::ipaddresses')).to_s == "false" -%>
+IPADDRESSES="<%= v %>"
+<% end -%>
+
diff --git a/puppet/modules/apt/templates/Debian/apticron_sid.erb b/puppet/modules/apt/templates/Debian/apticron_sid.erb
new file mode 120000
index 00000000..a9a3a6fd
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/apticron_sid.erb
@@ -0,0 +1 @@
+apticron_wheezy.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Debian/apticron_squeeze.erb b/puppet/modules/apt/templates/Debian/apticron_squeeze.erb
new file mode 100644
index 00000000..05b7c9b8
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/apticron_squeeze.erb
@@ -0,0 +1,82 @@
+# apticron.conf
+#
+# set EMAIL to a space separated list of addresses which will be notified of
+# impending updates
+#
+EMAIL="<%= scope.lookupvar('apt::apticron::email') %>"
+
+
+#
+# Set DIFF_ONLY to "1" to only output the difference of the current run
+# compared to the last run (ie. only new upgrades since the last run). If there
+# are no differences, no output/email will be generated. By default, apticron
+# will output everything that needs to be upgraded.
+#
+DIFF_ONLY="<%= scope.lookupvar('apt::apticron::diff_only') %>"
+
+#
+# Set LISTCHANGES_PROFILE if you would like apticron to invoke apt-listchanges
+# with the --profile option. You should add a corresponding profile to
+# /etc/apt/listchanges.conf
+#
+LISTCHANGES_PROFILE="<%= scope.lookupvar('apt::apticron::listchanges_profile') %>"
+
+#
+# Set SYSTEM if you would like apticron to use something other than the output
+# of "hostname -f" for the system name in the mails it generates
+#
+# SYSTEM="foobar.example.com"
+<% unless (v=scope.lookupvar('apt::apticron::system')).to_s == "false" -%>
+SYSTEM="<%= v %>"
+<% end -%>
+
+
+#
+# Set IPADDRESSNUM if you would like to configure the maximal number of IP
+# addresses apticron displays. The default is to display 1 address of each
+# family type (inet, inet6), if available.
+#
+# IPADDRESSNUM="1"
+<% unless (v=scope.lookupvar('apt::apticron::ipaddressnum')).to_s == "false" -%>
+IPADDRESSNUM="<%= v %>"
+<% end -%>
+
+
+#
+# Set IPADDRESSES to a whitespace separated list of reachable addresses for
+# this system. By default, apticron will try to work these out using the
+# "ip" command
+#
+# IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1"
+<% unless (v=scope.lookupvar('apt::apticron::ipaddresses')).to_s == "false" -%>
+IPADDRESSES="<%= v %>"
+<% end -%>
+
+
+#
+# Set NOTIFY_HOLDS="0" if you don't want to be notified about new versions of
+# packages on hold in your system. The default behavior is downloading and
+# listing them as any other package.
+#
+# NOTIFY_HOLDS="0"
+NOTIFY_HOLDS="<%= scope.lookupvar('apt::apticron::notifyholds') %>"
+
+#
+# Set NOTIFY_NEW="0" if you don't want to be notified about packages which
+# are not installed in your system. Yes, it's possible! There are some issues
+# related to systems which have mixed stable/unstable sources. In these cases
+# apt-get will consider for example that packages with "Priority:
+# required"/"Essential: yes" in unstable but not in stable should be installed,
+# so they will be listed in dist-upgrade output. Please take a look at
+# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=531002#44
+#
+# NOTIFY_NEW="0"
+NOTIFY_NEW="<%= scope.lookupvar('apt::apticron::notifynew') %>"
+
+#
+# Set CUSTOM_SUBJECT if you want to replace the default subject used in
+# the notification e-mails. This may help filtering/sorting client-side e-mail.
+#
+# CUSTOM_SUBJECT=""
+CUSTOM_SUBJECT="<%= scope.lookupvar('apt::apticron::customsubject') %>"
+
diff --git a/puppet/modules/apt/templates/Debian/apticron_wheezy.erb b/puppet/modules/apt/templates/Debian/apticron_wheezy.erb
new file mode 100644
index 00000000..655854e6
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/apticron_wheezy.erb
@@ -0,0 +1,80 @@
+# apticron.conf
+#
+# set EMAIL to a space separated list of addresses which will be notified of
+# impending updates
+#
+EMAIL="<%= scope.lookupvar('apt::apticron::email') %>"
+
+#
+# Set DIFF_ONLY to "1" to only output the difference of the current run
+# compared to the last run (ie. only new upgrades since the last run). If there
+# are no differences, no output/email will be generated. By default, apticron
+# will output everything that needs to be upgraded.
+#
+DIFF_ONLY="<%= scope.lookupvar('apt::apticron::diff_only') %>"
+
+#
+# Set LISTCHANGES_PROFILE if you would like apticron to invoke apt-listchanges
+# with the --profile option. You should add a corresponding profile to
+# /etc/apt/listchanges.conf
+#
+LISTCHANGES_PROFILE="<%= scope.lookupvar('apt::apticron::listchanges_profile') %>"
+
+#
+# Set SYSTEM if you would like apticron to use something other than the output
+# of "hostname -f" for the system name in the mails it generates
+#
+# SYSTEM="foobar.example.com"
+<% unless (v=scope.lookupvar('apt::apticron::system')).to_s == "false" -%>
+SYSTEM="<%= v %>"
+<% end -%>
+
+#
+# Set IPADDRESSNUM if you would like to configure the maximal number of IP
+# addresses apticron displays. The default is to display 1 address of each
+# family type (inet, inet6), if available.
+#
+# IPADDRESSNUM="1"
+<% unless (v=scope.lookupvar('apt::apticron::ipaddressnum')).to_s == "false" -%>
+IPADDRESSNUM="<%= v %>"
+<% end -%>
+
+#
+# Set IPADDRESSES to a whitespace separated list of reachable addresses for
+# this system. By default, apticron will try to work these out using the
+# "ip" command
+#
+# IPADDRESSES="192.0.2.1 2001:db8:1:2:3::1"
+<% unless (v=scope.lookupvar('apt::apticron::ipaddresses')).to_s == "false" -%>
+IPADDRESSES=<%= v %>"
+<% end -%>
+
+#
+# Set NOTIFY_HOLDS="0" if you don't want to be notified about new versions of
+# packages on hold in your system. The default behavior is downloading and
+# listing them as any other package.
+#
+# NOTIFY_HOLDS="0"
+NOTIFY_HOLDS="<%= scope.lookupvar('apt::apticron::notifyholds') %>"
+
+#
+# Set NOTIFY_NEW="0" if you don't want to be notified about packages which
+# are not installed in your system. Yes, it's possible! There are some issues
+# related to systems which have mixed stable/unstable sources. In these cases
+# apt-get will consider for example that packages with "Priority:
+# required"/"Essential: yes" in unstable but not in stable should be installed,
+# so they will be listed in dist-upgrade output. Please take a look at
+# http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=531002#44
+#
+# NOTIFY_NEW="0"
+NOTIFY_NEW="<%= scope.lookupvar('apt::apticron::notifynew') %>"
+
+
+#
+# Set CUSTOM_SUBJECT if you want to replace the default subject used in
+# the notification e-mails. This may help filtering/sorting client-side e-mail.
+# If you want to use internal vars please use single quotes here. Ex:
+# ='[apticron] :  package update(s)'
+#
+# CUSTOM_SUBJECT=""
+CUSTOM_SUBJECT="<%= scope.lookupvar('apt::apticron::customsubject') %>"
diff --git a/puppet/modules/apt/templates/Debian/listchanges_jessie.erb b/puppet/modules/apt/templates/Debian/listchanges_jessie.erb
new file mode 120000
index 00000000..74ab496d
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/listchanges_jessie.erb
@@ -0,0 +1 @@
+listchanges_lenny.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Debian/listchanges_lenny.erb b/puppet/modules/apt/templates/Debian/listchanges_lenny.erb
new file mode 100644
index 00000000..1025dd0e
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/listchanges_lenny.erb
@@ -0,0 +1,7 @@
+[apt]
+frontend=<%= scope.lookupvar('apt::listchanges::frontend') %>
+email_address=<%= scope.lookupvar('apt::listchanges::email') %>
+confirm=<%= scope.lookupvar('apt::listchanges::confirm') %>
+save_seen=<%= scope.lookupvar('apt::listchanges::saveseen') %>
+which=<%= scope.lookupvar('apt::listchanges::which') %>
+
diff --git a/puppet/modules/apt/templates/Debian/listchanges_sid.erb b/puppet/modules/apt/templates/Debian/listchanges_sid.erb
new file mode 120000
index 00000000..74ab496d
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/listchanges_sid.erb
@@ -0,0 +1 @@
+listchanges_lenny.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Debian/listchanges_squeeze.erb b/puppet/modules/apt/templates/Debian/listchanges_squeeze.erb
new file mode 120000
index 00000000..74ab496d
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/listchanges_squeeze.erb
@@ -0,0 +1 @@
+listchanges_lenny.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Debian/listchanges_wheezy.erb b/puppet/modules/apt/templates/Debian/listchanges_wheezy.erb
new file mode 120000
index 00000000..74ab496d
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/listchanges_wheezy.erb
@@ -0,0 +1 @@
+listchanges_lenny.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Debian/preferences_jessie.erb b/puppet/modules/apt/templates/Debian/preferences_jessie.erb
new file mode 100644
index 00000000..0888abe5
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/preferences_jessie.erb
@@ -0,0 +1,14 @@
+Explanation: Debian <%= codename=scope.lookupvar('::debian_codename') %>
+Package: *
+Pin: release o=Debian,n=<%= codename %>
+Pin-Priority: 990
+
+Explanation: Debian sid
+Package: *
+Pin: release o=Debian,n=sid
+Pin-Priority: 1
+
+Explanation: Debian fallback
+Package: *
+Pin: release o=Debian
+Pin-Priority: -10
diff --git a/puppet/modules/apt/templates/Debian/preferences_lenny.erb b/puppet/modules/apt/templates/Debian/preferences_lenny.erb
new file mode 100644
index 00000000..65001687
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/preferences_lenny.erb
@@ -0,0 +1,25 @@
+Explanation: Debian <%= codename=scope.lookupvar('::debian_codename') %>
+Package: *
+Pin: release o=Debian,a=<%= scope.lookupvar('::debian_release') %>,v=5*
+Pin-Priority: 990
+
+Explanation: Debian backports
+Package: *
+Pin: origin backports.debian.org
+Pin-Priority: 200
+
+Explanation: Debian <%= next_release=scope.lookupvar('::debian_nextrelease') %>
+Package: *
+Pin: release o=Debian,a=<%= next_release %>
+Pin-Priority: 2
+
+Explanation: Debian sid
+Package: *
+Pin: release o=Debian,a=unstable
+Pin-Priority: 1
+
+Explanation: Debian fallback
+Package: *
+Pin: release o=Debian
+Pin-Priority: -10
+
diff --git a/puppet/modules/apt/templates/Debian/preferences_sid.erb b/puppet/modules/apt/templates/Debian/preferences_sid.erb
new file mode 100644
index 00000000..eb185543
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/preferences_sid.erb
@@ -0,0 +1,10 @@
+Explanation: Debian sid
+Package: *
+Pin: release o=Debian,n=sid
+Pin-Priority: 990
+
+Explanation: Debian fallback
+Package: *
+Pin: release o=Debian
+Pin-Priority: -10
+
diff --git a/puppet/modules/apt/templates/Debian/preferences_squeeze.erb b/puppet/modules/apt/templates/Debian/preferences_squeeze.erb
new file mode 100644
index 00000000..885edc73
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/preferences_squeeze.erb
@@ -0,0 +1,30 @@
+Explanation: Debian <%= codename=scope.lookupvar('::debian_codename') %>
+Package: *
+Pin: release o=Debian,n=<%= codename %>
+Pin-Priority: 990
+
+Explanation: Debian <%= codename %>-updates
+Package: *
+Pin: release o=Debian,n=<%= codename %>-updates
+Pin-Priority: 990
+
+Explanation: Debian <%= codename %>-lts
+Package: *
+Pin: release o=Debian,n=<%= codename %>-lts
+Pin-Priority: 990
+
+Explanation: Debian <%= next_codename=scope.lookupvar('::debian_nextcodename') %>
+Package: *
+Pin: release o=Debian,n=<%= next_codename %>
+Pin-Priority: 2
+
+Explanation: Debian sid
+Package: *
+Pin: release o=Debian,n=sid
+Pin-Priority: 1
+
+Explanation: Debian fallback
+Package: *
+Pin: release o=Debian
+Pin-Priority: -10
+
diff --git a/puppet/modules/apt/templates/Debian/preferences_wheezy.erb b/puppet/modules/apt/templates/Debian/preferences_wheezy.erb
new file mode 100644
index 00000000..106108d5
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/preferences_wheezy.erb
@@ -0,0 +1,20 @@
+Explanation: Debian <%= codename=scope.lookupvar('::debian_codename') %>
+Package: *
+Pin: release o=Debian,n=<%= codename %>
+Pin-Priority: 990
+
+Explanation: Debian <%= codename %>-updates
+Package: *
+Pin: release o=Debian,n=<%= codename %>-updates
+Pin-Priority: 990
+
+Explanation: Debian sid
+Package: *
+Pin: release o=Debian,n=sid
+Pin-Priority: 1
+
+Explanation: Debian fallback
+Package: *
+Pin: release o=Debian
+Pin-Priority: -10
+
diff --git a/puppet/modules/apt/templates/Debian/sources.list.erb b/puppet/modules/apt/templates/Debian/sources.list.erb
new file mode 100644
index 00000000..44eea538
--- /dev/null
+++ b/puppet/modules/apt/templates/Debian/sources.list.erb
@@ -0,0 +1,76 @@
+# This file is managed by puppet
+# all local modifications will be overwritten
+
+### Debian current: <%= codename=scope.lookupvar('::debian_codename') %>
+
+# basic
+deb <%= debian_url=scope.lookupvar('apt::debian_url') %> <%= codename %> <%= lrepos=scope.lookupvar('apt::real_repos') %>
+<% if include_src=scope.lookupvar('apt::include_src')  -%>
+deb-src <%= debian_url %> <%= codename %> <%= lrepos %>
+<% end -%>
+
+# security
+<% if ((release=scope.lookupvar('::debian_release')) == "stable" || release == "oldstable") -%>
+deb <%= security_url=scope.lookupvar('apt::security_url') %> <%= codename %>/updates <%= lrepos %>
+<%   if include_src -%>
+deb-src <%= security_url %> <%= codename %>/updates <%= lrepos %>
+<% end -%>
+<% else -%>
+# There is no security support for <%= release %>
+<% end -%>
+
+<% if use_volatile=scope.lookupvar('apt::use_volatile') -%>
+# volatile
+<%   if (release == "testing" || release == "unstable" || release == "experimental") -%>
+# There is no volatile archive for <%= release %>
+<%   else -%>
+deb <%= debian_url %> <%= codename %>-updates <%= lrepos %>
+<%     if include_src -%>
+deb-src <%= debian_url %> <%= codename %>-updates <%= lrepos %>
+<%     end
+     end
+   end -%>
+
+<% if use_lts=scope.lookupvar('apt::use_lts') -%>
+# LTS
+<% if release_lts=scope.lookupvar('::debian_lts') == "false" -%>
+# There is no LTS archive for <%= release %>
+<% else -%>
+deb <%= debian_url %> <%= codename %>-lts <%= lrepos %>
+<% if include_src -%>
+deb-src <%= debian_url %> <%= codename %>-lts <%= lrepos %>
+<% end -%>
+<% end -%>
+<% end -%>
+
+<% if next_release=scope.lookupvar('apt::use_next_release') -%>
+### Debian next: <%= next_release=scope.lookupvar('::debian_nextrelease') ; next_codename=scope.lookupvar('::debian_nextcodename') %>
+
+# basic
+deb <%= debian_url %> <%= next_codename %> <%= lrepos %>
+<%   if include_src -%>
+deb-src <%= debian_url %> <%= next_codename %> <%= lrepos %>
+<%   end -%>
+
+# security
+<%   if (next_release == "unstable" || next_release == "experimental") -%>
+# There is no security support for <%= next_release %>
+<%   else -%>
+deb <%= security_url %> <%= next_codename %>/updates <%= lrepos %>
+<%     if include_src then -%>
+deb-src <%= security_url %> <%= next_codename %>/updates <%= lrepos %>
+<%     end
+     end -%>
+
+<%   if use_volatile -%>
+# volatile
+<%     if (next_release == "testing" || next_release == "unstable" || next_release == "experimental") -%>
+# There is no volatile archive for <%= next_release %>
+<%     else -%>
+deb <%= debian_url %> <%= next_codename %>-updates <%= lrepos %>
+<%       if include_src -%>
+deb-src <%= debian_url %> <%= next_codename %>-updates <%= lrepos %>
+<%       end
+       end
+     end
+   end -%>
diff --git a/puppet/modules/apt/templates/Ubuntu/preferences_lucid.erb b/puppet/modules/apt/templates/Ubuntu/preferences_lucid.erb
new file mode 120000
index 00000000..3debe4fc
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/preferences_lucid.erb
@@ -0,0 +1 @@
+preferences_maverick.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Ubuntu/preferences_maverick.erb b/puppet/modules/apt/templates/Ubuntu/preferences_maverick.erb
new file mode 100644
index 00000000..8e5481d3
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/preferences_maverick.erb
@@ -0,0 +1,30 @@
+Explanation: Ubuntu <%= codename=scope.lookupvar('::ubuntu_codename') %> security
+Package: *
+Pin: release o=Ubuntu,a=<%= codename %>-security
+Pin-Priority: 990
+
+Explanation: Ubuntu <%= codename %> updates
+Package: *
+Pin: release o=Ubuntu,a=<%= codename %>-updates
+Pin-Priority: 980
+
+Explanation: Ubuntu <%= codename %>
+Package: *
+Pin: release o=Ubuntu,a=<%= codename %>
+Pin-Priority: 970
+
+Explanation: Ubuntu backports
+Package: *
+Pin: release a=<%= codename %>-backports
+Pin-Priority: 200
+
+Explanation: Ubuntu <%= next_release=scope.lookupvar('::ubuntu_nextcodename') %>
+Package: *
+Pin: release o=Ubuntu,a=<%= next_release %>
+Pin-Priority: 2
+
+Explanation: Ubuntu fallback
+Package: *
+Pin: release o=Ubuntu
+Pin-Priority: -10
+
diff --git a/puppet/modules/apt/templates/Ubuntu/preferences_oneiric.erb b/puppet/modules/apt/templates/Ubuntu/preferences_oneiric.erb
new file mode 120000
index 00000000..3debe4fc
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/preferences_oneiric.erb
@@ -0,0 +1 @@
+preferences_maverick.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Ubuntu/preferences_precise.erb b/puppet/modules/apt/templates/Ubuntu/preferences_precise.erb
new file mode 120000
index 00000000..3debe4fc
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/preferences_precise.erb
@@ -0,0 +1 @@
+preferences_maverick.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Ubuntu/preferences_utopic.erb b/puppet/modules/apt/templates/Ubuntu/preferences_utopic.erb
new file mode 120000
index 00000000..3debe4fc
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/preferences_utopic.erb
@@ -0,0 +1 @@
+preferences_maverick.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Ubuntu/preferences_vivid.erb b/puppet/modules/apt/templates/Ubuntu/preferences_vivid.erb
new file mode 120000
index 00000000..3debe4fc
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/preferences_vivid.erb
@@ -0,0 +1 @@
+preferences_maverick.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Ubuntu/preferences_wily.erb b/puppet/modules/apt/templates/Ubuntu/preferences_wily.erb
new file mode 120000
index 00000000..3debe4fc
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/preferences_wily.erb
@@ -0,0 +1 @@
+preferences_maverick.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Ubuntu/preferences_xenial.erb b/puppet/modules/apt/templates/Ubuntu/preferences_xenial.erb
new file mode 120000
index 00000000..3debe4fc
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/preferences_xenial.erb
@@ -0,0 +1 @@
+preferences_maverick.erb
\ No newline at end of file
diff --git a/puppet/modules/apt/templates/Ubuntu/sources.list.erb b/puppet/modules/apt/templates/Ubuntu/sources.list.erb
new file mode 100644
index 00000000..e6d2f643
--- /dev/null
+++ b/puppet/modules/apt/templates/Ubuntu/sources.list.erb
@@ -0,0 +1,22 @@
+# This file is managed by puppet
+# all local modifications will be overwritten
+
+# basic <%= codename=scope.lookupvar('::ubuntu_codename') %>
+deb <%= ubuntu_url=scope.lookupvar('apt::ubuntu_url') %> <%= codename %> <%= lrepos=scope.lookupvar('apt::real_repos') %>
+<% if include_src=scope.lookupvar('apt::include_src') -%>
+deb-src <%= ubuntu_url %> <%= codename %> <%= lrepos %>
+<% end -%>
+
+<% if use_volatile=scope.lookupvar('apt::use_volatile') -%>
+# updates
+deb <%= ubuntu_url %> <%= codename %>-updates <%= lrepos %>
+<%   if include_src -%>
+deb-src <%= ubuntu_url %> <%= codename %>-updates <%= lrepos %>
+<%   end
+   end -%>
+
+# security suppport
+deb <%= ubuntu_url %> <%= codename %>-security <%= lrepos %>
+<% if include_src -%>
+deb-src <%= ubuntu_url %> <%= codename %>-security <%= lrepos %>
+<% end -%>
diff --git a/puppet/modules/apt/templates/preferences_snippet.erb b/puppet/modules/apt/templates/preferences_snippet.erb
new file mode 100644
index 00000000..903e73d6
--- /dev/null
+++ b/puppet/modules/apt/templates/preferences_snippet.erb
@@ -0,0 +1,4 @@
+Package: <%= @real_package %>
+Pin: <%= @pin %>
+Pin-Priority: <%= @priority %>
+
diff --git a/puppet/modules/apt/templates/preferences_snippet_release.erb b/puppet/modules/apt/templates/preferences_snippet_release.erb
new file mode 100644
index 00000000..b95d3f81
--- /dev/null
+++ b/puppet/modules/apt/templates/preferences_snippet_release.erb
@@ -0,0 +1,4 @@
+Package: <%= @real_package %>
+Pin: release a=<%= @release %>
+Pin-Priority: <%= @priority %>
+
-- 
cgit v1.2.3


From 5552d592f9332e55bcf2a5d2c6b0258b8130c26b Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:31 -0400
Subject: git subrepo clone https://leap.se/git/puppet_lsb puppet/modules/lsb

subrepo:
  subdir:   "puppet/modules/lsb"
  merged:   "bac64e7"
upstream:
  origin:   "https://leap.se/git/puppet_lsb"
  branch:   "master"
  commit:   "bac64e7"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ia48799c5442c7b930952fdb822bd80d796eab321
---
 puppet/modules/lsb/.gitrepo            | 11 +++++++++++
 puppet/modules/lsb/manifests/base.pp   |  3 +++
 puppet/modules/lsb/manifests/centos.pp |  5 +++++
 puppet/modules/lsb/manifests/debian.pp |  6 ++++++
 puppet/modules/lsb/manifests/init.pp   |  6 ++++++
 5 files changed, 31 insertions(+)
 create mode 100644 puppet/modules/lsb/.gitrepo
 create mode 100644 puppet/modules/lsb/manifests/base.pp
 create mode 100644 puppet/modules/lsb/manifests/centos.pp
 create mode 100644 puppet/modules/lsb/manifests/debian.pp
 create mode 100644 puppet/modules/lsb/manifests/init.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/lsb/.gitrepo b/puppet/modules/lsb/.gitrepo
new file mode 100644
index 00000000..640efc53
--- /dev/null
+++ b/puppet/modules/lsb/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_lsb
+	branch = master
+	commit = bac64e7595a6d4f8d409b024a26bddb1c06188d6
+	parent = 2e384e68fb867d8ba7178c4398e35653ab567538
+	cmdver = 0.3.0
diff --git a/puppet/modules/lsb/manifests/base.pp b/puppet/modules/lsb/manifests/base.pp
new file mode 100644
index 00000000..9dc8d5a4
--- /dev/null
+++ b/puppet/modules/lsb/manifests/base.pp
@@ -0,0 +1,3 @@
+class lsb::base {
+  package{'lsb': ensure => present }
+}
diff --git a/puppet/modules/lsb/manifests/centos.pp b/puppet/modules/lsb/manifests/centos.pp
new file mode 100644
index 00000000..b7006187
--- /dev/null
+++ b/puppet/modules/lsb/manifests/centos.pp
@@ -0,0 +1,5 @@
+class lsb::centos inherits lsb::base {
+  Package['lsb']{
+    name => 'redhat-lsb',
+  }
+}
diff --git a/puppet/modules/lsb/manifests/debian.pp b/puppet/modules/lsb/manifests/debian.pp
new file mode 100644
index 00000000..c32070f3
--- /dev/null
+++ b/puppet/modules/lsb/manifests/debian.pp
@@ -0,0 +1,6 @@
+class lsb::debian inherits lsb::base {
+  Package['lsb']{
+    name => 'lsb-release',
+    require => undef,
+  }
+}
diff --git a/puppet/modules/lsb/manifests/init.pp b/puppet/modules/lsb/manifests/init.pp
new file mode 100644
index 00000000..85b34e1f
--- /dev/null
+++ b/puppet/modules/lsb/manifests/init.pp
@@ -0,0 +1,6 @@
+class lsb {
+  case $::operatingsystem {
+    debian,ubuntu: { include lsb::debian }
+    centos: { include lsb::centos }
+  }
+}
-- 
cgit v1.2.3


From 984375bab6546a7ef1e716402468a2f4cb6e1925 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:32 -0400
Subject: git subrepo clone https://leap.se/git/puppet_ntp puppet/modules/ntp

subrepo:
  subdir:   "puppet/modules/ntp"
  merged:   "8a554ab"
upstream:
  origin:   "https://leap.se/git/puppet_ntp"
  branch:   "master"
  commit:   "8a554ab"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I6132c417d321ed4f48cc3cd52d4050603fada61a
---
 puppet/modules/ntp/.fixtures.yml                   |   5 +
 puppet/modules/ntp/.gitignore                      |   3 +
 puppet/modules/ntp/.gitrepo                        |  11 +
 puppet/modules/ntp/.nodeset.yml                    |  35 +++
 puppet/modules/ntp/.travis.yml                     |  40 ++++
 puppet/modules/ntp/CHANGELOG                       |  61 +++++
 puppet/modules/ntp/CONTRIBUTING.md                 |   9 +
 puppet/modules/ntp/Gemfile                         |  19 ++
 puppet/modules/ntp/LICENSE                         | 202 ++++++++++++++++
 puppet/modules/ntp/Modulefile                      |  11 +
 puppet/modules/ntp/README.markdown                 | 215 +++++++++++++++++
 puppet/modules/ntp/Rakefile                        |   2 +
 puppet/modules/ntp/manifests/config.pp             |  23 ++
 puppet/modules/ntp/manifests/init.pp               |  58 +++++
 puppet/modules/ntp/manifests/install.pp            |   9 +
 puppet/modules/ntp/manifests/params.pp             | 116 +++++++++
 puppet/modules/ntp/manifests/service.pp            |  18 ++
 puppet/modules/ntp/spec/classes/ntp_spec.rb        | 261 +++++++++++++++++++++
 .../fixtures/modules/my_ntp/templates/ntp.conf.erb |   4 +
 puppet/modules/ntp/spec/spec.opts                  |   6 +
 puppet/modules/ntp/spec/spec_helper.rb             |   1 +
 puppet/modules/ntp/spec/spec_helper_system.rb      |  26 ++
 puppet/modules/ntp/spec/system/basic_spec.rb       |  13 +
 puppet/modules/ntp/spec/system/class_spec.rb       |  39 +++
 puppet/modules/ntp/spec/system/ntp_config_spec.rb  |  35 +++
 puppet/modules/ntp/spec/system/ntp_install_spec.rb |  31 +++
 puppet/modules/ntp/spec/system/ntp_service_spec.rb |  25 ++
 .../ntp/spec/system/preferred_servers_spec.rb      |  20 ++
 puppet/modules/ntp/spec/system/restrict_spec.rb    |  20 ++
 .../ntp/spec/unit/puppet/provider/README.markdown  |   4 +
 .../ntp/spec/unit/puppet/type/README.markdown      |   4 +
 puppet/modules/ntp/templates/ntp.conf.erb          |  43 ++++
 puppet/modules/ntp/tests/init.pp                   |  11 +
 33 files changed, 1380 insertions(+)
 create mode 100644 puppet/modules/ntp/.fixtures.yml
 create mode 100644 puppet/modules/ntp/.gitignore
 create mode 100644 puppet/modules/ntp/.gitrepo
 create mode 100644 puppet/modules/ntp/.nodeset.yml
 create mode 100644 puppet/modules/ntp/.travis.yml
 create mode 100644 puppet/modules/ntp/CHANGELOG
 create mode 100644 puppet/modules/ntp/CONTRIBUTING.md
 create mode 100644 puppet/modules/ntp/Gemfile
 create mode 100644 puppet/modules/ntp/LICENSE
 create mode 100644 puppet/modules/ntp/Modulefile
 create mode 100644 puppet/modules/ntp/README.markdown
 create mode 100644 puppet/modules/ntp/Rakefile
 create mode 100644 puppet/modules/ntp/manifests/config.pp
 create mode 100644 puppet/modules/ntp/manifests/init.pp
 create mode 100644 puppet/modules/ntp/manifests/install.pp
 create mode 100644 puppet/modules/ntp/manifests/params.pp
 create mode 100644 puppet/modules/ntp/manifests/service.pp
 create mode 100644 puppet/modules/ntp/spec/classes/ntp_spec.rb
 create mode 100644 puppet/modules/ntp/spec/fixtures/modules/my_ntp/templates/ntp.conf.erb
 create mode 100644 puppet/modules/ntp/spec/spec.opts
 create mode 100644 puppet/modules/ntp/spec/spec_helper.rb
 create mode 100644 puppet/modules/ntp/spec/spec_helper_system.rb
 create mode 100644 puppet/modules/ntp/spec/system/basic_spec.rb
 create mode 100644 puppet/modules/ntp/spec/system/class_spec.rb
 create mode 100644 puppet/modules/ntp/spec/system/ntp_config_spec.rb
 create mode 100644 puppet/modules/ntp/spec/system/ntp_install_spec.rb
 create mode 100644 puppet/modules/ntp/spec/system/ntp_service_spec.rb
 create mode 100644 puppet/modules/ntp/spec/system/preferred_servers_spec.rb
 create mode 100644 puppet/modules/ntp/spec/system/restrict_spec.rb
 create mode 100644 puppet/modules/ntp/spec/unit/puppet/provider/README.markdown
 create mode 100644 puppet/modules/ntp/spec/unit/puppet/type/README.markdown
 create mode 100644 puppet/modules/ntp/templates/ntp.conf.erb
 create mode 100644 puppet/modules/ntp/tests/init.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/ntp/.fixtures.yml b/puppet/modules/ntp/.fixtures.yml
new file mode 100644
index 00000000..a4b98014
--- /dev/null
+++ b/puppet/modules/ntp/.fixtures.yml
@@ -0,0 +1,5 @@
+fixtures:
+  repositories:
+    "stdlib": "git://github.com/puppetlabs/puppetlabs-stdlib.git"
+  symlinks:
+    "ntp": "#{source_dir}"
diff --git a/puppet/modules/ntp/.gitignore b/puppet/modules/ntp/.gitignore
new file mode 100644
index 00000000..49cf4650
--- /dev/null
+++ b/puppet/modules/ntp/.gitignore
@@ -0,0 +1,3 @@
+pkg/
+metadata.json
+Gemfile.lock
diff --git a/puppet/modules/ntp/.gitrepo b/puppet/modules/ntp/.gitrepo
new file mode 100644
index 00000000..dd7d7267
--- /dev/null
+++ b/puppet/modules/ntp/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_ntp
+	branch = master
+	commit = 8a554ab4b00e25f52a337c4c974fd89f44042957
+	parent = 5552d592f9332e55bcf2a5d2c6b0258b8130c26b
+	cmdver = 0.3.0
diff --git a/puppet/modules/ntp/.nodeset.yml b/puppet/modules/ntp/.nodeset.yml
new file mode 100644
index 00000000..cbd0d57b
--- /dev/null
+++ b/puppet/modules/ntp/.nodeset.yml
@@ -0,0 +1,35 @@
+---
+default_set: 'centos-64-x64'
+sets:
+  'centos-59-x64':
+    nodes:
+      "main.foo.vm":
+        prefab: 'centos-59-x64'
+  'centos-64-x64':
+    nodes:
+      "main.foo.vm":
+        prefab: 'centos-64-x64'
+  'fedora-18-x64':
+    nodes:
+      "main.foo.vm":
+        prefab: 'fedora-18-x64'
+  'debian-607-x64':
+    nodes:
+      "main.foo.vm":
+        prefab: 'debian-607-x64'
+  'debian-70rc1-x64':
+    nodes:
+      "main.foo.vm":
+        prefab: 'debian-70rc1-x64'
+  'ubuntu-server-10044-x64':
+    nodes:
+      "main.foo.vm":
+        prefab: 'ubuntu-server-10044-x64'
+  'ubuntu-server-12042-x64':
+    nodes:
+      "main.foo.vm":
+        prefab: 'ubuntu-server-12042-x64'
+  'sles-11sp1-x64':
+    nodes:
+      "main.foo.vm":
+        prefab: 'sles-11sp1-x64'
diff --git a/puppet/modules/ntp/.travis.yml b/puppet/modules/ntp/.travis.yml
new file mode 100644
index 00000000..e9f0e84b
--- /dev/null
+++ b/puppet/modules/ntp/.travis.yml
@@ -0,0 +1,40 @@
+---
+branches:
+  only:
+  - master
+language: ruby
+bundler_args: --without development
+script: "bundle exec rake spec SPEC_OPTS='--format documentation'"
+after_success:
+  - git clone -q git://github.com/puppetlabs/ghpublisher.git .forge-releng
+  - .forge-releng/publish
+rvm:
+- 1.8.7
+- 1.9.3
+- 2.0.0
+env:
+  matrix:
+    - PUPPET_GEM_VERSION="~> 2.7.0"
+    - PUPPET_GEM_VERSION="~> 3.0.0"
+    - PUPPET_GEM_VERSION="~> 3.1.0"
+    - PUPPET_GEM_VERSION="~> 3.2.0"
+  global:
+    - PUBLISHER_LOGIN=puppetlabs
+    - secure: |-
+        ZiIkYd9+CdPzpwSjFPnVkCx1FIlipxpbdyD33q94h2Tj5zXjNb1GXizVy0NR
+        kVxGhU5Ld8y9z8DTqKRgCI1Yymg3H//OU++PKLOQj/X5juWVR4URBNPeBOzu
+        IJBDl1MADKA4i1+jAZPpz4mTvTtKS4pWKErgCSmhSfsY1hs7n6c=
+matrix:
+  exclude:
+    - rvm: 1.9.3
+      env: PUPPET_GEM_VERSION="~> 2.7.0"
+    - rvm: 2.0.0
+      env: PUPPET_GEM_VERSION="~> 2.7.0"
+    - rvm: 2.0.0
+      env: PUPPET_GEM_VERSION="~> 3.0.0"
+    - rvm: 2.0.0
+      env: PUPPET_GEM_VERSION="~> 3.1.0"
+    - rvm: 1.8.7
+      env: PUPPET_GEM_VERSION="~> 3.2.0"
+notifications:
+  email: false
diff --git a/puppet/modules/ntp/CHANGELOG b/puppet/modules/ntp/CHANGELOG
new file mode 100644
index 00000000..8be6c4e0
--- /dev/null
+++ b/puppet/modules/ntp/CHANGELOG
@@ -0,0 +1,61 @@
+2013-07-31 - Version 2.0.0
+
+Summary:
+
+The 2.0 release focuses on merging all the distro specific
+templates into a single reusable template across all platforms.
+
+To aid in that goal we now allow you to change the driftfile,
+ntp keys, and perferred_servers.
+
+Backwards-incompatible changes:
+
+As all the distro specific templates have been removed and a
+unified one created you may be missing functionality you
+previously relied on.  Please test carefully before rolling
+out globally.
+
+Configuration directives that might possibly be affected:
+- `filegen`
+- `fudge` (for virtual machines)
+- `keys`
+- `logfile`
+- `restrict`
+- `restrictkey`
+- `statistics`
+- `trustedkey`
+
+Features:
+- All templates merged into a single template.
+- NTP Keys support added.
+- Add preferred servers support.
+- Parameters in `ntp` class:
+ - `driftfile`: path for the ntp driftfile.
+ - `keys_enable`: Enable NTP keys feature.
+ - `keys_file`: Path for the NTP keys file.
+ - `keys_trusted`: Which keys to trust.
+ - `keys_controlkey`: Which key to use for the control key.
+ - `keys_requestkey`: Which key to use for the request key.
+ - `preferred_servers`: Array of servers to prefer.
+ - `restrict`: Array of restriction options to apply.
+
+2013-07-15 - Version 1.0.1
+Bugfixes:
+- Fix deprecated warning in `autoupdate` parameter.
+- Correctly quote is_virtual fact.
+
+2013-07-08 - Version 1.0.0
+Features:
+- Completely refactored to split across several classes.
+- rspec-puppet tests rewritten to cover more options.
+- rspec-system tests added.
+- ArchLinux handled via osfamily instead of special casing.
+- parameters in `ntp` class:
+ - `autoupdate`: deprecated in favor of directly setting package_ensure.
+ - `panic`: set to false if you wish to allow large clock skews. 
+
+2011-11-10 Dan Bode <dan@puppetlabs.com> - 0.0.4
+Add Amazon Linux as a supported platform
+Add unit tests
+2011-06-16 Jeff McCune <jeff@puppetlabs.com> - 0.0.3
+Initial release under puppetlabs
diff --git a/puppet/modules/ntp/CONTRIBUTING.md b/puppet/modules/ntp/CONTRIBUTING.md
new file mode 100644
index 00000000..a2b1d77b
--- /dev/null
+++ b/puppet/modules/ntp/CONTRIBUTING.md
@@ -0,0 +1,9 @@
+Puppet Labs modules on the Puppet Forge are open projects, and community contributions
+are essential for keeping them great. We can’t access the huge number of platforms and
+myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
+
+We want to keep it as easy as possible to contribute changes so that our modules work
+in your environment. There are a few guidelines that we need contributors to follow so
+that we can have a chance of keeping on top of things.
+
+You can read the complete module contribution guide [on the Puppet Labs wiki.](http://projects.puppetlabs.com/projects/module-site/wiki/Module_contributing)
diff --git a/puppet/modules/ntp/Gemfile b/puppet/modules/ntp/Gemfile
new file mode 100644
index 00000000..4e733308
--- /dev/null
+++ b/puppet/modules/ntp/Gemfile
@@ -0,0 +1,19 @@
+source 'https://rubygems.org'
+
+group :development, :test do
+  gem 'rake',                    :require => false
+  gem 'puppetlabs_spec_helper',  :require => false
+  gem 'rspec-system-puppet',     :require => false
+  gem 'puppet-lint',             :require => false
+  gem 'serverspec',              :require => false
+  gem 'rspec-system-serverspec', :require => false
+  gem 'vagrant-wrapper',         :require => false
+end
+
+if puppetversion = ENV['PUPPET_GEM_VERSION']
+  gem 'puppet', puppetversion, :require => false
+else
+  gem 'puppet', :require => false
+end
+
+# vim:ft=ruby
diff --git a/puppet/modules/ntp/LICENSE b/puppet/modules/ntp/LICENSE
new file mode 100644
index 00000000..57bc88a1
--- /dev/null
+++ b/puppet/modules/ntp/LICENSE
@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/puppet/modules/ntp/Modulefile b/puppet/modules/ntp/Modulefile
new file mode 100644
index 00000000..9610ef67
--- /dev/null
+++ b/puppet/modules/ntp/Modulefile
@@ -0,0 +1,11 @@
+name    'puppetlabs-ntp'
+version '2.0.0-rc1'
+source 'git://github.com/puppetlabs/puppetlabs-ntp'
+author 'Puppet Labs'
+license 'Apache Version 2.0'
+summary 'NTP Module'
+description 'NTP Module for Debian, Ubuntu, CentOS, RHEL, OEL, Fedora, FreeBSD, ArchLinux and Gentoo.'
+project_page 'http://github.com/puppetlabs/puppetlabs-ntp'
+
+## Add dependencies, if any:
+dependency 'puppetlabs/stdlib', '>= 0.1.6'
diff --git a/puppet/modules/ntp/README.markdown b/puppet/modules/ntp/README.markdown
new file mode 100644
index 00000000..3aedd47a
--- /dev/null
+++ b/puppet/modules/ntp/README.markdown
@@ -0,0 +1,215 @@
+#ntp
+
+####Table of Contents
+
+1. [Overview](#overview)
+2. [Module Description - What the module does and why it is useful](#module-description)
+3. [Setup - The basics of getting started with ntp](#setup)
+    * [What ntp affects](#what-ntp-affects)
+    * [Setup requirements](#setup-requirements)
+    * [Beginning with ntp](#beginning-with-ntp)
+4. [Usage - Configuration options and additional functionality](#usage)
+5. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
+5. [Limitations - OS compatibility, etc.](#limitations)
+6. [Development - Guide for contributing to the module](#development)
+
+##Overview
+
+The NTP module installs, configures, and manages the ntp service.
+
+##Module Description
+
+The NTP module handles running NTP across a range of operating systems and
+distributions.  Where possible we use the upstream ntp templates so that the
+results closely match what you'd get if you modified the package default conf
+files.
+
+##Setup
+
+###What ntp affects
+
+* ntp package.
+* ntp configuration file.
+* ntp service.
+
+###Beginning with ntp
+
+include '::ntp' is enough to get you up and running.  If you wish to pass in
+parameters like which servers to use then you can use:
+
+```puppet
+class { '::ntp':
+  servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
+}
+```
+
+##Usage
+
+All interaction with the ntp module can do be done through the main ntp class.
+This means you can simply toggle the options in the ntp class to get at the
+full functionality.
+
+###I just want NTP, what's the minimum I need?
+
+```puppet
+include '::ntp'
+```
+
+###I just want to tweak the servers, nothing else.
+
+```puppet
+class { '::ntp':
+  servers => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
+}
+```
+
+###I'd like to make sure I restrict who can connect as well.
+
+```puppet
+class { '::ntp':
+  servers  => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
+  restrict => 'restrict 127.0.0.1',
+}
+```
+
+###I'd like to opt out of having the service controlled, we use another tool for that.
+
+```puppet
+class { '::ntp':
+  servers        => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
+  restrict       => 'restrict 127.0.0.1',
+  manage_service => false,
+}
+```
+
+###Looks great!  But I'd like a different template, we need to do something unique here.
+
+```puppet
+class { '::ntp':
+  servers         => [ 'ntp1.corp.com', 'ntp2.corp.com' ],
+  restrict        => 'restrict 127.0.0.1',
+  manage_service  => false,
+  config_template => 'different/module/custom.template.erb',
+}
+```
+
+##Reference
+
+###Classes
+
+* ntp: Main class, includes all the rest.
+* ntp::install: Handles the packages.
+* ntp::config: Handles the configuration file.
+* ntp::service: Handles the service.
+
+###Parameters
+
+The following parameters are available in the ntp module
+
+####`autoupdate`
+
+Deprecated: This parameter previously determined if the ntp module should be
+automatically updated to the latest version available.  Replaced by package\_
+ensure.
+
+####`config`
+
+This sets the file to write ntp configuration into.
+
+####`config_template`
+
+This determines which template puppet should use for the ntp configuration.
+
+####`driftfile`
+
+This sets the location of the driftfile for ntp.
+
+####`keys_controlkey`
+
+Which of the keys is used as the control key.
+
+####`keys_enable`
+
+Should the ntp keys functionality be enabled.
+
+####`keys_file`
+
+Location of the keys file.
+
+####`keys_requestkey`
+
+Which of the keys is used as the request key.
+
+####`package_ensure`
+
+This can be set to 'present' or 'latest' or a specific version to choose the
+ntp package to be installed.
+
+####`package_name`
+
+This determines the name of the package to install.
+
+####`panic`
+
+This determines if ntp should 'panic' in the event of a very large clock skew.
+We set this to false if you're on a virtual machine by default as they don't
+do a great job with keeping time.
+
+####`preferred_servers`
+
+List of ntp servers to prefer.  Will append prefer for any server in this list
+that also appears in the servers list.
+
+####`restrict`
+
+This sets the restrict options in the ntp configuration.
+
+####`servers`
+
+This selects the servers to use for ntp peers.
+
+####`service_enable`
+
+This determines if the service should be enabled at boot.
+
+####`service_ensure`
+
+This determines if the service should be running or not.
+
+####`service_manage`
+
+This selects if puppet should manage the service in the first place.
+
+####`service_name`
+
+This selects the name of the ntp service for puppet to manage.
+
+
+##Limitations
+
+This module has been built on and tested against Puppet 2.7 and higher.
+
+The module has been tested on:
+
+* RedHat Enterprise Linux 5/6
+* Debian 6/7
+* CentOS 5/6
+* Ubuntu 12.04
+* Gentoo
+* Arch Linux
+* FreeBSD
+
+Testing on other platforms has been light and cannot be guaranteed. 
+
+##Development
+
+Puppet Labs modules on the Puppet Forge are open projects, and community
+contributions are essential for keeping them great. We can’t access the
+huge number of platforms and myriad of hardware, software, and deployment
+configurations that Puppet is intended to serve.
+
+We want to keep it as easy as possible to contribute changes so that our
+modules work in your environment. There are a few guidelines that we need
+contributors to follow so that we can have a chance of keeping on top of things.
+
+You can read the complete module contribution guide [on the Puppet Labs wiki.](http://projects.puppetlabs.com/projects/module-site/wiki/Module_contributing)
diff --git a/puppet/modules/ntp/Rakefile b/puppet/modules/ntp/Rakefile
new file mode 100644
index 00000000..bb60173e
--- /dev/null
+++ b/puppet/modules/ntp/Rakefile
@@ -0,0 +1,2 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'rspec-system/rake_task'
diff --git a/puppet/modules/ntp/manifests/config.pp b/puppet/modules/ntp/manifests/config.pp
new file mode 100644
index 00000000..1c8963dc
--- /dev/null
+++ b/puppet/modules/ntp/manifests/config.pp
@@ -0,0 +1,23 @@
+#
+class ntp::config inherits ntp {
+
+  if $keys_enable {
+    $directory = dirname($keys_file)
+    file { $directory:
+      ensure  => directory,
+      owner   => 0,
+      group   => 0,
+      mode    => '0755',
+      recurse => true,
+    }
+  }
+
+  file { $config:
+    ensure  => file,
+    owner   => 0,
+    group   => 0,
+    mode    => '0644',
+    content => template($config_template),
+  }
+
+}
diff --git a/puppet/modules/ntp/manifests/init.pp b/puppet/modules/ntp/manifests/init.pp
new file mode 100644
index 00000000..be951187
--- /dev/null
+++ b/puppet/modules/ntp/manifests/init.pp
@@ -0,0 +1,58 @@
+class ntp (
+  $autoupdate        = $ntp::params::autoupdate,
+  $config            = $ntp::params::config,
+  $config_template   = $ntp::params::config_template,
+  $driftfile         = $ntp::params::driftfile,
+  $keys_enable       = $ntp::params::keys_enable,
+  $keys_file         = $ntp::params::keys_file,
+  $keys_controlkey   = $ntp::params::keys_controlkey,
+  $keys_requestkey   = $ntp::params::keys_requestkey,
+  $keys_trusted      = $ntp::params::keys_trusted,
+  $package_ensure    = $ntp::params::package_ensure,
+  $package_name      = $ntp::params::package_name,
+  $panic             = $ntp::params::panic,
+  $preferred_servers = $ntp::params::preferred_servers,
+  $restrict          = $ntp::params::restrict,
+  $servers           = $ntp::params::servers,
+  $service_enable    = $ntp::params::service_enable,
+  $service_ensure    = $ntp::params::service_ensure,
+  $service_manage    = $ntp::params::service_manage,
+  $service_name      = $ntp::params::service_name,
+) inherits ntp::params {
+
+  validate_absolute_path($config)
+  validate_string($config_template)
+  validate_absolute_path($driftfile)
+  validate_bool($keys_enable)
+  validate_re($keys_controlkey, ['^\d+$', ''])
+  validate_re($keys_requestkey, ['^\d+$', ''])
+  validate_array($keys_trusted)
+  validate_string($package_ensure)
+  validate_array($package_name)
+  validate_bool($panic)
+  validate_array($preferred_servers)
+  validate_array($restrict)
+  validate_array($servers)
+  validate_bool($service_enable)
+  validate_string($service_ensure)
+  validate_bool($service_manage)
+  validate_string($service_name)
+
+  if $autoupdate {
+    notice('autoupdate parameter has been deprecated and replaced with package_ensure.  Set this to latest for the same behavior as autoupdate => true.')
+  }
+
+  include '::ntp::install'
+  include '::ntp::config'
+  include '::ntp::service'
+
+  # Anchor this as per #8040 - this ensures that classes won't float off and
+  # mess everything up.  You can read about this at:
+  # http://docs.puppetlabs.com/puppet/2.7/reference/lang_containment.html#known-issues
+  anchor { 'ntp::begin': }
+  anchor { 'ntp::end': }
+
+  Anchor['ntp::begin'] -> Class['::ntp::install'] -> Class['::ntp::config']
+    ~> Class['::ntp::service'] -> Anchor['ntp::end']
+
+}
diff --git a/puppet/modules/ntp/manifests/install.pp b/puppet/modules/ntp/manifests/install.pp
new file mode 100644
index 00000000..098949c3
--- /dev/null
+++ b/puppet/modules/ntp/manifests/install.pp
@@ -0,0 +1,9 @@
+#
+class ntp::install inherits ntp {
+
+  package { 'ntp':
+    ensure => $package_ensure,
+    name   => $package_name,
+  }
+
+}
diff --git a/puppet/modules/ntp/manifests/params.pp b/puppet/modules/ntp/manifests/params.pp
new file mode 100644
index 00000000..10a4fb2b
--- /dev/null
+++ b/puppet/modules/ntp/manifests/params.pp
@@ -0,0 +1,116 @@
+class ntp::params {
+
+  $autoupdate        = false
+  $config_template   = 'ntp/ntp.conf.erb'
+  $keys_enable       = false
+  $keys_controlkey   = ''
+  $keys_requestkey   = ''
+  $keys_trusted      = []
+  $package_ensure    = 'present'
+  $preferred_servers = []
+  $restrict          = [
+    'restrict default kod nomodify notrap nopeer noquery',
+    'restrict -6 default kod nomodify notrap nopeer noquery',
+    'restrict 127.0.0.1',
+    'restrict -6 ::1',
+  ]
+  $service_enable    = true
+  $service_ensure    = 'running'
+  $service_manage    = true
+
+  # On virtual machines allow large clock skews.
+  $panic = str2bool($::is_virtual) ? {
+    true    => false,
+    default => true,
+  }
+
+  case $::osfamily {
+    'Debian': {
+      $config          = '/etc/ntp.conf'
+      $keys_file       = '/etc/ntp/keys'
+      $driftfile       = '/var/lib/ntp/drift'
+      $package_name    = [ 'ntp' ]
+      $service_name    = 'ntp'
+      $servers         = [
+        '0.debian.pool.ntp.org iburst',
+        '1.debian.pool.ntp.org iburst',
+        '2.debian.pool.ntp.org iburst',
+        '3.debian.pool.ntp.org iburst',
+      ]
+    }
+    'RedHat': {
+      $config          = '/etc/ntp.conf'
+      $driftfile       = '/var/lib/ntp/drift'
+      $keys_file       = '/etc/ntp/keys'
+      $package_name    = [ 'ntp' ]
+      $service_name    = 'ntpd'
+      $servers         = [
+        '0.centos.pool.ntp.org',
+        '1.centos.pool.ntp.org',
+        '2.centos.pool.ntp.org',
+      ]
+    }
+    'SuSE': {
+      $config          = '/etc/ntp.conf'
+      $driftfile       = '/var/lib/ntp/drift/ntp.drift'
+      $keys_file       = '/etc/ntp/keys'
+      $package_name    = [ 'ntp' ]
+      $service_name    = 'ntp'
+      $servers         = [
+        '0.opensuse.pool.ntp.org',
+        '1.opensuse.pool.ntp.org',
+        '2.opensuse.pool.ntp.org',
+        '3.opensuse.pool.ntp.org',
+      ]
+    }
+    'FreeBSD': {
+      $config          = '/etc/ntp.conf'
+      $driftfile       = '/var/db/ntpd.drift'
+      $keys_file       = '/etc/ntp/keys'
+      $package_name    = ['net/ntp']
+      $service_name    = 'ntpd'
+      $servers         = [
+        '0.freebsd.pool.ntp.org iburst maxpoll 9',
+        '1.freebsd.pool.ntp.org iburst maxpoll 9',
+        '2.freebsd.pool.ntp.org iburst maxpoll 9',
+        '3.freebsd.pool.ntp.org iburst maxpoll 9',
+      ]
+    }
+    'Archlinux': {
+      $config          = '/etc/ntp.conf'
+      $driftfile       = '/var/lib/ntp/drift'
+      $keys_file       = '/etc/ntp/keys'
+      $package_name    = [ 'ntp' ]
+      $service_name    = 'ntpd'
+      $servers         = [
+        '0.pool.ntp.org',
+        '1.pool.ntp.org',
+        '2.pool.ntp.org',
+      ]
+    }
+    'Linux': {
+      # Account for distributions that don't have $::osfamily specific settings.
+      case $::operatingsystem {
+        'Gentoo': {
+          $config          = '/etc/ntp.conf'
+          $driftfile       = '/var/lib/ntp/drift'
+          $keys_file       = '/etc/ntp/keys'
+          $package_name    = ['net-misc/ntp']
+          $service_name    = 'ntpd'
+          $servers         = [
+            '0.gentoo.pool.ntp.org',
+            '1.gentoo.pool.ntp.org',
+            '2.gentoo.pool.ntp.org',
+            '3.gentoo.pool.ntp.org',
+          ]
+        }
+        default: {
+          fail("The ${module_name} module is not supported on an ${::operatingsystem} distribution.")
+        }
+      }
+    }
+    default: {
+      fail("The ${module_name} module is not supported on an ${::osfamily} based system.")
+    }
+  }
+}
diff --git a/puppet/modules/ntp/manifests/service.pp b/puppet/modules/ntp/manifests/service.pp
new file mode 100644
index 00000000..3f1ada0b
--- /dev/null
+++ b/puppet/modules/ntp/manifests/service.pp
@@ -0,0 +1,18 @@
+#
+class ntp::service inherits ntp {
+
+  if ! ($service_ensure in [ 'running', 'stopped' ]) {
+    fail('service_ensure parameter must be running or stopped')
+  }
+
+  if $service_manage == true {
+    service { 'ntp':
+      ensure     => $service_ensure,
+      enable     => $service_enable,
+      name       => $service_name,
+      hasstatus  => true,
+      hasrestart => true,
+    }
+  }
+
+}
diff --git a/puppet/modules/ntp/spec/classes/ntp_spec.rb b/puppet/modules/ntp/spec/classes/ntp_spec.rb
new file mode 100644
index 00000000..6c636f40
--- /dev/null
+++ b/puppet/modules/ntp/spec/classes/ntp_spec.rb
@@ -0,0 +1,261 @@
+require 'spec_helper'
+
+describe 'ntp' do
+
+  ['Debian', 'RedHat','SuSE', 'FreeBSD', 'Archlinux', 'Gentoo'].each do |system|
+    if system == 'Gentoo'
+      let(:facts) {{ :osfamily => 'Linux', :operatingsystem => system }}
+    else
+      let(:facts) {{ :osfamily => system }}
+    end
+
+    it { should include_class('ntp::install') }
+    it { should include_class('ntp::config') }
+    it { should include_class('ntp::service') }
+
+    describe 'ntp::config on #{system}' do
+      it { should contain_file('/etc/ntp.conf').with_owner('0') }
+      it { should contain_file('/etc/ntp.conf').with_group('0') }
+      it { should contain_file('/etc/ntp.conf').with_mode('0644') }
+
+      describe 'allows template to be overridden' do
+        let(:params) {{ :config_template => 'my_ntp/ntp.conf.erb' }}
+        it { should contain_file('/etc/ntp.conf').with({
+          'content' => /server foobar/})
+        }
+      end
+
+      describe "keys for osfamily #{system}" do
+        context "when enabled" do
+          let(:params) {{
+            :keys_enable     => true,
+            :keys_file       => '/etc/ntp/ntp.keys',
+            :keys_trusted    => ['1', '2', '3'],
+            :keys_controlkey => '2',
+            :keys_requestkey => '3',
+          }}
+
+          it { should contain_file('/etc/ntp').with({
+            'ensure'  => 'directory'})
+          }
+          it { should contain_file('/etc/ntp.conf').with({
+            'content' => /trustedkey 1 2 3/})
+          }
+          it { should contain_file('/etc/ntp.conf').with({
+            'content' => /controlkey 2/})
+          }
+          it { should contain_file('/etc/ntp.conf').with({
+            'content' => /requestkey 3/})
+          }
+        end
+      end
+
+      context "when disabled" do
+        let(:params) {{
+          :keys_enable     => false,
+          :keys_file       => '/etc/ntp/ntp.keys',
+          :keys_trusted    => ['1', '2', '3'],
+          :keys_controlkey => '2',
+          :keys_requestkey => '3',
+        }}
+
+        it { should_not contain_file('/etc/ntp').with({
+          'ensure'  => 'directory'})
+        }
+        it { should_not contain_file('/etc/ntp.conf').with({
+          'content' => /trustedkey 1 2 3/})
+        }
+        it { should_not contain_file('/etc/ntp.conf').with({
+          'content' => /controlkey 2/})
+        }
+        it { should_not contain_file('/etc/ntp.conf').with({
+          'content' => /requestkey 3/})
+        }
+      end
+
+      describe 'preferred servers' do
+        context "when set" do
+          let(:params) {{
+            :servers           => ['a', 'b', 'c', 'd'],
+            :preferred_servers => ['a', 'b']
+          }}
+
+          it { should contain_file('/etc/ntp.conf').with({
+            'content' => /server a prefer\nserver b prefer\nserver c\nserver d/})
+          }
+        end
+        context "when not set" do
+          let(:params) {{
+            :servers           => ['a', 'b', 'c', 'd'],
+            :preferred_servers => []
+          }}
+
+          it { should_not contain_file('/etc/ntp.conf').with({
+            'content' => /server a prefer/})
+          }
+        end
+      end
+
+      describe 'ntp::install on #{system}' do
+        let(:params) {{ :package_ensure => 'present', :package_name => ['ntp'], }}
+
+        it { should contain_package('ntp').with(
+          :ensure => 'present',
+          :name   => 'ntp'
+        )}
+
+        describe 'should allow package ensure to be overridden' do
+          let(:params) {{ :package_ensure => 'latest', :package_name => ['ntp'] }}
+          it { should contain_package('ntp').with_ensure('latest') }
+        end
+
+        describe 'should allow the package name to be overridden' do
+          let(:params) {{ :package_ensure => 'present', :package_name => ['hambaby'] }}
+          it { should contain_package('ntp').with_name('hambaby') }
+        end
+      end
+
+      describe 'ntp::service' do
+        let(:params) {{
+          :service_manage => true,
+          :service_enable => true,
+          :service_ensure => 'running',
+          :service_name   => 'ntp'
+        }}
+
+        describe 'with defaults' do
+          it { should contain_service('ntp').with(
+            :enable => true,
+            :ensure => 'running',
+            :name   => 'ntp'
+          )}
+        end
+
+        describe 'service_ensure' do
+          describe 'when overridden' do
+            let(:params) {{ :service_name => 'ntp', :service_ensure => 'stopped' }}
+            it { should contain_service('ntp').with_ensure('stopped') }
+          end
+        end
+
+        describe 'service_manage' do
+          let(:params) {{
+            :service_manage => false,
+            :service_enable => true,
+            :service_ensure => 'running',
+            :service_name   => 'ntpd',
+          }}
+
+          it 'when set to false' do
+            should_not contain_service('ntp').with({
+              'enable' => true,
+              'ensure' => 'running',
+              'name'   => 'ntpd'
+            })
+          end
+        end
+      end
+    end
+
+    context 'ntp::config' do
+      describe "for operating system Gentoo" do
+        let(:facts) {{ :operatingsystem => 'Gentoo',
+                       :osfamily        => 'Linux' }}
+
+        it 'uses the NTP pool servers by default' do
+          should contain_file('/etc/ntp.conf').with({
+            'content' => /server \d.gentoo.pool.ntp.org/,
+          })
+        end
+      end
+      describe "on osfamily Debian" do
+        let(:facts) {{ :osfamily => 'debian' }}
+
+        it 'uses the debian ntp servers by default' do
+          should contain_file('/etc/ntp.conf').with({
+            'content' => /server \d.debian.pool.ntp.org iburst/,
+          })
+        end
+      end
+
+      describe "on osfamily RedHat" do
+        let(:facts) {{ :osfamily => 'RedHat' }}
+
+        it 'uses the redhat ntp servers by default' do
+          should contain_file('/etc/ntp.conf').with({
+            'content' => /server \d.centos.pool.ntp.org/,
+          })
+        end
+      end
+
+      describe "on osfamily SuSE" do
+        let(:facts) {{ :osfamily => 'SuSE' }}
+
+        it 'uses the opensuse ntp servers by default' do
+          should contain_file('/etc/ntp.conf').with({
+            'content' => /server \d.opensuse.pool.ntp.org/,
+          })
+        end
+      end
+
+      describe "on osfamily FreeBSD" do
+        let(:facts) {{ :osfamily => 'FreeBSD' }}
+
+        it 'uses the freebsd ntp servers by default' do
+          should contain_file('/etc/ntp.conf').with({
+            'content' => /server \d.freebsd.pool.ntp.org iburst maxpoll 9/,
+          })
+        end
+      end
+
+      describe "on osfamily ArchLinux" do
+        let(:facts) {{ :osfamily => 'ArchLinux' }}
+
+        it 'uses the NTP pool servers by default' do
+          should contain_file('/etc/ntp.conf').with({
+            'content' => /server \d.pool.ntp.org/,
+          })
+        end
+      end
+
+      describe "for operating system family unsupported" do
+        let(:facts) {{
+          :osfamily  => 'unsupported',
+        }}
+
+        it { expect{ subject }.to raise_error(
+          /^The ntp module is not supported on an unsupported based system./
+        )}
+      end
+    end
+
+    describe 'for virtual machines' do
+      let(:facts) {{ :osfamily        => 'Archlinux',
+                     :is_virtual      => 'true' }}
+
+      it 'should not use local clock as a time source' do
+        should_not contain_file('/etc/ntp.conf').with({
+          'content' => /server.*127.127.1.0.*fudge.*127.127.1.0 stratum 10/,
+        })
+      end
+
+      it 'allows large clock skews' do
+        should contain_file('/etc/ntp.conf').with({
+          'content' => /tinker panic 0/,
+        })
+      end
+    end
+
+    describe 'for physical machines' do
+      let(:facts) {{ :osfamily        => 'Archlinux',
+                     :is_virtual      => 'false' }}
+
+      it 'disallows large clock skews' do
+        should_not contain_file('/etc/ntp.conf').with({
+          'content' => /tinker panic 0/,
+        })
+      end
+    end
+  end
+
+end
diff --git a/puppet/modules/ntp/spec/fixtures/modules/my_ntp/templates/ntp.conf.erb b/puppet/modules/ntp/spec/fixtures/modules/my_ntp/templates/ntp.conf.erb
new file mode 100644
index 00000000..40cf67c6
--- /dev/null
+++ b/puppet/modules/ntp/spec/fixtures/modules/my_ntp/templates/ntp.conf.erb
@@ -0,0 +1,4 @@
+#my uber ntp config
+#
+
+server foobar
diff --git a/puppet/modules/ntp/spec/spec.opts b/puppet/modules/ntp/spec/spec.opts
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/ntp/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/ntp/spec/spec_helper.rb b/puppet/modules/ntp/spec/spec_helper.rb
new file mode 100644
index 00000000..2c6f5664
--- /dev/null
+++ b/puppet/modules/ntp/spec/spec_helper.rb
@@ -0,0 +1 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
diff --git a/puppet/modules/ntp/spec/spec_helper_system.rb b/puppet/modules/ntp/spec/spec_helper_system.rb
new file mode 100644
index 00000000..d5208463
--- /dev/null
+++ b/puppet/modules/ntp/spec/spec_helper_system.rb
@@ -0,0 +1,26 @@
+require 'rspec-system/spec_helper'
+require 'rspec-system-puppet/helpers'
+require 'rspec-system-serverspec/helpers'
+include Serverspec::Helper::RSpecSystem
+include Serverspec::Helper::DetectOS
+include RSpecSystemPuppet::Helpers
+
+RSpec.configure do |c|
+  # Project root
+  proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+
+  # Enable colour
+  c.tty = true
+
+  c.include RSpecSystemPuppet::Helpers
+
+  # This is where we 'setup' the nodes before running our tests
+  c.before :suite do
+    # Install puppet
+    puppet_install
+
+    # Install modules and dependencies
+    puppet_module_install(:source => proj_root, :module_name => 'ntp')
+    shell('puppet module install puppetlabs-stdlib')
+  end
+end
diff --git a/puppet/modules/ntp/spec/system/basic_spec.rb b/puppet/modules/ntp/spec/system/basic_spec.rb
new file mode 100644
index 00000000..7b717a04
--- /dev/null
+++ b/puppet/modules/ntp/spec/system/basic_spec.rb
@@ -0,0 +1,13 @@
+require 'spec_helper_system'
+
+# Here we put the more basic fundamental tests, ultra obvious stuff.
+describe "basic tests:" do
+  context 'make sure we have copied the module across' do
+    # No point diagnosing any more if the module wasn't copied properly
+    context shell 'ls /etc/puppet/modules/ntp' do
+      its(:stdout) { should =~ /Modulefile/ }
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should be_zero }
+    end
+  end
+end
diff --git a/puppet/modules/ntp/spec/system/class_spec.rb b/puppet/modules/ntp/spec/system/class_spec.rb
new file mode 100644
index 00000000..49dfc641
--- /dev/null
+++ b/puppet/modules/ntp/spec/system/class_spec.rb
@@ -0,0 +1,39 @@
+require 'spec_helper_system'
+
+describe "ntp class:" do
+  context 'should run successfully' do
+    pp = "class { 'ntp': }"
+
+    context puppet_apply(pp) do
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should_not == 1 }
+      its(:refresh) { should be_nil }
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should be_zero }
+    end
+  end
+
+  context 'service_ensure => stopped:' do
+    pp = "class { 'ntp': service_ensure => stopped }"
+
+    context puppet_apply(pp) do
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should_not == 1 }
+      its(:refresh) { should be_nil }
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should be_zero }
+    end
+  end
+
+  context 'service_ensure => running:' do
+    pp = "class { 'ntp': service_ensure => running }"
+
+    context puppet_apply(pp) do |r|
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should_not == 1 }
+      its(:refresh) { should be_nil }
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should be_zero }
+    end
+  end
+end
diff --git a/puppet/modules/ntp/spec/system/ntp_config_spec.rb b/puppet/modules/ntp/spec/system/ntp_config_spec.rb
new file mode 100644
index 00000000..194cdf10
--- /dev/null
+++ b/puppet/modules/ntp/spec/system/ntp_config_spec.rb
@@ -0,0 +1,35 @@
+require 'spec_helper_system'
+
+describe 'ntp::config class' do
+  let(:os) {
+    node.facts['osfamily']
+  }
+
+  puppet_apply(%{
+    class { 'ntp': }
+  })
+
+  case node.facts['osfamily']
+  when 'FreeBSD'
+    line = '0.freebsd.pool.ntp.org iburst maxpoll 9'
+  when 'Debian'
+    line = '0.debian.pool.ntp.org iburst'
+  when 'RedHat'
+    line = '0.centos.pool.ntp.org'
+  when 'SuSE'
+    line = '0.opensuse.pool.ntp.org'
+  when 'Linux'
+    case node.facts['operatingsystem']
+    when 'ArchLinux'
+      line = '0.pool.ntp.org'
+    when 'Gentoo'
+      line = '0.gentoo.pool.ntp.org'
+    end
+  end
+
+  describe file('/etc/ntp.conf') do
+    it { should be_file }
+    it { should contain line }
+  end
+
+end
diff --git a/puppet/modules/ntp/spec/system/ntp_install_spec.rb b/puppet/modules/ntp/spec/system/ntp_install_spec.rb
new file mode 100644
index 00000000..39759c5e
--- /dev/null
+++ b/puppet/modules/ntp/spec/system/ntp_install_spec.rb
@@ -0,0 +1,31 @@
+require 'spec_helper_system'
+
+
+describe 'ntp::install class' do
+  let(:os) {
+    node.facts['osfamily']
+  }
+
+  case node.facts['osfamily']
+  when 'FreeBSD'
+    packagename = 'net/ntp'
+  when 'Linux'
+    case node.facts['operatingsystem']
+    when 'ArchLinux'
+      packagename = 'ntp'
+    when 'Gentoo'
+      packagename = 'net-misc/ntp'
+    end
+  else
+    packagename = 'ntp'
+  end
+
+  puppet_apply(%{
+    class { 'ntp': }
+  })
+
+  describe package(packagename) do
+    it { should be_installed }
+  end
+
+end
diff --git a/puppet/modules/ntp/spec/system/ntp_service_spec.rb b/puppet/modules/ntp/spec/system/ntp_service_spec.rb
new file mode 100644
index 00000000..b97e2a4e
--- /dev/null
+++ b/puppet/modules/ntp/spec/system/ntp_service_spec.rb
@@ -0,0 +1,25 @@
+require 'spec_helper_system'
+
+
+describe 'ntp::service class' do
+  let(:os) {
+    node.facts['osfamily']
+  }
+
+  case node.facts['osfamily']
+  when 'RedHat', 'FreeBSD', 'Linux'
+    servicename = 'ntpd'
+  else
+    servicename = 'ntp'
+  end
+
+  puppet_apply(%{
+    class { 'ntp': }
+  })
+
+  describe service(servicename) do
+    it { should be_enabled }
+    it { should be_running }
+  end
+
+end
diff --git a/puppet/modules/ntp/spec/system/preferred_servers_spec.rb b/puppet/modules/ntp/spec/system/preferred_servers_spec.rb
new file mode 100644
index 00000000..686861bc
--- /dev/null
+++ b/puppet/modules/ntp/spec/system/preferred_servers_spec.rb
@@ -0,0 +1,20 @@
+require 'spec_helper_system'
+
+describe 'preferred servers' do
+  it 'applies cleanly' do
+    puppet_apply(%{
+      class { '::ntp':
+        servers           => ['a', 'b', 'c', 'd'],
+        preferred_servers => ['c', 'd'],
+      }
+    })
+  end
+
+  describe file('/etc/ntp.conf') do
+    it { should be_file }
+    it { should contain 'server a' }
+    it { should contain 'server b' }
+    it { should contain 'server c prefer' }
+    it { should contain 'server d prefer' }
+  end
+end
diff --git a/puppet/modules/ntp/spec/system/restrict_spec.rb b/puppet/modules/ntp/spec/system/restrict_spec.rb
new file mode 100644
index 00000000..ae23bc01
--- /dev/null
+++ b/puppet/modules/ntp/spec/system/restrict_spec.rb
@@ -0,0 +1,20 @@
+require 'spec_helper_system'
+
+describe "ntp class with restrict:" do
+  context 'should run successfully' do
+    pp = "class { 'ntp': restrict => ['test restrict']}"
+
+    context puppet_apply(pp) do
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should_not == 1 }
+      its(:refresh) { should be_nil }
+      its(:stderr) { should be_empty }
+      its(:exit_code) { should be_zero }
+    end
+  end
+
+  describe file('/etc/ntp.conf') do
+    it { should contain('test restrict') }
+  end
+
+end
diff --git a/puppet/modules/ntp/spec/unit/puppet/provider/README.markdown b/puppet/modules/ntp/spec/unit/puppet/provider/README.markdown
new file mode 100644
index 00000000..70258502
--- /dev/null
+++ b/puppet/modules/ntp/spec/unit/puppet/provider/README.markdown
@@ -0,0 +1,4 @@
+Provider Specs
+==============
+
+Define specs for your providers under this directory.
diff --git a/puppet/modules/ntp/spec/unit/puppet/type/README.markdown b/puppet/modules/ntp/spec/unit/puppet/type/README.markdown
new file mode 100644
index 00000000..1ee19ac8
--- /dev/null
+++ b/puppet/modules/ntp/spec/unit/puppet/type/README.markdown
@@ -0,0 +1,4 @@
+Resource Type Specs
+===================
+
+Define specs for your resource types in this directory.
diff --git a/puppet/modules/ntp/templates/ntp.conf.erb b/puppet/modules/ntp/templates/ntp.conf.erb
new file mode 100644
index 00000000..94b36755
--- /dev/null
+++ b/puppet/modules/ntp/templates/ntp.conf.erb
@@ -0,0 +1,43 @@
+# ntp.conf: Managed by puppet.
+#
+<% if @panic == false -%>
+# Keep ntpd from panicking in the event of a large clock skew
+# when a VM guest is suspended and resumed.
+tinker panic 0
+<% end -%>
+
+<% if @restrict != [] -%>
+# Permit time synchronization with our time source, but do not'
+# permit the source to query or modify the service on this system.'
+<% @restrict.flatten.each do |restrict| -%>
+<%= restrict %>
+<% end %>
+<% end -%>
+
+# Servers
+<% [@servers].flatten.each do |server| -%>
+server <%= server %><% if @preferred_servers.include?(server) -%> prefer<% end %>
+<% end -%>
+
+<% if scope.lookupvar('::is_virtual') == "false" -%>
+# Undisciplined Local Clock. This is a fake driver intended for backup
+# and when no outside source of synchronized time is available. 
+server	127.127.1.0	# local clock
+fudge	127.127.1.0 stratum 10	
+<% end -%>
+
+# Driftfile.
+driftfile <%= @driftfile %>
+
+<% if @keys_enable -%>
+keys <%= @keys_file %>
+<% unless @keys_trusted.empty? -%>
+trustedkey <%= @keys_trusted.join(' ') %>
+<% end -%>
+<% if @keys_requestkey != '' -%>
+requestkey <%= @keys_requestkey %>
+<% end -%>
+<% if @keys_controlkey != '' -%>
+controlkey <%= @keys_controlkey %>
+<% end -%>
+<% end -%>
diff --git a/puppet/modules/ntp/tests/init.pp b/puppet/modules/ntp/tests/init.pp
new file mode 100644
index 00000000..e6d9b537
--- /dev/null
+++ b/puppet/modules/ntp/tests/init.pp
@@ -0,0 +1,11 @@
+node default {
+
+  notify { 'enduser-before': }
+  notify { 'enduser-after': }
+
+  class { 'ntp':
+    require => Notify['enduser-before'],
+    before  => Notify['enduser-after'],
+  }
+
+}
-- 
cgit v1.2.3


From 1f231f09a9b6911b2ca57ac82235c6028922d54f Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:35 -0400
Subject: git subrepo clone https://leap.se/git/puppet_git puppet/modules/git

subrepo:
  subdir:   "puppet/modules/git"
  merged:   "ba5dd8d"
upstream:
  origin:   "https://leap.se/git/puppet_git"
  branch:   "master"
  commit:   "ba5dd8d"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ic7edc42aa0639e51cfa1873ec265e20e25f0a4f4
---
 puppet/modules/git/.gitrepo                        |  11 ++
 puppet/modules/git/files/config/CentOS/git-daemon  |  26 ++++
 .../git/files/config/CentOS/git-daemon.vhosts      |  27 ++++
 puppet/modules/git/files/config/Debian/git-daemon  |  22 +++
 puppet/modules/git/files/init.d/CentOS/git-daemon  |  75 ++++++++++
 puppet/modules/git/files/init.d/Debian/git-daemon  | 151 +++++++++++++++++++++
 puppet/modules/git/files/web/gitweb.conf           |  53 ++++++++
 puppet/modules/git/files/xinetd.d/git              |  16 +++
 puppet/modules/git/files/xinetd.d/git.disabled     |  16 +++
 puppet/modules/git/files/xinetd.d/git.vhosts       |  16 +++
 puppet/modules/git/manifests/base.pp               |   7 +
 puppet/modules/git/manifests/centos.pp             |   2 +
 puppet/modules/git/manifests/changes.pp            |  33 +++++
 puppet/modules/git/manifests/clone.pp              |  60 ++++++++
 puppet/modules/git/manifests/daemon.pp             |  17 +++
 puppet/modules/git/manifests/daemon/base.pp        |  31 +++++
 puppet/modules/git/manifests/daemon/centos.pp      |  19 +++
 puppet/modules/git/manifests/daemon/disable.pp     |  33 +++++
 puppet/modules/git/manifests/daemon/vhosts.pp      |  10 ++
 puppet/modules/git/manifests/debian.pp             |   6 +
 puppet/modules/git/manifests/init.pp               |  25 ++++
 puppet/modules/git/manifests/svn.pp                |  10 ++
 puppet/modules/git/manifests/web.pp                |  20 +++
 puppet/modules/git/manifests/web/absent.pp         |  17 +++
 puppet/modules/git/manifests/web/lighttpd.pp       |   7 +
 puppet/modules/git/manifests/web/repo.pp           |  56 ++++++++
 puppet/modules/git/manifests/web/repo/lighttpd.pp  |  16 +++
 puppet/modules/git/templates/web/config            |  31 +++++
 puppet/modules/git/templates/web/lighttpd          |  21 +++
 29 files changed, 834 insertions(+)
 create mode 100644 puppet/modules/git/.gitrepo
 create mode 100644 puppet/modules/git/files/config/CentOS/git-daemon
 create mode 100644 puppet/modules/git/files/config/CentOS/git-daemon.vhosts
 create mode 100644 puppet/modules/git/files/config/Debian/git-daemon
 create mode 100644 puppet/modules/git/files/init.d/CentOS/git-daemon
 create mode 100644 puppet/modules/git/files/init.d/Debian/git-daemon
 create mode 100644 puppet/modules/git/files/web/gitweb.conf
 create mode 100644 puppet/modules/git/files/xinetd.d/git
 create mode 100644 puppet/modules/git/files/xinetd.d/git.disabled
 create mode 100644 puppet/modules/git/files/xinetd.d/git.vhosts
 create mode 100644 puppet/modules/git/manifests/base.pp
 create mode 100644 puppet/modules/git/manifests/centos.pp
 create mode 100644 puppet/modules/git/manifests/changes.pp
 create mode 100644 puppet/modules/git/manifests/clone.pp
 create mode 100644 puppet/modules/git/manifests/daemon.pp
 create mode 100644 puppet/modules/git/manifests/daemon/base.pp
 create mode 100644 puppet/modules/git/manifests/daemon/centos.pp
 create mode 100644 puppet/modules/git/manifests/daemon/disable.pp
 create mode 100644 puppet/modules/git/manifests/daemon/vhosts.pp
 create mode 100644 puppet/modules/git/manifests/debian.pp
 create mode 100644 puppet/modules/git/manifests/init.pp
 create mode 100644 puppet/modules/git/manifests/svn.pp
 create mode 100644 puppet/modules/git/manifests/web.pp
 create mode 100644 puppet/modules/git/manifests/web/absent.pp
 create mode 100644 puppet/modules/git/manifests/web/lighttpd.pp
 create mode 100644 puppet/modules/git/manifests/web/repo.pp
 create mode 100644 puppet/modules/git/manifests/web/repo/lighttpd.pp
 create mode 100644 puppet/modules/git/templates/web/config
 create mode 100644 puppet/modules/git/templates/web/lighttpd

(limited to 'puppet/modules')

diff --git a/puppet/modules/git/.gitrepo b/puppet/modules/git/.gitrepo
new file mode 100644
index 00000000..5b10e73e
--- /dev/null
+++ b/puppet/modules/git/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_git
+	branch = master
+	commit = ba5dd8d5c8e09d521ff49f1ebc753601e449f828
+	parent = 984375bab6546a7ef1e716402468a2f4cb6e1925
+	cmdver = 0.3.0
diff --git a/puppet/modules/git/files/config/CentOS/git-daemon b/puppet/modules/git/files/config/CentOS/git-daemon
new file mode 100644
index 00000000..a9b208c2
--- /dev/null
+++ b/puppet/modules/git/files/config/CentOS/git-daemon
@@ -0,0 +1,26 @@
+# git-daemon config file
+
+# location of the lockfile
+#LOCKFILE=/var/lock/subsys/git-daemon
+
+# which directory to server
+#GITDIR=/srv/git
+
+# do we serve vhosts?
+# setting this to yes assumes that you 
+# have in $GITDIR per vhost to serve
+# a subdirectory containing their repos.
+# for example:
+# - /srv/git/git.example.com
+# - /srv/git/git.example.org
+#GITVHOST=no
+
+# the user git-daemon should run with
+#GITUSER=nobody
+
+# options for the daemon
+#OPTIONS="--reuseaddr --verbose --detach"
+
+# location of the daemon
+#GITDAEMON=/usr/bin/git-daemon
+
diff --git a/puppet/modules/git/files/config/CentOS/git-daemon.vhosts b/puppet/modules/git/files/config/CentOS/git-daemon.vhosts
new file mode 100644
index 00000000..62bb9d4b
--- /dev/null
+++ b/puppet/modules/git/files/config/CentOS/git-daemon.vhosts
@@ -0,0 +1,27 @@
+# git-daemon config file
+
+# location of the lockfile
+#LOCKFILE=/var/lock/subsys/git-daemon
+
+# which directory to server
+#GITDIR=/srv/git
+
+# do we serve vhosts?
+# setting this to yes assumes that you 
+# have in $GITDIR per vhost to serve
+# a subdirectory containing their repos.
+# for example:
+# - /srv/git/git.example.com
+# - /srv/git/git.example.org
+#GITVHOST=no
+GITVHOST=yes
+
+# the user git-daemon should run with
+#GITUSER=nobody
+
+# options for the daemon
+#OPTIONS="--reuseaddr --verbose --detach"
+
+# location of the daemon
+#GITDAEMON=/usr/bin/git-daemon
+
diff --git a/puppet/modules/git/files/config/Debian/git-daemon b/puppet/modules/git/files/config/Debian/git-daemon
new file mode 100644
index 00000000..b25e1e7f
--- /dev/null
+++ b/puppet/modules/git/files/config/Debian/git-daemon
@@ -0,0 +1,22 @@
+# Defaults for the git-daemon initscript
+
+# Set to yes to start git-daemon
+RUN=yes
+
+# Set to the user and group git-daemon should run as
+USER=nobody
+GROUP=nogroup
+
+# Set the base path and the directory where the repositories are.
+REPOSITORIES="/srv/git"
+
+# Provide a way to have custom setup.
+#
+# Note, when ADVANCED_OPTS is defined the REPOSITORIES setting is ignored,
+# so take good care to specify exactly what git-daemon have to do.
+#
+# Here is an example from the man page:
+#ADVANCED_OPTS="--verbose --export-all \
+#               --interpolated-path=/pub/%IP/%D \
+#               /pub/192.168.1.200/software \
+#               /pub/10.10.220.23/software"
diff --git a/puppet/modules/git/files/init.d/CentOS/git-daemon b/puppet/modules/git/files/init.d/CentOS/git-daemon
new file mode 100644
index 00000000..aed20756
--- /dev/null
+++ b/puppet/modules/git/files/init.d/CentOS/git-daemon
@@ -0,0 +1,75 @@
+#!/bin/bash
+# puppet        Init script for running the git-daemon
+#
+# Author:       Marcel Haerry <mh+rpms(at)immerda.ch>
+#
+# chkconfig: - 98 02
+#
+# description: Enables the git-daemon to serve various directories. By default it serves /srv/git
+# processname: git-daemon
+# config: /etc/sysconfig/git-daemon
+
+PATH=/usr/bin:/sbin:/bin:/usr/sbin
+export PATH
+
+[ -f /etc/sysconfig/git-daemon ] && . /etc/sysconfig/git-daemon
+lockfile=${LOCKFILE-/var/lock/subsys/git-daemon}
+gitdir=${GITDIR-/srv/git}
+gitvhost=${GITVHOST-no}
+user=${GITUSER-nobody}
+options=${OPTIONS-"--reuseaddr --verbose --detach"}
+gitdaemon=${GITDAEMON-/usr/bin/git-daemon}
+RETVAL=0
+
+gitoptions="--user=${user} ${options}"
+if [ $gitvhost = yes ]; then
+	gitoptions="${gitoptions} --interpolated-path=${gitdir}/%H/%D"
+else
+	gitoptions="${gitoptions} --base-path=${gitdir}"
+fi
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+start() {
+    echo -n $"Starting git-daemon: "
+    daemon $gitdaemon $gitoptions
+    RETVAL=$?
+    echo
+    [ $RETVAL = 0 ] && touch ${lockfile}
+    return $RETVAL
+}
+
+stop() {
+    echo -n $"Stopping git-daemon: "
+    killproc $gitdaemon
+    RETVAL=$?
+    echo
+    [ $RETVAL = 0 ] && rm -f ${lockfile}
+}
+
+restart() {
+    stop
+    start
+}
+
+case "$1" in
+  start)
+    start
+    ;;
+  stop) 
+    stop
+    ;;
+  restart)
+    restart
+    ;;
+  status)
+    status $gitdaemon
+    RETVAL=$?
+    ;;
+  *)
+    echo $"Usage: $0 {start|stop|status|restart}"
+    exit 1
+esac
+
+exit $RETVAL
diff --git a/puppet/modules/git/files/init.d/Debian/git-daemon b/puppet/modules/git/files/init.d/Debian/git-daemon
new file mode 100644
index 00000000..ab57c4a1
--- /dev/null
+++ b/puppet/modules/git/files/init.d/Debian/git-daemon
@@ -0,0 +1,151 @@
+#! /bin/sh
+### BEGIN INIT INFO
+# Provides:          git-daemon
+# Required-Start:    $network $remote_fs $syslog
+# Required-Stop:     $network $remote_fs $syslog
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: git-daemon service
+# Description:       git-daemon makes git repositories available via the git
+#                    protocol.
+### END INIT INFO
+
+# Author: Antonio Ospite <ospite@studenti.unina.it>
+#
+# Please remove the "Author" lines above and replace them
+# with your own name if you copy and modify this script.
+
+# Do NOT "set -e"
+
+# PATH should only include /usr/* if it runs after the mountnfs.sh script
+PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/lib/git-core
+DESC="git-daemon service"
+NAME=git-daemon
+DAEMON=/usr/lib/git-core/$NAME
+PIDFILE=/var/run/$NAME.pid
+SCRIPTNAME=/etc/init.d/$NAME
+
+# Exit if the package is not installed
+[ -x "$DAEMON" ] || exit 0
+
+# Fallback options values, we use these when
+# the /etc/default/git-daemon file does not exist
+RUN=no
+USER=git
+GROUP=git
+REPOSITORIES="/srv/git/"
+
+# Read configuration variable file if it is present
+[ -r /etc/default/$NAME ] && . /etc/default/$NAME
+
+# If ADVANCED_OPTS is empty, use a default setting
+if [ "x$ADVANCED_OPTS" == "x" ];
+then
+  ADVANCED_OPTS="--base-path=$REPOSITORIES $REPOSITORIES"
+fi
+
+DAEMON_ARGS="--syslog --reuseaddr \
+             --user=$USER --group=$GROUP \
+             $ADVANCED_OPTS"
+
+
+# Load the VERBOSE setting and other rcS variables
+. /lib/init/vars.sh
+
+# Define LSB log_* functions.
+# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
+. /lib/lsb/init-functions
+
+#
+# Function that starts the daemon/service
+#
+do_start()
+{
+	# Return
+	#   0 if daemon has been started
+	#   1 if daemon was already running
+	#   2 if daemon could not be started
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
+		|| return 1
+	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --background --make-pidfile -- \
+		$DAEMON_ARGS \
+		|| return 2
+
+  return 0
+}
+
+#
+# Function that stops the daemon/service
+#
+do_stop()
+{
+	# Return
+	#   0 if daemon has been stopped
+	#   1 if daemon was already stopped
+	#   2 if daemon could not be stopped
+	#   other if a failure occurred
+	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
+	RETVAL="$?"
+	[ "$RETVAL" = 2 ] && return 2
+	# Wait for children to finish too if this is a daemon that forks
+	# and if the daemon is only ever run from this initscript.
+	# If the above conditions are not satisfied then add some other code
+	# that waits for the process to drop all resources that could be
+	# needed by services started subsequently.  A last resort is to
+	# sleep for some time.
+	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
+	[ "$?" = 2 ] && return 2
+	# Many daemons don't delete their pidfiles when they exit.
+	rm -f $PIDFILE
+	return "$RETVAL"
+}
+
+case "$1" in
+  start)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
+	do_start
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  stop)
+	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
+	do_stop
+	case "$?" in
+		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
+		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
+	esac
+	;;
+  status)
+       status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
+       ;;
+  restart|force-reload)
+	#
+	# If the "reload" option is implemented then remove the
+	# 'force-reload' alias
+	#
+	log_daemon_msg "Restarting $DESC" "$NAME"
+	do_stop
+	case "$?" in
+	  0|1)
+		do_start
+		case "$?" in
+			0) log_end_msg 0 ;;
+			1) log_end_msg 1 ;; # Old process is still running
+			*) log_end_msg 1 ;; # Failed to start
+		esac
+		;;
+	  *)
+	  	# Failed to stop
+		log_end_msg 1
+		;;
+	esac
+	;;
+  *)
+	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
+	exit 3
+	;;
+esac
+
+:
diff --git a/puppet/modules/git/files/web/gitweb.conf b/puppet/modules/git/files/web/gitweb.conf
new file mode 100644
index 00000000..88226aaa
--- /dev/null
+++ b/puppet/modules/git/files/web/gitweb.conf
@@ -0,0 +1,53 @@
+# The gitweb config file is a fragment of perl code. You can set variables
+# using "our $variable = value"; text from "#" character until the end of a
+# line is ignored. See perlsyn(1) man page for details.
+#
+# See /usr/share/doc/gitweb-*/README and /usr/share/doc/gitweb-*/INSTALL for
+# more details and available configuration variables.
+
+# Set the path to git projects.  This is an absolute filesystem path which will
+# be prepended to the project path.
+#our $projectroot = "/var/lib/git";
+
+# Set the list of git base URLs used for URL to where fetch project from, i.e.
+# the full URL is "$git_base_url/$project". By default this is empty
+#our @git_base_url_list = qw(git://git.example.com
+#                            ssh://git.example.com/var/lib/git);
+
+# Enable the 'blame' blob view, showing the last commit that modified
+# each line in the file. This can be very CPU-intensive. Disabled by default
+#$feature{'blame'}{'default'} = [1];
+#
+# Allow projects to override the default setting via git config file.
+# Example: gitweb.blame = 0|1;
+#$feature{'blame'}{'override'} = 1;
+
+# Disable the 'snapshot' link, providing a compressed archive of any tree. This
+# can potentially generate high traffic if you have large project. Enabled for
+# .tar.gz snapshots by default.
+#
+# Value is a list of formats defined in %known_snapshot_formats that you wish
+# to offer.
+#$feature{'snapshot'}{'default'} = [];
+#
+# Allow projects to override the default setting via git config file.
+# Example: gitweb.snapshot = tbz2,zip; (use "none" to disable)
+#$feature{'snapshot'}{'override'} = 1;
+
+# Disable grep search, which will list the files in currently selected tree
+# containing the given string. This can be potentially CPU-intensive, of
+# course. Enabled by default.
+#$feature{'grep'}{'default'} = [0];
+#
+# Allow projects to override the default setting via git config file.
+# Example: gitweb.grep = 0|1;
+#$feature{'grep'}{'override'} = 1;
+
+# Disable the pickaxe search, which will list the commits that modified a given
+# string in a file. This can be practical and quite faster alternative to
+# 'blame', but still potentially CPU-intensive. Enabled by default.
+#$feature{'pickaxe'}{'default'} = [0];
+#
+# Allow projects to override the default setting via git config file.
+# Example: gitweb.pickaxe = 0|1;
+#$feature{'pickaxe'}{'override'} = 1;
diff --git a/puppet/modules/git/files/xinetd.d/git b/puppet/modules/git/files/xinetd.d/git
new file mode 100644
index 00000000..64c53e8b
--- /dev/null
+++ b/puppet/modules/git/files/xinetd.d/git
@@ -0,0 +1,16 @@
+# default: off
+# description: The git dæmon allows git repositories to be exported using
+#	the git:// protocol.
+
+service git
+{
+        disable		= no
+        socket_type     = stream
+        wait            = no
+        user            = nobody
+        server          = /usr/bin/git-daemon
+        server_args     = --base-path=/srv/git --export-all --user-path=public_git --syslog --inetd --verbose
+        log_on_failure  += USERID
+# xinetd doesn't do this by default. bug #195265
+        flags		= IPv6
+}
diff --git a/puppet/modules/git/files/xinetd.d/git.disabled b/puppet/modules/git/files/xinetd.d/git.disabled
new file mode 100644
index 00000000..dcfae918
--- /dev/null
+++ b/puppet/modules/git/files/xinetd.d/git.disabled
@@ -0,0 +1,16 @@
+# default: off
+# description: The git dæmon allows git repositories to be exported using
+#	the git:// protocol.
+
+service git
+{
+        disable		= yes
+        socket_type     = stream
+        wait            = no
+        user            = nobody
+        server          = /usr/bin/git-daemon
+        server_args     = --base-path=/srv/git --export-all --user-path=public_git --syslog --inetd --verbose
+        log_on_failure  += USERID
+# xinetd doesn't do this by default. bug #195265
+        flags		= IPv6
+}
diff --git a/puppet/modules/git/files/xinetd.d/git.vhosts b/puppet/modules/git/files/xinetd.d/git.vhosts
new file mode 100644
index 00000000..98938206
--- /dev/null
+++ b/puppet/modules/git/files/xinetd.d/git.vhosts
@@ -0,0 +1,16 @@
+# default: off
+# description: The git dæmon allows git repositories to be exported using
+#	the git:// protocol.
+
+service git
+{
+        disable		= no
+        socket_type     = stream
+        wait            = no
+        user            = nobody
+        server          = /usr/bin/git-daemon
+        server_args     = --interpolated-path=/srv/git/%H/%D --syslog --inetd --verbose
+        log_on_failure  += USERID
+# xinetd doesn't do this by default. bug #195265
+        flags		= IPv6
+}
diff --git a/puppet/modules/git/manifests/base.pp b/puppet/modules/git/manifests/base.pp
new file mode 100644
index 00000000..e6188390
--- /dev/null
+++ b/puppet/modules/git/manifests/base.pp
@@ -0,0 +1,7 @@
+class git::base {
+
+  package { 'git':
+    ensure => present,
+    alias => 'git',
+  }
+}
diff --git a/puppet/modules/git/manifests/centos.pp b/puppet/modules/git/manifests/centos.pp
new file mode 100644
index 00000000..96344756
--- /dev/null
+++ b/puppet/modules/git/manifests/centos.pp
@@ -0,0 +1,2 @@
+class git::centos inherits git::base {
+}
diff --git a/puppet/modules/git/manifests/changes.pp b/puppet/modules/git/manifests/changes.pp
new file mode 100644
index 00000000..71112051
--- /dev/null
+++ b/puppet/modules/git/manifests/changes.pp
@@ -0,0 +1,33 @@
+# Usage
+# git::changes { name:
+#   cwd    =>  "/path/to/git/"
+#   user   =>  "me",
+#   ensure =>  {*assume-unchanged*, tracked}
+# }
+#
+
+define git::changes ( $cwd, $user, $ensure='assume-unchanged' ) {
+
+  case $ensure {
+    default: { err ( "unknown ensure value '${ensure}'" ) }
+
+    assume-unchanged: {
+      exec { "assume-unchanged ${name}":
+        command => "/usr/bin/git update-index --assume-unchanged ${name}",
+        cwd     => $cwd,
+        user    => $user,
+        unless  => "/usr/bin/git ls-files -v | grep '^[ch] ${name}'",
+      }
+    }
+
+    tracked: {
+      exec { "track changes ${name}":
+        command => "/usr/bin/git update-index --no-assume-unchanged ${name}",
+        cwd     => $cwd,
+        user    => $user,
+        onlyif  => "/usr/bin/git ls-files -v | grep '^[ch] ${name}'",
+      }
+    }
+  }
+}
+
diff --git a/puppet/modules/git/manifests/clone.pp b/puppet/modules/git/manifests/clone.pp
new file mode 100644
index 00000000..29f0b2b3
--- /dev/null
+++ b/puppet/modules/git/manifests/clone.pp
@@ -0,0 +1,60 @@
+# submodules: Whether we should initialize and update
+#             submodules as well
+#             Default: false
+# clone_before: before which resources a cloning should
+#               happen. This is releveant in combination
+#               with submodules as the exec of submodules
+#               requires the `cwd` and you might get a
+#               dependency cycle if you manage $projectroot
+#               somewhere else.
+define git::clone(
+  $ensure = present,
+  $git_repo,
+  $projectroot,
+  $submodules = false,
+  $clone_before = 'absent',
+  $cloneddir_user='root',
+  $cloneddir_group='0',
+  $cloneddir_restrict_mode=true
+){
+  case $ensure {
+    absent: {
+      exec{"rm -rf $projectroot":
+        onlyif => "test -d  $projectroot",
+      }
+    }
+    default: {
+      require ::git
+      exec {"git-clone_${name}":
+        command => "git clone --no-hardlinks ${git_repo} ${projectroot}",
+        creates => "${projectroot}/.git",
+        user => root,
+        notify => Exec["git-clone-chown_${name}"],
+      }
+      if $clone_before != 'absent' {
+        Exec["git-clone_${name}"]{
+          before => $clone_before,
+        }
+      }
+      if $submodules {
+        exec{"git-submodules_${name}":
+          command => "git submodule init && git submodule update",
+          cwd => $projectroot,
+          refreshonly => true,
+          subscribe => Exec["git-clone_${name}"],
+        }
+      }
+      exec {"git-clone-chown_${name}":
+        command => "chown -R ${cloneddir_user}:${cloneddir_group} ${projectroot};chmod -R og-rwx ${projectroot}/.git",
+        refreshonly => true
+      }
+      if $cloneddir_restrict_mode {
+        exec {"git-clone-chmod_${name}":
+          command => "chmod -R o-rwx ${projectroot}",
+          refreshonly => true,
+          subscribe => Exec["git-clone_${name}"],
+        }
+      }
+    }
+  }
+}
diff --git a/puppet/modules/git/manifests/daemon.pp b/puppet/modules/git/manifests/daemon.pp
new file mode 100644
index 00000000..1e85ff84
--- /dev/null
+++ b/puppet/modules/git/manifests/daemon.pp
@@ -0,0 +1,17 @@
+class git::daemon {
+
+  include git
+
+  case $operatingsystem {
+    centos: { include git::daemon::centos }
+    debian: { include git::daemon::base }
+  }
+
+  if $use_shorewall {
+    include shorewall::rules::gitdaemon
+  }
+
+  if $use_nagios {
+    nagios::service { "git-daemon": check_command => "check_git!${fqdn}"; }
+  }
+}
diff --git a/puppet/modules/git/manifests/daemon/base.pp b/puppet/modules/git/manifests/daemon/base.pp
new file mode 100644
index 00000000..6a03d4fd
--- /dev/null
+++ b/puppet/modules/git/manifests/daemon/base.pp
@@ -0,0 +1,31 @@
+class git::daemon::base inherits git::base {
+
+  file { 'git-daemon_initscript':
+    source => [ "puppet://$server/modules/site_git/init.d/${fqdn}/git-daemon",
+                "puppet://$server/modules/site_git/init.d/${operatingsystem}/git-daemon",
+                "puppet://$server/modules/site_git/init.d/git-daemon",
+                "puppet://$server/modules/git/init.d/${operatingsystem}/git-daemon",
+                "puppet://$server/modules/git/init.d/git-daemon" ],
+    require => Package['git'],
+    path => "/etc/init.d/git-daemon",
+    owner => root, group => 0, mode => 0755;
+  }
+  
+  file { 'git-daemon_config':
+    source => [ "puppet://$server/modules/site_git/config/${fqdn}/git-daemon",
+                "puppet://$server/modules/site_git/config/${operatingsystem}/git-daemon",
+                "puppet://$server/modules/site_git/config/git-daemon",
+                "puppet://$server/modules/git/config/${operatingsystem}/git-daemon",
+                "puppet://$server/modules/git/config/git-daemon" ],
+    require => Package['git'],
+    path => "/etc/default/git-daemon",
+    owner => root, group => 0, mode => 0644;
+  }
+  
+  service { 'git-daemon':
+    ensure => running,
+    enable => true,
+    hasstatus => true,
+    require => [ File['git-daemon_initscript'], File['git-daemon_config'] ],
+  }
+}
diff --git a/puppet/modules/git/manifests/daemon/centos.pp b/puppet/modules/git/manifests/daemon/centos.pp
new file mode 100644
index 00000000..e276259d
--- /dev/null
+++ b/puppet/modules/git/manifests/daemon/centos.pp
@@ -0,0 +1,19 @@
+class git::daemon::centos inherits git::daemon::base {
+
+  package { 'git-daemon':
+    ensure => installed,
+    require => Package['git'],
+    alias => 'git-daemon',
+  }
+  
+  File['git-daemon_initscript'] {
+    path => '/etc/init.d/git-daemon',
+    require +> Package['git-daemon'],
+  }
+
+  File['git-daemon_config'] {
+    path => '/etc/init.d/git-daemon',
+    require +> Package['git-daemon'],
+  }
+
+}
diff --git a/puppet/modules/git/manifests/daemon/disable.pp b/puppet/modules/git/manifests/daemon/disable.pp
new file mode 100644
index 00000000..c044e962
--- /dev/null
+++ b/puppet/modules/git/manifests/daemon/disable.pp
@@ -0,0 +1,33 @@
+class git::daemon::disable inherits git::daemon::base {
+
+  if defined(Package['git-daemon']) {
+    Package['git-daemon'] {
+      ensure => absent,
+    }
+  }
+
+  File['git-daemon_initscript'] { 
+    ensure => absent,
+  }
+  
+  File['git-daemon_config'] {
+    ensure => absent,
+  }
+  
+  Service['git-daemon'] {
+    ensure => stopped,
+    enable => false,
+    require => undef,
+    before => File['git-daemon_initscript'],
+  }
+
+  if $use_shorewall {
+    include shorewall::rules::gitdaemon::absent
+  }
+
+  if $use_nagios {
+    nagios::service { "git-daemon": check_command => "check_git!${fqdn}", ensure => absent; }
+  }
+}
+
+
diff --git a/puppet/modules/git/manifests/daemon/vhosts.pp b/puppet/modules/git/manifests/daemon/vhosts.pp
new file mode 100644
index 00000000..9591330f
--- /dev/null
+++ b/puppet/modules/git/manifests/daemon/vhosts.pp
@@ -0,0 +1,10 @@
+class git::daemon::vhosts inherits git::daemon {
+
+  File['git-daemon_config']{
+    source => [ "puppet://$server/modules/site_git/config/${fqdn}/git-daemon.vhosts",
+                "puppet://$server/modules/site_git/config/${operatingsystem}/git-daemon.vhosts",
+                "puppet://$server/modules/site_git/config/git-daemon.vhosts",
+                "puppet://$server/modules/git/config/${operatingsystem}/git-daemon.vhosts",
+                "puppet://$server/modules/git/config/git-daemon.vhosts" ],
+  }
+}
diff --git a/puppet/modules/git/manifests/debian.pp b/puppet/modules/git/manifests/debian.pp
new file mode 100644
index 00000000..2e63d692
--- /dev/null
+++ b/puppet/modules/git/manifests/debian.pp
@@ -0,0 +1,6 @@
+class git::debian inherits git::base {
+
+  Package['git'] {
+    name => 'git-core',
+  }
+}
diff --git a/puppet/modules/git/manifests/init.pp b/puppet/modules/git/manifests/init.pp
new file mode 100644
index 00000000..4693af75
--- /dev/null
+++ b/puppet/modules/git/manifests/init.pp
@@ -0,0 +1,25 @@
+#
+# git module
+#
+# Copyright 2008, Puzzle ITC
+# Marcel Härry haerry+puppet(at)puzzle.ch
+# Simon Josi josi+puppet(at)puzzle.ch
+#
+# This program is free software; you can redistribute 
+# it and/or modify it under the terms of the GNU 
+# General Public License version 3 as published by 
+# the Free Software Foundation.
+#
+
+class git {
+
+  case $operatingsystem {
+    debian: { include git::debian }
+    centos: { include git::centos }
+  }
+
+  if $use_shorewall {
+    include shorewall::rules::out::git
+  }
+
+}
diff --git a/puppet/modules/git/manifests/svn.pp b/puppet/modules/git/manifests/svn.pp
new file mode 100644
index 00000000..ea934749
--- /dev/null
+++ b/puppet/modules/git/manifests/svn.pp
@@ -0,0 +1,10 @@
+# manifests/svn.pp
+
+class git::svn {
+  include ::git
+  include subversion
+
+  package { 'git-svn':
+    require => [ Package['git'], Package['subversion'] ],
+  }
+}
diff --git a/puppet/modules/git/manifests/web.pp b/puppet/modules/git/manifests/web.pp
new file mode 100644
index 00000000..3cf5139e
--- /dev/null
+++ b/puppet/modules/git/manifests/web.pp
@@ -0,0 +1,20 @@
+class git::web {
+  include git
+
+  package { 'gitweb':
+    ensure => present,
+    require => Package['git'],
+  }
+
+  file { '/etc/gitweb.d':
+    ensure => directory,
+    owner => root, group => 0, mode => 0755;
+  }
+  file { '/etc/gitweb.conf':
+    source => [ "puppet:///modules/site_git/web/${fqdn}/gitweb.conf",
+                "puppet:///modules/site_git/web/gitweb.conf",
+                "puppet:///modules/git/web/gitweb.conf" ],
+    require => Package['gitweb'],
+    owner => root, group => 0, mode => 0644;
+  }
+}
diff --git a/puppet/modules/git/manifests/web/absent.pp b/puppet/modules/git/manifests/web/absent.pp
new file mode 100644
index 00000000..4d0dba33
--- /dev/null
+++ b/puppet/modules/git/manifests/web/absent.pp
@@ -0,0 +1,17 @@
+class git::web::absent {
+
+  package { 'gitweb':
+    ensure => absent,
+  } 
+
+  file { '/etc/gitweb.d':
+    ensure => absent,
+    purge => true,
+    force => true,
+    recurse => true,
+  } 
+  file { '/etc/gitweb.conf':
+    ensure => absent,
+  } 
+}
+
diff --git a/puppet/modules/git/manifests/web/lighttpd.pp b/puppet/modules/git/manifests/web/lighttpd.pp
new file mode 100644
index 00000000..980e23c0
--- /dev/null
+++ b/puppet/modules/git/manifests/web/lighttpd.pp
@@ -0,0 +1,7 @@
+class git::web::lighttpd {
+  include ::lighttpd 
+
+  lighttpd::config::file{'lighttpd-gitweb':
+    content => 'global { server.modules += ("mod_rewrite", "mod_redirect", "mod_alias", "mod_setenv", "mod_cgi" ) }',
+  }
+}
diff --git a/puppet/modules/git/manifests/web/repo.pp b/puppet/modules/git/manifests/web/repo.pp
new file mode 100644
index 00000000..da6f74f0
--- /dev/null
+++ b/puppet/modules/git/manifests/web/repo.pp
@@ -0,0 +1,56 @@
+# domain: the domain under which this repo will be avaiable
+# projectroot: where the git repos are listened
+# projects_list: which repos to export
+#
+# logmode:
+#   - default: Do normal logging including ips
+#   - anonym: Don't log ips
+define git::web::repo(
+  $ensure = 'present',
+  $projectroot = 'absent',
+  $projects_list = 'absent',
+  $logmode = 'default',
+  $sitename = 'absent'
+){
+  if ($ensure == 'present') and (($projects_list == 'absent') or ($projectroot == 'absent')){
+    fail("You have to pass \$project_list and \$projectroot for ${name} if it should be present!")
+  }
+  if $ensure == 'present' { include git::web }
+  $gitweb_url = $name
+  case $gitweb_sitename {
+    'absent': { $gitweb_sitename = "${name} git repository" }
+    default: { $gitweb_sitename = $sitename }
+  }
+  $gitweb_config = "/etc/gitweb.d/${name}.conf"
+  file{"${gitweb_config}": }
+  if $ensure == 'present' {
+    File["${gitweb_config}"]{
+      content => template("git/web/config")
+    }
+  } else {
+    File["${gitweb_config}"]{
+      ensure => absent,
+    }
+  }
+  case $gitweb_webserver {
+    'lighttpd': {
+      git::web::repo::lighttpd{$name:
+        ensure => $ensure,
+        logmode => $logmode,
+        gitweb_url => $gitweb_url,
+        gitweb_config => $gitweb_config,
+      }
+    }
+    'apache': {
+      apache::vhost::gitweb{$gitweb_url:
+        logmode => $logmode,
+        ensure => $ensure,
+      }
+    }
+    default: {
+      if ($ensure == 'present') {
+        fail("no supported \$gitweb_webserver defined on ${fqdn}, so can't do git::web::repo: ${name}")
+      }
+    }
+  }
+}
diff --git a/puppet/modules/git/manifests/web/repo/lighttpd.pp b/puppet/modules/git/manifests/web/repo/lighttpd.pp
new file mode 100644
index 00000000..11cee4ce
--- /dev/null
+++ b/puppet/modules/git/manifests/web/repo/lighttpd.pp
@@ -0,0 +1,16 @@
+# logmode:
+#   - default: Do normal logging including ips
+#   - anonym: Don't log ips
+define git::web::repo::lighttpd(
+  $ensure = 'present',
+  $gitweb_url,
+  $logmode = 'default',
+  $gitweb_config
+){
+  if $ensure == 'present' { include git::web::lighttpd }
+
+  lighttpd::vhost::file{$name:
+     ensure => $ensure,
+     content => template('git/web/lighttpd');
+  }
+}
diff --git a/puppet/modules/git/templates/web/config b/puppet/modules/git/templates/web/config
new file mode 100644
index 00000000..5286f6a6
--- /dev/null
+++ b/puppet/modules/git/templates/web/config
@@ -0,0 +1,31 @@
+# Include the global configuration, if found.
+do "/etc/gitweb.conf" if -e "/etc/gitweb.conf";
+
+# Point to projects.list file generated by gitosis.
+# Here gitosis manages the user "git", who has a
+# home directory of /srv/example.com/git
+$projects_list = "<%= projects_list %>";
+
+# Where the actual repositories are located.
+$projectroot = "<%= projectroot %>";
+
+# By default, gitweb will happily let people browse any repository
+# they guess the name of. This may or may not be what you wanted.  I
+# choose to allow gitweb to show only repositories that git-daemon
+# is already sharing anonymously.
+$export_ok = "git-daemon-export-ok";
+
+# Alternatively, you could set these, to allow exactly the things in
+# projects.list, which in this case is the repos with gitweb=yes
+# in gitosis.conf. This means you don't need daemon=yes, but you
+# can't have repositories hidden but browsable if you know the name.
+# And note gitweb already allows downloading the full repository,
+# so you might as well serve git-daemon too.
+# $export_ok = "";
+# $strict_export = "true";
+
+# A list of base urls where all the repositories can be cloned from.
+# Easier than having per-repository cloneurl files.
+@git_base_url_list = ('git://<%= gitweb_url %>');
+
+$GITWEB_SITENAME = "<%= gitweb_sitename %>"
diff --git a/puppet/modules/git/templates/web/lighttpd b/puppet/modules/git/templates/web/lighttpd
new file mode 100644
index 00000000..cf244691
--- /dev/null
+++ b/puppet/modules/git/templates/web/lighttpd
@@ -0,0 +1,21 @@
+$HTTP["host"] == "<%= gitweb_url %>" {
+    url.redirect += (
+      "^$" => "/",
+    )
+
+    <%- if logmode.to_s == 'anonym' -%>
+    accesslog.format = "127.0.0.1 %V %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
+    <%- end -%>
+
+    alias.url += (
+      "/static/gitweb.css" => "/var/www/git/static/gitweb.css",
+      "/static/git-logo.png" => "/var/www/git/static/git-logo.png",
+      "/static/git-favicon.png" => "/var/www/git/static/git-favicon.png",
+      "/" => "/var/www/git/gitweb.cgi",
+    )
+
+    setenv.add-environment = (
+      "GITWEB_CONFIG" => "<%= gitweb_config %>"
+    )
+    cgi.assign = ( ".cgi" => "" )
+}
-- 
cgit v1.2.3


From 6083b23278927189de58c11bbb5bc7d93ccced24 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:36 -0400
Subject: git subrepo clone https://leap.se/git/puppet_common
 puppet/modules/common

subrepo:
  subdir:   "puppet/modules/common"
  merged:   "ae14962"
upstream:
  origin:   "https://leap.se/git/puppet_common"
  branch:   "master"
  commit:   "ae14962"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I82a15d5ab5c4e8f689f73de4e5ae97557f39b6fb
---
 puppet/modules/common/.gitrepo                     |  11 +
 puppet/modules/common/LICENSE                      | 674 +++++++++++++++++++++
 puppet/modules/common/README                       |  44 ++
 .../common/lib/puppet/parser/functions/basename.rb |  22 +
 .../common/lib/puppet/parser/functions/dirname.rb  |  22 +
 .../lib/puppet/parser/functions/get_default.rb     |  15 +
 .../common/lib/puppet/parser/functions/hostname.rb |  13 +
 .../parser/functions/multi_source_template.rb      |  29 +
 .../lib/puppet/parser/functions/prefix_with.rb     |   9 +
 .../lib/puppet/parser/functions/re_escape.rb       |   7 +
 .../lib/puppet/parser/functions/slash_escape.rb    |   7 +
 .../lib/puppet/parser/functions/substitute.rb      |  20 +
 .../common/lib/puppet/parser/functions/tfile.rb    |  19 +
 puppet/modules/common/manifests/module_dir.pp      |  34 ++
 puppet/modules/common/manifests/module_file.pp     |  37 ++
 puppet/modules/common/manifests/moduledir.pp       |  18 +
 .../modules/common/manifests/moduledir/common.pp   |   4 +
 puppet/modules/common/spec/spec.opts               |   6 +
 puppet/modules/common/spec/spec_helper.rb          |  16 +
 .../common/spec/unit/parser/functions/tfile.rb     |  54 ++
 20 files changed, 1061 insertions(+)
 create mode 100644 puppet/modules/common/.gitrepo
 create mode 100644 puppet/modules/common/LICENSE
 create mode 100644 puppet/modules/common/README
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/basename.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/dirname.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/get_default.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/hostname.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/multi_source_template.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/prefix_with.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/re_escape.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/slash_escape.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/substitute.rb
 create mode 100644 puppet/modules/common/lib/puppet/parser/functions/tfile.rb
 create mode 100644 puppet/modules/common/manifests/module_dir.pp
 create mode 100644 puppet/modules/common/manifests/module_file.pp
 create mode 100644 puppet/modules/common/manifests/moduledir.pp
 create mode 100644 puppet/modules/common/manifests/moduledir/common.pp
 create mode 100644 puppet/modules/common/spec/spec.opts
 create mode 100644 puppet/modules/common/spec/spec_helper.rb
 create mode 100644 puppet/modules/common/spec/unit/parser/functions/tfile.rb

(limited to 'puppet/modules')

diff --git a/puppet/modules/common/.gitrepo b/puppet/modules/common/.gitrepo
new file mode 100644
index 00000000..7d45d07b
--- /dev/null
+++ b/puppet/modules/common/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_common
+	branch = master
+	commit = ae149624f9bc551865b93b9b7155af2de8deeb71
+	parent = 1f231f09a9b6911b2ca57ac82235c6028922d54f
+	cmdver = 0.3.0
diff --git a/puppet/modules/common/LICENSE b/puppet/modules/common/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/common/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/common/README b/puppet/modules/common/README
new file mode 100644
index 00000000..e6df7663
--- /dev/null
+++ b/puppet/modules/common/README
@@ -0,0 +1,44 @@
+Common Module
+-------------
+
+The common module installs various functions that are required by other
+modules. This module should be installed before any of the other module.
+
+! Upgrade Notice !
+
+The 'append_if_no_such_line' define has been replaced with the 'line' define. If
+you are using 'append_if_no_such_line' anywhere in your manifests, you will need
+to transition to 'line' before upgrading to this version of the common
+module. The 'line' define is a drop-in replacement and essentially equivalent,
+so the transition is quite easy, you should only simply need to change the name
+in your manifests.
+
+To use this module, follow these directions:
+
+1. Your modules directory will need all the files included in this
+   repository placed under a directory called "common"
+
+2. Add the following line to manifests/site.pp:
+   
+       import "modules.pp"
+
+3. Add the following line to manifests/modules.pp:
+
+       import "common"
+
+
+Original author: David Schmitt (mailto:david@dasz.at)
+Copyright:: Copyright (c) 2007-2009 dasz.at OG
+License::   3-clause BSD
+
+Additional authors:
+Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+Copyright 2008-2011, admin(at)immerda.ch
+Copyright 2008, Puzzle ITC GmbH
+ Marcel Härry haerry+puppet(at)puzzle.ch
+ Simon Josi josi+puppet(at)puzzle.ch
+Copyright 2009-2011, Riseup Labs <http://riseuplabs.org>
+ Pietro Ferrari <pietro@riseup.net>
+ Micah Anderson <micah@riseup.net>
+Copyright (C) 2007 Antoine Beaupre <anarcat@koumbit.org>
+Copyright (c) 2011 intrigeri - intrigeri(at)boum.org
\ No newline at end of file
diff --git a/puppet/modules/common/lib/puppet/parser/functions/basename.rb b/puppet/modules/common/lib/puppet/parser/functions/basename.rb
new file mode 100644
index 00000000..dc725375
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/basename.rb
@@ -0,0 +1,22 @@
+# This function has two modes of operation:
+#
+#  basename(string) : string
+#
+# Returns the last component of the filename given as argument, which must be
+# formed using forward slashes ("/") regardless of the separator used on the
+# local file system.
+#
+#  basename(string[]) : string[]
+#
+# Returns an array of strings with the basename of each item from the argument.
+#
+module Puppet::Parser::Functions
+	newfunction(:basename, :type => :rvalue) do |args|
+		if args[0].is_a?(Array)
+			args.collect do |a| File.basename(a) end
+		else
+			File.basename(args[0])
+		end
+	end
+end
+
diff --git a/puppet/modules/common/lib/puppet/parser/functions/dirname.rb b/puppet/modules/common/lib/puppet/parser/functions/dirname.rb
new file mode 100644
index 00000000..ea0d50b4
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/dirname.rb
@@ -0,0 +1,22 @@
+# This function has two modes of operation:
+# 
+#  dirname(string) : string
+#
+# Returns all components of the filename given as argument except the last
+# one. The filename must be formed using forward slashes (``/..) regardless of
+# the separator used on the local file system.
+#
+#  dirname(string[]) : string[]
+#
+# Returns an array of strings with the basename of each item from the argument. 
+#
+module Puppet::Parser::Functions
+	newfunction(:dirname, :type => :rvalue) do |args|
+		if args[0].is_a?(Array)
+			args.collect do |a| File.dirname(a) end
+		else
+			File.dirname(args[0])
+		end
+	end
+end
+
diff --git a/puppet/modules/common/lib/puppet/parser/functions/get_default.rb b/puppet/modules/common/lib/puppet/parser/functions/get_default.rb
new file mode 100644
index 00000000..3f4359bd
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/get_default.rb
@@ -0,0 +1,15 @@
+# get_default($value, $default) : $value
+#
+# return $value || $default.
+module Puppet::Parser::Functions
+    newfunction(:get_default, :type => :rvalue) do |args|
+        value = nil
+        args.each { |x|
+            if ! x.nil? and x.length > 0
+                value = x
+                break
+            end
+        }
+        return value
+    end
+end
diff --git a/puppet/modules/common/lib/puppet/parser/functions/hostname.rb b/puppet/modules/common/lib/puppet/parser/functions/hostname.rb
new file mode 100644
index 00000000..7bc477f2
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/hostname.rb
@@ -0,0 +1,13 @@
+# get an uniq array of ipaddresses for a hostname
+require 'resolv'
+
+module Puppet::Parser::Functions
+	newfunction(:hostname, :type => :rvalue) do |args|
+        res = Array.new
+        Resolv::DNS.new.each_address(args[0]){ |addr|
+            res << addr
+        }
+        res.uniq
+	end
+end
+
diff --git a/puppet/modules/common/lib/puppet/parser/functions/multi_source_template.rb b/puppet/modules/common/lib/puppet/parser/functions/multi_source_template.rb
new file mode 100644
index 00000000..e0753205
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/multi_source_template.rb
@@ -0,0 +1,29 @@
+module Puppet::Parser::Functions
+    require 'erb'
+
+    newfunction(:multi_source_template, :type => :rvalue) do |args|
+        contents = nil
+        environment = compiler.environment
+        sources = args
+
+        sources.each do |file|
+            Puppet.debug("Looking for #{file} in #{environment}")
+            if filename = Puppet::Parser::Files.find_template(file, environment.to_s)
+                wrapper = Puppet::Parser::TemplateWrapper.new(self)
+                wrapper.file = file
+
+                begin
+                     contents = wrapper.result
+                rescue => detail
+                     raise Puppet::ParseError, "Failed to parse template %s: %s" % [file, detail]
+                end
+
+                break
+            end
+        end
+
+        raise Puppet::ParseError, "multi_source_template: No match found for files: #{sources.join(', ')}" if contents == nil
+
+        contents
+    end
+end
diff --git a/puppet/modules/common/lib/puppet/parser/functions/prefix_with.rb b/puppet/modules/common/lib/puppet/parser/functions/prefix_with.rb
new file mode 100644
index 00000000..6e64a4a8
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/prefix_with.rb
@@ -0,0 +1,9 @@
+# prefix arguments 2..n with first argument
+
+module Puppet::Parser::Functions
+	newfunction(:prefix_with, :type => :rvalue) do |args|
+		prefix = args.shift
+		args.collect {|v| "%s%s" % [prefix, v] }
+	end
+end
+
diff --git a/puppet/modules/common/lib/puppet/parser/functions/re_escape.rb b/puppet/modules/common/lib/puppet/parser/functions/re_escape.rb
new file mode 100644
index 00000000..7bee90a8
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/re_escape.rb
@@ -0,0 +1,7 @@
+# apply ruby regexp escaping to a string
+module Puppet::Parser::Functions
+	newfunction(:re_escape, :type => :rvalue) do |args|
+		Regexp.escape(args[0])
+	end
+end
+
diff --git a/puppet/modules/common/lib/puppet/parser/functions/slash_escape.rb b/puppet/modules/common/lib/puppet/parser/functions/slash_escape.rb
new file mode 100644
index 00000000..04d3b95e
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/slash_escape.rb
@@ -0,0 +1,7 @@
+# escape slashes in a String
+module Puppet::Parser::Functions
+	newfunction(:slash_escape, :type => :rvalue) do |args|
+		args[0].gsub(/\//, '\\/')
+	end
+end
+
diff --git a/puppet/modules/common/lib/puppet/parser/functions/substitute.rb b/puppet/modules/common/lib/puppet/parser/functions/substitute.rb
new file mode 100644
index 00000000..4c97def3
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/substitute.rb
@@ -0,0 +1,20 @@
+# subsititute($string, $regex, $replacement) : $string
+# subsititute($string[], $regex, $replacement) : $string[]
+#
+# Replace all ocurrences of $regex in $string by $replacement.
+# $regex is interpreted as Ruby regular expression.
+#
+# For long-term portability it is recommended to refrain from using Ruby's
+# extended RE features.
+module Puppet::Parser::Functions
+	newfunction(:substitute, :type => :rvalue) do |args|
+		if args[0].is_a?(Array)
+			args[0].collect do |val|
+				val.gsub(/#{args[1]}/, args[2])
+			end
+		else
+			args[0].gsub(/#{args[1]}/, args[2])
+		end
+	end
+end
+
diff --git a/puppet/modules/common/lib/puppet/parser/functions/tfile.rb b/puppet/modules/common/lib/puppet/parser/functions/tfile.rb
new file mode 100644
index 00000000..acb6609b
--- /dev/null
+++ b/puppet/modules/common/lib/puppet/parser/functions/tfile.rb
@@ -0,0 +1,19 @@
+Puppet::Parser::Functions::newfunction(
+  :tfile,
+  :type => :rvalue,
+  :doc => "Returns the content of a file. If the file or the path does not
+    yet exist, it will create the path and touch the file."
+) do |args|
+  raise Puppet::ParseError, 'tfile() needs one argument' if args.length != 1
+  path = args.to_a.first
+  unless File.exists?(path)
+    dir = File.dirname(path)
+    unless File.directory?(dir)
+      require 'fileutils'
+      FileUtils.mkdir_p(dir, :mode => 0700)
+    end
+    require 'fileutils'
+    FileUtils.touch(path)
+  end
+  File.read(path)
+end
diff --git a/puppet/modules/common/manifests/module_dir.pp b/puppet/modules/common/manifests/module_dir.pp
new file mode 100644
index 00000000..2420da94
--- /dev/null
+++ b/puppet/modules/common/manifests/module_dir.pp
@@ -0,0 +1,34 @@
+# common/manifests/modules_dir.pp -- create a default directory
+# for storing module specific information
+#
+# Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+# See LICENSE for the full license granted to you.
+
+# A module_dir is a storage place for all the stuff a module might want to
+# store. According to the FHS, this should go to /var/lib. Since this is a part
+# of puppet, the full path is /var/lib/puppet/modules/${name}. Every module
+# should # prefix its module_dirs with its name.
+#
+# Usage:
+# include common::moduledir
+# module_dir { ["common", "common/dir1", "common/dir2" ]: }
+#
+# You may refer to a file in module_dir by using :
+# file { "${common::moduledir::module_dir_path}/somedir/somefile": }
+define common::module_dir(
+  $owner = root,
+  $group = 0,
+  $mode = 0644
+) {
+  include common::moduledir
+  file {
+    "${common::moduledir::module_dir_path}/${name}":
+      ensure    => directory,
+      recurse   => true,
+      purge     => true,
+      force     => true,
+      owner     => $owner,
+      group     => $group,
+      mode      => $mode;
+  }
+}
diff --git a/puppet/modules/common/manifests/module_file.pp b/puppet/modules/common/manifests/module_file.pp
new file mode 100644
index 00000000..c1070bcf
--- /dev/null
+++ b/puppet/modules/common/manifests/module_file.pp
@@ -0,0 +1,37 @@
+# common/manifests/module_file.pp -- use a modules_dir to store module
+# specific files
+#
+# Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+# See LICENSE for the full license granted to you.
+
+# Put a file into module-local storage.
+#
+# Usage:
+# common::module_file { "module/file":
+#     source => "puppet:///...",
+#     mode   => 644,   # default
+#     owner  => root,  # default
+#     group  => 0,     # default
+# }
+define common::module_file (
+  $ensure = present,
+  $source = undef,
+  $owner  = root,
+  $group  = 0,
+  $mode   = 0644
+){
+  include common::moduledir
+  file {
+    "${common::moduledir::module_dir_path}/${name}":
+      ensure  => $ensure,
+  }
+
+  if $ensure != 'absent' {
+    File["${common::moduledir::module_dir_path}/${name}"]{
+      source  => $source,
+      owner   => $owner,
+      group   => $group,
+      mode    => $mode,
+    }
+  }
+}
diff --git a/puppet/modules/common/manifests/moduledir.pp b/puppet/modules/common/manifests/moduledir.pp
new file mode 100644
index 00000000..f779085b
--- /dev/null
+++ b/puppet/modules/common/manifests/moduledir.pp
@@ -0,0 +1,18 @@
+# setup root for module_dirs
+class common::moduledir {
+  # Use this variable to reference the base path. Thus you are safe from any
+  # changes.
+  $module_dir_path = '/var/lib/puppet/modules'
+
+  # Module programmers can use /var/lib/puppet/modules/$modulename to save
+  # module-local data, e.g. for constructing config files
+  file{$module_dir_path:
+    ensure  => directory,
+    recurse => true,
+    purge   => true,
+    force   => true,
+    owner   => root,
+    group   => 0,
+    mode    => '0755';
+  }
+}
diff --git a/puppet/modules/common/manifests/moduledir/common.pp b/puppet/modules/common/manifests/moduledir/common.pp
new file mode 100644
index 00000000..e74c601e
--- /dev/null
+++ b/puppet/modules/common/manifests/moduledir/common.pp
@@ -0,0 +1,4 @@
+# setup a common dir
+class common::moduledir::common{
+  common::module_dir{'common': }
+}
diff --git a/puppet/modules/common/spec/spec.opts b/puppet/modules/common/spec/spec.opts
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/common/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/common/spec/spec_helper.rb b/puppet/modules/common/spec/spec_helper.rb
new file mode 100644
index 00000000..6ba62e11
--- /dev/null
+++ b/puppet/modules/common/spec/spec_helper.rb
@@ -0,0 +1,16 @@
+require 'pathname'
+dir = Pathname.new(__FILE__).parent
+$LOAD_PATH.unshift(dir, dir + 'lib', dir + '../lib')
+require 'puppet'
+gem 'rspec', '>= 1.2.9'
+require 'spec/autorun'
+
+Dir[File.join(File.dirname(__FILE__), 'support', '*.rb')].each do |support_file|
+  require support_file
+end
+
+# We need this because the RAL uses 'should' as a method.  This
+# allows us the same behaviour but with a different method name.
+class Object
+    alias :must :should
+end
diff --git a/puppet/modules/common/spec/unit/parser/functions/tfile.rb b/puppet/modules/common/spec/unit/parser/functions/tfile.rb
new file mode 100644
index 00000000..5c8f636e
--- /dev/null
+++ b/puppet/modules/common/spec/unit/parser/functions/tfile.rb
@@ -0,0 +1,54 @@
+#! /usr/bin/env ruby
+
+require File.dirname(__FILE__) + '/../../../spec_helper'
+require 'mocha'
+
+describe "the tfile function" do
+
+  before :each do
+    @scope = Puppet::Parser::Scope.new
+  end
+
+  it "should exist" do
+    Puppet::Parser::Functions.function("tfile").should == "function_tfile"
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    lambda { @scope.function_tfile([]) }.should( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if there is more than 1 arguments" do
+    lambda { @scope.function_tfile(["bar", "gazonk"]) }.should( raise_error(Puppet::ParseError))
+  end
+
+  describe "when executed properly" do
+
+    before :each do
+       File.stubs(:read).with('/some_path/aa').returns("foo1\nfoo2\n")
+    end
+
+    it "should return the content of the file" do
+      File.stubs(:exists?).with('/some_path/aa').returns(true)
+      result = @scope.function_tfile(['/some_path/aa'])
+      result.should == "foo1\nfoo2\n"
+    end
+
+    it "should touch a file if it does not exist" do
+      File.stubs(:exists?).with('/some_path/aa').returns(false)
+      File.stubs(:directory?).with('/some_path').returns(true)
+      FileUtils.expects(:touch).with('/some_path/aa')
+      result = @scope.function_tfile(['/some_path/aa'])
+      result.should == "foo1\nfoo2\n"
+    end
+
+    it "should create the path if it does not exist" do
+      File.stubs(:exists?).with('/some_path/aa').returns(false)
+      File.stubs(:directory?).with('/some_path').returns(false)
+      FileUtils.expects(:mkdir_p).with("/some_path",:mode => 0700)
+      FileUtils.expects(:touch).with('/some_path/aa')
+      result = @scope.function_tfile(['/some_path/aa'])
+      result.should == "foo1\nfoo2\n"
+    end
+  end
+
+end
-- 
cgit v1.2.3


From 6209061fd112fed1715676abb7b6ae4697f21d83 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:51 -0400
Subject: git subrepo clone https://leap.se/git/puppet_shorewall
 puppet/modules/shorewall

subrepo:
  subdir:   "puppet/modules/shorewall"
  merged:   "06e89ed"
upstream:
  origin:   "https://leap.se/git/puppet_shorewall"
  branch:   "master"
  commit:   "06e89ed"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ief531c1b951e9a1573d31bd9718cc5df11706af5
---
 puppet/modules/shorewall/.gitrepo                  |  11 +
 puppet/modules/shorewall/LICENSE                   | 674 +++++++++++++++++++++
 puppet/modules/shorewall/README.md                 | 224 +++++++
 .../shorewall/files/boilerplate/blacklist.footer   |   1 +
 .../shorewall/files/boilerplate/blacklist.header   |  10 +
 .../shorewall/files/boilerplate/clear.footer       |   1 +
 .../shorewall/files/boilerplate/clear.header       |  13 +
 .../shorewall/files/boilerplate/continue.footer    |   1 +
 .../shorewall/files/boilerplate/continue.header    |  14 +
 .../shorewall/files/boilerplate/hosts.footer       |   1 +
 .../shorewall/files/boilerplate/hosts.header       |   9 +
 .../shorewall/files/boilerplate/init.footer        |   1 +
 .../shorewall/files/boilerplate/init.header        |  13 +
 .../shorewall/files/boilerplate/initdone.footer    |   1 +
 .../shorewall/files/boilerplate/initdone.header    |  14 +
 .../shorewall/files/boilerplate/interfaces.footer  |   1 +
 .../shorewall/files/boilerplate/interfaces.header  |  10 +
 .../shorewall/files/boilerplate/maclog.footer      |   1 +
 .../shorewall/files/boilerplate/maclog.header      |  14 +
 .../shorewall/files/boilerplate/mangle.footer      |   1 +
 .../shorewall/files/boilerplate/mangle.header      |   7 +
 .../shorewall/files/boilerplate/masq.footer        |   1 +
 .../shorewall/files/boilerplate/masq.header        |   9 +
 .../modules/shorewall/files/boilerplate/nat.footer |   1 +
 .../modules/shorewall/files/boilerplate/nat.header |   9 +
 .../shorewall/files/boilerplate/params.footer      |   1 +
 .../shorewall/files/boilerplate/params.header      |  26 +
 .../shorewall/files/boilerplate/policy.footer      |   1 +
 .../shorewall/files/boilerplate/policy.header      |  11 +
 .../shorewall/files/boilerplate/providers.footer   |   1 +
 .../shorewall/files/boilerplate/providers.header   |   9 +
 .../shorewall/files/boilerplate/proxyarp.footer    |   1 +
 .../shorewall/files/boilerplate/proxyarp.header    |   9 +
 .../shorewall/files/boilerplate/rfc1918.footer     |   5 +
 .../shorewall/files/boilerplate/rfc1918.header     |   5 +
 .../files/boilerplate/routestopped.footer          |   1 +
 .../files/boilerplate/routestopped.header          |  11 +
 .../shorewall/files/boilerplate/rtrules.footer     |   1 +
 .../shorewall/files/boilerplate/rtrules.header     |   8 +
 .../shorewall/files/boilerplate/rules.footer       |   1 +
 .../shorewall/files/boilerplate/rules.header       |  10 +
 .../shorewall/files/boilerplate/start.footer       |   1 +
 .../shorewall/files/boilerplate/start.header       |  12 +
 .../shorewall/files/boilerplate/started.footer     |   1 +
 .../shorewall/files/boilerplate/started.header     |  20 +
 .../shorewall/files/boilerplate/stop.footer        |   1 +
 .../shorewall/files/boilerplate/stop.header        |  13 +
 .../shorewall/files/boilerplate/stopped.footer     |   1 +
 .../shorewall/files/boilerplate/stopped.header     |  13 +
 .../shorewall/files/boilerplate/tcclasses.footer   |   1 +
 .../shorewall/files/boilerplate/tcclasses.header   |   9 +
 .../shorewall/files/boilerplate/tcdevices.footer   |   1 +
 .../shorewall/files/boilerplate/tcdevices.header   |  10 +
 .../shorewall/files/boilerplate/tcrules.footer     |   1 +
 .../shorewall/files/boilerplate/tcrules.header     |  15 +
 .../shorewall/files/boilerplate/tunnel.footer      |   1 +
 .../shorewall/files/boilerplate/tunnel.header      |  11 +
 .../shorewall/files/boilerplate/zones.footer       |   1 +
 .../shorewall/files/boilerplate/zones.header       |  12 +
 puppet/modules/shorewall/files/empty/.ignore       |   1 +
 puppet/modules/shorewall/manifests/base.pp         |  78 +++
 puppet/modules/shorewall/manifests/blacklist.pp    |   9 +
 puppet/modules/shorewall/manifests/centos.pp       |  13 +
 puppet/modules/shorewall/manifests/debian.pp       |  11 +
 puppet/modules/shorewall/manifests/entry.pp        |  12 +
 .../shorewall/manifests/extension_script.pp        |  16 +
 puppet/modules/shorewall/manifests/gentoo.pp       |   5 +
 puppet/modules/shorewall/manifests/host.pp         |  10 +
 puppet/modules/shorewall/manifests/init.pp         | 123 ++++
 puppet/modules/shorewall/manifests/interface.pp    |  29 +
 puppet/modules/shorewall/manifests/managed_file.pp |  20 +
 puppet/modules/shorewall/manifests/mangle.pp       |  20 +
 puppet/modules/shorewall/manifests/masq.pp         |  17 +
 puppet/modules/shorewall/manifests/nat.pp          |  11 +
 puppet/modules/shorewall/manifests/params.pp       |   5 +
 puppet/modules/shorewall/manifests/policy.pp       |  12 +
 puppet/modules/shorewall/manifests/providers.pp    |  16 +
 puppet/modules/shorewall/manifests/proxyarp.pp     |  11 +
 puppet/modules/shorewall/manifests/rfc1918.pp      |   8 +
 puppet/modules/shorewall/manifests/routestopped.pp |  14 +
 puppet/modules/shorewall/manifests/rtrules.pp      |  11 +
 puppet/modules/shorewall/manifests/rule.pp         |  20 +
 puppet/modules/shorewall/manifests/rule_section.pp |   7 +
 .../modules/shorewall/manifests/rules/cobbler.pp   |  19 +
 puppet/modules/shorewall/manifests/rules/dns.pp    |   6 +
 .../shorewall/manifests/rules/dns/disable.pp       |   6 +
 .../modules/shorewall/manifests/rules/dns_rules.pp |  22 +
 puppet/modules/shorewall/manifests/rules/ekeyd.pp  |  10 +
 puppet/modules/shorewall/manifests/rules/ftp.pp    |  10 +
 .../modules/shorewall/manifests/rules/gitdaemon.pp |  10 +
 .../shorewall/manifests/rules/gitdaemon/absent.pp  |   5 +
 puppet/modules/shorewall/manifests/rules/http.pp   |  10 +
 .../shorewall/manifests/rules/http/disable.pp      |   5 +
 puppet/modules/shorewall/manifests/rules/https.pp  |  10 +
 puppet/modules/shorewall/manifests/rules/identd.pp |  10 +
 puppet/modules/shorewall/manifests/rules/imap.pp   |  11 +
 puppet/modules/shorewall/manifests/rules/ipsec.pp  |  32 +
 .../modules/shorewall/manifests/rules/ipsec_nat.pp |  18 +
 .../shorewall/manifests/rules/jabberserver.pp      |  34 ++
 puppet/modules/shorewall/manifests/rules/jetty.pp  |  12 +
 .../shorewall/manifests/rules/jetty/http.pp        |   9 +
 .../modules/shorewall/manifests/rules/jetty/ssl.pp |  11 +
 .../modules/shorewall/manifests/rules/keyserver.pp |  11 +
 .../shorewall/manifests/rules/libvirt/host.pp      |  80 +++
 .../shorewall/manifests/rules/managesieve.pp       |  25 +
 puppet/modules/shorewall/manifests/rules/mdns.pp   |   8 +
 puppet/modules/shorewall/manifests/rules/munin.pp  |  16 +
 puppet/modules/shorewall/manifests/rules/mysql.pp  |  11 +
 puppet/modules/shorewall/manifests/rules/nfsd.pp   | 115 ++++
 .../shorewall/manifests/rules/ntp/client.pp        |  11 +
 .../shorewall/manifests/rules/ntp/server.pp        |  10 +
 .../modules/shorewall/manifests/rules/openfire.pp  |  12 +
 .../modules/shorewall/manifests/rules/openvpn.pp   |  18 +
 .../modules/shorewall/manifests/rules/out/ekeyd.pp |  10 +
 .../modules/shorewall/manifests/rules/out/git.pp   |  10 +
 .../shorewall/manifests/rules/out/ibackup.pp       |  12 +
 .../modules/shorewall/manifests/rules/out/imap.pp  |  11 +
 .../modules/shorewall/manifests/rules/out/irc.pp   |  10 +
 .../modules/shorewall/manifests/rules/out/ircs.pp  |  10 +
 .../shorewall/manifests/rules/out/keyserver.pp     |  11 +
 .../shorewall/manifests/rules/out/managesieve.pp   |  25 +
 .../modules/shorewall/manifests/rules/out/munin.pp |  10 +
 .../modules/shorewall/manifests/rules/out/mysql.pp |  11 +
 .../modules/shorewall/manifests/rules/out/pop3.pp  |  11 +
 .../shorewall/manifests/rules/out/postgres.pp      |  11 +
 .../shorewall/manifests/rules/out/puppet.pp        |  20 +
 .../modules/shorewall/manifests/rules/out/pyzor.pp |  12 +
 .../modules/shorewall/manifests/rules/out/razor.pp |  12 +
 .../modules/shorewall/manifests/rules/out/silc.pp  |  19 +
 .../modules/shorewall/manifests/rules/out/smtp.pp  |  11 +
 .../modules/shorewall/manifests/rules/out/ssh.pp   |  10 +
 .../shorewall/manifests/rules/out/ssh/disable.pp   |   5 +
 .../shorewall/manifests/rules/out/ssh/remove.pp    |   5 +
 .../modules/shorewall/manifests/rules/out/whois.pp |  11 +
 .../modules/shorewall/manifests/rules/out/xmpp.pp  |  10 +
 puppet/modules/shorewall/manifests/rules/pop3.pp   |  11 +
 .../modules/shorewall/manifests/rules/postgres.pp  |  10 +
 puppet/modules/shorewall/manifests/rules/puppet.pp |  11 +
 .../shorewall/manifests/rules/puppet/master.pp     |  10 +
 puppet/modules/shorewall/manifests/rules/rsync.pp  |  10 +
 puppet/modules/shorewall/manifests/rules/silcd.pp  |  19 +
 puppet/modules/shorewall/manifests/rules/smtp.pp   |  10 +
 .../shorewall/manifests/rules/smtp/disable.pp      |   5 +
 .../shorewall/manifests/rules/smtp_submission.pp   |  10 +
 .../manifests/rules/smtp_submission/disable.pp     |   5 +
 puppet/modules/shorewall/manifests/rules/smtps.pp  |  10 +
 .../shorewall/manifests/rules/smtps/disable.pp     |   5 +
 .../shorewall/manifests/rules/sobby/instance.pp    |  11 +
 puppet/modules/shorewall/manifests/rules/ssh.pp    |  13 +
 puppet/modules/shorewall/manifests/rules/syslog.pp |  12 +
 puppet/modules/shorewall/manifests/rules/tftp.pp   |  18 +
 puppet/modules/shorewall/manifests/rules/tinc.pp   |  34 ++
 puppet/modules/shorewall/manifests/rules/tomcat.pp |  12 +
 puppet/modules/shorewall/manifests/rules/torify.pp |  29 +
 .../rules/torify/allow_tor_transparent_proxy.pp    |  21 +
 .../manifests/rules/torify/allow_tor_user.pp       |  15 +
 .../manifests/rules/torify/redirect_tcp_to_tor.pp  |  40 ++
 .../manifests/rules/torify/reject_non_tor.pp       |  32 +
 .../shorewall/manifests/rules/torify/user.pp       |  27 +
 puppet/modules/shorewall/manifests/tcclasses.pp    |  12 +
 puppet/modules/shorewall/manifests/tcdevices.pp    |  11 +
 puppet/modules/shorewall/manifests/tcrules.pp      |  12 +
 puppet/modules/shorewall/manifests/tunnel.pp       |  11 +
 puppet/modules/shorewall/manifests/zone.pp         |  14 +
 .../modules/shorewall/templates/debian_default.erb |  26 +
 165 files changed, 3036 insertions(+)
 create mode 100644 puppet/modules/shorewall/.gitrepo
 create mode 100644 puppet/modules/shorewall/LICENSE
 create mode 100644 puppet/modules/shorewall/README.md
 create mode 100644 puppet/modules/shorewall/files/boilerplate/blacklist.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/blacklist.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/clear.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/clear.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/continue.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/continue.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/hosts.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/hosts.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/init.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/init.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/initdone.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/initdone.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/interfaces.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/interfaces.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/maclog.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/maclog.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/mangle.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/mangle.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/masq.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/masq.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/nat.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/nat.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/params.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/params.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/policy.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/policy.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/providers.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/providers.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/proxyarp.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/proxyarp.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/rfc1918.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/rfc1918.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/routestopped.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/routestopped.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/rtrules.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/rtrules.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/rules.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/rules.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/start.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/start.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/started.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/started.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/stop.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/stop.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/stopped.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/stopped.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/tcclasses.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/tcclasses.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/tcdevices.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/tcdevices.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/tcrules.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/tcrules.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/tunnel.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/tunnel.header
 create mode 100644 puppet/modules/shorewall/files/boilerplate/zones.footer
 create mode 100644 puppet/modules/shorewall/files/boilerplate/zones.header
 create mode 100644 puppet/modules/shorewall/files/empty/.ignore
 create mode 100644 puppet/modules/shorewall/manifests/base.pp
 create mode 100644 puppet/modules/shorewall/manifests/blacklist.pp
 create mode 100644 puppet/modules/shorewall/manifests/centos.pp
 create mode 100644 puppet/modules/shorewall/manifests/debian.pp
 create mode 100644 puppet/modules/shorewall/manifests/entry.pp
 create mode 100644 puppet/modules/shorewall/manifests/extension_script.pp
 create mode 100644 puppet/modules/shorewall/manifests/gentoo.pp
 create mode 100644 puppet/modules/shorewall/manifests/host.pp
 create mode 100644 puppet/modules/shorewall/manifests/init.pp
 create mode 100644 puppet/modules/shorewall/manifests/interface.pp
 create mode 100644 puppet/modules/shorewall/manifests/managed_file.pp
 create mode 100644 puppet/modules/shorewall/manifests/mangle.pp
 create mode 100644 puppet/modules/shorewall/manifests/masq.pp
 create mode 100644 puppet/modules/shorewall/manifests/nat.pp
 create mode 100644 puppet/modules/shorewall/manifests/params.pp
 create mode 100644 puppet/modules/shorewall/manifests/policy.pp
 create mode 100644 puppet/modules/shorewall/manifests/providers.pp
 create mode 100644 puppet/modules/shorewall/manifests/proxyarp.pp
 create mode 100644 puppet/modules/shorewall/manifests/rfc1918.pp
 create mode 100644 puppet/modules/shorewall/manifests/routestopped.pp
 create mode 100644 puppet/modules/shorewall/manifests/rtrules.pp
 create mode 100644 puppet/modules/shorewall/manifests/rule.pp
 create mode 100644 puppet/modules/shorewall/manifests/rule_section.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/cobbler.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/dns.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/dns/disable.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/dns_rules.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/ekeyd.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/ftp.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/gitdaemon.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/gitdaemon/absent.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/http.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/http/disable.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/https.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/identd.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/imap.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/ipsec.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/ipsec_nat.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/jabberserver.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/jetty.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/jetty/http.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/jetty/ssl.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/keyserver.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/libvirt/host.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/managesieve.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/mdns.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/munin.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/mysql.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/nfsd.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/ntp/client.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/ntp/server.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/openfire.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/openvpn.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ekeyd.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/git.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ibackup.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/imap.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/irc.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ircs.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/keyserver.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/managesieve.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/munin.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/mysql.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/pop3.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/postgres.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/puppet.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/pyzor.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/razor.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/silc.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/smtp.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ssh.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ssh/disable.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/ssh/remove.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/whois.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/out/xmpp.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/pop3.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/postgres.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/puppet.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/puppet/master.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/rsync.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/silcd.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/smtp.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/smtp/disable.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/smtp_submission.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/smtp_submission/disable.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/smtps.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/smtps/disable.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/sobby/instance.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/ssh.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/syslog.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/tftp.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/tinc.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/tomcat.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/torify.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/torify/allow_tor_user.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/torify/redirect_tcp_to_tor.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp
 create mode 100644 puppet/modules/shorewall/manifests/rules/torify/user.pp
 create mode 100644 puppet/modules/shorewall/manifests/tcclasses.pp
 create mode 100644 puppet/modules/shorewall/manifests/tcdevices.pp
 create mode 100644 puppet/modules/shorewall/manifests/tcrules.pp
 create mode 100644 puppet/modules/shorewall/manifests/tunnel.pp
 create mode 100644 puppet/modules/shorewall/manifests/zone.pp
 create mode 100644 puppet/modules/shorewall/templates/debian_default.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/shorewall/.gitrepo b/puppet/modules/shorewall/.gitrepo
new file mode 100644
index 00000000..7ae31f9d
--- /dev/null
+++ b/puppet/modules/shorewall/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_shorewall
+	branch = master
+	commit = 06e89ed3486916ae12186e46b8ec59c8c7c79142
+	parent = 6083b23278927189de58c11bbb5bc7d93ccced24
+	cmdver = 0.3.0
diff --git a/puppet/modules/shorewall/LICENSE b/puppet/modules/shorewall/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/shorewall/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/shorewall/README.md b/puppet/modules/shorewall/README.md
new file mode 100644
index 00000000..e7e29859
--- /dev/null
+++ b/puppet/modules/shorewall/README.md
@@ -0,0 +1,224 @@
+Puppet Module for Shorewall
+---------------------------
+This module manages the configuration of Shorewall (http://www.shorewall.net/)
+
+Requirements
+------------
+
+This module requires the augeas module, you can find that here:
+https://gitlab.com/shared-puppet-modules-group/augeas.git
+
+This module requires the concat module, you can find that here:
+https://github.com/puppetlabs/puppetlabs-concat.git
+
+Copyright
+---------
+
+Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+adapted by immerda project group - admin+puppet(at)immerda.ch
+adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch
+
+Copyright (c) 2009 Riseup Networks - micah(shift+2)riseup.net
+
+Copyright (c) 2010 intrigeri - intrigeri(at)boum.org
+See LICENSE for the full license granted to you.
+
+Based on the work of ADNET Ghislain <gadnet@aqueos.com> from AQUEOS
+at https://reductivelabs.com/trac/puppet/wiki/AqueosShorewall
+
+Merged from:
+- git://git.puppet.immerda.ch/module-shorewall.git
+- git://labs.riseup.net/module_shorewall
+- https://gitlab.com/shared-puppet-modules-group/shorewall.git
+
+
+Todo
+----
+- check if shorewall compiles without errors, otherwise fail !
+
+Configuration
+-------------
+
+If you need to install a specific version of shorewall other than
+the default one that would be installed by 'ensure => present', then
+you can set the following variable and that specific version will be
+installed instead:
+
+    $shorewall_ensure_version = "4.0.15-1"
+
+The main shorewall.conf is not managed by this module, rather the default one
+that your operatingsystem provides is used, and any modifications you wish to do
+to it should be configured with augeas, for example, to set IP_FORWARDING=Yes in
+shorewall.conf, simply do this:
+
+    augeas { 'enable_ip_forwarding':
+      changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING Yes',
+      lens    => 'Shellvars.lns',
+      incl    => '/etc/shorewall/shorewall.conf',
+      notify  => Service[shorewall];
+    }
+
+NOTE: this requires the augeas ruby bindings newer than 0.7.3.
+
+If you need to, you can provide an entire shorewall.conf by passing its
+source to the main class:
+
+    class{'shorewall':
+      conf_source => "puppet:///modules/site_shorewall/${::fqdn}/shorewall.conf.${::operatingsystem}",
+    }
+
+NOTE: if you distribute a file, you cannot also use augeas, puppet and augeas
+will fight forever. Secondly, you will *need* to make sure that if you are shipping your own
+shorewall.conf that you have the following value set in your shorewall.conf otherwise this
+module will not work:
+
+    CONFIG_PATH="/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"
+
+Documentation
+-------------
+
+see also: http://reductivelabs.com/trac/puppet/wiki/Recipes/AqueosShorewall
+
+Torify
+------
+
+The shorewall::rules::torify define can be used to force some outgoing
+TCP traffic through the Tor transparent proxy. The corresponding
+non-TCP traffic is rejected accordingly.
+
+Beware! This define only is part of a torified setup. DNS requests and
+IPv6, amongst others, might leak network activity you would prefer not
+to. You really need to read proper documentation about these matters
+before using this feature e.g.:
+
+  https://www.torproject.org/download/download.html.en#warning
+
+The Tor transparent proxy location defaults to 127.0.0.1:9040 and can
+be configured by setting the $tor_transparent_proxy_host and
+$tor_transparent_proxy_port variables before including the main
+shorewall class.
+
+Example usage follows.
+
+Torify any outgoing TCP traffic originating from user bob or alice and
+aimed at 6.6.6.6 or 7.7.7.7:
+
+    shorewall::rules::torify {
+      'torify-some-bits':
+        users        => [ 'bob', 'alice' ],
+        destinations => [ '6.6.6.6', '7.7.7.7' ];
+    }
+
+Torify any outgoing TCP traffic to 8.8.8.8:
+
+    shorewall::rules::torify {
+      'torify-to-this-host':
+        destinations  => [ '8.8.8.8' ];
+    }
+
+When no destination nor user is provided any outgoing TCP traffic (see
+restrictions bellow) is torified. In that case the user running the
+Tor client ($tor_user) is whitelisted; this variable defaults to
+"debian-tor" on Debian systems and to "tor" on others. if this does
+not suit your configuration you need to set the $tor_user variable
+before including the main shorewall class.
+
+When no destination is provided traffic directed to RFC1918 addresses
+is by default allowed and (obviously) not torified. This behaviour can
+be changed by setting the allow_rfc1918 parameter to false.
+
+Torify any outgoing TCP traffic but connections to RFC1918 addresses:
+
+    shorewall::rules::torify {
+      'torify-everything-but-lan':
+    }
+
+Torify any outgoing TCP traffic:
+
+    shorewall::rules::torify {
+      'torify-everything:
+        allow_rfc1918 => false;
+    }
+
+In some cases (e.g. when providing no specific destination nor user
+and denying access to RFC1918 addresses) UDP DNS requests may be
+rejected. This is intentional: it does not make sense leaking -via DNS
+requests- network activity that would otherwise be torified. In that
+case you probably want to read proper documentation about such
+matters, enable the Tor DNS resolver and redirect DNS requests through
+it.
+
+Example
+-------
+
+Example from node.pp:
+
+    node xy {
+      class{'config::site_shorewall':
+        startup => "0"  # create shorewall ruleset but don't startup
+      }
+      shorewall::rule {
+        'incoming-ssh': source => 'all', destination => '$FW',  action  => 'SSH(ACCEPT)', order => 200;
+        'incoming-puppetmaster': source => 'all', destination => '$FW',  action  => 'Puppetmaster(ACCEPT)', order => 300;
+        'incoming-imap': source => 'all', destination => '$FW',  action  => 'IMAP(ACCEPT)', order => 300;
+        'incoming-smtp': source => 'all', destination => '$FW',  action  => 'SMTP(ACCEPT)', order => 300;
+      }
+    }
+
+
+    class config::site_shorewall($startup = '1') {
+      class{'shorewall':
+        startup => $startup
+      }
+
+      # If you want logging:
+      #shorewall::params {
+      # 'LOG':  value => 'debug';
+      #}
+
+      shorewall::zone {'net':
+        type => 'ipv4';
+      }
+
+      shorewall::rule_section { 'NEW':
+        order => 100;
+      }
+
+      shorewall::interface { 'eth0':
+        zone    => 'net',
+        rfc1918  => true,
+        options => 'tcpflags,blacklist,nosmurfs';
+      }
+
+      shorewall::policy {
+        'fw-to-fw':
+          sourcezone              =>      '$FW',
+          destinationzone         =>      '$FW',
+          policy                  =>      'ACCEPT',
+          order                   =>      100;
+        'fw-to-net':
+          sourcezone              =>      '$FW',
+          destinationzone         =>      'net',
+          policy                  =>      'ACCEPT',
+          shloglevel              =>      '$LOG',
+          order                   =>      110;
+        'net-to-fw':
+          sourcezone              =>      'net',
+          destinationzone         =>      '$FW',
+          policy                  =>      'DROP',
+          shloglevel              =>      '$LOG',
+          order                   =>      120;
+      }
+
+
+      # default Rules : ICMP
+      shorewall::rule {
+        'allicmp-to-host':
+          source => 'all',
+          destination => '$FW',
+          order  => 200,
+          action  => 'AllowICMPs/(ACCEPT)';
+      }
+    }
+
+
diff --git a/puppet/modules/shorewall/files/boilerplate/blacklist.footer b/puppet/modules/shorewall/files/boilerplate/blacklist.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/blacklist.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/blacklist.header b/puppet/modules/shorewall/files/boilerplate/blacklist.header
new file mode 100644
index 00000000..2392e176
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/blacklist.header
@@ -0,0 +1,10 @@
+#
+# Shorewall version 3.4 - Blacklist File
+#
+# For information about entries in this file, type "man shorewall-blacklist"
+#
+# Please see http://shorewall.net/blacklisting_support.htm for additional
+# information.
+#
+###############################################################################
+#ADDRESS/SUBNET         PROTOCOL        PORT
diff --git a/puppet/modules/shorewall/files/boilerplate/clear.footer b/puppet/modules/shorewall/files/boilerplate/clear.footer
new file mode 100644
index 00000000..662ac1cc
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/clear.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/clear.header b/puppet/modules/shorewall/files/boilerplate/clear.header
new file mode 100644
index 00000000..6a39b0b6
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/clear.header
@@ -0,0 +1,13 @@
+#
+# Shorewall version 4 - Clear
+#
+# /etc/shorewall/stop
+#
+#       Add commands below that you want to be executed at the beginning of a
+#       "shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/continue.footer b/puppet/modules/shorewall/files/boilerplate/continue.footer
new file mode 100644
index 00000000..662ac1cc
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/continue.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/continue.header b/puppet/modules/shorewall/files/boilerplate/continue.header
new file mode 100644
index 00000000..d2ee48a5
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/continue.header
@@ -0,0 +1,14 @@
+#
+# Shorewall version 4 - Continue File
+#
+#  /etc/shorewall/continue
+#
+#	Add commands below that you want to be executed after shorewall has
+#	cleared any existing Netfilter rules and has enabled existing
+#	connections.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+
diff --git a/puppet/modules/shorewall/files/boilerplate/hosts.footer b/puppet/modules/shorewall/files/boilerplate/hosts.footer
new file mode 100644
index 00000000..dc2fef52
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/hosts.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/hosts.header b/puppet/modules/shorewall/files/boilerplate/hosts.header
new file mode 100644
index 00000000..e39d6145
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/hosts.header
@@ -0,0 +1,9 @@
+#
+# Shorewall version 3.4 - Hosts file
+#
+# For information about entries in this file, type "man shorewall-hosts"
+#
+# For additional information, see http://shorewall.net/Documentation.htm#Hosts
+#
+###############################################################################
+#ZONE   HOST(S)                                 OPTIONS
diff --git a/puppet/modules/shorewall/files/boilerplate/init.footer b/puppet/modules/shorewall/files/boilerplate/init.footer
new file mode 100644
index 00000000..662ac1cc
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/init.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/init.header b/puppet/modules/shorewall/files/boilerplate/init.header
new file mode 100644
index 00000000..cbb0393e
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/init.header
@@ -0,0 +1,13 @@
+#
+# Shorewall version 4 - Init File
+#
+# /etc/shorewall/init
+#
+#	Add commands below that you want to be executed at the beginning of
+#	a "shorewall start" or "shorewall restart" command.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+
diff --git a/puppet/modules/shorewall/files/boilerplate/initdone.footer b/puppet/modules/shorewall/files/boilerplate/initdone.footer
new file mode 100644
index 00000000..662ac1cc
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/initdone.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/initdone.header b/puppet/modules/shorewall/files/boilerplate/initdone.header
new file mode 100644
index 00000000..9252a3bc
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/initdone.header
@@ -0,0 +1,14 @@
+#
+# Shorewall version 4 - Initdone File
+#
+# /etc/shorewall/initdone
+#
+#	Add commands below that you want to be executed during
+#	"shorewall start" or "shorewall restart" commands at the point where
+#	Shorewall has not yet added any perminent rules to the builtin chains.
+#
+# For additional information, see
+# http://shorewall.net/shorewall_extension_scripts.htm
+#
+###############################################################################
+
diff --git a/puppet/modules/shorewall/files/boilerplate/interfaces.footer b/puppet/modules/shorewall/files/boilerplate/interfaces.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/interfaces.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/interfaces.header b/puppet/modules/shorewall/files/boilerplate/interfaces.header
new file mode 100644
index 00000000..663e4367
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/interfaces.header
@@ -0,0 +1,10 @@
+#
+# Shorewall version 4 - Interfaces File
+#
+# For information about entries in this file, type "man shorewall-interfaces"
+#
+# For additional information, see
+# http://www.shorewall.net/manpages/shorewall-interfaces.html
+#
+###############################################################################
+#ZONE   INTERFACE       BROADCAST       OPTIONS
diff --git a/puppet/modules/shorewall/files/boilerplate/maclog.footer b/puppet/modules/shorewall/files/boilerplate/maclog.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/maclog.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/maclog.header b/puppet/modules/shorewall/files/boilerplate/maclog.header
new file mode 100644
index 00000000..b0c382ab
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/maclog.header
@@ -0,0 +1,14 @@
+#
+# Shorewall version 4 - Maclog File (Added in Shorewall version 3.2.5)
+#
+# /etc/shorewall/start
+#
+#	Add commands below that you want executed while mac filtering rules are
+#	being created. These will be executed once for each interface having
+#	'maclist' speciied and it is invoked just before the logging rule is 
+#	added to the current chain (the name of that chain will be in $CHAIN)
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
diff --git a/puppet/modules/shorewall/files/boilerplate/mangle.footer b/puppet/modules/shorewall/files/boilerplate/mangle.footer
new file mode 100644
index 00000000..6bebc05c
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/mangle.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/mangle.header b/puppet/modules/shorewall/files/boilerplate/mangle.header
new file mode 100644
index 00000000..7a7b12ab
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/mangle.header
@@ -0,0 +1,7 @@
+#
+# Shorewall - Mangle File
+#
+# For additional information, see http://shorewall.net/manpages/shorewall-mangle.html
+#
+#######################################################################################
+#ACTION SOURCE DESTINATION PROTO DSTPORT SRCPORT USER TEST LENGTH TOS CONNBYTES HELPER HEADERS
diff --git a/puppet/modules/shorewall/files/boilerplate/masq.footer b/puppet/modules/shorewall/files/boilerplate/masq.footer
new file mode 100644
index 00000000..6bebc05c
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/masq.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/masq.header b/puppet/modules/shorewall/files/boilerplate/masq.header
new file mode 100644
index 00000000..f8233210
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/masq.header
@@ -0,0 +1,9 @@
+#
+# Shorewall version 3.4 - Masq file
+#
+# For information about entries in this file, type "man shorewall-masq"
+#
+# For additional information, see http://shorewall.net/Documentation.htm#Masq
+#
+###############################################################################
+#INTERFACE              SOURCE          ADDRESS         PROTO   PORT(S) IPSEC   MARK
diff --git a/puppet/modules/shorewall/files/boilerplate/nat.footer b/puppet/modules/shorewall/files/boilerplate/nat.footer
new file mode 100644
index 00000000..6bebc05c
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/nat.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/nat.header b/puppet/modules/shorewall/files/boilerplate/nat.header
new file mode 100644
index 00000000..c2e0d922
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/nat.header
@@ -0,0 +1,9 @@
+#
+# Shorewall version 3.4 - Nat File
+#
+# For information about entries in this file, type "man shorewall-nat"
+#
+# For additional information, see http://shorewall.net/NAT.htm
+#
+###############################################################################
+#EXTERNAL       INTERFACE       INTERNAL        ALL             LOCAL
diff --git a/puppet/modules/shorewall/files/boilerplate/params.footer b/puppet/modules/shorewall/files/boilerplate/params.footer
new file mode 100644
index 00000000..662ac1cc
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/params.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/params.header b/puppet/modules/shorewall/files/boilerplate/params.header
new file mode 100644
index 00000000..b258b0de
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/params.header
@@ -0,0 +1,26 @@
+#
+# Shorewall version 3.4 - Params File
+#
+# /etc/shorewall/params
+#
+#       Assign any variables that you need here.
+#
+#       It is suggested that variable names begin with an upper case letter
+#       to distinguish them from variables used internally within the
+#       Shorewall programs
+#
+#       Example:
+#
+#               NET_IF=eth0
+#               NET_BCAST=130.252.100.255
+#               NET_OPTIONS=routefilter,norfc1918
+#
+#       Example (/etc/shorewall/interfaces record):
+#
+#               net     $NET_IF         $NET_BCAST      $NET_OPTIONS
+#
+#       The result will be the same as if the record had been written
+#
+#               net     eth0            130.252.100.255 routefilter,norfc1918
+#
+###############################################################################
diff --git a/puppet/modules/shorewall/files/boilerplate/policy.footer b/puppet/modules/shorewall/files/boilerplate/policy.footer
new file mode 100644
index 00000000..16c86d0e
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/policy.footer
@@ -0,0 +1 @@
+#LAST LINE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/policy.header b/puppet/modules/shorewall/files/boilerplate/policy.header
new file mode 100644
index 00000000..cc9781f0
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/policy.header
@@ -0,0 +1,11 @@
+#
+# Shorewall version 4 - Policy File
+#
+# For information about entries in this file, type "man shorewall-policy"
+#
+# The manpage is also online at
+# http://www.shorewall.net/manpages/shorewall-policy.html
+#
+###############################################################################
+#SOURCE DEST  POLICY    LOG LIMIT:    CONNLIMIT:
+#       LEVEL BURST   MASK
diff --git a/puppet/modules/shorewall/files/boilerplate/providers.footer b/puppet/modules/shorewall/files/boilerplate/providers.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/providers.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/providers.header b/puppet/modules/shorewall/files/boilerplate/providers.header
new file mode 100644
index 00000000..b4a5990f
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/providers.header
@@ -0,0 +1,9 @@
+#
+# Shorewall version 4 - Providers File
+#
+# For information about entries in this file, type "man shorewall-providers"
+#
+# For additional information, see http://shorewall.net/MultiISP.html
+#
+############################################################################################
+#NAME	NUMBER	MARK	DUPLICATE	INTERFACE	GATEWAY		OPTIONS		COPY
diff --git a/puppet/modules/shorewall/files/boilerplate/proxyarp.footer b/puppet/modules/shorewall/files/boilerplate/proxyarp.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/proxyarp.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/proxyarp.header b/puppet/modules/shorewall/files/boilerplate/proxyarp.header
new file mode 100644
index 00000000..1e168532
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/proxyarp.header
@@ -0,0 +1,9 @@
+#
+# Shorewall version  3.4 - Proxyarp File
+#
+# For information about entries in this file, type "man shorewall-proxyarp"
+#
+# See http://shorewall.net/ProxyARP.htm for additional information.
+#
+###############################################################################
+#ADDRESS        INTERFACE       EXTERNAL        HAVEROUTE       PERSISTENT
diff --git a/puppet/modules/shorewall/files/boilerplate/rfc1918.footer b/puppet/modules/shorewall/files/boilerplate/rfc1918.footer
new file mode 100644
index 00000000..e07fdb15
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/rfc1918.footer
@@ -0,0 +1,5 @@
+# The real subnets from RFC1918
+172.16.0.0/12           logdrop         # RFC 1918
+192.168.0.0/16          logdrop         # RFC 1918
+10.0.0.0/8              logdrop         # RFC 1918
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/rfc1918.header b/puppet/modules/shorewall/files/boilerplate/rfc1918.header
new file mode 100644
index 00000000..8d6a4162
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/rfc1918.header
@@ -0,0 +1,5 @@
+#
+# Shorewall version 3.4 - Rfc1918 File
+#
+###############################################################################
+#SUBNETS                TARGET
diff --git a/puppet/modules/shorewall/files/boilerplate/routestopped.footer b/puppet/modules/shorewall/files/boilerplate/routestopped.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/routestopped.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/routestopped.header b/puppet/modules/shorewall/files/boilerplate/routestopped.header
new file mode 100644
index 00000000..5408aace
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/routestopped.header
@@ -0,0 +1,11 @@
+#
+# Shorewall version 3.4 - Routestopped File
+#
+# For information about entries in this file, type "man shorewall-routestopped"
+#
+# See http://shorewall.net/Documentation.htm#Routestopped and
+# http://shorewall.net/starting_and_stopping_shorewall.htm for additional
+# information.
+#
+###############################################################################
+#INTERFACE      HOST(S)                 OPTIONS
diff --git a/puppet/modules/shorewall/files/boilerplate/rtrules.footer b/puppet/modules/shorewall/files/boilerplate/rtrules.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/rtrules.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/rtrules.header b/puppet/modules/shorewall/files/boilerplate/rtrules.header
new file mode 100644
index 00000000..fd9b2f48
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/rtrules.header
@@ -0,0 +1,8 @@
+#
+# Shorewall version 4 - route rules File
+#
+# For information about entries in this file, type "man shorewall-rtrules"
+#
+# For additional information, see http://www.shorewall.net/MultiISP.html
+####################################################################################
+# SOURCE DEST PROVIDER PRIORITY MASK 
diff --git a/puppet/modules/shorewall/files/boilerplate/rules.footer b/puppet/modules/shorewall/files/boilerplate/rules.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/rules.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/rules.header b/puppet/modules/shorewall/files/boilerplate/rules.header
new file mode 100644
index 00000000..764358ac
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/rules.header
@@ -0,0 +1,10 @@
+#
+# Shorewall version 3.4 - Rules File
+#
+# For information on the settings in this file, type "man shorewall-rules"
+#
+# See http://shorewall.net/Documentation.htm#Rules for additional information.
+#
+#############################################################################################################
+#ACTION SOURCE          DEST            PROTO   DEST    SOURCE          ORIGINAL        RATE            USER/   MARK
+#                                               PORT    PORT(S)         DEST            LIMIT           GROUP
diff --git a/puppet/modules/shorewall/files/boilerplate/start.footer b/puppet/modules/shorewall/files/boilerplate/start.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/start.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/start.header b/puppet/modules/shorewall/files/boilerplate/start.header
new file mode 100644
index 00000000..689dff19
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/start.header
@@ -0,0 +1,12 @@
+#
+# Shorewall version 4 - Start File
+#
+# /etc/shorewall/start
+#
+#	Add commands below that you want to be executed after shorewall has
+#	been started or restarted.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
diff --git a/puppet/modules/shorewall/files/boilerplate/started.footer b/puppet/modules/shorewall/files/boilerplate/started.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/started.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/started.header b/puppet/modules/shorewall/files/boilerplate/started.header
new file mode 100644
index 00000000..b7704dba
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/started.header
@@ -0,0 +1,20 @@
+#
+# Shorewall version 4 - Started File
+#
+# /etc/shorewall/started
+#
+#	Add commands below that you want to be executed after shorewall has
+#	been completely started or restarted. The difference between this
+#	extension script and /etc/shorewall/start is that this one is invoked
+#	after delayed loading of the blacklist (DELAYBLACKLISTLOAD=Yes) and
+#	after the 'shorewall' chain has been created (thus signaling that the
+#	firewall is completely up).
+#
+#	This script should not change the firewall configuration directly but
+#	may do so indirectly by running /sbin/shorewall with the 'nolock'
+#	option.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
diff --git a/puppet/modules/shorewall/files/boilerplate/stop.footer b/puppet/modules/shorewall/files/boilerplate/stop.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/stop.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/stop.header b/puppet/modules/shorewall/files/boilerplate/stop.header
new file mode 100644
index 00000000..0088abe1
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/stop.header
@@ -0,0 +1,13 @@
+#
+# Shorewall version 4 - Stop File
+#
+# /etc/shorewall/stop
+#
+#	Add commands below that you want to be executed at the beginning of a
+#	"shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/stopped.footer b/puppet/modules/shorewall/files/boilerplate/stopped.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/stopped.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/stopped.header b/puppet/modules/shorewall/files/boilerplate/stopped.header
new file mode 100644
index 00000000..438e5e05
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/stopped.header
@@ -0,0 +1,13 @@
+#
+# Shorewall version 4 - Stopped File
+#
+# /etc/shorewall/stopped
+#
+#	Add commands below that you want to be executed at the completion of a
+#	"shorewall stop" command.
+#
+# See http://shorewall.net/shorewall_extension_scripts.htm for additional
+# information.
+#
+###############################################################################
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/tcclasses.footer b/puppet/modules/shorewall/files/boilerplate/tcclasses.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/tcclasses.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/tcclasses.header b/puppet/modules/shorewall/files/boilerplate/tcclasses.header
new file mode 100644
index 00000000..025415ba
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/tcclasses.header
@@ -0,0 +1,9 @@
+#
+# Shorewall version 4 - Tcclasses File
+#
+# For information about entries in this file, type "man shorewall-tcclasses"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+#
+###############################################################################
+#INTERFACE:CLASS        MARK    RATE    CEIL    PRIORITY        OPTIONS
diff --git a/puppet/modules/shorewall/files/boilerplate/tcdevices.footer b/puppet/modules/shorewall/files/boilerplate/tcdevices.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/tcdevices.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/tcdevices.header b/puppet/modules/shorewall/files/boilerplate/tcdevices.header
new file mode 100644
index 00000000..fe7c3d1f
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/tcdevices.header
@@ -0,0 +1,10 @@
+#
+# Shorewall version 4 - Tcdevices File
+#
+# For information about entries in this file, type "man shorewall-tcdevices"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+#
+###############################################################################
+#NUMBER:        IN-BANDWITH     OUT-BANDWIDTH   OPTIONS         REDIRECTED
+#INTERFACE                                                      INTERFACES
diff --git a/puppet/modules/shorewall/files/boilerplate/tcrules.footer b/puppet/modules/shorewall/files/boilerplate/tcrules.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/tcrules.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/tcrules.header b/puppet/modules/shorewall/files/boilerplate/tcrules.header
new file mode 100644
index 00000000..e0e7adcf
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/tcrules.header
@@ -0,0 +1,15 @@
+#
+# Shorewall version 4 - Tcrules File
+#
+# For information about entries in this file, type "man shorewall-tcrules"
+#
+# See http://shorewall.net/traffic_shaping.htm for additional information.
+# For usage in selecting among multiple ISPs, see
+# http://shorewall.net/MultiISP.html
+#
+# See http://shorewall.net/PacketMarking.html for a detailed description of
+# the Netfilter/Shorewall packet marking mechanism.
+######################################################################################################################
+#MARK   SOURCE          DEST            PROTO   DEST    SOURCE  USER    TEST    LENGTH  TOS   CONNBYTES         HELPER
+#                                               PORT(S) PORT(S)
+
diff --git a/puppet/modules/shorewall/files/boilerplate/tunnel.footer b/puppet/modules/shorewall/files/boilerplate/tunnel.footer
new file mode 100644
index 00000000..5e12d1da
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/tunnel.footer
@@ -0,0 +1 @@
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/tunnel.header b/puppet/modules/shorewall/files/boilerplate/tunnel.header
new file mode 100644
index 00000000..638fd568
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/tunnel.header
@@ -0,0 +1,11 @@
+#
+# Shorewall version 4 - Tunnels File
+#
+# For information about entries in this file, type "man shorewall-tunnels"
+#
+# The manpage is also online at
+# http://www.shorewall.net/manpages/shorewall-tunnels.html
+#
+###############################################################################
+#TYPE			ZONE	GATEWAY		GATEWAY
+#						ZONE
diff --git a/puppet/modules/shorewall/files/boilerplate/zones.footer b/puppet/modules/shorewall/files/boilerplate/zones.footer
new file mode 100644
index 00000000..662ac1cc
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/zones.footer
@@ -0,0 +1 @@
+#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE
diff --git a/puppet/modules/shorewall/files/boilerplate/zones.header b/puppet/modules/shorewall/files/boilerplate/zones.header
new file mode 100644
index 00000000..5dada523
--- /dev/null
+++ b/puppet/modules/shorewall/files/boilerplate/zones.header
@@ -0,0 +1,12 @@
+#
+# Shorewall version 4 - Zones File
+#
+# For information about this file, type "man shorewall-zones"
+#
+# The manpage is also online at
+# http://www.shorewall.net/manpages/shorewall-zones.html
+#
+###############################################################################
+#ZONE TYPE    OPTIONS   IN      OUT
+#         OPTIONS     OPTIONS
+fw  firewall
diff --git a/puppet/modules/shorewall/files/empty/.ignore b/puppet/modules/shorewall/files/empty/.ignore
new file mode 100644
index 00000000..89cb1fe9
--- /dev/null
+++ b/puppet/modules/shorewall/files/empty/.ignore
@@ -0,0 +1 @@
+# file needed for git - don't remove it
diff --git a/puppet/modules/shorewall/manifests/base.pp b/puppet/modules/shorewall/manifests/base.pp
new file mode 100644
index 00000000..6599759e
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/base.pp
@@ -0,0 +1,78 @@
+# base things for shorewall
+class shorewall::base {
+
+  package { 'shorewall':
+    ensure => $shorewall::ensure_version,
+  }
+
+  # This file has to be managed in place, so shorewall can find it
+  file {
+    '/etc/shorewall/shorewall.conf':
+      require => Package['shorewall'],
+      notify  => Exec['shorewall_check'],
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644';
+    '/etc/shorewall/puppet':
+      ensure  => directory,
+      require => Package['shorewall'],
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644';
+  }
+
+  if $shorewall::conf_source {
+    File['/etc/shorewall/shorewall.conf']{
+      source => $shorewall::conf_source,
+    }
+  } else {
+
+    include ::augeas
+    Class['augeas'] -> Class['shorewall::base']
+
+    augeas { 'shorewall_module_config_path':
+      changes => 'set /files/etc/shorewall/shorewall.conf/CONFIG_PATH \'"/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"\'',
+      lens    => 'Shellvars.lns',
+      incl    => '/etc/shorewall/shorewall.conf',
+      notify  => Exec['shorewall_check'],
+      require => Package['shorewall'];
+    }
+  }
+
+  exec{'shorewall_check':
+    command     => 'shorewall check',
+    refreshonly => true,
+    notify      => Service['shorewall'],
+  }
+  service{'shorewall':
+    ensure     => running,
+    enable     => true,
+    hasstatus  => true,
+    hasrestart => true,
+    require    => Package['shorewall'],
+  }
+
+  file{'/etc/cron.daily/shorewall_check':}
+  if $shorewall::daily_check {
+    File['/etc/cron.daily/shorewall_check']{
+      content => '#!/bin/bash
+
+output=$(shorewall check 2>&1)
+if [ $? -gt 0 ]; then
+  echo "Error while checking firewall!"
+  echo $output
+  exit 1
+fi
+exit 0
+',
+      owner   => root,
+      group   => 0,
+      mode    => '0700',
+      require => Service['shorewall'],
+    }
+  } else {
+    File['/etc/cron.daily/shorewall_check']{
+      ensure => absent,
+    }
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/blacklist.pp b/puppet/modules/shorewall/manifests/blacklist.pp
new file mode 100644
index 00000000..afbe2165
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/blacklist.pp
@@ -0,0 +1,9 @@
+define shorewall::blacklist(
+    $proto = '-',
+    $port = '-',
+    $order='100'
+){
+    shorewall::entry{"blacklist-${order}-${name}":
+        line => "${name} ${proto} ${port}",
+    }           
+}
diff --git a/puppet/modules/shorewall/manifests/centos.pp b/puppet/modules/shorewall/manifests/centos.pp
new file mode 100644
index 00000000..1f8b37dd
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/centos.pp
@@ -0,0 +1,13 @@
+# things needed on centos
+class shorewall::centos inherits shorewall::base {
+  if versioncmp($::operatingsystemmajrelease,'5') > 0 {
+    augeas{'enable_shorewall':
+      context => '/files/etc/sysconfig/shorewall',
+      changes => 'set startup 1',
+      lens    => 'Shellvars.lns',
+      incl    => '/etc/sysconfig/shorewall',
+      require => Package['shorewall'],
+      notify  => Exec['shorewall_check'],
+    }
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/debian.pp b/puppet/modules/shorewall/manifests/debian.pp
new file mode 100644
index 00000000..07176a32
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/debian.pp
@@ -0,0 +1,11 @@
+# debian specific things
+class shorewall::debian inherits shorewall::base {
+  file{'/etc/default/shorewall':
+    content => template('shorewall/debian_default.erb'),
+    require => Package['shorewall'],
+    notify  => Exec['shorewall_check'],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/entry.pp b/puppet/modules/shorewall/manifests/entry.pp
new file mode 100644
index 00000000..c8fffc72
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/entry.pp
@@ -0,0 +1,12 @@
+define shorewall::entry(
+    $ensure = present,
+    $line
+){
+  $parts = split($name,'-')
+  concat::fragment{$name:
+    ensure => $ensure,
+    content => "${line}\n",
+    order => $parts[1],
+    target => "/etc/shorewall/puppet/${parts[0]}",
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/extension_script.pp b/puppet/modules/shorewall/manifests/extension_script.pp
new file mode 100644
index 00000000..80b83d3b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/extension_script.pp
@@ -0,0 +1,16 @@
+# See http://shorewall.net/shorewall_extension_scripts.htm
+define shorewall::extension_script(
+  $script
+) {
+  case $name {
+    'init', 'initdone', 'start', 'started', 'stop', 'stopped', 'clear', 'refresh', 'continue', 'maclog': {
+      file { "/etc/shorewall/puppet/${name}":
+        content => "${script}\n",
+        notify  => Exec['shorewall_check'];
+      }
+    }
+    default: {
+      err("${name}: unknown shorewall extension script")
+    }
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/gentoo.pp b/puppet/modules/shorewall/manifests/gentoo.pp
new file mode 100644
index 00000000..7b307a4e
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/gentoo.pp
@@ -0,0 +1,5 @@
+class shorewall::gentoo inherits shorewall::base {
+    Package[shorewall]{
+        category => 'net-firewall',
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/host.pp b/puppet/modules/shorewall/manifests/host.pp
new file mode 100644
index 00000000..f4002232
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/host.pp
@@ -0,0 +1,10 @@
+define shorewall::host(
+    $zone,
+    $options = 'tcpflags,blacklist,norfc1918',
+    $order='100'
+){
+    shorewall::entry{"hosts-${order}-${name}":
+        line => "${zone} ${name} ${options}"
+    }
+}
+
diff --git a/puppet/modules/shorewall/manifests/init.pp b/puppet/modules/shorewall/manifests/init.pp
new file mode 100644
index 00000000..d6b2d2a4
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/init.pp
@@ -0,0 +1,123 @@
+# Manage shorewall on your system
+class shorewall(
+  $startup                    = '1',
+  $conf_source                = false,
+  $ensure_version             = 'present',
+  $tor_transparent_proxy_host = '127.0.0.1',
+  $tor_transparent_proxy_port = '9040',
+  $tor_user                   = $::operatingsystem ? {
+    'Debian' => 'debian-tor',
+    default  => 'tor'
+  },
+  $zones                      = {},
+  $zones_defaults             = {},
+  $interfaces                 = {},
+  $interfaces_defaults        = {},
+  $hosts                      = {},
+  $hosts_defaults             = {},
+  $policy                     = {},
+  $policy_defaults            = {},
+  $rules                      = {},
+  $rules_defaults             = {},
+  $rulesections               = {},
+  $rulesections_defaults      = {},
+  $masq                       = {},
+  $masq_defaults              = {},
+  $proxyarp                   = {},
+  $proxyarp_defaults          = {},
+  $nat                        = {},
+  $nat_defaults               = {},
+  $blacklist                  = {},
+  $blacklist_defaults         = {},
+  $rfc1918                    = {},
+  $rfc1918_defaults           = {},
+  $routestopped               = {},
+  $routestopped_defaults      = {},
+  $params                     = {},
+  $params_defaults            = {},
+  $tcdevices                  = {},
+  $tcdevices_defaults         = {},
+  $tcrules                    = {},
+  $tcrules_defaults           = {},
+  $tcclasses                  = {},
+  $tcclasses_defaults         = {},
+  $tunnels                    = {},
+  $tunnels_defaults           = {},
+  $rtrules                    = {},
+  $rtrules_defaults           = {},
+  $daily_check                = true,
+) {
+
+  case $::operatingsystem {
+    'Gentoo': { include ::shorewall::gentoo }
+    'Debian','Ubuntu': { include ::shorewall::debian }
+    'CentOS': { include ::shorewall::centos }
+    default: {
+      notice "unknown operatingsystem: ${::operatingsystem}"
+      include ::shorewall::base
+    }
+  }
+
+  shorewall::managed_file{
+    [
+      # See http://www.shorewall.net/3.0/Documentation.htm#Zones
+      'zones',
+      # See http://www.shorewall.net/3.0/Documentation.htm#Interfaces
+      'interfaces',
+      # See http://www.shorewall.net/3.0/Documentation.htm#Hosts
+      'hosts',
+      # See http://www.shorewall.net/3.0/Documentation.htm#Policy
+      'policy',
+      # See http://www.shorewall.net/3.0/Documentation.htm#Rules
+      'rules',
+      # See http://www.shorewall.net/3.0/Documentation.htm#Masq
+      'masq',
+      # See http://www.shorewall.net/3.0/Documentation.htm#ProxyArp
+      'proxyarp',
+      # See http://www.shorewall.net/3.0/Documentation.htm#NAT
+      'nat',
+      # See http://www.shorewall.net/3.0/Documentation.htm#Blacklist
+      'blacklist',
+      # See http://www.shorewall.net/3.0/Documentation.htm#rfc1918
+      'rfc1918',
+      # See http://www.shorewall.net/3.0/Documentation.htm#Routestopped
+      'routestopped',
+      # See http://www.shorewall.net/3.0/Documentation.htm#Variables
+      'params',
+      # See http://www.shorewall.net/3.0/traffic_shaping.htm
+      'tcdevices',
+      # See http://www.shorewall.net/3.0/traffic_shaping.htm
+      'tcrules',
+      # See http://www.shorewall.net/3.0/traffic_shaping.htm
+      'tcclasses',
+      # http://www.shorewall.net/manpages/shorewall-providers.html
+      'providers',
+      # See http://www.shorewall.net/manpages/shorewall-tunnels.html
+      'tunnel',
+      # See http://www.shorewall.net/MultiISP.html
+      'rtrules',
+      # See http://www.shorewall.net/manpages/shorewall-mangle.html
+      'mangle',
+    ]:;
+  }
+
+  create_resources('shorewall::zone',$zones,$zones_defaults)
+  create_resources('shorewall::interface',$interfaces,$interfaces_defaults)
+  create_resources('shorewall::host',$hosts,$hosts_defaults)
+  create_resources('shorewall::policy',$policy,$policy_defaults)
+  create_resources('shorewall::rule',$rules,$rules_defaults)
+  create_resources('shorewall::rule_section',$rulesections,$rulesections_defaults)
+  create_resources('shorewall::masq',$masq,$masq_defaults)
+  create_resources('shorewall::proxyarp',$proxyarp,$proxyarp_defaults)
+  create_resources('shorewall::nat',$nat,$nat_defaults)
+  create_resources('shorewall::blacklist',$blacklist,$blacklist_defaults)
+  create_resources('shorewall::rfc1918',$rfc1918,$rfc1918_defaults)
+  create_resources('shorewall::routestopped',$routestopped,
+    $routestopped_defaults)
+  create_resources('shorewall::params',$params,$params_defaults)
+  create_resources('shorewall::tcdevices',$tcdevices,$tcdevices_defaults)
+  create_resources('shorewall::tcrules',$tcrules,$tcrules_defaults)
+  create_resources('shorewall::tcclasses',$tcclasses,$tcclasses_defaults)
+  create_resources('shorewall::tunnel',$tunnels,$tunnels_defaults)
+  create_resources('shorewall::rtrules',$rtrules,$rtrules_defaults)
+}
diff --git a/puppet/modules/shorewall/manifests/interface.pp b/puppet/modules/shorewall/manifests/interface.pp
new file mode 100644
index 00000000..403ee749
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/interface.pp
@@ -0,0 +1,29 @@
+define shorewall::interface(
+    $zone,
+    $broadcast = 'detect',
+    $options = 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
+    $add_options = '',
+    $rfc1918 = false,
+    $dhcp = false,
+    $order = 100
+){
+    $added_opts = $add_options ? {
+        ''      => '',
+        default => ",${add_options}",
+    }
+
+    $dhcp_opt = $dhcp ? {
+        false   => '',
+        default => ',dhcp',
+    }
+
+    $rfc1918_opt = $rfc1918 ? {
+        false   => ',norfc1918',
+        default => '',
+    }
+
+    shorewall::entry { "interfaces-${order}-${name}":
+        line => "${zone} ${name} ${broadcast} ${options}${dhcp_opt}${rfc1918_opt}${added_opts}",
+    }
+}
+
diff --git a/puppet/modules/shorewall/manifests/managed_file.pp b/puppet/modules/shorewall/manifests/managed_file.pp
new file mode 100644
index 00000000..b3538145
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/managed_file.pp
@@ -0,0 +1,20 @@
+# manage a certain file
+define shorewall::managed_file() {
+  concat{ "/etc/shorewall/puppet/${name}":
+    notify  => Exec['shorewall_check'],
+    require => File['/etc/shorewall/puppet'],
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0600';
+  }
+  concat::fragment {
+    "${name}-header":
+      source => "puppet:///modules/shorewall/boilerplate/${name}.header",
+      target => "/etc/shorewall/puppet/${name}",
+      order  => '000';
+    "${name}-footer":
+      source => "puppet:///modules/shorewall/boilerplate/${name}.footer",
+      target => "/etc/shorewall/puppet/${name}",
+      order  => '999';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/mangle.pp b/puppet/modules/shorewall/manifests/mangle.pp
new file mode 100644
index 00000000..cd404e7c
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/mangle.pp
@@ -0,0 +1,20 @@
+define shorewall::mangle(
+  $source,
+  $destination,
+  $action          = $name,
+  $proto           = '-',
+  $destinationport = '-',
+  $sourceport      = '-',
+  $user            = '-',
+  $test            = '-',
+  $length          = '-',
+  $tos             = '-',
+  $connbytes       = '-',
+  $helper          = '-',
+  $headers         = '-',
+  $order           = '100'
+){
+  shorewall::entry{"mangle-${order}-${name}":
+    line => "${action} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${user} ${test} ${length} ${tos} ${connbytes} ${helper} ${headers}"
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/masq.pp b/puppet/modules/shorewall/manifests/masq.pp
new file mode 100644
index 00000000..fb097e5e
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/masq.pp
@@ -0,0 +1,17 @@
+# mark is new in 3.4.4
+# source (= subnet) = Set of hosts that you wish to masquerade.
+# address = If  you  specify  an  address here, SNAT will be used and this will be the source address.
+define shorewall::masq(
+    $interface,
+    $source, $address = '-',
+    $proto = '-',
+    $port = '-',
+    $ipsec = '-',
+    $mark = '',
+    $order='100'
+){
+    shorewall::entry{"masq-${order}-${name}":
+        line => "# ${name}\n${interface} ${source} ${address} ${proto} ${port} ${ipsec} ${mark}"
+    }
+}
+
diff --git a/puppet/modules/shorewall/manifests/nat.pp b/puppet/modules/shorewall/manifests/nat.pp
new file mode 100644
index 00000000..e29b7849
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/nat.pp
@@ -0,0 +1,11 @@
+define shorewall::nat(
+    $interface,
+    $internal,
+    $all = 'no',
+    $local = 'yes',
+    $order='100'
+){
+    shorewall::entry{"nat-${order}-${name}":
+        line => "${name} ${interface} ${internal} ${all} ${local}"
+    }           
+}
diff --git a/puppet/modules/shorewall/manifests/params.pp b/puppet/modules/shorewall/manifests/params.pp
new file mode 100644
index 00000000..3bc56630
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/params.pp
@@ -0,0 +1,5 @@
+define shorewall::params($value, $order='100'){
+    shorewall::entry{"params-${order}-${name}":
+        line => "${name}=${value}",
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/policy.pp b/puppet/modules/shorewall/manifests/policy.pp
new file mode 100644
index 00000000..efee05b5
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/policy.pp
@@ -0,0 +1,12 @@
+define shorewall::policy(
+    $sourcezone,
+    $destinationzone,
+    $policy, $shloglevel = '-',
+    $limitburst = '-',
+    $order
+){
+    shorewall::entry{"policy-${order}-${name}":
+        line => "# ${name}\n${sourcezone} ${destinationzone} ${policy} ${shloglevel} ${limitburst}",
+    }
+}
+
diff --git a/puppet/modules/shorewall/manifests/providers.pp b/puppet/modules/shorewall/manifests/providers.pp
new file mode 100644
index 00000000..a1f8726a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/providers.pp
@@ -0,0 +1,16 @@
+# manage providers
+define shorewall::providers(
+  $provider   = $name,
+  $number     = '',
+  $mark       = '',
+  $duplicate  = 'main',
+  $interface  = '',
+  $gateway    = '',
+  $options    = '',
+  $copy       = '',
+  $order      = '100'
+){
+  shorewall::entry{"providers-${order}-${name}":
+    line => "# ${name}\n${provider} ${number} ${mark} ${duplicate} ${interface} ${gateway} ${options} ${copy}"
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/proxyarp.pp b/puppet/modules/shorewall/manifests/proxyarp.pp
new file mode 100644
index 00000000..1af554fb
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/proxyarp.pp
@@ -0,0 +1,11 @@
+define shorewall::proxyarp(
+    $interface,
+    $external,
+    $haveroute = yes,
+    $persistent = no,
+    $order='100'
+    ){
+    shorewall::entry{"proxyarp-${order}-${name}":
+        line => "# ${name}\n${name} ${interface} ${external} ${haveroute} ${persistent}"
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rfc1918.pp b/puppet/modules/shorewall/manifests/rfc1918.pp
new file mode 100644
index 00000000..31dce5dc
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rfc1918.pp
@@ -0,0 +1,8 @@
+define shorewall::rfc1918(
+    $action = 'logdrop',
+    $order='100'
+){
+    shorewall::entry{"rfc1918-${order}-${name}":
+        line => "${name} ${action}"
+    }   
+}
diff --git a/puppet/modules/shorewall/manifests/routestopped.pp b/puppet/modules/shorewall/manifests/routestopped.pp
new file mode 100644
index 00000000..aca57b51
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/routestopped.pp
@@ -0,0 +1,14 @@
+define shorewall::routestopped(
+    $interface = $name,
+    $host = '-',
+    $options = '',
+    $order='100'
+){
+    $real_interface = $interface ? { 
+        '' => $name,
+        default => $interface,
+    }   
+    shorewall::entry{"routestopped-${order}-${name}":
+        line => "${real_interface} ${host} ${options}",
+    }           
+}
diff --git a/puppet/modules/shorewall/manifests/rtrules.pp b/puppet/modules/shorewall/manifests/rtrules.pp
new file mode 100644
index 00000000..3810f26d
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rtrules.pp
@@ -0,0 +1,11 @@
+define shorewall::rtrules(
+    $source = '-',
+    $destination = '-',
+    $provider,
+    $priority = '10000',
+    $mark,
+){
+    shorewall::entry { "rtrules-${mark}-${name}":
+        line => "# ${name}\n${source} ${destination} ${provider} ${priority} ${mark}",
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rule.pp b/puppet/modules/shorewall/manifests/rule.pp
new file mode 100644
index 00000000..2fe91e27
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rule.pp
@@ -0,0 +1,20 @@
+# mark is new in 3.4.4
+define shorewall::rule(
+    $ensure = present,
+    $action,
+    $source,
+    $destination,
+    $proto = '-',
+    $destinationport = '-',
+    $sourceport = '-',
+    $originaldest = '-',
+    $ratelimit = '-',
+    $user = '-',
+    $mark = '',
+    $order
+){
+  shorewall::entry{"rules-${order}-${name}":
+    ensure => $ensure,
+    line => "# ${name}\n${action} ${source} ${destination} ${proto} ${destinationport} ${sourceport} ${originaldest} ${ratelimit} ${user} ${mark}",
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rule_section.pp b/puppet/modules/shorewall/manifests/rule_section.pp
new file mode 100644
index 00000000..82984ca2
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rule_section.pp
@@ -0,0 +1,7 @@
+define shorewall::rule_section(
+    $order
+){
+    shorewall::entry{"rules-${order}-${name}":
+        line => "SECTION ${name}",
+    }       
+}
diff --git a/puppet/modules/shorewall/manifests/rules/cobbler.pp b/puppet/modules/shorewall/manifests/rules/cobbler.pp
new file mode 100644
index 00000000..e04e4925
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/cobbler.pp
@@ -0,0 +1,19 @@
+class shorewall::rules::cobbler {
+     shorewall::rule{'net-me-syslog-xmlrpc-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '25150:25151',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule{'net-me-syslog-xmlrpc-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '25150:25151',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    include shorewall::rules::rsync
+}
diff --git a/puppet/modules/shorewall/manifests/rules/dns.pp b/puppet/modules/shorewall/manifests/rules/dns.pp
new file mode 100644
index 00000000..e775eeed
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/dns.pp
@@ -0,0 +1,6 @@
+# open dns port
+class shorewall::rules::dns {
+  shorewall::rules::dns_rules{
+    'net':
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/dns/disable.pp b/puppet/modules/shorewall/manifests/rules/dns/disable.pp
new file mode 100644
index 00000000..7de923bd
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/dns/disable.pp
@@ -0,0 +1,6 @@
+# disable dns acccess
+class shorewall::rules::dns::disable inherits shorewall::rules::dns {
+  Shorewall::Rules::Dns_rules['net']{
+    action  => 'DROP',
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/dns_rules.pp b/puppet/modules/shorewall/manifests/rules/dns_rules.pp
new file mode 100644
index 00000000..abe0eb5a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/dns_rules.pp
@@ -0,0 +1,22 @@
+# open dns port
+define shorewall::rules::dns_rules(
+  $source = $name,
+  $action = 'ACCEPT',
+) {
+  shorewall::rule {
+    "${source}-me-tcp_dns":
+      source          => $source,
+      destination     => '$FW',
+      proto           => 'tcp',
+      destinationport => '53',
+      order           => 240,
+      action          => $action;
+    "${source}-me-udp_dns":
+      source          => $source,
+      destination     => '$FW',
+      proto           => 'udp',
+      destinationport => '53',
+      order           => 240,
+      action          => $action;
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/ekeyd.pp b/puppet/modules/shorewall/manifests/rules/ekeyd.pp
new file mode 100644
index 00000000..dbff02fe
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/ekeyd.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::ekeyd {
+  shorewall::rule { 'net-me-tcp_ekeyd':
+    source          => 'net',
+    destination     => '$FW',
+    proto           => 'tcp',
+    destinationport => '8888',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/ftp.pp b/puppet/modules/shorewall/manifests/rules/ftp.pp
new file mode 100644
index 00000000..6d34c78f
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/ftp.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::ftp {
+    shorewall::rule { 'net-me-ftp-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '21',
+        order           => 240,
+        action          => 'FTP/ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/gitdaemon.pp b/puppet/modules/shorewall/manifests/rules/gitdaemon.pp
new file mode 100644
index 00000000..21372f63
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/gitdaemon.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::gitdaemon {
+        shorewall::rule {'net-me-tcp_gitdaemon':
+            source          => 'net',
+            destination     => '$FW',
+            proto           => 'tcp',
+            destinationport => '9418',
+            order           => 240,
+            action          => 'ACCEPT';
+        }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/gitdaemon/absent.pp b/puppet/modules/shorewall/manifests/rules/gitdaemon/absent.pp
new file mode 100644
index 00000000..ade6fba0
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/gitdaemon/absent.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::gitdaemon::absent inherits shorewall::rules::gitdaemon {
+  Shorewall::Rule['net-me-tcp_gitdaemon']{
+    ensure => absent,
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/http.pp b/puppet/modules/shorewall/manifests/rules/http.pp
new file mode 100644
index 00000000..e6a9bdef
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/http.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::http {
+    shorewall::rule { 'net-me-http-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '80',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/http/disable.pp b/puppet/modules/shorewall/manifests/rules/http/disable.pp
new file mode 100644
index 00000000..5d9170ca
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/http/disable.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::http::disable inherits shorewall::rules::http {
+  Shorewall::Rule['net-me-http-tcp']{
+        action  => 'DROP',
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/https.pp b/puppet/modules/shorewall/manifests/rules/https.pp
new file mode 100644
index 00000000..cc49d100
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/https.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::https {
+    shorewall::rule { 'net-me-https-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '443',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/identd.pp b/puppet/modules/shorewall/manifests/rules/identd.pp
new file mode 100644
index 00000000..719e581c
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/identd.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::identd {
+  shorewall::rule { 'net-me-identd-tcp':
+    source          => 'net',
+    destination     => '$FW',
+    proto           => 'tcp',
+    destinationport => '113',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/imap.pp b/puppet/modules/shorewall/manifests/rules/imap.pp
new file mode 100644
index 00000000..7fbe1818
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/imap.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::imap {
+    shorewall::rule {
+        'net-me-tcp_imap_s':
+            source          =>      'net',
+            destination     =>      '$FW',
+            proto           =>      'tcp',
+            destinationport =>      '143,993',
+            order           =>      260,
+            action          =>      'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/ipsec.pp b/puppet/modules/shorewall/manifests/rules/ipsec.pp
new file mode 100644
index 00000000..413406e1
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/ipsec.pp
@@ -0,0 +1,32 @@
+# manage ipsec rules for zone specified in
+# $name
+define shorewall::rules::ipsec() {
+  shorewall::rule {
+    "${name}-me-ipsec-udp":
+      source          => $name,
+      destination     => '$FW',
+      proto           => 'udp',
+      destinationport => '500',
+      order           => 240,
+      action          => 'ACCEPT';
+    "me-${name}-ipsec-udp":
+      source          => '$FW',
+      destination     => $name,
+      proto           => 'udp',
+      destinationport => '500',
+      order           => 240,
+      action          => 'ACCEPT';
+    "${name}-me-ipsec":
+      source          => $name,
+      destination     => '$FW',
+      proto           => 'esp',
+      order           => 240,
+      action          => 'ACCEPT';
+    "me-${name}-ipsec":
+      source          => '$FW',
+      destination     => $name,
+      proto           => 'esp',
+      order           => 240,
+      action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/ipsec_nat.pp b/puppet/modules/shorewall/manifests/rules/ipsec_nat.pp
new file mode 100644
index 00000000..6c0d5072
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/ipsec_nat.pp
@@ -0,0 +1,18 @@
+class shorewall::rules::ipsec_nat {
+    shorewall::rule {
+      'net-me-ipsec-nat-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '4500',
+        order           => 240,
+        action          => 'ACCEPT';
+      'me-net-ipsec-nat-udp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'udp',
+        destinationport => '4500',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/jabberserver.pp b/puppet/modules/shorewall/manifests/rules/jabberserver.pp
new file mode 100644
index 00000000..226d6274
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/jabberserver.pp
@@ -0,0 +1,34 @@
+# open ports used by a jabberserver
+# in and outbound.
+class shorewall::rules::jabberserver(
+  $open_stun = true,
+) {
+  shorewall::rule {
+    'net-me-tcp_jabber':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '5222,5223,5269',
+        order           => 240,
+        action          => 'ACCEPT';
+    'me-net-tcp_jabber_s2s':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '5260,5269,5270,5271,5272',
+        order           => 240,
+        action          => 'ACCEPT';
+  }
+
+  if $open_stun {
+    shorewall::rule {
+      'net-me-udp_jabber_stun_server':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '3478',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/jetty.pp b/puppet/modules/shorewall/manifests/rules/jetty.pp
new file mode 100644
index 00000000..4080e7e6
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/jetty.pp
@@ -0,0 +1,12 @@
+class shorewall::rules::jetty {
+    # open jetty port
+    shorewall::rule {
+        'net-me-jetty-tcp':
+            source          => 'net',
+            destination     => '$FW',
+            proto           => 'tcp',
+            destinationport => '8080',
+            order           => 240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/jetty/http.pp b/puppet/modules/shorewall/manifests/rules/jetty/http.pp
new file mode 100644
index 00000000..4c0652be
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/jetty/http.pp
@@ -0,0 +1,9 @@
+class shorewall::rules::jetty::http {
+    # dnat
+    shorewall::rule {
+        'dnat-http-to-jetty':
+            destination     =>      "net:${::ipaddress}:8080",
+            destinationport =>      '80',
+            source          =>      'net', proto => 'tcp', order => 140, action => 'DNAT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/jetty/ssl.pp b/puppet/modules/shorewall/manifests/rules/jetty/ssl.pp
new file mode 100644
index 00000000..f7517493
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/jetty/ssl.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::jetty::ssl {
+    shorewall::rule {
+        'net-me-jettyssl-tcp':
+            source          => 'net',
+            destination     => '$FW',
+            proto           => 'tcp',
+            destinationport => '8443',
+            order           => 240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/keyserver.pp b/puppet/modules/shorewall/manifests/rules/keyserver.pp
new file mode 100644
index 00000000..2ade9c1e
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/keyserver.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::keyserver {
+	shorewall::rule {
+		'net-me-tcp_keyserver':
+      source      => 'net',
+  		destination     => '$FW',
+	  	proto           => 'tcp',
+		  destinationport => '11371,11372',
+   		order           => 240,
+	    action          => 'ACCEPT';
+	}
+}
diff --git a/puppet/modules/shorewall/manifests/rules/libvirt/host.pp b/puppet/modules/shorewall/manifests/rules/libvirt/host.pp
new file mode 100644
index 00000000..dc3970d1
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/libvirt/host.pp
@@ -0,0 +1,80 @@
+class shorewall::rules::libvirt::host (
+  $vmz           = 'vmz',
+  $masq_iface    = 'eth0',
+  $debproxy_port = 8000,
+  $accept_dhcp   = true,
+  $vmz_iface     = 'virbr0',
+  ) {
+
+  define shorewall::rule::accept::from_vmz (
+    $proto           = '-',
+    $destinationport = '-',
+    $action          = 'ACCEPT'
+    ) {
+      shorewall::rule { $name:
+        source          => $shorewall::rules::libvirt::host::vmz,
+        destination     => '$FW',
+        order           => 300,
+        proto           => $proto,
+        destinationport => $destinationport,
+        action          => $action;
+      }
+    }
+
+  shorewall::policy {
+    'fw-to-vmz':
+      sourcezone              =>      '$FW',
+      destinationzone         =>      $vmz,
+      policy                  =>      'ACCEPT',
+      order                   =>      110;
+    'vmz-to-net':
+      sourcezone              =>      $vmz,
+      destinationzone         =>      'net',
+      policy                  =>      'ACCEPT',
+      order                   =>      200;
+    'vmz-to-all':
+      sourcezone              =>      $vmz,
+      destinationzone         =>      'all',
+      policy                  =>      'DROP',
+      shloglevel              =>      'info',
+      order                   =>      800;
+  }
+
+  shorewall::rule::accept::from_vmz {
+    'accept_dns_from_vmz':
+      action          => 'DNS(ACCEPT)';
+    'accept_tftp_from_vmz':
+      action          => 'TFTP(ACCEPT)';
+    'accept_puppet_from_vmz':
+      proto           => 'tcp',
+      destinationport => '8140',
+      action          => 'ACCEPT';
+  }
+
+  if $accept_dhcp {
+    shorewall::mangle { "CHECKSUM:T_${vmz_iface}":
+      action          => 'CHECKSUM:T',
+      source          => '-',
+      destination     => $vmz_iface,
+      proto           => 'udp',
+      destinationport => '68';
+    }
+  }
+
+  if $debproxy_port {
+    shorewall::rule::accept::from_vmz { 'accept_debproxy_from_vmz':
+      proto           => 'tcp',
+      destinationport => $debproxy_port,
+      action          => 'ACCEPT';
+    }
+  }
+
+  if $masq_iface {
+    shorewall::masq {
+      "masq-${masq_iface}":
+        interface => $masq_iface,
+        source    => '10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16';
+    }
+  }
+
+}
diff --git a/puppet/modules/shorewall/manifests/rules/managesieve.pp b/puppet/modules/shorewall/manifests/rules/managesieve.pp
new file mode 100644
index 00000000..ce1c321f
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/managesieve.pp
@@ -0,0 +1,25 @@
+# manage managesieve ports
+class shorewall::rules::managesieve(
+  $legacy_port = false,
+) {
+  shorewall::rule {
+    'net-me-tcp_managesieve':
+      source          =>      'net',
+      destination     =>      '$FW',
+      proto           =>      'tcp',
+      destinationport =>      '4190',
+      order           =>      260,
+      action          =>      'ACCEPT';
+  }
+  if $legacy_port {
+    shorewall::rule {
+      'net-me-tcp_managesieve_legacy':
+        source          =>      'net',
+        destination     =>      '$FW',
+        proto           =>      'tcp',
+        destinationport =>      '2000',
+        order           =>      260,
+        action          =>      'ACCEPT';
+    }
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/mdns.pp b/puppet/modules/shorewall/manifests/rules/mdns.pp
new file mode 100644
index 00000000..76b1fd90
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/mdns.pp
@@ -0,0 +1,8 @@
+class shorewall::rules::mdns {
+    shorewall::rule { 'net-me-mdns':
+        source          => 'net',
+        destination     => '$FW',
+        order           => 240,
+        action          => 'mDNS(ACCEPT)';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/munin.pp b/puppet/modules/shorewall/manifests/rules/munin.pp
new file mode 100644
index 00000000..a20a4e0a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/munin.pp
@@ -0,0 +1,16 @@
+class shorewall::rules::munin(
+  $munin_port = '4949',
+  $munin_collector = ['127.0.0.1'],
+  $collector_source = 'net'
+){
+    shorewall::params { 'MUNINPORT': value => $munin_port }
+    shorewall::params { 'MUNINCOLLECTOR': value => join(any2array($munin_collector),',') }
+    shorewall::rule{'net-me-munin-tcp':
+        source          => "${collector_source}:\$MUNINCOLLECTOR",
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '$MUNINPORT',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/mysql.pp b/puppet/modules/shorewall/manifests/rules/mysql.pp
new file mode 100644
index 00000000..0da68a19
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/mysql.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::mysql {
+	shorewall::rule {
+		'net-me-tcp_mysql':
+            source          => 'net',
+            destination     => '$FW',
+            proto           => 'tcp',
+            destinationport => '3306',
+            order           => 240,
+            action          => 'ACCEPT';
+	}
+}
diff --git a/puppet/modules/shorewall/manifests/rules/nfsd.pp b/puppet/modules/shorewall/manifests/rules/nfsd.pp
new file mode 100644
index 00000000..bd509cf2
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/nfsd.pp
@@ -0,0 +1,115 @@
+class shorewall::rules::nfsd {
+    shorewall::rule { 'net-me-portmap-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '111',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-portmap-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '111',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.statd-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '662',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.statd-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '662',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'me-net-rpc.statd-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '2020',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'me-net-rpc.statd-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '2020',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.lockd-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '32803',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.lockd-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '32769',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.mountd-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '892',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.mountd-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '892',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.rquotad-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '875',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.rquoata-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '875',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.nfsd-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '2049',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-rpc.nfsd-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '2049',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+
+}
diff --git a/puppet/modules/shorewall/manifests/rules/ntp/client.pp b/puppet/modules/shorewall/manifests/rules/ntp/client.pp
new file mode 100644
index 00000000..e0db8d45
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/ntp/client.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::ntp::client {
+    # open ntp udp port to fetch time
+    shorewall::rule {'me-net-udp_ntp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'udp',
+        destinationport => '123',
+        order           => 251,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/ntp/server.pp b/puppet/modules/shorewall/manifests/rules/ntp/server.pp
new file mode 100644
index 00000000..ed0968db
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/ntp/server.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::ntp::server {
+    shorewall::rule {'net-me-udp_ntp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '123',
+        order           => 241, 
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/openfire.pp b/puppet/modules/shorewall/manifests/rules/openfire.pp
new file mode 100644
index 00000000..0e6d1d80
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/openfire.pp
@@ -0,0 +1,12 @@
+class shorewall::rules::openfire {
+  include shorewall::rules::jaberserver
+
+  shorewall::rule { 'me-all-openfire-tcp':
+    source          => '$FW',
+    destination     => 'all',
+    proto           => 'tcp',
+    destinationport => '7070,7443,7777',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/openvpn.pp b/puppet/modules/shorewall/manifests/rules/openvpn.pp
new file mode 100644
index 00000000..55a20d2d
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/openvpn.pp
@@ -0,0 +1,18 @@
+class shorewall::rules::openvpn {
+    shorewall::rule { 'net-me-openvpn-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '1194',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'me-net-openvpn-udp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'udp',
+        destinationport => '1194',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ekeyd.pp b/puppet/modules/shorewall/manifests/rules/out/ekeyd.pp
new file mode 100644
index 00000000..8acdaad5
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ekeyd.pp
@@ -0,0 +1,10 @@
+define shorewall::rules::out::ekeyd($host) {
+  shorewall::rule { "me-${name}-tcp_ekeyd":
+    source          => '$FW',
+    destination     => "${name}:${host}",
+    proto           => 'tcp',
+    destinationport => '8888',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/git.pp b/puppet/modules/shorewall/manifests/rules/out/git.pp
new file mode 100644
index 00000000..cb88da85
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/git.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::git {
+    shorewall::rule{'me-net-git-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '9418',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ibackup.pp b/puppet/modules/shorewall/manifests/rules/out/ibackup.pp
new file mode 100644
index 00000000..856bcdb9
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ibackup.pp
@@ -0,0 +1,12 @@
+class shorewall::rules::out::ibackup(
+  $backup_host
+){
+  shorewall::rule { 'me-net-tcp_backupssh':
+    source          => '$FW',
+    destination     => "net:${backup_host}",
+    proto           => 'tcp',
+    destinationport => 'ssh',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/imap.pp b/puppet/modules/shorewall/manifests/rules/out/imap.pp
new file mode 100644
index 00000000..f1313d2c
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/imap.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::imap {
+    shorewall::rule {
+        'me-net-tcp_imap_s':
+            source          =>      '$FW',
+            destination     =>      'net',
+            proto           =>      'tcp',
+            destinationport =>      '143,993',
+            order           =>      260,
+            action          =>      'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/irc.pp b/puppet/modules/shorewall/manifests/rules/out/irc.pp
new file mode 100644
index 00000000..9c8590ab
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/irc.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::irc {
+    shorewall::rule{'me-net-irc-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '6667',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ircs.pp b/puppet/modules/shorewall/manifests/rules/out/ircs.pp
new file mode 100644
index 00000000..a71585d8
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ircs.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::ircs {
+    shorewall::rule{'me-net-ircs-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '6669',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/keyserver.pp b/puppet/modules/shorewall/manifests/rules/out/keyserver.pp
new file mode 100644
index 00000000..aa7147e0
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/keyserver.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::keyserver {
+  shorewall::rule {
+    'me-net-tcp_keyserver':
+      source          =>  '$FW',
+      destination     =>  'net',
+      proto           =>  'tcp',
+      destinationport =>  '11371,11372',
+      order           =>  240,
+      action          => 'ACCEPT'; 
+ }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/managesieve.pp b/puppet/modules/shorewall/manifests/rules/out/managesieve.pp
new file mode 100644
index 00000000..c4147d4b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/managesieve.pp
@@ -0,0 +1,25 @@
+# manage outgoing traffic to managesieve
+class shorewall::rules::out::managesieve(
+  $legacy_port = false
+) {
+  shorewall::rule {
+    'me-net-tcp_managesieve':
+      source          =>      '$FW',
+      destination     =>      'net',
+      proto           =>      'tcp',
+      destinationport =>      '4190',
+      order           =>      260,
+      action          =>      'ACCEPT';
+  }
+  if $legacy_port {
+    shorewall::rule {
+      'me-net-tcp_managesieve_legacy':
+        source          =>      '$FW',
+        destination     =>      'net',
+        proto           =>      'tcp',
+        destinationport =>      '2000',
+        order           =>      260,
+        action          =>      'ACCEPT';
+    }
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/munin.pp b/puppet/modules/shorewall/manifests/rules/out/munin.pp
new file mode 100644
index 00000000..004a3d5b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/munin.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::munin {
+  shorewall::rule { 'me-net-rcp_muninhost':
+    source          => '$FW',
+    destination     => 'net',
+    proto           => 'tcp',
+    destinationport => '4949',
+    order           => 340,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/mysql.pp b/puppet/modules/shorewall/manifests/rules/out/mysql.pp
new file mode 100644
index 00000000..1334ba6a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/mysql.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::mysql {
+    shorewall::rule {
+        'me-net-tcp_mysql':
+            source          =>  '$FW',
+            destination     =>  'net',
+            proto           =>  'tcp',
+            destinationport =>  '3306',
+            order           =>  240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/pop3.pp b/puppet/modules/shorewall/manifests/rules/out/pop3.pp
new file mode 100644
index 00000000..ebd4828f
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/pop3.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::pop3 {
+    shorewall::rule {
+        'me-net-tcp_pop3_s':
+            source          =>      '$FW',
+            destination     =>      'net',
+            proto           =>      'tcp',
+            destinationport =>      'pop3,pop3s',
+            order           =>      260,
+            action          =>      'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/postgres.pp b/puppet/modules/shorewall/manifests/rules/out/postgres.pp
new file mode 100644
index 00000000..a62d75d7
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/postgres.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::postgres {
+    shorewall::rule {
+        'me-net-tcp_postgres':
+            source          =>  '$FW',
+            destination     =>  'net',
+            proto           =>  'tcp',
+            destinationport =>  '5432',
+            order           =>  240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/puppet.pp b/puppet/modules/shorewall/manifests/rules/out/puppet.pp
new file mode 100644
index 00000000..cbe8cce7
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/puppet.pp
@@ -0,0 +1,20 @@
+class shorewall::rules::out::puppet(
+  $puppetserver = "puppet.${::domain}",
+  $puppetserver_port = 8140,
+  $puppetserver_signport = 8141
+) {
+  class{'shorewall::rules::puppet':
+    puppetserver          => $puppetserver,
+    puppetserver_port     => $puppetserver_port,
+    puppetserver_signport => $puppetserver_signport,
+  }
+  # we want to connect to the puppet server
+  shorewall::rule { 'me-net-puppet_tcp':
+    source          =>      '$FW',
+    destination     =>      'net:$PUPPETSERVER',
+    proto           =>      'tcp',
+    destinationport =>      '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
+    order           =>      340,
+    action          =>      'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/pyzor.pp b/puppet/modules/shorewall/manifests/rules/out/pyzor.pp
new file mode 100644
index 00000000..f4f5151a
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/pyzor.pp
@@ -0,0 +1,12 @@
+# pyzor calls out on 24441
+# https://wiki.apache.org/spamassassin/NetTestFirewallIssues
+class shorewall::rules::out::pyzor {
+  shorewall::rule { 'me-net-udp_pyzor':
+    source          => '$FW',
+    destination     => 'net',
+    proto           => 'udp',
+    destinationport => '24441',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/razor.pp b/puppet/modules/shorewall/manifests/rules/out/razor.pp
new file mode 100644
index 00000000..1f8397ce
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/razor.pp
@@ -0,0 +1,12 @@
+# razor calls out on 2703
+# https://wiki.apache.org/spamassassin/NetTestFirewallIssues
+class shorewall::rules::out::razor {
+  shorewall::rule { 'me-net-tcp_razor':
+    source          => '$FW',
+    destination     => 'net',
+    proto           => 'tcp',
+    destinationport => '2703',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/silc.pp b/puppet/modules/shorewall/manifests/rules/out/silc.pp
new file mode 100644
index 00000000..830df9c3
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/silc.pp
@@ -0,0 +1,19 @@
+class shorewall::rules::out::silc {
+  shorewall::rule{
+    'me-net-silc-tcp':
+      source          => '$FW',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => '706',
+      order           => 240,
+      action          => 'ACCEPT';
+    'me-net-silc-udp':
+      source          => '$FW',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => '706',
+      order           => 240,
+      action          => 'ACCEPT';
+
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/smtp.pp b/puppet/modules/shorewall/manifests/rules/out/smtp.pp
new file mode 100644
index 00000000..2cc77cc3
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/smtp.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::smtp {
+    shorewall::rule {
+        'me-net-tcp_smtp':
+            source          =>  '$FW',
+            destination     =>  'net',
+            proto           =>  'tcp',
+            destinationport =>  'smtp',
+            order           =>  240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ssh.pp b/puppet/modules/shorewall/manifests/rules/out/ssh.pp
new file mode 100644
index 00000000..c18e299b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ssh.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::ssh {
+    shorewall::rule { 'me-net-tcp_ssh':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => 'ssh',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ssh/disable.pp b/puppet/modules/shorewall/manifests/rules/out/ssh/disable.pp
new file mode 100644
index 00000000..223bf73b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ssh/disable.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::out::ssh::disable inherits shorewall::rules::out::ssh {
+  Shorewall::Rule['me-net-tcp_ssh']{
+    action => 'DROP',
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/ssh/remove.pp b/puppet/modules/shorewall/manifests/rules/out/ssh/remove.pp
new file mode 100644
index 00000000..bc0acf37
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/ssh/remove.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::out::ssh::remove inherits shorewall::rules::out::ssh {
+  Shorewall::Rule['me-net-tcp_ssh']{
+    ensure => absent,
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/whois.pp b/puppet/modules/shorewall/manifests/rules/out/whois.pp
new file mode 100644
index 00000000..d003d5c1
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/whois.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::out::whois {
+    # open whois tcp port 
+    shorewall::rule {'me-net-tcp_whois':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '43',
+        order           => 251,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/out/xmpp.pp b/puppet/modules/shorewall/manifests/rules/out/xmpp.pp
new file mode 100644
index 00000000..a1b4577c
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/out/xmpp.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::out::xmpp {
+    shorewall::rule{'me-net-xmpp-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '5222',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/pop3.pp b/puppet/modules/shorewall/manifests/rules/pop3.pp
new file mode 100644
index 00000000..25878568
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/pop3.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::pop3 {
+    shorewall::rule {
+        'net-me-tcp_pop3_s':
+            source          =>      'net',
+            destination     =>      '$FW',
+            proto           =>      'tcp',
+            destinationport =>      'pop3,pop3s',
+            order           =>      260,
+            action          =>      'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/postgres.pp b/puppet/modules/shorewall/manifests/rules/postgres.pp
new file mode 100644
index 00000000..1a22027e
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/postgres.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::postgres {
+    shorewall::rule { 'net-me-tcp_postgres':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '5432',
+        order           => 250,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/puppet.pp b/puppet/modules/shorewall/manifests/rules/puppet.pp
new file mode 100644
index 00000000..84e7d813
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/puppet.pp
@@ -0,0 +1,11 @@
+class shorewall::rules::puppet(
+  $puppetserver = "puppet.${::domain}",
+  $puppetserver_port = 8140,
+  $puppetserver_signport = 8141
+){
+  shorewall::params{
+    'PUPPETSERVER':             value => $puppetserver;
+    'PUPPETSERVER_PORT':        value => $puppetserver_port;
+    'PUPPETSERVER_SIGN_PORT':   value => $puppetserver_signport;
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/puppet/master.pp b/puppet/modules/shorewall/manifests/rules/puppet/master.pp
new file mode 100644
index 00000000..925979c3
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/puppet/master.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::puppet::master {
+  shorewall::rule { 'net-me-tcp_puppet-main':
+    source          => 'net',
+    destination     => '$FW',
+    proto           => 'tcp',
+    destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT',
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/rsync.pp b/puppet/modules/shorewall/manifests/rules/rsync.pp
new file mode 100644
index 00000000..144624db
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/rsync.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::rsync {
+    shorewall::rule{'me-net-rsync-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '873',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/silcd.pp b/puppet/modules/shorewall/manifests/rules/silcd.pp
new file mode 100644
index 00000000..91ee4a59
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/silcd.pp
@@ -0,0 +1,19 @@
+class shorewall::rules::silcd {
+  shorewall::rule{
+    'net-me-silcd-tcp':
+      source          => 'net',
+      destination     => '$FW',
+      proto           => 'tcp',
+      destinationport => '706',
+      order           => 240,
+      action          => 'ACCEPT';
+    'net-me-silcd-udp':
+      source          => 'net',
+      destination     => '$FW',
+      proto           => 'udp',
+      destinationport => '706',
+      order           => 240,
+      action          => 'ACCEPT';
+
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/smtp.pp b/puppet/modules/shorewall/manifests/rules/smtp.pp
new file mode 100644
index 00000000..b0389012
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/smtp.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::smtp {
+    shorewall::rule { 'net-me-smtp-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '25',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/smtp/disable.pp b/puppet/modules/shorewall/manifests/rules/smtp/disable.pp
new file mode 100644
index 00000000..cee85b08
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/smtp/disable.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::smtp::disable inherits shorewall::rules::smtp {
+  Shorewall::Rule['net-me-smtp-tcp']{
+    action          => 'DROP'
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/smtp_submission.pp b/puppet/modules/shorewall/manifests/rules/smtp_submission.pp
new file mode 100644
index 00000000..dff90f35
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/smtp_submission.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::smtp_submission {
+    shorewall::rule { 'net-me-smtp_submission-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '587',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/smtp_submission/disable.pp b/puppet/modules/shorewall/manifests/rules/smtp_submission/disable.pp
new file mode 100644
index 00000000..9724fe79
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/smtp_submission/disable.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::smtp_submission::disable inherits shorewall::rules::smtp_submission {
+  Shorewall::Rule['net-me-smtp_submission-tcp']{
+    action          => 'DROP'
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/smtps.pp b/puppet/modules/shorewall/manifests/rules/smtps.pp
new file mode 100644
index 00000000..48183f74
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/smtps.pp
@@ -0,0 +1,10 @@
+class shorewall::rules::smtps {
+	shorewall::rule {'net-me-smtps-tcp':
+        source          =>      'net',
+        destination     =>      '$FW',
+        proto           =>      'tcp',
+        destinationport =>      '465',
+        order           =>      240,
+        action          =>      'ACCEPT';
+	}
+}
diff --git a/puppet/modules/shorewall/manifests/rules/smtps/disable.pp b/puppet/modules/shorewall/manifests/rules/smtps/disable.pp
new file mode 100644
index 00000000..24bd21fb
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/smtps/disable.pp
@@ -0,0 +1,5 @@
+class shorewall::rules::smtps::disable inherits shorewall::rules::smtps {
+  Shorewall::Rule['net-me-smtps-tcp']{
+        action  => 'DROP',
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/sobby/instance.pp b/puppet/modules/shorewall/manifests/rules/sobby/instance.pp
new file mode 100644
index 00000000..7151976b
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/sobby/instance.pp
@@ -0,0 +1,11 @@
+define shorewall::rules::sobby::instance( $port ){
+  shorewall::rule {
+    "net-me-tcp_sobby_${name}":
+      source          => 'net',
+      destination     => '$FW',
+      proto           => 'tcp',
+      destinationport => $port,
+      order           => 240,
+      action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/ssh.pp b/puppet/modules/shorewall/manifests/rules/ssh.pp
new file mode 100644
index 00000000..3a1b5309
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/ssh.pp
@@ -0,0 +1,13 @@
+class shorewall::rules::ssh(
+  $ports,
+  $source = 'net'
+) {
+  shorewall::rule { 'net-me-tcp_ssh':
+    source          => $shorewall::rules::ssh::source,
+    destination     => '$FW',
+    proto           => 'tcp',
+    destinationport => join($shorewall::rules::ssh::ports,','),
+    order           => 240,
+    action          => 'ACCEPT';
+  }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/syslog.pp b/puppet/modules/shorewall/manifests/rules/syslog.pp
new file mode 100644
index 00000000..de802e25
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/syslog.pp
@@ -0,0 +1,12 @@
+class shorewall::rules::syslog {
+    shorewall::rule { 'net-me-syslog-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '514',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
+
+
diff --git a/puppet/modules/shorewall/manifests/rules/tftp.pp b/puppet/modules/shorewall/manifests/rules/tftp.pp
new file mode 100644
index 00000000..78877293
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/tftp.pp
@@ -0,0 +1,18 @@
+class shorewall::rules::tftp {
+    shorewall::rule { 'net-me-tftp-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '69',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-tftp-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '69',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/tinc.pp b/puppet/modules/shorewall/manifests/rules/tinc.pp
new file mode 100644
index 00000000..79cf92e4
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/tinc.pp
@@ -0,0 +1,34 @@
+class shorewall::rules::tinc {
+    shorewall::rule { 'net-me-tinc-tcp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'tcp',
+        destinationport => '655',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'me-net-tinc-tcp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'tcp',
+        destinationport => '655',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'net-me-tinc-udp':
+        source          => 'net',
+        destination     => '$FW',
+        proto           => 'udp',
+        destinationport => '655',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+    shorewall::rule { 'me-net-tinc-udp':
+        source          => '$FW',
+        destination     => 'net',
+        proto           => 'udp',
+        destinationport => '655',
+        order           => 240,
+        action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/tomcat.pp b/puppet/modules/shorewall/manifests/rules/tomcat.pp
new file mode 100644
index 00000000..3c6f9df0
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/tomcat.pp
@@ -0,0 +1,12 @@
+class shorewall::rules::tomcat {
+    # open tomcat port
+    shorewall::rule {
+        'net-me-tomcat-tcp':
+            source          => 'net',
+            destination     => '$FW',
+            proto           => 'tcp',
+            destinationport => '8080',
+            order           => 240,
+            action          => 'ACCEPT';
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/rules/torify.pp b/puppet/modules/shorewall/manifests/rules/torify.pp
new file mode 100644
index 00000000..f6e62d81
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/torify.pp
@@ -0,0 +1,29 @@
+# shorewall::rules::torify
+#
+# Note: shorewall::rules::torify cannot be used several times with the
+# same user listed in the $users array. This restriction applies to
+# using this define multiple times without providing a $users
+# parameter.
+#
+# Parameters:
+#
+# - users: every element of this array must be valid in shorewall
+#   rules user/group column.
+# - destinations: every element of this array must be valid in
+#   shorewall rules original destination column.
+
+define shorewall::rules::torify(
+  $users        = ['-'],
+  $destinations = ['-'],
+  $allow_rfc1918 = true
+){
+
+  $originaldest = join($destinations,',')
+
+  shorewall::rules::torify::user {
+    $users:
+      originaldest  => $originaldest,
+      allow_rfc1918 => $allow_rfc1918;
+  }
+
+}
diff --git a/puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp b/puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp
new file mode 100644
index 00000000..3c18db69
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/torify/allow_tor_transparent_proxy.pp
@@ -0,0 +1,21 @@
+class shorewall::rules::torify::allow_tor_transparent_proxy {
+
+  $rule = "allow-tor-transparent-proxy"
+
+  if !defined(Shorewall::Rule["$rule"]) {
+    # A weirdness in shorewall forces us to explicitly allow traffic to
+    # net:$tor_transparent_proxy_host:$tor_transparent_proxy_port even
+    # if $FW->$FW traffic is allowed. This anyway avoids us special-casing
+    # the remote Tor transparent proxy situation.
+    shorewall::rule {
+      "$rule":
+        source          => '$FW',
+        destination     => "net:${shorewall::tor_transparent_proxy_host}",
+        proto           => 'tcp',
+        destinationport => $shorewall::tor_transparent_proxy_port,
+        order           => 100,
+        action          => 'ACCEPT';
+    }
+  }
+
+}
diff --git a/puppet/modules/shorewall/manifests/rules/torify/allow_tor_user.pp b/puppet/modules/shorewall/manifests/rules/torify/allow_tor_user.pp
new file mode 100644
index 00000000..f44c1f01
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/torify/allow_tor_user.pp
@@ -0,0 +1,15 @@
+class shorewall::rules::torify::allow_tor_user {
+
+  $whitelist_rule = "allow-from-tor-user"
+  if !defined(Shorewall::Rule["$whitelist_rule"]) {
+    shorewall::rule {
+      "$whitelist_rule":
+        source      => '$FW',
+        destination => 'all',
+        user        => $shorewall::tor_user,
+        order       => 101,
+        action      => 'ACCEPT';
+    }
+  }
+
+}
diff --git a/puppet/modules/shorewall/manifests/rules/torify/redirect_tcp_to_tor.pp b/puppet/modules/shorewall/manifests/rules/torify/redirect_tcp_to_tor.pp
new file mode 100644
index 00000000..2bee6584
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/torify/redirect_tcp_to_tor.pp
@@ -0,0 +1,40 @@
+define shorewall::rules::torify::redirect_tcp_to_tor(
+  $user = '-',
+  $originaldest = '-'
+){
+
+  # hash the destination as it may contain slashes
+  $originaldest_sha1 = sha1($originaldest)
+  $rule = "redirect-to-tor-user=${user}-to=${originaldest_sha1}"
+
+  if !defined(Shorewall::Rule["$rule"]) {
+
+    $originaldest_real = $originaldest ? {
+      '-'     => '!127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16',
+      default => $originaldest,
+    }
+
+    $user_real = $user ? {
+      '-'     => "!${shorewall::tor_user}",
+      default => $user,
+    }
+
+    $destzone = $shorewall::tor_transparent_proxy_host ? {
+      '127.0.0.1' => '$FW',
+      default     => 'net'
+    }
+    
+    shorewall::rule {
+      "$rule":
+        source       => '$FW',
+        destination  => "${destzone}:${shorewall::tor_transparent_proxy_host}:${shorewall::tor_transparent_proxy_port}",
+        proto        => 'tcp:syn',
+        originaldest => $originaldest_real,
+        user         => $user_real,
+        order        => 110,
+        action       => 'DNAT';
+    }
+
+  }
+
+}
diff --git a/puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp b/puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp
new file mode 100644
index 00000000..80240ec7
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/torify/reject_non_tor.pp
@@ -0,0 +1,32 @@
+define shorewall::rules::torify::reject_non_tor(
+  $user = '-',
+  $originaldest = '-',
+  $allow_rfc1918 = true
+){
+
+  # hash the destination as it may contain slashes
+  $originaldest_sha1 = sha1($originaldest)
+  $rule = "reject-non-tor-from-${user}-to=${originaldest_sha1}"
+
+  if $originaldest == '-' {
+    $originaldest_real = $allow_rfc1918 ? {
+      false   => '!127.0.0.1',
+      default => '!127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16',
+    }
+  } else {
+    $originaldest_real = $originaldest
+  }
+
+  if !defined(Shorewall::Rule["$rule"]) {
+    shorewall::rule {
+      "$rule":
+        source          => '$FW',
+        destination     => 'all',
+        originaldest    => $originaldest_real,
+        user            => $user,
+        order           => 120,
+        action          => 'REJECT';
+    }
+  }
+
+}
diff --git a/puppet/modules/shorewall/manifests/rules/torify/user.pp b/puppet/modules/shorewall/manifests/rules/torify/user.pp
new file mode 100644
index 00000000..5caccfd6
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/rules/torify/user.pp
@@ -0,0 +1,27 @@
+define shorewall::rules::torify::user(
+  $originaldest = '-',
+  $allow_rfc1918 = true
+){
+
+  $user = $name
+
+  include shorewall::rules::torify::allow_tor_transparent_proxy
+
+  if $originaldest == '-' and $user == '-' {
+    include shorewall::rules::torify::allow_tor_user
+  }
+
+  shorewall::rules::torify::redirect_tcp_to_tor {
+    "redirect-to-tor-user=${user}-to=${originaldest}":
+      user         => $user,
+      originaldest => $originaldest
+  }
+
+  shorewall::rules::torify::reject_non_tor {
+    "reject-non-tor-user=${user}-to=${originaldest}":
+      user          => "$user",
+      originaldest  => $originaldest,
+      allow_rfc1918 => $allow_rfc1918;
+  }
+
+}
diff --git a/puppet/modules/shorewall/manifests/tcclasses.pp b/puppet/modules/shorewall/manifests/tcclasses.pp
new file mode 100644
index 00000000..4e30a556
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/tcclasses.pp
@@ -0,0 +1,12 @@
+define shorewall::tcclasses(
+    $interface,
+    $rate,
+    $ceil,
+    $priority,
+    $options = '',
+    $order = '1'
+){
+    shorewall::entry { "tcclasses-${order}-${name}":
+        line => "# ${name}\n${interface} ${order} ${rate} ${ceil} ${priority} ${options}",
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/tcdevices.pp b/puppet/modules/shorewall/manifests/tcdevices.pp
new file mode 100644
index 00000000..f4e88d80
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/tcdevices.pp
@@ -0,0 +1,11 @@
+define shorewall::tcdevices(
+    $in_bandwidth,
+    $out_bandwidth,
+    $options = '',
+    $redirected_interfaces = '',
+    $order = '100'
+){
+    shorewall::entry { "tcdevices-${order}-${name}":
+        line => "${name} ${in_bandwidth} ${out_bandwidth} ${options} ${redirected_interfaces}",
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/tcrules.pp b/puppet/modules/shorewall/manifests/tcrules.pp
new file mode 100644
index 00000000..b9ab4a9d
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/tcrules.pp
@@ -0,0 +1,12 @@
+define shorewall::tcrules(
+    $source,
+    $destination,
+    $protocol = 'all',
+    $ports,
+    $client_ports = '',
+    $order = '1'
+){
+    shorewall::entry { "tcrules-${order}-${name}":
+        line => "# ${name}\n${order} ${source} ${destination} ${protocol} ${ports} ${client_ports}",
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/tunnel.pp b/puppet/modules/shorewall/manifests/tunnel.pp
new file mode 100644
index 00000000..2cac9227
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/tunnel.pp
@@ -0,0 +1,11 @@
+define shorewall::tunnel(
+    $tunnel_type,
+    $zone,
+    $gateway = '0.0.0.0/0',
+    $gateway_zones = '',
+    $order = '1'
+) {
+    shorewall::entry { "tunnel-${order}-${name}":
+        line => "# ${name}\n${tunnel_type} ${zone} ${gateway} ${gateway_zones}",
+    }
+}
diff --git a/puppet/modules/shorewall/manifests/zone.pp b/puppet/modules/shorewall/manifests/zone.pp
new file mode 100644
index 00000000..81e57711
--- /dev/null
+++ b/puppet/modules/shorewall/manifests/zone.pp
@@ -0,0 +1,14 @@
+define shorewall::zone(
+    $type,
+    $options = '-',
+    $in = '-',
+    $out = '-',
+    $parent = '-',
+    $order = 100
+){
+    $real_name = $parent ? { '-' => $name, default => "${name}:${parent}" }
+    shorewall::entry { "zones-${order}-${name}":
+        line => "${real_name} ${type} ${options} ${in} ${out}"
+    }
+}
+
diff --git a/puppet/modules/shorewall/templates/debian_default.erb b/puppet/modules/shorewall/templates/debian_default.erb
new file mode 100644
index 00000000..ec64cbe0
--- /dev/null
+++ b/puppet/modules/shorewall/templates/debian_default.erb
@@ -0,0 +1,26 @@
+# prevent startup with default configuration
+# set the following varible to 1 in order to allow Shorewall to start
+
+# This file is brought to you by puppet
+
+startup=<%= scope.lookupvar('shorewall::startup') == "0" ? '0' : '1' %>
+
+# if your Shorewall configuration requires detection of the ip address of a ppp
+# interface, you must list such interfaces in "wait_interface" to get Shorewall to
+# wait until the interface is configured. Otherwise the script will fail because
+# it won't be able to detect the IP address.
+#
+# Example:
+#    wait_interface="ppp0"
+# or
+#    wait_interface="ppp0 ppp1"
+# or, if you have defined  in /etc/shorewall/params
+#    wait_interface=
+
+#
+# Startup options
+#
+
+OPTIONS=""
+
+# EOF
-- 
cgit v1.2.3


From 81210aea5cf136194598e7a399ce307ecbe088f1 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:52 -0400
Subject: git subrepo clone https://leap.se/git/puppet_resolvconf
 puppet/modules/resolvconf

subrepo:
  subdir:   "puppet/modules/resolvconf"
  merged:   "c7eca07"
upstream:
  origin:   "https://leap.se/git/puppet_resolvconf"
  branch:   "master"
  commit:   "c7eca07"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I41a76bde0943f76786b7a67c3b9ee4a6b4db7f28
---
 puppet/modules/resolvconf/.gitrepo                 | 11 +++++++++
 puppet/modules/resolvconf/manifests/init.pp        | 27 ++++++++++++++++++++++
 .../resolvconf/templates/resolvconf.OpenBSD.erb    |  5 ++++
 puppet/modules/resolvconf/templates/resolvconf.erb |  7 ++++++
 4 files changed, 50 insertions(+)
 create mode 100644 puppet/modules/resolvconf/.gitrepo
 create mode 100644 puppet/modules/resolvconf/manifests/init.pp
 create mode 100644 puppet/modules/resolvconf/templates/resolvconf.OpenBSD.erb
 create mode 100644 puppet/modules/resolvconf/templates/resolvconf.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/resolvconf/.gitrepo b/puppet/modules/resolvconf/.gitrepo
new file mode 100644
index 00000000..3359b659
--- /dev/null
+++ b/puppet/modules/resolvconf/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_resolvconf
+	branch = master
+	commit = c7eca077fdda063edc96d3bea02c4774569e4b10
+	parent = 6209061fd112fed1715676abb7b6ae4697f21d83
+	cmdver = 0.3.0
diff --git a/puppet/modules/resolvconf/manifests/init.pp b/puppet/modules/resolvconf/manifests/init.pp
new file mode 100644
index 00000000..c22c4ea6
--- /dev/null
+++ b/puppet/modules/resolvconf/manifests/init.pp
@@ -0,0 +1,27 @@
+#
+# resolvconf module
+#
+# Copyright 2008, admin(at)immerda.ch
+# Copyright 2008, Puzzle ITC GmbH
+# Marcel Härry haerry+puppet(at)puzzle.ch
+# Simon Josi josi+puppet(at)puzzle.ch
+#
+# This program is free software; you can redistribute 
+# it and/or modify it under the terms of the GNU 
+# General Public License version 3 as published by 
+# the Free Software Foundation.
+#
+
+class resolvconf(
+  $domain = $::domain,  
+  $search = $::domain,
+  $nameservers = [ '8.8.8.8' ]
+) {
+  file{'/etc/resolv.conf':
+    content => $::operatingsystem ? {
+      openbsd => template("resolvconf/resolvconf.${::operatingsystem}.erb"),
+      default => template('resolvconf/resolvconf.erb'),
+    },
+    owner => root, group => 0, mode => 0444;
+  }
+}
diff --git a/puppet/modules/resolvconf/templates/resolvconf.OpenBSD.erb b/puppet/modules/resolvconf/templates/resolvconf.OpenBSD.erb
new file mode 100644
index 00000000..48daf279
--- /dev/null
+++ b/puppet/modules/resolvconf/templates/resolvconf.OpenBSD.erb
@@ -0,0 +1,5 @@
+# managed by puppet
+lookup file bind
+<% scope.lookupvar('resolvconf::nameservers').each do |nameserver| -%>
+nameserver <%= nameserver %> 
+<% end -%>
diff --git a/puppet/modules/resolvconf/templates/resolvconf.erb b/puppet/modules/resolvconf/templates/resolvconf.erb
new file mode 100644
index 00000000..d8136bfb
--- /dev/null
+++ b/puppet/modules/resolvconf/templates/resolvconf.erb
@@ -0,0 +1,7 @@
+# managed by puppet
+domain <%= scope.lookupvar('resolvconf::domain') %>
+search <%= scope.lookupvar('resolvconf::search') %>
+
+<% scope.lookupvar('resolvconf::nameservers').each do |nameserver| -%>
+nameserver <%= nameserver %>
+<% end -%>
-- 
cgit v1.2.3


From f2019755fd724fb1020cb2d97cdf82b751450ebc Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:54 -0400
Subject: git subrepo clone https://leap.se/git/puppet_couchdb
 puppet/modules/couchdb

subrepo:
  subdir:   "puppet/modules/couchdb"
  merged:   "76ff149"
upstream:
  origin:   "https://leap.se/git/puppet_couchdb"
  branch:   "master"
  commit:   "76ff149"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I9ccb1a9dfdaa083814ea395132c42a778052f59b
---
 puppet/modules/couchdb/.fixtures.yml               |   6 +
 puppet/modules/couchdb/.gitrepo                    |  11 ++
 puppet/modules/couchdb/Gemfile                     |  11 ++
 puppet/modules/couchdb/README.md                   |  32 +++
 puppet/modules/couchdb/Rakefile                    |  19 ++
 puppet/modules/couchdb/files/Debian/couchdb        | 160 +++++++++++++++
 puppet/modules/couchdb/files/couch-doc-diff        |  17 ++
 puppet/modules/couchdb/files/couch-doc-update      | 219 +++++++++++++++++++++
 puppet/modules/couchdb/files/local.ini             |  84 ++++++++
 .../couchdb/lib/facter/couchdb_pwhash_alg.rb       |  43 ++++
 .../modules/couchdb/lib/facter/couchdb_version.rb  |  34 ++++
 .../lib/puppet/parser/functions/couchdblookup.rb   |  55 ++++++
 .../couchdb/lib/puppet/parser/functions/pbkdf2.rb  |  62 ++++++
 puppet/modules/couchdb/manifests/add_user.pp       |  39 ++++
 puppet/modules/couchdb/manifests/backup.pp         |  51 +++++
 puppet/modules/couchdb/manifests/base.pp           | 124 ++++++++++++
 puppet/modules/couchdb/manifests/bigcouch.pp       |  51 +++++
 .../modules/couchdb/manifests/bigcouch/add_node.pp |   8 +
 .../modules/couchdb/manifests/bigcouch/debian.pp   |  11 ++
 .../modules/couchdb/manifests/bigcouch/document.pp |  14 ++
 .../couchdb/manifests/bigcouch/package/cloudant.pp |  35 ++++
 puppet/modules/couchdb/manifests/create_db.pp      |  21 ++
 puppet/modules/couchdb/manifests/debian.pp         |  15 ++
 puppet/modules/couchdb/manifests/deploy_config.pp  |  12 ++
 puppet/modules/couchdb/manifests/document.pp       |  47 +++++
 puppet/modules/couchdb/manifests/init.pp           |  31 +++
 puppet/modules/couchdb/manifests/mirror_db.pp      |  21 ++
 puppet/modules/couchdb/manifests/params.pp         |  23 +++
 puppet/modules/couchdb/manifests/query.pp          |  12 ++
 puppet/modules/couchdb/manifests/query/setup.pp    |  10 +
 puppet/modules/couchdb/manifests/redhat.pp         |   1 +
 .../modules/couchdb/manifests/ssl/deploy_cert.pp   |  28 +++
 .../modules/couchdb/manifests/ssl/generate_cert.pp |  25 +++
 puppet/modules/couchdb/manifests/update.pp         |  12 ++
 .../modules/couchdb/spec/classes/couchdb_spec.rb   |  35 ++++
 .../couchdb/spec/fixtures/manifests/site.pp        |   8 +
 .../couchdb/spec/functions/versioncmp_spec.rb      |   9 +
 puppet/modules/couchdb/spec/spec_helper.rb         |   9 +
 puppet/modules/couchdb/templates/admin.ini.erb     |   9 +
 .../modules/couchdb/templates/bigcouch/default.ini | 172 ++++++++++++++++
 puppet/modules/couchdb/templates/bigcouch/vm.args  |  32 +++
 .../couchdb/templates/couchdb-backup.py.erb        |  32 +++
 42 files changed, 1650 insertions(+)
 create mode 100644 puppet/modules/couchdb/.fixtures.yml
 create mode 100644 puppet/modules/couchdb/.gitrepo
 create mode 100644 puppet/modules/couchdb/Gemfile
 create mode 100644 puppet/modules/couchdb/README.md
 create mode 100644 puppet/modules/couchdb/Rakefile
 create mode 100755 puppet/modules/couchdb/files/Debian/couchdb
 create mode 100644 puppet/modules/couchdb/files/couch-doc-diff
 create mode 100644 puppet/modules/couchdb/files/couch-doc-update
 create mode 100644 puppet/modules/couchdb/files/local.ini
 create mode 100644 puppet/modules/couchdb/lib/facter/couchdb_pwhash_alg.rb
 create mode 100644 puppet/modules/couchdb/lib/facter/couchdb_version.rb
 create mode 100644 puppet/modules/couchdb/lib/puppet/parser/functions/couchdblookup.rb
 create mode 100644 puppet/modules/couchdb/lib/puppet/parser/functions/pbkdf2.rb
 create mode 100644 puppet/modules/couchdb/manifests/add_user.pp
 create mode 100644 puppet/modules/couchdb/manifests/backup.pp
 create mode 100644 puppet/modules/couchdb/manifests/base.pp
 create mode 100644 puppet/modules/couchdb/manifests/bigcouch.pp
 create mode 100644 puppet/modules/couchdb/manifests/bigcouch/add_node.pp
 create mode 100644 puppet/modules/couchdb/manifests/bigcouch/debian.pp
 create mode 100644 puppet/modules/couchdb/manifests/bigcouch/document.pp
 create mode 100644 puppet/modules/couchdb/manifests/bigcouch/package/cloudant.pp
 create mode 100644 puppet/modules/couchdb/manifests/create_db.pp
 create mode 100644 puppet/modules/couchdb/manifests/debian.pp
 create mode 100644 puppet/modules/couchdb/manifests/deploy_config.pp
 create mode 100644 puppet/modules/couchdb/manifests/document.pp
 create mode 100644 puppet/modules/couchdb/manifests/init.pp
 create mode 100644 puppet/modules/couchdb/manifests/mirror_db.pp
 create mode 100644 puppet/modules/couchdb/manifests/params.pp
 create mode 100644 puppet/modules/couchdb/manifests/query.pp
 create mode 100644 puppet/modules/couchdb/manifests/query/setup.pp
 create mode 100644 puppet/modules/couchdb/manifests/redhat.pp
 create mode 100644 puppet/modules/couchdb/manifests/ssl/deploy_cert.pp
 create mode 100644 puppet/modules/couchdb/manifests/ssl/generate_cert.pp
 create mode 100644 puppet/modules/couchdb/manifests/update.pp
 create mode 100644 puppet/modules/couchdb/spec/classes/couchdb_spec.rb
 create mode 100644 puppet/modules/couchdb/spec/fixtures/manifests/site.pp
 create mode 100644 puppet/modules/couchdb/spec/functions/versioncmp_spec.rb
 create mode 100644 puppet/modules/couchdb/spec/spec_helper.rb
 create mode 100644 puppet/modules/couchdb/templates/admin.ini.erb
 create mode 100644 puppet/modules/couchdb/templates/bigcouch/default.ini
 create mode 100644 puppet/modules/couchdb/templates/bigcouch/vm.args
 create mode 100644 puppet/modules/couchdb/templates/couchdb-backup.py.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/couchdb/.fixtures.yml b/puppet/modules/couchdb/.fixtures.yml
new file mode 100644
index 00000000..50c6c9ac
--- /dev/null
+++ b/puppet/modules/couchdb/.fixtures.yml
@@ -0,0 +1,6 @@
+fixtures:
+  symlinks:
+    couchdb: "#{source_dir}"
+  repositories:
+    stdlib:    " https://leap.se/git/puppet_stdlib"
+
diff --git a/puppet/modules/couchdb/.gitrepo b/puppet/modules/couchdb/.gitrepo
new file mode 100644
index 00000000..d72ab390
--- /dev/null
+++ b/puppet/modules/couchdb/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_couchdb
+	branch = master
+	commit = 76ff149a095023611c05bbb00157d06f87b07c05
+	parent = 81210aea5cf136194598e7a399ce307ecbe088f1
+	cmdver = 0.3.0
diff --git a/puppet/modules/couchdb/Gemfile b/puppet/modules/couchdb/Gemfile
new file mode 100644
index 00000000..1c86e980
--- /dev/null
+++ b/puppet/modules/couchdb/Gemfile
@@ -0,0 +1,11 @@
+source "https://rubygems.org"
+
+group :test do
+  gem "rake"
+  gem "puppet", ENV['PUPPET_VERSION'] || '~> 3.7.0'
+  gem "rspec", '< 3.2.0'
+  gem "rspec-puppet"
+  gem "puppetlabs_spec_helper"
+  gem "metadata-json-lint"
+  gem "rspec-puppet-facts"
+end
diff --git a/puppet/modules/couchdb/README.md b/puppet/modules/couchdb/README.md
new file mode 100644
index 00000000..096221a4
--- /dev/null
+++ b/puppet/modules/couchdb/README.md
@@ -0,0 +1,32 @@
+# Couchdb Puppet module
+
+This module is based on the one from Camptocamp_.
+
+.. _Camptocamp: http://www.camptocamp.com/
+
+For more information about couchdb see http://couchdb.apache.org/
+
+# Dependencies
+
+- ruby module from the shared-modules group
+
+# Couchdb debian packages
+
+## Jessie
+
+There are no couchdb packages for jessie, so the only way is to
+to configure apt to install couchdb from unstable by adding a
+sources list file to `/etc/apt/sources.list.d`.
+
+## Example usage
+
+This will setup couchdb:
+
+    # needed for wget call, which is unqualified by purpose so we don't force
+    # a location for the wget binary
+    Exec { path    => '/usr/bin:/usr/sbin/:/bin:/sbin:/usr/local/bin:/usr/local/sbin' }
+
+    class { 'couchdb':
+      admin_pw => '123'
+    }
+
diff --git a/puppet/modules/couchdb/Rakefile b/puppet/modules/couchdb/Rakefile
new file mode 100644
index 00000000..85326bb4
--- /dev/null
+++ b/puppet/modules/couchdb/Rakefile
@@ -0,0 +1,19 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
+
+desc "Validate manifests, templates, and ruby files"
+task :validate do
+  Dir['manifests/**/*.pp'].each do |manifest|
+    sh "puppet parser validate --noop #{manifest}"
+  end
+  Dir['spec/**/*.rb','lib/**/*.rb'].each do |ruby_file|
+    sh "ruby -c #{ruby_file}" unless ruby_file =~ /spec\/fixtures/
+  end
+  Dir['templates/**/*.erb'].each do |template|
+    sh "erb -P -x -T '-' #{template} | ruby -c"
+  end
+end
+
+task :test => [:lint, :syntax , :validate, :spec]
diff --git a/puppet/modules/couchdb/files/Debian/couchdb b/puppet/modules/couchdb/files/Debian/couchdb
new file mode 100755
index 00000000..ccdfe716
--- /dev/null
+++ b/puppet/modules/couchdb/files/Debian/couchdb
@@ -0,0 +1,160 @@
+#!/bin/sh -e
+
+# Licensed under the Apache License, Version 2.0 (the "License"); you may not
+# use this file except in compliance with the License. You may obtain a copy of
+# the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations under
+# the License.
+
+### BEGIN INIT INFO
+# Provides:          couchdb
+# Required-Start:    $local_fs $remote_fs
+# Required-Stop:     $local_fs $remote_fs
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: Apache CouchDB init script
+# Description:       Apache CouchDB init script for the database server.
+### END INIT INFO
+
+SCRIPT_OK=0
+SCRIPT_ERROR=1
+
+DESCRIPTION="database server"
+NAME=couchdb
+SCRIPT_NAME=`basename $0`
+COUCHDB=/usr/bin/couchdb
+CONFIGURATION_FILE=/etc/default/couchdb
+RUN_DIR=/var/run/couchdb
+LSB_LIBRARY=/lib/lsb/init-functions
+
+if test ! -x $COUCHDB; then
+    exit $SCRIPT_ERROR
+fi
+
+if test -r $CONFIGURATION_FILE; then
+    . $CONFIGURATION_FILE
+fi
+
+log_daemon_msg () {
+    # Dummy function to be replaced by LSB library.
+
+    echo $@
+}
+
+log_end_msg () {
+    # Dummy function to be replaced by LSB library.
+
+    if test "$1" != "0"; then
+      echo "Error with $DESCRIPTION: $NAME"
+    fi
+    return $1
+}
+
+if test -r $LSB_LIBRARY; then
+    . $LSB_LIBRARY
+fi
+
+run_command () {
+    command="$1"
+    if test -n "$COUCHDB_OPTIONS"; then
+        command="$command $COUCHDB_OPTIONS"
+    fi
+    if test -n "$COUCHDB_USER"; then
+        if su $COUCHDB_USER -c "$command"; then
+            return $SCRIPT_OK
+        else
+            return $SCRIPT_ERROR
+        fi
+    else
+        if $command; then
+            return $SCRIPT_OK
+        else
+            return $SCRIPT_ERROR
+        fi
+    fi
+}
+
+start_couchdb () {
+    # Start Apache CouchDB as a background process.
+
+    mkdir -p "$RUN_DIR"
+    chown -R "$COUCHDB_USER" "$RUN_DIR"
+    command="$COUCHDB -b"
+    if test -n "$COUCHDB_STDOUT_FILE"; then
+        command="$command -o $COUCHDB_STDOUT_FILE"
+    fi
+    if test -n "$COUCHDB_STDERR_FILE"; then
+        command="$command -e $COUCHDB_STDERR_FILE"
+    fi
+    if test -n "$COUCHDB_RESPAWN_TIMEOUT"; then
+        command="$command -r $COUCHDB_RESPAWN_TIMEOUT"
+    fi
+    run_command "$command" > /dev/null
+}
+
+stop_couchdb () {
+    # Stop the running Apache CouchDB process.
+
+    run_command "$COUCHDB -d" > /dev/null
+    pkill -u couchdb
+    # always return true even if no remaining couchdb procs got killed
+    /bin/true
+}
+
+display_status () {
+    # Display the status of the running Apache CouchDB process.
+
+    run_command "$COUCHDB -s"
+}
+
+parse_script_option_list () {
+    # Parse arguments passed to the script and take appropriate action.
+
+    case "$1" in
+        start)
+            log_daemon_msg "Starting $DESCRIPTION" $NAME
+            if start_couchdb; then
+                log_end_msg $SCRIPT_OK
+            else
+                log_end_msg $SCRIPT_ERROR
+            fi
+            ;;
+        stop)
+            log_daemon_msg "Stopping $DESCRIPTION" $NAME
+            if stop_couchdb; then
+                log_end_msg $SCRIPT_OK
+            else
+                log_end_msg $SCRIPT_ERROR
+            fi
+            ;;
+        restart|force-reload)
+            log_daemon_msg "Restarting $DESCRIPTION" $NAME
+            if stop_couchdb; then
+                if start_couchdb; then
+                    log_end_msg $SCRIPT_OK
+                else
+                    log_end_msg $SCRIPT_ERROR
+                fi
+            else
+                log_end_msg $SCRIPT_ERROR
+            fi
+            ;;
+        status)
+            display_status
+            ;;
+        *)
+            cat << EOF >&2
+Usage: $SCRIPT_NAME {start|stop|restart|force-reload|status}
+EOF
+            exit $SCRIPT_ERROR
+            ;;
+    esac
+}
+
+parse_script_option_list $@
diff --git a/puppet/modules/couchdb/files/couch-doc-diff b/puppet/modules/couchdb/files/couch-doc-diff
new file mode 100644
index 00000000..a5907d5e
--- /dev/null
+++ b/puppet/modules/couchdb/files/couch-doc-diff
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# Run a diff between a couch document specified as the first parameter
+# and the second parameter.
+# Diff returns 0 if there is no difference. This way you can tell the data
+# is already on the couch.
+# Both the couch document and the second paramter will be pretty printed
+# before comparison so differences in spaces etc. do not matter.
+# All keys starting with an underscore on the couch such as _id and _rev
+# will be removed before the comparison - we assume we want to compare
+# the real data, not the metadata about the document as we usually do not
+# know or care about what the id and revision will be.
+
+curl -s --netrc-file /etc/couchdb/couchdb.netrc $1 \
+ | python -mjson.tool \
+ | grep -v '^\s*"_' \
+ | diff -w - <(echo $2 | python -mjson.tool)
diff --git a/puppet/modules/couchdb/files/couch-doc-update b/puppet/modules/couchdb/files/couch-doc-update
new file mode 100644
index 00000000..a137e7ff
--- /dev/null
+++ b/puppet/modules/couchdb/files/couch-doc-update
@@ -0,0 +1,219 @@
+#!/usr/bin/ruby
+require 'syslog'
+
+#
+# This script will delete or update the values of a particular couchdb document. The benefit of this little script over
+# using a simple curl command for updating a document is this:
+#
+#   * exit non-zero status if document was not updated.
+#   * updates existing documents easily, taking care of the _rev id for you.
+#   * if document doesn't exist, it is created
+#
+# REQUIREMENTS
+#
+#   gem 'couchrest'
+#
+# USAGE
+#
+#   see the ouput of
+#
+#     couch-doc-update
+#
+#   the content of <file> will be merged with the data provided.
+#   If you only want the file content use --data '{}'
+#
+# EXAMPLE
+#
+#   create a new user:
+#     couch-doc-update --db _users --id org.couchdb.user:ca_daemon --data '{"type": "user", "name": "ca_daemon", "roles": ["certs"], "password": "sshhhh"}'
+#
+#   update a user:
+#     couch-doc-update --db _users --id org.couchdb.user:ca_daemon --data '{"password":"sssshhh"}'
+#
+#   To update the _users DB on bigcouch, you must connect to port 5986 instead of the default couchdb port 5984
+#
+#   delete a doc:
+#     couch-doc-update --delete --db invite_codes --id dfaf0ee65670c16d5a9161dc86f3bff8
+#
+
+begin; require 'rubygems'; rescue LoadError; end # optionally load rubygems
+require 'couchrest'
+
+def main
+  db, id, data, delete = process_options
+
+  result = if delete
+    delete_document(db, id)
+  else
+    set_document(db, id, data)
+  end
+
+  exit 0 if result['ok']
+  raise StandardError.new(result.inspect)
+rescue StandardError => exc
+  db_without_password = db.to_s.sub(/:[^\/]*@/, ':PASSWORD_HIDDEN@')
+  indent = "       "
+  log "ERROR: " + exc.to_s
+  log indent + $@[0..4].join("\n#{indent}")
+  log indent + "Failed writing to #{db_without_password}/#{id}"
+  exit 1
+end
+
+def log(message)
+  $stderr.puts message
+  Syslog.open('couch-doc-update') do |logger|
+    logger.log(Syslog::LOG_CRIT, message)
+  end
+end
+
+def process_options
+  #
+  # parse options
+  #
+  host       = nil
+  db_name    = nil
+  doc_id     = nil
+  new_data   = nil
+  filename   = nil
+  netrc_file = nil
+  delete     = false
+  loop do
+    case ARGV[0]
+      when '--host' then ARGV.shift; host     = ARGV.shift
+      when '--db'   then ARGV.shift; db_name  = ARGV.shift
+      when '--id'   then ARGV.shift; doc_id   = ARGV.shift
+      when '--data' then ARGV.shift; new_data = ARGV.shift
+      when '--file' then ARGV.shift; filename = ARGV.shift
+      when '--netrc-file' then ARGV.shift; netrc_file = ARGV.shift
+      when '--delete' then ARGV.shift; delete = true
+      when /^-/     then usage("Unknown option: #{ARGV[0].inspect}")
+      else break
+    end
+  end
+  usage("Missing required option") unless db_name && doc_id && (new_data || delete)
+
+  unless delete
+    new_data = MultiJson.load(new_data)
+    new_data.merge!(read_file(filename)) if filename
+  end
+  db  = CouchRest.database(connection_string(db_name, host, netrc_file))
+  return db, doc_id, new_data, delete
+end
+
+def read_file(filename)
+  data = MultiJson.load( IO.read(filename) )
+  # strip off _id and _rev to avoid conflicts
+  data.delete_if {|k,v| k.start_with? '_'}
+end
+
+  #
+  # update document
+  #
+def set_document(db, id, data)
+  attempt ||= 1
+  doc = get_document(db, id)
+  if doc
+    doc.id ||= id
+    update_document(db, doc, data)
+  else
+    create_document(db, id, data)
+  end
+rescue RestClient::Conflict
+  # retry once, reraise if that does not work
+  raise if attempt > 1
+  attempt += 1
+  retry
+end
+
+COUCH_RESPONSE_OK = { 'ok' => true }
+
+# Deletes document, if exists, with retry
+def delete_document(db, id)
+  attempts ||= 1
+  doc = get_document(db, id)
+  if doc
+    db.delete_doc(doc)
+  else
+    COUCH_RESPONSE_OK
+  end
+rescue RestClient::ExceptionWithResponse => e
+  if attempts < 6 && !e.response.nil? && RETRY_CODES.include?(e.response.code)
+    attempts += 1
+    sleep 10
+    retry
+  else
+    raise e
+  end
+end
+
+def get_document(db, doc_id)
+  begin
+    db.get(doc_id)
+  rescue RestClient::ResourceNotFound
+    nil
+  end
+end
+
+# if the response status code is one of these
+# then retry instead of failing.
+RETRY_CODES = [500, 422].freeze
+
+def update_document(db, doc, data)
+  attempts ||= 1
+  doc.reject! {|k,v| !["_id", "_rev"].include? k}
+  doc.merge! data
+  db.save_doc(doc)
+rescue RestClient::ExceptionWithResponse => e
+  if attempts < 6 && !e.response.nil? && RETRY_CODES.include?(e.response.code)
+    attempts += 1
+    sleep 10
+    retry
+  else
+    raise e
+  end
+end
+
+def create_document(db, doc_id, data)
+  attempts ||= 1
+  data["_id"] = doc_id
+  db.save_doc(data)
+rescue RestClient::ExceptionWithResponse => e
+  if attempts < 6 && !e.response.nil? && RETRY_CODES.include?(e.response.code)
+    attempts += 1
+    sleep 10
+    retry
+  else
+    raise e
+  end
+end
+
+def connection_string(database, host, netrc_file = nil)
+  protocol  = "http"
+  #hostname  = "127.0.0.1"
+  port      = "5984"
+  username  = "admin"
+  password  = ""
+
+  netrc = File.read(netrc_file || '/etc/couchdb/couchdb.netrc')
+  netrc.scan(/\w+ [\w\.]+/).each do |key_value|
+    key, value = key_value.split ' '
+    case key
+      when "machine"  then host ||= value + ':' + port
+      when "login"    then username = value
+      when "password" then password = value
+    end
+  end
+
+  host ||= '127.0.0.1:5984'
+
+  "%s://%s:%s@%s/%s" % [protocol, username, password, host, database]
+end
+
+def usage(s)
+  $stderr.puts(s)
+  $stderr.puts("Usage: #{File.basename($0)} --host <host> --db <db> --id <doc_id> --data <json> [--file <file>] [--netrc-file <netrc-file>]")
+  $stderr.puts("       #{File.basename($0)} --host <host> --db <db> --id <doc_id> --delete [--netrc-file <netrc-file>]")
+  exit(2)
+end
+
+main()
diff --git a/puppet/modules/couchdb/files/local.ini b/puppet/modules/couchdb/files/local.ini
new file mode 100644
index 00000000..7365b6c6
--- /dev/null
+++ b/puppet/modules/couchdb/files/local.ini
@@ -0,0 +1,84 @@
+; CouchDB Configuration Settings
+
+; Custom settings should be made in this file. They will override settings
+; in default.ini, but unlike changes made to default.ini, this file won't be
+; overwritten on server upgrade.
+
+[couchdb]
+;max_document_size = 4294967296 ; bytes
+
+[httpd]
+;port = 5984
+;bind_address = 127.0.0.1
+; Options for the MochiWeb HTTP server.
+;server_options = [{backlog, 128}, {acceptor_pool_size, 16}]
+; For more socket options, consult Erlang's module 'inet' man page.
+;socket_options = [{recbuf, 262144}, {sndbuf, 262144}, {nodelay, true}]
+
+; Uncomment next line to trigger basic-auth popup on unauthorized requests.
+;WWW-Authenticate = Basic realm="administrator"
+
+; Uncomment next line to set the configuration modification whitelist. Only
+; whitelisted values may be changed via the /_config URLs. To allow the admin
+; to change this value over HTTP, remember to include {httpd,config_whitelist}
+; itself. Excluding it from the list would require editing this file to update
+; the whitelist.
+;config_whitelist = [{httpd,config_whitelist}, {log,level}, {etc,etc}]
+
+[httpd_global_handlers]
+;_google = {couch_httpd_proxy, handle_proxy_req, <<"http://www.google.com">>}
+
+[couch_httpd_auth]
+; If you set this to true, you should also uncomment the WWW-Authenticate line
+; above. If you don't configure a WWW-Authenticate header, CouchDB will send
+; Basic realm="server" in order to prevent you getting logged out.
+; require_valid_user = false
+
+[log]
+;level = debug
+
+[os_daemons]
+; For any commands listed here, CouchDB will attempt to ensure that
+; the process remains alive while CouchDB runs as well as shut them
+; down when CouchDB exits.
+;foo = /path/to/command -with args
+
+[daemons]
+; enable SSL support by uncommenting the following line and supply the PEM's below.
+; the default ssl port CouchDB listens on is 6984
+; httpsd = {couch_httpd, start_link, [https]}
+
+[ssl]
+;cert_file = /full/path/to/server_cert.pem
+;key_file = /full/path/to/server_key.pem
+;password = somepassword
+; set to true to validate peer certificates
+verify_ssl_certificates = false
+; Path to file containing PEM encoded CA certificates (trusted
+; certificates used for verifying a peer certificate). May be omitted if
+; you do not want to verify the peer.
+;cacert_file = /full/path/to/cacertf
+; The verification fun (optionnal) if not specidied, the default
+; verification fun will be used.
+;verify_fun = {Module, VerifyFun}
+ssl_certificate_max_depth = 1
+; To enable Virtual Hosts in CouchDB, add a vhost = path directive. All requests to
+; the Virual Host will be redirected to the path. In the example below all requests
+; to http://example.com/ are redirected to /database.
+; If you run CouchDB on a specific port, include the port number in the vhost:
+; example.com:5984 = /database
+
+[vhosts]
+;example.com = /database/
+
+[update_notification]
+;unique notifier name=/full/path/to/exe -with "cmd line arg"
+
+; To create an admin account uncomment the '[admins]' section below and add a
+; line in the format 'username = password'. When you next start CouchDB, it
+; will change the password to a hash (so that your passwords don't linger
+; around in plain-text files). You can add more admin accounts with more
+; 'username = password' lines. Don't forget to restart CouchDB after
+; changing this.
+[admins]
+;admin = mysecretpassword
diff --git a/puppet/modules/couchdb/lib/facter/couchdb_pwhash_alg.rb b/puppet/modules/couchdb/lib/facter/couchdb_pwhash_alg.rb
new file mode 100644
index 00000000..60ae701a
--- /dev/null
+++ b/puppet/modules/couchdb/lib/facter/couchdb_pwhash_alg.rb
@@ -0,0 +1,43 @@
+require 'facter'
+
+def version_parts ( version )
+  # gives back a hash containing major, minor and patch numbers
+  # of a give version string
+
+  parts = Hash.new
+  first, *rest = version.split(".")
+  parts["major"] = first
+  parts["minor"] = rest[0]
+  parts["patch"] = rest[1]
+  return parts
+end
+
+def couchdb_pwhash_alg
+  # couchdb uses sha1 as pw hash algorithm until v. 1.2,
+  # but pbkdf2 from v.1.3 on.
+  # see http://docs.couchdb.org/en/1.4.x/configuring.html for
+  # details
+
+  couchdb_version = Facter.value(:couchdb_version)
+  version = version_parts(couchdb_version)
+  major = version["major"].to_i
+  alg = case major
+    when 0 then alg = 'n/a'
+    when 1 then
+      minor = version['minor'].to_i
+      if minor < 3
+        alg = 'sha1'
+      else
+        alg = 'pbkdf2'
+      end
+  else
+    alg = 'pbkdf2'
+  end
+  return alg
+end
+
+Facter.add(:couchdb_pwhash_alg) do
+  setcode do
+    couchdb_pwhash_alg
+  end
+end
diff --git a/puppet/modules/couchdb/lib/facter/couchdb_version.rb b/puppet/modules/couchdb/lib/facter/couchdb_version.rb
new file mode 100644
index 00000000..3a721169
--- /dev/null
+++ b/puppet/modules/couchdb/lib/facter/couchdb_version.rb
@@ -0,0 +1,34 @@
+require 'facter'
+
+def deb_installed_version ( name )
+  # returns an empty string if package is not installed,
+  # otherwise the version
+
+  version = `apt-cache policy #{name} | grep Installed 2>&1`
+  version.slice! "  Installed: "
+  version.slice! "(none)"
+  return version.strip.chomp
+end
+
+def couchdb_version
+  bigcouch = deb_installed_version("bigcouch")
+  if bigcouch.empty?
+    couchdb = deb_installed_version("couchdb")
+    if couchdb.empty?
+      version = 'n/a'
+    else
+      version =  couchdb
+    end
+  else
+    # bigcouch is currently only available in one version (0.4.2),
+    # which includes couchdb 1.1.1
+    version = '1.1.1'
+  end
+  return version
+end
+
+Facter.add(:couchdb_version) do
+  setcode do
+    couchdb_version
+  end
+end
diff --git a/puppet/modules/couchdb/lib/puppet/parser/functions/couchdblookup.rb b/puppet/modules/couchdb/lib/puppet/parser/functions/couchdblookup.rb
new file mode 100644
index 00000000..b9067d2a
--- /dev/null
+++ b/puppet/modules/couchdb/lib/puppet/parser/functions/couchdblookup.rb
@@ -0,0 +1,55 @@
+#
+# A basic function to retrieve data in couchdb
+#
+
+
+module Puppet::Parser::Functions
+  newfunction(:couchdblookup, :type => :rvalue) do |args|
+    require 'json'
+    require 'open-uri'
+
+    raise Puppet::ParseError, ("couchdblookup(): wrong number of arguments (#{args.length}; must be 2 or 3)") unless args.length.between?(2, 3)
+
+    url = args[0]
+    key = args[1]
+    default = args[2] if args.length >= 3
+
+    begin
+      json = JSON.parse(open(URI.parse(url)).read)
+    rescue OpenURI::HTTPError => error
+      raise Puppet::ParseError, "couchdblookup(): fetching URL #{url} failed with status '#{error.message}'"
+    rescue Timeout::Error => error
+      raise Puppet::ParseError, "couchdblookup(): connection to couchdb server timed out: '#{error.message}'"
+    rescue Errno::ECONNREFUSED => error
+      raise Puppet::ParseError, "couchdblookup(): connection to couchdb server failed: '#{error.message}'"
+    rescue JSON::ParserError => error
+      raise Puppet::ParseError, "couchdblookup(): failed to parse JSON received from couchdb: '#{error.message}'"
+    rescue StandardError => error
+      raise Puppet::ParseError, "couchdblookup(): something unexpected happened: '#{error.inspect}'"
+    end
+
+    result = nil
+
+    if json.has_key?("rows")
+
+      if json['rows'].length > 1
+        arr = json['rows'].collect do |x|
+          x[key] if x.is_a?(Hash) and x.has_key?(key)
+        end
+        arr.compact!
+        result = arr unless arr.empty?
+
+      elsif json['rows'].length == 1
+        hash = json['rows'].pop
+        result = hash[key] if hash.is_a?(Hash)
+      end
+
+    elsif json.has_key?(key)
+      result = json[key]
+    end
+
+    result or default or raise Puppet::ParseError, "couchdblookup(): key '#{key}' not found in JSON object !"
+
+  end
+end
+
diff --git a/puppet/modules/couchdb/lib/puppet/parser/functions/pbkdf2.rb b/puppet/modules/couchdb/lib/puppet/parser/functions/pbkdf2.rb
new file mode 100644
index 00000000..46400c9c
--- /dev/null
+++ b/puppet/modules/couchdb/lib/puppet/parser/functions/pbkdf2.rb
@@ -0,0 +1,62 @@
+#
+# pbkdf2.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:pbkdf2, :type => :rvalue, :doc => <<-EOS
+This converts a password and a salt (and optional iterations and keylength
+parameters) to a hash containing the salted SHA1 password hash, salt,
+iterations and keylength.
+pbkdf2 is used i.e. for couchdb passwords since v1.3.
+
+Example usage:
+  $pbkdf2 = pbkdf2($::couchdb::admin_pw, $::couchdb::admin_salt)
+  $sha1   = $pbkdf2['sha1']
+EOS
+  ) do |arguments|
+    require 'openssl'
+    require 'base64'
+
+    raise(Puppet::ParseError, "pbkdf2(): Wrong number of arguments " +
+      "passed (#{arguments.size} but we require at least 2)") if arguments.size < 2
+
+    unless arguments.is_a?(Array)
+      raise(Puppet::ParseError, 'pbkdf2(): Requires a ' +
+        "Array argument, you passed: #{password.class}")
+    end
+
+    password   = arguments[0]
+    salt       = arguments[1]
+
+    if arguments.size > 2
+      iterations = arguments[2].to_i
+    else
+      iterations = 1000
+    end
+
+    if arguments.size > 3
+      keylength  = arguments[3].to_i
+    else
+      keylength  = 20
+    end
+
+    pbkdf2 = OpenSSL::PKCS5::pbkdf2_hmac_sha1(
+      password,
+      salt,
+      iterations,
+      keylength
+    )
+
+    return_hash = Hash.new()
+    # return hex encoded string
+    return_hash['sha1']       = pbkdf2.unpack('H*')[0]
+    return_hash['password']   = password
+    return_hash['salt']       = salt
+    return_hash['iterations'] = iterations
+    return_hash['keylength']  = keylength
+
+    return return_hash
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/couchdb/manifests/add_user.pp b/puppet/modules/couchdb/manifests/add_user.pp
new file mode 100644
index 00000000..29c6a8c8
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/add_user.pp
@@ -0,0 +1,39 @@
+define couchdb::add_user ( $roles, $pw, $salt = '' ) {
+  # Couchdb < 1.2 needs a pre-hashed pw and salt
+  # If you provide a salt, couchdb::add_user will assume that
+  # $pw is prehashed and pass both parameters to couchdb::update
+  # If $salt is empty, couchdb::add_user will assume that the pw
+  # is plaintext and will pass it to couchdb::update
+
+  if $::couchdb::bigcouch == true {
+    $port = 5986
+  } else {
+    $port = 5984
+  }
+
+  if $salt == '' {
+    # unhashed, plaintext pw, no salt. For couchdb >= 1.2
+    $data = "{\"type\": \"user\", \"name\": \"${name}\", \"roles\": ${roles}, \"password\": \"${pw}\"}"
+  } else {
+    # prehashed pw with salt, for couchdb < 1.2
+    # salt and encrypt pw
+    # str_and_salt2sha1 is a function from leap's stdlib module
+    $pw_and_salt = [ $pw, $salt ]
+    $sha         = str_and_salt2sha1($pw_and_salt)
+    $data = "{\"type\": \"user\", \"name\": \"${name}\", \"roles\": ${roles}, \"password_sha\": \"${sha}\", \"salt\": \"${salt}\"}"
+  }
+
+  # update the user with the given password unless they already work
+  couchdb::document { "update_user_${name}":
+    host   => "127.0.0.1:${port}",
+    db     => '_users',
+    id     => "org.couchdb.user:${name}",
+    data   => $data
+  }
+
+  couchdb::query::setup { $name:
+    user  => $name,
+    pw    => $pw,
+  }
+
+}
diff --git a/puppet/modules/couchdb/manifests/backup.pp b/puppet/modules/couchdb/manifests/backup.pp
new file mode 100644
index 00000000..a477b5b1
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/backup.pp
@@ -0,0 +1,51 @@
+# configure backup using couchdb-backup.py
+class couchdb::backup {
+
+  include couchdb::params
+
+  # used in ERB templates
+  $bind_address = $couchdb::params::bind_address
+  $port         = $couchdb::params::port
+  $backupdir    = $couchdb::params::backupdir
+
+  file { $couchdb::params::backupdir:
+    ensure  => directory,
+    mode    => '0755',
+    require => Package['couchdb'],
+  }
+
+  file { '/usr/local/sbin/couchdb-backup.py':
+    ensure  => present,
+    owner   => root,
+    group   => root,
+    mode    => '0755',
+    content => template('couchdb/couchdb-backup.py.erb'),
+    require => File[$couchdb::params::backupdir],
+  }
+
+  cron { 'couchdb-backup':
+    command => '/usr/local/sbin/couchdb-backup.py 2> /dev/null',
+    hour    => 3,
+    minute  => 0,
+    require => File['/usr/local/sbin/couchdb-backup.py'],
+  }
+
+  case $::operatingsystem {
+    /Debian|Ubunu/: {
+      # note: python-couchdb >= 0.8 required, which is found in debian wheezy.
+      ensure_packages (['python-couchdb', 'python-simplejson'], {
+        before => File['/usr/local/sbin/couchdb-backup.py']
+      })
+    }
+    /RedHat|Centos/: {
+      exec {'install python-couchdb using easy_install':
+        command => 'easy_install http://pypi.python.org/packages/2.6/C/CouchDB/CouchDB-0.8-py2.6.egg',
+        creates => '/usr/lib/python2.6/site-packages/CouchDB-0.8-py2.6.egg',
+      }
+    }
+    default: {
+      err('This module has not been written to support your operating system')
+    }
+  }
+
+}
diff --git a/puppet/modules/couchdb/manifests/base.pp b/puppet/modules/couchdb/manifests/base.pp
new file mode 100644
index 00000000..6c7bf25f
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/base.pp
@@ -0,0 +1,124 @@
+# configure couchdb
+class couchdb::base {
+
+  if $::couchdb::bigcouch == true {
+    $couchdb_user = 'bigcouch'
+    include couchdb::bigcouch
+  } else {
+    $couchdb_user = 'couchdb'
+  }
+
+  # we use package{} here because bigcouch.pp overwrites it and
+  # this won't work with ensure_packages()
+  package {'couchdb':
+    ensure => installed
+  }
+
+  service { 'couchdb':
+    ensure    => running,
+    hasstatus => true,
+    enable    => true,
+    require   => Package['couchdb']
+  }
+
+  # todo: make host/port configurable
+  exec { 'wait_for_couchdb':
+    command => 'wget --retry-connrefused --tries 10 --quiet "http://127.0.0.1:5984" -O /dev/null',
+    require => Service['couchdb']
+  }
+
+
+  # couchrest gem is required for couch-doc-update script,
+  # and it needs the ruby-dev package installed to build
+
+  if versioncmp($::operatingsystemrelease, '8') < 0 {
+    $couchrest_version = '1.2'
+  }
+  else {
+    # couchrest v1.2.1 doesn't build with default debian jessie rake version
+    # shipped as debian package (10.3.2)
+    # see https://leap.se/code/issues/7754
+    $couchrest_version = '1.2.0'
+  }
+
+  ensure_packages('ruby-dev')
+  ensure_packages('couchrest', {
+    provider => 'gem',
+    ensure   => $couchrest_version,
+    require  => Package['ruby-dev']
+  })
+
+  File['/usr/local/bin/couch-doc-update'] ->  Couchdb::Update <| |>
+  File['/usr/local/bin/couch-doc-diff'] ->  Couchdb::Update <| |>
+
+  Couchdb::Update <| |> -> Couchdb::Document <| |>
+
+  file {
+    '/usr/local/bin/couch-doc-update':
+      source  => 'puppet:///modules/couchdb/couch-doc-update',
+      mode    => '0755',
+      owner   => 'root',
+      group   => 'root',
+      require => Package['couchrest'];
+
+    '/usr/local/bin/couch-doc-diff':
+      source  => 'puppet:///modules/couchdb/couch-doc-diff',
+      mode    => '0755',
+      owner   => 'root',
+      group   => 'root',
+      require => Package['couchrest'];
+
+    '/etc/couchdb/local.ini':
+      source  => [ "puppet:///modules/site_couchdb/${::fqdn}/local.ini",
+                  'puppet:///modules/site_couchdb/local.ini',
+                  'puppet:///modules/couchdb/local.ini' ],
+      notify  => Service[couchdb],
+      owner   => $couchdb_user,
+      group   => $couchdb_user,
+      mode    => '0660',
+      require => Package['couchdb'];
+
+    '/etc/couchdb/local.d':
+      ensure  => directory,
+      require => Package['couchdb'];
+  }
+
+  $alg  = $::couchdb::pwhash_alg
+  $salt = $::couchdb::admin_salt
+  case $alg {
+    'sha1': {
+      # str_and_salt2sha1 is a function from leap's stdlib module
+      $pw_and_salt = [ $::couchdb::admin_pw, $salt ]
+      $sha1        = str_and_salt2sha1($pw_and_salt)
+      $admin_hash  = "-hashed-${sha1},${salt}"
+    }
+    'pbkdf2': {
+      $pbkdf2      = pbkdf2($::couchdb::admin_pw, $::couchdb::admin_salt, 10)
+      $sha1        = $pbkdf2['sha1']
+      $admin_hash  = "-pbkdf2-${sha1},${salt},10"
+    }
+    default:  { fail ("Unknown fact couchdb_pwhash_alg ${::couchdb_pwhash_alg} - Exiting.") }
+  }
+
+  file { '/etc/couchdb/local.d/admin.ini':
+    content => template('couchdb/admin.ini.erb'),
+    mode    => '0600',
+    owner   => $couchdb_user,
+    group   => $couchdb_user,
+    notify  => Service[couchdb],
+    require => File['/etc/couchdb/local.d'];
+  }
+
+  case $::couchdb::bigcouch {
+    true: { $restart_command = '/etc/init.d/bigcouch restart; sleep 6' }
+    default: { $restart_command = '/etc/init.d/couchdb restart; sleep 6' }
+  }
+
+  exec { 'couchdb_restart':
+    command     => $restart_command,
+    path        => ['/bin', '/usr/bin',],
+    subscribe   => File['/etc/couchdb/local.d/admin.ini',
+                        '/etc/couchdb/local.ini'],
+    refreshonly => true
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/bigcouch.pp b/puppet/modules/couchdb/manifests/bigcouch.pp
new file mode 100644
index 00000000..a97411bf
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/bigcouch.pp
@@ -0,0 +1,51 @@
+class couchdb::bigcouch inherits couchdb::base {
+
+  file {
+    '/opt/bigcouch':
+      ensure => directory,
+      mode   => '0755';
+
+    '/etc/couchdb':
+      ensure => directory,
+      mode   => '0755',
+      before => Package['couchdb'];
+
+    '/opt/bigcouch/etc':
+      ensure => link,
+      target => '/etc/couchdb',
+      before => Package['couchdb'];
+  }
+
+  # there's no bigcouch in the official debian repo, you need
+  # to setup a repository for that. You can use class
+  # couchdb::bigcouch::package::cloudant for unauthenticated 0.4.0 packages,
+  # or site_apt::leap_repo from the leap_platfrom repository
+  # for signed 0.4.2 packages
+
+  Package['couchdb'] {
+    name    => 'bigcouch'
+  }
+
+  file { '/opt/bigcouch/etc/vm.args':
+    content => template('couchdb/bigcouch/vm.args'),
+    mode    => '0640',
+    owner   => 'bigcouch',
+    group   => 'bigcouch',
+    require => Package['couchdb'],
+    notify  => Service[couchdb]
+  }
+
+  file { '/opt/bigcouch/etc/default.ini':
+    content => template('couchdb/bigcouch/default.ini'),
+    mode    => '0640',
+    owner   => 'bigcouch',
+    group   => 'bigcouch',
+    require => Package['couchdb'],
+    notify  => Service[couchdb]
+  }
+
+  Service['couchdb'] {
+    name     => 'bigcouch'
+  }
+
+}
diff --git a/puppet/modules/couchdb/manifests/bigcouch/add_node.pp b/puppet/modules/couchdb/manifests/bigcouch/add_node.pp
new file mode 100644
index 00000000..ed9db94b
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/bigcouch/add_node.pp
@@ -0,0 +1,8 @@
+define couchdb::bigcouch::add_node {
+
+  couchdb::bigcouch::document { "add_${name}":
+    db   => 'nodes',
+    id   => "bigcouch@${name}",
+    ensure => 'present'
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/bigcouch/debian.pp b/puppet/modules/couchdb/manifests/bigcouch/debian.pp
new file mode 100644
index 00000000..645c6da8
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/bigcouch/debian.pp
@@ -0,0 +1,11 @@
+class couchdb::bigcouch::debian inherits couchdb::debian {
+
+  File['/etc/init.d/couchdb'] {
+    ensure => absent
+  }
+
+  file {'/etc/init.d/bigcouch':
+    ensure => link,
+    target => '/usr/bin/sv'
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/bigcouch/document.pp b/puppet/modules/couchdb/manifests/bigcouch/document.pp
new file mode 100644
index 00000000..13f4ac17
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/bigcouch/document.pp
@@ -0,0 +1,14 @@
+define couchdb::bigcouch::document (
+  $db,
+  $id,
+  $host = '127.0.0.1:5986',
+  $data ='{}',
+  $ensure ='content') {
+  couchdb::document { $name:
+    ensure => $ensure,
+    host   => $host,
+    db     => $db,
+    id     => $id,
+    data   => $data
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/bigcouch/package/cloudant.pp b/puppet/modules/couchdb/manifests/bigcouch/package/cloudant.pp
new file mode 100644
index 00000000..cfdcf10c
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/bigcouch/package/cloudant.pp
@@ -0,0 +1,35 @@
+class couchdb::bigcouch::package::cloudant (
+  $ensure = 'present'
+) {
+
+  # cloudant's signing key can be fetched from
+  # http://packages.cloudant.com/KEYS, please use the apt module to
+  # distribute it on your servers after verifying its fingerprint
+
+  # cloudant's wheezy repo will fail cause in their Release file
+  # (http://packages.cloudant.com/debian/dists/wheezy/Release) they
+  # wrongly marked the packages for squeeze
+  # so we will use their squeeze repo here
+  apt::sources_list {'bigcouch-cloudant.list':
+    ensure  => $ensure,
+    content => 'deb http://packages.cloudant.com/debian squeeze main'
+  }
+
+  # right now, cloudant only provides authenticated bigcouch 0.4.2 packages
+  # for squeeze, therefore we need to allow the installation of the depending
+  # packages libicu44 and libssl0.9.8 from squeeze
+
+  if $::lsbdistcodename == 'wheezy' {
+    apt::sources_list {'squeeze.list':
+      ensure  => $ensure,
+      content => 'deb http://http.debian.net/debian squeeze main
+deb http://security.debian.org/ squeeze/updates main
+'   }
+    apt::preferences_snippet { 'bigcouch_squeeze_deps':
+      ensure   => $ensure,
+      package  => 'libicu44 libssl0.9.8',
+      priority => '980',
+      pin      => 'release o=Debian,n=squeeze'
+    }
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/create_db.pp b/puppet/modules/couchdb/manifests/create_db.pp
new file mode 100644
index 00000000..8a8d1144
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/create_db.pp
@@ -0,0 +1,21 @@
+define couchdb::create_db (
+  $host='127.0.0.1:5984',
+  $admins="{\"names\": [], \"roles\": [] }",
+  $members="{\"names\": [], \"roles\": [] }" )
+{
+
+  couchdb::query { "create_db_${name}":
+    cmd    => 'PUT',
+    host   => $host,
+    path   => $name,
+    unless => "/usr/bin/curl -s -f --netrc-file /etc/couchdb/couchdb.netrc ${host}/${name}"
+  }
+
+  couchdb::document { "${name}_security":
+    db   => $name,
+    id   => '_security',
+    host => $host,
+    data => "{ \"admins\": ${admins}, \"members\": ${members} }",
+    require => Couchdb::Query["create_db_${name}"]
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/debian.pp b/puppet/modules/couchdb/manifests/debian.pp
new file mode 100644
index 00000000..b83b227a
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/debian.pp
@@ -0,0 +1,15 @@
+# installs initscript and dependent packages on debian
+class couchdb::debian inherits couchdb::base {
+
+  ensure_packages('libjs-jquery')
+
+  file { '/etc/init.d/couchdb':
+    source  => [
+      'puppet:///modules/site_couchdb/Debian/couchdb',
+      'puppet:///modules/couchdb/Debian/couchdb' ],
+    mode    => '0755',
+    owner   => 'root',
+    group   => 'root',
+    require => Package['couchdb']
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/deploy_config.pp b/puppet/modules/couchdb/manifests/deploy_config.pp
new file mode 100644
index 00000000..2ce1fd20
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/deploy_config.pp
@@ -0,0 +1,12 @@
+class couchdb::deploy_config {
+
+  file { '/etc/couchdb/local.ini':
+    source  => [ "puppet:///modules/site_couchdb/${::fqdn}/local.ini",
+                'puppet:///modules/site_couchdb/local.ini',
+                'puppet:///modules/couchdb/local.ini' ],
+    notify  => Service[couchdb],
+    owner   => couchdb,
+    group   => couchdb,
+    mode    => '0660'
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/document.pp b/puppet/modules/couchdb/manifests/document.pp
new file mode 100644
index 00000000..6180474b
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/document.pp
@@ -0,0 +1,47 @@
+# Usage:
+# couchdb::document { id:
+#   db => "database",
+#   data => "content",
+#   ensure => {absent,present,*content*}
+# }
+#
+define couchdb::document(
+  $db,
+  $id,
+  $host   = '127.0.0.1:5984',
+  $data   = '{}',
+  $netrc  = '/etc/couchdb/couchdb.netrc',
+  $ensure = 'content') {
+
+  $url = "${host}/${db}/${id}"
+
+  case $ensure {
+    default: { err ( "unknown ensure value '${ensure}'" ) }
+    content: {
+      exec { "couch-doc-update --netrc-file ${netrc} --host ${host} --db ${db} --id ${id} --data \'${data}\'":
+        require => Exec['wait_for_couchdb'],
+        unless  => "couch-doc-diff $url '$data'"
+      }
+    }
+
+    present: {
+      couchdb::query { "create_${db}_${id}":
+        cmd    => 'PUT',
+        host   => $host,
+        path   => "${db}/${id}",
+        require => Exec['wait_for_couchdb'],
+        unless => "/usr/bin/curl -s -f --netrc-file ${netrc} ${url}"
+      }
+    }
+
+    absent: {
+      couchdb::query { "destroy_${db}_${id}":
+        cmd    => 'DELETE',
+        host   => $host,
+        path   => "${db}/${id}",
+        require => Exec['wait_for_couchdb'],
+        unless => "/usr/bin/curl -s -f --netrc-file ${netrc} ${url}"
+      }
+    }
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/init.pp b/puppet/modules/couchdb/manifests/init.pp
new file mode 100644
index 00000000..12598ba0
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/init.pp
@@ -0,0 +1,31 @@
+# initial couchdb class
+class couchdb (
+  $admin_pw,
+  $admin_salt = '',
+  $bigcouch = false,
+  $bigcouch_cookie = '',
+  $ednp_port = '9001',
+  $chttpd_bind_address = '0.0.0.0',
+  $pwhash_alg = 'pbkdf2' )
+{
+
+  # stdlib is needed i.e. for ensure_packages()
+  include ::stdlib
+
+  case $::operatingsystem {
+    Debian: {
+      case $::lsbdistcodename {
+        /lenny|squeeze|wheezy|jessie/: {
+          include couchdb::debian
+          if $bigcouch == true {
+            include couchdb::bigcouch::debian
+          }
+        }
+        default:         { fail "couchdb not available for ${::operatingsystem}/${::lsbdistcodename}" }
+      }
+    }
+    RedHat: { include couchdb::redhat }
+  }
+
+  ensure_packages('curl')
+}
diff --git a/puppet/modules/couchdb/manifests/mirror_db.pp b/puppet/modules/couchdb/manifests/mirror_db.pp
new file mode 100644
index 00000000..b07b6749
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/mirror_db.pp
@@ -0,0 +1,21 @@
+define couchdb::mirror_db (
+  $host='127.0.0.1:5984',
+  $from='',
+  $to='',
+  $user='replication',
+  $role='replication'
+  )
+{
+  $source = "${from}/${name}"
+  if $to == '' { $target = $name }
+  else { $target = "${to}/${name}" }
+
+  couchdb::document { "${name}_replication":
+    db      => "_replicator",
+    id      => "${name}_replication",
+    netrc   => "/etc/couchdb/couchdb-${user}.netrc",
+    host    => $host,
+    data    => "{ \"source\": \"${source}\", \"target\": \"${target}\", \"continuous\": true, \"user_ctx\": { \"name\": \"${user}\", \"roles\": [\"${role}\"] }, \"owner\": \"${user}\" }",
+    require => Couchdb::Query["create_db_${name}"]
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/params.pp b/puppet/modules/couchdb/manifests/params.pp
new file mode 100644
index 00000000..02d5f02e
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/params.pp
@@ -0,0 +1,23 @@
+class couchdb::params {
+
+  $bind_address = $::couchdb_bind_address ? {
+    ''      => '127.0.0.1',
+    default => $::couchdb_bind_address,
+  }
+
+  $port = $::couchdb_port ? {
+    ''      => '5984',
+    default => $::couchdb_port,
+  }
+
+  $backupdir = $::couchdb_backupdir ? {
+    ''      => '/var/backups/couchdb',
+    default => $::couchdb_backupdir,
+  }
+
+  $cert_path = $::couchdb_cert_path ? {
+    ""      => '/etc/couchdb',
+    default => $::couchdb_cert_path,
+  }
+
+}
diff --git a/puppet/modules/couchdb/manifests/query.pp b/puppet/modules/couchdb/manifests/query.pp
new file mode 100644
index 00000000..9507ca1e
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/query.pp
@@ -0,0 +1,12 @@
+define couchdb::query (
+  $cmd, $path,
+  $netrc='/etc/couchdb/couchdb.netrc',
+  $host='127.0.0.1:5984',
+  $data = '{}',
+  $unless = undef) {
+
+  exec { "/usr/bin/curl -s --netrc-file ${netrc} -X ${cmd} ${host}/${path} --data \'${data}\'":
+    require => [ Package['curl'], Exec['wait_for_couchdb'] ],
+    unless  => $unless
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/query/setup.pp b/puppet/modules/couchdb/manifests/query/setup.pp
new file mode 100644
index 00000000..451eb536
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/query/setup.pp
@@ -0,0 +1,10 @@
+define couchdb::query::setup ($user, $pw, $host='127.0.0.1') {
+
+  file { "/etc/couchdb/couchdb-${user}.netrc":
+    content => "machine ${host} login ${user} password ${pw}",
+    mode    => '0600',
+    owner   => $::couchdb::base::couchdb_user,
+    group   => $::couchdb::base::couchdb_user,
+    require => Package['couchdb'];
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/redhat.pp b/puppet/modules/couchdb/manifests/redhat.pp
new file mode 100644
index 00000000..defa0a94
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/redhat.pp
@@ -0,0 +1 @@
+class couchdb::redhat inherits couchdb::base {}
diff --git a/puppet/modules/couchdb/manifests/ssl/deploy_cert.pp b/puppet/modules/couchdb/manifests/ssl/deploy_cert.pp
new file mode 100644
index 00000000..d3e743f1
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/ssl/deploy_cert.pp
@@ -0,0 +1,28 @@
+define couchdb::ssl::deploy_cert ($cert, $key) {
+
+  include couchdb::params
+
+  file { 'couchdb_cert_directory':
+    ensure  => 'directory',
+    path    => $couchdb::params::cert_path,
+    mode    => '0600',
+    owner   => 'couchdb',
+    group   => 'couchdb';
+  }
+
+  file { 'couchdb_cert':
+    path    => "${couchdb::params::cert_path}/server_cert.pem",
+    mode    => '0644',
+    owner   => 'couchdb',
+    group   => 'couchdb',
+    content => $cert
+  }
+
+  file { 'couchdb_key':
+    path    => "${couchdb::params::cert_path}/server_key.pem",
+    mode    => '0600',
+    owner   => 'couchdb',
+    group   => 'couchdb',
+    content => $key
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/ssl/generate_cert.pp b/puppet/modules/couchdb/manifests/ssl/generate_cert.pp
new file mode 100644
index 00000000..a443250e
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/ssl/generate_cert.pp
@@ -0,0 +1,25 @@
+# configures cert for ssl access
+class couchdb::ssl::generate_cert {
+
+  ensure_packages('openssl')
+
+  file { $couchdb::cert_path:
+    ensure => 'directory',
+    mode   => '0600',
+    owner  => 'couchdb',
+    group  => 'couchdb';
+  }
+
+exec { 'generate-certs':
+    command => "/usr/bin/openssl req -new -inform PEM -x509 -nodes -days 150 -subj \
+'/C=ZZ/ST=AutoSign/O=AutoSign/localityName=AutoSign/commonName=${::hostname}/organizationalUnitName=AutoSign/emailAddress=AutoSign/' \
+-newkey rsa:2048 -out ${couchdb::cert_path}/couchdb_cert.pem -keyout ${couchdb::cert_path}/couchdb_key.pem",
+    unless  => "/usr/bin/test -f ${couchdb::cert_path}/couchdb_cert.pem &&
+/usr/bin/test -f ${couchdb::params::cert_path}/couchdb_key.pem",
+    require => [
+      File[$couchdb::params::cert_path],
+      Exec['make-install']
+    ],
+    notify  => Service['couchdb'],
+  }
+}
diff --git a/puppet/modules/couchdb/manifests/update.pp b/puppet/modules/couchdb/manifests/update.pp
new file mode 100644
index 00000000..b1dba84c
--- /dev/null
+++ b/puppet/modules/couchdb/manifests/update.pp
@@ -0,0 +1,12 @@
+define couchdb::update (
+  $db,
+  $id,
+  $data,
+  $host='127.0.0.1:5984',
+  $unless=undef) {
+
+  exec { "couch-doc-update --host ${host} --db ${db} --id ${id} --data \'${data}\'":
+    require => Exec['wait_for_couchdb'],
+    unless  => $unless
+  }
+}
diff --git a/puppet/modules/couchdb/spec/classes/couchdb_spec.rb b/puppet/modules/couchdb/spec/classes/couchdb_spec.rb
new file mode 100644
index 00000000..e8e4174e
--- /dev/null
+++ b/puppet/modules/couchdb/spec/classes/couchdb_spec.rb
@@ -0,0 +1,35 @@
+require 'spec_helper'
+
+describe 'couchdb' do
+  context 'given it is a wheezy system' do
+    let(:params) { {:admin_pw => 'foo'} }
+    let(:facts) do
+      {
+      :operatingsystemrelease => '7',
+      :operatingsystem           => 'Debian',
+      :lsbdistcodename           => 'wheezy',
+      }
+    end
+    it "should install couchrest 1.2" do
+      should contain_package('couchrest').with({
+        'ensure'=> '1.2',
+      })
+    end
+  end
+  context 'given it is a jessie system' do
+    let(:params) { {:admin_pw => 'foo'} }
+    let(:facts) do
+      {
+      :operatingsystemrelease => '8',
+      :operatingsystem           => 'Debian',
+      :lsbdistcodename           => 'jessie',
+      }
+    end
+    it "should install latest couchrest version" do
+      should contain_package('couchrest').with({
+        'ensure'=> 'latest',
+      })
+    end
+  end
+end
+
diff --git a/puppet/modules/couchdb/spec/fixtures/manifests/site.pp b/puppet/modules/couchdb/spec/fixtures/manifests/site.pp
new file mode 100644
index 00000000..a959fb77
--- /dev/null
+++ b/puppet/modules/couchdb/spec/fixtures/manifests/site.pp
@@ -0,0 +1,8 @@
+# set a default exec path
+# the logoutput exec parameter defaults to "on_error" in puppet 3,
+# but to "false" in puppet 2.7, so we need to set this globally here
+Exec {
+  logoutput => on_failure,
+  path    => '/usr/bin:/usr/sbin/:/bin:/sbin:/usr/local/bin:/usr/local/sbin'
+}
+
diff --git a/puppet/modules/couchdb/spec/functions/versioncmp_spec.rb b/puppet/modules/couchdb/spec/functions/versioncmp_spec.rb
new file mode 100644
index 00000000..0a244275
--- /dev/null
+++ b/puppet/modules/couchdb/spec/functions/versioncmp_spec.rb
@@ -0,0 +1,9 @@
+require 'spec_helper'
+
+describe 'versioncmp' do
+    it { should run.with_params('7.2','8').and_return(-1) }
+    it { should run.with_params('7','8').and_return(-1) }
+    it { should run.with_params('8','8').and_return(0) }
+    it { should run.with_params('8.1','8').and_return(1) }
+end
+
diff --git a/puppet/modules/couchdb/spec/spec_helper.rb b/puppet/modules/couchdb/spec/spec_helper.rb
new file mode 100644
index 00000000..b55ede81
--- /dev/null
+++ b/puppet/modules/couchdb/spec/spec_helper.rb
@@ -0,0 +1,9 @@
+require 'rspec-puppet'
+
+fixture_path = File.expand_path(File.join(__FILE__, '..', 'fixtures'))
+
+RSpec.configure do |c|
+  c.module_path = File.join(fixture_path, 'modules')
+  c.manifest_dir = File.join(fixture_path, 'manifests')
+  c.environmentpath = File.join(Dir.pwd, 'spec')
+end
diff --git a/puppet/modules/couchdb/templates/admin.ini.erb b/puppet/modules/couchdb/templates/admin.ini.erb
new file mode 100644
index 00000000..479f8bfc
--- /dev/null
+++ b/puppet/modules/couchdb/templates/admin.ini.erb
@@ -0,0 +1,9 @@
+<%- require 'digest' -%>
+[admins]
+admin = <%= @admin_hash %>
+
+[couchdb]
+<%- # uuid uniquely identifies this couchdb instance. if not set, couchdb will set a random one
+    # but we want a stable one so that this config file doesn't change all the time.
+    # Md5 of hostname and ipaddress seems reasonable, but it could be based on anything. -%>
+uuid = <%= Digest::MD5.hexdigest(Facter.value("hostname") + Facter.value("ipaddress")) %>
diff --git a/puppet/modules/couchdb/templates/bigcouch/default.ini b/puppet/modules/couchdb/templates/bigcouch/default.ini
new file mode 100644
index 00000000..a315ddab
--- /dev/null
+++ b/puppet/modules/couchdb/templates/bigcouch/default.ini
@@ -0,0 +1,172 @@
+[couchdb]
+database_dir = /opt/bigcouch/var/lib
+view_index_dir = /opt/bigcouch/var/lib
+max_document_size = 67108864
+os_process_timeout = 5000
+max_dbs_open = 500
+delayed_commits = false
+
+[cluster]
+; Default number of shards for a new database
+q = 8
+; Default number of copies of each shard
+n = 3
+
+[chttpd]
+port = 5984
+docroot = /opt/bigcouch/share/www
+
+; Options for the MochiWeb HTTP server.
+;server_options = [{backlog, 128}, {acceptor_pool_size, 16}]
+
+; For more socket options, consult Erlang's module 'inet' man page.
+;socket_options = [{recbuf, 262144}, {sndbuf, 262144}, {nodelay, true}]
+
+bind_address = <%= scope.lookupvar('couchdb::chttpd_bind_address') %>
+
+[chttps]
+port = 6984
+
+; cert_file = /full/path/to/server_cert.pem
+; key_file = /full/path/to/server_key.pem
+; password = somepassword
+; also remember to enable the chttps daemon in [daemons] section.
+
+; set to true to validate peer certificates
+verify_ssl_certificates = false
+
+; Path to file containing PEM encoded CA certificates (trusted
+; certificates used for verifying a peer certificate). May be omitted if
+; you do not want to verify the peer.
+;cacert_file = /full/path/to/cacertf
+
+; The verification fun (optional) if not specified, the default
+; verification fun will be used.
+;verify_fun = {Module, VerifyFun}
+ssl_certificate_max_depth = 1
+
+[httpd]
+port = 5986
+bind_address = 127.0.0.1
+authentication_handlers = {couch_httpd_oauth, oauth_authentication_handler}, {couch_httpd_auth, cookie_authentication_handler}, {couch_httpd_auth, default_authentication_handler}
+default_handler = {couch_httpd_db, handle_request}
+secure_rewrites = true
+vhost_global_handlers = _utils, _uuids, _session, _oauth, _users
+allow_jsonp = false
+log_max_chunk_size = 1000000
+
+[ssl]
+port = 6984
+
+[log]
+file = /opt/bigcouch/var/log/bigcouch.log
+level = info
+include_sasl = true
+
+[couch_httpd_auth]
+authentication_db = _users
+authentication_redirect = /_utils/session.html
+require_valid_user = false
+timeout = 43200 ; (default to 12 hours) number of seconds before automatic logout
+auth_cache_size = 50 ; size is number of cache entries
+
+[query_servers]
+javascript = /opt/bigcouch/bin/couchjs /opt/bigcouch/share/couchjs/main.js
+
+[query_server_config]
+reduce_limit = true
+os_process_soft_limit = 100
+
+[daemons]
+view_manager={couch_view, start_link, []}
+external_manager={couch_external_manager, start_link, []}
+query_servers={couch_proc_manager, start_link, []}
+httpd={couch_httpd, start_link, []}
+stats_aggregator={couch_stats_aggregator, start, []}
+stats_collector={couch_stats_collector, start, []}
+uuids={couch_uuids, start, []}
+auth_cache={couch_auth_cache, start_link, []}
+replication_manager={couch_replication_manager, start_link, []}
+vhosts={couch_httpd_vhost, start_link, []}
+os_daemons={couch_os_daemons, start_link, []}
+; Uncomment next line to enable SSL daemon
+; chttpsd = {chttpd, start_link, [https]}
+
+[httpd_global_handlers]
+/ = {couch_httpd_misc_handlers, handle_welcome_req, <<"Welcome">>}
+favicon.ico = {couch_httpd_misc_handlers, handle_favicon_req, "/opt/bigcouch/share/www"}
+
+_utils = {couch_httpd_misc_handlers, handle_utils_dir_req, "/opt/bigcouch/share/www"}
+_all_dbs = {couch_httpd_misc_handlers, handle_all_dbs_req}
+_active_tasks = {couch_httpd_misc_handlers, handle_task_status_req}
+_config = {couch_httpd_misc_handlers, handle_config_req}
+_replicate = {couch_httpd_misc_handlers, handle_replicate_req}
+_uuids = {couch_httpd_misc_handlers, handle_uuids_req}
+_restart = {couch_httpd_misc_handlers, handle_restart_req}
+_stats = {couch_httpd_stats_handlers, handle_stats_req}
+_log = {couch_httpd_misc_handlers, handle_log_req}
+_session = {couch_httpd_auth, handle_session_req}
+_oauth = {couch_httpd_oauth, handle_oauth_req}
+_system = {chttpd_misc, handle_system_req}
+
+[httpd_db_handlers]
+_view_cleanup = {couch_httpd_db, handle_view_cleanup_req}
+_compact = {couch_httpd_db, handle_compact_req}
+_design = {couch_httpd_db, handle_design_req}
+_temp_view = {couch_httpd_view, handle_temp_view_req}
+_changes = {couch_httpd_db, handle_changes_req}
+
+[httpd_design_handlers]
+_view = {couch_httpd_view, handle_view_req}
+_show = {couch_httpd_show, handle_doc_show_req}
+_list = {couch_httpd_show, handle_view_list_req}
+_info = {couch_httpd_db,   handle_design_info_req}
+_rewrite = {couch_httpd_rewrite, handle_rewrite_req}
+_update = {couch_httpd_show, handle_doc_update_req}
+
+; enable external as an httpd handler, then link it with commands here.
+; note, this api is still under consideration.
+; [external]
+; mykey = /path/to/mycommand
+
+; Here you can setup commands for CouchDB to manage
+; while it is alive. It will attempt to keep each command
+; alive if it exits.
+; [os_daemons]
+; some_daemon_name = /path/to/script -with args
+
+
+[uuids]
+; Known algorithms:
+;   random - 128 bits of random awesome
+;     All awesome, all the time.
+;   sequential - monotonically increasing ids with random increments
+;     First 26 hex characters are random. Last 6 increment in
+;     random amounts until an overflow occurs. On overflow, the
+;     random prefix is regenerated and the process starts over.
+;   utc_random - Time since Jan 1, 1970 UTC with microseconds
+;     First 14 characters are the time in hex. Last 18 are random.
+algorithm = sequential
+
+[stats]
+; rate is in milliseconds
+rate = 1000
+; sample intervals are in seconds
+samples = [0, 60, 300, 900]
+
+[attachments]
+compression_level = 8 ; from 1 (lowest, fastest) to 9 (highest, slowest), 0 to disable compression
+compressible_types = text/*, application/javascript, application/json, application/xml
+
+[replicator]
+db = _replicator
+; Maximum replicaton retry count can be a non-negative integer or "infinity".
+max_replication_retry_count = 10
+max_http_sessions = 20
+max_http_pipeline_size = 50
+; set to true to validate peer certificates
+verify_ssl_certificates = false
+; file containing a list of peer trusted certificates (PEM format)
+; ssl_trusted_certificates_file = /etc/ssl/certs/ca-certificates.crt
+; maximum peer certificate depth (must be set even if certificate validation is off)
+ssl_certificate_max_depth = 3
diff --git a/puppet/modules/couchdb/templates/bigcouch/vm.args b/puppet/modules/couchdb/templates/bigcouch/vm.args
new file mode 100644
index 00000000..4618a52c
--- /dev/null
+++ b/puppet/modules/couchdb/templates/bigcouch/vm.args
@@ -0,0 +1,32 @@
+# Each node in the system must have a unique name.  A name can be short
+# (specified using -sname) or it can by fully qualified (-name).  There can be
+# no communication between nodes running with the -sname flag and those running 
+# with the -name flag.
+-name bigcouch 
+
+# All nodes must share the same magic cookie for distributed Erlang to work.
+# Comment out this line if you synchronized the cookies by other means (using
+# the ~/.erlang.cookie file, for example).
+-setcookie <%= scope.lookupvar('couchdb::bigcouch_cookie') %>
+
+# Tell SASL not to log progress reports
+-sasl errlog_type error
+
+# Use kernel poll functionality if supported by emulator
++K true
+
+# Start a pool of asynchronous IO threads
++A 16
+
+# Comment this line out to enable the interactive Erlang shell on startup
++Bd -noinput
+
+# read config files
+# otherwise /etc/couchdb/local.d/admin.ini wouldn't be read mysteriously
+-couch_ini /etc/couchdb/default.ini /etc/couchdb/local.ini /etc/couchdb/local.d/admin.ini /etc/couchdb/default.ini /etc/couchdb/local.ini /etc/couchdb/local.d/admin.ini
+#
+
+# make firewalling easier, see
+# http://stackoverflow.com/questions/8459949/bigcouch-cluster-connection-issue#comment10467603_8463814
+
+-kernel inet_dist_listen_min <%= scope.lookupvar('couchdb::ednp_port') %> inet_dist_use_interface "{127,0,0,1}"
diff --git a/puppet/modules/couchdb/templates/couchdb-backup.py.erb b/puppet/modules/couchdb/templates/couchdb-backup.py.erb
new file mode 100644
index 00000000..c49df65b
--- /dev/null
+++ b/puppet/modules/couchdb/templates/couchdb-backup.py.erb
@@ -0,0 +1,32 @@
+#!/usr/bin/env python
+# file manage by puppet 
+
+import os
+import gzip
+import tarfile
+import datetime
+import urllib2
+import simplejson
+import couchdb.tools.dump
+from os.path import join
+
+DB_URL="http://127.0.0.1:5984"
+DUMP_DIR="<%= backupdir %>"
+TODAY=datetime.datetime.today().strftime("%A").lower()
+
+ftar = os.path.join(DUMP_DIR,"%s.tar" % TODAY)
+tmp_ftar = os.path.join(DUMP_DIR,"_%s.tar" % TODAY)
+tar = tarfile.open(tmp_ftar, "w")
+
+databases = simplejson.load(urllib2.urlopen("%s/_all_dbs" % DB_URL))
+
+for db in databases:
+  db_file = os.path.join(DUMP_DIR,"%s.gz" % db)
+  f = gzip.open(db_file, 'wb')
+  couchdb.tools.dump.dump_db(os.path.join(DB_URL,db), output=f)
+  f.close()
+  tar.add(db_file,"%s.gz" % db)
+  os.remove(db_file)
+
+tar.close()
+os.rename(tmp_ftar,ftar)
-- 
cgit v1.2.3


From 4aff06cc2fecc0b59728d7fc825fb36394b847b7 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:45:58 -0400
Subject: git subrepo clone https://leap.se/git/puppet_apache
 puppet/modules/apache

subrepo:
  subdir:   "puppet/modules/apache"
  merged:   "415e950"
upstream:
  origin:   "https://leap.se/git/puppet_apache"
  branch:   "master"
  commit:   "415e950"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Iba7353669969a09c0b4bbd63add67e3245b05ede
---
 puppet/modules/apache/.gitignore                   |    6 +
 puppet/modules/apache/.gitrepo                     |   11 +
 puppet/modules/apache/.rspec                       |    2 +
 puppet/modules/apache/Gemfile                      |   13 +
 puppet/modules/apache/LICENSE                      |  674 ++++++++++++
 puppet/modules/apache/Puppetfile                   |   15 +
 puppet/modules/apache/README.md                    |  233 ++++
 puppet/modules/apache/Rakefile                     |   26 +
 puppet/modules/apache/files/conf.d/CentOS/ssl.conf |   76 ++
 .../apache/files/conf.d/CentOS/welcome.conf        |   10 +
 puppet/modules/apache/files/conf.d/Debian/charset  |    6 +
 puppet/modules/apache/files/conf.d/Debian/security |   50 +
 puppet/modules/apache/files/conf.d/Debian/ssl.conf |    1 +
 .../modules/apache/files/conf.d/do_includes.conf   |    5 +
 puppet/modules/apache/files/conf.d/git.conf        |    5 +
 .../apache/files/conf.d/mozilla_autoconfig.conf    |    6 +
 puppet/modules/apache/files/conf.d/status.conf     |   24 +
 puppet/modules/apache/files/conf.d/vhosts.conf     |    8 +
 .../apache/files/config/Debian.jessie/apache2.conf |  221 ++++
 .../apache/files/config/Debian.wheezy/apache2.conf |  268 +++++
 .../apache/files/config/Debian/apache2.conf        |  230 ++++
 .../modules/apache/files/config/OpenBSD/httpd.conf | 1120 ++++++++++++++++++++
 puppet/modules/apache/files/include.d/defaults.inc |    5 +
 puppet/modules/apache/files/include.d/joomla.inc   |   30 +
 .../apache/files/include.d/silverstripe.inc        |   17 +
 .../apache/files/itk_plus/conf.d/CentOS/ssl.conf   |   75 ++
 .../modules.d/Gentoo/00_default_settings.conf      |  105 ++
 .../files/modules.d/Gentoo/00_error_documents.conf |   66 ++
 .../files/modules.d/Gentoo/00_languages.conf       |  137 +++
 .../files/modules.d/Gentoo/00_mod_autoindex.conf   |   83 ++
 .../apache/files/modules.d/Gentoo/00_mod_info.conf |   14 +
 .../files/modules.d/Gentoo/00_mod_log_config.conf  |   35 +
 .../apache/files/modules.d/Gentoo/00_mod_mime.conf |   55 +
 .../files/modules.d/Gentoo/00_mod_status.conf      |   19 +
 .../files/modules.d/Gentoo/00_mod_userdir.conf     |   40 +
 .../apache/files/modules.d/Gentoo/00_mpm.conf      |  102 ++
 .../files/modules.d/Gentoo/10_mod_mem_cache.conf   |   10 +
 .../apache/files/modules.d/Gentoo/40_mod_ssl.conf  |   65 ++
 .../apache/files/modules.d/Gentoo/45_mod_dav.conf  |   56 +
 .../apache/files/modules.d/Gentoo/46_mod_ldap.conf |   29 +
 .../apache/files/modules.d/Gentoo/70_mod_php5.conf |   18 +
 puppet/modules/apache/files/munin/apache_activity  |   99 ++
 .../files/scripts/OpenBSD/bin/apache_logrotate.sh  |    7 +
 .../files/scripts/OpenBSD/bin/restart_apache.sh    |    6 +
 .../scripts/OpenBSD/bin/restart_apache_ssl.sh      |    6 +
 puppet/modules/apache/files/service/CentOS/httpd   |   22 +
 .../modules/apache/files/service/CentOS/httpd.itk  |   23 +
 .../apache/files/service/CentOS/httpd.itk_plus     |   24 +
 .../apache/files/service/CentOS/httpd.worker       |   22 +
 .../apache/files/vhosts.d/CentOS/0-default.conf    |   11 +
 .../apache/files/vhosts.d/Debian/0-default.conf    |   41 +
 .../apache/files/vhosts.d/Gentoo/0-default.conf    |   51 +
 .../files/vhosts.d/Gentoo/default_vhost.include    |   79 ++
 .../apache/files/vhosts.d/OpenBSD/0-default.conf   |    8 +
 puppet/modules/apache/lib/facter/apache_version.rb |   28 +
 .../parser/functions/guess_apache_version.rb       |   39 +
 .../lib/puppet/parser/functions/htpasswd_sha1.rb   |    8 +
 puppet/modules/apache/manifests/base.pp            |   75 ++
 puppet/modules/apache/manifests/base/itk.pp        |    6 +
 puppet/modules/apache/manifests/centos.pp          |   86 ++
 puppet/modules/apache/manifests/centos/itk.pp      |   10 +
 puppet/modules/apache/manifests/centos/itk_plus.pp |   20 +
 puppet/modules/apache/manifests/centos/module.pp   |   30 +
 puppet/modules/apache/manifests/centos/worker.pp   |    5 +
 puppet/modules/apache/manifests/config/file.pp     |  106 ++
 puppet/modules/apache/manifests/config/global.pp   |   18 +
 puppet/modules/apache/manifests/config/include.pp  |   17 +
 puppet/modules/apache/manifests/debian.pp          |   44 +
 puppet/modules/apache/manifests/debian/itk.pp      |    9 +
 puppet/modules/apache/manifests/debian/module.pp   |   48 +
 puppet/modules/apache/manifests/defaultdavdbdir.pp |   17 +
 puppet/modules/apache/manifests/defaultphpdirs.pp  |   31 +
 puppet/modules/apache/manifests/file.pp            |   15 +
 puppet/modules/apache/manifests/file/readonly.pp   |   12 +
 puppet/modules/apache/manifests/file/rw.pp         |   13 +
 puppet/modules/apache/manifests/gentoo.pp          |   39 +
 puppet/modules/apache/manifests/gentoo/module.pp   |   30 +
 puppet/modules/apache/manifests/htpasswd_user.pp   |   34 +
 puppet/modules/apache/manifests/include/joomla.pp  |    3 +
 .../modules/apache/manifests/include/mod_fcgid.pp  |    7 +
 .../apache/manifests/include/silverstripe.pp       |    3 +
 puppet/modules/apache/manifests/includes.pp        |    5 +
 puppet/modules/apache/manifests/init.pp            |   44 +
 puppet/modules/apache/manifests/itk.pp             |   11 +
 puppet/modules/apache/manifests/itk/lock.pp        |    4 +
 puppet/modules/apache/manifests/itk_plus.pp        |   10 +
 puppet/modules/apache/manifests/itk_plus/lock.pp   |    4 +
 .../modules/apache/manifests/logrotate/centos.pp   |   10 +
 .../apache/manifests/logrotate/centos/vhosts.pp    |   11 +
 puppet/modules/apache/manifests/mod_dav_svn.pp     |    7 +
 puppet/modules/apache/manifests/mod_macro.pp       |    7 +
 puppet/modules/apache/manifests/module.pp          |   35 +
 puppet/modules/apache/manifests/module/alias.pp    |   14 +
 .../modules/apache/manifests/module/auth_basic.pp  |    6 +
 .../modules/apache/manifests/module/authn_core.pp  |    6 +
 .../modules/apache/manifests/module/authn_file.pp  |    6 +
 .../modules/apache/manifests/module/authz_core.pp  |    7 +
 .../modules/apache/manifests/module/authz_host.pp  |    6 +
 .../modules/apache/manifests/module/authz_user.pp  |    6 +
 puppet/modules/apache/manifests/module/cgi.pp      |    6 +
 puppet/modules/apache/manifests/module/dir.pp      |    6 +
 puppet/modules/apache/manifests/module/env.pp      |    7 +
 puppet/modules/apache/manifests/module/expires.pp  |    5 +
 puppet/modules/apache/manifests/module/headers.pp  |    6 +
 puppet/modules/apache/manifests/module/mime.pp     |    6 +
 .../modules/apache/manifests/module/mpm_event.pp   |    7 +
 .../modules/apache/manifests/module/mpm_prefork.pp |    6 +
 .../modules/apache/manifests/module/negotiation.pp |    6 +
 puppet/modules/apache/manifests/module/php5.pp     |    6 +
 puppet/modules/apache/manifests/module/removeip.pp |    6 +
 puppet/modules/apache/manifests/module/rewrite.pp  |    6 +
 .../apache/manifests/module/socache_shmcb.pp       |    6 +
 puppet/modules/apache/manifests/module/status.pp   |    6 +
 .../modules/apache/manifests/mozilla_autoconfig.pp |   37 +
 puppet/modules/apache/manifests/munin.pp           |   12 +
 puppet/modules/apache/manifests/noiplog.pp         |    5 +
 puppet/modules/apache/manifests/openbsd.pp         |   75 ++
 puppet/modules/apache/manifests/package.pp         |   32 +
 puppet/modules/apache/manifests/package/itk.pp     |    5 +
 puppet/modules/apache/manifests/sftponly.pp        |    5 +
 puppet/modules/apache/manifests/sftponly/centos.pp |   10 +
 puppet/modules/apache/manifests/ssl.pp             |   13 +
 puppet/modules/apache/manifests/ssl/base.pp        |   15 +
 puppet/modules/apache/manifests/ssl/centos.pp      |   12 +
 puppet/modules/apache/manifests/ssl/debian.pp      |    4 +
 puppet/modules/apache/manifests/ssl/itk.pp         |    8 +
 puppet/modules/apache/manifests/ssl/itk/centos.pp  |    6 +
 puppet/modules/apache/manifests/ssl/itk_plus.pp    |    6 +
 .../apache/manifests/ssl/itk_plus/centos.pp        |   11 +
 puppet/modules/apache/manifests/ssl/openbsd.pp     |   18 +
 puppet/modules/apache/manifests/status.pp          |   13 +
 puppet/modules/apache/manifests/status/base.pp     |    1 +
 puppet/modules/apache/manifests/status/centos.pp   |    5 +
 puppet/modules/apache/manifests/status/debian.pp   |    4 +
 puppet/modules/apache/manifests/vhost.pp           |  127 +++
 puppet/modules/apache/manifests/vhost/davdbdir.pp  |   40 +
 puppet/modules/apache/manifests/vhost/file.pp      |  151 +++
 .../apache/manifests/vhost/file/documentrootdir.pp |   24 +
 .../manifests/vhost/file/documentrootfile.pp       |   27 +
 puppet/modules/apache/manifests/vhost/gitweb.pp    |   59 ++
 puppet/modules/apache/manifests/vhost/modperl.pp   |  153 +++
 puppet/modules/apache/manifests/vhost/passenger.pp |  139 +++
 .../modules/apache/manifests/vhost/php/drupal.pp   |  144 +++
 .../modules/apache/manifests/vhost/php/gallery2.pp |  141 +++
 .../manifests/vhost/php/global_exec_bin_dir.pp     |    9 +
 .../modules/apache/manifests/vhost/php/joomla.pp   |  174 +++
 .../apache/manifests/vhost/php/mediawiki.pp        |  106 ++
 .../apache/manifests/vhost/php/safe_mode_bin.pp    |   17 +
 .../apache/manifests/vhost/php/silverstripe.pp     |  119 +++
 .../apache/manifests/vhost/php/simplemachine.pp    |  125 +++
 puppet/modules/apache/manifests/vhost/php/spip.pp  |  114 ++
 .../modules/apache/manifests/vhost/php/standard.pp |  304 ++++++
 puppet/modules/apache/manifests/vhost/php/typo3.pp |  150 +++
 .../modules/apache/manifests/vhost/php/webapp.pp   |  148 +++
 .../apache/manifests/vhost/php/wordpress.pp        |  123 +++
 puppet/modules/apache/manifests/vhost/phpdirs.pp   |   39 +
 puppet/modules/apache/manifests/vhost/proxy.pp     |   67 ++
 puppet/modules/apache/manifests/vhost/redirect.pp  |   56 +
 puppet/modules/apache/manifests/vhost/static.pp    |   86 ++
 puppet/modules/apache/manifests/vhost/template.pp  |  158 +++
 puppet/modules/apache/manifests/vhost/webdav.pp    |  126 +++
 puppet/modules/apache/manifests/vhost/webdir.pp    |  130 +++
 puppet/modules/apache/manifests/webdav.pp          |    8 +
 puppet/modules/apache/manifests/worker.pp          |    5 +
 puppet/modules/apache/spec/classes/init_spec.rb    |   43 +
 .../modules/apache/spec/defines/vhost_file_spec.rb |  131 +++
 .../apache/spec/defines/vhost_php_drupal_spec.rb   |  187 ++++
 .../apache/spec/defines/vhost_php_gallery2_spec.rb |  162 +++
 .../apache/spec/defines/vhost_php_joomla_spec.rb   |  279 +++++
 .../apache/spec/defines/vhost_php_standard_spec.rb |  534 ++++++++++
 .../apache/spec/defines/vhost_php_webapp_spec.rb   |  261 +++++
 .../spec/defines/vhost_php_wordpress_spec.rb       |  171 +++
 puppet/modules/apache/spec/defines/vhost_spec.rb   |  202 ++++
 .../apache/spec/defines/vhost_static_spec.rb       |   54 +
 .../apache/spec/defines/vhost_template_spec.rb     |  297 ++++++
 .../apache/spec/functions/guess_apache_version.rb  |   50 +
 puppet/modules/apache/spec/spec_helper.rb          |   13 +
 .../apache/templates/default/default_index.erb     |   13 +
 .../templates/include.d/ssl_defaults.inc.erb       |   78 ++
 .../itk_plus/CentOS/00-listen-ssl.conf.erb         |    6 +
 .../templates/itk_plus/CentOS/00-listen.conf.erb   |    8 +
 .../apache/templates/vhosts/0-default_ssl.conf.erb |   21 +
 puppet/modules/apache/templates/vhosts/default.erb |   44 +
 .../apache/templates/vhosts/gitweb/partial.erb     |   16 +
 .../modules/apache/templates/vhosts/itk_plus.erb   |    6 +
 .../apache/templates/vhosts/itk_plus/partial.erb   |   31 +
 .../templates/vhosts/partials/authentication.erb   |    6 +
 .../templates/vhosts/partials/header_default.erb   |   22 +
 .../apache/templates/vhosts/partials/logs.erb      |   18 +
 .../templates/vhosts/partials/mod_security.erb     |   27 +
 .../templates/vhosts/partials/php_settings.erb     |   20 +
 .../apache/templates/vhosts/partials/ssl.erb       |    8 +
 .../vhosts/partials/std_override_options.erb       |    4 +
 .../apache/templates/vhosts/passenger/partial.erb  |    7 +
 .../apache/templates/vhosts/perl/partial.erb       |   14 +
 .../apache/templates/vhosts/php/partial.erb        |    5 +
 .../apache/templates/vhosts/php_drupal/partial.erb |   22 +
 .../templates/vhosts/php_gallery2/partial.erb      |   14 +
 .../apache/templates/vhosts/php_joomla/partial.erb |   30 +
 .../templates/vhosts/php_mediawiki/partial.erb     |    7 +
 .../templates/vhosts/php_silverstripe/partial.erb  |   12 +
 .../apache/templates/vhosts/php_typo3/partial.erb  |   10 +
 .../templates/vhosts/php_wordpress/partial.erb     |   19 +
 .../apache/templates/vhosts/proxy/partial.erb      |    8 +
 .../apache/templates/vhosts/redirect/partial.erb   |    1 +
 .../apache/templates/vhosts/static/partial.erb     |    4 +
 .../apache/templates/vhosts/webdav/partial.erb     |   21 +
 .../templates/webfiles/autoconfig/config.shtml.erb |   58 +
 208 files changed, 11717 insertions(+)
 create mode 100644 puppet/modules/apache/.gitignore
 create mode 100644 puppet/modules/apache/.gitrepo
 create mode 100644 puppet/modules/apache/.rspec
 create mode 100644 puppet/modules/apache/Gemfile
 create mode 100644 puppet/modules/apache/LICENSE
 create mode 100644 puppet/modules/apache/Puppetfile
 create mode 100644 puppet/modules/apache/README.md
 create mode 100644 puppet/modules/apache/Rakefile
 create mode 100644 puppet/modules/apache/files/conf.d/CentOS/ssl.conf
 create mode 100644 puppet/modules/apache/files/conf.d/CentOS/welcome.conf
 create mode 100644 puppet/modules/apache/files/conf.d/Debian/charset
 create mode 100644 puppet/modules/apache/files/conf.d/Debian/security
 create mode 100644 puppet/modules/apache/files/conf.d/Debian/ssl.conf
 create mode 100644 puppet/modules/apache/files/conf.d/do_includes.conf
 create mode 100644 puppet/modules/apache/files/conf.d/git.conf
 create mode 100644 puppet/modules/apache/files/conf.d/mozilla_autoconfig.conf
 create mode 100644 puppet/modules/apache/files/conf.d/status.conf
 create mode 100644 puppet/modules/apache/files/conf.d/vhosts.conf
 create mode 100644 puppet/modules/apache/files/config/Debian.jessie/apache2.conf
 create mode 100644 puppet/modules/apache/files/config/Debian.wheezy/apache2.conf
 create mode 100644 puppet/modules/apache/files/config/Debian/apache2.conf
 create mode 100644 puppet/modules/apache/files/config/OpenBSD/httpd.conf
 create mode 100644 puppet/modules/apache/files/include.d/defaults.inc
 create mode 100644 puppet/modules/apache/files/include.d/joomla.inc
 create mode 100644 puppet/modules/apache/files/include.d/silverstripe.inc
 create mode 100644 puppet/modules/apache/files/itk_plus/conf.d/CentOS/ssl.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_default_settings.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_error_documents.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_languages.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_mod_autoindex.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_mod_info.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_mod_log_config.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_mod_mime.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_mod_status.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_mod_userdir.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/00_mpm.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/10_mod_mem_cache.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/40_mod_ssl.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/45_mod_dav.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/46_mod_ldap.conf
 create mode 100644 puppet/modules/apache/files/modules.d/Gentoo/70_mod_php5.conf
 create mode 100755 puppet/modules/apache/files/munin/apache_activity
 create mode 100644 puppet/modules/apache/files/scripts/OpenBSD/bin/apache_logrotate.sh
 create mode 100644 puppet/modules/apache/files/scripts/OpenBSD/bin/restart_apache.sh
 create mode 100644 puppet/modules/apache/files/scripts/OpenBSD/bin/restart_apache_ssl.sh
 create mode 100644 puppet/modules/apache/files/service/CentOS/httpd
 create mode 100644 puppet/modules/apache/files/service/CentOS/httpd.itk
 create mode 100644 puppet/modules/apache/files/service/CentOS/httpd.itk_plus
 create mode 100644 puppet/modules/apache/files/service/CentOS/httpd.worker
 create mode 100644 puppet/modules/apache/files/vhosts.d/CentOS/0-default.conf
 create mode 100644 puppet/modules/apache/files/vhosts.d/Debian/0-default.conf
 create mode 100644 puppet/modules/apache/files/vhosts.d/Gentoo/0-default.conf
 create mode 100644 puppet/modules/apache/files/vhosts.d/Gentoo/default_vhost.include
 create mode 100644 puppet/modules/apache/files/vhosts.d/OpenBSD/0-default.conf
 create mode 100644 puppet/modules/apache/lib/facter/apache_version.rb
 create mode 100644 puppet/modules/apache/lib/puppet/parser/functions/guess_apache_version.rb
 create mode 100644 puppet/modules/apache/lib/puppet/parser/functions/htpasswd_sha1.rb
 create mode 100644 puppet/modules/apache/manifests/base.pp
 create mode 100644 puppet/modules/apache/manifests/base/itk.pp
 create mode 100644 puppet/modules/apache/manifests/centos.pp
 create mode 100644 puppet/modules/apache/manifests/centos/itk.pp
 create mode 100644 puppet/modules/apache/manifests/centos/itk_plus.pp
 create mode 100644 puppet/modules/apache/manifests/centos/module.pp
 create mode 100644 puppet/modules/apache/manifests/centos/worker.pp
 create mode 100644 puppet/modules/apache/manifests/config/file.pp
 create mode 100644 puppet/modules/apache/manifests/config/global.pp
 create mode 100644 puppet/modules/apache/manifests/config/include.pp
 create mode 100644 puppet/modules/apache/manifests/debian.pp
 create mode 100644 puppet/modules/apache/manifests/debian/itk.pp
 create mode 100644 puppet/modules/apache/manifests/debian/module.pp
 create mode 100644 puppet/modules/apache/manifests/defaultdavdbdir.pp
 create mode 100644 puppet/modules/apache/manifests/defaultphpdirs.pp
 create mode 100644 puppet/modules/apache/manifests/file.pp
 create mode 100644 puppet/modules/apache/manifests/file/readonly.pp
 create mode 100644 puppet/modules/apache/manifests/file/rw.pp
 create mode 100644 puppet/modules/apache/manifests/gentoo.pp
 create mode 100644 puppet/modules/apache/manifests/gentoo/module.pp
 create mode 100644 puppet/modules/apache/manifests/htpasswd_user.pp
 create mode 100644 puppet/modules/apache/manifests/include/joomla.pp
 create mode 100644 puppet/modules/apache/manifests/include/mod_fcgid.pp
 create mode 100644 puppet/modules/apache/manifests/include/silverstripe.pp
 create mode 100644 puppet/modules/apache/manifests/includes.pp
 create mode 100644 puppet/modules/apache/manifests/init.pp
 create mode 100644 puppet/modules/apache/manifests/itk.pp
 create mode 100644 puppet/modules/apache/manifests/itk/lock.pp
 create mode 100644 puppet/modules/apache/manifests/itk_plus.pp
 create mode 100644 puppet/modules/apache/manifests/itk_plus/lock.pp
 create mode 100644 puppet/modules/apache/manifests/logrotate/centos.pp
 create mode 100644 puppet/modules/apache/manifests/logrotate/centos/vhosts.pp
 create mode 100644 puppet/modules/apache/manifests/mod_dav_svn.pp
 create mode 100644 puppet/modules/apache/manifests/mod_macro.pp
 create mode 100644 puppet/modules/apache/manifests/module.pp
 create mode 100644 puppet/modules/apache/manifests/module/alias.pp
 create mode 100644 puppet/modules/apache/manifests/module/auth_basic.pp
 create mode 100644 puppet/modules/apache/manifests/module/authn_core.pp
 create mode 100644 puppet/modules/apache/manifests/module/authn_file.pp
 create mode 100644 puppet/modules/apache/manifests/module/authz_core.pp
 create mode 100644 puppet/modules/apache/manifests/module/authz_host.pp
 create mode 100644 puppet/modules/apache/manifests/module/authz_user.pp
 create mode 100644 puppet/modules/apache/manifests/module/cgi.pp
 create mode 100644 puppet/modules/apache/manifests/module/dir.pp
 create mode 100644 puppet/modules/apache/manifests/module/env.pp
 create mode 100644 puppet/modules/apache/manifests/module/expires.pp
 create mode 100644 puppet/modules/apache/manifests/module/headers.pp
 create mode 100644 puppet/modules/apache/manifests/module/mime.pp
 create mode 100644 puppet/modules/apache/manifests/module/mpm_event.pp
 create mode 100644 puppet/modules/apache/manifests/module/mpm_prefork.pp
 create mode 100644 puppet/modules/apache/manifests/module/negotiation.pp
 create mode 100644 puppet/modules/apache/manifests/module/php5.pp
 create mode 100644 puppet/modules/apache/manifests/module/removeip.pp
 create mode 100644 puppet/modules/apache/manifests/module/rewrite.pp
 create mode 100644 puppet/modules/apache/manifests/module/socache_shmcb.pp
 create mode 100644 puppet/modules/apache/manifests/module/status.pp
 create mode 100644 puppet/modules/apache/manifests/mozilla_autoconfig.pp
 create mode 100644 puppet/modules/apache/manifests/munin.pp
 create mode 100644 puppet/modules/apache/manifests/noiplog.pp
 create mode 100644 puppet/modules/apache/manifests/openbsd.pp
 create mode 100644 puppet/modules/apache/manifests/package.pp
 create mode 100644 puppet/modules/apache/manifests/package/itk.pp
 create mode 100644 puppet/modules/apache/manifests/sftponly.pp
 create mode 100644 puppet/modules/apache/manifests/sftponly/centos.pp
 create mode 100644 puppet/modules/apache/manifests/ssl.pp
 create mode 100644 puppet/modules/apache/manifests/ssl/base.pp
 create mode 100644 puppet/modules/apache/manifests/ssl/centos.pp
 create mode 100644 puppet/modules/apache/manifests/ssl/debian.pp
 create mode 100644 puppet/modules/apache/manifests/ssl/itk.pp
 create mode 100644 puppet/modules/apache/manifests/ssl/itk/centos.pp
 create mode 100644 puppet/modules/apache/manifests/ssl/itk_plus.pp
 create mode 100644 puppet/modules/apache/manifests/ssl/itk_plus/centos.pp
 create mode 100644 puppet/modules/apache/manifests/ssl/openbsd.pp
 create mode 100644 puppet/modules/apache/manifests/status.pp
 create mode 100644 puppet/modules/apache/manifests/status/base.pp
 create mode 100644 puppet/modules/apache/manifests/status/centos.pp
 create mode 100644 puppet/modules/apache/manifests/status/debian.pp
 create mode 100644 puppet/modules/apache/manifests/vhost.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/davdbdir.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/file.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/file/documentrootdir.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/file/documentrootfile.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/gitweb.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/modperl.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/passenger.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/drupal.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/gallery2.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/global_exec_bin_dir.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/joomla.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/mediawiki.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/safe_mode_bin.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/silverstripe.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/simplemachine.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/spip.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/standard.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/typo3.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/webapp.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/php/wordpress.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/phpdirs.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/proxy.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/redirect.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/static.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/template.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/webdav.pp
 create mode 100644 puppet/modules/apache/manifests/vhost/webdir.pp
 create mode 100644 puppet/modules/apache/manifests/webdav.pp
 create mode 100644 puppet/modules/apache/manifests/worker.pp
 create mode 100644 puppet/modules/apache/spec/classes/init_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_file_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_php_drupal_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_php_gallery2_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_php_joomla_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_php_standard_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_php_webapp_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_php_wordpress_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_static_spec.rb
 create mode 100644 puppet/modules/apache/spec/defines/vhost_template_spec.rb
 create mode 100644 puppet/modules/apache/spec/functions/guess_apache_version.rb
 create mode 100644 puppet/modules/apache/spec/spec_helper.rb
 create mode 100644 puppet/modules/apache/templates/default/default_index.erb
 create mode 100644 puppet/modules/apache/templates/include.d/ssl_defaults.inc.erb
 create mode 100644 puppet/modules/apache/templates/itk_plus/CentOS/00-listen-ssl.conf.erb
 create mode 100644 puppet/modules/apache/templates/itk_plus/CentOS/00-listen.conf.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/0-default_ssl.conf.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/default.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/gitweb/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/itk_plus.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/itk_plus/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/partials/authentication.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/partials/header_default.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/partials/logs.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/partials/mod_security.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/partials/php_settings.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/partials/ssl.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/partials/std_override_options.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/passenger/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/perl/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/php/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/php_drupal/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/php_gallery2/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/php_joomla/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/php_mediawiki/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/php_silverstripe/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/php_typo3/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/php_wordpress/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/proxy/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/redirect/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/static/partial.erb
 create mode 100644 puppet/modules/apache/templates/vhosts/webdav/partial.erb
 create mode 100644 puppet/modules/apache/templates/webfiles/autoconfig/config.shtml.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/apache/.gitignore b/puppet/modules/apache/.gitignore
new file mode 100644
index 00000000..cb918d8c
--- /dev/null
+++ b/puppet/modules/apache/.gitignore
@@ -0,0 +1,6 @@
+.tmp_*~
+.librarian
+.tmp
+spec/fixtures/modules
+spec/fixtures/manifests
+*.lock
diff --git a/puppet/modules/apache/.gitrepo b/puppet/modules/apache/.gitrepo
new file mode 100644
index 00000000..fdeb3d77
--- /dev/null
+++ b/puppet/modules/apache/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_apache
+	branch = master
+	commit = 415e9504f99dca3ccaa4dfd389dde24ad9d0e01c
+	parent = f2019755fd724fb1020cb2d97cdf82b751450ebc
+	cmdver = 0.3.0
diff --git a/puppet/modules/apache/.rspec b/puppet/modules/apache/.rspec
new file mode 100644
index 00000000..8c18f1ab
--- /dev/null
+++ b/puppet/modules/apache/.rspec
@@ -0,0 +1,2 @@
+--format documentation
+--color
diff --git a/puppet/modules/apache/Gemfile b/puppet/modules/apache/Gemfile
new file mode 100644
index 00000000..b1fc9814
--- /dev/null
+++ b/puppet/modules/apache/Gemfile
@@ -0,0 +1,13 @@
+source 'https://rubygems.org'
+
+if ENV.key?('PUPPET_VERSION')
+  puppetversion = "~> #{ENV['PUPPET_VERSION']}"
+else
+  puppetversion = ['>= 3.3.1']
+end
+
+gem 'puppet', puppetversion
+gem 'puppet-lint', '>=0.3.2'
+gem 'puppetlabs_spec_helper', '>=0.2.0'
+gem 'rake', '>=0.9.2.2'
+gem 'librarian-puppet', '>=0.9.10'
diff --git a/puppet/modules/apache/LICENSE b/puppet/modules/apache/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/apache/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/apache/Puppetfile b/puppet/modules/apache/Puppetfile
new file mode 100644
index 00000000..86d58ae6
--- /dev/null
+++ b/puppet/modules/apache/Puppetfile
@@ -0,0 +1,15 @@
+# empty
+
+forge 'https://forgeapi.puppetlabs.com'
+
+mod 'shorewall', :git => 'https://git-ipuppet.immerda.ch/module-shorewall'
+mod 'templatewlv', :git => 'https://git-ipuppet.immerda.ch/module-templatewlv'
+mod 'mod_security', :git => 'https://git-ipuppet.immerda.ch/module-mod_security'
+mod 'mod_fcgid', :git => 'https://git-ipuppet.immerda.ch/module-mod_fcgid'
+mod 'php', :git => 'https://git-ipuppet.immerda.ch/module-php'
+mod 'perl', :git => 'https://git-ipuppet.immerda.ch/module-perl'
+mod 'scl', :git => 'https://git-ipuppet.immerda.ch/module-scl'
+mod 'yum', :git => 'https://git-ipuppet.immerda.ch/module-yum'
+mod 'puppetlabs-stdlib'
+mod 'puppetlabs-concat'
+#mod 'munin', :git => 'https://git-ipuppet.immerda.ch/module-munin'
diff --git a/puppet/modules/apache/README.md b/puppet/modules/apache/README.md
new file mode 100644
index 00000000..331c85b0
--- /dev/null
+++ b/puppet/modules/apache/README.md
@@ -0,0 +1,233 @@
+Puppet module for managing an Apache web server
+===============================================
+
+This module tries to manage apache on different distros in a similar manner. a
+few additional directories have to be created as well some configuration files
+have to be deployed to fit this schema.
+
+! Upgrade Notices !
+
+ * The $ssl_cipher_suite has been evaluated from the `cert` module in the
+   past, but is now a hardcoded default for the sake of reducing dependency
+   to other modules. If you were using the `cert` module before, you should
+   pass this parameter when declaring the apache class !
+
+ * this module now only works with puppet 2.7 or newer
+
+ * this module now uses parameterized classes, if you were using global
+   variables before, you need to change the class declarations in your manifests
+
+ * this module now requires the stdlib module
+
+ * this module no longer requires the common module
+
+ * if using the munin module, you need a version of the munin module that is
+   at or newer than commit 77e0a70999a8c4c20ee8d9eb521b927c525ac653 (Feb 28, 2013)
+
+ * if using munin, you will need to have the perl module installed
+
+ * you must change your modules/site-apache to modules/site_apache
+
+ * the $apache_no_default_site variable is no longer supported, you should
+   switch to passing the parameter "no_default_site => true" to the apache class
+
+ * the $use_munin variable is no longer supported, you should switch to
+   passing the parameter 'manage_munin' to the apache class
+
+ * the $use_shorewall variable is no longer supported, you should switch to
+   passing the parameter 'manage_shorewall' to the apache class
+
+ * if you were using apache::vhost::file, or apache::vhost::template, there is a
+   wrapper called apache::vhost now that takes a $vhost_mode (either the default
+   'template', or 'file), although you can continue to use the longer defines
+
+ * Previously, apache::config::file resources would require the source to be a
+   full source specification, this is no longer needed, so please change any:
+
+      source => "puppet:///modules/site-apache/blah"
+
+   to be:
+
+      source => "modules/site-apache/blah"
+
+
+Requirements
+------------
+
+ * puppet 2.7 or newer
+ * stdlib module
+ * templatewlv module
+ * facter >= 2.2
+   because we check for $::operatingsystemmajrelease on multiple places.
+   In Debian wheezy, facter needs to get upgraded from wheezy-backports.
+   The facter version of Debian jessie is new enough.
+
+Usage
+=====
+
+Installing Apache
+-----------------
+
+To install Apache, simply include the 'apache' class in your manifests:
+
+    include apache
+
+This will give you a basic managed setup. You can pass a couple parameters to the
+class to have the module do some things for you:
+
+  * manage_shorewall: If you have the shorewall module installed and are using
+    it then rules will be automatically defined for you to let traffic come from
+    the exterior into the web server via port 80, and also 443 if you're using
+    the apache::ssl class. (Default: false)
+
+  * manage_munin: If you have the munin module installed and are using it, then
+    some apache graphs will be configured for you. (Default: false)
+
+  * no_default_site: If you do not want the 0-default.conf and
+    0-default_ssl.conf virtualhosts automatically created in your node
+    configuration. (Default: false)
+
+  * ssl: If you want to install Apache SSL support enabled, just pass this
+    parameter (Default: false)
+
+For example:
+
+    class { 'apache':
+      manage_shorewall => true,
+      manage_munin     => true,
+      no_default_site  => true,
+      ssl              => true
+    }
+
+You can install the ITK worker model to enforce stronger, per-user security:
+
+    include apache::itk
+
+On CentOS you can include 'apache::itk_plus' to get that mode. Not currently
+implemented for other operating systems
+
+You can combine SSL support and the ITK worker model by including both classes.
+
+
+Configuring Apache
+------------------
+
+To deploy a configuration files to the conf.d or include.d directory under
+Apache's config directory, you can use the following:
+
+    apache::config::file { 'filename':
+      content => 'Alias /thisApplication /usr/share/thisApplication/htdocs',
+    }
+
+by default this will deploy a conf.d global configuration file called 'filename'
+with that content.
+
+You can pass the parameter 'type => include' to add includes for vhosts
+
+
+To manage users in an htpasswd file:
+
+    apache::htpasswd_user { "joe@$domain":
+      ensure             => present,   # default: present
+      site               => "$domain", # default: 'absent' - will use $name
+      username           => 'joe',     # default: 'absent' - will use $name
+      password           => "pass",
+      password_iscrypted => false,     # default: false - will sha1 hash the value
+      path               => 'absent'   # default: 'absent' - /var/www/htpasswds/${site}
+    }
+
+This will place an encrypted version of "pass" for user joe into
+/var/www/htpasswds/${site}
+
+You will need to make sure that ${site} exists before this is done, see the
+apache::vhost class below for how this is done.
+
+VirtualHost files
+-----------------
+
+vhosts can be added with the apache::vhost define.
+
+You can ship a flat file containing the configuration, or a template. That is
+controlled by the 'vhost_mode' parameter, which can be either 'file', or
+'template' (default).
+
+Unless specified, the source will be automatically pulled from
+modules/site_apache/{templates,files}/vhosts.d, searched in this order:
+
+    "puppet:///modules/site_apache/vhosts.d/${::fqdn}/${name}.conf",
+    "puppet:///modules/site_apache/vhosts.d/{$apache::cluster_node}/${name}.conf",
+    "puppet:///modules/site_apache/vhosts.d/${::operatingsystem}.${::operatingsystemmajrelease}/${name}.conf",
+    "puppet:///modules/site_apache/vhosts.d/${::operatingsystem}/${name}.conf",
+    "puppet:///modules/site_apache/vhosts.d/${name}.conf",
+
+otherwise you can pass a 'content' parameter to configure a template location that
+it should be pulled from, or a 'vhost_source' parameter to specify the file source.
+
+For example:
+
+This would deploy a the vhost for $domain, pulled from a file from the sources
+listed above:
+
+    apache::vhost { "$domain": vhost_mode => 'file' }
+
+    apache::vhost { "$domain":
+                       vhost_mode   => 'file',
+                       vhost_source => 'modules/site_configs/vhosts.d/${name}.conf"
+    }
+
+There are multiple other additional configurables that you can pass to each
+vhost definition:
+
+* logmode:
+   - default: Do normal logging to CustomLog and ErrorLog
+   - nologs: Send every logging to /dev/null
+   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+
+* run_mode: controls in which mode the vhost should be run, there are different setups
+            possible:
+    - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+              setup anything special
+    - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+           with 'proxy-itk' & 'static-itk' mode)
+    - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+                 requests for the itk setup, that listens only on the loobpack device.
+                 (Incompatibility: cannot be used in combination with the itk setup.)
+    - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+                  content and proxies the dynamic calls to the itk setup, that listens only on
+                  the loobpack device (Incompatibility: cannot be used in combination with
+                  'itk' mode)
+
+* mod_security: Whether we use mod_security or not (will include mod_security module)
+     - false: (*default*) don't activate mod_security
+     - true: activate mod_security
+
+For templates, you can pass various parameters that will automatically configure
+the template accordingly (such as php_options and php_settings). Please see
+manifests/vhost/template.pp for the full list.
+
+There are various pre-made vhost configurations that use good defaults that you can use:
+
+- apache::vhost::gitweb - sets up a gitweb vhost
+- apache::vhost::modperl - uses modperl, with optional fastcgi
+- apache::vhost::passenger - setup passenger
+- apache::vhost::proxy - setup a proxy vhost
+- apache::vhost::redirect - vhost to redirect hosts
+- apache::vhost::static - a static vhost
+- apache::vhost::webdav - for managing webdave accessible targets
+
+Additionally, for php sites, there are several handy pre-made vhost configurations:
+
+- apache::vhost::php::drupal
+- apache::vhost::php::gallery2
+- apache::vhost::php::global_exec_bin_dir
+- apache::vhost::php::joomla
+- apache::vhost::php::mediawiki
+- apache::vhost::php::safe_mode_bin
+- apache::vhost::php::silverstripe
+- apache::vhost::php::simplemachine
+- apache::vhost::php::spip
+- apache::vhost::php::standard
+- apache::vhost::php::typo3
+- apache::vhost::php::webapp
+- apache::vhost::php::wordpress
diff --git a/puppet/modules/apache/Rakefile b/puppet/modules/apache/Rakefile
new file mode 100644
index 00000000..ec1c52b3
--- /dev/null
+++ b/puppet/modules/apache/Rakefile
@@ -0,0 +1,26 @@
+require 'bundler'
+Bundler.require(:rake)
+
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+
+Rake::Task[:lint].clear
+PuppetLint::RakeTask.new :lint do |config|
+  config.ignore_paths = ["spec/**/*.pp", "vendor/**/*.pp"]
+  config.log_format = '%{path}:%{linenumber}:%{KIND}: %{message}'
+  config.disable_checks = [ "class_inherits_from_params_class", "80chars" ]
+end
+
+# use librarian-puppet to manage fixtures instead of .fixtures.yml
+# offers more possibilities like explicit version management, forge downloads,...
+task :librarian_spec_prep do
+  sh "librarian-puppet install --path=spec/fixtures/modules/"
+  pwd = `pwd`.strip
+  unless File.directory?("#{pwd}/spec/fixtures/modules/apache")
+    sh "ln -s #{pwd} #{pwd}/spec/fixtures/modules/apache"
+  end
+end
+task :spec_prep => :librarian_spec_prep
+
+
+task :default => [:spec, :lint]
diff --git a/puppet/modules/apache/files/conf.d/CentOS/ssl.conf b/puppet/modules/apache/files/conf.d/CentOS/ssl.conf
new file mode 100644
index 00000000..7f9be957
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/CentOS/ssl.conf
@@ -0,0 +1,76 @@
+#
+# This is the Apache server configuration file providing SSL support.
+# It contains the configuration directives to instruct the server how to
+# serve pages over an https connection. For detailing information about these 
+# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
+# 
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+
+LoadModule ssl_module modules/mod_ssl.so
+
+#
+# When we also provide SSL we have to listen to the 
+# the HTTPS port in addition.
+#
+Listen 443
+NameVirtualHost *:443
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#
+#   Some MIME-types for downloading Certificates and CRLs
+#
+AddType application/x-x509-ca-cert .crt
+AddType application/x-pkcs7-crl    .crl
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is a internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+SSLPassPhraseDialog  builtin
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First the mechanism 
+#   to use and second the expiring timeout (in seconds).
+#SSLSessionCache        dc:UNIX:/var/cache/mod_ssl/distcache
+SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
+SSLSessionCacheTimeout  300
+
+#   Semaphore:
+#   Configure the path to the mutual exclusion semaphore the
+#   SSL engine uses internally for inter-process synchronization. 
+SSLMutex default
+
+#   Pseudo Random Number Generator (PRNG):
+#   Configure one or more sources to seed the PRNG of the 
+#   SSL library. The seed data should be of good random quality.
+#   WARNING! On some platforms /dev/random blocks if not enough entropy
+#   is available. This means you then cannot use the /dev/random device
+#   because it would lead to very long connection times (as long as
+#   it requires to make more entropy available). But usually those
+#   platforms additionally provide a /dev/urandom device which doesn't
+#   block. So, if available, use this one instead. Read the mod_ssl User
+#   Manual for more details.
+SSLRandomSeed startup file:/dev/urandom  256
+SSLRandomSeed connect builtin
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+
+#
+# Use "SSLCryptoDevice" to enable any supported hardware
+# accelerators. Use "openssl engine -v" to list supported
+# engine names.  NOTE: If you enable an accelerator and the
+# server does not start, consult the error logs and ensure
+# your accelerator is functioning properly. 
+#
+SSLCryptoDevice builtin
+#SSLCryptoDevice ubsec
diff --git a/puppet/modules/apache/files/conf.d/CentOS/welcome.conf b/puppet/modules/apache/files/conf.d/CentOS/welcome.conf
new file mode 100644
index 00000000..7d7b0cd6
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/CentOS/welcome.conf
@@ -0,0 +1,10 @@
+# 
+# This configuration file enables the default "Welcome"
+# page if there is no default index page present for
+# the root URL.  To disable the Welcome page, comment
+# out all the lines below.
+#
+#<LocationMatch "^/+$">
+#    Options -Indexes
+#    ErrorDocument 403 /error/noindex.html
+#</LocationMatch>
diff --git a/puppet/modules/apache/files/conf.d/Debian/charset b/puppet/modules/apache/files/conf.d/Debian/charset
new file mode 100644
index 00000000..40d7198b
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/Debian/charset
@@ -0,0 +1,6 @@
+# Read the documentation before enabling AddDefaultCharset.
+# In general, it is only a good idea if you know that all your files
+# have this encoding. It will override any encoding given in the files
+# in meta http-equiv or xml encoding tags.
+
+#AddDefaultCharset UTF-8
diff --git a/puppet/modules/apache/files/conf.d/Debian/security b/puppet/modules/apache/files/conf.d/Debian/security
new file mode 100644
index 00000000..55b3e519
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/Debian/security
@@ -0,0 +1,50 @@
+#
+# Disable access to the entire file system except for the directories that
+# are explicitly allowed later.
+#
+# This currently breaks the configurations that come with some web application
+# Debian packages. It will be made the default for the release after lenny.
+#
+#<Directory />
+#	AllowOverride None
+#	Order Deny,Allow
+#	Deny from all
+#</Directory>
+
+
+# Changing the following options will not really affect the security of the
+# server, but might make attacks slightly more difficult in some cases.
+
+#
+# ServerTokens
+# This directive configures what you return as the Server HTTP response
+# Header. The default is 'Full' which sends information about the OS-Type
+# and compiled in modules.
+# Set to one of:  Full | OS | Minimal | Minor | Major | Prod
+# where Full conveys the most information, and Prod the least.
+#
+#ServerTokens Minimal
+ServerTokens Full
+
+#
+# Optionally add a line containing the server version and virtual host
+# name to server-generated pages (internal error documents, FTP directory
+# listings, mod_status and mod_info output etc., but not CGI generated
+# documents or custom error documents).
+# Set to "EMail" to also include a mailto: link to the ServerAdmin.
+# Set to one of:  On | Off | EMail
+#
+#ServerSignature Off
+ServerSignature On
+
+#
+# Allow TRACE method
+#
+# Set to "extended" to also reflect the request body (only for testing and
+# diagnostic purposes).
+#
+# Set to one of:  On | Off | extended
+#
+#TraceEnable Off
+TraceEnable On
+
diff --git a/puppet/modules/apache/files/conf.d/Debian/ssl.conf b/puppet/modules/apache/files/conf.d/Debian/ssl.conf
new file mode 100644
index 00000000..bcfe8201
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/Debian/ssl.conf
@@ -0,0 +1 @@
+NameVirtualHost *:443
diff --git a/puppet/modules/apache/files/conf.d/do_includes.conf b/puppet/modules/apache/files/conf.d/do_includes.conf
new file mode 100644
index 00000000..f44d9d4a
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/do_includes.conf
@@ -0,0 +1,5 @@
+#
+# Add index.shtml to the list of files that will be served as directory
+# indexes.
+#
+DirectoryIndex index.shtml
diff --git a/puppet/modules/apache/files/conf.d/git.conf b/puppet/modules/apache/files/conf.d/git.conf
new file mode 100644
index 00000000..c03ee2b5
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/git.conf
@@ -0,0 +1,5 @@
+# deny access to git repository folders
+<DirectoryMatch .*\.git/.*>
+    Order allow,deny
+    Deny From All
+</DirectoryMatch>
diff --git a/puppet/modules/apache/files/conf.d/mozilla_autoconfig.conf b/puppet/modules/apache/files/conf.d/mozilla_autoconfig.conf
new file mode 100644
index 00000000..6e4f7db8
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/mozilla_autoconfig.conf
@@ -0,0 +1,6 @@
+Alias /.well-known/autoconfig/mail/config-v1.1.xml /var/www/autoconfig/config.shtml
+<Directory /var/www/autoconfig/>
+  Options +Includes
+  AddType application/xml .shtml
+  AddOutputFilter INCLUDES .shtml
+</Directory>
diff --git a/puppet/modules/apache/files/conf.d/status.conf b/puppet/modules/apache/files/conf.d/status.conf
new file mode 100644
index 00000000..fb706cc1
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/status.conf
@@ -0,0 +1,24 @@
+###########################################################
+### this file is managed by PUPPET                     ####
+### only modify it in puppet repo or you will          ####
+### loose the changes !                                ####
+###########################################################
+
+# Allow server status reports generated by mod_status,
+# with the URL of http://servername/server-status
+<Location /server-status>
+    SetHandler server-status
+    Order deny,allow
+    Deny from all
+    Allow from 127.0.0.1
+
+    <IfModule mod_security2.c>
+	SecRuleEngine Off
+    </IfModule>
+</Location>
+
+# ExtendedStatus controls whether Apache will generate "full" status
+# information (ExtendedStatus On) or just basic information (ExtendedStatus
+# Off) when the "server-status" handler is called.
+ExtendedStatus On
+
diff --git a/puppet/modules/apache/files/conf.d/vhosts.conf b/puppet/modules/apache/files/conf.d/vhosts.conf
new file mode 100644
index 00000000..86485501
--- /dev/null
+++ b/puppet/modules/apache/files/conf.d/vhosts.conf
@@ -0,0 +1,8 @@
+###########################################################
+### this file is managed by PUPPET                     ####
+### only modify it in puppet repo or you will          ####
+### loose the changes !                                ####
+###########################################################
+
+NameVirtualHost *:80
+Include vhosts.d/*.conf
diff --git a/puppet/modules/apache/files/config/Debian.jessie/apache2.conf b/puppet/modules/apache/files/config/Debian.jessie/apache2.conf
new file mode 100644
index 00000000..7b1f96f5
--- /dev/null
+++ b/puppet/modules/apache/files/config/Debian.jessie/apache2.conf
@@ -0,0 +1,221 @@
+# This is the main Apache server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See http://httpd.apache.org/docs/2.4/ for detailed information about
+# the directives and /usr/share/doc/apache2/README.Debian about Debian specific
+# hints.
+#
+#
+# Summary of how the Apache 2 configuration works in Debian:
+# The Apache 2 web server configuration in Debian is quite different to
+# upstream's suggested way to configure the web server. This is because Debian's
+# default Apache2 installation attempts to make adding and removing modules,
+# virtual hosts, and extra configuration directives as flexible as possible, in
+# order to make automating the changes and administering the server as easy as
+# possible.
+
+# It is split into several files forming the configuration hierarchy outlined
+# below, all located in the /etc/apache2/ directory:
+#
+#   /etc/apache2/
+#   |-- apache2.conf
+#   |   `--  ports.conf
+#   |-- mods-enabled
+#   |   |-- *.load
+#   |   `-- *.conf
+#   |-- conf-enabled
+#   |   `-- *.conf
+#   `-- sites-enabled
+#       `-- *.conf
+#
+#
+# * apache2.conf is the main configuration file (this file). It puts the pieces
+#   together by including all remaining configuration files when starting up the
+#   web server.
+#
+# * ports.conf is always included from the main configuration file. It is
+#   supposed to determine listening ports for incoming connections which can be
+#   customized anytime.
+#
+# * Configuration files in the mods-enabled/, conf-enabled/ and sites-enabled/
+#   directories contain particular configuration snippets which manage modules,
+#   global configuration fragments, or virtual host configurations,
+#   respectively.
+#
+#   They are activated by symlinking available configuration files from their
+#   respective *-available/ counterparts. These should be managed by using our
+#   helpers a2enmod/a2dismod, a2ensite/a2dissite and a2enconf/a2disconf. See
+#   their respective man pages for detailed information.
+#
+# * The binary is called apache2. Due to the use of environment variables, in
+#   the default configuration, apache2 needs to be started/stopped with
+#   /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not
+#   work with the default configuration.
+
+
+# Global configuration
+#
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# NOTE!  If you intend to place this on an NFS (or otherwise network)
+# mounted filesystem then please read the Mutex documentation (available
+# at <URL:http://httpd.apache.org/docs/2.4/mod/core.html#mutex>);
+# you will save yourself a lot of trouble.
+#
+# Do NOT add a slash at the end of the directory path.
+#
+#ServerRoot "/etc/apache2"
+
+#
+# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
+#
+Mutex file:${APACHE_LOCK_DIR} default
+
+#
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+# This needs to be set in /etc/apache2/envvars
+#
+PidFile ${APACHE_PID_FILE}
+
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 5
+
+
+# These need to be set in /etc/apache2/envvars
+User ${APACHE_RUN_USER}
+Group ${APACHE_RUN_GROUP}
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog ${APACHE_LOG_DIR}/error.log
+
+#
+# LogLevel: Control the severity of messages logged to the error_log.
+# Available values: trace8, ..., trace1, debug, info, notice, warn,
+# error, crit, alert, emerg.
+# It is also possible to configure the log level for particular modules, e.g.
+# "LogLevel info ssl:warn"
+#
+LogLevel warn
+
+# Include module configuration:
+IncludeOptional mods-enabled/*.load
+IncludeOptional mods-enabled/*.conf
+
+# Include list of ports to listen on
+Include ports.conf
+
+
+# Sets the default security model of the Apache2 HTTPD server. It does
+# not allow access to the root filesystem outside of /usr/share and /var/www.
+# The former is used by web applications packaged in Debian,
+# the latter may be used for local directories served by the web server. If
+# your system is serving content from a sub-directory in /srv you must allow
+# access here, or in any related virtual host.
+<Directory />
+    Options FollowSymLinks
+    AllowOverride None
+    Require all denied
+</Directory>
+
+<Directory /usr/share>
+    AllowOverride None
+    Require all granted
+</Directory>
+
+<Directory /var/www/>
+    Options Indexes FollowSymLinks
+    AllowOverride None
+    Require all granted
+</Directory>
+
+#<Directory /srv/>
+#   Options Indexes FollowSymLinks
+#   AllowOverride None
+#   Require all granted
+#</Directory>
+
+
+
+
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives.  See also the AllowOverride
+# directive.
+#
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being
+# viewed by Web clients.
+#
+<FilesMatch "^\.ht">
+    Require all denied
+</FilesMatch>
+
+
+#
+# The following directives define some format nicknames for use with
+# a CustomLog directive.
+#
+# These deviate from the Common Log Format definitions in that they use %O
+# (the actual bytes sent including headers) instead of %b (the size of the
+# requested file), because the latter makes it impossible to detect partial
+# requests.
+#
+# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
+# Use mod_remoteip instead.
+#
+LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %O" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+
+# Include of directories ignores editors' and dpkg's backup files,
+# see README.Debian for details.
+
+# Include generic snippets of statements
+IncludeOptional conf-enabled/*.conf
+
+# Include the virtual host configurations:
+IncludeOptional sites-enabled/*.conf
+
+# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
diff --git a/puppet/modules/apache/files/config/Debian.wheezy/apache2.conf b/puppet/modules/apache/files/config/Debian.wheezy/apache2.conf
new file mode 100644
index 00000000..50545671
--- /dev/null
+++ b/puppet/modules/apache/files/config/Debian.wheezy/apache2.conf
@@ -0,0 +1,268 @@
+# This is the main Apache server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See http://httpd.apache.org/docs/2.2/ for detailed information about
+# the directives and /usr/share/doc/apache2-common/README.Debian.gz about
+# Debian specific hints.
+#
+#
+# Summary of how the Apache 2 configuration works in Debian:
+# The Apache 2 web server configuration in Debian is quite different to
+# upstream's suggested way to configure the web server. This is because Debian's
+# default Apache2 installation attempts to make adding and removing modules,
+# virtual hosts, and extra configuration directives as flexible as possible, in
+# order to make automating the changes and administering the server as easy as
+# possible.
+
+# It is split into several files forming the configuration hierarchy outlined
+# below, all located in the /etc/apache2/ directory:
+#
+#	/etc/apache2/
+#	|-- apache2.conf
+#	|	`--  ports.conf
+#	|-- mods-enabled
+#	|	|-- *.load
+#	|	`-- *.conf
+#	|-- conf.d
+#	|	`-- *
+# 	`-- sites-enabled
+#	 	`-- *
+#
+#
+# * apache2.conf is the main configuration file (this file). It puts the pieces
+#   together by including all remaining configuration files when starting up the
+#   web server.
+#
+#   In order to avoid conflicts with backup files, the Include directive is
+#   adapted to ignore files that:
+#   - do not begin with a letter or number
+#   - contain a character that is neither letter nor number nor _-:.
+#   - contain .dpkg
+#
+#   Yet we strongly suggest that all configuration files either end with a
+#   .conf or .load suffix in the file name. The next Debian release will
+#   ignore files not ending with .conf (or .load for mods-enabled).
+#
+# * ports.conf is always included from the main configuration file. It is
+#   supposed to determine listening ports for incoming connections, and which
+#   of these ports are used for name based virtual hosts.
+#
+# * Configuration files in the mods-enabled/ and sites-enabled/ directories
+#   contain particular configuration snippets which manage modules or virtual
+#   host configurations, respectively.
+#
+#   They are activated by symlinking available configuration files from their
+#   respective *-available/ counterparts. These should be managed by using our
+#   helpers a2enmod/a2dismod, a2ensite/a2dissite. See
+#   their respective man pages for detailed information.
+#
+# * Configuration files in the conf.d directory are either provided by other
+#   packages or may be added by the local administrator. Local additions
+#   should start with local- or end with .local.conf to avoid name clashes. All
+#   files in conf.d are considered (excluding the exceptions noted above) by
+#   the Apache 2 web server.
+#
+# * The binary is called apache2. Due to the use of environment variables, in
+#   the default configuration, apache2 needs to be started/stopped with
+#   /etc/init.d/apache2 or apache2ctl. Calling /usr/bin/apache2 directly will not
+#   work with the default configuration.
+
+
+# Global configuration
+#
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# NOTE!  If you intend to place this on an NFS (or otherwise network)
+# mounted filesystem then please read the LockFile documentation (available
+# at <URL:http://httpd.apache.org/docs/2.2/mod/mpm_common.html#lockfile>);
+# you will save yourself a lot of trouble.
+#
+# Do NOT add a slash at the end of the directory path.
+#
+#ServerRoot "/etc/apache2"
+
+#
+# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
+#
+LockFile ${APACHE_LOCK_DIR}/accept.lock
+
+#
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+# This needs to be set in /etc/apache2/envvars
+#
+PidFile ${APACHE_PID_FILE}
+
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 5
+
+##
+## Server-Pool Size Regulation (MPM specific)
+## 
+
+# prefork MPM
+# StartServers: number of server processes to start
+# MinSpareServers: minimum number of server processes which are kept spare
+# MaxSpareServers: maximum number of server processes which are kept spare
+# MaxClients: maximum number of server processes allowed to start
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_prefork_module>
+    StartServers          5
+    MinSpareServers       5
+    MaxSpareServers      10
+    MaxClients          150
+    MaxRequestsPerChild   0
+</IfModule>
+
+# worker MPM
+# StartServers: initial number of server processes to start
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a
+#              graceful restart. ThreadLimit can only be changed by stopping
+#              and starting Apache.
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxClients: maximum number of simultaneous client connections
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_worker_module>
+    StartServers          2
+    MinSpareThreads      25
+    MaxSpareThreads      75 
+    ThreadLimit          64
+    ThreadsPerChild      25
+    MaxClients          150
+    MaxRequestsPerChild   0
+</IfModule>
+
+# event MPM
+# StartServers: initial number of server processes to start
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxClients: maximum number of simultaneous client connections
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_event_module>
+    StartServers          2
+    MinSpareThreads      25
+    MaxSpareThreads      75 
+    ThreadLimit          64
+    ThreadsPerChild      25
+    MaxClients          150
+    MaxRequestsPerChild   0
+</IfModule>
+
+# These need to be set in /etc/apache2/envvars
+User ${APACHE_RUN_USER}
+Group ${APACHE_RUN_GROUP}
+
+#
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives.  See also the AllowOverride
+# directive.
+#
+
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being 
+# viewed by Web clients. 
+#
+<Files ~ "^\.ht">
+    Order allow,deny
+    Deny from all
+    Satisfy all
+</Files>
+
+#
+# DefaultType is the default MIME type the server will use for a document
+# if it cannot otherwise determine one, such as from filename extensions.
+# If your server contains mostly text or HTML documents, "text/plain" is
+# a good value.  If most of your content is binary, such as applications
+# or images, you may want to use "application/octet-stream" instead to
+# keep browsers from trying to display binary files as though they are
+# text.
+#
+# It is also possible to omit any default MIME type and let the
+# client's browser guess an appropriate action instead. Typically the
+# browser will decide based on the file's extension then. In cases
+# where no good assumption can be made, letting the default MIME type
+# unset is suggested  instead of forcing the browser to accept
+# incorrect  metadata.
+#
+DefaultType None
+
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog ${APACHE_LOG_DIR}/error.log
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+# Include module configuration:
+Include mods-enabled/*.load
+Include mods-enabled/*.conf
+
+# Include list of ports to listen on and which to use for name based vhosts
+Include ports.conf
+
+#
+# The following directives define some format nicknames for use with
+# a CustomLog directive (see below).
+# If you are behind a reverse proxy, you might want to change %h into %{X-Forwarded-For}i
+#
+LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %O" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+
+# Include of directories ignores editors' and dpkg's backup files,
+# see the comments above for details.
+
+# Include generic snippets of statements
+Include conf.d/
+
+# Include the virtual host configurations:
+Include sites-enabled/
diff --git a/puppet/modules/apache/files/config/Debian/apache2.conf b/puppet/modules/apache/files/config/Debian/apache2.conf
new file mode 100644
index 00000000..1e97b4eb
--- /dev/null
+++ b/puppet/modules/apache/files/config/Debian/apache2.conf
@@ -0,0 +1,230 @@
+#
+# Based upon the NCSA server configuration files originally by Rob McCool.
+#
+# This is the main Apache server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See http://httpd.apache.org/docs/2.2/ for detailed information about
+# the directives.
+#
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# The configuration directives are grouped into three basic sections:
+#  1. Directives that control the operation of the Apache server process as a
+#     whole (the 'global environment').
+#  2. Directives that define the parameters of the 'main' or 'default' server,
+#     which responds to requests that aren't handled by a virtual host.
+#     These directives also provide default values for the settings
+#     of all virtual hosts.
+#  3. Settings for virtual hosts, which allow Web requests to be sent to
+#     different IP addresses or hostnames and have them handled by the
+#     same Apache server process.
+#
+# Configuration and logfile names: If the filenames you specify for many
+# of the server's control files begin with "/" (or "drive:/" for Win32), the
+# server will use that explicit path.  If the filenames do *not* begin
+# with "/", the value of ServerRoot is prepended -- so "foo.log"
+# with ServerRoot set to "/etc/apache2" will be interpreted by the
+# server as "/etc/apache2/foo.log".
+#
+
+### Section 1: Global Environment
+#
+# The directives in this section affect the overall operation of Apache,
+# such as the number of concurrent requests it can handle or where it
+# can find its configuration files.
+#
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# NOTE!  If you intend to place this on an NFS (or otherwise network)
+# mounted filesystem then please read the LockFile documentation (available
+# at <URL:http://httpd.apache.org/docs/2.2/mod/mpm_common.html#lockfile>);
+# you will save yourself a lot of trouble.
+#
+# Do NOT add a slash at the end of the directory path.
+#
+#ServerRoot "/etc/apache2"
+
+#
+# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
+#
+LockFile ${APACHE_LOCK_DIR}/accept.lock
+
+#
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+# This needs to be set in /etc/apache2/envvars
+#
+PidFile ${APACHE_PID_FILE}
+
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 15
+
+##
+## Server-Pool Size Regulation (MPM specific)
+## 
+
+# prefork MPM
+# StartServers: number of server processes to start
+# MinSpareServers: minimum number of server processes which are kept spare
+# MaxSpareServers: maximum number of server processes which are kept spare
+# MaxClients: maximum number of server processes allowed to start
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_prefork_module>
+    StartServers          5
+    MinSpareServers       5
+    MaxSpareServers      10
+    MaxClients          150
+    MaxRequestsPerChild   0
+</IfModule>
+
+# worker MPM
+# StartServers: initial number of server processes to start
+# MaxClients: maximum number of simultaneous client connections
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a
+#              graceful restart. ThreadLimit can only be changed by stopping
+#              and starting Apache.
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_worker_module>
+    StartServers          2
+    MinSpareThreads      25
+    MaxSpareThreads      75 
+    ThreadLimit          64
+    ThreadsPerChild      25
+    MaxClients          150
+    MaxRequestsPerChild   0
+</IfModule>
+
+# event MPM
+# StartServers: initial number of server processes to start
+# MaxClients: maximum number of simultaneous client connections
+# MinSpareThreads: minimum number of worker threads which are kept spare
+# MaxSpareThreads: maximum number of worker threads which are kept spare
+# ThreadsPerChild: constant number of worker threads in each server process
+# MaxRequestsPerChild: maximum number of requests a server process serves
+<IfModule mpm_event_module>
+    StartServers          2
+    MaxClients          150
+    MinSpareThreads      25
+    MaxSpareThreads      75 
+    ThreadLimit          64
+    ThreadsPerChild      25
+    MaxRequestsPerChild   0
+</IfModule>
+
+# These need to be set in /etc/apache2/envvars
+User ${APACHE_RUN_USER}
+Group ${APACHE_RUN_GROUP}
+
+#
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives.  See also the AllowOverride
+# directive.
+#
+
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being 
+# viewed by Web clients. 
+#
+<Files ~ "^\.ht">
+    Order allow,deny
+    Deny from all
+    Satisfy all
+</Files>
+
+#
+# DefaultType is the default MIME type the server will use for a document
+# if it cannot otherwise determine one, such as from filename extensions.
+# If your server contains mostly text or HTML documents, "text/plain" is
+# a good value.  If most of your content is binary, such as applications
+# or images, you may want to use "application/octet-stream" instead to
+# keep browsers from trying to display binary files as though they are
+# text.
+#
+DefaultType text/plain
+
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog ${APACHE_LOG_DIR}/error.log
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+# Include module configuration:
+Include mods-enabled/*.load
+Include mods-enabled/*.conf
+
+# Include all the user configurations:
+Include httpd.conf
+
+# Include ports listing
+Include ports.conf
+
+#
+# The following directives define some format nicknames for use with
+# a CustomLog directive (see below).
+# If you are behind a reverse proxy, you might want to change %h into %{X-Forwarded-For}i
+#
+LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
+LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %O" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+
+# Include of directories ignores editors' and dpkg's backup files,
+# see README.Debian for details.
+
+# Include generic snippets of statements
+Include conf.d/
+
+# Include the virtual host configurations:
+Include sites-enabled/
diff --git a/puppet/modules/apache/files/config/OpenBSD/httpd.conf b/puppet/modules/apache/files/config/OpenBSD/httpd.conf
new file mode 100644
index 00000000..09e452e6
--- /dev/null
+++ b/puppet/modules/apache/files/config/OpenBSD/httpd.conf
@@ -0,0 +1,1120 @@
+#	$OpenBSD: httpd.conf,v 1.22 2008/01/25 09:59:57 sthen Exp $
+#
+# Based upon the NCSA server configuration files originally by Rob McCool.
+#
+# This is the main Apache server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See <URL:http://www.apache.org/docs/> for detailed information about
+# the directives.
+#
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# After this file is processed, the server will look for and process
+# /var/www/conf/srm.conf and then /var/www/conf/access.conf
+# unless you have overridden these with ResourceConfig and/or
+# AccessConfig directives here.
+#
+# The configuration directives are grouped into three basic sections:
+#  1. Directives that control the operation of the Apache server process as a
+#     whole (the 'global environment').
+#  2. Directives that define the parameters of the 'main' or 'default' server,
+#     which responds to requests that aren't handled by a virtual host.
+#     These directives also provide default values for the settings
+#     of all virtual hosts.
+#  3. Settings for virtual hosts, which allow Web requests to be sent to
+#     different IP addresses or hostnames and have them handled by the
+#     same Apache server process.
+#
+# Configuration and logfile names: If the filenames you specify for many
+# of the server's control files begin with "/" (or "drive:/" for Win32), the
+# server will use that explicit path.  If the filenames do *not* begin
+# with "/", the value of ServerRoot is prepended -- so "logs/foo.log"
+# with ServerRoot set to "/usr/local/apache" will be interpreted by the
+# server as "/usr/local/apache/logs/foo.log".
+#
+
+### Section 1: Global Environment
+#
+# The directives in this section affect the overall operation of Apache,
+# such as the number of concurrent requests it can handle or where it
+# can find its configuration files.
+#
+
+#
+# ServerType is either inetd, or standalone.  Inetd mode is only supported on
+# Unix platforms.
+#
+ServerType standalone
+
+#
+# ServerTokens is either Full, OS, Minimal, or ProductOnly.
+# The values define what version information is returned in the
+# Server header in HTTP responses.
+#
+# ServerTokens ProductOnly
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# NOTE!  If you intend to place this on an NFS (or otherwise network)
+# mounted filesystem then please read the LockFile documentation
+# (available at <URL:http://www.apache.org/docs/mod/core.html#lockfile>);
+# you will save yourself a lot of trouble.
+#
+# Do NOT add a slash at the end of the directory path.
+#
+ServerRoot "/var/www"
+
+#
+# The LockFile directive sets the path to the lockfile used when Apache
+# is compiled with either USE_FCNTL_SERIALIZED_ACCEPT or
+# USE_FLOCK_SERIALIZED_ACCEPT. This directive should normally be left at
+# its default value. The main reason for changing it is if the logs
+# directory is NFS mounted, since the lockfile MUST BE STORED ON A LOCAL
+# DISK. The PID of the main server process is automatically appended to
+# the filename. 
+#
+#LockFile logs/accept.lock
+
+#
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+#
+PidFile logs/httpd.pid
+#
+# ScoreBoardFile: File used to store internal server process information.
+# Not all architectures require this.  But if yours does (you'll know because
+# this file will be  created when you run Apache) then you *must* ensure that
+# no two invocations of Apache share the same scoreboard file.
+#
+ScoreBoardFile logs/apache_runtime_status
+
+#
+# In the standard configuration, the server will process httpd.conf,
+# srm.conf, and access.conf in that order.  The latter two files are
+# now deprecated and not installed any more, as it is recommended that 
+# all directives be kept in a single file for simplicity.  
+#
+#ResourceConfig conf/srm.conf
+#AccessConfig conf/access.conf
+
+#
+# Timeout: The number of seconds before receives and sends time out.
+#
+Timeout 300
+
+#
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+#
+KeepAlive On
+
+#
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+#
+MaxKeepAliveRequests 100
+
+#
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+#
+KeepAliveTimeout 15
+
+#
+# Server-pool size regulation.  Rather than making you guess how many
+# server processes you need, Apache dynamically adapts to the load it
+# sees --- that is, it tries to maintain enough server processes to
+# handle the current load, plus a few spare servers to handle transient
+# load spikes (e.g., multiple simultaneous requests from a single
+# Netscape browser).
+#
+# It does this by periodically checking how many servers are waiting
+# for a request.  If there are fewer than MinSpareServers, it creates
+# a new spare.  If there are more than MaxSpareServers, some of the
+# spares die off.  The default values in httpd.conf-dist are probably OK
+# for most sites.
+#
+MinSpareServers 5
+MaxSpareServers 10
+
+#
+# Number of servers to start initially --- should be a reasonable ballpark
+# figure.
+#
+StartServers 5
+
+#
+# Limit on total number of servers running, i.e., limit on the number
+# of clients who can simultaneously connect --- if this limit is ever
+# reached, clients will be LOCKED OUT, so it should NOT BE SET TOO LOW.
+# It is intended mainly as a brake to keep a runaway server from taking
+# the system with it as it spirals down...
+#
+MaxClients 150
+
+#
+# MaxRequestsPerChild: the number of requests each child process is
+# allowed to process before the child dies.  The child will exit so
+# as to avoid problems after prolonged use when Apache (and maybe the
+# libraries it uses) leak memory or other resources.  On most systems, this
+# isn't really needed, but a few (such as Solaris) do have notable leaks
+# in the libraries.
+#
+MaxRequestsPerChild 0
+
+#
+# MaxFOOPerChild: these directives set the current and hard rlimits for
+# the child processes. Attempts to exceed them will cause the the OS to
+# take appropriate action. See the setrlimit(2) and signal(3).
+#
+MaxCPUPerChild 0
+MaxDATAPerChild 0
+MaxNOFILEPerChild 0
+MaxRSSPerChild 0
+MaxSTACKPerChild 0
+
+#
+# Listen: Allows you to bind Apache to specific IP addresses and/or
+# ports, in addition to the default. See also the <VirtualHost>
+# directive.
+#
+#Listen 3000
+#Listen 12.34.56.78:80
+
+#
+# BindAddress: You can support virtual hosts with this option. This directive
+# is used to tell the server which IP address to listen to. It can either
+# contain "*", an IP address, or a fully qualified Internet domain name.
+# See also the <VirtualHost> and Listen directives.
+#
+#BindAddress *
+
+#
+# Dynamic Shared Object (DSO) Support
+#
+# To be able to use the functionality of a module which was built as a DSO you
+# have to place corresponding `LoadModule' lines at this location so the
+# directives contained in it are actually available _before_ they are used.
+# Please read the file README.DSO in the Apache 1.3 distribution for more
+# details about the DSO mechanism and run `httpd -l' for the list of already
+# built-in (statically linked and thus always available) modules in your httpd
+# binary.
+#
+# Note: The order is which modules are loaded is important.  Don't change
+# the order below without expert advice.
+#
+# Example:
+# LoadModule foo_module libexec/mod_foo.so
+
+# "anonymous" user access to authenticated areas
+# LoadModule anon_auth_module	/usr/lib/apache/modules/mod_auth_anon.so
+
+# user authentication using Berkeley DB files
+# LoadModule db_auth_module	/usr/lib/apache/modules/mod_auth_db.so
+
+# user authentication using DBM files
+# LoadModule dbm_auth_module	/usr/lib/apache/modules/mod_auth_dbm.so
+
+# authentication using new-style MD5 Digest Authentication (experimental)
+# LoadModule digest_auth_module	/usr/lib/apache/modules/mod_auth_digest.so
+
+# CERN httpd metafile semantics
+# LoadModule cern_meta_module	/usr/lib/apache/modules/mod_cern_meta.so
+
+# configuration defines ($xxx)
+# LoadModule define_module	/usr/lib/apache/modules/mod_define.so
+
+# user authentication using old-style MD5 Digest Authentication
+# LoadModule digest_module	/usr/lib/apache/modules/mod_digest.so
+
+# generation of Expires HTTP headers according to user-specified criteria
+# LoadModule expires_module	/usr/lib/apache/modules/mod_expires.so
+
+# customization of HTTP response headers
+# LoadModule headers_module	/usr/lib/apache/modules/mod_headers.so
+
+# comprehensive overview of the server configuration
+# LoadModule info_module		/usr/lib/apache/modules/mod_info.so
+
+# logging of the client user agents (deprecated in favor of mod_log_config)
+# LoadModule agent_log_module	/usr/lib/apache/modules/mod_log_agent.so
+
+# logging of referers (deprecated in favor of mod_log_config)
+# LoadModule referer_log_module	/usr/lib/apache/modules/mod_log_referer.so
+
+# determining the MIME type of a file by looking at a few bytes of its contents
+# LoadModule mime_magic_module	/usr/lib/apache/modules/mod_mime_magic.so
+
+# mmap()ing of a statically configured list of frequently requested but 
+# not changed files (experimental)
+# LoadModule mmap_static_module	/usr/lib/apache/modules/mod_mmap_static.so
+
+# rule-based rewriting engine to rewrite requested URLs on the fly
+# LoadModule rewrite_module	/usr/lib/apache/modules/mod_rewrite.so
+
+# attempt to correct misspellings of URLs that users might have entered
+# LoadModule speling_module	/usr/lib/apache/modules/mod_speling.so
+
+# provides an environment variable with a unique identifier for each request
+# LoadModule unique_id_module	/usr/lib/apache/modules/mod_unique_id.so
+
+# uses cookies to provide for a clickstream log of user activity on a site
+# LoadModule usertrack_module	/usr/lib/apache/modules/mod_usertrack.so
+
+# dynamically configured mass virtual hosting
+# LoadModule vhost_alias_module	/usr/lib/apache/modules/mod_vhost_alias.so
+
+# caching proxy
+# LoadModule proxy_module	/usr/lib/apache/modules/libproxy.so
+
+#
+# Include extra module configuration files
+#
+Include /var/www/conf/modules/*.conf
+
+#
+# ExtendedStatus controls whether Apache will generate "full" status
+# information (ExtendedStatus On) or just basic information (ExtendedStatus
+# Off) when the "server-status" handler is called. The default is Off.
+#
+#ExtendedStatus On
+
+### Section 2: 'Main' server configuration
+#
+# The directives in this section set up the values used by the 'main'
+# server, which responds to any requests that aren't handled by a
+# <VirtualHost> definition.  These values also provide defaults for
+# any <VirtualHost> containers you may define later in the file.
+#
+# All of these directives may appear inside <VirtualHost> containers,
+# in which case these default settings will be overridden for the
+# virtual host being defined.
+#
+
+#
+# If your ServerType directive (set earlier in the 'Global Environment'
+# section) is set to "inetd", the next few directives don't have any
+# effect since their settings are defined by the inetd configuration.
+# Skip ahead to the ServerAdmin directive.
+#
+
+#
+# Port: The port to which the standalone server listens. For
+# ports < 1023, you will need httpd to be run as root initially.
+#
+Port 80
+
+##
+##  SSL Support
+##
+##  When we also provide SSL we have to listen to the 
+##  standard HTTP port (see above) and to the HTTPS port
+##
+<IfDefine SSL>
+Listen 80
+Listen 443
+</IfDefine>
+
+#
+# If you wish httpd to run as a different user or group, you must run
+# httpd as root initially and it will switch.  
+#
+# User/Group: The name (or #number) of the user/group to run httpd as.
+#  . On SCO (ODT 3) use "User nouser" and "Group nogroup".
+#  . On HPUX you may not be able to use shared memory as nobody, and the
+#    suggested workaround is to create a user www and use that user.
+#  NOTE that some kernels refuse to setgid(Group) or semctl(IPC_SET)
+#  when the value of (unsigned)Group is above 60000; 
+#  don't use Group #-1 on these systems!
+#  On OpenBSD, use user www, group www.
+#
+User www
+Group www
+
+#
+# ServerAdmin: Your address, where problems with the server should be
+# e-mailed.  This address appears on some server-generated pages, such
+# as error documents.
+#
+ServerAdmin you@your.address
+
+#
+# ServerName allows you to set a host name which is sent back to clients for
+# your server if it's different than the one the program would get (i.e., use
+# "www" instead of the host's real name).
+#
+# Note: You cannot just invent host names and hope they work. The name you 
+# define here must be a valid DNS name for your host. If you don't understand
+# this, ask your network administrator.
+# If your host doesn't have a registered DNS name, enter its IP address here.
+# You will have to access it by its address (e.g., http://123.45.67.89/)
+# anyway, and this will make redirections work in a sensible way.
+#
+#ServerName new.host.name
+
+#
+# DocumentRoot: The directory out of which you will serve your
+# documents. By default, all requests are taken from this directory, but
+# symbolic links and aliases may be used to point to other locations.
+#
+DocumentRoot "/var/www/htdocs"
+
+#
+# Each directory to which Apache has access, can be configured with respect
+# to which services and features are allowed and/or disabled in that
+# directory (and its subdirectories). 
+#
+# First, we configure the "default" to be a very restrictive set of 
+# permissions.  
+#
+<Directory />
+    Options FollowSymLinks
+    AllowOverride None
+</Directory>
+
+#
+# Note that from this point forward you must specifically allow
+# particular features to be enabled - so if something's not working as
+# you might expect, make sure that you have specifically enabled it
+# below.
+#
+
+#
+# This should be changed to whatever you set DocumentRoot to.
+#
+<Directory "/var/www/htdocs">
+
+#
+# This may also be "None", "All", or any combination of "Indexes",
+# "Includes", "FollowSymLinks", "ExecCGI", or "MultiViews".
+#
+# Note that "MultiViews" must be named *explicitly* --- "Options All"
+# doesn't give it to you.
+#
+    Options Indexes FollowSymLinks
+
+#
+# This controls which options the .htaccess files in directories can
+# override. Can also be "All", or any combination of "Options", "FileInfo", 
+# "AuthConfig", and "Limit"
+#
+    AllowOverride None
+
+#
+# Controls who can get stuff from this server.
+#
+    Order allow,deny
+    Allow from all
+</Directory>
+
+#
+# UserDir: The directory which is prepended onto a users username, within 
+# which a users's web pages are looked for if a ~user request is received. 
+# Relative pathes are relative to the user's home directory.
+#
+# "disabled" turns this feature off.
+#
+# Since httpd will chroot(2) to the ServerRoot path by default,
+# you should use
+#	UserDir /var/www/users
+# and create per user directories in /var/www/users/<username>
+#
+
+UserDir disabled
+
+#
+# Control access to UserDir directories.  The following is an example
+# for a site where these directories are restricted to read-only and
+# are located under /users/<username>
+# You will need to change this to match your site's home directories.
+#
+#<Directory /users/*>
+#    AllowOverride FileInfo AuthConfig Limit
+#    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+#    <Limit GET POST OPTIONS PROPFIND>
+#        Order allow,deny
+#        Allow from all
+#    </Limit>
+#    <Limit PUT DELETE PATCH PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
+#        Order deny,allow
+#        Deny from all
+#    </Limit>
+#</Directory>
+
+#
+# DirectoryIndex: Name of the file or files to use as a pre-written HTML
+# directory index.  Separate multiple entries with spaces.
+#
+DirectoryIndex index.html
+
+#
+# AccessFileName: The name of the file to look for in each directory
+# for access control information.
+#
+AccessFileName .htaccess
+
+#
+# The following lines prevent .htaccess files from being viewed by
+# Web clients.  Since .htaccess files often contain authorization
+# information, access is disallowed for security reasons.  Comment
+# these lines out if you want Web visitors to see the contents of
+# .htaccess files.  If you change the AccessFileName directive above,
+# be sure to make the corresponding changes here.
+#
+<Files .htaccess>
+    Order allow,deny
+    Deny from all
+</Files>
+
+#
+# CacheNegotiatedDocs: By default, Apache sends "Pragma: no-cache" with each
+# document that was negotiated on the basis of content. This asks proxy
+# servers not to cache the document. Uncommenting the following line disables
+# this behavior, and proxies will be allowed to cache the documents.
+#
+#CacheNegotiatedDocs
+
+#
+# UseCanonicalName:  (new for 1.3)  With this setting turned on, whenever
+# Apache needs to construct a self-referencing URL (a URL that refers back
+# to the server the response is coming from) it will use ServerName and
+# Port to form a "canonical" name.  With this setting off, Apache will
+# use the hostname:port that the client supplied, when possible.  This
+# also affects SERVER_NAME and SERVER_PORT in CGI scripts.
+#
+UseCanonicalName On
+
+#
+# TypesConfig describes where the mime.types file (or equivalent) is
+# to be found.
+#
+TypesConfig conf/mime.types
+
+#
+# DefaultType is the default MIME type the server will use for a document
+# if it cannot otherwise determine one, such as from filename extensions.
+# If your server contains mostly text or HTML documents, "text/plain" is
+# a good value.  If most of your content is binary, such as applications
+# or images, you may want to use "application/octet-stream" instead to
+# keep browsers from trying to display binary files as though they are
+# text.
+#
+DefaultType text/plain
+
+#
+# The mod_mime_magic module allows the server to use various hints from the
+# contents of the file itself to determine its type.  The MIMEMagicFile
+# directive tells the module where the hint definitions are located.
+# mod_mime_magic is not part of the default server (you have to add
+# it yourself with a LoadModule [see the DSO paragraph in the 'Global
+# Environment' section], or recompile the server and include mod_mime_magic
+# as part of the configuration), so it's enclosed in an <IfModule> container.
+# This means that the MIMEMagicFile directive will only be processed if the
+# module is part of the server.
+#
+<IfModule mod_mime_magic.c>
+    MIMEMagicFile conf/magic
+</IfModule>
+
+#
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+#
+HostnameLookups Off
+
+#
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+# Either a filename or the text "syslog:" followed by a facility
+# name may be specified here.
+#
+#ErrorLog syslog:daemon
+ErrorLog logs/error_log
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+#
+# The following directives define some format nicknames for use with
+# a CustomLog directive (see below).
+#
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %b" common
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-agent}i" agent
+
+#
+# The location and format of the access logfile (Common Logfile Format).
+# If you do not define any access logfiles within a <VirtualHost>
+# container, they will be logged here.  Contrariwise, if you *do*
+# define per-<VirtualHost> access logfiles, transactions will be
+# logged therein and *not* in this file.
+#
+CustomLog logs/access_log common
+
+#
+# If you would like to have agent and referer logfiles, uncomment the
+# following directives.
+#
+#CustomLog logs/referer_log referer
+#CustomLog logs/agent_log agent
+
+#
+# If you prefer a single logfile with access, agent, and referer information
+# (Combined Logfile Format) you can use the following directive.
+#
+#CustomLog logs/access_log combined
+
+#
+# Optionally add a line containing the server version and virtual host
+# name to server-generated pages (error documents, FTP directory listings,
+# mod_status and mod_info output etc., but not CGI generated documents).
+# Set to "EMail" to also include a mailto: link to the ServerAdmin.
+# Set to one of:  On | Off | EMail
+#
+# ServerSignature Off
+
+#
+# Aliases: Add here as many aliases as you need (with no limit). The format is 
+# Alias fakename realname
+#
+# Note that if you include a trailing / on fakename then the server will
+# require it to be present in the URL.  So "/icons" isn't aliased in this
+# example, only "/icons/"..
+#
+Alias /icons/ "/var/www/icons/"
+
+<Directory "/var/www/icons">
+    Options Indexes MultiViews
+    AllowOverride None
+    Order allow,deny
+    Allow from all
+</Directory>
+
+<Directory "/var/www/htdocs/manual">
+    Options MultiViews
+    AllowOverride None
+    Order allow,deny
+    Allow from all
+</Directory>
+
+#
+# ScriptAlias: This controls which directories contain server scripts.
+# ScriptAliases are essentially the same as Aliases, except that
+# documents in the realname directory are treated as applications and
+# run by the server when requested rather than as documents sent to the client.
+# The same rules about trailing "/" apply to ScriptAlias directives as to
+# Alias.
+#
+ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
+
+#
+# "/var/www/cgi-bin" should be changed to whatever your ScriptAliased
+# CGI directory exists, if you have that configured.
+#
+<Directory "/var/www/cgi-bin">
+    AllowOverride None
+    Options None
+    Order allow,deny
+    Allow from all
+</Directory>
+
+#
+# Redirect allows you to tell clients about documents which used to exist in
+# your server's namespace, but do not anymore. This allows you to tell the
+# clients where to look for the relocated document.
+# Format: Redirect old-URI new-URL
+#
+
+#
+# Directives controlling the display of server-generated directory listings.
+#
+
+#
+# FancyIndexing is whether you want fancy directory indexing or standard
+#
+IndexOptions FancyIndexing
+
+#
+# AddIcon* directives tell the server which icon to show for different
+# files or filename extensions.  These are only displayed for
+# FancyIndexed directories.
+#
+AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
+
+AddIconByType (TXT,/icons/text.gif) text/*
+AddIconByType (IMG,/icons/image2.gif) image/*
+AddIconByType (SND,/icons/sound2.gif) audio/*
+AddIconByType (VID,/icons/movie.gif) video/*
+
+AddIcon /icons/binary.gif .bin .exe
+AddIcon /icons/binhex.gif .hqx
+AddIcon /icons/tar.gif .tar
+AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
+AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
+AddIcon /icons/a.gif .ps .ai .eps
+AddIcon /icons/layout.gif .html .shtml .htm .pdf
+AddIcon /icons/text.gif .txt
+AddIcon /icons/c.gif .c
+AddIcon /icons/p.gif .pl .py
+AddIcon /icons/f.gif .for
+AddIcon /icons/dvi.gif .dvi
+AddIcon /icons/uuencoded.gif .uu
+AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+AddIcon /icons/tex.gif .tex
+AddIcon /icons/bomb.gif core
+
+AddIcon /icons/back.gif ..
+AddIcon /icons/hand.right.gif README
+AddIcon /icons/folder.gif ^^DIRECTORY^^
+AddIcon /icons/blank.gif ^^BLANKICON^^
+
+#
+# DefaultIcon is which icon to show for files which do not have an icon
+# explicitly set.
+#
+DefaultIcon /icons/unknown.gif
+
+#
+# AddDescription allows you to place a short description after a file in
+# server-generated indexes.  These are only displayed for FancyIndexed
+# directories.
+# Format: AddDescription "description" filename
+#
+#AddDescription "GZIP compressed document" .gz
+#AddDescription "tar archive" .tar
+#AddDescription "GZIP compressed tar archive" .tgz
+
+#
+# ReadmeName is the name of the README file the server will look for by
+# default, and append to directory listings.
+#
+# HeaderName is the name of a file which should be prepended to
+# directory indexes. 
+#
+# The server will first look for name.html and include it if found.
+# If name.html doesn't exist, the server will then look for name.txt
+# and include it as plaintext if found.
+#
+ReadmeName README
+HeaderName HEADER
+
+#
+# IndexIgnore is a set of filenames which directory indexing should ignore
+# and not include in the listing.  Shell-style wildcarding is permitted.
+#
+IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
+
+#
+# AddEncoding allows you to have certain browsers (Mosaic/X 2.1+) uncompress
+# information on the fly. Note: Not all browsers support this.
+# Despite the name similarity, the following Add* directives have nothing
+# to do with the FancyIndexing customization directives above.
+#
+AddEncoding x-compress Z
+AddEncoding x-gzip gz
+
+#
+# AddLanguage allows you to specify the language of a document. You can
+# then use content negotiation to give a browser a file in a language
+# it can understand.  Note that the suffix does not have to be the same
+# as the language keyword --- those with documents in Polish (whose
+# net-standard language code is pl) may wish to use "AddLanguage pl .po" 
+# to avoid the ambiguity with the common suffix for perl scripts.
+#
+AddLanguage en .en
+AddLanguage fr .fr
+AddLanguage de .de
+AddLanguage da .da
+AddLanguage el .el
+AddLanguage it .it
+
+#
+# LanguagePriority allows you to give precedence to some languages
+# in case of a tie during content negotiation.
+# Just list the languages in decreasing order of preference.
+#
+LanguagePriority en fr de
+
+#
+# AddType allows you to tweak mime.types without actually editing it, or to
+# make certain files to be certain types.
+#
+# For example, the PHP module (not part of the Apache distribution)
+# will typically use:
+#
+#AddType application/x-httpd-php .php
+
+#
+# AddHandler allows you to map certain file extensions to "handlers",
+# actions unrelated to filetype. These can be either built into the server
+# or added with the Action command (see below)
+#
+# If you want to use server side includes, or CGI outside
+# ScriptAliased directories, uncomment the following lines.
+#
+# To use CGI scripts:
+#
+#AddHandler cgi-script .cgi
+
+#
+# To use server-parsed HTML files
+#
+#AddType text/html .shtml
+#AddHandler server-parsed .shtml
+
+#
+# Uncomment the following line to enable Apache's send-asis HTTP file
+# feature
+#
+#AddHandler send-as-is asis
+
+#
+# If you wish to use server-parsed imagemap files, use
+#
+#AddHandler imap-file map
+
+#
+# To enable type maps, you might want to use
+#
+#AddHandler type-map var
+
+#
+# Action lets you define media types that will execute a script whenever
+# a matching file is called. This eliminates the need for repeated URL
+# pathnames for oft-used CGI file processors.
+# Format: Action media/type /cgi-script/location
+# Format: Action handler-name /cgi-script/location
+#
+
+#
+# MetaDir: specifies the name of the directory in which Apache can find
+# meta information files. These files contain additional HTTP headers
+# to include when sending the document
+#
+#MetaDir .web
+
+#
+# MetaSuffix: specifies the file name suffix for the file containing the
+# meta information.
+#
+#MetaSuffix .meta
+
+#
+# Customizable error response (Apache style)
+#  these come in three flavors
+#
+#    1) plain text
+#ErrorDocument 500 "The server made a boo boo.
+#  n.b.  the (") marks it as text, it does not get output
+#
+#    2) local redirects
+#ErrorDocument 404 /missing.html
+#  to redirect to local URL /missing.html
+#ErrorDocument 404 /cgi-bin/missing_handler.pl
+#  N.B.: You can redirect to a script or a document using server-side-includes.
+#
+#    3) external redirects
+#ErrorDocument 402 http://some.other_server.com/subscription_info.html
+#  N.B.: Many of the environment variables associated with the original
+#  request will *not* be available to such a script.
+
+#
+# The following directives modify normal HTTP response behavior.
+# The first directive disables keepalive for Netscape 2.x and browsers that
+# spoof it. There are known problems with these browser implementations.
+# The second directive is for Microsoft Internet Explorer 4.0b2
+# which has a broken HTTP/1.1 implementation and does not properly
+# support keepalive when it is used on 301 or 302 (redirect) responses.
+#
+BrowserMatch "Mozilla/2" nokeepalive
+BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
+
+#
+# The following directive disables HTTP/1.1 responses to browsers which
+# are in violation of the HTTP/1.0 spec by not being able to grok a
+# basic 1.1 response.
+#
+BrowserMatch "RealPlayer 4\.0" force-response-1.0
+BrowserMatch "Java/1\.0" force-response-1.0
+BrowserMatch "JDK/1\.0" force-response-1.0
+
+#
+# Allow server status reports, with the URL of http://servername/server-status
+# Change the ".your_domain.com" to match your domain to enable.
+#
+#<Location /server-status>
+#    SetHandler server-status
+#    Order deny,allow
+#    Deny from all
+#    Allow from .your_domain.com
+#</Location>
+
+#
+# Allow remote server configuration reports, with the URL of
+#  http://servername/server-info (requires that mod_info.c be loaded).
+# Change the ".your_domain.com" to match your domain to enable.
+#
+#<Location /server-info>
+#    SetHandler server-info
+#    Order deny,allow
+#    Deny from all
+#    Allow from .your_domain.com
+#</Location>
+
+#
+# There have been reports of people trying to abuse an old bug from pre-1.1
+# days.  This bug involved a CGI script distributed as a part of Apache.
+# By uncommenting these lines you can redirect these attacks to a logging 
+# script on phf.apache.org.  Or, you can record them yourself, using the script
+# support/phf_abuse_log.cgi.
+#
+#<Location /cgi-bin/phf*>
+#    Deny from all
+#    ErrorDocument 403 http://phf.apache.org/phf_abuse_log.cgi
+#</Location>
+
+#
+# Proxy Server directives. Uncomment the following lines to
+# enable the proxy server:
+#
+#<IfModule mod_proxy.c>
+#ProxyRequests On
+#
+#<Directory proxy:*>
+#    Order deny,allow
+#    Deny from all
+#    Allow from .your_domain.com
+#</Directory>
+
+#
+# Enable/disable the handling of HTTP/1.1 "Via:" headers.
+# ("Full" adds the server version; "Block" removes all outgoing Via: headers)
+# Set to one of: Off | On | Full | Block
+#
+#ProxyVia On
+
+#
+# To enable the cache as well, edit and uncomment the following lines:
+# (no cacheing without CacheRoot)
+#
+#CacheRoot "/var/www/proxy"
+#CacheSize 5
+#CacheGcInterval 4
+#CacheMaxExpire 24
+#CacheLastModifiedFactor 0.1
+#CacheDefaultExpire 1
+#NoCache a_domain.com another_domain.edu joes.garage_sale.com
+
+#</IfModule>
+# End of proxy directives.
+
+### Section 3: Virtual Hosts
+#
+# VirtualHost: If you want to maintain multiple domains/hostnames on your
+# machine you can setup VirtualHost containers for them.
+# Please see the documentation at <URL:http://www.apache.org/docs/vhosts/>
+# for further details before you try to setup virtual hosts.
+# You may use the command line option '-S' to verify your virtual host
+# configuration.
+
+#
+# If you want to use name-based virtual hosts you need to define at
+# least one IP address (and port number) for them.
+#
+#NameVirtualHost 12.34.56.78:80
+#NameVirtualHost 12.34.56.78
+
+#
+# VirtualHost example:
+# Almost any Apache directive may go into a VirtualHost container.
+#
+#<VirtualHost ip.address.of.host.some_domain.com>
+#    ServerAdmin webmaster@host.some_domain.com
+#    DocumentRoot /www/docs/host.some_domain.com
+#    ServerName host.some_domain.com
+#    ErrorLog logs/host.some_domain.com-error_log
+#    CustomLog logs/host.some_domain.com-access_log common
+#</VirtualHost>
+
+#<VirtualHost _default_:*>
+#</VirtualHost>
+
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#
+#   Some MIME-types for downloading Certificates and CRLs
+#
+<IfDefine SSL>
+AddType application/x-x509-ca-cert .crt
+AddType application/x-pkcs7-crl    .crl
+</IfDefine>
+
+<IfModule mod_ssl.c>
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is a internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+SSLPassPhraseDialog  builtin
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First either `none'
+#   or `dbm:/path/to/file' for the mechanism to use and
+#   second the expiring timeout (in seconds).
+SSLSessionCache         dbm:logs/ssl_scache
+SSLSessionCacheTimeout  300
+
+#   Semaphore:
+#   Configure the path to the mutual exclusion semaphore the
+#   SSL engine uses internally for inter-process synchronization. 
+SSLMutex  sem
+
+#   Pseudo Random Number Generator (PRNG):
+#   Configure one or more sources to seed the PRNG of the 
+#   SSL library. The seed data should be of good random quality.
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed startup file:/dev/urandom 512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+SSLRandomSeed startup file:/dev/arandom  512
+
+#   Logging:
+#   The home of the dedicated SSL protocol logfile. Errors are
+#   additionally duplicated in the general error log file.  Put
+#   this somewhere where it cannot be used for symlink attacks on
+#   a real server (i.e. somewhere where only root can write).
+#   Log levels are (ascending order: higher ones include lower ones):
+#   none, error, warn, info, trace, debug.
+SSLLog      logs/ssl_engine_log
+SSLLogLevel info
+
+</IfModule>
+
+<IfDefine SSL>
+
+##
+## SSL Virtual Host Context
+##
+
+<VirtualHost _default_:443>
+
+#  General setup for the virtual host
+DocumentRoot /var/www/htdocs
+ServerName new.host.name
+ServerAdmin you@your.address
+ErrorLog logs/error_log
+TransferLog logs/access_log
+
+#   SSL Engine Switch:
+#   Enable/Disable SSL for this virtual host.
+SSLEngine on
+
+#   SSL Cipher Suite:
+#   List the ciphers that the client is permitted to negotiate.
+#   See the mod_ssl documentation for a complete list.
+#SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
+
+#   Server Certificate:
+#   Point SSLCertificateFile at a PEM encoded certificate.  If
+#   the certificate is encrypted, then you will be prompted for a
+#   pass phrase.  Note that a kill -HUP will prompt again. A test
+#   certificate can be generated with `make certificate' under
+#   built time.
+SSLCertificateFile    /etc/ssl/server.crt
+
+#   Server Private Key:
+#   If the key is not combined with the certificate, use this
+#   directive to point at the key file.
+SSLCertificateKeyFile /etc/ssl/private/server.key
+
+#   Certificate Authority (CA):
+#   Set the CA certificate verification path where to find CA
+#   certificates for client authentication or alternatively one
+#   huge file containing all of them (file must be PEM encoded)
+#   Note: Inside SSLCACertificatePath you need hash symlinks
+#         to point to the certificate files. Use the provided
+#         Makefile to update the hash symlinks after changes.
+#SSLCACertificatePath    /var/www/conf/ssl.crt
+#SSLCACertificateFile    /var/www/conf/ssl.crt/ca-bundle.crt
+
+#   Client Authentication (Type):
+#   Client certificate verification type and depth.  Types are
+#   none, optional, require and optional_no_ca.  Depth is a
+#   number which specifies how deeply to verify the certificate
+#   issuer chain before deciding the certificate is not valid.
+#SSLVerifyClient require
+#SSLVerifyDepth  10
+
+#   Access Control:
+#   With SSLRequire you can do per-directory access control based
+#   on arbitrary complex boolean expressions containing server
+#   variable checks and other lookup directives.  The syntax is a
+#   mixture between C and Perl.  See the mod_ssl documentation
+#   for more details.
+#<Location />
+#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
+#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
+#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+#</Location>
+
+#   SSL Engine Options:
+#   Set various options for the SSL engine.
+#   FakeBasicAuth:
+#     Translate the client X.509 into a Basic Authorisation.  This means that
+#     the standard Auth/DBMAuth methods can be used for access control.  The
+#     user name is the `one line' version of the client's X.509 certificate.
+#     Note that no password is obtained from the user. Every entry in the user
+#     file needs this password: `xxj31ZMTZzkVA'.
+#   ExportCertData:
+#     This exports two additional environment variables: SSL_CLIENT_CERT and
+#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+#     server (always existing) and the client (only existing when client
+#     authentication is used). This can be used to import the certificates
+#     into CGI scripts.
+#   CompatEnvVars:
+#     This exports obsolete environment variables for backward compatibility
+#     to Apache-SSL 1.x, mod_ssl 2.0.x, Sioux 1.0 and Stronghold 2.x. Use this
+#     to provide compatibility to existing CGI scripts.
+#SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars
+
+#   Per-Server Logging:
+#   The home of a custom SSL log file. Use this when you want a
+#   compact non-error SSL logfile on a virtual host basis.
+CustomLog logs/ssl_request_log \
+          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
+
+</VirtualHost>                                  
+
+</IfDefine>
+
+# include additional things
+Include conf.d/*.conf
+Include vhosts.d/*.conf
diff --git a/puppet/modules/apache/files/include.d/defaults.inc b/puppet/modules/apache/files/include.d/defaults.inc
new file mode 100644
index 00000000..3e5e7d73
--- /dev/null
+++ b/puppet/modules/apache/files/include.d/defaults.inc
@@ -0,0 +1,5 @@
+RewriteEngine on
+RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
+RewriteRule .* - [F]
+
+ServerSignature Off
diff --git a/puppet/modules/apache/files/include.d/joomla.inc b/puppet/modules/apache/files/include.d/joomla.inc
new file mode 100644
index 00000000..1535ce37
--- /dev/null
+++ b/puppet/modules/apache/files/include.d/joomla.inc
@@ -0,0 +1,30 @@
+########## Begin - Rewrite rules to block out some common exploits
+#          against joomla's
+#                             
+# Block out any script trying to set a mosConfig value through the URL
+RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|\%3D) [OR]
+
+# Block out any script trying to base64_encode crap to send via URL
+RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
+
+# Block out any script that includes a <script> tag in URL
+RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
+
+# Block out any script trying to set a PHP GLOBALS variable via URL
+RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
+
+# Block out any script trying to modify a _REQUEST variable via URL
+RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
+
+# Block out any script that tries to set CONFIG_EXT (com_extcal2 issue)
+RewriteCond %{QUERY_STRING} CONFIG_EXT(\[|\%20|\%5B).*= [NC,OR]
+
+# Block out any script that tries to set sbp or sb_authorname via URL (simpleboard) 
+RewriteCond %{QUERY_STRING} sbp(=|\%20|\%3D) [OR]
+RewriteCond %{QUERY_STRING} sb_authorname(=|\%20|\%3D)
+
+# Send all blocked request to homepage with 403 Forbidden error!
+RewriteRule ^(.*)$ index.php [F,L]
+#
+########## End - Rewrite rules to block out some common exploits
+
diff --git a/puppet/modules/apache/files/include.d/silverstripe.inc b/puppet/modules/apache/files/include.d/silverstripe.inc
new file mode 100644
index 00000000..40c44e46
--- /dev/null
+++ b/puppet/modules/apache/files/include.d/silverstripe.inc
@@ -0,0 +1,17 @@
+# silverstripe .htaccess
+<Files *.ss>
+  Order deny,allow
+  Deny from all
+  #Allow from 127.0.0.1
+</Files>
+
+<IfModule mod_rewrite.c>
+  RewriteEngine On
+  #RewriteBase /
+
+  RewriteCond %{REQUEST_URI} !(\.gif$)|(\.jpg$)|(\.png$)|(\.css$)|(\.js$)
+
+  RewriteCond %{REQUEST_URI} ^(.*)$
+  RewriteCond %{REQUEST_FILENAME} !-f
+  RewriteRule .* sapphire/main.php?url=%1&%{QUERY_STRING} [L]
+</IfModule>
diff --git a/puppet/modules/apache/files/itk_plus/conf.d/CentOS/ssl.conf b/puppet/modules/apache/files/itk_plus/conf.d/CentOS/ssl.conf
new file mode 100644
index 00000000..fb0c915a
--- /dev/null
+++ b/puppet/modules/apache/files/itk_plus/conf.d/CentOS/ssl.conf
@@ -0,0 +1,75 @@
+#
+# This is the Apache server configuration file providing SSL support.
+# It contains the configuration directives to instruct the server how to
+# serve pages over an https connection. For detailing information about these 
+# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
+# 
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+
+LoadModule ssl_module modules/mod_ssl.so
+
+#
+# When we also provide SSL we have to listen to the 
+# the HTTPS port in addition.
+#
+NameVirtualHost *:443
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#
+#   Some MIME-types for downloading Certificates and CRLs
+#
+AddType application/x-x509-ca-cert .crt
+AddType application/x-pkcs7-crl    .crl
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is a internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+SSLPassPhraseDialog  builtin
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First the mechanism 
+#   to use and second the expiring timeout (in seconds).
+#SSLSessionCache        dc:UNIX:/var/cache/mod_ssl/distcache
+SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
+SSLSessionCacheTimeout  300
+
+#   Semaphore:
+#   Configure the path to the mutual exclusion semaphore the
+#   SSL engine uses internally for inter-process synchronization. 
+SSLMutex default
+
+#   Pseudo Random Number Generator (PRNG):
+#   Configure one or more sources to seed the PRNG of the 
+#   SSL library. The seed data should be of good random quality.
+#   WARNING! On some platforms /dev/random blocks if not enough entropy
+#   is available. This means you then cannot use the /dev/random device
+#   because it would lead to very long connection times (as long as
+#   it requires to make more entropy available). But usually those
+#   platforms additionally provide a /dev/urandom device which doesn't
+#   block. So, if available, use this one instead. Read the mod_ssl User
+#   Manual for more details.
+SSLRandomSeed startup file:/dev/urandom  256
+SSLRandomSeed connect builtin
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+
+#
+# Use "SSLCryptoDevice" to enable any supported hardware
+# accelerators. Use "openssl engine -v" to list supported
+# engine names.  NOTE: If you enable an accelerator and the
+# server does not start, consult the error logs and ensure
+# your accelerator is functioning properly. 
+#
+SSLCryptoDevice builtin
+#SSLCryptoDevice ubsec
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_default_settings.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_default_settings.conf
new file mode 100644
index 00000000..5315fcb7
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_default_settings.conf
@@ -0,0 +1,105 @@
+# This configuration file reflects default settings for Apache HTTP Server.
+# You may change these, but chances are that you may not need to.
+
+# Timeout: The number of seconds before receives and sends time out.
+Timeout 300
+
+# KeepAlive: Whether or not to allow persistent connections (more than
+# one request per connection). Set to "Off" to deactivate.
+KeepAlive On
+
+# MaxKeepAliveRequests: The maximum number of requests to allow
+# during a persistent connection. Set to 0 to allow an unlimited amount.
+# We recommend you leave this number high, for maximum performance.
+MaxKeepAliveRequests 100
+
+# KeepAliveTimeout: Number of seconds to wait for the next request from the
+# same client on the same connection.
+KeepAliveTimeout 15
+
+# UseCanonicalName: Determines how Apache constructs self-referencing
+# URLs and the SERVER_NAME and SERVER_PORT variables.
+# When set "Off", Apache will use the Hostname and Port supplied
+# by the client.  When set "On", Apache will use the value of the
+# ServerName directive.
+UseCanonicalName Off
+
+# AccessFileName: The name of the file to look for in each directory
+# for additional configuration directives.  See also the AllowOverride
+# directive.
+AccessFileName .htaccess
+
+# ServerTokens
+# This directive configures what you return as the Server HTTP response
+# Header. The default is 'Full' which sends information about the OS-Type
+# and compiled in modules.
+# Set to one of:  Full | OS | Minor | Minimal | Major | Prod
+# where Full conveys the most information, and Prod the least.
+ServerTokens Prod
+
+# Optionally add a line containing the server version and virtual host
+# name to server-generated pages (internal error documents, FTP directory
+# listings, mod_status and mod_info output etc., but not CGI generated
+# documents or custom error documents).
+# Set to "EMail" to also include a mailto: link to the ServerAdmin.
+# Set to one of:  On | Off | EMail
+ServerSignature Off
+
+# HostnameLookups: Log the names of clients or just their IP addresses
+# e.g., www.apache.org (on) or 204.62.129.132 (off).
+# The default is off because it'd be overall better for the net if people
+# had to knowingly turn this feature on, since enabling it means that
+# each client request will result in AT LEAST one lookup request to the
+# nameserver.
+HostnameLookups Off
+
+# EnableMMAP and EnableSendfile: On systems that support it,
+# memory-mapping or the sendfile syscall is used to deliver
+# files.  This usually improves server performance, but must
+# be turned off when serving from networked-mounted 
+# filesystems or if support for these functions is otherwise
+# broken on your system.
+#EnableMMAP off
+#EnableSendfile off
+
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+ErrorLog /var/log/apache2/error_log
+
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+LogLevel warn
+
+# We configure the "default" to be a very restrictive set of features.
+<Directory />
+	Options FollowSymLinks
+	AllowOverride None
+	Order deny,allow
+	Deny from all
+</Directory>
+
+# DirectoryIndex: sets the file that Apache will serve if a directory
+# is requested.
+#
+# The index.html.var file (a type-map) is used to deliver content-
+# negotiated documents. The MultiViews Options can be used for the
+# same purpose, but it is much slower.
+#
+# To add files to that list use AddDirectoryIndex in a custom config
+# file. Do not change this entry unless you know what you are doing.
+<IfModule dir_module>
+	DirectoryIndex index.html index.html.var
+</IfModule>
+
+# The following lines prevent .htaccess and .htpasswd files from being
+# viewed by Web clients.
+<FilesMatch "^\.ht">
+	Order allow,deny
+	Deny from all
+</FilesMatch>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_error_documents.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_error_documents.conf
new file mode 100644
index 00000000..90900269
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_error_documents.conf
@@ -0,0 +1,66 @@
+# The configuration below implements multi-language error documents through
+# content-negotiation.
+
+# Customizable error responses come in three flavors:
+# 1) plain text 2) local redirects 3) external redirects
+# Some examples:
+#ErrorDocument 500 "The server made a boo boo."
+#ErrorDocument 404 /missing.html
+#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
+#ErrorDocument 402 http://www.example.com/subscription_info.html
+
+# Required modules: mod_alias, mod_include, mod_negotiation
+# We use Alias to redirect any /error/HTTP_<error>.html.var response to
+# our collection of by-error message multi-language collections. We use
+# includes to substitute the appropriate text.
+# You can modify the messages' appearance without changing any of the
+# default HTTP_<error>.html.var files by adding the line:
+#   Alias /error/include/ "/your/include/path/"
+# which allows you to create your own set of files by starting with the
+# /var/www/localhost/error/include/ files and copying them to /your/include/path/, 
+# even on a per-VirtualHost basis. The default include files will display
+# your Apache version number and your ServerAdmin email address regardless
+# of the setting of ServerSignature.
+
+<IfDefine ERRORDOCS>
+<IfModule alias_module>
+<IfModule mime_module>
+<IfModule negotiation_module>
+
+Alias /error/ "/var/www/localhost/error/"
+
+<Directory "/var/www/localhost/error">
+	AllowOverride None
+	Options IncludesNoExec
+	AddOutputFilter Includes html
+	AddHandler type-map var
+	Order allow,deny
+	Allow from all
+	LanguagePriority en cs de es fr it ja ko nl pl pt-br ro sv tr
+	ForceLanguagePriority Prefer Fallback
+</Directory>
+
+ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
+ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
+ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
+ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
+ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
+ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
+ErrorDocument 410 /error/HTTP_GONE.html.var
+ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
+ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
+ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
+ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
+ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
+ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
+ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
+ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
+ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
+ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var
+
+</IfModule>
+</IfModule>
+</IfModule>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_languages.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_languages.conf
new file mode 100644
index 00000000..287f6544
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_languages.conf
@@ -0,0 +1,137 @@
+# Settings for hosting different languages.
+<IfDefine LANGUAGE>
+<IfModule mime_module>
+<IfModule negotiation_module>
+# DefaultLanguage and AddLanguage allows you to specify the language of
+# a document. You can then use content negotiation to give a browser a
+# file in a language the user can understand.
+#
+# Specify a default language. This means that all data
+# going out without a specific language tag (see below) will
+# be marked with this one. You probably do NOT want to set
+# this unless you are sure it is correct for all cases.
+#
+# It is generally better to not mark a page as
+# being a certain language than marking it with the wrong
+# language!
+#
+# DefaultLanguage nl
+#
+# Note 1: The suffix does not have to be the same as the language
+# keyword --- those with documents in Polish (whose net-standard
+# language code is pl) may wish to use "AddLanguage pl .po" to
+# avoid the ambiguity with the common suffix for perl scripts.
+#
+# Note 2: The example entries below illustrate that in some cases
+# the two character 'Language' abbreviation is not identical to
+# the two character 'Country' code for its country,
+# E.g. 'Danmark/dk' versus 'Danish/da'.
+#
+# Note 3: In the case of 'ltz' we violate the RFC by using a three char
+# specifier. There is 'work in progress' to fix this and get
+# the reference data for rfc1766 cleaned up.
+#
+# Catalan (ca) - Croatian (hr) - Czech (cs) - Danish (da) - Dutch (nl)
+# English (en) - Esperanto (eo) - Estonian (et) - French (fr) - German (de)
+# Greek-Modern (el) - Hebrew (he) - Italian (it) - Japanese (ja)
+# Korean (ko) - Luxembourgeois* (ltz) - Norwegian Nynorsk (nn)
+# Norwegian (no) - Polish (pl) - Portugese (pt)
+# Brazilian Portuguese (pt-BR) - Russian (ru) - Swedish (sv)
+# Simplified Chinese (zh-CN) - Spanish (es) - Traditional Chinese (zh-TW)
+AddLanguage ca .ca
+AddLanguage cs .cz .cs
+AddLanguage da .dk
+AddLanguage de .de
+AddLanguage el .el
+AddLanguage en .en
+AddLanguage eo .eo
+AddLanguage es .es
+AddLanguage et .et
+AddLanguage fr .fr
+AddLanguage he .he
+AddLanguage hr .hr
+AddLanguage it .it
+AddLanguage ja .ja
+AddLanguage ko .ko
+AddLanguage ltz .ltz
+AddLanguage nl .nl
+AddLanguage nn .nn
+AddLanguage no .no
+AddLanguage pl .po
+AddLanguage pt .pt
+AddLanguage pt-BR .pt-br
+AddLanguage ru .ru
+AddLanguage sv .sv
+AddLanguage zh-CN .zh-cn
+AddLanguage zh-TW .zh-tw
+
+# LanguagePriority allows you to give precedence to some languages
+# in case of a tie during content negotiation.
+#
+# Just list the languages in decreasing order of preference. We have
+# more or less alphabetized them here. You probably want to change this.
+LanguagePriority en ca cs da de el eo es et fr he hr it ja ko ltz nl nn no pl pt pt-BR ru sv zh-CN zh-TW
+
+# ForceLanguagePriority allows you to serve a result page rather than
+# MULTIPLE CHOICES (Prefer) [in case of a tie] or NOT ACCEPTABLE (Fallback)
+# [in case no accepted languages matched the available variants]
+ForceLanguagePriority Prefer Fallback
+
+# Commonly used filename extensions to character sets. You probably
+# want to avoid clashes with the language extensions, unless you
+# are good at carefully testing your setup after each change.
+# See http://www.iana.org/assignments/character-sets for the
+# official list of charset names and their respective RFCs.
+AddCharset us-ascii.ascii	.us-ascii
+AddCharset ISO-8859-1		.iso8859-1 .latin1
+AddCharset ISO-8859-2		.iso8859-2 .latin2 .cen
+AddCharset ISO-8859-3		.iso8859-3 .latin3
+AddCharset ISO-8859-4		.iso8859-4 .latin4
+AddCharset ISO-8859-5		.iso8859-5 .cyr .iso-ru
+AddCharset ISO-8859-6		.iso8859-6 .arb .arabic
+AddCharset ISO-8859-7		.iso8859-7 .grk .greek
+AddCharset ISO-8859-8		.iso8859-8 .heb .hebrew
+AddCharset ISO-8859-9		.iso8859-9 .latin5 .trk
+AddCharset ISO-8859-10		.iso8859-10 .latin6
+AddCharset ISO-8859-13		.iso8859-13
+AddCharset ISO-8859-14		.iso8859-14 .latin8
+AddCharset ISO-8859-15		.iso8859-15 .latin9
+AddCharset ISO-8859-16		.iso8859-16 .latin10
+AddCharset ISO-2022-JP		.iso2022-jp .jis
+AddCharset ISO-2022-KR		.iso2022-kr .kis
+AddCharset ISO-2022-CN		.iso2022-cn .cis
+AddCharset Big5.Big5		.big5 .b5
+AddCharset cn-Big5			.cn-big5
+# For russian, more than one charset is used (depends on client, mostly):
+AddCharset WINDOWS-1251		.cp-1251 .win-1251
+AddCharset CP866			.cp866
+AddCharset KOI8				.koi8
+AddCharset KOI8-E			.koi8-e
+AddCharset KOI8-r			.koi8-r .koi8-ru
+AddCharset KOI8-U			.koi8-u
+AddCharset KOI8-ru			.koi8-uk .ua
+AddCharset ISO-10646-UCS-2	.ucs2
+AddCharset ISO-10646-UCS-4	.ucs4
+AddCharset UTF-7			.utf7
+AddCharset UTF-8			.utf8
+AddCharset UTF-16			.utf16
+AddCharset UTF-16BE			.utf16be
+AddCharset UTF-16LE			.utf16le
+AddCharset UTF-32			.utf32
+AddCharset UTF-32BE			.utf32be
+AddCharset UTF-32LE			.utf32le
+AddCharset euc-cn			.euc-cn
+AddCharset euc-gb			.euc-gb
+AddCharset euc-jp			.euc-jp
+AddCharset euc-kr			.euc-kr
+# Not sure how euc-tw got in - IANA doesn't list it???
+AddCharset EUC-TW			.euc-tw
+AddCharset gb2312			.gb2312 .gb
+AddCharset iso-10646-ucs-2	.ucs-2 .iso-10646-ucs-2
+AddCharset iso-10646-ucs-4	.ucs-4 .iso-10646-ucs-4
+AddCharset shift_jis		.shift_jis .sjis
+</IfModule>
+</IfModule>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_mod_autoindex.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_autoindex.conf
new file mode 100644
index 00000000..2512357d
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_autoindex.conf
@@ -0,0 +1,83 @@
+<IfModule autoindex_module>
+<IfModule alias_module>
+# We include the /icons/ alias for FancyIndexed directory listings.  If
+# you do not use FancyIndexing, you may comment this out.
+Alias /icons/ "/var/www/localhost/icons/"
+
+<Directory "/var/www/localhost/icons">
+	Options Indexes MultiViews
+	AllowOverride None
+	Order allow,deny
+	Allow from all
+</Directory>
+</IfModule>
+
+# Directives controlling the display of server-generated directory listings.
+#
+# To see the listing of a directory, the Options directive for the
+# directory must include "Indexes", and the directory must not contain
+# a file matching those listed in the DirectoryIndex directive.
+
+# IndexOptions: Controls the appearance of server-generated directory
+# listings.
+IndexOptions FancyIndexing VersionSort
+
+# AddIcon* directives tell the server which icon to show for different
+# files or filename extensions.  These are only displayed for
+# FancyIndexed directories.
+AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
+
+AddIconByType (TXT,/icons/text.gif) text/*
+AddIconByType (IMG,/icons/image2.gif) image/*
+AddIconByType (SND,/icons/sound2.gif) audio/*
+AddIconByType (VID,/icons/movie.gif) video/*
+
+AddIcon /icons/binary.gif .bin .exe
+AddIcon /icons/binhex.gif .hqx
+AddIcon /icons/tar.gif .tar
+AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
+AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
+AddIcon /icons/a.gif .ps .ai .eps
+AddIcon /icons/layout.gif .html .shtml .htm .pdf
+AddIcon /icons/text.gif .txt
+AddIcon /icons/c.gif .c
+AddIcon /icons/p.gif .pl .py
+AddIcon /icons/f.gif .for
+AddIcon /icons/dvi.gif .dvi
+AddIcon /icons/uuencoded.gif .uu
+AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
+AddIcon /icons/tex.gif .tex
+AddIcon /icons/bomb.gif core
+
+AddIcon /icons/back.gif ..
+AddIcon /icons/hand.right.gif README
+AddIcon /icons/folder.gif ^^DIRECTORY^^
+AddIcon /icons/blank.gif ^^BLANKICON^^
+
+# DefaultIcon is which icon to show for files which do not have an icon
+# explicitly set.
+DefaultIcon /icons/unknown.gif
+
+# AddDescription allows you to place a short description after a file in
+# server-generated indexes.  These are only displayed for FancyIndexed
+# directories.
+# Format: AddDescription "description" filename
+
+#AddDescription "GZIP compressed document" .gz
+#AddDescription "tar archive" .tar
+#AddDescription "GZIP compressed tar archive" .tgz
+
+# ReadmeName is the name of the README file the server will look for by
+# default, and append to directory listings.
+
+# HeaderName is the name of a file which should be prepended to 
+# directory indexes. 
+ReadmeName README.html
+HeaderName HEADER.html
+
+# IndexIgnore is a set of filenames which directory indexing should ignore
+# and not include in the listing.  Shell-style wildcarding is permitted.
+IndexIgnore .??* *~ *# HEADER* README* RCS CVS *,v *,t
+</IfModule>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_mod_info.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_info.conf
new file mode 100644
index 00000000..53fd7aea
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_info.conf
@@ -0,0 +1,14 @@
+<IfDefine INFO>
+<IfModule info_module>
+# Allow remote server configuration reports, with the URL of
+# http://servername/server-info
+<Location /server-info>
+	SetHandler server-info
+	Order deny,allow
+	Deny from all
+	Allow from 127.0.0.1
+</Location>
+</IfModule>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_mod_log_config.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_log_config.conf
new file mode 100644
index 00000000..2f4244c9
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_log_config.conf
@@ -0,0 +1,35 @@
+<IfModule log_config_module>
+# The following directives define some format nicknames for use with
+# a CustomLog directive (see below).
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
+LogFormat "%h %l %u %t \"%r\" %>s %b" common
+
+LogFormat "%{Referer}i -> %U" referer
+LogFormat "%{User-Agent}i" agent
+LogFormat "%v %h %l %u %t \"%r\" %>s %b %T" script
+LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i VLOG=%{VLOG}e" vhost
+
+<IfModule logio_module>
+# You need to enable mod_logio.c to use %I and %O
+LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" vhostio
+</IfModule>
+
+# The location and format of the access logfile (Common Logfile Format).
+# If you do not define any access logfiles within a <VirtualHost>
+# container, they will be logged here.  Contrariwise, if you *do*
+# define per-<VirtualHost> access logfiles, transactions will be
+# logged therein and *not* in this file.
+CustomLog /var/log/apache2/access_log common
+
+# If you would like to have agent and referer logfiles,
+# uncomment the following directives.
+#CustomLog /var/log/apache2/referer_log referer
+#CustomLog /var/log/apache2/agent_logs agent
+
+# If you prefer a logfile with access, agent, and referer information
+# (Combined Logfile Format) you can use the following directive.
+#CustomLog /var/log/apache2/access_log combined
+</IfModule>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_mod_mime.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_mime.conf
new file mode 100644
index 00000000..51f23d55
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_mime.conf
@@ -0,0 +1,55 @@
+# DefaultType: the default MIME type the server will use for a document
+# if it cannot otherwise determine one, such as from filename extensions.
+# If your server contains mostly text or HTML documents, "text/plain" is
+# a good value.  If most of your content is binary, such as applications
+# or images, you may want to use "application/octet-stream" instead to
+# keep browsers from trying to display binary files as though they are
+# text.
+DefaultType text/plain
+
+<IfModule mime_module>
+# TypesConfig points to the file containing the list of mappings from
+# filename extension to MIME-type.
+TypesConfig /etc/mime.types
+
+# AddType allows you to add to or override the MIME configuration
+# file specified in TypesConfig for specific file types.
+#AddType application/x-gzip .tgz
+
+# AddEncoding allows you to have certain browsers uncompress
+# information on the fly. Note: Not all browsers support this.
+#AddEncoding x-compress .Z
+#AddEncoding x-gzip .gz .tgz
+
+# If the AddEncoding directives above are commented-out, then you
+# probably should define those extensions to indicate media types:
+AddType application/x-compress .Z
+AddType application/x-gzip .gz .tgz
+
+# AddHandler allows you to map certain file extensions to "handlers":
+# actions unrelated to filetype. These can be either built into the server
+# or added with the Action directive (see below)
+
+# To use CGI scripts outside of ScriptAliased directories:
+# (You will also need to add "ExecCGI" to the "Options" directive.)
+#AddHandler cgi-script .cgi
+
+# For type maps (negotiated resources):
+#AddHandler type-map var
+
+# Filters allow you to process content before it is sent to the client.
+#
+# To parse .shtml files for server-side includes (SSI):
+# (You will also need to add "Includes" to the "Options" directive.)
+#AddType text/html .shtml
+#AddOutputFilter INCLUDES .shtml
+</IfModule>
+
+<IfModule mime_magic_module>
+# The mod_mime_magic module allows the server to use various hints from the
+# contents of the file itself to determine its type.  The MIMEMagicFile
+# directive tells the module where the hint definitions are located.
+MIMEMagicFile /etc/apache2/magic
+</IfModule>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_mod_status.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_status.conf
new file mode 100644
index 00000000..fa906766
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_status.conf
@@ -0,0 +1,19 @@
+<IfDefine STATUS>
+<IfModule status_module>
+# Allow server status reports generated by mod_status,
+# with the URL of http://servername/server-status
+<Location /server-status>
+	SetHandler server-status
+	Order deny,allow
+	Deny from all
+	Allow from 127.0.0.1
+</Location>
+
+# ExtendedStatus controls whether Apache will generate "full" status
+# information (ExtendedStatus On) or just basic information (ExtendedStatus
+# Off) when the "server-status" handler is called.
+ExtendedStatus On
+</IfModule>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_mod_userdir.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_userdir.conf
new file mode 100644
index 00000000..3fb69117
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_mod_userdir.conf
@@ -0,0 +1,40 @@
+# Settings for user home directories
+
+<IfDefine USERDIR>
+<IfModule userdir_module>
+
+# UserDir: The name of the directory that is appended onto a user's home
+# directory if a ~user request is received.  Note that you must also set
+# the default access control for these directories, as in the example below.
+UserDir public_html
+
+# Control access to UserDir directories.  The following is an example
+# for a site where these directories are restricted to read-only.
+<Directory /home/*/public_html>
+	AllowOverride FileInfo AuthConfig Limit Indexes
+	Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+	<Limit GET POST OPTIONS>
+		Order allow,deny
+		Allow from all
+	</Limit>
+	<LimitExcept GET POST OPTIONS>
+		Order deny,allow
+		Deny from all
+	</LimitExcept>
+</Directory>
+
+# Suexec isn't really required to run cgi-scripts, but it's a really good
+# idea if you have multiple users serving websites...
+<IfDefine SUEXEC>
+<IfModule suexec_module>
+<Directory /home/*/public_html/cgi-bin>
+	Options ExecCGI
+	SetHandler cgi-script
+</Directory>
+</IfModule>
+</IfDefine>
+
+</IfModule>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/00_mpm.conf b/puppet/modules/apache/files/modules.d/Gentoo/00_mpm.conf
new file mode 100644
index 00000000..01833059
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/00_mpm.conf
@@ -0,0 +1,102 @@
+# Server-Pool Management (MPM specific)
+
+# PidFile: The file in which the server should record its process
+# identification number when it starts.
+#
+# Note that this is the default PidFile for most MPMs.
+PidFile /var/run/apache2.pid
+
+# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
+#LockFile /var/run/apache2.lock
+
+# Only one of the below sections will be relevant on your
+# installed httpd.  Use "/usr/sbin/apache2 -l" to find out the
+# active mpm.
+
+# common MPM configuration
+# These configuration directives apply to all MPMs
+#
+# StartServers: Number of child server processes created at startup
+# MaxClients: Maximum number of child processes to serve requests
+# MaxRequestsPerChild: Limit on the number of requests that an individual child
+#                      server will handle during its life
+
+
+# prefork MPM
+# This is the default MPM if USE=-threads
+#
+# MinSpareServers: Minimum number of idle child server processes
+# MaxSpareServers: Maximum number of idle child server processes
+<IfModule mpm_prefork_module>
+	StartServers		5
+	MinSpareServers		5
+	MaxSpareServers		10
+	MaxClients			150
+	MaxRequestsPerChild	10000
+</IfModule>
+
+# worker MPM
+# This is the default MPM if USE=threads
+#
+# MinSpareThreads: Minimum number of idle threads available to handle request spikes
+# MaxSpareThreads: Maximum number of idle threads
+# ThreadsPerChild: Number of threads created by each child process
+<IfModule mpm_worker_module>
+	StartServers		2
+	MinSpareThreads		25
+	MaxSpareThreads		75
+	ThreadsPerChild		25
+	MaxClients			150
+	MaxRequestsPerChild	10000
+</IfModule>
+
+# event MPM
+#
+# MinSpareThreads: Minimum number of idle threads available to handle request spikes
+# MaxSpareThreads: Maximum number of idle threads
+# ThreadsPerChild: Number of threads created by each child process
+<IfModule mpm_event_module>
+	StartServers		2
+	MinSpareThreads		25
+	MaxSpareThreads		75
+	ThreadsPerChild		25
+	MaxClients			150
+	MaxRequestsPerChild	10000
+</IfModule>
+
+# peruser MPM
+#
+# MinSpareProcessors: Minimum number of idle child server processes
+# MinProcessors: Minimum number of processors per virtual host
+# MaxProcessors: Maximum number of processors per virtual host
+# ExpireTimeout: Maximum idle time before a child is killed, 0 to disable
+# Multiplexer: Specify a Multiplexer child configuration.
+# Processor: Specify a user and group for a specific child process
+<IfModule mpm_peruser_module>
+	MinSpareProcessors	2
+	MinProcessors		2
+	MaxProcessors		10
+	MaxClients			150
+	MaxRequestsPerChild	1000
+	ExpireTimeout		1800
+
+	# KeepAlive *MUST* be set to off
+	KeepAlive Off
+
+	Multiplexer nobody nobody
+	Processor apache apache
+</IfModule>
+
+# itk MPM
+#
+# MinSpareServers: Minimum number of idle child server processes
+# MaxSpareServers: Maximum number of idle child server processes
+<IfModule mpm_itk_module>
+	StartServers		5
+	MinSpareServers		5
+	MaxSpareServers		10
+	MaxClients			150
+	MaxRequestsPerChild	10000
+</IfModule>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/10_mod_mem_cache.conf b/puppet/modules/apache/files/modules.d/Gentoo/10_mod_mem_cache.conf
new file mode 100644
index 00000000..ad7fa9e0
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/10_mod_mem_cache.conf
@@ -0,0 +1,10 @@
+<IfDefine MEM_CACHE>
+# 128MB cache for objects < 2MB
+CacheEnable mem /
+MCacheSize 131072
+MCacheMaxObjectCount 1000
+MCacheMinObjectSize 1
+MCacheMaxObjectSize 2048
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/40_mod_ssl.conf b/puppet/modules/apache/files/modules.d/Gentoo/40_mod_ssl.conf
new file mode 100644
index 00000000..331783a6
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/40_mod_ssl.conf
@@ -0,0 +1,65 @@
+# Note: The following must must be present to support
+# starting without SSL on platforms with no /dev/random equivalent
+# but a statically compiled-in mod_ssl.
+<IfModule ssl_module>
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+</IfModule>
+
+<IfDefine SSL>
+<IfModule ssl_module>
+# This is the Apache server configuration file providing SSL support.
+# It contains the configuration directives to instruct the server how to
+# serve pages over an https connection. For detailing information about these 
+# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
+
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders. If you are unsure
+# consult the online docs. You have been warned.
+
+## Pseudo Random Number Generator (PRNG):
+# Configure one or more sources to seed the PRNG of the SSL library.
+# The seed data should be of good random quality.
+# WARNING! On some platforms /dev/random blocks if not enough entropy
+# is available. This means you then cannot use the /dev/random device
+# because it would lead to very long connection times (as long as
+# it requires to make more entropy available). But usually those
+# platforms additionally provide a /dev/urandom device which doesn't
+# block. So, if available, use this one instead. Read the mod_ssl User
+# Manual for more details.
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed startup file:/dev/urandom 512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+
+## SSL Global Context:
+# All SSL configuration in this context applies both to the main server and 
+# all SSL-enabled virtual hosts.
+
+# Some MIME-types for downloading Certificates and CRLs
+<IfModule mime_module>
+	AddType application/x-x509-ca-cert .crt
+	AddType application/x-pkcs7-crl    .crl
+</IfModule>
+
+## Pass Phrase Dialog:
+# Configure the pass phrase gathering process. The filtering dialog program 
+# (`builtin' is a internal terminal dialog) has to provide the pass phrase on
+# stdout.
+SSLPassPhraseDialog  builtin
+
+## Inter-Process Session Cache:
+# Configure the SSL Session Cache: First the mechanism  to use and second the
+# expiring timeout (in seconds).
+#SSLSessionCache		dbm:/var/run/ssl_scache
+SSLSessionCache			shmcb:/var/run/ssl_scache(512000)
+SSLSessionCacheTimeout  300
+
+## Semaphore:
+# Configure the path to the mutual exclusion semaphore the SSL engine uses
+# internally for inter-process synchronization.
+SSLMutex  file:/var/run/ssl_mutex
+</IfModule>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/45_mod_dav.conf b/puppet/modules/apache/files/modules.d/Gentoo/45_mod_dav.conf
new file mode 100644
index 00000000..b15ca017
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/45_mod_dav.conf
@@ -0,0 +1,56 @@
+<IfDefine DAV>
+<IfModule dav_module>
+<IfModule dav_fs_module>
+DavLockDB "/var/lib/dav/lockdb"
+
+# The following example gives DAV write access to a directory called
+# "uploads" under the ServerRoot directory.
+<IfModule alias_module>
+<IfModule auth_digest_module>
+<IfModule authn_file_module>
+Alias /uploads "/var/www/uploads"
+
+<Directory "/var/www/uploads">
+	Dav On
+
+	AuthType Digest
+	AuthName DAV-upload
+
+	# You can use the htdigest program to create the password database:
+	#   htdigest -c "/var/www/.htpasswd-dav" DAV-upload admin
+	AuthUserFile "/var/www/.htpasswd-dav"
+
+	# Allow access from any host
+	Order allow,deny
+	Allow from all
+
+	# Allow universal read-access, but writes are restricted
+	# to the admin user.
+	<LimitExcept GET OPTIONS>
+		require user admin
+	</LimitExcept>
+</Directory>
+</IfModule>
+</IfModule>
+</IfModule>
+
+</IfModule>
+</IfModule>
+
+# The following directives disable redirects on non-GET requests for
+# a directory that does not include the trailing slash.  This fixes a 
+# problem with several clients that do not appropriately handle 
+# redirects for folders with DAV methods.
+<IfModule setenvif_module>
+BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
+BrowserMatch "MS FrontPage" redirect-carefully
+BrowserMatch "^WebDrive" redirect-carefully
+BrowserMatch "^WebDAVFS/1.[012345]" redirect-carefully
+BrowserMatch "^gnome-vfs/1.0" redirect-carefully
+BrowserMatch "^XML Spy" redirect-carefully
+BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully
+</IfModule>
+
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/46_mod_ldap.conf b/puppet/modules/apache/files/modules.d/Gentoo/46_mod_ldap.conf
new file mode 100644
index 00000000..837bc6e6
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/46_mod_ldap.conf
@@ -0,0 +1,29 @@
+# Examples below are taken from the online documentation
+# Refer to:
+# http://localhost/manual/mod/mod_ldap.html
+# http://localhost/manual/mod/mod_auth_ldap.html
+<IfDefine LDAP>
+<IfModule ldap_module>
+LDAPSharedCacheSize	200000
+LDAPCacheEntries	1024
+LDAPCacheTTL		600
+LDAPOpCacheEntries	1024
+LDAPOpCacheTTL		600
+
+<Location /ldap-status>
+	SetHandler ldap-status
+	Order deny,allow
+	Deny from all
+	Allow from 127.0.0.1
+</Location>
+</IfModule>
+</IfDefine>
+
+<IfDefine AUTHNZ_LDAP>
+<IfModule authnz_ldap_module>
+	#AuthLDAPURL ldap://ldap1.airius.com:389/ou=People, o=Airius?uid?sub?(objectClass=*)
+	#require valid-user
+</IfModule>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/modules.d/Gentoo/70_mod_php5.conf b/puppet/modules/apache/files/modules.d/Gentoo/70_mod_php5.conf
new file mode 100644
index 00000000..a8254359
--- /dev/null
+++ b/puppet/modules/apache/files/modules.d/Gentoo/70_mod_php5.conf
@@ -0,0 +1,18 @@
+<IfDefine PHP5>
+	# Load the module first
+	<IfModule !mod_php5.c>
+		LoadModule php5_module    modules/libphp5.so
+	</IfModule>
+
+	# Set it to handle the files
+	<IfModule mod_mime.c>
+		AddType application/x-httpd-php .php
+		AddType application/x-httpd-php .phtml
+		AddType application/x-httpd-php .php3
+		AddType application/x-httpd-php .php4
+		AddType application/x-httpd-php .php5
+		AddType application/x-httpd-php-source .phps
+	</IfModule>
+
+	DirectoryIndex index.php index.phtml
+</IfDefine>
diff --git a/puppet/modules/apache/files/munin/apache_activity b/puppet/modules/apache/files/munin/apache_activity
new file mode 100755
index 00000000..65fc0722
--- /dev/null
+++ b/puppet/modules/apache/files/munin/apache_activity
@@ -0,0 +1,99 @@
+#!/usr/bin/perl
+#
+# Parameters supported:
+#
+# 	config
+# 	autoconf
+#
+# Configurable variables
+#
+# 	url      - Override default status-url
+#
+# Magic markers:
+#%# family=auto
+#%# capabilities=autoconf
+
+my $ret = undef;
+if (!eval "require LWP::UserAgent;") {
+    $ret = "LWP::UserAgent not found";
+}
+
+my $URL = exists $ENV{'url'} ? $ENV{'url'} : "http://127.0.0.1:%d/server-status?auto";
+my @PORTS = exists $ENV{'ports'} ? split(' ', $ENV{'ports'}) : (80);
+my %chars = (
+	     # '\_' => 'Waiting',
+	     # 'S' => 'Starting up',
+	     'R' => 'Reading request',
+	     'W' => 'Sending reply',
+	     'K' => 'Keepalive',
+	     'D' => 'DNS lookup',
+	     'C' => 'Closing',
+	     # 'L' => 'Logging',
+	     # 'G' => 'Gracefully finishing',
+	     # 'I' => 'Idle cleanup',
+	     # '\.' => 'Open slot',
+	     );
+
+#    "_" Waiting for Connection, "S" Starting up, "R" Reading Request,
+#    "W" Sending Reply, "K" Keepalive (read), "D" DNS Lookup,
+#    "C" Closing connection, "L" Logging, "G" Gracefully finishing,
+#    "I" Idle cleanup of worker, "." Open slot with no current process
+
+if (exists $ARGV[0] and $ARGV[0] eq "autoconf") {
+    if ($ret) {
+	print "no ($ret)\n";
+	exit 1;
+    }
+    my $ua = LWP::UserAgent->new(timeout => 30);
+    my @badports;
+    
+    foreach my $port (@PORTS) {
+	my $url = sprintf $URL, $port;
+	my $response = $ua->request(HTTP::Request->new('GET',$url));
+	push @badports, $port unless $response->is_success and $response->content =~ /Scoreboard/im;
+    }
+    
+    if (@badports) {
+	print "no (no apache server-status on ports @badports)\n";
+	exit 1;
+    } else {
+	print "yes\n";
+	exit 0;
+    }
+}
+
+if (exists $ARGV[0] and $ARGV[0] eq "config") {
+    print "graph_title Apache activity\n";
+    print "graph_args --base 1000 -l 0\n";
+    print "graph_category apache\n";
+    print "graph_vlabel processes\n";
+    foreach my $port (@PORTS) {
+	while (my ($char, $val) = each (%chars)) {
+	    $char =~ s/\\\./dot/;
+            $char =~ s/\\\_/underline/;
+            print "activity_${port}_${char}.label ";
+	    print $val, "\n";
+            print "activity_${port}_${char}.type GAUGE\n";
+        }
+    }    
+    exit 0;
+}
+
+foreach my $port (@PORTS) {
+    my $ua = LWP::UserAgent->new (timeout => 30);
+    my $url = sprintf $URL, $port;
+    my $response = $ua->request (HTTP::Request->new('GET',$url));
+    if ($response->content =~ /^Scoreboard\:\s?(.*)$/sm) {
+	my $string = $1;
+	chomp $string;
+	my @act = split (//, $string);
+	foreach my $char (keys (%chars)) {
+	    my $num = scalar (grep (/$char/, @act));
+	    $char =~ s/\\\./dot/;
+	    $char =~ s/\\\_/underline/;
+	    print "activity_${port}_${char}.value $num\n";
+	}
+    }
+}
+
+
diff --git a/puppet/modules/apache/files/scripts/OpenBSD/bin/apache_logrotate.sh b/puppet/modules/apache/files/scripts/OpenBSD/bin/apache_logrotate.sh
new file mode 100644
index 00000000..c2fcad97
--- /dev/null
+++ b/puppet/modules/apache/files/scripts/OpenBSD/bin/apache_logrotate.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+WEBROOT="/var/www/htdocs"
+#PIDFILE="/var/www/logs/httpd.pid"
+echo "#Autogenrated newsyslog.conf\n# logfile_name          owner:group     mode count size when  flags"
+find /var/www/logs -name '*_log' -exec perl -e 'print "\n{}\twww:www\t644\t30\t*\t\$D0\tZ" ' \;
+find $WEBROOT -name '*_log' -exec perl -e 'print "\n{}\twww:www\t644\t30\t*\t\$D0\tZ" ' \;
+perl -e 'print "\t\t \"/bin/sh /opt/bin/restart_apache.sh\"";'
diff --git a/puppet/modules/apache/files/scripts/OpenBSD/bin/restart_apache.sh b/puppet/modules/apache/files/scripts/OpenBSD/bin/restart_apache.sh
new file mode 100644
index 00000000..4dc936d3
--- /dev/null
+++ b/puppet/modules/apache/files/scripts/OpenBSD/bin/restart_apache.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+ignoreout='Processing config'
+apachectl restart 2>&1 | (egrep -v -e "_default_ VirtualHost overlap on port 443" -e "$ignoreout" -e "/usr/sbin/apachectl restart: httpd restarted" || true )
+sleep 10
+apachectl start 2>&1 | (egrep -v -e "_default_ VirtualHost overlap on port 443" -e "$ignoreout" -e "/usr/sbin/apachectl startssl: httpd started" || true )
diff --git a/puppet/modules/apache/files/scripts/OpenBSD/bin/restart_apache_ssl.sh b/puppet/modules/apache/files/scripts/OpenBSD/bin/restart_apache_ssl.sh
new file mode 100644
index 00000000..314018b6
--- /dev/null
+++ b/puppet/modules/apache/files/scripts/OpenBSD/bin/restart_apache_ssl.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+ignoreout='Processing config'
+apachectl restart 2>&1 | (egrep -v -e "_default_ VirtualHost overlap on port 443" -e "$ignoreout" -e "/usr/sbin/apachectl restart: httpd restarted" || true )
+sleep 10
+apachectl startssl 2>&1 | (egrep -v -e "_default_ VirtualHost overlap on port 443" -e "$ignoreout" -e "/usr/sbin/apachectl startssl: httpd started" || true )
diff --git a/puppet/modules/apache/files/service/CentOS/httpd b/puppet/modules/apache/files/service/CentOS/httpd
new file mode 100644
index 00000000..7102c611
--- /dev/null
+++ b/puppet/modules/apache/files/service/CentOS/httpd
@@ -0,0 +1,22 @@
+# Configuration file for the httpd service.
+
+#
+# The default processing model (MPM) is the process-based
+# 'prefork' model.  A thread-based model, 'worker', is also
+# available, but does not work with some modules (such as PHP).
+# The service must be stopped before changing this variable.
+#
+#HTTPD=/usr/sbin/httpd.worker
+
+#
+# To pass additional options (for instance, -D definitions) to the
+# httpd binary at startup, set OPTIONS here.
+#
+#OPTIONS=
+
+#
+# By default, the httpd process is started in the C locale; to 
+# change the locale in which the server runs, the HTTPD_LANG
+# variable can be set.
+#
+#HTTPD_LANG=C
diff --git a/puppet/modules/apache/files/service/CentOS/httpd.itk b/puppet/modules/apache/files/service/CentOS/httpd.itk
new file mode 100644
index 00000000..62a2d24f
--- /dev/null
+++ b/puppet/modules/apache/files/service/CentOS/httpd.itk
@@ -0,0 +1,23 @@
+# Configuration file for the httpd service.
+
+#
+# The default processing model (MPM) is the process-based
+# 'prefork' model.  A thread-based model, 'worker', is also
+# available, but does not work with some modules (such as PHP).
+# The service must be stopped before changing this variable.
+#
+#HTTPD=/usr/sbin/httpd.worker
+HTTPD=/usr/sbin/httpd.itk
+
+#
+# To pass additional options (for instance, -D definitions) to the
+# httpd binary at startup, set OPTIONS here.
+#
+#OPTIONS=
+
+#
+# By default, the httpd process is started in the C locale; to 
+# change the locale in which the server runs, the HTTPD_LANG
+# variable can be set.
+#
+#HTTPD_LANG=C
diff --git a/puppet/modules/apache/files/service/CentOS/httpd.itk_plus b/puppet/modules/apache/files/service/CentOS/httpd.itk_plus
new file mode 100644
index 00000000..4d74de2c
--- /dev/null
+++ b/puppet/modules/apache/files/service/CentOS/httpd.itk_plus
@@ -0,0 +1,24 @@
+# Configuration file for the httpd service.
+
+#
+# The default processing model (MPM) is the process-based
+# 'prefork' model.  A thread-based model, 'worker', is also
+# available, but does not work with some modules (such as PHP).
+# The service must be stopped before changing this variable.
+#
+#HTTPD=/usr/sbin/httpd.worker
+HTTPD=/usr/sbin/httpd
+HTTPD_LOCAL=/usr/sbin/httpd.itk
+
+#
+# To pass additional options (for instance, -D definitions) to the
+# httpd binary at startup, set OPTIONS here.
+#
+#OPTIONS=
+
+#
+# By default, the httpd process is started in the C locale; to 
+# change the locale in which the server runs, the HTTPD_LANG
+# variable can be set.
+#
+#HTTPD_LANG=C
diff --git a/puppet/modules/apache/files/service/CentOS/httpd.worker b/puppet/modules/apache/files/service/CentOS/httpd.worker
new file mode 100644
index 00000000..290923f5
--- /dev/null
+++ b/puppet/modules/apache/files/service/CentOS/httpd.worker
@@ -0,0 +1,22 @@
+# Configuration file for the httpd service.
+
+#
+# The default processing model (MPM) is the process-based
+# 'prefork' model.  A thread-based model, 'worker', is also
+# available, but does not work with some modules (such as PHP).
+# The service must be stopped before changing this variable.
+#
+HTTPD=/usr/sbin/httpd.worker
+
+#
+# To pass additional options (for instance, -D definitions) to the
+# httpd binary at startup, set OPTIONS here.
+#
+#OPTIONS=
+
+#
+# By default, the httpd process is started in the C locale; to 
+# change the locale in which the server runs, the HTTPD_LANG
+# variable can be set.
+#
+#HTTPD_LANG=C
diff --git a/puppet/modules/apache/files/vhosts.d/CentOS/0-default.conf b/puppet/modules/apache/files/vhosts.d/CentOS/0-default.conf
new file mode 100644
index 00000000..a8a84813
--- /dev/null
+++ b/puppet/modules/apache/files/vhosts.d/CentOS/0-default.conf
@@ -0,0 +1,11 @@
+############################################################
+### This file is managed by PUPPET!                     ####
+### Only modify in repo or you will loose the changes!  ####
+############################################################
+
+<VirtualHost *:80>
+    Include include.d/defaults.inc
+    DocumentRoot /var/www/html
+</VirtualHost>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/vhosts.d/Debian/0-default.conf b/puppet/modules/apache/files/vhosts.d/Debian/0-default.conf
new file mode 100644
index 00000000..2cbd90fe
--- /dev/null
+++ b/puppet/modules/apache/files/vhosts.d/Debian/0-default.conf
@@ -0,0 +1,41 @@
+<VirtualHost *:80>
+	ServerAdmin webmaster@localhost
+	
+	DocumentRoot /var/www/
+	<Directory />
+		Options FollowSymLinks
+		AllowOverride None
+	</Directory>
+	<Directory /var/www/>
+		Options Indexes FollowSymLinks MultiViews
+		AllowOverride None
+		Order allow,deny
+		allow from all
+	</Directory>
+
+	ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
+	<Directory "/usr/lib/cgi-bin">
+		AllowOverride None
+		Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
+		Order allow,deny
+		Allow from all
+	</Directory>
+
+	ErrorLog /var/log/apache2/error.log
+
+	# Possible values include: debug, info, notice, warn, error, crit,
+	# alert, emerg.
+	LogLevel warn
+
+	CustomLog /var/log/apache2/access.log combined
+
+    Alias /doc/ "/usr/share/doc/"
+    <Directory "/usr/share/doc/">
+        Options Indexes MultiViews FollowSymLinks
+        AllowOverride None
+        Order deny,allow
+        Deny from all
+        Allow from 127.0.0.0/255.0.0.0 ::1/128
+    </Directory>
+
+</VirtualHost>
diff --git a/puppet/modules/apache/files/vhosts.d/Gentoo/0-default.conf b/puppet/modules/apache/files/vhosts.d/Gentoo/0-default.conf
new file mode 100644
index 00000000..03468459
--- /dev/null
+++ b/puppet/modules/apache/files/vhosts.d/Gentoo/0-default.conf
@@ -0,0 +1,51 @@
+# ###########################################################
+# ### this file is managed by PUPPET                     ####
+# ### only modify in svn or you will loose the changes ! ####
+# ###########################################################
+# Virtual Hosts
+#
+# If you want to maintain multiple domains/hostnames on your
+# machine you can setup VirtualHost containers for them. Most configurations
+# use only name-based virtual hosts so the server doesn't need to worry about
+# IP addresses. This is indicated by the asterisks in the directives below.
+#
+# Please see the documentation at
+# <URL:http://httpd.apache.org/docs/2.2/vhosts/>
+# for further details before you try to setup virtual hosts.
+#
+# You may use the command line option '-S' to verify your virtual host
+# configuration.
+
+<IfDefine DEFAULT_VHOST>
+# see bug #178966 why this is in here
+
+# Listen: Allows you to bind Apache to specific IP addresses and/or
+# ports, instead of the default. See also the <VirtualHost>
+# directive.
+#
+# Change this to Listen on specific IP addresses as shown below to
+# prevent Apache from glomming onto all bound IP addresses.
+#
+#Listen 12.34.56.78:80
+Listen 80
+
+# Use name-based virtual hosting.
+NameVirtualHost *:80
+
+# When virtual hosts are enabled, the main host defined in the default
+# httpd.conf configuration will go away. We redefine it here so that it is
+# still available.
+#
+# If you disable this vhost by removing -D DEFAULT_VHOST from
+# /etc/conf.d/apache2, the first defined virtual host elsewhere will be
+# the default.
+<VirtualHost *:80>
+	Include /etc/apache2/vhosts.d/default_vhost.include
+
+	<IfModule mpm_peruser_module>
+		ServerEnvironment apache apache
+	</IfModule>
+</VirtualHost>
+</IfDefine>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/vhosts.d/Gentoo/default_vhost.include b/puppet/modules/apache/files/vhosts.d/Gentoo/default_vhost.include
new file mode 100644
index 00000000..590c1848
--- /dev/null
+++ b/puppet/modules/apache/files/vhosts.d/Gentoo/default_vhost.include
@@ -0,0 +1,79 @@
+# ###########################################################
+# # copyleft 2008 immerda.ch
+# ###########################################################
+# ### this file is managed by PUPPET                     ####
+# ### only modify in svn or you will loose the changes ! ####
+# ###########################################################
+# ServerAdmin: Your address, where problems with the server should be
+# e-mailed.  This address appears on some server-generated pages, such
+# as error documents.  e.g. admin@your-domain.com
+ServerAdmin root@localhost
+
+# DocumentRoot: The directory out of which you will serve your
+# documents. By default, all requests are taken from this directory, but
+# symbolic links and aliases may be used to point to other locations.
+#
+# If you change this to something that isn't under /var/www then suexec
+# will no longer work.
+DocumentRoot "/var/www/localhost/htdocs"
+
+# This should be changed to whatever you set DocumentRoot to.
+<Directory "/var/www/localhost/htdocs">
+	# Possible values for the Options directive are "None", "All",
+	# or any combination of:
+	#   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
+	#
+	# Note that "MultiViews" must be named *explicitly* --- "Options All"
+	# doesn't give it to you.
+	#
+	# The Options directive is both complicated and important.  Please see
+	# http://httpd.apache.org/docs/2.2/mod/core.html#options
+	# for more information.
+	Options Indexes FollowSymLinks
+
+	# AllowOverride controls what directives may be placed in .htaccess files.
+	# It can be "All", "None", or any combination of the keywords:
+	#   Options FileInfo AuthConfig Limit
+	AllowOverride All
+
+	# Controls who can get stuff from this server.
+	Order allow,deny
+	Allow from all
+</Directory>
+
+<IfModule alias_module>
+	# Redirect: Allows you to tell clients about documents that used to
+	# exist in your server's namespace, but do not anymore. The client
+	# will make a new request for the document at its new location.
+	# Example:
+	#   Redirect permanent /foo http://www.example.com/bar
+
+	# Alias: Maps web paths into filesystem paths and is used to
+	# access content that does not live under the DocumentRoot.
+	# Example:
+	#   Alias /webpath /full/filesystem/path
+	#
+	# If you include a trailing / on /webpath then the server will
+	# require it to be present in the URL.  You will also likely
+	# need to provide a <Directory> section to allow access to
+	# the filesystem path.
+
+	# ScriptAlias: This controls which directories contain server scripts.
+	# ScriptAliases are essentially the same as Aliases, except that
+	# documents in the target directory are treated as applications and
+	# run by the server when requested rather than as documents sent to the
+	# client.  The same rules about trailing "/" apply to ScriptAlias
+	# directives as to Alias.
+	ScriptAlias /cgi-bin/ "/var/www/localhost/cgi-bin/"
+</IfModule>
+
+# "/var/www/localhost/cgi-bin" should be changed to whatever your ScriptAliased
+# CGI directory exists, if you have that configured.
+<Directory "/var/www/localhost/cgi-bin">
+	AllowOverride None
+	Options None
+	Order allow,deny
+	Allow from all
+</Directory>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/files/vhosts.d/OpenBSD/0-default.conf b/puppet/modules/apache/files/vhosts.d/OpenBSD/0-default.conf
new file mode 100644
index 00000000..9c4aa9d5
--- /dev/null
+++ b/puppet/modules/apache/files/vhosts.d/OpenBSD/0-default.conf
@@ -0,0 +1,8 @@
+<VirtualHost *:80>
+    Include include.d/defaults.inc
+
+    DocumentRoot /var/www/htdocs/default/www/
+    ErrorLog /var/www/htdocs/default/logs/default_error_log
+    CustomLog /var/www/htdocs/default/logs/default_access_log combined
+</VirtualHost>
+
diff --git a/puppet/modules/apache/lib/facter/apache_version.rb b/puppet/modules/apache/lib/facter/apache_version.rb
new file mode 100644
index 00000000..f0521832
--- /dev/null
+++ b/puppet/modules/apache/lib/facter/apache_version.rb
@@ -0,0 +1,28 @@
+# determine the version of apache installed
+ 
+def parse_version(version_string)
+  version = ""
+  version_string.each_line do |line|
+    if line.match(/^Server version/)
+      version = line.scan(/Apache\/(.*) /)[0][0]
+    end
+  end
+  return version
+end
+ 
+Facter.add('apache_version') do
+  setcode do
+    case Facter.value('osfamily')
+    when /RedHat/
+      if File.exists?('/usr/sbin/httpd')
+        version = parse_version(%x(/usr/sbin/httpd -v))
+      end
+    when /Debian/
+      if File.exists?('/usr/sbin/apache2')
+        version = parse_version(%x(/usr/sbin/apache2 -v))
+      end
+    else
+      version = 'undef'
+    end
+  end
+end
diff --git a/puppet/modules/apache/lib/puppet/parser/functions/guess_apache_version.rb b/puppet/modules/apache/lib/puppet/parser/functions/guess_apache_version.rb
new file mode 100644
index 00000000..7537f6d9
--- /dev/null
+++ b/puppet/modules/apache/lib/puppet/parser/functions/guess_apache_version.rb
@@ -0,0 +1,39 @@
+# Try to guess the version of apache to be installed.
+# Certain apache modules depend on each other, so we
+# need to evaluate the apache version before it gets
+# installed. This function decides which apache version
+# is going to be installed based on the `operatingsystemrelease`
+# fact.
+module Puppet::Parser::Functions
+  newfunction(:guess_apache_version, :type => :rvalue) do |args|
+    release = lookupvar('operatingsystemrelease')
+    unknown = 'unknown'
+
+    case lookupvar('operatingsystem')
+
+      when 'Debian'
+        case release
+          when /^7.*/
+            version = '2.2'
+          when /^8.*/
+            version = '2.4'
+          else
+            version = unknown
+        end
+
+      when 'Ubuntu'
+        case release
+          when /(12.04|12.10|13.04|13.10)/
+            version = '2.2'
+          when /(14.04|14.10|15.04|15.10|16.04)/
+            version = '2.4'
+          else
+            version = unknown
+        end
+
+      else
+        version = unknown
+    end
+    version
+  end
+end
diff --git a/puppet/modules/apache/lib/puppet/parser/functions/htpasswd_sha1.rb b/puppet/modules/apache/lib/puppet/parser/functions/htpasswd_sha1.rb
new file mode 100644
index 00000000..937621d9
--- /dev/null
+++ b/puppet/modules/apache/lib/puppet/parser/functions/htpasswd_sha1.rb
@@ -0,0 +1,8 @@
+require 'digest/sha1' 
+require 'base64'
+
+module Puppet::Parser::Functions
+  newfunction(:htpasswd_sha1, :type => :rvalue) do |args|
+    "{SHA}" + Base64.encode64(Digest::SHA1.digest(args[0]))
+  end
+end
diff --git a/puppet/modules/apache/manifests/base.pp b/puppet/modules/apache/manifests/base.pp
new file mode 100644
index 00000000..3f921599
--- /dev/null
+++ b/puppet/modules/apache/manifests/base.pp
@@ -0,0 +1,75 @@
+# setup base apache class
+class apache::base {
+  file{
+    'vhosts_dir':
+      ensure  => directory,
+      path    => '/etc/apache2/vhosts.d',
+      purge   => true,
+      recurse => true,
+      force   => true,
+      notify  => Service['apache'],
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+    'config_dir':
+      ensure  => directory,
+      path    => '/etc/apache2/conf.d',
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+    'include_dir':
+      ensure  => directory,
+      path    => '/etc/apache2/include.d',
+      purge   => true,
+      recurse => true,
+      force   => true,
+      notify  => Service['apache'],
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+    'modules_dir':
+      ensure  => directory,
+      path    => '/etc/apache2/modules.d',
+      purge   => true,
+      recurse => true,
+      force   => true,
+      notify  => Service['apache'],
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+    'htpasswd_dir':
+      ensure  => directory,
+      path    => '/var/www/htpasswds',
+      purge   => true,
+      recurse => true,
+      force   => true,
+      notify  => Service['apache'],
+      owner   => root,
+      group   => 'apache',
+      mode    => '0640';
+    'web_dir':
+      ensure  => directory,
+      path    => '/var/www',
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+    'default_apache_index':
+      path    => '/var/www/localhost/htdocs/index.html',
+      content => template('apache/default/default_index.erb'),
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+  } -> anchor{'apache::basic_dirs::ready': }
+
+  apache::config::include{ 'defaults.inc': }
+  apache::config::global{ 'git.conf': }
+  if !$apache::no_default_site {
+    apache::vhost::file { '0-default': }
+  }
+
+  service{'apache':
+    ensure => running,
+    name   => 'apache2',
+    enable => true,
+  }
+}
diff --git a/puppet/modules/apache/manifests/base/itk.pp b/puppet/modules/apache/manifests/base/itk.pp
new file mode 100644
index 00000000..7772bfdf
--- /dev/null
+++ b/puppet/modules/apache/manifests/base/itk.pp
@@ -0,0 +1,6 @@
+class apache::base::itk inherits apache::base {
+    File['htpasswd_dir']{
+        group => 0,
+        mode => 0644,
+    }
+}
diff --git a/puppet/modules/apache/manifests/centos.pp b/puppet/modules/apache/manifests/centos.pp
new file mode 100644
index 00000000..f4697155
--- /dev/null
+++ b/puppet/modules/apache/manifests/centos.pp
@@ -0,0 +1,86 @@
+### centos
+class apache::centos inherits apache::package {
+  $config_dir = '/etc/httpd'
+
+  Package[apache]{
+    name => 'httpd',
+  }
+  Service[apache]{
+    name    => 'httpd',
+    restart => '/etc/init.d/httpd graceful',
+  }
+  File[vhosts_dir]{
+    path => "${config_dir}/vhosts.d",
+  }
+  File[config_dir]{
+    path => "${config_dir}/conf.d",
+  }
+  File[include_dir]{
+    path => "${config_dir}/include.d",
+  }
+  File[modules_dir]{
+    path => "${config_dir}/modules.d",
+  }
+  File[web_dir]{
+    path => '/var/www/vhosts',
+  }
+  File[default_apache_index]{
+    path => '/var/www/html/index.html',
+  }
+
+  if str2bool($::selinux) {
+    Selinux::Fcontext{
+      before => File[web_dir],
+    }
+    $seltype_rw = $::operatingsystemmajrelease ? {
+      5       => 'httpd_sys_script_rw_t',
+      default => 'httpd_sys_rw_content_t'
+    }
+    selinux::fcontext{
+      [ '/var/www/vhosts/[^/]*/www(/.*)?',
+        '/var/www/vhosts/[^/]*/non_public(/.*)?',
+        '/var/www/vhosts/[^/]*/data(/.*)?',
+        '/var/www/vhosts/[^/]*/upload(/.*)?' ]:
+        require => Package['apache'],
+        setype  => $seltype_rw;
+      '/var/www/vhosts/[^/]*/logs(/.*)?':
+        require => Package['apache'],
+        setype  => 'httpd_log_t';
+    }
+  }
+  file{'apache_service_config':
+    path    => '/etc/sysconfig/httpd',
+    source  => [  "puppet:///modules/site_apache/service/CentOS/${::fqdn}/httpd",
+                  'puppet:///modules/site_apache/service/CentOS/httpd',
+                  'puppet:///modules/apache/service/CentOS/httpd' ],
+    require => Package['apache'],
+    notify  => Service['apache'],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+
+  # this is for later fixes
+  exec{
+    'adjust_pidfile':
+      command => 'sed -i  "s/^#PidFile \(.*\)/PidFile \1/g" /etc/httpd/conf/httpd.conf',
+      unless  => 'grep -qE \'^PidFile \' /etc/httpd/conf/httpd.conf',
+      require => Package['apache'],
+      notify  => Service['apache'];
+    'adjust_listen':
+      command => 'sed -i  "s/^#Listen 80/Listen 80/g" /etc/httpd/conf/httpd.conf',
+      unless  => 'grep -qE \'^Listen 80\' /etc/httpd/conf/httpd.conf',
+      require => Package['apache'],
+      notify  => Service['apache'];
+  }
+
+  apache::config::global{'00-listen.conf':
+    ensure => absent,
+  }
+
+  include apache::logrotate::centos
+
+  apache::config::global{ 'welcome.conf': }
+  apache::config::global{ 'vhosts.conf': }
+}
+
diff --git a/puppet/modules/apache/manifests/centos/itk.pp b/puppet/modules/apache/manifests/centos/itk.pp
new file mode 100644
index 00000000..20f4270d
--- /dev/null
+++ b/puppet/modules/apache/manifests/centos/itk.pp
@@ -0,0 +1,10 @@
+# http://hostby.net/home/2008/07/12/centos-5-and-mpm-itk/
+class apache::centos::itk inherits apache::centos {
+    include ::apache::base::itk
+    Package['apache']{
+        name => 'httpd-itk',
+    }
+    File['apache_service_config']{
+      source => "puppet:///modules/apache/service/${::operatingsystem}/httpd.itk"
+    }
+}
diff --git a/puppet/modules/apache/manifests/centos/itk_plus.pp b/puppet/modules/apache/manifests/centos/itk_plus.pp
new file mode 100644
index 00000000..0df92c84
--- /dev/null
+++ b/puppet/modules/apache/manifests/centos/itk_plus.pp
@@ -0,0 +1,20 @@
+# http://hostby.net/home/2008/07/12/centos-5-and-mpm-itk/
+class apache::centos::itk_plus inherits apache::centos::itk {
+  Exec['adjust_pidfile']{
+    command => "sed -i  's/^PidFile \\(.*\\)/#PidFile \\1/g' /etc/httpd/conf/httpd.conf",
+    unless => "grep -qE '^#PidFile ' /etc/httpd/conf/httpd.conf",
+  }
+  Exec['adjust_listen']{
+    command => "sed -i  's/^Listen 80/#Listen 80/g' /etc/httpd/conf/httpd.conf",
+    unless => "grep -qE '^#Listen 80' /etc/httpd/conf/httpd.conf",
+  }
+
+  Apache::Config::Global['00-listen.conf']{
+    ensure => 'present',
+    content => template("apache/itk_plus/${::operatingsystem}/00-listen.conf.erb"),
+  }
+
+  File['apache_service_config']{
+    source => "puppet:///modules/apache/service/CentOS/httpd.itk_plus"
+  }
+}
diff --git a/puppet/modules/apache/manifests/centos/module.pp b/puppet/modules/apache/manifests/centos/module.pp
new file mode 100644
index 00000000..3220d1f8
--- /dev/null
+++ b/puppet/modules/apache/manifests/centos/module.pp
@@ -0,0 +1,30 @@
+define apache::centos::module(
+    $ensure = present,
+    $source = '',
+    $destination = ''
+){
+    $modules_dir = "${apache::centos::config_dir}/modules.d"
+    $real_destination = $destination ? {
+        '' => "${modules_dir}/${name}.so",
+        default => $destination,
+    }
+    $real_source = $source ? {
+        ''  => [
+            "puppet:///modules/site_apache/modules.d/${::fqdn}/${name}.so",
+            "puppet:///modules/site_apache/modules.d/${apache::cluster_node}/${name}.so",
+            "puppet:///modules/site_apache/modules.d/${name}.so",
+            "puppet:///modules/apache/modules.d/${::operatingsystem}/${name}.so",
+            "puppet:///modules/apache/modules.d/${name}.so"
+        ],
+        default => "puppet:///$source",
+    }
+    file{"modules_${name}.conf":
+        ensure => $ensure,
+        path => $real_destination,
+        source => $real_source,
+        require => [ File[modules_dir], Package[apache] ],
+        notify => Service[apache],
+        owner => root, group => 0, mode => 0755;
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/centos/worker.pp b/puppet/modules/apache/manifests/centos/worker.pp
new file mode 100644
index 00000000..f374bb70
--- /dev/null
+++ b/puppet/modules/apache/manifests/centos/worker.pp
@@ -0,0 +1,5 @@
+class apache::centos::worker inherits apache::centos {
+    File['apache_service_config']{
+      source => "puppet:///modules/apache/service/${::operatingsystem}/httpd.worker"
+    }
+}
diff --git a/puppet/modules/apache/manifests/config/file.pp b/puppet/modules/apache/manifests/config/file.pp
new file mode 100644
index 00000000..7b058691
--- /dev/null
+++ b/puppet/modules/apache/manifests/config/file.pp
@@ -0,0 +1,106 @@
+# deploy apache configuration file
+# by default we assume it's a global configuration file
+define apache::config::file(
+  $ensure     = present,
+  $target     = false,
+  $type       = 'global',
+  $source     = 'absent',
+  $content    = 'absent',
+  $destination = 'absent'
+){
+  case $type {
+    'include': { $confdir = 'include.d' }
+    'global': { $confdir = 'conf.d' }
+    default: { fail("Wrong config file type specified for ${name}") }
+  }
+  $real_destination = $destination ? {
+    'absent'  => $::operatingsystem ? {
+      centos    => "${apache::centos::config_dir}/${confdir}/${name}",
+      gentoo    => "${apache::gentoo::config_dir}/${name}",
+      debian    => "${apache::debian::config_dir}/${confdir}/${name}",
+      ubuntu    => "${apache::ubuntu::config_dir}/${confdir}/${name}",
+      openbsd   => "${apache::openbsd::config_dir}/${confdir}/${name}",
+      default   => "/etc/apache2/${confdir}/${name}",
+    },
+    default => $destination
+  }
+  file{"apache_${name}":
+    ensure  => $ensure,
+    path    => $real_destination,
+    notify  => Service[apache],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+
+  case $ensure {
+    'absent', 'purged': {
+      # We want to avoid all stuff related to source and content
+    }
+    'link': {
+      if $target {
+        File["apache_${name}"] {
+          target => $target,
+        }
+      }
+    }
+    default: {
+      case $content {
+        'absent': {
+          $real_source = $source ? {
+            'absent' => [
+              "puppet:///modules/site_apache/${confdir}/${::fqdn}/${name}",
+              "puppet:///modules/site_apache/${confdir}/${apache::cluster_node}/${name}",
+              "puppet:///modules/site_apache/${confdir}/${::operatingsystem}.${::operatingsystemmajrelease}/${name}",
+              "puppet:///modules/site_apache/${confdir}/${::operatingsystem}/${name}",
+              "puppet:///modules/site_apache/${confdir}/${name}",
+              "puppet:///modules/apache/${confdir}/${::operatingsystem}.${::operatingsystemmajrelease}/${name}",
+              "puppet:///modules/apache/${confdir}/${::operatingsystem}/${name}",
+              "puppet:///modules/apache/${confdir}/${name}"
+            ],
+            default => $source
+          }
+          File["apache_${name}"]{
+            source => $real_source,
+          }
+        }
+        default: {
+          case $content {
+            'absent': {
+              $real_source = $source ? {
+                'absent' => [
+                    "puppet:///modules/site-apache/${confdir}/${::fqdn}/${name}",
+                    "puppet:///modules/site-apache/${confdir}/${apache::cluster_node}/${name}",
+                    "puppet:///modules/site-apache/${confdir}/${::operatingsystem}.${::operatingsystemmajrelease}/${name}",
+                    "puppet:///modules/site-apache/${confdir}/${::operatingsystem}/${name}",
+                    "puppet:///modules/site-apache/${confdir}/${name}",
+                    "puppet:///modules/apache/${confdir}/${::operatingsystem}.${::operatingsystemmajrelease}/${name}",
+                    "puppet:///modules/apache/${confdir}/${::operatingsystem}/${name}",
+                    "puppet:///modules/apache/${confdir}/${name}"
+                ],
+                default => $source,
+              }
+              File["apache_${name}"]{
+                source => $real_source,
+              }
+            }
+            default: {
+              File["apache_${name}"]{
+                content => $content,
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  case $::operatingsystem {
+    openbsd: { info("no package dependency on ${::operatingsystem} for ${name}") }
+    default: {
+      File["apache_${name}"]{
+        require => Package[apache],
+      }
+    }
+  }
+}
diff --git a/puppet/modules/apache/manifests/config/global.pp b/puppet/modules/apache/manifests/config/global.pp
new file mode 100644
index 00000000..8b0389be
--- /dev/null
+++ b/puppet/modules/apache/manifests/config/global.pp
@@ -0,0 +1,18 @@
+# deploy apache configuration file (global)
+# wrapper for apache::config::file
+define apache::config::global(
+    $ensure = present,
+    $target = false,
+    $source = 'absent',
+    $content = 'absent',
+    $destination = 'absent'
+){
+    apache::config::file { "${name}":
+        ensure => $ensure,
+        target => $target,
+        type => 'global',
+        source => $source,
+        content => $content,
+        destination => $destination,
+    }
+}
diff --git a/puppet/modules/apache/manifests/config/include.pp b/puppet/modules/apache/manifests/config/include.pp
new file mode 100644
index 00000000..4d676f05
--- /dev/null
+++ b/puppet/modules/apache/manifests/config/include.pp
@@ -0,0 +1,17 @@
+# deploy apache configuration file (includes for vhosts)
+define apache::config::include(
+    $ensure = present,
+    $target = false,
+    $source = 'absent',
+    $content = 'absent',
+    $destination = 'absent'
+){
+    apache::config::file { "${name}":
+        ensure => $ensure,
+        target => $target,
+        type => 'include',
+        source => $source,
+        content => $content,
+        destination => $destination,
+    }
+}
diff --git a/puppet/modules/apache/manifests/debian.pp b/puppet/modules/apache/manifests/debian.pp
new file mode 100644
index 00000000..6ae4cee8
--- /dev/null
+++ b/puppet/modules/apache/manifests/debian.pp
@@ -0,0 +1,44 @@
+### debian
+class apache::debian inherits apache::package {
+  $config_dir = '/etc/apache2'
+
+  Package[apache] {
+    name => 'apache2',
+  }
+  File[vhosts_dir] {
+    path => "${config_dir}/sites-enabled",
+  }
+  File[modules_dir] {
+    path => "${config_dir}/mods-enabled",
+  }
+  File[htpasswd_dir] {
+    path   => '/var/www/htpasswds',
+    group  => 'www-data',
+  }
+  File[default_apache_index] {
+    path => '/var/www/index.html',
+  }
+  file { 'apache_main_config':
+    path    => "${config_dir}/apache2.conf",
+    source  => [ "puppet:///modules/site_apache/config/Debian.${::lsbdistcodename}/${::fqdn}/apache2.conf",
+                "puppet:///modules/site_apache/config/Debian/${::fqdn}/apache2.conf",
+                "puppet:///modules/site_apache/config/Debian.${::lsbdistcodename}/apache2.conf",
+                'puppet:///modules/site_apache/config/Debian/apache2.conf',
+                "puppet:///modules/apache/config/Debian.${::lsbdistcodename}/${::fqdn}/apache2.conf",
+                "puppet:///modules/apache/config/Debian/${::fqdn}/apache2.conf",
+                "puppet:///modules/apache/config/Debian.${::lsbdistcodename}/apache2.conf",
+                'puppet:///modules/apache/config/Debian/apache2.conf' ],
+    require => Package['apache'],
+    notify  => Service['apache'],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+  apache::config::global{ 'charset': }
+  apache::config::global{ 'security': }
+  file { 'default_debian_apache_vhost':
+    ensure  => absent,
+    path    => '/etc/apache2/sites-enabled/000-default',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/debian/itk.pp b/puppet/modules/apache/manifests/debian/itk.pp
new file mode 100644
index 00000000..718a81b3
--- /dev/null
+++ b/puppet/modules/apache/manifests/debian/itk.pp
@@ -0,0 +1,9 @@
+class apache::debian::itk inherits apache::debian {
+  File['htpasswd_dir']{
+    group => 0,
+    mode => 0644,
+  }
+  Package['apache']{
+    name => 'apache2-mpm-itk',
+  }
+}
diff --git a/puppet/modules/apache/manifests/debian/module.pp b/puppet/modules/apache/manifests/debian/module.pp
new file mode 100644
index 00000000..ed255155
--- /dev/null
+++ b/puppet/modules/apache/manifests/debian/module.pp
@@ -0,0 +1,48 @@
+# install/remove apache module on debian/ubuntu systems
+define apache::debian::module(
+  $ensure = present,
+  $package_name = 'absent',
+  $conf_source = '',
+  $conf_content = '',
+){
+  $modules_dir = "${apache::debian::config_dir}/mods"
+
+  if ($package_name != 'absent') {
+    package { $package_name:
+      ensure  => $ensure,
+      notify  => Service['apache'],
+      require => [ File['modules_dir'], Package['apache'] ],
+    }
+    $required_packages = [ 'apache', $package_name ]
+  }
+  else {
+    $required_packages = [ 'apache' ]
+  }
+
+  file {
+    "${modules_dir}-enabled/${name}.load":
+      ensure  => "../mods-available/${name}.load",
+      notify  => Service['apache'],
+      require => [ File['modules_dir'], Package[$required_packages] ];
+    "${modules_dir}-enabled/${name}.conf":
+      ensure  => "../mods-available/${name}.conf",
+      notify  => Service['apache'],
+      require => [ File['modules_dir'], Package[$required_packages] ];
+    "${modules_dir}-available/${name}.conf":
+      ensure  => file,
+      notify  => Service['apache'],
+      require => [ File['modules_dir'], Package[$required_packages] ];
+  }
+
+  if $conf_content != '' {
+    File["${modules_dir}-available/${name}.conf"] {
+      content => $conf_content,
+    }
+  }
+  elsif $conf_source != '' {
+    File["${modules_dir}-available/${name}.conf"] {
+      source => $conf_source,
+    }
+  }
+
+}
diff --git a/puppet/modules/apache/manifests/defaultdavdbdir.pp b/puppet/modules/apache/manifests/defaultdavdbdir.pp
new file mode 100644
index 00000000..c0e2a81a
--- /dev/null
+++ b/puppet/modules/apache/manifests/defaultdavdbdir.pp
@@ -0,0 +1,17 @@
+class apache::defaultdavdbdir {
+    file {
+        '/var/www/dav_db_dir' :
+            ensure => directory,
+            require => Package['apache'],
+            owner => root,
+            group => 0,
+            mode => 0755 ;
+    }
+    if $::selinux != 'false' {
+        selinux::fcontext {
+            ['/var/www/dav_db_dir/.+(/.*)?'] :
+                setype => 'httpd_var_lib_t',
+                before => File['/var/www/dav_db_dir'] ;
+        }
+    }
+}
diff --git a/puppet/modules/apache/manifests/defaultphpdirs.pp b/puppet/modules/apache/manifests/defaultphpdirs.pp
new file mode 100644
index 00000000..595744bb
--- /dev/null
+++ b/puppet/modules/apache/manifests/defaultphpdirs.pp
@@ -0,0 +1,31 @@
+# setup some directories for php
+class apache::defaultphpdirs {
+    file{
+      '/var/www/upload_tmp_dir':
+        ensure  => directory,
+        require => Package['apache'],
+        owner   => root,
+        group   => 0,
+        mode    => '0755';
+      '/var/www/session.save_path':
+        ensure  => directory,
+        require => Package['apache'],
+        owner   => root,
+        group   => 0,
+        mode    => '0755';
+    }
+
+    if str2bool($::selinux) {
+      $seltype_rw = $::operatingsystemmajrelease ? {
+        5       => 'httpd_sys_script_rw_t',
+        default => 'httpd_sys_rw_content_t'
+      }
+      selinux::fcontext{
+        [ '/var/www/upload_tmp_dir/.+(/.*)?',
+          '/var/www/session.save_path/.+(/.*)?' ]:
+          require => Package['apache'],
+          setype  => $seltype_rw,
+          before  => File['/var/www/upload_tmp_dir','/var/www/session.save_path'];
+      }
+    }
+}
diff --git a/puppet/modules/apache/manifests/file.pp b/puppet/modules/apache/manifests/file.pp
new file mode 100644
index 00000000..b0a60ecb
--- /dev/null
+++ b/puppet/modules/apache/manifests/file.pp
@@ -0,0 +1,15 @@
+define apache::file(
+    $owner = root,
+    $group = 0,
+    $mode = 0640
+) {
+    file{$name:
+# as long as there are significant memory problems using
+# recurse we avoid it
+#        recurse => true,
+        backup => false,
+        checksum => undef,
+        owner => $owner, group => $group, mode => $mode;
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/file/readonly.pp b/puppet/modules/apache/manifests/file/readonly.pp
new file mode 100644
index 00000000..6308d889
--- /dev/null
+++ b/puppet/modules/apache/manifests/file/readonly.pp
@@ -0,0 +1,12 @@
+define apache::file::readonly(
+    $owner = root,
+    $group = 0,
+    $mode = 0640
+) {
+    apache::file{$name:
+        owner => $owner,
+        group => $group,
+        mode => $mode,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/file/rw.pp b/puppet/modules/apache/manifests/file/rw.pp
new file mode 100644
index 00000000..0f258bf3
--- /dev/null
+++ b/puppet/modules/apache/manifests/file/rw.pp
@@ -0,0 +1,13 @@
+# a file that is writable by apache
+define apache::file::rw(
+  $owner  = root,
+  $group  = 0,
+  $mode   = '0660',
+) {
+  apache::file{$name:
+    owner => $owner,
+    group => $group,
+    mode  => $mode,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/gentoo.pp b/puppet/modules/apache/manifests/gentoo.pp
new file mode 100644
index 00000000..3a13977f
--- /dev/null
+++ b/puppet/modules/apache/manifests/gentoo.pp
@@ -0,0 +1,39 @@
+### gentoo
+class apache::gentoo inherits apache::package {
+  $config_dir = '/etc/apache2'
+
+  # needs module gentoo
+  gentoo::etcconfd {
+    'apache2':
+      require => Package['apache'],
+      notify  => Service['apache'],
+  }
+  Package['apache']{
+    category => 'www-servers',
+  }
+  File[vhosts_dir]{
+    path => "${config_dir}/vhosts.d",
+  }
+  File[modules_dir]{
+    path => "${config_dir}/modules.d",
+  }
+
+  apache::gentoo::module{
+    '00_default_settings':;
+    '00_error_documents':;
+  }
+  apache::config::file { 'default_vhost.include':
+      source      => 'apache/vhosts.d/default_vhost.include',
+      destination => "${config_dir}/vhosts.d/default_vhost.include",
+  }
+
+  # set the default for the ServerName
+  file{"${config_dir}/modules.d/00_default_settings_ServerName.conf":
+      content => "ServerName ${::fqdn}\n",
+      require => Package[apache],
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/gentoo/module.pp b/puppet/modules/apache/manifests/gentoo/module.pp
new file mode 100644
index 00000000..1e9d03a6
--- /dev/null
+++ b/puppet/modules/apache/manifests/gentoo/module.pp
@@ -0,0 +1,30 @@
+define apache::gentoo::module(
+    $ensure = present,
+    $source = '',
+    $destination = ''
+){
+    $modules_dir = "${apache::gentoo::config_dir}/modules.d"
+    $real_destination = $destination ? {
+        '' => "${modules_dir}/${name}.conf",
+        default => $destination,
+    }
+    $real_source = $source ? {
+        ''  => [
+            "puppet:///modules/site_apache/modules.d/${::fqdn}/${name}.conf",
+            "puppet:///modules/site_apache/modules.d/${apache::cluster_node}/${name}.conf",
+            "puppet:///modules/site_apache/modules.d/${name}.conf",
+            "puppet:///modules/apache/modules.d/${::operatingsystem}/${name}.conf",
+            "puppet:///modules/apache/modules.d/${name}.conf"
+        ],
+        default => "puppet:///$source",
+    }
+    file{"modules_${name}.conf":
+        ensure => $ensure,
+        path => $real_destination,
+        source => $real_source,
+        require => [ File[modules_dir], Package[apache] ],
+        notify => Service[apache],
+        owner => root, group => 0, mode => 0644;
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/htpasswd_user.pp b/puppet/modules/apache/manifests/htpasswd_user.pp
new file mode 100644
index 00000000..82fbce45
--- /dev/null
+++ b/puppet/modules/apache/manifests/htpasswd_user.pp
@@ -0,0 +1,34 @@
+# ToDo: This should be rewritten as native type
+define apache::htpasswd_user(
+    $password,
+    $password_iscrypted = false,
+    $ensure   = 'present',
+    $site     = 'absent',
+    $username = 'absent',
+    $path     = 'absent'
+){
+    case $username {
+        'absent': { $real_username = $name }
+        default: { $real_username = $username }
+    }
+    case $site {
+        'absent': { $real_site = $name }
+        default: { $real_site = $site }
+    }
+    if $password_iscrypted {
+        $real_password = $password
+    } else {
+        $real_password = htpasswd_sha1($password)
+    }
+
+    case $path {
+        'absent': { $real_path = "/var/www/htpasswds/${real_site}" }
+        default:  { $real_path = $path }
+    }
+
+    file_line{"htpasswd_for_${real_site}":
+        ensure => $ensure,
+        path   => $real_path,
+        line   => "${username}:${real_password}",
+    }
+}
diff --git a/puppet/modules/apache/manifests/include/joomla.pp b/puppet/modules/apache/manifests/include/joomla.pp
new file mode 100644
index 00000000..5adae30a
--- /dev/null
+++ b/puppet/modules/apache/manifests/include/joomla.pp
@@ -0,0 +1,3 @@
+class apache::include::joomla {
+    apache::config::include{'joomla.inc': }
+}
diff --git a/puppet/modules/apache/manifests/include/mod_fcgid.pp b/puppet/modules/apache/manifests/include/mod_fcgid.pp
new file mode 100644
index 00000000..b3c1cdc2
--- /dev/null
+++ b/puppet/modules/apache/manifests/include/mod_fcgid.pp
@@ -0,0 +1,7 @@
+class apache::include::mod_fcgid {
+  apache::config::global{'mod_fcgid.conf':
+    content => "<IfModule mod_fcgid.c>
+  FcgidFixPathinfo 1
+</IfModule>\n"
+  }
+}
diff --git a/puppet/modules/apache/manifests/include/silverstripe.pp b/puppet/modules/apache/manifests/include/silverstripe.pp
new file mode 100644
index 00000000..fd2484b7
--- /dev/null
+++ b/puppet/modules/apache/manifests/include/silverstripe.pp
@@ -0,0 +1,3 @@
+class apache::include::silverstripe {
+    apache::config::include{'silverstripe.inc': }
+}
diff --git a/puppet/modules/apache/manifests/includes.pp b/puppet/modules/apache/manifests/includes.pp
new file mode 100644
index 00000000..02502f82
--- /dev/null
+++ b/puppet/modules/apache/manifests/includes.pp
@@ -0,0 +1,5 @@
+# manifests/includes.pp
+
+class apache::includes {
+    apache::config::global{'do_includes.conf':}
+}
diff --git a/puppet/modules/apache/manifests/init.pp b/puppet/modules/apache/manifests/init.pp
new file mode 100644
index 00000000..ad1478a1
--- /dev/null
+++ b/puppet/modules/apache/manifests/init.pp
@@ -0,0 +1,44 @@
+#
+# apache module
+#
+# Copyright 2008, admin(at)immerda.ch
+# Copyright 2008, Puzzle ITC GmbH
+# Marcel Haerry haerry+puppet(at)puzzle.ch
+# Simon Josi josi+puppet(at)puzzle.ch
+#
+# This program is free software; you can redistribute
+# it and/or modify it under the terms of the GNU
+# General Public License version 3 as published by
+# the Free Software Foundation.
+#
+
+# manage a simple apache
+class apache(
+  $cluster_node                       = '',
+  $manage_shorewall                   = false,
+  $manage_munin                       = false,
+  $no_default_site                    = false,
+  $ssl                                = false,
+  $default_ssl_certificate_file       = absent,
+  $default_ssl_certificate_key_file   = absent,
+  $default_ssl_certificate_chain_file = absent,
+  $ssl_cipher_suite                   = 'HIGH:MEDIUM:!aNULL:!MD5'
+) {
+  case $::operatingsystem {
+    centos: { include apache::centos }
+    gentoo: { include apache::gentoo }
+    debian,ubuntu: { include apache::debian }
+    openbsd: { include apache::openbsd }
+    default: { include apache::base }
+  }
+  if $apache::manage_munin {
+    include apache::status
+  }
+  if $apache::manage_shorewall {
+    include shorewall::rules::http
+  }
+  if $ssl {
+    include apache::ssl
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/itk.pp b/puppet/modules/apache/manifests/itk.pp
new file mode 100644
index 00000000..5292343d
--- /dev/null
+++ b/puppet/modules/apache/manifests/itk.pp
@@ -0,0 +1,11 @@
+# manifests/itk.pp
+#
+# see: http://mpm-itk.sesse.net/
+
+class apache::itk inherits apache {
+    case $::operatingsystem {
+        centos: { include ::apache::centos::itk }
+        debian: { include ::apache::debian::itk }
+        default: { include ::apache::base::itk }
+    }
+}
diff --git a/puppet/modules/apache/manifests/itk/lock.pp b/puppet/modules/apache/manifests/itk/lock.pp
new file mode 100644
index 00000000..4ad95faf
--- /dev/null
+++ b/puppet/modules/apache/manifests/itk/lock.pp
@@ -0,0 +1,4 @@
+class apache::itk::lock {
+  # This file resource is used to ensure that only one itk mode is used per host
+  file{'/var/www/.itk_mode_lock': ensure => absent }
+}
diff --git a/puppet/modules/apache/manifests/itk_plus.pp b/puppet/modules/apache/manifests/itk_plus.pp
new file mode 100644
index 00000000..7d9f721a
--- /dev/null
+++ b/puppet/modules/apache/manifests/itk_plus.pp
@@ -0,0 +1,10 @@
+# manifests/itk.pp
+#
+# see: http://mpm-itk.sesse.net/
+
+class apache::itk_plus inherits apache::itk {
+    case $::operatingsystem {
+        centos: { include ::apache::centos::itk_plus }
+        default: { fail("itk plus mode is currently only implemented for CentOS") }
+    }
+}
diff --git a/puppet/modules/apache/manifests/itk_plus/lock.pp b/puppet/modules/apache/manifests/itk_plus/lock.pp
new file mode 100644
index 00000000..d540939d
--- /dev/null
+++ b/puppet/modules/apache/manifests/itk_plus/lock.pp
@@ -0,0 +1,4 @@
+class apache::itk_plus::lock {
+  # This file resource is used to ensure that only one itk mode is used per host
+  file{'/var/www/.itk_mode_lock': ensure => absent }
+}
diff --git a/puppet/modules/apache/manifests/logrotate/centos.pp b/puppet/modules/apache/manifests/logrotate/centos.pp
new file mode 100644
index 00000000..4381205d
--- /dev/null
+++ b/puppet/modules/apache/manifests/logrotate/centos.pp
@@ -0,0 +1,10 @@
+# add vhost folders to logrotation
+class apache::logrotate::centos {
+    augeas{'logrotate_httpd':
+      changes => [ 'rm /files/etc/logrotate.d/httpd/rule/file',
+        'ins file before /files/etc/logrotate.d/httpd/rule/*[1]',
+        'set /files/etc/logrotate.d/httpd/rule/file[1] /var/log/httpd/*log' ],
+      onlyif  => 'get /files/etc/logrotate.d/httpd/rule/file[1] != "/var/log/httpd/*log"',
+      require => Package['apache'],
+    }
+}
diff --git a/puppet/modules/apache/manifests/logrotate/centos/vhosts.pp b/puppet/modules/apache/manifests/logrotate/centos/vhosts.pp
new file mode 100644
index 00000000..b1159a11
--- /dev/null
+++ b/puppet/modules/apache/manifests/logrotate/centos/vhosts.pp
@@ -0,0 +1,11 @@
+# add vhost folders to logrotation
+class apache::logrotate::centos::vhosts inherits apache::logrotate::centos {
+    Augeas['logrotate_httpd']{
+      changes => [ 'rm /files/etc/logrotate.d/httpd/rule/file',
+        'ins file before /files/etc/logrotate.d/httpd/rule/*[1]',
+        'ins file before /files/etc/logrotate.d/httpd/rule/*[1]',
+        'set /files/etc/logrotate.d/httpd/rule/file[1] /var/log/httpd/*log',
+        'set /files/etc/logrotate.d/httpd/rule/file[2] /var/www/vhosts/*/logs/*log' ],
+      onlyif => 'get /files/etc/logrotate.d/httpd/rule/file[2] != "/var/www/vhosts/*/logs/*log"',
+    }
+}
diff --git a/puppet/modules/apache/manifests/mod_dav_svn.pp b/puppet/modules/apache/manifests/mod_dav_svn.pp
new file mode 100644
index 00000000..bdcc4abd
--- /dev/null
+++ b/puppet/modules/apache/manifests/mod_dav_svn.pp
@@ -0,0 +1,7 @@
+class apache::mod_dav_svn {
+    package{'mod_dav_svn':
+        ensure => installed,
+        require => Package['apache'],
+        notify => Service['apache'],
+    }
+}
diff --git a/puppet/modules/apache/manifests/mod_macro.pp b/puppet/modules/apache/manifests/mod_macro.pp
new file mode 100644
index 00000000..eed59e52
--- /dev/null
+++ b/puppet/modules/apache/manifests/mod_macro.pp
@@ -0,0 +1,7 @@
+class apache::mod_macro {
+    package{'mod_macro':
+        ensure => installed,
+        require => Package['apache'],
+        notify => Service['apache'],
+    }
+}
diff --git a/puppet/modules/apache/manifests/module.pp b/puppet/modules/apache/manifests/module.pp
new file mode 100644
index 00000000..cbcf2d04
--- /dev/null
+++ b/puppet/modules/apache/manifests/module.pp
@@ -0,0 +1,35 @@
+define apache::module (
+  $ensure = present, $source = '',
+  $destination = '', $module = '', $package_name = 'absent',
+  $conf_content = '', $conf_source = '',
+) {
+
+  $real_module = $module ? {
+    '' => $name,
+    default => $module,
+  }
+
+  case $operatingsystem {
+    'centos': {
+      apache::centos::module { "$real_module":
+        ensure => $ensure, source => $source,
+        destination => $destination
+      }
+    }
+    'gentoo': {
+      apache::gentoo::module { "$real_module":
+        ensure => $ensure, source => $source,
+        destination => $destination
+      }
+    }
+    'debian','ubuntu': {
+      apache::debian::module { "$real_module":
+        ensure => $ensure, package_name => $package_name,
+        conf_content => $conf_content, conf_source => $conf_source
+      }
+    }
+    default: {
+      err('Your operating system does not have a module deployment mechanism defined')
+    }
+  }
+}
diff --git a/puppet/modules/apache/manifests/module/alias.pp b/puppet/modules/apache/manifests/module/alias.pp
new file mode 100644
index 00000000..33d26efe
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/alias.pp
@@ -0,0 +1,14 @@
+# install mod_alias
+class apache::module::alias ( $ensure = present )
+{
+
+  apache::module { 'alias': ensure => $ensure }
+
+  # from 2.4, /etc/apache2/mods-enabled/alias.conf contains the "Require"
+  # directive which needs "authz_core" mod enabled
+
+  if ( guess_apache_version() == '2.4') {
+    class { 'authz_core': ensure => $ensure }
+  }
+
+}
diff --git a/puppet/modules/apache/manifests/module/auth_basic.pp b/puppet/modules/apache/manifests/module/auth_basic.pp
new file mode 100644
index 00000000..4335a09c
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/auth_basic.pp
@@ -0,0 +1,6 @@
+# enable/disable auth_basic module
+class apache::module::auth_basic ( $ensure = present )
+{
+
+  apache::module { 'auth_basic': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/authn_core.pp b/puppet/modules/apache/manifests/module/authn_core.pp
new file mode 100644
index 00000000..46baace0
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/authn_core.pp
@@ -0,0 +1,6 @@
+# enable/disable authn_core module
+class apache::module::authn_core ( $ensure = present )
+{
+
+  apache::module { 'authn_core': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/authn_file.pp b/puppet/modules/apache/manifests/module/authn_file.pp
new file mode 100644
index 00000000..7c346d9b
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/authn_file.pp
@@ -0,0 +1,6 @@
+# enable/disable authn_file module
+class apache::module::authn_file ( $ensure = present )
+{
+
+  apache::module { 'authn_file': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/authz_core.pp b/puppet/modules/apache/manifests/module/authz_core.pp
new file mode 100644
index 00000000..03b0617c
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/authz_core.pp
@@ -0,0 +1,7 @@
+# install mod_authz_core (needed i.e. by the alias mod config)
+class apache::module::authz_core ( $ensure = present )
+{
+
+  apache::module { 'authz_core': ensure => $ensure }
+
+}
diff --git a/puppet/modules/apache/manifests/module/authz_host.pp b/puppet/modules/apache/manifests/module/authz_host.pp
new file mode 100644
index 00000000..46c3a812
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/authz_host.pp
@@ -0,0 +1,6 @@
+# enable/disable authz_host module
+class apache::module::authz_host ( $ensure = present )
+{
+
+  apache::module { 'authz_host': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/authz_user.pp b/puppet/modules/apache/manifests/module/authz_user.pp
new file mode 100644
index 00000000..84775727
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/authz_user.pp
@@ -0,0 +1,6 @@
+# enable/disable authz_user module
+class apache::module::authz_user ( $ensure = present )
+{
+
+  apache::module { 'authz_user': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/cgi.pp b/puppet/modules/apache/manifests/module/cgi.pp
new file mode 100644
index 00000000..ce212e97
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/cgi.pp
@@ -0,0 +1,6 @@
+# enable/disable cgi module
+class apache::module::cgi ( $ensure = present )
+{
+
+  apache::module { 'cgi': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/dir.pp b/puppet/modules/apache/manifests/module/dir.pp
new file mode 100644
index 00000000..da2dc1ee
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/dir.pp
@@ -0,0 +1,6 @@
+# enable/disable dir module
+class apache::module::dir ( $ensure = present )
+{
+
+  apache::module { 'dir': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/env.pp b/puppet/modules/apache/manifests/module/env.pp
new file mode 100644
index 00000000..f358e363
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/env.pp
@@ -0,0 +1,7 @@
+# install mod_env, needed by api.conf
+class apache::module::env ( $ensure = present )
+{
+
+  apache::module { 'env': ensure => $ensure }
+
+}
diff --git a/puppet/modules/apache/manifests/module/expires.pp b/puppet/modules/apache/manifests/module/expires.pp
new file mode 100644
index 00000000..c56f416b
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/expires.pp
@@ -0,0 +1,5 @@
+# enable/disable expires module
+class apache::module::expires ( $ensure = present )
+{
+  apache::module { 'expires': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/headers.pp b/puppet/modules/apache/manifests/module/headers.pp
new file mode 100644
index 00000000..d1d587b0
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/headers.pp
@@ -0,0 +1,6 @@
+# enable/disable headers module
+class apache::module::headers ( $ensure = present )
+{
+
+  apache::module { 'headers': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/mime.pp b/puppet/modules/apache/manifests/module/mime.pp
new file mode 100644
index 00000000..5d691d30
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/mime.pp
@@ -0,0 +1,6 @@
+# enable/disable mime module
+class apache::module::mime ( $ensure = present )
+{
+
+  apache::module { 'mime': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/mpm_event.pp b/puppet/modules/apache/manifests/module/mpm_event.pp
new file mode 100644
index 00000000..a824cb37
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/mpm_event.pp
@@ -0,0 +1,7 @@
+# install mod_mpm_event (needed for jessie hosts)
+class apache::module::mpm_event ( $ensure = present )
+{
+
+  apache::module { 'mpm_event': ensure => $ensure }
+
+}
diff --git a/puppet/modules/apache/manifests/module/mpm_prefork.pp b/puppet/modules/apache/manifests/module/mpm_prefork.pp
new file mode 100644
index 00000000..7c08da7f
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/mpm_prefork.pp
@@ -0,0 +1,6 @@
+# enable/disable mpm_prefork module
+class apache::module::mpm_prefork ( $ensure = present )
+{
+
+  apache::module { 'mpm_prefork': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/negotiation.pp b/puppet/modules/apache/manifests/module/negotiation.pp
new file mode 100644
index 00000000..15334fb9
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/negotiation.pp
@@ -0,0 +1,6 @@
+# enable/disable negotiation module
+class apache::module::negotiation ( $ensure = present )
+{
+
+  apache::module { 'negotiation': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/php5.pp b/puppet/modules/apache/manifests/module/php5.pp
new file mode 100644
index 00000000..ffb571fe
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/php5.pp
@@ -0,0 +1,6 @@
+# enable/disable php5 module
+class apache::module::php5 ( $ensure = present )
+{
+
+  apache::module { 'php5': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/removeip.pp b/puppet/modules/apache/manifests/module/removeip.pp
new file mode 100644
index 00000000..11088fc1
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/removeip.pp
@@ -0,0 +1,6 @@
+# enable/disable removeip module
+class apache::module::removeip ( $ensure = present )
+{
+  package { 'libapache2-mod-removeip': ensure => $ensure }
+  apache::module { 'removeip': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/rewrite.pp b/puppet/modules/apache/manifests/module/rewrite.pp
new file mode 100644
index 00000000..24ef899b
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/rewrite.pp
@@ -0,0 +1,6 @@
+# enable/disable rewrite module
+class apache::module::rewrite ( $ensure = present )
+{
+
+  apache::module { 'rewrite': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/socache_shmcb.pp b/puppet/modules/apache/manifests/module/socache_shmcb.pp
new file mode 100644
index 00000000..4c53adde
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/socache_shmcb.pp
@@ -0,0 +1,6 @@
+# enable/disable socache_shmcb module
+class apache::module::socache_shmcb ( $ensure = present )
+{
+
+  apache::module { 'socache_shmcb': ensure => $ensure }
+}
diff --git a/puppet/modules/apache/manifests/module/status.pp b/puppet/modules/apache/manifests/module/status.pp
new file mode 100644
index 00000000..cfc437ca
--- /dev/null
+++ b/puppet/modules/apache/manifests/module/status.pp
@@ -0,0 +1,6 @@
+# enable/disable status module
+class apache::module::status ( $ensure = present )
+{
+
+  apache::module { 'status': ensure => $present }
+}
diff --git a/puppet/modules/apache/manifests/mozilla_autoconfig.pp b/puppet/modules/apache/manifests/mozilla_autoconfig.pp
new file mode 100644
index 00000000..f16e5ec7
--- /dev/null
+++ b/puppet/modules/apache/manifests/mozilla_autoconfig.pp
@@ -0,0 +1,37 @@
+# setup autoconfig infos
+#
+# this will create a global autoconfig file, that maps
+# any of your hosted domains on this host to a certain
+# provider configuration. Which means, that you get a zero
+# setup autoconfig for any domain that you host the website
+# and the emails for.
+# By default you only need to define the provider, which
+# is usually your main domain. Everything else should be
+# derived from that.
+# You can however still fine tune things from it.
+class apache::mozilla_autoconfig(
+  $provider,
+  $display_name      = undef,
+  $shortname         = undef,
+  $imap_server       = undef,
+  $pop_server        = undef,
+  $smtp_server       = undef,
+  $documentation_url = undef,
+) {
+  apache::config::global { 'mozilla_autoconfig.conf': }
+
+  file{
+    '/var/www/autoconfig':
+      ensure  => directory,
+      require => Package['apache'],
+      owner   => root,
+      group   => apache,
+      mode    => '0640';
+  '/var/www/autoconfig/config.shtml':
+      content => template('apache/webfiles/autoconfig/config.shtml.erb'),
+      owner   => root,
+      group   => apache,
+      mode    => '0640',
+      before  => Service['apache'],
+  }
+}
diff --git a/puppet/modules/apache/manifests/munin.pp b/puppet/modules/apache/manifests/munin.pp
new file mode 100644
index 00000000..46af1723
--- /dev/null
+++ b/puppet/modules/apache/manifests/munin.pp
@@ -0,0 +1,12 @@
+# manage apache monitoring things
+class apache::munin {
+  if $::osfamily == 'Debian' {
+    include perl::extensions::libwww
+  }
+
+  munin::plugin{ [ 'apache_accesses', 'apache_processes', 'apache_volume' ]: }
+  munin::plugin::deploy { 'apache_activity':
+    source  => 'apache/munin/apache_activity',
+    seltype => 'munin_services_plugin_exec_t',
+  }
+}
diff --git a/puppet/modules/apache/manifests/noiplog.pp b/puppet/modules/apache/manifests/noiplog.pp
new file mode 100644
index 00000000..355d7e6a
--- /dev/null
+++ b/puppet/modules/apache/manifests/noiplog.pp
@@ -0,0 +1,5 @@
+class apache::noiplog {
+  apache::config::global{ 'noip_log.conf':
+    content => 'LogFormat "127.0.0.1 - - %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %T %V" noip';
+  }
+}
diff --git a/puppet/modules/apache/manifests/openbsd.pp b/puppet/modules/apache/manifests/openbsd.pp
new file mode 100644
index 00000000..96a216ad
--- /dev/null
+++ b/puppet/modules/apache/manifests/openbsd.pp
@@ -0,0 +1,75 @@
+### openbsd
+class apache::openbsd inherits apache::base {
+  $config_dir = '/var/www'
+
+  File[vhosts_dir]{
+    path => "${config_dir}/vhosts.d",
+  }
+  File[modules_dir]{
+    path => "${config_dir}/conf/modules",
+  }
+  File[config_dir]{
+    path => "${config_dir}/conf.d",
+  }
+  File[include_dir]{
+    path => "${config_dir}/include.d",
+  }
+  File['htpasswd_dir']{
+    group => www,
+  }
+  File[web_dir]{
+    group => daemon,
+  }
+  file_line{'enable_apache_on_boot':
+    path => '/etc/rc.conf.local',
+    line => 'httpd flags=""',
+  }
+  file{'apache_main_config':
+    path    => "${config_dir}/conf/httpd.conf",
+    source  => ["puppet:///modules/site_apache/config/OpenBSD/${::fqdn}/httpd.conf",
+                "puppet:///modules/site_apache/config/OpenBSD/${apache::cluster_node}/httpd.conf",
+                'puppet:///modules/site_apache/config/OpenBSD//httpd.conf',
+                'puppet:///modules/apache/config/OpenBSD/httpd.conf' ],
+    notify  => Service['apache'],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+  File[default_apache_index] {
+    path => '/var/www/htdocs/default/www/index.html',
+  }
+  file{'/opt/bin/restart_apache.sh':
+    source  => 'puppet:///modules/apache/scripts/OpenBSD/bin/restart_apache.sh',
+    require => File['/opt/bin'],
+    owner   => root,
+    group   => 0,
+    mode    => '0700';
+  }
+
+  ::apache::vhost::webdir{'default':
+    datadir => false,
+  }
+
+  Service['apache']{
+    restart => '/opt/bin/restart_apache.sh',
+    status  => 'apachectl status',
+    start   => 'apachectl start',
+    stop    => 'apachectl stop',
+  }
+  file{'/opt/bin/apache_logrotate.sh':
+    source  => 'puppet:///modules/apache/scripts/OpenBSD/bin/apache_logrotate.sh',
+    require => File['/opt/bin'],
+    owner   => root,
+    group   => 0,
+    mode    => '0700';
+  }
+  cron { 'update_apache_logrotation':
+    command => '/bin/sh /opt/bin/apache_logrotate.sh  > /etc/newsyslog_apache.conf',
+    minute  => '1',
+    hour    => '1',
+  }
+  cron { 'run_apache_logrotation':
+    command => '/usr/bin/newsyslog -f /etc/newsyslog_apache.conf > /dev/null',
+    minute  => '10',
+  }
+}
diff --git a/puppet/modules/apache/manifests/package.pp b/puppet/modules/apache/manifests/package.pp
new file mode 100644
index 00000000..3308b371
--- /dev/null
+++ b/puppet/modules/apache/manifests/package.pp
@@ -0,0 +1,32 @@
+# deploy apache as package
+class apache::package inherits apache::base {
+    package { 'apache':
+        name => 'apache',
+        ensure => present,
+    }
+    File['vhosts_dir']{
+        require => Package[apache],
+    }
+    File['config_dir']{
+        require => Package[apache],
+    }
+    Service['apache']{
+        require => Package[apache],
+    }
+    File['default_apache_index']{
+        require => Package[apache],
+    }
+    File['modules_dir']{
+        require => Package[apache],
+    }
+    File['include_dir']{
+        require => Package[apache],
+    }
+    File['web_dir']{
+        require => Package[apache],
+    }
+    File['htpasswd_dir']{
+        require => Package[apache],
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/package/itk.pp b/puppet/modules/apache/manifests/package/itk.pp
new file mode 100644
index 00000000..4ca9960e
--- /dev/null
+++ b/puppet/modules/apache/manifests/package/itk.pp
@@ -0,0 +1,5 @@
+class apache::package::itk inherits apache::package {
+    Package['apache'] {
+        name => 'apache2-itk',
+    }
+}
diff --git a/puppet/modules/apache/manifests/sftponly.pp b/puppet/modules/apache/manifests/sftponly.pp
new file mode 100644
index 00000000..ece726b0
--- /dev/null
+++ b/puppet/modules/apache/manifests/sftponly.pp
@@ -0,0 +1,5 @@
+class apache::sftponly {
+  case $::operatingsystem {
+    centos: { include apache::sftponly::centos }
+  }
+}
diff --git a/puppet/modules/apache/manifests/sftponly/centos.pp b/puppet/modules/apache/manifests/sftponly/centos.pp
new file mode 100644
index 00000000..0f2a43d8
--- /dev/null
+++ b/puppet/modules/apache/manifests/sftponly/centos.pp
@@ -0,0 +1,10 @@
+# manage sftponly group and apache
+# user for access
+class apache::sftponly::centos {
+  require user::groups::sftponly
+  user::groups::manage_user{'apache':
+    group   => 'sftponly',
+    require => Package['apache'],
+    notify  => Service['apache'],
+  }
+}
diff --git a/puppet/modules/apache/manifests/ssl.pp b/puppet/modules/apache/manifests/ssl.pp
new file mode 100644
index 00000000..bfef7adc
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl.pp
@@ -0,0 +1,13 @@
+# manifests/ssl.pp
+
+class apache::ssl {
+  case $::operatingsystem {
+    centos: { include apache::ssl::centos }
+    openbsd: { include apache::ssl::openbsd }
+    debian: { include apache::ssl::debian }
+    defaults: { include apache::ssl::base }
+  }
+  if $apache::manage_shorewall {
+    include shorewall::rules::https
+  }
+}
diff --git a/puppet/modules/apache/manifests/ssl/base.pp b/puppet/modules/apache/manifests/ssl/base.pp
new file mode 100644
index 00000000..3f329136
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl/base.pp
@@ -0,0 +1,15 @@
+# basic defaults for ssl support
+class apache::ssl::base (
+) {
+  apache::config::include {
+    'ssl_defaults.inc':
+      content => template('apache/include.d/ssl_defaults.inc.erb');
+  }
+
+  if !$apache::no_default_site {
+    apache::vhost::file{
+      '0-default_ssl':
+        content => template('apache/vhosts/0-default_ssl.conf.erb');
+    }
+  }
+}
diff --git a/puppet/modules/apache/manifests/ssl/centos.pp b/puppet/modules/apache/manifests/ssl/centos.pp
new file mode 100644
index 00000000..7bc8c895
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl/centos.pp
@@ -0,0 +1,12 @@
+class apache::ssl::centos inherits apache::ssl::base {
+    package { 'mod_ssl':
+        name => 'mod_ssl',
+        ensure => present,
+        require => Package[apache],
+    }
+    ::apache::config::global{ 'ssl.conf': }
+
+    apache::config::global{'00-listen-ssl.conf':
+      ensure => absent,
+    }
+}
diff --git a/puppet/modules/apache/manifests/ssl/debian.pp b/puppet/modules/apache/manifests/ssl/debian.pp
new file mode 100644
index 00000000..99dfe36e
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl/debian.pp
@@ -0,0 +1,4 @@
+class apache::ssl::debian inherits apache::ssl::base {
+    apache::debian::module { 'ssl': ensure => present }
+    apache::config::global { 'ssl.conf': }
+}
diff --git a/puppet/modules/apache/manifests/ssl/itk.pp b/puppet/modules/apache/manifests/ssl/itk.pp
new file mode 100644
index 00000000..5fd3aaf6
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl/itk.pp
@@ -0,0 +1,8 @@
+# manifests/ssl/itk.pp
+
+class apache::ssl::itk inherits apache::ssl {
+    case $::operatingsystem {
+        centos: { include apache::ssl::itk::centos }
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/ssl/itk/centos.pp b/puppet/modules/apache/manifests/ssl/itk/centos.pp
new file mode 100644
index 00000000..fb6a4a6b
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl/itk/centos.pp
@@ -0,0 +1,6 @@
+class apache::ssl::itk::centos inherits apache::ssl::centos {
+    Package['mod_ssl']{
+        name => 'mod_ssl-itk',
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/ssl/itk_plus.pp b/puppet/modules/apache/manifests/ssl/itk_plus.pp
new file mode 100644
index 00000000..0c8e6679
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl/itk_plus.pp
@@ -0,0 +1,6 @@
+class apache::ssl::itk_plus inherits apache::ssl::itk {
+    case $::operatingsystem {
+        centos: { include ::apache::ssl::itk_plus::centos }
+        default: { fail("itk plus mode is currently only implemented for CentOS") }
+    }
+}
diff --git a/puppet/modules/apache/manifests/ssl/itk_plus/centos.pp b/puppet/modules/apache/manifests/ssl/itk_plus/centos.pp
new file mode 100644
index 00000000..00fb4729
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl/itk_plus/centos.pp
@@ -0,0 +1,11 @@
+class apache::ssl::itk_plus::centos inherits apache::ssl::centos {
+  include apache::ssl::itk::centos
+  Apache::Config::Global['ssl.conf']{
+    source => "modules/apache/itk_plus/conf.d/${::operatingsystem}/ssl.conf",
+  }
+
+  Apache::Config::Global['00-listen-ssl.conf']{
+    ensure => 'present',
+    content => template("apache/itk_plus/${::operatingsystem}/00-listen-ssl.conf.erb"),
+  }
+}
diff --git a/puppet/modules/apache/manifests/ssl/openbsd.pp b/puppet/modules/apache/manifests/ssl/openbsd.pp
new file mode 100644
index 00000000..43bc6803
--- /dev/null
+++ b/puppet/modules/apache/manifests/ssl/openbsd.pp
@@ -0,0 +1,18 @@
+class apache::ssl::openbsd inherits apache::openbsd {
+    include apache::ssl::base
+
+    File_line['enable_apache_on_boot']{
+        ensure => 'absent',
+    }
+    file_line{'enable_apachessl_on_boot':
+        path => '/etc/rc.conf.local',
+        line => 'httpd flags="-DSSL"',
+    }
+
+    File['/opt/bin/restart_apache.sh']{
+        source => "puppet:///modules/apache/scripts/OpenBSD/bin/restart_apache_ssl.sh",
+    }
+    Service['apache']{
+        start => 'apachectl startssl',
+    }
+}
diff --git a/puppet/modules/apache/manifests/status.pp b/puppet/modules/apache/manifests/status.pp
new file mode 100644
index 00000000..c5070130
--- /dev/null
+++ b/puppet/modules/apache/manifests/status.pp
@@ -0,0 +1,13 @@
+# enable apache status page
+# manage munin plugins if requested
+class apache::status {
+  case $::operatingsystem {
+    centos: { include apache::status::centos }
+    debian: { include apache::status::debian }
+    defaults: { include apache::status::base }
+  }
+  if $apache::manage_munin {
+    include apache::munin
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/status/base.pp b/puppet/modules/apache/manifests/status/base.pp
new file mode 100644
index 00000000..df6c90b9
--- /dev/null
+++ b/puppet/modules/apache/manifests/status/base.pp
@@ -0,0 +1 @@
+class apache::status::base {}
diff --git a/puppet/modules/apache/manifests/status/centos.pp b/puppet/modules/apache/manifests/status/centos.pp
new file mode 100644
index 00000000..d893707d
--- /dev/null
+++ b/puppet/modules/apache/manifests/status/centos.pp
@@ -0,0 +1,5 @@
+### centos
+class apache::status::centos {
+    ::apache::config::global{ 'status.conf': }
+}
+
diff --git a/puppet/modules/apache/manifests/status/debian.pp b/puppet/modules/apache/manifests/status/debian.pp
new file mode 100644
index 00000000..222b85c7
--- /dev/null
+++ b/puppet/modules/apache/manifests/status/debian.pp
@@ -0,0 +1,4 @@
+# enable status module on debian
+class apache::status::debian {
+  ::apache::debian::module { 'status': }
+}
diff --git a/puppet/modules/apache/manifests/vhost.pp b/puppet/modules/apache/manifests/vhost.pp
new file mode 100644
index 00000000..da1ce901
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost.pp
@@ -0,0 +1,127 @@
+# this is a wrapper for apache::vhost::file and avhost::template below
+#
+# vhost_mode: which option is choosed to deploy the vhost
+#   - template: generate it from a template (default)
+#   - file: deploy a vhost file (apache::vhost::file will be called directly)
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: (*default*) don't activate mod_security
+#    - true: activate mod_security
+#
+define apache::vhost(
+    $ensure                           = present,
+    $configuration                    = {},
+    $path                             = 'absent',
+    $path_is_webdir                   = false,
+    $logpath                          = 'absent',
+    $logmode                          = 'default',
+    $logprefix                        = '',
+    $vhost_mode                       = 'template',
+    $template_partial                 = 'apache/vhosts/static/partial.erb',
+    $vhost_source                     = 'absent',
+    $vhost_destination                = 'absent',
+    $content                          = 'absent',
+    $domain                           = 'absent',
+    $domainalias                      = 'absent',
+    $server_admin                     = 'absent',
+    $allow_override                   = 'None',
+    $php_settings                     = {},
+    $php_options                      = {},
+    $cgi_binpath                      = 'absent',
+    $default_charset                  = 'absent',
+    $do_includes                      = false,
+    $options                          = 'absent',
+    $additional_options               = 'absent',
+    $run_mode                         = 'normal',
+    $run_uid                          = 'absent',
+    $run_gid                          = 'absent',
+    $ssl_mode                         = false,
+    $htpasswd_file                    = 'absent',
+    $htpasswd_path                    = 'absent',
+    $mod_security                     = true,
+    $mod_security_relevantonly        = true,
+    $mod_security_rules_to_disable    = [],
+    $mod_security_additional_options  = 'absent',
+    $use_mod_macro                    = false,
+    $ldap_auth                        = false,
+    $ldap_user                        = 'any',
+    $passing_extension                = 'absent',
+    $gempath                          = 'absent'
+) {
+    # file or template mode?
+    case $vhost_mode {
+        'file': {
+            apache::vhost::file{$name:
+                ensure            => $ensure,
+                configuration     => $configuration,
+                vhost_source      => $vhost_source,
+                vhost_destination => $vhost_destination,
+                do_includes       => $do_includes,
+                run_mode          => $run_mode,
+                mod_security      => $mod_security,
+                htpasswd_file     => $htpasswd_file,
+                htpasswd_path     => $htpasswd_path,
+                use_mod_macro     => $use_mod_macro,
+            }
+        }
+        'template': {
+            apache::vhost::template{$name:
+                ensure                          => $ensure,
+                configuration                   => $configuration,
+                path                            => $path,
+                path_is_webdir                  => $path_is_webdir,
+                logpath                         => $logpath,
+                logmode                         => $logmode,
+                logprefix                       => $logprefix,
+                domain                          => $domain,
+                domainalias                     => $domainalias,
+                server_admin                    => $server_admin,
+                cgi_binpath                     => $cgi_binpath,
+                allow_override                  => $allow_override,
+                do_includes                     => $do_includes,
+                options                         => $options,
+                additional_options              => $additional_options,
+                default_charset                 => $default_charset,
+                php_settings                    => $php_settings,
+                php_options                     => $php_options,
+                run_mode                        => $run_mode,
+                run_uid                         => $run_uid,
+                run_gid                         => $run_gid,
+                template_partial                => $template_partial,
+                ssl_mode                        => $ssl_mode,
+                htpasswd_file                   => $htpasswd_file,
+                htpasswd_path                   => $htpasswd_path,
+                ldap_auth                       => $ldap_auth,
+                ldap_user                       => $ldap_user,
+                mod_security                    => $mod_security,
+                mod_security_relevantonly       => $mod_security_relevantonly,
+                mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+                mod_security_additional_options => $mod_security_additional_options,
+                use_mod_macro                   => $use_mod_macro,
+                passing_extension               => $passing_extension,
+                gempath                         => $gempath,
+            }
+        }
+        default: { fail("No such vhost_mode: ${vhost_mode} defined for ${name}.") }
+    }
+}
diff --git a/puppet/modules/apache/manifests/vhost/davdbdir.pp b/puppet/modules/apache/manifests/vhost/davdbdir.pp
new file mode 100644
index 00000000..459167c9
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/davdbdir.pp
@@ -0,0 +1,40 @@
+define apache::vhost::davdbdir(
+    $ensure = present,
+    $dav_db_dir = 'absent',
+    $documentroot_owner = apache,
+    $documentroot_group = 0,
+    $documentroot_mode = 0750,
+    $run_mode = 'normal',
+    $run_uid = 'absent'
+){
+    # php db dir
+    case $dav_db_dir {
+        'absent': {
+            include apache::defaultdavdbdir
+            $real_dav_db_dir = "/var/www/dav_db_dir/${name}"
+        }
+        default: { $real_dav_db_dir = $dav_db_dir }
+    }
+
+    case $ensure {
+        absent: {
+            file{$real_dav_db_dir:
+                ensure => absent,
+                purge => true,
+                force => true,
+                recurse => true,
+            }
+        }
+        default: {
+            file{$real_dav_db_dir:
+                ensure => directory,
+                owner => $run_mode ? {
+                    'itk' => $run_uid,
+                    default => $documentroot_owner
+                },
+                group => $documentroot_group, mode => $documentroot_mode;
+            }
+        }
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/file.pp b/puppet/modules/apache/manifests/vhost/file.pp
new file mode 100644
index 00000000..686cb1a1
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/file.pp
@@ -0,0 +1,151 @@
+# htpasswd_file: wether to deploy a passwd for this vhost or not
+#   - absent: ignore (default)
+#   - nodeploy: htpasswd file isn't deployed by this mechanism
+#   - else: try to deploy the file
+#
+# htpasswd_path: where to deploy the passwd file
+#   - absent: standardpath (default)
+#   - else: path to deploy
+#
+# ssl_mode: wether this vhost supports ssl or not
+#   - false: don't enable ssl for this vhost (default)
+#   - true: enable ssl for this vhost
+#   - force: enable ssl and redirect non-ssl to ssl
+#   - only: enable ssl only
+#
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+#
+# mod_security: Whether we use mod_security or not
+#               (will include mod_security module)
+#    - false: (*default*) don't activate mod_security
+#    - true: activate mod_security
+#
+define apache::vhost::file(
+    $ensure             = present,
+    $configuration      = {},
+    $vhost_source       = 'absent',
+    $vhost_destination  = 'absent',
+    $content            = 'absent',
+    $do_includes        = false,
+    $run_mode           = 'normal',
+    $logmode            = 'default',
+    $ssl_mode           = false,
+    $mod_security       = false,
+    $htpasswd_file      = 'absent',
+    $htpasswd_path      = 'absent',
+    $use_mod_macro      = false
+){
+    $vhosts_dir = $::operatingsystem ? {
+        centos  => "${apache::centos::config_dir}/vhosts.d",
+        gentoo  => "${apache::gentoo::config_dir}/vhosts.d",
+        debian  => "${apache::debian::config_dir}/sites-enabled",
+        ubuntu  => "${apache::ubuntu::config_dir}/sites-enabled",
+        openbsd => "${apache::openbsd::config_dir}/vhosts.d",
+        default => '/etc/apache2/vhosts.d',
+    }
+    $real_vhost_destination = $vhost_destination ? {
+        'absent'  => "${vhosts_dir}/${name}.conf",
+        default   => $vhost_destination,
+    }
+    file{"${name}.conf":
+        ensure  => $ensure,
+        path    => $real_vhost_destination,
+        require => File[vhosts_dir],
+        notify  => Service[apache],
+        owner   => root,
+        group   => 0,
+        mode    => '0644';
+    }
+    if $ensure != 'absent' {
+      if $do_includes {
+        include ::apache::includes
+      }
+      if $use_mod_macro {
+        include ::apache::mod_macro
+      }
+      case $logmode {
+        'semianonym','anonym': { include apache::noiplog }
+      }
+      case $run_mode {
+        'itk': {
+          include ::apache::itk::lock
+          if $mod_security { include mod_security::itk }
+        }
+        'proxy-itk','static-itk': {
+          include ::apache::itk_plus::lock
+          if $mod_security { include mod_security::itk_plus }
+        }
+        default: {
+          if $mod_security { include mod_security }
+        }
+      }
+
+      case $content {
+        'absent': {
+            $real_vhost_source = $vhost_source ? {
+                'absent'  => [
+                    "puppet:///modules/site_apache/vhosts.d/${::fqdn}/${name}.conf",
+                    "puppet:///modules/site_apache/vhosts.d/${apache::cluster_node}/${name}.conf",
+                    "puppet:///modules/site_apache/vhosts.d/${::operatingsystem}.${::operatingsystemmajrelease}/${name}.conf",
+                    "puppet:///modules/site_apache/vhosts.d/${::operatingsystem}/${name}.conf",
+                    "puppet:///modules/site_apache/vhosts.d/${name}.conf",
+                    "puppet:///modules/apache/vhosts.d/${::operatingsystem}.${::operatingsystemmajrelease}/${name}.conf",
+                    "puppet:///modules/apache/vhosts.d/${::operatingsystem}/${name}.conf",
+                    "puppet:///modules/apache/vhosts.d/${name}.conf"
+                ],
+                default => "puppet:///${vhost_source}",
+            }
+            File["${name}.conf"]{
+                source => $real_vhost_source,
+            }
+        }
+        default: {
+            File["${name}.conf"]{
+                content => $content,
+            }
+        }
+      }
+    }
+    case $htpasswd_file {
+        'absent','nodeploy': { info("don't deploy a htpasswd file for ${name}") }
+        default: {
+            if $htpasswd_path == 'absent' {
+                $real_htpasswd_path = "/var/www/htpasswds/${name}"
+            } else {
+                $real_htpasswd_path = $htpasswd_path
+            }
+            file{$real_htpasswd_path:
+                ensure => $ensure,
+            }
+            if ($ensure!='absent') {
+              File[$real_htpasswd_path]{
+                source  => [ "puppet:///modules/site_apache/htpasswds/${::fqdn}/${name}",
+                            "puppet:///modules/site_apache/htpasswds/${apache::cluster_node}/${name}",
+                            "puppet:///modules/site_apache/htpasswds/${name}" ],
+                owner   => root,
+                group   => 0,
+                mode    => '0644',
+              }
+            }
+        }
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/file/documentrootdir.pp b/puppet/modules/apache/manifests/vhost/file/documentrootdir.pp
new file mode 100644
index 00000000..425406ad
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/file/documentrootdir.pp
@@ -0,0 +1,24 @@
+define apache::vhost::file::documentrootdir(
+      $ensure = directory,
+      $documentroot,
+      $filename,
+      $thedomain,
+      $owner = 'root',
+      $group = '0',
+      $mode = 440
+){
+  file{"$documentroot/$filename":
+    require => Apache::Vhost::Webdir["$thedomain"],
+    owner => $owner, group => $group, mode => $mode;
+  }
+  if $ensure != 'absent' {
+    File["$documentroot/$filename"]{
+      ensure => directory,
+    }
+  } else {
+    File["$documentroot/$filename"]{
+      ensure => $ensure,
+    }
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/file/documentrootfile.pp b/puppet/modules/apache/manifests/vhost/file/documentrootfile.pp
new file mode 100644
index 00000000..c5bc72a1
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/file/documentrootfile.pp
@@ -0,0 +1,27 @@
+# place a file in the documentroot
+define apache::vhost::file::documentrootfile(
+  $documentroot,
+  $filename,
+  $thedomain,
+  $owner        = 'root',
+  $group        = '0',
+  $mode         = '0440',
+){
+    file{"${documentroot}/${filename}":
+        source  => [ "puppet:///modules/site_apache/vhost_varieties/${::fqdn}/${thedomain}/${filename}",
+                    "puppet:///modules/site_apache/vhost_varieties/${apache::cluster_node}/${thedomain}/${filename}",
+                    "puppet:///modules/site_apache/vhost_varieties/${::operatingsystem}.${::operatingsystemmajrelease}/${thedomain}/${filename}",
+                    "puppet:///modules/site_apache/vhost_varieties/${::operatingsystem}/${thedomain}/${filename}",
+                    "puppet:///modules/site_apache/vhost_varieties/${thedomain}/${filename}",
+                    "puppet:///modules/apache/vhost_varieties/${thedomain}/${filename}",
+                    "puppet:///modules/apache/vhost_varieties/${::operatingsystem}.${::operatingsystemmajrelease}/${thedomain}/${filename}",
+                    "puppet:///modules/apache/vhost_varieties/${::operatingsystem}/${thedomain}/${filename}",
+                    "puppet:///modules/apache/vhost_varieties/${thedomain}/${filename}",
+        ],
+        require => Apache::Vhost::Webdir[$thedomain],
+        owner   => $owner,
+        group   => $group,
+        mode    => $mode;
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/gitweb.pp b/puppet/modules/apache/manifests/vhost/gitweb.pp
new file mode 100644
index 00000000..6dd86439
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/gitweb.pp
@@ -0,0 +1,59 @@
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::gitweb(
+    $ensure = present,
+    $configuration = {},
+    $domain = 'absent',
+    $logmode = 'default',
+    $domainalias = 'absent',
+    $server_admin = 'absent',
+    $owner = root,
+    $group = apache,
+    $documentroot_owner = apache,
+    $documentroot_group = 0,
+    $documentroot_mode = 0640,
+    $allow_override = 'None',
+    $template_partial = 'apache/vhosts/gitweb/partial.erb',
+    $do_includes = false,
+    $options = 'absent',
+    $additional_options = 'absent',
+    $default_charset = 'absent',
+    $ssl_mode = false,
+    $htpasswd_file = 'absent',
+    $htpasswd_path = 'absent'
+){
+    # create vhost configuration file
+    ::apache::vhost{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        path => '/var/www/git',
+        path_is_webdir => true,
+        logpath => $::operatingsystem ? {
+            centos => '/var/log/httpd',
+            fedora => '/var/log/httpd',
+            redhat => '/var/log/httpd',
+            openbsd => '/var/www/logs',
+            default => '/var/log/apache2'
+        },
+        logmode => $logmode,
+        template_partial => $template_partial,
+        domain => $domain,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        allow_override => $allow_override,
+        do_includes => $do_includes,
+        options => $options,
+        additional_options => $additional_options,
+        default_charset => $default_charset,
+        run_mode => 'normal',
+        ssl_mode => $ssl_mode,
+        htpasswd_file => $htpasswd_file,
+        htpasswd_path => $htpasswd_path,
+        mod_security => false,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/modperl.pp b/puppet/modules/apache/manifests/vhost/modperl.pp
new file mode 100644
index 00000000..31e46b6f
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/modperl.pp
@@ -0,0 +1,153 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::modperl(
+    $ensure = present,
+    $configuration = configuration,
+    $domain = 'absent',
+    $domainalias = 'absent',
+    $server_admin = 'absent',
+    $logmode = 'default',
+    $path = 'absent',
+    $owner = root,
+    $group = apache,
+    $documentroot_owner = apache,
+    $documentroot_group = 0,
+    $documentroot_mode = 0640,
+    $run_mode = 'normal',
+    $run_uid = 'absent',
+    $run_gid = 'absent',
+    $allow_override = 'None',
+    $cgi_binpath = 'absent',
+    $do_includes = false,
+    $options = 'absent',
+    $additional_options = 'absent',
+    $default_charset = 'absent',
+    $mod_security = true,
+    $mod_security_relevantonly = true,
+    $mod_security_rules_to_disable = [],
+    $mod_security_additional_options = 'absent',
+    $ssl_mode = false,
+    $vhost_mode = 'template',
+    $template_partial = 'apache/vhosts/perl/partial.erb',
+    $vhost_source = 'absent',
+    $vhost_destination = 'absent',
+    $htpasswd_file = 'absent',
+    $htpasswd_path = 'absent'
+){
+    # cgi_bin path
+    case $cgi_binpath {
+        'absent': {
+            $real_path = $path ? {
+                'absent' => $::operatingsystem ? {
+                    openbsd => "/var/www/htdocs/${name}",
+                    default => "/var/www/vhosts/${name}"
+                },
+                default => $path
+            }
+            $real_cgi_binpath = "${real_path}/cgi-bin"
+        }
+        default: { $real_cgi_binpath = $cgi_binpath }
+    }
+
+    file{$real_cgi_binpath:
+        ensure => $ensure ? {
+          'absent' => 'absent',
+          default => directory
+        },
+        owner => $documentroot_owner,
+        group => $documentroot_group,
+        mode => $documentroot_mode;
+    }
+
+    if $ensure != 'absent' {
+      case $run_mode {
+        'proxy-itk','static-itk': {
+          include ::mod_perl::itk_plus
+        }
+        'fcgid': {
+          include ::mod_fcgid
+          include apache::include::mod_fcgid
+
+          # we don't need mod_perl if we run it as fcgid
+          include ::mod_perl::disable
+          mod_fcgid::starter {$name:
+            cgi_type => 'perl',
+            owner => $run_uid,
+            group => $run_gid,
+            notify => Service['apache'],
+          }
+        }
+        default: { include ::mod_perl }
+      }
+    }
+
+    # create webdir
+    ::apache::vhost::webdir{$name:
+        ensure => $ensure,
+        path => $path,
+        owner => $owner,
+        group => $group,
+        run_mode => $run_mode,
+        documentroot_owner => $documentroot_owner,
+        documentroot_group => $documentroot_group,
+        documentroot_mode => $documentroot_mode,
+    }
+
+    # create vhost configuration file
+    ::apache::vhost{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        path => $path,
+        logmode => $logmode,
+        vhost_mode => $vhost_mode,
+        template_partial => $template_partial,
+        vhost_source => $vhost_source,
+        vhost_destination => $vhost_destination,
+        domain => $domain,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        run_mode => $run_mode,
+        run_uid => $run_uid,
+        run_gid => $run_gid,
+        allow_override => $allow_override,
+        do_includes => $do_includes,
+        options => $options,
+        additional_options => $additional_options,
+        default_charset => $default_charset,
+        cgi_binpath => $real_cgi_binpath,
+        ssl_mode => $ssl_mode,
+        htpasswd_file => $htpasswd_file,
+        htpasswd_path => $htpasswd_path,
+        mod_security => $mod_security,
+        mod_security_relevantonly => $mod_security_relevantonly,
+        mod_security_rules_to_disable => $mod_security_rules_to_disable,
+        mod_security_additional_options => $mod_security_additional_options,
+        passing_extension => 'pl'
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/passenger.pp b/puppet/modules/apache/manifests/vhost/passenger.pp
new file mode 100644
index 00000000..46218908
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/passenger.pp
@@ -0,0 +1,139 @@
+# run_uid: the uid the vhost should run as with the mod_passenger module
+# run_gid: the gid the vhost should run as with the mod_passenger module
+#
+# logmode:
+#
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*defaul*) activate mod_security
+#
+define apache::vhost::passenger(
+    $ensure = present,
+    $configuration = {},
+    $domain = 'absent',
+    $domainalias = 'absent',
+    $server_admin = 'absent',
+    $logmode = 'default',
+    $path = 'absent',
+    $manage_webdir = true,
+    $manage_docroot = true,
+    $owner = root,
+    $group = apache,
+    $documentroot_owner = apache,
+    $documentroot_group = 0,
+    $documentroot_mode = 0640,
+    $run_uid = 'absent',
+    $run_gid = 'absent',
+    $allow_override = 'None',
+    $do_includes = false,
+    $options = 'absent',
+    $additional_options = 'absent',
+    $default_charset = 'absent',
+    $mod_security = true,
+    $mod_security_relevantonly = true,
+    $mod_security_rules_to_disable = [],
+    $mod_security_additional_options = 'absent',
+    $ssl_mode = false,
+    $vhost_mode = 'template',
+    $template_partial = 'apache/vhosts/passenger/partial.erb',
+    $vhost_source = 'absent',
+    $vhost_destination = 'absent',
+    $htpasswd_file = 'absent',
+    $htpasswd_path = 'absent',
+    $passenger_ree = false,
+    $passenger_app = 'rails'
+){
+
+    if $passenger_ree {
+      include ::passenger::ree::apache
+    } else {
+      include ::passenger::apache
+    }
+
+    if $manage_webdir {
+      # create webdir
+      ::apache::vhost::webdir{$name:
+        ensure => $ensure,
+        path => $path,
+        owner => $owner,
+        group => $group,
+        mode => 0644,
+        run_mode => 'normal',
+        manage_docroot => $manage_docroot,
+        documentroot_owner => $documentroot_owner,
+        documentroot_group => $run_gid,
+        documentroot_mode => $documentroot_mode,
+      }
+    }
+    $real_path = $path ? {
+        'absent' => $::operatingsystem ? {
+            openbsd => "/var/www/htdocs/${name}",
+            default => "/var/www/vhosts/${name}"
+        },
+        default => $path
+    }
+    file{
+      ["${real_path}/www/tmp", "${real_path}/www/log"]:
+        ensure => directory,
+        owner => $documentroot_owner, group => $run_gid, mode => 0660;
+      ["${real_path}/www/public", "${real_path}/gems"]:
+        ensure => directory,
+        owner => $documentroot_owner, group => $run_gid, mode => 0640;
+    }
+    if $passenger_app == 'rails' {
+      file{
+        "${real_path}/www/config":
+          ensure => directory,
+          owner => $documentroot_owner, group => $run_gid, mode => 0640;
+        "${real_path}/www/config/environment.rb":
+          ensure => present,
+          owner => $run_uid, group => $run_gid, mode => 0640;
+      }
+    } else {
+      #rack based
+      file{
+        "${real_path}/www/config.ru":
+          ensure => present,
+          owner => $run_uid, group => $run_gid, mode => 0640;
+      }
+    }
+
+    # create vhost configuration file
+    ::apache::vhost{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        path => "${real_path}/www/public",
+        path_is_webdir => true,
+        template_partial => $template_partial,
+        logmode => $logmode,
+        logpath => "${real_path}/logs",
+        vhost_mode => $vhost_mode,
+        vhost_source => $vhost_source,
+        vhost_destination => $vhost_destination,
+        domain => $domain,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        run_mode => 'normal',
+        run_uid => $run_uid,
+        run_gid => $run_gid,
+        allow_override => $allow_override,
+        do_includes => $do_includes,
+        options => $options,
+        additional_options => $additional_options,
+        default_charset => $default_charset,
+        ssl_mode => $ssl_mode,
+        htpasswd_file => $htpasswd_file,
+        htpasswd_path => $htpasswd_path,
+        mod_security => $mod_security,
+        mod_security_relevantonly => $mod_security_relevantonly,
+        mod_security_rules_to_disable => $mod_security_rules_to_disable,
+        mod_security_additional_options => $mod_security_additional_options,
+        gempath => "${real_path}/gems"
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/drupal.pp b/puppet/modules/apache/manifests/vhost/php/drupal.pp
new file mode 100644
index 00000000..5b15e6a0
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/drupal.pp
@@ -0,0 +1,144 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# php_safe_mode_exec_bins: An array of local binaries which should be linked in the
+#                          safe_mode_exec_bin for this hosting
+#                          *default*: None
+# php_default_charset: default charset header for php.
+#                      *default*: absent, which will set the same as default_charset
+#                                 of apache
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::php::drupal(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_drupal/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_directories               = true,
+  $config_webwriteable              = false,
+  $manage_config                    = true,
+  $manage_cron                      = true
+){
+  $documentroot = $path ? {
+      'absent' => $::operatingsystem ? {
+          openbsd => "/var/www/htdocs/${name}/www",
+          default => "/var/www/vhosts/${name}/www"
+      },
+      default => "${path}/www"
+  }
+
+  if $manage_cron {
+    if $domain == 'absent' {
+      $real_domain = $name
+    } else {
+      $real_domain = $domain
+    }
+
+    file{"/etc/cron.d/drupal_cron_${name}":
+      content => "0   *   *   *   *   apache wget -O - -q -t 1 http://${real_domain}/cron.php\n",
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+    }
+  }
+
+  $std_drupal_php_settings = {
+    magic_quotes_gpc                => 0,
+    register_globals                => 0,
+    'session.auto_start'            => 0,
+    'mbstring.http_input'           => 'pass',
+    'mbstring.http_output'          => 'pass',
+    'mbstring.encoding_translation' => 0,
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => merge($std_drupal_php_settings, $php_settings),
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => false,
+    manage_config                   => false,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/gallery2.pp b/puppet/modules/apache/manifests/vhost/php/gallery2.pp
new file mode 100644
index 00000000..3acb011d
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/gallery2.pp
@@ -0,0 +1,141 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: (*defaul*) don't activate mod_security
+#    - true: activate mod_security
+#
+# php_safe_mode_exec_bins: An array of local binaries which should be linked in the
+#                          safe_mode_exec_bin for this hosting
+#                          *default*: None
+# php_default_charset: default charset header for php.
+#                      *default*: absent, which will set the same as default_charset
+#                                 of apache
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::gallery2(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = 0640,
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = false,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_gallery2/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+){
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+  $upload_dir = "/var/www/vhosts/${name}/data/upload"
+  $gdata_dir = "/var/www/vhosts/${name}/data/gdata"
+  if $ensure != 'absent' {
+    file{
+      $gdata_dir:
+        ensure  => 'directory',
+        owner   => $documentroot_owner,
+        group   => $documentroot_group,
+        mode    => '0660';
+      $upload_dir:
+        ensure  => 'directory',
+        owner   => $documentroot_owner,
+        group   => $documentroot_group,
+        mode    => '0660';
+    }
+  }
+
+  $gallery_php_settings = {
+    safe_mode        => 'Off',
+    output_buffering => 'Off',
+  }
+  $real_php_settings = merge($gallery_php_settings,$php_settings)
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $real_php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    manage_config                   => $manage_config,
+    config_file                     => 'config.php',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/global_exec_bin_dir.pp b/puppet/modules/apache/manifests/vhost/php/global_exec_bin_dir.pp
new file mode 100644
index 00000000..efcdaf7f
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/global_exec_bin_dir.pp
@@ -0,0 +1,9 @@
+# manage global exec_bin_dir
+class apache::vhost::php::global_exec_bin_dir {
+  file{'/var/www/php_safe_exec_bins':
+    ensure  => directory,
+    owner   => root,
+    group   => apache,
+    mode    => '0640';
+  }
+}
diff --git a/puppet/modules/apache/manifests/vhost/php/joomla.pp b/puppet/modules/apache/manifests/vhost/php/joomla.pp
new file mode 100644
index 00000000..ed0696f8
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/joomla.pp
@@ -0,0 +1,174 @@
+# run_mode: controls in which mode the vhost should be run, there are different
+#           setups possible:
+#   - normal: (*default*) run vhost with the current active worker
+#             (default: prefork) don't setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in
+#          combination with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just
+#                proxies all the requests for the itk setup, that listens only
+#                on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk
+#                setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves
+#                 all the static
+#                 content and proxies the dynamic calls to the itk setup, that
+#                 listens only on the loobpack device
+#                 (Incompatibility: cannot be used in combination with 'itk'
+#                 mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security
+#               module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::joomla(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $php_installation                 = 'system',
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_joomla/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true
+){
+  include ::apache::include::joomla
+
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+
+  if $mod_security_additional_options == 'absent' {
+    $id_str = $::operatingsystem ? {
+      'CentOS'  => $::operatingsystemmajrelease ? {
+        5       => '',
+        default => 'id:1199400,'
+      },
+      default => ''
+    }
+    $real_mod_security_additional_options = "
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"${id_str}allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+"
+  } else {
+    $real_mod_security_additional_options = $mod_security_additional_options
+  }
+
+  $std_joomla_php_settings = {
+    'allow_url_fopen'   => 'on',
+    'allow_url_include' => 'off',
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{
+    $name:
+      ensure                          => $ensure,
+      configuration                   => $configuration,
+      domain                          => $domain,
+      domainalias                     => $domainalias,
+      server_admin                    => $server_admin,
+      logmode                         => $logmode,
+      path                            => $path,
+      owner                           => $owner,
+      group                           => $group,
+      documentroot_owner              => $documentroot_owner,
+      documentroot_group              => $documentroot_group,
+      documentroot_mode               => $documentroot_mode,
+      run_mode                        => $run_mode,
+      run_uid                         => $run_uid,
+      run_gid                         => $run_gid,
+      allow_override                  => $allow_override,
+      php_settings                    => merge($std_joomla_php_settings,
+        $php_settings),
+      php_options                     => $php_options,
+      php_installation                => $php_installation,
+      do_includes                     => $do_includes,
+      options                         => $options,
+      additional_options              => $additional_options,
+      default_charset                 => $default_charset,
+      mod_security                    => $mod_security,
+      mod_security_relevantonly       => $mod_security_relevantonly,
+      mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+      mod_security_additional_options => $real_mod_security_additional_options,
+      ssl_mode                        => $ssl_mode,
+      vhost_mode                      => $vhost_mode,
+      template_partial                => $template_partial,
+      vhost_source                    => $vhost_source,
+      vhost_destination               => $vhost_destination,
+      htpasswd_file                   => $htpasswd_file,
+      htpasswd_path                   => $htpasswd_path,
+      manage_directories              => $manage_directories,
+      managed_directories             => [ "${documentroot}/administrator/backups",
+                                            "${documentroot}/administrator/components",
+                                            "${documentroot}/administrator/language",
+                                            "${documentroot}/administrator/modules",
+                                            "${documentroot}/administrator/templates",
+                                            "${documentroot}/components",
+                                            "${documentroot}/dmdocuments",
+                                            "${documentroot}/images",
+                                            "${documentroot}/language",
+                                            "${documentroot}/media",
+                                            "${documentroot}/modules",
+                                            "${documentroot}/plugins",
+                                            "${documentroot}/templates",
+                                            "${documentroot}/cache",
+                                            "${documentroot}/tmp",
+                                            "${documentroot}/administrator/cache" ],
+      manage_config                   => $manage_config,
+      config_webwriteable             => $config_webwriteable,
+      config_file                     => 'configuration.php',
+  }
+
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/mediawiki.pp b/puppet/modules/apache/manifests/vhost/php/mediawiki.pp
new file mode 100644
index 00000000..25881ca1
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/mediawiki.pp
@@ -0,0 +1,106 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::mediawiki(
+  $ensure = present,
+  $configuration = {},
+  $domain = 'absent',
+  $domainalias = 'absent',
+  $server_admin = 'absent',
+  $logmode = 'default',
+  $path = 'absent',
+  $manage_docroot = true,
+  $owner = root,
+  $group = apache,
+  $documentroot_owner = apache,
+  $documentroot_group = 0,
+  $documentroot_mode = 0640,
+  $run_mode = 'normal',
+  $run_uid = 'absent',
+  $run_gid = 'absent',
+  $allow_override = 'FileInfo Limit',
+  $php_settings = {},
+  $php_options = {},
+  $options = 'absent',
+  $additional_options = 'absent',
+  $default_charset = 'absent',
+  $mod_security = true,
+  $mod_security_relevantonly = true,
+  $mod_security_rules_to_disable = [],
+  $mod_security_additional_options = 'absent',
+  $ssl_mode = false,
+  $vhost_mode = 'template',
+  $template_partial = 'apache/vhosts/php_mediawiki/partial.erb',
+  $vhost_source = 'absent',
+  $vhost_destination = 'absent',
+  $htpasswd_file = 'absent',
+  $htpasswd_path = 'absent'
+){
+
+  $mediawiki_php_settings = {
+    safe_mode => false,
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    manage_docroot                  => $manage_docroot,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => merge($mediawiki_php_settings,$php_settings),
+    php_options                     => $php_options,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => false,
+    manage_config                   => false,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/safe_mode_bin.pp b/puppet/modules/apache/manifests/vhost/php/safe_mode_bin.pp
new file mode 100644
index 00000000..1c82e199
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/safe_mode_bin.pp
@@ -0,0 +1,17 @@
+# safe_mode binaries
+define apache::vhost::php::safe_mode_bin(
+  $ensure = 'present',
+  $path
+){
+  $substr=regsubst($name,'^.*\/','','G')
+  $real_path = "${path}/${substr}"
+  $target = $ensure ? {
+    'present' => regsubst($name,'^.*@',''),
+    default => absent,
+  }
+  file{$real_path:
+    ensure => link,
+    target => $target,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/silverstripe.pp b/puppet/modules/apache/manifests/vhost/php/silverstripe.pp
new file mode 100644
index 00000000..1f19eab4
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/silverstripe.pp
@@ -0,0 +1,119 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::silverstripe(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_silverstripe/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+){
+
+  include ::apache::include::silverstripe
+
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+  $modsec_rules = ['960010']
+  $real_mod_security_rules_to_disable = union($mod_security_rules_to_disable,$modsec_rules)
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    managed_directories             =>  [ "${documentroot}/assets" ],
+    manage_config                   => $manage_config,
+  }
+
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/simplemachine.pp b/puppet/modules/apache/manifests/vhost/php/simplemachine.pp
new file mode 100644
index 00000000..3fa11a77
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/simplemachine.pp
@@ -0,0 +1,125 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::simplemachine(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+){
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    managed_directories             => [
+      "${documentroot}/agreement.txt",
+      "${documentroot}/attachments",
+      "${documentroot}/avatars",
+      "${documentroot}/cache",
+      "${documentroot}/Packages",
+      "${documentroot}/Packages/installed.list",
+      "${documentroot}/Smileys",
+      "${documentroot}/Themes",
+      "${documentroot}/Themes/default/languages/Install.english.php"
+    ],
+    manage_config                   => $manage_config,
+    config_webwriteable             => $config_webwriteable,
+    config_file                     => 'Settings.php',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/spip.pp b/puppet/modules/apache/manifests/vhost/php/spip.pp
new file mode 100644
index 00000000..e33c1dfe
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/spip.pp
@@ -0,0 +1,114 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::spip(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'FileInfo',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $template_partial                 = 'apache/vhosts/php/partial.erb',
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent'
+){
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}/www",
+      default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    managed_directories             => [
+      "${documentroot}/IMG",
+      "${documentroot}/tmp",
+      "${documentroot}/local",
+      "${documentroot}/config"
+    ],
+    manage_config                   => false,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/standard.pp b/puppet/modules/apache/manifests/vhost/php/standard.pp
new file mode 100644
index 00000000..3870707a
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/standard.pp
@@ -0,0 +1,304 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::standard(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $logpath                          = 'absent',
+  $logprefix                        = '',
+  $path                             = 'absent',
+  $manage_webdir                    = true,
+  $path_is_webdir                   = false,
+  $manage_docroot                   = true,
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = 0640,
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $php_installation                 = 'system',
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $use_mod_macro                    = false,
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+){
+
+  if $manage_webdir {
+    # create webdir
+    ::apache::vhost::webdir{$name:
+      ensure              => $ensure,
+      path                => $path,
+      owner               => $owner,
+      group               => $group,
+      run_mode            => $run_mode,
+      manage_docroot      => $manage_docroot,
+      documentroot_owner  => $documentroot_owner,
+      documentroot_group  => $documentroot_group,
+      documentroot_mode   => $documentroot_mode,
+    }
+  }
+
+  $real_path = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}",
+      default => "/var/www/vhosts/${name}"
+    },
+    default   => $path
+  }
+
+  if $path_is_webdir {
+    $documentroot = $real_path
+  } else {
+    $documentroot = "${real_path}/www"
+  }
+  $logdir = $logpath ? {
+    'absent'  => "${real_path}/logs",
+    default   => $logpath
+  }
+
+  $std_php_options = {
+    smarty  => false,
+    pear    => false,
+  }
+  $real_php_options = merge($std_php_options,$php_options)
+
+  if $real_php_options[smarty] {
+    include php::extensions::smarty
+    $smarty_path = '/usr/share/php/Smarty/:'
+  } else {
+    $smarty_path = ''
+  }
+
+  if $real_php_options[pear] {
+    $pear_path = '/usr/share/pear/:'
+  } else {
+    $pear_path = ''
+  }
+
+  if $logmode != 'nologs' {
+    $php_error_log = "${logdir}/php_error_log"
+  } else {
+    $php_error_log = undef
+  }
+
+  if ('safe_mode_exec_dir' in $php_settings) {
+    $php_safe_mode_exec_dir = $php_settings[safe_mode_exec_dir]
+  } else {
+    $php_safe_mode_exec_dir =  $path ? {
+      'absent' => $::operatingsystem ? {
+        openbsd => "/var/www/htdocs/${name}/bin",
+        default => "/var/www/vhosts/${name}/bin"
+      },
+      default   => "${path}/bin"
+    }
+  }
+  file{$php_safe_mode_exec_dir:
+    recurse => true,
+    force   => true,
+    purge   => true,
+  }
+  if ('safe_mode_exec_bins' in $php_options) {
+    $std_php_settings_safe_mode_exec_dir = $php_safe_mode_exec_dir
+    $ensure_exec = $ensure ? {
+      'present'  => directory,
+      default    => 'absent',
+    }
+    File[$php_safe_mode_exec_dir]{
+      ensure => $ensure_exec,
+      owner  => $documentroot_owner,
+      group  => $documentroot_group,
+      mode   => '0750',
+    }
+    $php_safe_mode_exec_bins_subst = regsubst($php_options[safe_mode_exec_bins],'(.+)',"${name}@\\1")
+    apache::vhost::php::safe_mode_bin{
+      $php_safe_mode_exec_bins_subst:
+        ensure  => $ensure,
+        path    => $php_safe_mode_exec_dir;
+    }
+  } else {
+    $std_php_settings_safe_mode_exec_dir = undef
+    File[$php_safe_mode_exec_dir]{
+      ensure => absent,
+    }
+  }
+
+  if !('default_charset' in $php_settings) and ($default_charset != 'absent') {
+    $std_php_settings_default_charset =  $default_charset ? {
+      'On'    => 'iso-8859-1',
+      default => $default_charset
+    }
+  } else {
+    $std_php_settings_default_charset = undef
+  }
+
+  if ('additional_open_basedir' in $php_options) {
+    $the_open_basedir = "${smarty_path}${pear_path}${documentroot}:${real_path}/data:/var/www/upload_tmp_dir/${name}:/var/www/session.save_path/${name}:${php_options[additional_open_basedir]}"
+  } else {
+    $the_open_basedir = "${smarty_path}${pear_path}${documentroot}:${real_path}/data:/var/www/upload_tmp_dir/${name}:/var/www/session.save_path/${name}"
+  }
+
+  if $run_mode == 'fcgid' {
+    $safe_mode_gid = $::operatingsystem ? {
+      debian  => undef,
+      default => $php_installation ? {
+        'system'  => 'On',
+        default   => undef,
+      }
+    }
+  } else {
+    $safe_mode_gid = undef
+  }
+
+  $safe_mode = $::operatingsystem ? {
+    debian  => undef,
+    default => $php_installation ? {
+      'system'  => 'On',
+      default   => undef,
+    }
+  }
+  $std_php_settings = {
+    engine              => 'On',
+    upload_tmp_dir      => "/var/www/upload_tmp_dir/${name}",
+    'session.save_path' => "/var/www/session.save_path/${name}",
+    error_log           => $php_error_log,
+    safe_mode           => $safe_mode,
+    safe_mode_gid       => $safe_mode_gid,
+    safe_mode_exec_dir  => $std_php_settings_safe_mode_exec_dir,
+    default_charset     => $std_php_settings_default_charset,
+    open_basedir        => $the_open_basedir,
+  }
+
+  $real_php_settings = merge($std_php_settings,$php_settings)
+
+  if $ensure != 'absent' {
+    case $run_mode {
+      'proxy-itk','static-itk': {
+        include ::php::itk_plus
+      }
+      'itk': { include ::php::itk }
+      'fcgid': {
+        include ::mod_fcgid
+        include ::php::mod_fcgid
+        include apache::include::mod_fcgid
+
+        mod_fcgid::starter {$name:
+          tmp_dir          => $real_php_settings[php_tmp_dir],
+          cgi_type         => 'php',
+          cgi_type_options => delete($real_php_settings, php_tmp_dir),
+          owner            => $run_uid,
+          group            => $run_gid,
+          notify           => Service['apache'],
+        }
+        if $php_installation == 'scl54' {
+          require php::scl::php54
+          Mod_fcgid::Starter[$name]{
+            binary          => '/opt/rh/php54/root/usr/bin/php-cgi',
+            additional_cmds => 'source /opt/rh/php54/enable',
+            rc              => '/opt/rh/php54/root/etc',
+          }
+        } elsif $php_installation == 'scl55' {
+          require php::scl::php55
+          Mod_fcgid::Starter[$name]{
+            binary          => '/opt/rh/php55/root/usr/bin/php-cgi',
+            additional_cmds => 'source /opt/rh/php55/enable',
+            rc              => '/opt/rh/php55/root/etc',
+          }
+        }
+      }
+      default: { include ::php }
+    }
+  }
+
+  ::apache::vhost::phpdirs{$name:
+    ensure                => $ensure,
+    php_upload_tmp_dir    => $real_php_settings[upload_tmp_dir],
+    php_session_save_path => $real_php_settings['session.save_path'],
+    documentroot_owner    => $documentroot_owner,
+    documentroot_group    => $documentroot_group,
+    documentroot_mode     => $documentroot_mode,
+    run_mode              => $run_mode,
+    run_uid               => $run_uid,
+  }
+
+  # create vhost configuration file
+  ::apache::vhost{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    path                            => $path,
+    path_is_webdir                  => $path_is_webdir,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    logpath                         => $logpath,
+    logprefix                       => $logprefix,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    php_settings                    => $real_php_settings,
+    php_options                     => $real_php_options,
+    ssl_mode                        => $ssl_mode,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    use_mod_macro                   => $use_mod_macro,
+    passing_extension               => 'php',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/typo3.pp b/puppet/modules/apache/manifests/vhost/php/typo3.pp
new file mode 100644
index 00000000..d9e877a6
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/typo3.pp
@@ -0,0 +1,150 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::typo3(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_typo3/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+){
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+        openbsd => "/var/www/htdocs/${name}/www",
+        default => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+
+  $modsec_rules = ['960010']
+  $real_mod_security_rules_to_disable = union($mod_security_rules_to_disable,$modsec_rules)
+  if $mod_security_additional_options == 'absent' {
+  $real_mod_security_additional_options = '
+    <Location "/typo3">
+      SecRuleEngine Off
+      SecAuditEngine Off
+    </Location>
+'
+  } else {
+    $real_mod_security_additional_options = $mod_security_additional_options
+  }
+
+  $typo3_php_settings = {
+    # turn allow_url_fopen on for the extension manager fetch
+    allow_url_fopen => 'On'
+  }
+  $real_php_settings = merge($typo3_php_settings,$php_settings)
+
+  # create vhost configuration file
+  ::apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $real_php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $real_mod_security_rules_to_disable,
+    mod_security_additional_options => $real_mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    managed_directories             =>  [ "${documentroot}/typo3temp",
+                                          "${documentroot}/typo3temp/pics",
+                                          "${documentroot}/typo3temp/temp",
+                                          "${documentroot}/typo3temp/llxml",
+                                          "${documentroot}/typo3temp/cs",
+                                          "${documentroot}/typo3temp/GB",
+                                          "${documentroot}/typo3temp/locks",
+                                          "${documentroot}/typo3conf",
+                                          "${documentroot}/typo3conf/ext",
+                                          "${documentroot}/typo3conf/l10n",
+                                          # "${documentroot}/typo3/ext/", # only needed for ext manager installing global extensions
+                                          "${documentroot}/uploads",
+                                          "${documentroot}/uploads/pics",
+                                          "${documentroot}/uploads/media",
+                                          "${documentroot}/uploads/tf",
+                                          "${documentroot}/fileadmin",
+                                          "${documentroot}/fileadmin/_temp_"
+                                        ],
+    manage_config                   => $manage_config,
+  }
+
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/webapp.pp b/puppet/modules/apache/manifests/vhost/php/webapp.pp
new file mode 100644
index 00000000..695120d0
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/webapp.pp
@@ -0,0 +1,148 @@
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::webapp(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $manage_webdir                    = true,
+  $manage_docroot                   = true,
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'None',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $php_installation                 = 'system',
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial,
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_file                      = 'absent',
+  $config_webwriteable              = false,
+  $manage_directories               = true,
+  $managed_directories              = 'absent',
+){
+  if ($ensure != 'absent') {
+    if $manage_directories and ($managed_directories != 'absent') {
+      ::apache::file::rw{ $managed_directories :
+        owner => $documentroot_owner,
+        group => $documentroot_group,
+      }
+    }
+
+    if $manage_config {
+      if $config_file == 'absent' { fail("No config file defined for ${name} on ${::fqdn}, if you'd like to manage the config, you have to add one!") }
+
+      $real_path = $path ? {
+        'absent' => $::operatingsystem ? {
+          openbsd => "/var/www/htdocs/${name}",
+          default => "/var/www/vhosts/${name}"
+        },
+        default => $path
+      }
+      $documentroot = "${real_path}/www"
+      ::apache::vhost::file::documentrootfile{"configurationfile_${name}":
+        documentroot  => $documentroot,
+        filename      => $config_file,
+        thedomain     => $name,
+        owner         => $documentroot_owner,
+        group         => $documentroot_group,
+      }
+      if $config_webwriteable {
+        Apache::Vhost::File::Documentrootfile["configurationfile_${name}"]{
+          mode => '0660',
+        }
+      } else {
+        Apache::Vhost::File::Documentrootfile["configurationfile_${name}"]{
+          mode => '0440',
+        }
+      }
+    }
+  }
+
+  # create vhost configuration file
+  ::apache::vhost::php::standard{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    manage_webdir                   => $manage_webdir,
+    manage_docroot                  => $manage_docroot,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    php_installation                => $php_installation,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/php/wordpress.pp b/puppet/modules/apache/manifests/vhost/php/wordpress.pp
new file mode 100644
index 00000000..a6bbe434
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/php/wordpress.pp
@@ -0,0 +1,123 @@
+# run_mode: controls in which mode the vhost should be run, there are different
+#           setups #           possible:
+#   - normal: (*default*) run vhost with the current active worker
+#             (default: prefork) don't setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in
+#          combination with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just
+#                proxies all the requests for the itk setup, that listens only
+#                on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk
+#                 setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves
+#                 all the static content and proxies the dynamic calls to the
+#                 itk setup, that listens only on the loobpack device
+#                 (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security
+#               module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+define apache::vhost::php::wordpress(
+  $ensure                           = present,
+  $configuration                    = {},
+  $domain                           = 'absent',
+  $domainalias                      = 'absent',
+  $server_admin                     = 'absent',
+  $logmode                          = 'default',
+  $path                             = 'absent',
+  $owner                            = root,
+  $group                            = apache,
+  $documentroot_owner               = apache,
+  $documentroot_group               = 0,
+  $documentroot_mode                = '0640',
+  $run_mode                         = 'normal',
+  $run_uid                          = 'absent',
+  $run_gid                          = 'absent',
+  $allow_override                   = 'FileInfo Indexes',
+  $php_settings                     = {},
+  $php_options                      = {},
+  $do_includes                      = false,
+  $options                          = 'absent',
+  $additional_options               = 'absent',
+  $default_charset                  = 'absent',
+  $mod_security                     = true,
+  $mod_security_relevantonly        = true,
+  $mod_security_rules_to_disable    = [],
+  $mod_security_additional_options  = 'absent',
+  $ssl_mode                         = false,
+  $vhost_mode                       = 'template',
+  $template_partial                 = 'apache/vhosts/php_wordpress/partial.erb',
+  $vhost_source                     = 'absent',
+  $vhost_destination                = 'absent',
+  $htpasswd_file                    = 'absent',
+  $htpasswd_path                    = 'absent',
+  $manage_config                    = true,
+  $config_webwriteable              = false,
+  $manage_directories               = true
+){
+
+  $documentroot = $path ? {
+    'absent' => $::operatingsystem ? {
+        'openbsd' => "/var/www/htdocs/${name}/www",
+        default   => "/var/www/vhosts/${name}/www"
+    },
+    default => "${path}/www"
+  }
+  $modsec_rules = ['960010', '950018']
+  $real_mod_security_rules_to_disable = union($mod_security_rules_to_disable,
+                                                $modsec_rules)
+
+  # create vhost configuration file
+  apache::vhost::php::webapp{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    logmode                         => $logmode,
+    path                            => $path,
+    owner                           => $owner,
+    group                           => $group,
+    documentroot_owner              => $documentroot_owner,
+    documentroot_group              => $documentroot_group,
+    documentroot_mode               => $documentroot_mode,
+    run_mode                        => $run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    allow_override                  => $allow_override,
+    php_settings                    => $php_settings,
+    php_options                     => $php_options,
+    do_includes                     => $do_includes,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $real_mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+    ssl_mode                        => $ssl_mode,
+    vhost_mode                      => $vhost_mode,
+    template_partial                => $template_partial,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    manage_directories              => $manage_directories,
+    managed_directories             => [ "${documentroot}/wp-content/uploads",],
+    manage_config                   => $manage_config,
+    config_webwriteable             => $config_webwriteable,
+    config_file                     => 'wp-config.php',
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/phpdirs.pp b/puppet/modules/apache/manifests/vhost/phpdirs.pp
new file mode 100644
index 00000000..5936da61
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/phpdirs.pp
@@ -0,0 +1,39 @@
+define apache::vhost::phpdirs(
+  $ensure = present,
+  $php_upload_tmp_dir,
+  $php_session_save_path,
+  $documentroot_owner = apache,
+  $documentroot_group = 0,
+  $documentroot_mode = 0750,
+  $run_mode = 'normal',
+  $run_uid = 'absent'
+){
+  case $ensure {
+    absent : {
+      file {
+        [$php_upload_tmp_dir, $php_session_save_path] :
+          ensure => absent,
+          purge => true,
+          force => true,
+          recurse => true,
+      }
+    }
+    default : {
+      include apache::defaultphpdirs
+      file {
+        [$php_upload_tmp_dir, $php_session_save_path] :
+          ensure => directory,
+          owner => $run_mode ? {
+            'itk' => $run_uid,
+            'static-itk' => $run_uid,
+            'proxy-itk' => $run_uid,
+            'fcgid' => $run_uid,
+            default => $documentroot_owner
+          },
+          group => $documentroot_group,
+          mode => $documentroot_mode ;
+      }
+    }
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/proxy.pp b/puppet/modules/apache/manifests/vhost/proxy.pp
new file mode 100644
index 00000000..95ae2059
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/proxy.pp
@@ -0,0 +1,67 @@
+# Proxy VHost
+# Parameters:
+#
+# - ensure: wether this vhost is `present` or `absent`
+# - domain: the domain to redirect (*name*)
+# - domainalias: A list of whitespace seperated domains to redirect
+# - target_url: the url to be proxied. Note: We don't want http://example.com/foobar only example.com/foobar
+# - server_admin: the email that is shown as responsible
+# - ssl_mode: wether this vhost supports ssl or not
+#   - false: don't enable ssl for this vhost (default)
+#   - true: enable ssl for this vhost
+#   - force: enable ssl and redirect non-ssl to ssl
+#   - only: enable ssl only
+#
+# logmode:
+#
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::proxy(
+    $ensure = present,
+    $configuration = {},
+    $domain = 'absent',
+    $domainalias = 'absent',
+    $htpasswd_file = 'absent',
+    $target_url,
+    $server_admin = 'absent',
+    $logmode = 'default',
+    $mod_security = false,
+    $ssl_mode = false,
+    $mod_security_relevantonly = true,
+    $mod_security_rules_to_disable = [],
+    $mod_security_additional_options = 'absent',
+    $additional_options = 'absent'
+){
+    # create vhost configuration file
+    # we use the options field as the target_url
+    ::apache::vhost::template{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        template_partial => 'apache/vhosts/proxy/partial.erb',
+        domain => $domain,
+        path => 'really_absent',
+        path_is_webdir => true,
+        htpasswd_file => $htpasswd_file,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        logpath => $::operatingsystem ? {
+          openbsd => '/var/www/logs',
+          centos => '/var/log/httpd',
+          default => '/var/log/apache2'
+        },
+        logmode => $logmode,
+        allow_override => $allow_override,
+        run_mode => 'normal',
+        mod_security => $mod_security,
+        mod_security_relevantonly => $mod_security_relevantonly,
+        mod_security_rules_to_disable => $mod_security_rules_to_disable,
+        mod_security_additional_options => $mod_security_additional_options,
+        options => $target_url,
+        ssl_mode => $ssl_mode,
+        additional_options => $additional_options,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/redirect.pp b/puppet/modules/apache/manifests/vhost/redirect.pp
new file mode 100644
index 00000000..0ac40cc3
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/redirect.pp
@@ -0,0 +1,56 @@
+# Redirect VHost to redirect hosts
+# Parameters:
+#
+# - ensure: wether this vhost is `present` or `absent`
+# - domain: the domain to redirect (*name*)
+# - domainalias: A list of whitespace seperated domains to redirect
+# - target_url: the url to redirect to. Note: We don't want http://example.com/foobar only example.com/foobar
+# - server_admin: the email that is shown as responsible
+# - ssl_mode: wether this vhost supports ssl or not
+#   - false: don't enable ssl for this vhost (default)
+#   - true: enable ssl for this vhost
+#   - force: enable ssl and redirect non-ssl to ssl
+#   - only: enable ssl only
+#
+# logmode:
+#
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::redirect(
+    $ensure = present,
+    $configuration = {},
+    $domain = 'absent',
+    $domainalias = 'absent',
+    $target_url,
+    $server_admin = 'absent',
+    $logmode = 'default',
+    $ssl_mode = false
+){
+    # create vhost configuration file
+    # we use the options field as the target_url
+    ::apache::vhost::template{$name:
+        ensure => $ensure,
+        configuration => $configuration,
+        template_partial => 'apache/vhosts/redirect/partial.erb',
+        domain => $domain,
+        path => 'really_absent',
+        path_is_webdir => true,
+        domainalias => $domainalias,
+        server_admin => $server_admin,
+        logpath => $::operatingsystem ? {
+          openbsd => '/var/www/logs',
+          centos => '/var/log/httpd',
+          default => '/var/log/apache2'
+        },
+        logmode => $logmode,
+        allow_override => $allow_override,
+        run_mode => 'normal',
+        mod_security => false,
+        options => $target_url,
+        ssl_mode => $ssl_mode,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/static.pp b/puppet/modules/apache/manifests/vhost/static.pp
new file mode 100644
index 00000000..f9197662
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/static.pp
@@ -0,0 +1,86 @@
+# vhost_mode: which option is chosen to deploy the vhost
+#   - template: generate it from a template (default)
+#   - file: deploy a vhost file (apache::vhost::file will be called directly)
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: (*default*) don't activate mod_security
+#    - true: activate mod_security
+#
+define apache::vhost::static(
+    $ensure                           = present,
+    $configuration                    = {},
+    $domain                           = 'absent',
+    $domainalias                      = 'absent',
+    $server_admin                     = 'absent',
+    $logmode                          = 'default',
+    $path                             = 'absent',
+    $owner                            = root,
+    $group                            = apache,
+    $documentroot_owner               = apache,
+    $documentroot_group               = 0,
+    $documentroot_mode                = 0640,
+    $allow_override                   = 'None',
+    $do_includes                      = false,
+    $options                          = 'absent',
+    $additional_options               = 'absent',
+    $default_charset                  = 'absent',
+    $ssl_mode                         = false,
+    $run_mode                         = 'normal',
+    $vhost_mode                       = 'template',
+    $template_partial                 = 'apache/vhosts/static/partial.erb',
+    $vhost_source                     = 'absent',
+    $vhost_destination                = 'absent',
+    $htpasswd_file                    = 'absent',
+    $htpasswd_path                    = 'absent',
+    $mod_security                     = false,
+    $mod_security_relevantonly        = true,
+    $mod_security_rules_to_disable    = [],
+    $mod_security_additional_options  = 'absent'
+){
+    # create webdir
+    ::apache::vhost::webdir{$name:
+        ensure              => $ensure,
+        path                => $path,
+        owner               => $owner,
+        group               => $group,
+        run_mode            => $run_mode,
+        datadir             => false,
+        documentroot_owner  => $documentroot_owner,
+        documentroot_group  => $documentroot_group,
+        documentroot_mode   => $documentroot_mode,
+    }
+
+    # create vhost configuration file
+    ::apache::vhost{$name:
+        ensure                          => $ensure,
+        configuration                   => $configuration,
+        path                            => $path,
+        template_partial                => $template_partial,
+        vhost_mode                      => $vhost_mode,
+        vhost_source                    => $vhost_source,
+        vhost_destination               => $vhost_destination,
+        domain                          => $domain,
+        domainalias                     => $domainalias,
+        server_admin                    => $server_admin,
+        logmode                         => $logmode,
+        allow_override                  => $allow_override,
+        do_includes                     => $do_includes,
+        options                         => $options,
+        additional_options              => $additional_options,
+        default_charset                 => $default_charset,
+        ssl_mode                        => $ssl_mode,
+        htpasswd_file                   => $htpasswd_file,
+        htpasswd_path                   => $htpasswd_path,
+        mod_security                    => $mod_security,
+        mod_security_relevantonly       => $mod_security_relevantonly,
+        mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+        mod_security_additional_options => $mod_security_additional_options,
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/template.pp b/puppet/modules/apache/manifests/vhost/template.pp
new file mode 100644
index 00000000..8e9b798c
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/template.pp
@@ -0,0 +1,158 @@
+# template_partial:
+#  which template should be used to generate the type specific part
+#  of the vhost entry.
+#
+# domainalias:
+#   - absent: no domainalias is set (*default*)
+#   - www: domainalias is set to www.$domain
+#   - else: domainalias is set to that
+#
+# ssl_mode: wether this vhost supports ssl or not
+#   - false: don't enable ssl for this vhost (default)
+#   - true: enable ssl for this vhost
+#   - force: enable ssl and redirect non-ssl to ssl
+#   - only: enable ssl only
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: run vhost with a dual prefork/itk setup, where prefork serves all the static
+#                 content and proxies the dynamic calls to the itk setup, that listens only on
+#                 the loobpack device (Incompatibility: cannot be used in combination with
+#                 'itk' mode)
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: don't activate mod_security
+#    - true: (*default*) activate mod_security
+#
+define apache::vhost::template(
+    $ensure                           = present,
+    $configuration                    = {},
+    $path                             = 'absent',
+    $path_is_webdir                   = false,
+    $logpath                          = 'absent',
+    $logmode                          = 'default',
+    $logprefix                        = '',
+    $domain                           = 'absent',
+    $domainalias                      = 'absent',
+    $server_admin                     = 'absent',
+    $allow_override                   = 'None',
+    $dav_db_dir                       = 'absent',
+    $cgi_binpath                      = 'absent',
+    $do_includes                      = false,
+    $options                          = 'absent',
+    $additional_options               = 'absent',
+    $default_charset                  = 'absent',
+    $php_options                      = {},
+    $php_settings                     = {},
+    $run_mode                         = 'normal',
+    $run_uid                          = 'absent',
+    $run_gid                          = 'absent',
+    $template_partial                 = 'apache/vhosts/static/partial.erb',
+    $template_vars                    = {},
+    $ssl_mode                         = false,
+    $mod_security                     = true,
+    $mod_security_relevantonly        = true,
+    $mod_security_rules_to_disable    = [],
+    $mod_security_additional_options  = 'absent',
+    $use_mod_macro                    = false,
+    $htpasswd_file                    = 'absent',
+    $htpasswd_path                    = 'absent',
+    $ldap_auth                        = false,
+    $ldap_user                        = 'any',
+    $passing_extension                = 'absent',
+    $gempath                          = 'absent'
+){
+    $real_path = $path ? {
+        'absent'  => $::operatingsystem ? {
+            openbsd => "/var/www/htdocs/${name}",
+            default => "/var/www/vhosts/${name}"
+        },
+        default   => $path
+    }
+
+    if $path_is_webdir {
+        $documentroot = $real_path
+    } else {
+        $documentroot = "${real_path}/www"
+    }
+    $logdir = $logpath ? {
+        'absent'  => "${real_path}/logs",
+        default   => $logpath
+    }
+
+    $servername = $domain ? {
+        'absent'  => $name,
+        default   => $domain
+    }
+    $serveralias = $domainalias ? {
+        'absent'  => '',
+        'www'     => "www.${servername}",
+        default   => $domainalias
+    }
+    if $htpasswd_path == 'absent' {
+      $real_htpasswd_path = "/var/www/htpasswds/${name}"
+    } else {
+      $real_htpasswd_path = $htpasswd_path
+    }
+    case $run_mode {
+      'proxy-itk': { $logfileprefix = 'proxy' }
+      'static-itk': { $logfileprefix = 'static' }
+    }
+    case $run_mode {
+        'fcgid','itk','proxy-itk','static-itk': {
+            case $run_uid {
+                'absent': { fail("you have to define run_uid for ${name} on ${::fqdn}") }
+            }
+            case $run_gid {
+                'absent': { fail("you have to define run_gid for ${name} on ${::fqdn}") }
+            }
+        }
+    }
+
+    # dav db dir
+    case $dav_db_dir {
+        'absent': {
+            $real_dav_db_dir = "/var/www/dav_db_dir/${name}"
+        }
+        default: { $real_dav_db_dir = $dav_db_dir }
+    }
+
+    apache::vhost::file{$name:
+        configuration => $configuration,
+        ensure        => $ensure,
+        do_includes   => $do_includes,
+        run_mode      => $run_mode,
+        ssl_mode      => $ssl_mode,
+        logmode       => $logmode,
+        mod_security  => $mod_security,
+        htpasswd_file => $htpasswd_file,
+        htpasswd_path => $htpasswd_path,
+        use_mod_macro => $use_mod_macro,
+    }
+    if $ensure != 'absent' {
+      Apache::Vhost::File[$name]{
+        content => $run_mode ? {
+          'proxy-itk'  => template('apache/vhosts/itk_plus.erb'),
+          'static-itk' => template('apache/vhosts/itk_plus.erb'),
+          default      => template('apache/vhosts/default.erb'),
+        }
+      }
+    }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/webdav.pp b/puppet/modules/apache/manifests/vhost/webdav.pp
new file mode 100644
index 00000000..ff9e8abc
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/webdav.pp
@@ -0,0 +1,126 @@
+# Webdav vhost: to manage webdav accessible targets
+# run_mode: controls in which mode the vhost should be run, there are different setups
+#           possible:
+#   - normal: (*default*) run vhost with the current active worker (default: prefork) don't
+#             setup anything special
+#   - itk: run vhost with the mpm_itk module (Incompatibility: cannot be used in combination
+#          with 'proxy-itk' & 'static-itk' mode)
+#   - proxy-itk: run vhost with a dual prefork/itk setup, where prefork just proxies all the
+#                requests for the itk setup, that listens only on the loobpack device.
+#                (Incompatibility: cannot be used in combination with the itk setup.)
+#   - static-itk: this mode is not possible and will be rewritten to proxy-itk
+#
+# run_uid: the uid the vhost should run as with the itk module
+# run_gid: the gid the vhost should run as with the itk module
+#
+# mod_security: Whether we use mod_security or not (will include mod_security module)
+#    - false: (*default*) don't activate mod_security
+#    - true: activate mod_security
+#
+# logmode:
+#   - default: Do normal logging to CustomLog and ErrorLog
+#   - nologs: Send every logging to /dev/null
+#   - anonym: Don't log ips for CustomLog, send ErrorLog to /dev/null
+#   - semianonym: Don't log ips for CustomLog, log normal ErrorLog
+#
+define apache::vhost::webdav(
+    $ensure                           = present,
+    $configuration                    = {},
+    $domain                           = 'absent',
+    $domainalias                      = 'absent',
+    $server_admin                     = 'absent',
+    $path                             = 'absent',
+    $owner                            = root,
+    $group                            = apache,
+    $manage_webdir                    = true,
+    $path_is_webdir                   = false,
+    $logmode                          = 'default',
+    $logpath                          = 'absent',
+    $documentroot_owner               = apache,
+    $documentroot_group               = 0,
+    $documentroot_mode                = 0640,
+    $run_mode                         = 'normal',
+    $run_uid                          = 'absent',
+    $run_gid                          = 'absent',
+    $options                          = 'absent',
+    $additional_options               = 'absent',
+    $default_charset                  = 'absent',
+    $mod_security                     = false,
+    $mod_security_relevantonly        = true,
+    $mod_security_rules_to_disable    = [],
+    $mod_security_additional_options  = 'absent',
+    $ssl_mode                         = false,
+    $vhost_mode                       = 'template',
+    $vhost_source                     = 'absent',
+    $vhost_destination                = 'absent',
+    $htpasswd_file                    = 'absent',
+    $htpasswd_path                    = 'absent',
+    $ldap_auth                        = false,
+    $ldap_user                        = 'any',
+    $dav_db_dir                       = 'absent'
+){
+  ::apache::vhost::davdbdir{$name:
+    ensure              => $ensure,
+    dav_db_dir          => $dav_db_dir,
+    documentroot_owner  => $documentroot_owner,
+    documentroot_group  => $documentroot_group,
+    documentroot_mode   => $documentroot_mode,
+    run_mode            => $run_mode,
+    run_uid             => $run_uid,
+  }
+
+  if $manage_webdir {
+    # create webdir
+    ::apache::vhost::webdir{$name:
+      ensure              => $ensure,
+      path                => $path,
+      owner               => $owner,
+      group               => $group,
+      run_mode            => $run_mode,
+      datadir             => false,
+      documentroot_owner  => $documentroot_owner,
+      documentroot_group  => $documentroot_group,
+      documentroot_mode   => $documentroot_mode,
+    }
+  }
+
+  if $run_mode == 'static-itk' {
+    notice('static-itk mode is not possible for webdav vhosts, rewriting it to proxy-itk')
+    $real_run_mode = 'proxy-itk'
+  } else {
+    $real_run_mode = $run_mode
+  }
+
+  # create vhost configuration file
+  ::apache::vhost{$name:
+    ensure                          => $ensure,
+    configuration                   => $configuration,
+    path                            => $path,
+    path_is_webdir                  => $path_is_webdir,
+    logpath                         => $logpath,
+    logmode                         => $logmode,
+    template_partial                => 'apache/vhosts/webdav/partial.erb',
+    vhost_mode                      => $vhost_mode,
+    vhost_source                    => $vhost_source,
+    vhost_destination               => $vhost_destination,
+    domain                          => $domain,
+    domainalias                     => $domainalias,
+    server_admin                    => $server_admin,
+    run_mode                        => $real_run_mode,
+    run_uid                         => $run_uid,
+    run_gid                         => $run_gid,
+    options                         => $options,
+    additional_options              => $additional_options,
+    default_charset                 => $default_charset,
+    ssl_mode                        => $ssl_mode,
+    htpasswd_file                   => $htpasswd_file,
+    htpasswd_path                   => $htpasswd_path,
+    ldap_auth                       => $ldap_auth,
+    ldap_user                       => $ldap_user,
+    mod_security                    => $mod_security,
+    mod_security_relevantonly       => $mod_security_relevantonly,
+    mod_security_rules_to_disable   => $mod_security_rules_to_disable,
+    mod_security_additional_options => $mod_security_additional_options,
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/vhost/webdir.pp b/puppet/modules/apache/manifests/vhost/webdir.pp
new file mode 100644
index 00000000..e0e25464
--- /dev/null
+++ b/puppet/modules/apache/manifests/vhost/webdir.pp
@@ -0,0 +1,130 @@
+# create webdir
+define apache::vhost::webdir(
+  $ensure               = present,
+  $path                 = 'absent',
+  $owner                = root,
+  $group                = apache,
+  $mode                 = 0640,
+  $run_mode             = 'normal',
+  $manage_docroot       = true,
+  $datadir              = true,
+  $documentroot_owner   = root,
+  $documentroot_group   = apache,
+  $documentroot_mode    = 0640,
+  $documentroot_recurse = false
+){
+  $real_path = $path ? {
+    'absent' => $::operatingsystem ? {
+      openbsd => "/var/www/htdocs/${name}",
+      default => "/var/www/vhosts/${name}"
+    },
+    default => $path
+  }
+
+  if (($run_mode =~ /^(static\-|proxy\-)?itk$/) or $run_mode == 'fcgid') and ($mode == '0640'){
+    $real_mode = 0644
+  } else {
+    $real_mode = $mode
+  }
+
+  $documentroot = "${real_path}/www"
+  $logdir = "${real_path}/logs"
+
+  if $owner == 'apache' {
+    $real_owner = $::operatingsystem ? {
+      openbsd => 'www',
+      debian  => 'www-data',
+      default => $owner
+    }
+  } else {
+      $real_owner = $owner
+  }
+  if $group == 'apache' {
+    $real_group = $::operatingsystem ? {
+      openbsd => 'www',
+      debian  => 'www-data',
+      default => $group
+    }
+  } else {
+    $real_group = $group
+  }
+
+  if $documentroot_owner == 'apache' {
+    $real_documentroot_owner = $::operatingsystem ? {
+      openbsd => 'www',
+      debian  => 'www-data',
+      default => $documentroot_owner
+    }
+  } else {
+    $real_documentroot_owner = $documentroot_owner
+  }
+  if $documentroot_group == 'apache' {
+    $real_documentroot_group = $::operatingsystem ? {
+      openbsd => 'www',
+      debian  => 'www-data',
+      default => $documentroot_group
+    }
+  } else {
+    $real_documentroot_group = $documentroot_group
+  }
+  case $ensure {
+    absent: {
+      exec{"cleanup_webdir_${real_path}":
+        command => "rm -rf ${real_path}",
+        onlyif  => "test -d  ${real_path}",
+        before  => File[$real_path],
+      }
+      file{$real_path:
+        ensure  => absent,
+        purge   => true,
+        recurse => true,
+        force   => true;
+      }
+    }
+    default: {
+      file{
+        $real_path:
+          ensure  => directory,
+          require => Anchor['apache::basic_dirs::ready'],
+          owner   => $real_owner,
+          group   => $real_group,
+          mode    => $real_mode;
+        $logdir:
+          ensure  => directory,
+          before  => Service['apache'],
+          owner   => $real_documentroot_owner,
+          group   => $real_documentroot_group,
+          mode    => '0660';
+        "${real_path}/private":
+          ensure  => directory,
+          owner   => $real_documentroot_owner,
+          group   => $real_documentroot_group,
+          mode    => '0600';
+      }
+      if $manage_docroot {
+        file{$documentroot:
+          ensure  => directory,
+          before  => Service['apache'],
+          recurse => $documentroot_recurse,
+          owner   => $real_documentroot_owner,
+          group   => $real_documentroot_group,
+          mode    => $documentroot_mode;
+        }
+      }
+      if $datadir {
+        file{"${real_path}/data":
+          ensure  => directory,
+          owner   => $real_documentroot_owner,
+          group   => $real_documentroot_group,
+          mode    => '0640';
+        }
+      }
+      case $::operatingsystem {
+        centos: { include apache::logrotate::centos::vhosts }
+        default: { #nothing
+        }
+      }
+    }
+  }
+}
+
diff --git a/puppet/modules/apache/manifests/webdav.pp b/puppet/modules/apache/manifests/webdav.pp
new file mode 100644
index 00000000..75219c90
--- /dev/null
+++ b/puppet/modules/apache/manifests/webdav.pp
@@ -0,0 +1,8 @@
+# manifests/webdav.pp
+
+class apache::webdav {
+    file{'/var/www/webdavlock':
+        ensure => directory,
+        owner => apache, group => 0, mode => 0700;
+    }
+}
diff --git a/puppet/modules/apache/manifests/worker.pp b/puppet/modules/apache/manifests/worker.pp
new file mode 100644
index 00000000..9a7b3be4
--- /dev/null
+++ b/puppet/modules/apache/manifests/worker.pp
@@ -0,0 +1,5 @@
+class apache::worker inherits apache {
+  case $::operatingsystem {
+    centos: { include ::apache::centos::worker }
+  }
+}
diff --git a/puppet/modules/apache/spec/classes/init_spec.rb b/puppet/modules/apache/spec/classes/init_spec.rb
new file mode 100644
index 00000000..baf26470
--- /dev/null
+++ b/puppet/modules/apache/spec/classes/init_spec.rb
@@ -0,0 +1,43 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache', :type => 'class' do
+  describe 'with standard' do
+    #puppet-rspec bug
+    #it { should compile.with_all_deps }
+
+    it { should contain_class('apache::base') }
+    it { should_not contain_class('apache::status') }
+    it { should_not contain_class('shorewall::rules::http') }
+    it { should_not contain_class('apache::ssl') }
+    context 'on centos' do
+      let(:facts) {
+        {
+          :operatingsystem => 'CentOS',
+        }
+      }
+      it { should contain_class('apache::centos') }
+    end
+  end
+  describe 'with params' do
+    let(:facts) {
+      {
+        :concat_basedir => '/var/lib/puppet/concat'
+      }
+    }
+    let(:params){
+      {
+        :manage_shorewall => true,
+        # there is puppet-librarian bug in using that module
+        #:manage_munin     => true,
+        :ssl              => true,
+      }
+    }
+    #puppet-rspec bug
+    #it { should compile.with_all_deps }
+
+    it { should contain_class('apache::base') }
+    it { should_not contain_class('apache::status') }
+    it { should contain_class('shorewall::rules::http') }
+    it { should contain_class('apache::ssl') }
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_file_spec.rb b/puppet/modules/apache/spec/defines/vhost_file_spec.rb
new file mode 100644
index 00000000..ed9ac5e2
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_file_spec.rb
@@ -0,0 +1,131 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::file', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+    }
+  }
+  let(:pre_condition) {
+    'include apache'
+  }
+  describe 'with standard' do
+    it { should contain_file('example.com.conf').with(
+      :ensure  => 'present',
+      :source  => [ "puppet:///modules/site_apache/vhosts.d/apache.example.com/example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d//example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/./example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d//example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/./example.com.conf",
+                  "puppet:///modules/apache/vhosts.d//example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/example.com.conf" ],
+      :path    => '/etc/apache2/vhosts.d/example.com.conf',
+      :require => 'File[vhosts_dir]',
+      :notify  => 'Service[apache]',
+      :owner   => 'root',
+      :group   => 0,
+      :mode    => '0644',
+    )}
+    it { should_not contain_file('/var/www/htpasswds/example.com') }
+    it { should_not contain_class('apache::includes') }
+    it { should_not contain_class('apache::mod_macro') }
+    it { should_not contain_class('apache::noiplog') }
+    it { should_not contain_class('apache::itk::lock') }
+    it { should_not contain_class('mod_security::itk_plus') }
+    it { should_not contain_class('mod_security') }
+  end
+  context 'on centos' do
+    let(:facts){
+      {
+        :fqdn                       => 'apache.example.com',
+        :operatingsystem            => 'CentOS',
+        :operatingsystemmajrelease  => '7',
+      }
+    }
+    it { should contain_file('example.com.conf').with(
+      :ensure  => 'present',
+      :source  => [ "puppet:///modules/site_apache/vhosts.d/apache.example.com/example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d//example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/CentOS.7/example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/CentOS/example.com.conf",
+                  "puppet:///modules/site_apache/vhosts.d/example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/CentOS.7/example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/CentOS/example.com.conf",
+                  "puppet:///modules/apache/vhosts.d/example.com.conf" ],
+      :path    => '/etc/httpd/vhosts.d/example.com.conf',
+      :require => 'File[vhosts_dir]',
+      :notify  => 'Service[apache]',
+      :owner   => 'root',
+      :group   => 0,
+      :mode    => '0644',
+    )}
+    it { should_not contain_file('/var/www/htpasswds/example.com') }
+    it { should_not contain_class('apache::includes') }
+    it { should_not contain_class('apache::mod_macro') }
+    it { should_not contain_class('apache::noiplog') }
+    it { should_not contain_class('apache::itk::lock') }
+    it { should_not contain_class('mod_security::itk_plus') }
+    it { should_not contain_class('mod_security') }
+    context 'with params' do
+      let(:params) {
+        {
+          :vhost_destination => '/tmp/a/example.com.conf',
+          :vhost_source      => 'modules/my_module/example.com.conf',
+          :htpasswd_file     => true,
+          :do_includes       => true,
+          :mod_security      => true,
+          :use_mod_macro     => true,
+          :logmode           => 'anonym',
+        }
+      }
+      it { should contain_file('example.com.conf').with(
+        :ensure  => 'present',
+        :source  => 'puppet:///modules/my_module/example.com.conf',
+        :path    => '/tmp/a/example.com.conf',
+        :require => 'File[vhosts_dir]',
+        :notify  => 'Service[apache]',
+        :owner   => 'root',
+        :group   => 0,
+        :mode    => '0644',
+      )}
+      it { should contain_file('/var/www/htpasswds/example.com').with(
+        :source  => [ "puppet:///modules/site_apache/htpasswds/apache.example.com/example.com",
+                      "puppet:///modules/site_apache/htpasswds//example.com",
+                      "puppet:///modules/site_apache/htpasswds/example.com" ],
+        :owner   => 'root',
+        :group   => 0,
+        :mode    => '0644',
+      )}
+      it { should contain_class('apache::includes') }
+      it { should contain_class('apache::mod_macro') }
+      it { should contain_class('apache::noiplog') }
+      it { should_not contain_class('apache::itk::lock') }
+      it { should_not contain_class('mod_security::itk_plus') }
+      it { should contain_class('mod_security') }
+    end
+    context 'with content' do
+      let(:params) {
+        {
+          :content => "<VirtualHost *:80>\n  Servername example.com\n</VirtualHost>"
+        }
+      }
+      it { should contain_file('example.com.conf').with(
+        :ensure  => 'present',
+        :path    => '/etc/httpd/vhosts.d/example.com.conf',
+        :require => 'File[vhosts_dir]',
+        :notify  => 'Service[apache]',
+        :owner   => 'root',
+        :group   => 0,
+        :mode    => '0644',
+      )}
+      it { should contain_file('example.com.conf').with_content(
+"<VirtualHost *:80>
+  Servername example.com
+</VirtualHost>"
+      )}
+      it { should_not contain_file('/var/www/htpasswds/example.com') }
+    end
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_drupal_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_drupal_spec.rb
new file mode 100644
index 00000000..5256746d
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_drupal_spec.rb
@@ -0,0 +1,187 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::drupal', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    it { should contain_file('/etc/cron.d/drupal_cron_example.com').with(
+      :content => "0   *   *   *   *   apache wget -O - -q -t 1 http://example.com/cron.php\n",
+      :owner   => 'root',
+      :group   => 0,
+      :mode    => '0644',
+    )}
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :manage_directories => false,
+      :template_partial   => 'apache/vhosts/php_drupal/partial.erb',
+      :manage_config      => false,
+      :php_settings       => {
+        'magic_quotes_gpc'              => 0,
+        'register_globals'              => 0,
+        'session.auto_start'            => 0,
+        'mbstring.http_input'           => 'pass',
+        'mbstring.http_output'          => 'pass',
+        'mbstring.encoding_translation' => 0,
+      }
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value magic_quotes_gpc 0
+    php_admin_value mbstring.encoding_translation 0
+    php_admin_value mbstring.http_input pass
+    php_admin_value mbstring.http_output pass
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_value register_globals 0
+    php_admin_flag safe_mode on
+    php_admin_value session.auto_start 0
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+    # Protect files and directories from prying eyes.
+    <FilesMatch \"\\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\\.php)?|xtmpl)$|^(code-style\\.pl|Entries.*|Repository|Root|Tag|Template)$\">
+      Order allow,deny
+    </FilesMatch>
+
+    # Customized error messages.
+    ErrorDocument 404 /index.php
+
+    RewriteEngine on
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/files/\">
+    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+    Options None
+    Options +FollowSymLinks
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    it { should contain_file('/etc/cron.d/drupal_cron_example.com').with(
+      :content => "0   *   *   *   *   apache wget -O - -q -t 1 http://example.com/cron.php\n",
+      :owner   => 'root',
+      :group   => 0,
+      :mode    => '0644',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :run_mode                       => 'fcgid',
+      :run_uid                        => 'foo',
+      :run_gid                        => 'bar',
+      :manage_directories             => false,
+      :template_partial               => 'apache/vhosts/php_drupal/partial.erb',
+      :manage_config                  => false,
+      :php_settings                   => {
+        'magic_quotes_gpc'              => 0,
+        'register_globals'              => 0,
+        'session.auto_start'            => 0,
+        'mbstring.http_input'           => 'pass',
+        'mbstring.http_output'          => 'pass',
+        'mbstring.encoding_translation' => 0,
+      },
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+    # Protect files and directories from prying eyes.
+    <FilesMatch \"\\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\\.php)?|xtmpl)$|^(code-style\\.pl|Entries.*|Repository|Root|Tag|Template)$\">
+      Order allow,deny
+    </FilesMatch>
+
+    # Customized error messages.
+    ErrorDocument 404 /index.php
+
+    RewriteEngine on
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/files/\">
+    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+    Options None
+    Options +FollowSymLinks
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_gallery2_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_gallery2_spec.rb
new file mode 100644
index 00000000..9f2325e9
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_gallery2_spec.rb
@@ -0,0 +1,162 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::gallery2', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :manage_directories             => true,
+      :template_partial               => 'apache/vhosts/php_gallery2/partial.erb',
+      :php_settings                   => {
+        'safe_mode'         => 'Off',
+        'output_buffering'  => 'Off',
+      },
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'config.php',
+    )}
+    it { should contain_file('/var/www/vhosts/example.com/data/upload').with(
+      :ensure => 'directory',
+      :owner  => 'apache',
+      :group  => 0,
+      :mode   => '0660',
+    )}
+    it { should contain_file('/var/www/vhosts/example.com/data/gdata').with(
+      :ensure => 'directory',
+      :owner  => 'apache',
+      :group  => 0,
+      :mode   => '0660',
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag output_buffering off
+    php_admin_flag safe_mode off
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+
+    # Always rewrite login's
+    # Source: http://gallery.menalto.com/node/30558
+    RewriteEngine On
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+    RewriteCond %{HTTP_COOKIE} ^GALLERYSID= [OR]
+    RewriteCond %{QUERY_STRING} subView=core\\.UserLogin
+    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,R,L]
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :run_mode                       => 'fcgid',
+      :run_uid                        => 'foo',
+      :run_gid                        => 'bar',
+      :template_partial               => 'apache/vhosts/php_gallery2/partial.erb',
+      :php_settings                   => {
+        'safe_mode'         => 'Off',
+        'output_buffering'  => 'Off',
+      },
+      :manage_directories             => true,
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'config.php',
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+
+    # Always rewrite login's
+    # Source: http://gallery.menalto.com/node/30558
+    RewriteEngine On
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+    RewriteCond %{HTTP_COOKIE} ^GALLERYSID= [OR]
+    RewriteCond %{QUERY_STRING} subView=core\\.UserLogin
+    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,R,L]
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_joomla_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_joomla_spec.rb
new file mode 100644
index 00000000..000154de
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_joomla_spec.rb
@@ -0,0 +1,279 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::joomla', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    it { should contain_class('apache::include::joomla') }
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :template_partial               => 'apache/vhosts/php_joomla/partial.erb',
+      :php_settings                   => {
+        'allow_url_fopen'   => 'on',
+        'allow_url_include' => 'off',
+      },
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'configuration.php',
+      :manage_directories             => true,
+      :managed_directories            =>  [ "/var/www/vhosts/example.com/www/administrator/backups",
+                                            "/var/www/vhosts/example.com/www/administrator/components",
+                                            "/var/www/vhosts/example.com/www/administrator/language",
+                                            "/var/www/vhosts/example.com/www/administrator/modules",
+                                            "/var/www/vhosts/example.com/www/administrator/templates",
+                                            "/var/www/vhosts/example.com/www/components",
+                                            "/var/www/vhosts/example.com/www/dmdocuments",
+                                            "/var/www/vhosts/example.com/www/images",
+                                            "/var/www/vhosts/example.com/www/language",
+                                            "/var/www/vhosts/example.com/www/media",
+                                            "/var/www/vhosts/example.com/www/modules",
+                                            "/var/www/vhosts/example.com/www/plugins",
+                                            "/var/www/vhosts/example.com/www/templates",
+                                            "/var/www/vhosts/example.com/www/cache",
+                                            "/var/www/vhosts/example.com/www/tmp",
+                                            "/var/www/vhosts/example.com/www/administrator/cache" ],
+      :mod_security_additional_options => "
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"id:1199400,allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+"
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag allow_url_fopen on
+    php_admin_flag allow_url_include off
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+ 
+
+
+    Include include.d/joomla.inc
+  </Directory>
+
+  <Directory \"/var/www/vhosts/example.com/www/administrator/\">
+    RewriteEngine on
+
+    # Rewrite URLs to https that go for the admin area
+    RewriteCond %{REMOTE_ADDR} !^127\\.[0-9]+\\.[0-9]+\\.[0-9]+$
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{REQUEST_URI} (.*/administrator/.*)
+    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R]
+  </Directory>
+
+  # Deny various directories that
+  # shouldn't be webaccessible
+  <Directory \"/var/www/vhosts/example.com/www/tmp/\">
+    Deny From All
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/logs/\">
+    Deny From All
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/cli/\">
+    Deny From All
+  </Directory>
+
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+
+    
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"id:1199400,allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    it { should contain_class('apache::include::joomla') }
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :run_mode                       => 'fcgid',
+      :run_uid                        => 'foo',
+      :run_gid                        => 'bar',
+      :template_partial               => 'apache/vhosts/php_joomla/partial.erb',
+      :php_settings                   => {
+        'allow_url_fopen'   => 'on',
+        'allow_url_include' => 'off',
+      },
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'configuration.php',
+      :manage_directories             => true,
+      :managed_directories            =>  [ "/var/www/vhosts/example.com/www/administrator/backups",
+                                            "/var/www/vhosts/example.com/www/administrator/components",
+                                            "/var/www/vhosts/example.com/www/administrator/language",
+                                            "/var/www/vhosts/example.com/www/administrator/modules",
+                                            "/var/www/vhosts/example.com/www/administrator/templates",
+                                            "/var/www/vhosts/example.com/www/components",
+                                            "/var/www/vhosts/example.com/www/dmdocuments",
+                                            "/var/www/vhosts/example.com/www/images",
+                                            "/var/www/vhosts/example.com/www/language",
+                                            "/var/www/vhosts/example.com/www/media",
+                                            "/var/www/vhosts/example.com/www/modules",
+                                            "/var/www/vhosts/example.com/www/plugins",
+                                            "/var/www/vhosts/example.com/www/templates",
+                                            "/var/www/vhosts/example.com/www/cache",
+                                            "/var/www/vhosts/example.com/www/tmp",
+                                            "/var/www/vhosts/example.com/www/administrator/cache" ],
+      :mod_security_additional_options => "
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"id:1199400,allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+"
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+ 
+
+
+    Include include.d/joomla.inc
+  </Directory>
+
+  <Directory \"/var/www/vhosts/example.com/www/administrator/\">
+    RewriteEngine on
+
+    # Rewrite URLs to https that go for the admin area
+    RewriteCond %{REMOTE_ADDR} !^127\\.[0-9]+\\.[0-9]+\\.[0-9]+$
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{REQUEST_URI} (.*/administrator/.*)
+    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R]
+  </Directory>
+
+  # Deny various directories that
+  # shouldn't be webaccessible
+  <Directory \"/var/www/vhosts/example.com/www/tmp/\">
+    Deny From All
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/logs/\">
+    Deny From All
+  </Directory>
+  <Directory \"/var/www/vhosts/example.com/www/cli/\">
+    Deny From All
+  </Directory>
+
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+
+    
+    # http://optics.csufresno.edu/~kriehn/fedora/fedora_files/f9/howto/modsecurity.html
+    # Exceptions for Joomla Root Directory
+    <LocationMatch \"^/\">
+        SecRuleRemoveById 950013
+    </LocationMatch>
+
+    # Exceptions for Joomla Administration Panel
+    SecRule REQUEST_FILENAME \"/administrator/index2.php\" \"id:1199400,allow,phase:1,nolog,ctl:ruleEngine=Off\"
+
+    # Exceptions for Joomla Component Expose
+    <LocationMatch \"^/components/com_expose/expose/manager/amfphp/gateway.php\">
+        SecRuleRemoveById 960010
+    </LocationMatch>
+
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_standard_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_standard_spec.rb
new file mode 100644
index 00000000..159d4b81
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_standard_spec.rb
@@ -0,0 +1,534 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::standard', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should_not contain_class('mod_fcgid') }
+    it { should_not contain_class('php::mod_fcgid') }
+    it { should_not contain_class('apache::include::mod_fcgid') }
+    it { should_not contain_class('php::scl::php54') }
+    it { should_not contain_class('php::scl::php55') }
+    it { should_not contain_class('php::extensions::smarty') }
+    it { should contain_class('php') }
+    it { should_not contain_mod_fcgid__starter('example.com') }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(0) }
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'absent',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with standard and params' do
+    let(:params) {
+      {
+        :php_settings => {
+          'safe_mode' => 'Off',
+        }
+      }
+    }
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode off
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should contain_class('mod_fcgid') }
+    it { should contain_class('php::mod_fcgid') }
+    it { should contain_class('apache::include::mod_fcgid') }
+    it { should_not contain_class('php::scl::php54') }
+    it { should_not contain_class('php::scl::php55') }
+    it { should_not contain_class('php::extensions::smarty') }
+    it { should contain_mod_fcgid__starter('example.com').with(
+      :tmp_dir          => false,
+      :cgi_type         => 'php',
+      :cgi_type_options => {
+        "engine"            =>"On",
+        "upload_tmp_dir"    =>"/var/www/upload_tmp_dir/example.com",
+        "session.save_path" =>"/var/www/session.save_path/example.com",
+        "error_log"         =>"/var/www/vhosts/example.com/logs/php_error_log",
+        "safe_mode"         =>"On",
+        "safe_mode_gid"     =>"On",
+        "safe_mode_exec_dir"=>:undef,
+        "default_charset"   =>:undef,
+        "open_basedir"      =>"/var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com"
+      },
+      :owner            => 'foo',
+      :group            => 'bar',
+      :notify           => 'Service[apache]',
+    ) }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(0) }
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'absent',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid scl 5.4' do
+    let(:pre_condition){ 'include yum::prerequisites' }
+    let(:params){
+      {
+        :run_mode         => 'fcgid',
+        :run_uid          => 'foo',
+        :run_gid          => 'bar',
+        :php_installation => 'scl54',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should contain_class('mod_fcgid') }
+    it { should contain_class('php::mod_fcgid') }
+    it { should contain_class('apache::include::mod_fcgid') }
+    it { should contain_class('php::scl::php54') }
+    it { should_not contain_class('php::scl::php55') }
+    it { should_not contain_class('php::extensions::smarty') }
+    it { should contain_mod_fcgid__starter('example.com').with(
+      :tmp_dir          => false,
+      :cgi_type         => 'php',
+      :cgi_type_options => {
+        "engine"            =>"On",
+        "upload_tmp_dir"    =>"/var/www/upload_tmp_dir/example.com",
+        "session.save_path" =>"/var/www/session.save_path/example.com",
+        "error_log"         =>"/var/www/vhosts/example.com/logs/php_error_log",
+        "safe_mode"         =>:undef,
+        "safe_mode_gid"     =>:undef,
+        "safe_mode_exec_dir"=>:undef,
+        "default_charset"   =>:undef,
+        "open_basedir"      =>"/var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com"
+      },
+      :binary           => '/opt/rh/php54/root/usr/bin/php-cgi',
+      :additional_cmds  => 'source /opt/rh/php54/enable',
+      :rc               => '/opt/rh/php54/root/etc',
+      :owner            => 'foo',
+      :group            => 'bar',
+      :notify           => 'Service[apache]',
+    ) }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(0) }
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'absent',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid with scl55' do
+    let(:pre_condition){ 'include yum::prerequisites' }
+    let(:params){
+      {
+        :run_mode         => 'fcgid',
+        :run_uid          => 'foo',
+        :run_gid          => 'bar',
+        :php_installation => 'scl55',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should contain_class('mod_fcgid') }
+    it { should contain_class('php::mod_fcgid') }
+    it { should contain_class('apache::include::mod_fcgid') }
+    it { should_not contain_class('php::scl::php54') }
+    it { should contain_class('php::scl::php55') }
+    it { should_not contain_class('php::extensions::smarty') }
+    it { should contain_mod_fcgid__starter('example.com').with(
+      :tmp_dir          => false,
+      :cgi_type         => 'php',
+      :cgi_type_options => {
+        "engine"            =>"On",
+        "upload_tmp_dir"    =>"/var/www/upload_tmp_dir/example.com",
+        "session.save_path" =>"/var/www/session.save_path/example.com",
+        "error_log"         =>"/var/www/vhosts/example.com/logs/php_error_log",
+        "safe_mode"         =>:undef,
+        "safe_mode_gid"     =>:undef,
+        "safe_mode_exec_dir"=>:undef,
+        "default_charset"   =>:undef,
+        "open_basedir"      =>"/var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com"
+      },
+      :binary           => '/opt/rh/php55/root/usr/bin/php-cgi',
+      :additional_cmds  => 'source /opt/rh/php55/enable',
+      :rc               => '/opt/rh/php55/root/etc',
+      :owner            => 'foo',
+      :group            => 'bar',
+      :notify           => 'Service[apache]',
+    ) }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(0) }
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'absent',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid and params' do
+    let(:params){
+      {
+        :run_mode     => 'fcgid',
+        :run_uid      => 'foo',
+        :run_gid      => 'bar',
+        :logmode      => 'nologs',
+        :php_options  => {
+          'smarty'              => true,
+          'pear'                => true,
+          'safe_mode_exec_bins' => ['/usr/bin/cat'],
+        }
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__webdir('example.com') }
+    it { should contain_class('mod_fcgid') }
+    it { should contain_class('php::mod_fcgid') }
+    it { should contain_class('apache::include::mod_fcgid') }
+    it { should_not contain_class('php::scl::php54') }
+    it { should_not contain_class('php::scl::php55') }
+    it { should contain_class('php::extensions::smarty') }
+    it { should contain_mod_fcgid__starter('example.com').with(
+      :tmp_dir          => false,
+      :cgi_type         => 'php',
+      :cgi_type_options => {
+        "engine"            =>"On",
+        "upload_tmp_dir"    =>"/var/www/upload_tmp_dir/example.com",
+        "session.save_path" =>"/var/www/session.save_path/example.com",
+        "error_log"         =>:undef,
+        "safe_mode"         =>"On",
+        "safe_mode_gid"     =>"On",
+        "safe_mode_exec_dir"=>"/var/www/vhosts/example.com/bin",
+        "default_charset"   =>:undef,
+        "open_basedir"      =>"/usr/share/php/Smarty/:/usr/share/pear/:/var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com"
+      },
+      :owner            => 'foo',
+      :group            => 'bar',
+      :notify           => 'Service[apache]',
+    ) }
+
+    # only test variables that are tuned
+    it { should contain_apache__vhost__phpdirs('example.com').with(
+      :php_upload_tmp_dir     => '/var/www/upload_tmp_dir/example.com',
+      :php_session_save_path  => '/var/www/session.save_path/example.com',
+    )}
+    # only test variables that are tuned
+    it { should contain_apache__vhost('example.com').with(
+      :template_partial  => 'apache/vhosts/php/partial.erb',
+      :passing_extension => 'php'
+    )}
+
+    it { should have_apache__vhost__php__safe_mode_bin_resource_count(1) }
+    it { should contain_apache__vhost__php__safe_mode_bin('example.com@/usr/bin/cat').with(
+      :ensure => 'present',
+      :path   => '/var/www/vhosts/example.com/bin',
+    )}
+    it { should contain_file('/var/www/vhosts/example.com/bin').with(
+      :ensure  => 'directory',
+      :owner   => 'apache',
+      :group   => '0',
+      :recurse => true,
+      :force   => true,
+      :purge   => true,
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /dev/null
+  CustomLog /dev/null
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_webapp_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_webapp_spec.rb
new file mode 100644
index 00000000..bdebb14c
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_webapp_spec.rb
@@ -0,0 +1,261 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::webapp', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    let(:params){
+      {
+        :manage_config    => false,
+        :template_partial => 'apache/vhosts/php/partial.erb',
+      }
+    }
+    # only test variables that are tuned
+    it { should have_apache__file__rw_resource_count(0) }
+    it { should_not contain_apache__vhost__file__documentrootfile('configurationfile_example.com') }
+    it { should contain_apache__vhost__php__standard('example.com') }
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :manage_config    => false,
+        :template_partial => 'apache/vhosts/php/partial.erb',
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    # only test variables that are tuned
+    it { should have_apache__file__rw_resource_count(0) }
+    it { should_not contain_apache__vhost__file__documentrootfile('configurationfile_example.com') }
+    it { should contain_apache__vhost__php__standard('example.com') }
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +ExecCGI
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  context 'with config file and directories' do
+    describe 'with standard' do
+      let(:params){
+        {
+          :manage_config        => true,
+          :managed_directories  => [ '/tmp/a', '/tmp/b' ],
+          :config_file          => 'config.php',
+          :template_partial     => 'apache/vhosts/php/partial.erb',
+        }
+      }
+      # only test variables that are tuned
+      it { should have_apache__file__rw_resource_count(2) }
+      it { should contain_apache__file__rw('/tmp/a').with(
+        :owner => 'apache',
+        :group => 0,
+      )}
+      it { should contain_apache__file__rw('/tmp/b').with(
+        :owner => 'apache',
+        :group => 0,
+      )}
+      it { should contain_apache__vhost__file__documentrootfile('configurationfile_example.com').with(
+        :documentroot => '/var/www/vhosts/example.com/www',
+        :filename     => 'config.php',
+        :thedomain    => 'example.com',
+        :owner        => 'apache',
+        :group        => 0,
+        :mode         => '0440',
+      ) }
+      it { should contain_apache__vhost__php__standard('example.com') }
+      # go deeper in the catalog and test the produced template
+      it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+    end
+    describe 'with standard but writable' do
+      let(:params){
+        {
+          :manage_config        => true,
+          :config_webwriteable  => true,
+          :managed_directories  => [ '/tmp/a', '/tmp/b' ],
+          :config_file          => 'config.php',
+          :template_partial     => 'apache/vhosts/php/partial.erb',
+        }
+      }
+      # only test variables that are tuned
+      it { should have_apache__file__rw_resource_count(2) }
+      it { should contain_apache__file__rw('/tmp/a').with(
+        :owner => 'apache',
+        :group => 0,
+      )}
+      it { should contain_apache__file__rw('/tmp/b').with(
+        :owner => 'apache',
+        :group => 0,
+      )}
+      it { should contain_apache__vhost__file__documentrootfile('configurationfile_example.com').with(
+        :documentroot => '/var/www/vhosts/example.com/www',
+        :filename     => 'config.php',
+        :thedomain    => 'example.com',
+        :owner        => 'apache',
+        :group        => 0,
+        :mode         => '0660',
+      ) }
+      it { should contain_apache__vhost__php__standard('example.com') }
+      # go deeper in the catalog and test the produced template
+      it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+    end
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_php_wordpress_spec.rb b/puppet/modules/apache/spec/defines/vhost_php_wordpress_spec.rb
new file mode 100644
index 00000000..203f9690
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_php_wordpress_spec.rb
@@ -0,0 +1,171 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::php::wordpress', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  describe 'with standard' do
+    # only test the differences from the default
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :mod_security_rules_to_disable  => ["960010", "950018"],
+      :manage_directories             => true,
+      :managed_directories            => '/var/www/vhosts/example.com/www/wp-content',
+      :template_partial               => 'apache/vhosts/php_wordpress/partial.erb',
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'wp-config.php',
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride FileInfo
+
+    php_admin_flag engine on
+    php_admin_value error_log /var/www/vhosts/example.com/logs/php_error_log
+    php_admin_value open_basedir /var/www/vhosts/example.com/www:/var/www/vhosts/example.com/data:/var/www/upload_tmp_dir/example.com:/var/www/session.save_path/example.com
+    php_admin_flag safe_mode on
+    php_admin_value session.save_path /var/www/session.save_path/example.com
+    php_admin_value upload_tmp_dir /var/www/upload_tmp_dir/example.com
+
+
+  </Directory>
+
+
+  # fixes: http://git.zx2c4.com/w3-total-fail/tree/w3-total-fail.sh
+  <Directory \"/var/www/vhosts/example.com/www/wp-content/w3tc/dbcache\">
+    Deny From All
+  </Directory>
+
+  # simple wp-login brute force protection
+  # http://www.frameloss.org/2013/04/26/even-easier-brute-force-login-protection-for-wordpress/
+  RewriteEngine On
+  RewriteCond %{HTTP_COOKIE} !359422a82c97336dc082622faf72013a8e857bfd
+  RewriteRule ^/wp-login.php /wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php [R,L]
+  <Location /wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php>
+    CookieTracking on
+    CookieExpires 30
+    CookieName 359422a82c97336dc082622faf72013a8e857bfd
+  </Location>
+  RewriteRule ^/wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php /wp-login.php [NE]
+
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+
+    SecRuleRemoveById \"960010\"
+    SecRuleRemoveById \"950018\"
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with mod_fcgid' do
+    let(:params){
+      {
+        :run_mode => 'fcgid',
+        :run_uid  => 'foo',
+        :run_gid  => 'bar',
+      }
+    }
+    # only test variables that are tuned
+    it { should contain_apache__vhost__php__webapp('example.com').with(
+      :run_mode                       => 'fcgid',
+      :run_uid                        => 'foo',
+      :run_gid                        => 'bar',
+      :template_partial               => 'apache/vhosts/php_wordpress/partial.erb',
+      :mod_security_rules_to_disable  => ["960010", "950018"],
+      :manage_directories             => true,
+      :managed_directories            => '/var/www/vhosts/example.com/www/wp-content',
+      :manage_config                  => true,
+      :config_webwriteable            => false,
+      :config_file                    => 'wp-config.php',
+    )}
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+  DirectoryIndex index.htm index.html index.php
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup foo bar
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/example.com/example.com-starter .php
+    AddHandler fcgid-script .php
+  </IfModule>
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride FileInfo
+    Options  +ExecCGI
+
+
+  </Directory>
+
+
+  # fixes: http://git.zx2c4.com/w3-total-fail/tree/w3-total-fail.sh
+  <Directory \"/var/www/vhosts/example.com/www/wp-content/w3tc/dbcache\">
+    Deny From All
+  </Directory>
+
+  # simple wp-login brute force protection
+  # http://www.frameloss.org/2013/04/26/even-easier-brute-force-login-protection-for-wordpress/
+  RewriteEngine On
+  RewriteCond %{HTTP_COOKIE} !359422a82c97336dc082622faf72013a8e857bfd
+  RewriteRule ^/wp-login.php /wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php [R,L]
+  <Location /wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php>
+    CookieTracking on
+    CookieExpires 30
+    CookieName 359422a82c97336dc082622faf72013a8e857bfd
+  </Location>
+  RewriteRule ^/wordpress-login-576a63fdc98202e7c7283713f2ddfee334bf13ee.php /wp-login.php [NE]
+
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+
+    SecRuleRemoveById \"960010\"
+    SecRuleRemoveById \"950018\"
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_spec.rb b/puppet/modules/apache/spec/defines/vhost_spec.rb
new file mode 100644
index 00000000..051ad0d4
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_spec.rb
@@ -0,0 +1,202 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  let(:pre_condition) {
+    'include apache'
+  }
+  describe 'with standard' do
+    it { should contain_apache__vhost__template('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => false,
+      :run_mode       => 'normal',
+      :ssl_mode       => false,
+      :logmode        => 'default',
+      :mod_security   => true,
+      :htpasswd_file  => 'absent',
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    # go deeper in the catalog and the test the produced content from the template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params' do
+    let(:params){
+      {
+        :do_includes    => true,
+        :ssl_mode       => true,
+        :logmode        => 'anonym',
+        :mod_security   => false,
+        :htpasswd_file  => true,
+      }
+    }
+    it { should contain_apache__vhost__template('example.com').with(
+      :ensure                           => 'present',
+      :path                             => 'absent',
+      :path_is_webdir                   => false,
+      :logpath                          => 'absent',
+      :logmode                          => 'anonym',
+      :logprefix                        => '',
+      :domain                           => 'absent',
+      :domainalias                      => 'absent',
+      :server_admin                     => 'absent',
+      :allow_override                   => 'None',
+      :do_includes                      => true,
+      :options                          => 'absent',
+      :additional_options               => 'absent',
+      :default_charset                  => 'absent',
+      :php_settings                     => {},
+      :php_options                      => {},
+      :run_mode                         => 'normal',
+      :run_uid                          => 'absent',
+      :run_gid                          => 'absent',
+      :template_partial                 => 'apache/vhosts/static/partial.erb',
+      :ssl_mode                         => true,
+      :htpasswd_file                    => true,
+      :htpasswd_path                    => 'absent',
+      :ldap_auth                        => false,
+      :ldap_user                        => 'any',
+      :mod_security                     => false,
+      :mod_security_relevantonly        => true,
+      :mod_security_rules_to_disable    => [],
+      :mod_security_additional_options  => 'absent',
+      :use_mod_macro                    => false,
+      :passing_extension                => 'absent',
+      :gempath                          => 'absent',
+    )}
+    # go deeper in the catalog and the test the produced content from the template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+<VirtualHost *:443 >
+
+  Include include.d/defaults.inc
+  Include include.d/ssl_defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params II' do
+    let(:params){
+      {
+        :vhost_mode     => 'file',
+      }
+    }
+    it { should_not contain_apache__vhost__template('example.com') }
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure             => 'present',
+      :vhost_source       => 'absent',
+      :vhost_destination  => 'absent',
+      :do_includes        => false,
+      :run_mode       => 'normal',
+      :mod_security   => true,
+      :htpasswd_file  => 'absent',
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+  end
+  describe 'with wrong vhost_mode' do
+    let(:params){
+      {
+        :vhost_mode     => 'foo',
+      }
+    }
+    it { expect { should compile }.to raise_error(Puppet::Error, /No such vhost_mode: foo defined for example.com\./)
+    }
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_static_spec.rb b/puppet/modules/apache/spec/defines/vhost_static_spec.rb
new file mode 100644
index 00000000..37891bb5
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_static_spec.rb
@@ -0,0 +1,54 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::static', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  let(:pre_condition) {
+    'include apache'
+  }
+  describe 'with standard' do
+    # only test the relevant options
+    it { should contain_apache__vhost__webdir('example.com').with(
+      :datadir  => false,
+    )}
+    it { should contain_apache__vhost('example.com') }
+    # go deeper in the catalog and test the produced template
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/defines/vhost_template_spec.rb b/puppet/modules/apache/spec/defines/vhost_template_spec.rb
new file mode 100644
index 00000000..96fb9ac3
--- /dev/null
+++ b/puppet/modules/apache/spec/defines/vhost_template_spec.rb
@@ -0,0 +1,297 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'apache::vhost::template', :type => 'define' do
+  let(:title){ 'example.com' }
+  let(:facts){
+    {
+      :fqdn => 'apache.example.com',
+      :operatingsystem            => 'CentOS',
+      :operatingsystemmajrelease  => '7',
+    }
+  }
+  let(:pre_condition) {
+    'include apache'
+  }
+  describe 'with standard' do
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => false,
+      :run_mode       => 'normal',
+      :ssl_mode       => false,
+      :logmode        => 'default',
+      :mod_security   => true,
+      :htpasswd_file  => 'absent',
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log combined
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params' do
+    let(:params){
+      {
+        :do_includes    => true,
+        :ssl_mode       => true,
+        :logmode        => 'anonym',
+        :mod_security   => false,
+        :htpasswd_file  => true,
+      }
+    }
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => true,
+      :run_mode       => 'normal',
+      :ssl_mode       => true,
+      :logmode        => 'anonym',
+      :mod_security   => false,
+      :htpasswd_file  => true,
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+<VirtualHost *:443 >
+
+  Include include.d/defaults.inc
+  Include include.d/ssl_defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params II' do
+    let(:params){
+      {
+        :do_includes    => true,
+        :ssl_mode       => 'force',
+        :logmode        => 'semianonym',
+        :mod_security   => false,
+        :htpasswd_file  => true,
+      }
+    }
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => true,
+      :run_mode       => 'normal',
+      :ssl_mode       => 'force',
+      :logmode        => 'semianonym',
+      :mod_security   => false,
+      :htpasswd_file  => true,
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:80 >
+
+  Include include.d/defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  RewriteEngine On
+  RewriteCond %{HTTPS} !=on
+  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+  RewriteRule (.*) https://%{SERVER_NAME}$1 [R=permanent,L]
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+<VirtualHost *:443 >
+
+  Include include.d/defaults.inc
+  Include include.d/ssl_defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /var/www/vhosts/example.com/logs/error_log
+  CustomLog /var/www/vhosts/example.com/logs/access_log noip
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+    Options  +Includes
+    AuthType Basic
+    AuthName \"Access fuer example.com\"
+    AuthUserFile /var/www/htpasswds/example.com
+    require valid-user
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine Off
+    SecAuditEngine Off
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+  describe 'with params III' do
+    let(:params){
+      {
+        :do_includes    => false,
+        :ssl_mode       => 'only',
+        :logmode        => 'nologs',
+        :mod_security   => true,
+        :htpasswd_file  => 'absent',
+      }
+    }
+    it { should contain_apache__vhost__file('example.com').with(
+      :ensure         => 'present',
+      :do_includes    => false,
+      :run_mode       => 'normal',
+      :ssl_mode       => 'only',
+      :logmode        => 'nologs',
+      :mod_security   => true,
+      :htpasswd_file  => 'absent',
+      :htpasswd_path  => 'absent',
+      :use_mod_macro  => false,
+    )}
+    it { should contain_apache__vhost__file('example.com').with_content(
+"<VirtualHost *:443 >
+
+  Include include.d/defaults.inc
+  Include include.d/ssl_defaults.inc
+  ServerName example.com
+  DocumentRoot /var/www/vhosts/example.com/www/
+
+
+  ErrorLog /dev/null
+  CustomLog /dev/null
+
+
+
+  <Directory \"/var/www/vhosts/example.com/www/\">
+    AllowOverride None
+
+
+  </Directory>
+
+  <IfModule mod_security2.c>
+    SecRuleEngine On
+    SecAuditEngine RelevantOnly
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir /var/www/vhosts/example.com/logs/
+    SecAuditLog /var/www/vhosts/example.com/logs/mod_security_audit.log
+    SecDebugLog /var/www/vhosts/example.com/logs/mod_security_debug.log
+  </IfModule>
+
+</VirtualHost>
+"
+)}
+  end
+end
diff --git a/puppet/modules/apache/spec/functions/guess_apache_version.rb b/puppet/modules/apache/spec/functions/guess_apache_version.rb
new file mode 100644
index 00000000..b57a7a0f
--- /dev/null
+++ b/puppet/modules/apache/spec/functions/guess_apache_version.rb
@@ -0,0 +1,50 @@
+require File.expand_path(File.join(File.dirname(__FILE__),'../spec_helper'))
+
+describe 'guess_apache_version function' do
+
+  #let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("guess_apache_version")).to eq("function_guess_apache_version")
+  end
+
+  context 'on debian 7.8' do
+    let(:facts) do
+      {
+        :operatingsystem => 'Debian',
+        :operatingsystemrelease => '7.8'
+      }
+    end
+    it "should return 2.2" do
+      result = scope.function_guess_apache_version([])
+      expect(result).to(eq('2.2'))
+    end
+  end
+
+  context 'on debian 8.0' do
+    let(:facts) do
+      {
+        :operatingsystem => 'Debian',
+        :operatingsystemrelease => '8.0'
+      }
+    end
+    it "should return 2.4" do
+      result = scope.function_guess_apache_version([])
+      expect(result).to(eq('2.4'))
+    end
+  end
+
+  context 'on ubuntu 15.10' do
+    let(:facts) do
+      {
+        :operatingsystem => 'Ubuntu',
+        :operatingsystemrelease => '15.10'
+      }
+    end
+    it "should return 2.4" do
+      result = scope.function_guess_apache_version([])
+      expect(result).to(eq('2.4'))
+    end
+  end
+
+end
diff --git a/puppet/modules/apache/spec/spec_helper.rb b/puppet/modules/apache/spec/spec_helper.rb
new file mode 100644
index 00000000..381f9720
--- /dev/null
+++ b/puppet/modules/apache/spec/spec_helper.rb
@@ -0,0 +1,13 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
+require 'rake'
+
+fixture_path = File.expand_path(File.join(__FILE__, '..', 'fixtures'))
+
+RSpec.configure do |c|
+  c.module_path = File.join(fixture_path, 'modules')
+  c.manifest_dir = File.join(fixture_path, 'manifests')
+  c.pattern = FileList[c.pattern].exclude(/^spec\/fixtures/)
+end
+
+Puppet::Util::Log.level = :warning
+Puppet::Util::Log.newdestination(:console)
diff --git a/puppet/modules/apache/templates/default/default_index.erb b/puppet/modules/apache/templates/default/default_index.erb
new file mode 100644
index 00000000..b35ecd91
--- /dev/null
+++ b/puppet/modules/apache/templates/default/default_index.erb
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<head>
+  <title><%= scope.lookupvar('::hostname') %></title>
+  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
+</head>
+<body>
+  <h1> No page @ this location</h1>
+  <p>
+    <small><em><%= scope.lookupvar('::hostname') %></em></small>
+  </p>
+</body>
+</html>
diff --git a/puppet/modules/apache/templates/include.d/ssl_defaults.inc.erb b/puppet/modules/apache/templates/include.d/ssl_defaults.inc.erb
new file mode 100644
index 00000000..77f8e77a
--- /dev/null
+++ b/puppet/modules/apache/templates/include.d/ssl_defaults.inc.erb
@@ -0,0 +1,78 @@
+#   SSL Engine Switch:
+#   Enable/Disable SSL for this virtual host.
+SSLEngine on
+
+#   SSL Protocol support:
+# List the enable protocol levels with which clients will be able to
+# connect.  Disable SSLv2 access by default:
+SSLProtocol All -SSLv2 -SSLv3
+
+#   SSL Cipher Suite:
+# List the ciphers that the client is permitted to negotiate.
+# See the mod_ssl documentation for a complete list.
+SSLCipherSuite "<%= scope.lookupvar('apache::ssl_cipher_suite') %>"
+
+SSLHonorCipherOrder on
+
+#   SSL Engine Options:
+#   Set various options for the SSL engine.
+#   o FakeBasicAuth:
+#     Translate the client X.509 into a Basic Authorisation.  This means that
+#     the standard Auth/DBMAuth methods can be used for access control.  The
+#     user name is the `one line' version of the client's X.509 certificate.
+#     Note that no password is obtained from the user. Every entry in the user
+#     file needs this password: `xxj31ZMTZzkVA'.
+#   o ExportCertData:
+#     This exports two additional environment variables: SSL_CLIENT_CERT and
+#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+#     server (always existing) and the client (only existing when client
+#     authentication is used). This can be used to import the certificates
+#     into CGI scripts.
+#   o StdEnvVars:
+#     This exports the standard SSL/TLS related `SSL_*' environment variables.
+#     Per default this exportation is switched off for performance reasons,
+#     because the extraction step is an expensive operation and is usually
+#     useless for serving static content. So one usually enables the
+#     exportation for CGI and SSI requests only.
+#   o StrictRequire:
+#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
+#     under a "Satisfy any" situation, i.e. when it applies access is denied
+#     and no other module can change it.
+#   o OptRenegotiate:
+#     This enables optimized SSL connection renegotiation handling when SSL
+#     directives are used in per-directory context. 
+#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+<Files ~ "\.(cgi|shtml|phtml|php3?)$">
+    SSLOptions +StdEnvVars
+</Files>
+<Directory "/var/www/cgi-bin">
+    SSLOptions +StdEnvVars
+</Directory>
+
+#   SSL Protocol Adjustments:
+#   The safe and default but still SSL/TLS standard compliant shutdown
+#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+#   the close notify alert from client. When you need a different shutdown
+#   approach you can use one of the following variables:
+#   o ssl-unclean-shutdown:
+#     This forces an unclean shutdown when the connection is closed, i.e. no
+#     SSL close notify alert is send or allowed to received.  This violates
+#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
+#     this when you receive I/O errors because of the standard approach where
+#     mod_ssl sends the close notify alert.
+#   o ssl-accurate-shutdown:
+#     This forces an accurate shutdown when the connection is closed, i.e. a
+#     SSL close notify alert is send and mod_ssl waits for the close notify
+#     alert of the client. This is 100% SSL/TLS standard compliant, but in
+#     practice often causes hanging connections with brain-dead browsers. Use
+#     this only for browsers where you know that their SSL implementation
+#     works correctly. 
+#   Notice: Most problems of broken clients are also related to the HTTP
+#   keep-alive facility, so you usually additionally want to disable
+#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+#   "force-response-1.0" for this.
+SetEnvIf User-Agent ".*MSIE.*" \
+         nokeepalive ssl-unclean-shutdown \
+         downgrade-1.0 force-response-1.0
diff --git a/puppet/modules/apache/templates/itk_plus/CentOS/00-listen-ssl.conf.erb b/puppet/modules/apache/templates/itk_plus/CentOS/00-listen-ssl.conf.erb
new file mode 100644
index 00000000..83f7beeb
--- /dev/null
+++ b/puppet/modules/apache/templates/itk_plus/CentOS/00-listen-ssl.conf.erb
@@ -0,0 +1,6 @@
+<IfDefine HttpdLocal>
+Listen 127.0.0.1:443
+</IfDefine>
+<IfDefine !HttpdLocal>
+Listen <%= scope.lookupvar('::ipaddress') %>:443
+</IfDefine>
diff --git a/puppet/modules/apache/templates/itk_plus/CentOS/00-listen.conf.erb b/puppet/modules/apache/templates/itk_plus/CentOS/00-listen.conf.erb
new file mode 100644
index 00000000..30b20466
--- /dev/null
+++ b/puppet/modules/apache/templates/itk_plus/CentOS/00-listen.conf.erb
@@ -0,0 +1,8 @@
+<IfDefine HttpdLocal>
+Listen 127.0.0.1:80
+PidFile run/httpdlocal.pid
+</IfDefine>
+<IfDefine !HttpdLocal>
+Listen <%= scope.lookupvar('::ipaddress') %>:80
+PidFile run/httpd.pid
+</IfDefine>
diff --git a/puppet/modules/apache/templates/vhosts/0-default_ssl.conf.erb b/puppet/modules/apache/templates/vhosts/0-default_ssl.conf.erb
new file mode 100644
index 00000000..86e4979f
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/0-default_ssl.conf.erb
@@ -0,0 +1,21 @@
+############################################################
+### This file is managed by PUPPET!                     ####
+### Only modify in repo or you will loose the changes!  ####
+############################################################
+
+<VirtualHost *:443>
+    Include include.d/defaults.inc
+    Include include.d/ssl_defaults.inc
+    DocumentRoot /var/www/html
+
+    # Use separate log files for the SSL virtual host; note that LogLevel
+    # is not inherited from httpd.conf.
+    ErrorLog logs/ssl_error_log
+    TransferLog logs/ssl_access_log
+    LogLevel warn
+
+<%= scope.function_templatewlv(['apache/vhosts/partials/ssl.erb',
+                                {'configuration' => {}}]) %>
+</VirtualHost>
+
+# vim: ts=4 filetype=apache
diff --git a/puppet/modules/apache/templates/vhosts/default.erb b/puppet/modules/apache/templates/vhosts/default.erb
new file mode 100644
index 00000000..1ef8023d
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/default.erb
@@ -0,0 +1,44 @@
+<%
+vhost_parts = case @ssl_mode
+  when 'only' then [:ssl]
+  when false,'false' then  [:normal]
+  else [:normal,:ssl]
+end
+vhost_parts.each do |vhost_part| -%>
+<VirtualHost *:<%= vhost_part == :ssl ? '443' : '80' %> >
+
+<%= scope.function_templatewlv(['apache/vhosts/partials/header_default.erb',
+                                {'vhost_part'    => vhost_part,
+                                 'configuration' => @configuration,}]) %>
+
+<%= scope.function_template(['apache/vhosts/partials/logs.erb']) %>
+
+<% if @run_mode.to_s =~ /(proxy\-|static\-)?itk/ -%>
+  <IfModule mpm_itk_module>
+    AssignUserId <%= "#{@run_uid} #{@run_gid}" %>
+  </IfModule>
+
+<% elsif @run_mode.to_s == 'fcgid' -%>
+  <IfModule mod_fcgid.c>
+    SuexecUserGroup <%= "#{@run_uid} #{@run_gid}" %>
+    FcgidMaxRequestsPerProcess 5000
+    FCGIWrapper /var/www/mod_fcgid-starters/<%= @name %>/<%= @name %>-starter .<%= @passing_extension %>
+    AddHandler fcgid-script .<%= @passing_extension %>
+  </IfModule>
+
+<% end -%>
+<% if @ssl_mode == 'force' && vhost_part == :normal -%>
+  RewriteEngine On
+  RewriteCond %{HTTPS} !=on
+  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+  RewriteRule (.*) https://%{SERVER_NAME}$1 [R=permanent,L]
+<% end -%>
+<%= scope.function_templatewlv([@template_partial, {'vhost_part' => vhost_part } ]) %>
+<% unless @template_partial == 'apache/vhosts/itk_plus/partial.erb' -%>
+<%= scope.function_template(['apache/vhosts/partials/mod_security.erb']) %>
+<% end -%>
+<% unless @additional_options.to_s == 'absent' -%>
+  <%= @additional_options %>
+<% end -%>
+</VirtualHost>
+<% end -%>
diff --git a/puppet/modules/apache/templates/vhosts/gitweb/partial.erb b/puppet/modules/apache/templates/vhosts/gitweb/partial.erb
new file mode 100644
index 00000000..a8475f60
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/gitweb/partial.erb
@@ -0,0 +1,16 @@
+  SetEnv GITWEB_CONFIG <%= @gitweb_config %>
+  DirectoryIndex gitweb.cgi
+  <Directory "<%= @documentroot %>/">
+<% if @options.to_s != 'absent' || @do_includes.to_s == 'true'-%>
+    Options <% unless @options.to_s == 'absent' -%><%= @options %><% end -%><% if @do_includes.to_s == 'true' && !@options.include?('+Includes') -%> +Includes<% end -%><% unless @options.include?('+ExecCGI') -%> +ExecCGI<% end -%>
+<% end -%>
+    AddHandler cgi-script .cgi
+    <Files gitweb.cgi>
+      Options ExecCGI FollowSymLinks
+      SetHandler cgi-script
+    </Files>
+    RewriteEngine on
+    RewriteRule ^[a-zA-Z0-9_-]+.git/?(\?.)?$ /gitweb.cgi%{REQUESTURI} [L,PT]
+
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+  </Directory>
diff --git a/puppet/modules/apache/templates/vhosts/itk_plus.erb b/puppet/modules/apache/templates/vhosts/itk_plus.erb
new file mode 100644
index 00000000..b5461968
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/itk_plus.erb
@@ -0,0 +1,6 @@
+<IfDefine HttpdLocal>
+<%= scope.function_template(['apache/vhost/default.erb']) %>
+</IfDefine>
+<IfDefine !HttpdLocal>
+<%= scope.function_templatewlv(['apache/vhost/default.erb', {'template_partial' => 'apache/vhosts/itk_plus/partial.erb' }]) %>
+</IfDefine>
diff --git a/puppet/modules/apache/templates/vhosts/itk_plus/partial.erb b/puppet/modules/apache/templates/vhosts/itk_plus/partial.erb
new file mode 100644
index 00000000..df045433
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/itk_plus/partial.erb
@@ -0,0 +1,31 @@
+
+  ProxyPreserveHost On
+  ProxyRequests off
+<% if vhost_part == :ssl -%>
+  SSLProxyEngine On
+<%   if run_mode.to_s == 'static-itk' -%>
+  ProxyPassMatch ^/(.*\.<%= @passing_extension %>/?.*)$ https://127.0.0.1/$1
+<%   else -%>
+  ProxyPass / https://127.0.0.1/
+<%   end -%>
+  ProxyPassReverse / https://127.0.0.1/
+<% else -%>
+<%   if run_mode.to_s == 'static-itk' -%>
+  ProxyPassMatch ^/(.*\.<%= @passing_extension %>/?.*)$ http://127.0.0.1/$1
+<%   else -%>
+  ProxyPass / http://127.0.0.1/
+<%   end -%>
+  ProxyPassReverse / http://127.0.0.1/
+<% end -%>
+
+<% if @run_mode.to_s == 'static-itk' && (@ssl_mode.to_s != 'force' || vhost_part == :ssl) -%>
+  <Directory "<%= @documentroot %>/">
+    AllowOverride <%= @allow_override %>
+<%   if @options.to_s != 'absent' || @do_includes.to_s == 'true' -%>
+    Options <% unless @options.to_s == 'absent' -%><%= @options %><% end -%><% if @do_includes.to_s == 'true' && !@options.include?('+Includes') -%> +Includes<% end -%>
+<%   end -%>
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+  </Directory>
+<% end -%>
+
+
diff --git a/puppet/modules/apache/templates/vhosts/partials/authentication.erb b/puppet/modules/apache/templates/vhosts/partials/authentication.erb
new file mode 100644
index 00000000..ed832210
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/partials/authentication.erb
@@ -0,0 +1,6 @@
+<% unless @htpasswd_file.to_s == 'absent' -%>
+    AuthType Basic
+    AuthName "Access fuer <%= @servername %>"
+    AuthUserFile <%= @real_htpasswd_path %>
+    require valid-user
+<% end -%>
diff --git a/puppet/modules/apache/templates/vhosts/partials/header_default.erb b/puppet/modules/apache/templates/vhosts/partials/header_default.erb
new file mode 100644
index 00000000..cd4d04ca
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/partials/header_default.erb
@@ -0,0 +1,22 @@
+  Include include.d/defaults.inc
+<% if vhost_part == :ssl -%>
+  Include include.d/ssl_defaults.inc
+<%= scope.function_templatewlv(['apache/vhosts/partials/ssl.erb',
+                                {'configuration' => configuration}]) %>
+<% end -%>
+  ServerName <%= @servername %>
+<% unless @serveralias.empty? || (@serveralias == 'absent') -%>
+  ServerAlias <%= Array(@serveralias).sort.join(' ') %>
+<% end -%>
+<% unless @server_admin.empty? || (@server_admin == 'absent') -%>
+  ServerAdmin <%= @server_admin %>
+<% end -%>
+<% unless @documentroot == 'really_absent' -%>
+  DocumentRoot <%= @documentroot %>/
+<% end -%>
+<% if @default_charset != 'absent' -%>
+  AddDefaultCharset <%= @default_charset %>
+<% end -%>
+<% if @passing_extension != 'absent' -%>
+  DirectoryIndex index.htm index.html index.<%= @passing_extension %>
+<% end -%>
diff --git a/puppet/modules/apache/templates/vhosts/partials/logs.erb b/puppet/modules/apache/templates/vhosts/partials/logs.erb
new file mode 100644
index 00000000..4fe1b0a6
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/partials/logs.erb
@@ -0,0 +1,18 @@
+<% case @logmode.to_s
+      when 'nologs' -%>
+  ErrorLog /dev/null
+  CustomLog /dev/null %%
+<% when 'noaccess' -%>
+  ErrorLog <%= @logdir %>/<%= @logprefix %>error_log
+  CustomLog /dev/null noip
+<% when 'semianonym' -%>
+  ErrorLog <%= @logdir %>/<%= @logprefix %>error_log
+  CustomLog <%= @logdir %>/<%= @logprefix %>access_log noip
+<% when 'anonym' -%>
+  ErrorLog /dev/null
+  CustomLog <%= @logdir %>/<%= @logprefix %>access_log noip
+<% else -%>
+  ErrorLog <%= @logdir %>/<%= @logprefix %>error_log
+  CustomLog <%= @logdir %>/<%= @logprefix %>access_log combined
+<% end -%>
+
diff --git a/puppet/modules/apache/templates/vhosts/partials/mod_security.erb b/puppet/modules/apache/templates/vhosts/partials/mod_security.erb
new file mode 100644
index 00000000..380e78f1
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/partials/mod_security.erb
@@ -0,0 +1,27 @@
+  <IfModule mod_security2.c>
+<% if @mod_security.to_s == 'true' -%>
+    SecRuleEngine On
+<%   if @mod_security_relevantonly.to_s == 'true' -%>
+    SecAuditEngine RelevantOnly
+<%   else -%>
+    SecAuditEngine On
+<%   end -%>
+<% else -%>
+    SecRuleEngine Off
+    SecAuditEngine Off
+<% end -%>
+    SecAuditLogType Concurrent
+    SecAuditLogStorageDir <%= @logdir %>/
+    SecAuditLog <%= @logdir %>/mod_security_audit.log
+    SecDebugLog <%= @logdir %>/mod_security_debug.log
+<% unless (disabled_rules=Array(@mod_security_rules_to_disable)).empty? -%>
+
+<%    disabled_rules.each do |rule| -%>
+    SecRuleRemoveById "<%= rule %>"
+<%   end -%>
+<% end -%>
+<% unless (s=@mod_security_additional_options).to_s == 'absent' -%>
+
+    <%= s %>
+<% end -%>
+  </IfModule>
diff --git a/puppet/modules/apache/templates/vhosts/partials/php_settings.erb b/puppet/modules/apache/templates/vhosts/partials/php_settings.erb
new file mode 100644
index 00000000..74f6ecf2
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/partials/php_settings.erb
@@ -0,0 +1,20 @@
+<% if @run_mode != 'fcgid'
+  @php_settings.reject{|k,v| (v == :undef) || v.nil? }.keys.sort.each do |key|
+    dvalue = @php_settings[key].to_s.downcase
+    munged_value = if dvalue == 'true'
+       'on'
+      elsif dvalue == 'false'
+        'off'
+      elsif ['on','off'].include?(dvalue)
+        dvalue
+      else
+        @php_settings[key]
+      end
+
+       if ['on','off' ].include?(munged_value) -%>
+    php_admin_flag <%= key %> <%= munged_value %>
+<%     else -%>
+    php_admin_value <%= key %> <%= munged_value %>
+<%     end -%>
+<%   end -%>
+<% end -%>
diff --git a/puppet/modules/apache/templates/vhosts/partials/ssl.erb b/puppet/modules/apache/templates/vhosts/partials/ssl.erb
new file mode 100644
index 00000000..c9f39333
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/partials/ssl.erb
@@ -0,0 +1,8 @@
+  SSLCertificateFile <%= configuration['ssl_certificate_file'] || scope.lookupvar('apache::default_ssl_certificate_file') %>
+  SSLCertificateKeyFile <%= configuration['ssl_certificate_key_file'] || scope.lookupvar('apache::default_ssl_certificate_key_file') %>
+<% if configuration['ssl_certificate_chain_file'] || scope.lookupvar('apache::default_ssl_certificate_chain_file') != 'absent' -%>
+  SSLCertificateChainFile <%= configuration['ssl_certificate_chain_file'] || scope.lookupvar('apache::default_ssl_certificate_chain_file') %>
+<% end -%>
+<% if configuration['hsts'] -%>
+  Header add Strict-Transport-Security "max-age=<%= (configuration['hsts']['age'] || 15768000) rescue 15768000 %>"
+<% end -%>
diff --git a/puppet/modules/apache/templates/vhosts/partials/std_override_options.erb b/puppet/modules/apache/templates/vhosts/partials/std_override_options.erb
new file mode 100644
index 00000000..6d8b74f8
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/partials/std_override_options.erb
@@ -0,0 +1,4 @@
+    AllowOverride <%= @allow_override %>
+<% if @options.to_s != 'absent' || @do_includes.to_s == 'true' || @run_mode == 'fcgid' -%>
+    Options <%- unless @options.to_s == 'absent' -%><%= @options %><% end -%><% if @do_includes.to_s == 'true' && !@options.include?('+Includes') -%> +Includes<% end -%><% if @run_mode == 'fcgid' && !@options.include?('+ExecCGI') -%> +ExecCGI<% end -%>
+<% end -%>
diff --git a/puppet/modules/apache/templates/vhosts/passenger/partial.erb b/puppet/modules/apache/templates/vhosts/passenger/partial.erb
new file mode 100644
index 00000000..c3b63f55
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/passenger/partial.erb
@@ -0,0 +1,7 @@
+  SetEnv GEM_HOME <%= @gempath %>
+  <Directory <%= @documentroot %>/>
+    AllowOverride <%= @allow_override %>
+    Options <%- unless @options.to_s == 'absent' -%><%= @options %><%- end -%><%- unless !@options.to_s.include?('MultiViews') -%>-MultiViews<%- end -%>
+
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+  </Directory>
diff --git a/puppet/modules/apache/templates/vhosts/perl/partial.erb b/puppet/modules/apache/templates/vhosts/perl/partial.erb
new file mode 100644
index 00000000..8c1f0a5a
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/perl/partial.erb
@@ -0,0 +1,14 @@
+  <Directory "<%= @documentroot %>/">
+<%= scope.function_template(['apache/vhosts/partials/std_override_options.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+  </Directory>
+
+<% unless @htpasswd_file.to_s == 'absent' -%>
+  <Directory "<%= @cgi_binpath %>/">
+    AuthType Basic
+    AuthName "Access fuer <%= @servername %>"
+    AuthUserFile <%= @real_htpasswd_path %>
+    require valid-user
+  </Directory>
+<% end -%>
+ ScriptAlias /cgi-bin/ <%= @cgi_binpath %>/
diff --git a/puppet/modules/apache/templates/vhosts/php/partial.erb b/puppet/modules/apache/templates/vhosts/php/partial.erb
new file mode 100644
index 00000000..c19ae7b4
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/php/partial.erb
@@ -0,0 +1,5 @@
+  <Directory "<%= @documentroot %>/">
+<%= scope.function_template(['apache/vhosts/partials/std_override_options.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/php_settings.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+  </Directory>
diff --git a/puppet/modules/apache/templates/vhosts/php_drupal/partial.erb b/puppet/modules/apache/templates/vhosts/php_drupal/partial.erb
new file mode 100644
index 00000000..316942fd
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/php_drupal/partial.erb
@@ -0,0 +1,22 @@
+  <Directory "<%= @documentroot %>/">
+<%= scope.function_template(['apache/vhosts/partials/std_override_options.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/php_settings.erb']) %>
+    # Protect files and directories from prying eyes.
+    <FilesMatch "\.(engine|inc|info|install|module|profile|po|sh|.*sql|theme|tpl(\.php)?|xtmpl)$|^(code-style\.pl|Entries.*|Repository|Root|Tag|Template)$">
+      Order allow,deny
+    </FilesMatch>
+
+    # Customized error messages.
+    ErrorDocument 404 /index.php
+
+    RewriteEngine on
+    RewriteCond %{REQUEST_FILENAME} !-f
+    RewriteCond %{REQUEST_FILENAME} !-d
+    RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
+  </Directory>
+  <Directory "<%= @documentroot %>/files/">
+    SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
+    Options None
+    Options +FollowSymLinks
+  </Directory>
diff --git a/puppet/modules/apache/templates/vhosts/php_gallery2/partial.erb b/puppet/modules/apache/templates/vhosts/php_gallery2/partial.erb
new file mode 100644
index 00000000..218c0e71
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/php_gallery2/partial.erb
@@ -0,0 +1,14 @@
+  <Directory "<%= @documentroot %>/">
+<%= scope.function_template(['apache/vhosts/partials/std_override_options.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/php_settings.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+
+    # Always rewrite login's
+    # Source: http://gallery.menalto.com/node/30558
+    RewriteEngine On
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+    RewriteCond %{HTTP_COOKIE} ^GALLERYSID= [OR]
+    RewriteCond %{QUERY_STRING} subView=core\.UserLogin
+    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,R,L]
+  </Directory>
diff --git a/puppet/modules/apache/templates/vhosts/php_joomla/partial.erb b/puppet/modules/apache/templates/vhosts/php_joomla/partial.erb
new file mode 100644
index 00000000..55445bfc
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/php_joomla/partial.erb
@@ -0,0 +1,30 @@
+  <Directory "<%= @documentroot %>/">
+<%= scope.function_template(['apache/vhosts/partials/std_override_options.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/php_settings.erb']) %> 
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+
+    Include include.d/joomla.inc
+  </Directory>
+
+  <Directory "<%= @documentroot %>/administrator/">
+    RewriteEngine on
+
+    # Rewrite URLs to https that go for the admin area
+    RewriteCond %{REMOTE_ADDR} !^127\.[0-9]+\.[0-9]+\.[0-9]+$
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{REQUEST_URI} (.*/administrator/.*)
+    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R]
+  </Directory>
+
+  # Deny various directories that
+  # shouldn't be webaccessible
+  <Directory "<%= @documentroot %>/tmp/">
+    Deny From All
+  </Directory>
+  <Directory "<%= @documentroot %>/logs/">
+    Deny From All
+  </Directory>
+  <Directory "<%= @documentroot %>/cli/">
+    Deny From All
+  </Directory>
+
diff --git a/puppet/modules/apache/templates/vhosts/php_mediawiki/partial.erb b/puppet/modules/apache/templates/vhosts/php_mediawiki/partial.erb
new file mode 100644
index 00000000..1ed6ee3e
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/php_mediawiki/partial.erb
@@ -0,0 +1,7 @@
+<% if @run_mode == 'fcgid' -%>
+  RewriteEngine On
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
+  RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-d
+  RewriteRule ^/?index.php/(.*)$ /index.php?title=$1 [PT,L,QSA]
+<% end -%>
+<%= scope.function_template(['apache/vhosts/php/partial.erb']) %>
diff --git a/puppet/modules/apache/templates/vhosts/php_silverstripe/partial.erb b/puppet/modules/apache/templates/vhosts/php_silverstripe/partial.erb
new file mode 100644
index 00000000..75a81931
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/php_silverstripe/partial.erb
@@ -0,0 +1,12 @@
+  # silverstripe
+  RewriteEngine On
+  RewriteCond %{HTTPS} !=on
+  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+  RewriteRule /(Security|admin)(.*) https://%{HTTP_HOST}/admin$1$2 [L,R,NE]
+
+  <Directory "<%= @documentroot %>/">
+<%= scope.function_template(['apache/vhosts/partials/std_override_options.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/php_settings.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+    Include include.d/silverstripe.inc
+  </Directory>
diff --git a/puppet/modules/apache/templates/vhosts/php_typo3/partial.erb b/puppet/modules/apache/templates/vhosts/php_typo3/partial.erb
new file mode 100644
index 00000000..afb756df
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/php_typo3/partial.erb
@@ -0,0 +1,10 @@
+<%= scope.function_template(['apache/vhosts/php/partial.erb']) %>
+  <Directory "<%= @documentroot %>/typo3/">
+    RewriteEngine on
+
+    # Rewrite URLs to https that go for the admin area
+    RewriteCond %{HTTPS} !=on
+    RewriteCond %{HTTP:X-Forwarded-Proto} !=https
+    RewriteCond %{REQUEST_URI} (.*/typo3/.*)
+    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R,NE]
+  </Directory>
diff --git a/puppet/modules/apache/templates/vhosts/php_wordpress/partial.erb b/puppet/modules/apache/templates/vhosts/php_wordpress/partial.erb
new file mode 100644
index 00000000..5e6ebd5e
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/php_wordpress/partial.erb
@@ -0,0 +1,19 @@
+<%= scope.function_template(['apache/vhosts/php/partial.erb']) %>
+
+  # fixes: http://git.zx2c4.com/w3-total-fail/tree/w3-total-fail.sh
+  <Directory "<%= @documentroot %>/wp-content/w3tc/dbcache">
+    Deny From All
+  </Directory>
+
+  # simple wp-login brute force protection
+  # http://www.frameloss.org/2013/04/26/even-easier-brute-force-login-protection-for-wordpress/
+  RewriteEngine On
+  RewriteCond %{HTTP_COOKIE} !<%= cookie = scope.function_sha1([scope.function_fqdn_rand([9999999999999,@name]).to_s + "cookie"]) %>
+  RewriteRule ^/wp-login.php /wordpress-login-<%= tmpuri = scope.function_sha1([scope.function_fqdn_rand([9999999999999,@name]).to_s + "wp-login"]) %>.php [R,L]
+  <Location /wordpress-login-<%= tmpuri %>.php>
+    CookieTracking on
+    CookieExpires 30
+    CookieName <%= cookie %>
+  </Location>
+  RewriteRule ^/wordpress-login-<%= tmpuri %>.php /wp-login.php [NE]
+
diff --git a/puppet/modules/apache/templates/vhosts/proxy/partial.erb b/puppet/modules/apache/templates/vhosts/proxy/partial.erb
new file mode 100644
index 00000000..0eecf820
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/proxy/partial.erb
@@ -0,0 +1,8 @@
+  <Proxy *>
+    Order deny,allow
+    Allow from all
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+  </Proxy>
+  ProxyRequests Off
+  ProxyPass        /   <%= @options %>/
+  ProxyPassReverse /   <%= @options %>/
diff --git a/puppet/modules/apache/templates/vhosts/redirect/partial.erb b/puppet/modules/apache/templates/vhosts/redirect/partial.erb
new file mode 100644
index 00000000..c8d7d11e
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/redirect/partial.erb
@@ -0,0 +1 @@
+  Redirect permanent / https://<%= @options %>
diff --git a/puppet/modules/apache/templates/vhosts/static/partial.erb b/puppet/modules/apache/templates/vhosts/static/partial.erb
new file mode 100644
index 00000000..dc6f11ca
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/static/partial.erb
@@ -0,0 +1,4 @@
+  <Directory "<%= @documentroot %>/">
+<%= scope.function_template(['apache/vhosts/partials/std_override_options.erb']) %>
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+  </Directory>
diff --git a/puppet/modules/apache/templates/vhosts/webdav/partial.erb b/puppet/modules/apache/templates/vhosts/webdav/partial.erb
new file mode 100644
index 00000000..09ce632f
--- /dev/null
+++ b/puppet/modules/apache/templates/vhosts/webdav/partial.erb
@@ -0,0 +1,21 @@
+  DAVLockDB <%= @real_dav_db_dir %>/DAVLock
+  <Directory "<%= @documentroot %>/">
+    Dav on
+    AllowOverride None
+<% if @options.to_s != 'absent' || @do_includes.to_s == 'true' -%>
+    Options <% unless @options.to_s == 'absent' -%><%= @options %><% end -%><% unless @options.include?('Indexes') -%> Indexes<%- end -%>
+
+<% else -%>
+    Options Indexes
+
+<% end -%>
+<%= scope.function_template(['apache/vhosts/partials/authentication.erb']) %>
+<% if @ldap_auth.to_s == 'true' then -%>
+    Include include.d/ldap_auth.inc
+<%   unless ldap_user.to_s == 'any' -%>
+    Require ldap-user <%= ldap_user.to_s %>
+<%   else -%>
+    Require valid-user
+<%   end
+   end -%>
+  </Directory>
diff --git a/puppet/modules/apache/templates/webfiles/autoconfig/config.shtml.erb b/puppet/modules/apache/templates/webfiles/autoconfig/config.shtml.erb
new file mode 100644
index 00000000..3a3d6bb5
--- /dev/null
+++ b/puppet/modules/apache/templates/webfiles/autoconfig/config.shtml.erb
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--#if expr="$SERVER_NAME = /([^.]*\.[^.]*)$/" -->
+    <!--#set var="DOMAIN" value="$1" -->
+<!--#endif -->
+
+<clientConfig version="1.1">
+  <emailProvider id="<%= @provider %>">
+    <domain><!--#echo var="DOMAIN" --></domain>
+    <displayName><%= @display_name || @provider %> Mail (<!--#echo var="DOMAIN" -->)</displayName>
+    <displayShortName><%= @shortname || @provider.split('.').first %></displayShortName>
+    <incomingServer type="imap">
+      <hostname><%= @imap_server || "imap.#{@provider}" %></hostname>
+      <port>143</port>
+      <socketType>STARTTLS</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </incomingServer>
+    <incomingServer type="imap">
+      <hostname><%= @imap_server || "imap.#{@provider}" %></hostname>
+      <port>993</port>
+      <socketType>SSL</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </incomingServer>
+    <incomingServer type="pop3">
+      <hostname><%= @pop_server || "pop.#{@provider}" %></hostname>
+      <port>110</port>
+      <socketType>STARTTLS</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </incomingServer>
+    <incomingServer type="pop3">
+      <hostname><%= @pop_server  || "pop.#{@provider}" %></hostname>
+      <port>995</port>
+      <socketType>SSL</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </incomingServer>
+    <outgoingServer type="smtp">
+      <hostname><%= @smtp_server || "smtp.#{@provider}" %></hostname>
+      <port>587</port>
+      <socketType>STARTTLS</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </outgoingServer>
+    <outgoingServer type="smtp">
+      <hostname><%= @smtp_server  || "smtp.#{@provider}"%></hostname>
+      <port>465</port>
+      <socketType>SSL</socketType>
+      <authentication>password-cleartext</authentication>
+      <username>%EMAILADDRESS%</username>
+    </outgoingServer>
+    <documentation url="<%= @documentation_url || "http://#{@provider}" %>">
+      <descr lang="de">Allgemeine Beschreibung der Einstellungen</descr>
+      <descr lang="en">Generic settings page</descr>
+    </documentation>
+  </emailProvider>
+</clientConfig>
-- 
cgit v1.2.3


From b5c3c14ae094bff896d19ee37f967e8fc8c34017 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:00 -0400
Subject: git subrepo clone https://leap.se/git/puppet_bundler
 puppet/modules/bundler

subrepo:
  subdir:   "puppet/modules/bundler"
  merged:   "bacec3e"
upstream:
  origin:   "https://leap.se/git/puppet_bundler"
  branch:   "master"
  commit:   "bacec3e"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I7596e2c4abf326acbce2a01c363e9694626e230f
---
 puppet/modules/bundler/.gitignore           |  1 +
 puppet/modules/bundler/.gitrepo             | 11 +++++
 puppet/modules/bundler/LICENSE              | 13 +++++
 puppet/modules/bundler/README.md            | 63 ++++++++++++++++++++++++
 puppet/modules/bundler/manifests/config.pp  | 74 +++++++++++++++++++++++++++++
 puppet/modules/bundler/manifests/install.pp | 64 +++++++++++++++++++++++++
 puppet/modules/bundler/manifests/params.pp  | 31 ++++++++++++
 7 files changed, 257 insertions(+)
 create mode 100644 puppet/modules/bundler/.gitignore
 create mode 100644 puppet/modules/bundler/.gitrepo
 create mode 100644 puppet/modules/bundler/LICENSE
 create mode 100644 puppet/modules/bundler/README.md
 create mode 100644 puppet/modules/bundler/manifests/config.pp
 create mode 100644 puppet/modules/bundler/manifests/install.pp
 create mode 100644 puppet/modules/bundler/manifests/params.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/bundler/.gitignore b/puppet/modules/bundler/.gitignore
new file mode 100644
index 00000000..1377554e
--- /dev/null
+++ b/puppet/modules/bundler/.gitignore
@@ -0,0 +1 @@
+*.swp
diff --git a/puppet/modules/bundler/.gitrepo b/puppet/modules/bundler/.gitrepo
new file mode 100644
index 00000000..4ec4aacc
--- /dev/null
+++ b/puppet/modules/bundler/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_bundler
+	branch = master
+	commit = bacec3e072649be4ade56f7df8506b46ae9c5166
+	parent = 4aff06cc2fecc0b59728d7fc825fb36394b847b7
+	cmdver = 0.3.0
diff --git a/puppet/modules/bundler/LICENSE b/puppet/modules/bundler/LICENSE
new file mode 100644
index 00000000..9cef3784
--- /dev/null
+++ b/puppet/modules/bundler/LICENSE
@@ -0,0 +1,13 @@
+Copyright (c) 2012 Evan Stachowiak
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/puppet/modules/bundler/README.md b/puppet/modules/bundler/README.md
new file mode 100644
index 00000000..2abb1cfc
--- /dev/null
+++ b/puppet/modules/bundler/README.md
@@ -0,0 +1,63 @@
+puppet-bundler - Bundler gem manager for Ruby
+==========================================
+
+This puppet module will install bundler and set config 
+variables.
+
+This module supports Ubuntu 10.04 and Debian
+
+Installation
+------------
+
+1. Copy this directory to your puppet master module path $(git clone
+https://github.com/evanstachowiak/puppet-bundler bundler)
+
+2. Apply the `bundler` class to any nodes you want bundler installed on:
+
+  class { 'bundler::install': }
+
+   By default this will install bundler with RVM, if you wish to use another
+   method, you can pass any puppet package provider to the class as
+   'install_method', or just use 'package' if you wish the puppet parser to
+   automatically chose the best method for your platform.
+
+  Examples: class { 'bundler::install': install_method => 'fink' }
+            class { 'bundler::install': install_method => 'gem' }
+            class { 'bundler::install': install_method => 'package' }
+
+3. Set whatever config variables are necessary: 
+   bundler::config { 'linecache19':
+    user        => ubuntu,
+    config_flag => "--with-ruby-include=/usr/local/rvm/src/ruby-1.9.2-p290",
+    app_dir     => your_app_dir,
+  }
+
+
+Contributing
+------------
+
+- fork on github (https://github.com/evanstachowiak/puppet-bundler)
+- send a pull request
+
+Author
+------
+Evan Stachowiak (https://github.com/evanstachowiak)
+
+LICENSE
+-------
+
+    Author:: Evan Stachowiak
+    Copyright:: Copyright (c) 2012 Evan Stachowiak
+    License:: Apache License, Version 2.0
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
diff --git a/puppet/modules/bundler/manifests/config.pp b/puppet/modules/bundler/manifests/config.pp
new file mode 100644
index 00000000..5937a228
--- /dev/null
+++ b/puppet/modules/bundler/manifests/config.pp
@@ -0,0 +1,74 @@
+# Define bundler::config
+#
+# All config settings for candiapp class
+#
+# == Parameters
+#
+#   [*user*]
+#     App directory owner
+#   [*config_flag*]
+#     config flag for specific gem compile settings
+#   [*app_dir*]
+#     App directory where Gemfile is located
+#   [*home_dir_base_path*]
+#     Home directory of the specified user
+#   [*use_rvm*]
+#      Sets whether rvm is used. Defaults to true
+#   [*rvm_bin*]
+#     RVM install location. Defaults to /usr/local/rvm/bin/rvm
+#   [*rvm_gem_path*]
+#     RVM gem directory. Defaults to /usr/local/rvm/gems
+#   [*rvm_gemset*]
+#     RVM gemset to use. Defaults to global.
+#   [*ruby_version*]
+#     Ruby version for RVM purposes.
+#   [*bundler_path*]
+#     Bundler install directory
+#
+# == Examples
+#
+#
+# == Requires:
+#
+#   class { bundler::install: }
+#
+define bundler::config (
+  $user,
+  $config_flag,
+  $app_dir,
+  $home_dir_base_path = $bundler::params::home_dir_base_path,
+  $use_rvm            = $bundler::params::use_rvm,
+  $rvm_bin            = $bundler::params::rvm_bin,
+  $rvm_gem_path       = $bundler::params::rvm_gem_path,
+  $rvm_gemset         = $bundler::params::rvm_gemset,
+  $ruby_version       = $bundler::ruby_version,
+  $bundler_path       = $bundler::params::bundler_path
+) {
+
+  Class['bundler::install'] -> Bundler::Config[$name]
+
+  if $user == 'root' {
+    $home_dir = '/root'
+  }
+  else {
+    $home_dir = "${home_dir_base_path}/${user}"
+  }
+
+  # Must use $bundler_path_real, otherwise cannot reassign variable error is thrown
+  if $use_rvm == 'true' {
+    $bundler_path_rvm = "${rvm_gem_path}/${ruby_version}@${rvm_gemset}/bin"
+    $bundler_bin = "${rvm_bin} ${ruby_version} exec ${bundler_path_rvm}/bundle"
+  }
+  else {
+    $bundler_bin = "${bundler_path}/bundle"
+  }
+
+  # Bundler doesn't respect uid. Use /bin/su to override this behavior for users
+  # other than root.
+  exec { "bundler_config_${name}":
+    cwd       => $app_dir,
+    command   => "/bin/su -c '${bundler_bin} config build.${name} ${config_flag} --gemfile=${app_dir}/Gemfile' ${user}",
+    unless    => "/bin/grep -i \"BUNDLE_BUILD__${name}: ${config_flag}\" ${home_dir}/.bundle/config",
+  }
+
+}
diff --git a/puppet/modules/bundler/manifests/install.pp b/puppet/modules/bundler/manifests/install.pp
new file mode 100644
index 00000000..1524de31
--- /dev/null
+++ b/puppet/modules/bundler/manifests/install.pp
@@ -0,0 +1,64 @@
+# Class bundler::install
+#
+# Installs bundler Ruby gem manager
+#
+# == Parameters
+#
+#   [*install_method*]
+#     How to install bundler, 'rvm' is the default
+#   [*ruby_version*]
+#     Ruby version that bundler will use.
+#
+# == Examples
+#
+#
+# == Requires:
+#
+#   If use_rvm = 'true':
+#   include rvm
+#
+class bundler::install (
+  $ruby_version    = undef,
+  $ensure          = 'present',
+  $install_method  = 'rvm',
+  $use_rvm         = '',
+  ) inherits bundler::params {
+
+  # deprecation warning
+  if $use_rvm != '' {
+    warning('$use_rvm is deprecated, please use $install_method instead')
+  }
+
+  if ( $install_method == undef ) or ( $install_method == 'package' ) {
+    $provider_method = undef
+  }
+  else {
+    # backwards compatibility
+    if $use_rvm == false {
+      $provider_method = gem
+    }
+    else {
+      $provider_method = $bundler::params::install_method
+    }
+  }
+
+  if $provider_method == 'rvm' {
+    if $ruby_version == undef {
+      fail('When using rvm, you must pass a ruby_version')
+    }
+    else {
+      #Install bundler with correct RVM
+      rvm_gem { 'bundler':
+        ensure       => $ensure,
+        ruby_version => $ruby_version,
+      }
+    }
+  }
+  else {
+    package { 'bundler':
+      ensure   => $ensure,
+      provider => $provider_method,
+    }
+  }
+
+}
diff --git a/puppet/modules/bundler/manifests/params.pp b/puppet/modules/bundler/manifests/params.pp
new file mode 100644
index 00000000..53ca86e4
--- /dev/null
+++ b/puppet/modules/bundler/manifests/params.pp
@@ -0,0 +1,31 @@
+# Class bundler::params
+#
+# All config settings for candiapp class
+#
+# == Parameters
+#
+#
+#
+# == Examples
+#
+#
+# == Requires:
+#
+class bundler::params {
+
+  case $::operatingsystem {
+    ubuntu, debian: {
+      $user               = 'root'
+      $home_dir_base_path = '/home'
+      $install_method     = 'rvm'
+      $rvm_bin            = '/usr/local/rvm/bin/rvm'
+      $rvm_gem_path       = '/usr/local/rvm/gems'
+      $rvm_gemset         = 'global'
+      $bundler_path       = '/usr/bin'
+    }
+    default: {
+      fail("Unsupported platform: ${::operatingsystem}")
+    }
+  }
+
+}
-- 
cgit v1.2.3


From 10c80c65126cd84e6010495d30cb921d245f0d33 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:02 -0400
Subject: git subrepo clone https://leap.se/git/puppet_rubygems
 puppet/modules/rubygems

subrepo:
  subdir:   "puppet/modules/rubygems"
  merged:   "510a369"
upstream:
  origin:   "https://leap.se/git/puppet_rubygems"
  branch:   "master"
  commit:   "510a369"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Id2668c747e7d8b0a73415180baee9edece1017db
---
 puppet/modules/rubygems/.gitrepo                   |  11 +++
 puppet/modules/rubygems/files/gemrc                |   3 +
 puppet/modules/rubygems/manifests/activerecord.pp  |   7 ++
 puppet/modules/rubygems/manifests/activesupport.pp |   7 ++
 puppet/modules/rubygems/manifests/backports.pp     |   7 ++
 puppet/modules/rubygems/manifests/bcrypt.pp        |  14 +++
 puppet/modules/rubygems/manifests/brokengem.pp     |  14 +++
 puppet/modules/rubygems/manifests/camping.pp       |   7 ++
 .../modules/rubygems/manifests/captcha/v_0_1_2.pp  |   5 +
 .../modules/rubygems/manifests/chronic_duration.pp |   5 +
 puppet/modules/rubygems/manifests/devel.pp         |   6 ++
 puppet/modules/rubygems/manifests/fastercsv.pp     |   6 ++
 puppet/modules/rubygems/manifests/gd/v_0_7_4.pp    |   5 +
 puppet/modules/rubygems/manifests/gem.pp           | 108 +++++++++++++++++++++
 puppet/modules/rubygems/manifests/gem/cachedir.pp  |   4 +
 puppet/modules/rubygems/manifests/gpgme.pp         |  35 +++++++
 puppet/modules/rubygems/manifests/hiera.pp         |   7 ++
 puppet/modules/rubygems/manifests/hiera_puppet.pp  |   7 ++
 puppet/modules/rubygems/manifests/highline.pp      |  14 +++
 puppet/modules/rubygems/manifests/init.pp          |  31 ++++++
 puppet/modules/rubygems/manifests/ip.pp            |   7 ++
 puppet/modules/rubygems/manifests/json/v_1_4_6.pp  |   3 +
 puppet/modules/rubygems/manifests/lockfile.pp      |   7 ++
 puppet/modules/rubygems/manifests/mail.pp          |  19 ++++
 puppet/modules/rubygems/manifests/maildir.pp       |  15 +++
 puppet/modules/rubygems/manifests/markaby.pp       |   7 ++
 puppet/modules/rubygems/manifests/moneta.pp        |   7 ++
 puppet/modules/rubygems/manifests/mysql.pp         |   5 +
 .../modules/rubygems/manifests/net_ldap/v_0_0_4.pp |   3 +
 puppet/modules/rubygems/manifests/ntlm/v_0_1_1.pp  |   3 +
 puppet/modules/rubygems/manifests/open4.pp         |   7 ++
 puppet/modules/rubygems/manifests/pbkdf2.pp        |   8 ++
 puppet/modules/rubygems/manifests/postgres.pp      |  11 +++
 puppet/modules/rubygems/manifests/rack.pp          |   7 ++
 puppet/modules/rubygems/manifests/sinatra.pp       |   7 ++
 puppet/modules/rubygems/manifests/sqlite.pp        |   6 ++
 puppet/modules/rubygems/manifests/systemu.pp       |   7 ++
 puppet/modules/rubygems/manifests/thin.pp          |   7 ++
 puppet/modules/rubygems/manifests/tlsmail.pp       |   7 ++
 puppet/modules/rubygems/manifests/tmail.pp         |   7 ++
 puppet/modules/rubygems/manifests/xmlsimple.pp     |  20 ++++
 puppet/modules/rubygems/manifests/xmpp4r.pp        |   7 ++
 puppet/modules/rubygems/manifests/ya2yaml.pp       |   7 ++
 43 files changed, 487 insertions(+)
 create mode 100644 puppet/modules/rubygems/.gitrepo
 create mode 100644 puppet/modules/rubygems/files/gemrc
 create mode 100644 puppet/modules/rubygems/manifests/activerecord.pp
 create mode 100644 puppet/modules/rubygems/manifests/activesupport.pp
 create mode 100644 puppet/modules/rubygems/manifests/backports.pp
 create mode 100644 puppet/modules/rubygems/manifests/bcrypt.pp
 create mode 100644 puppet/modules/rubygems/manifests/brokengem.pp
 create mode 100644 puppet/modules/rubygems/manifests/camping.pp
 create mode 100644 puppet/modules/rubygems/manifests/captcha/v_0_1_2.pp
 create mode 100644 puppet/modules/rubygems/manifests/chronic_duration.pp
 create mode 100644 puppet/modules/rubygems/manifests/devel.pp
 create mode 100644 puppet/modules/rubygems/manifests/fastercsv.pp
 create mode 100644 puppet/modules/rubygems/manifests/gd/v_0_7_4.pp
 create mode 100644 puppet/modules/rubygems/manifests/gem.pp
 create mode 100644 puppet/modules/rubygems/manifests/gem/cachedir.pp
 create mode 100644 puppet/modules/rubygems/manifests/gpgme.pp
 create mode 100644 puppet/modules/rubygems/manifests/hiera.pp
 create mode 100644 puppet/modules/rubygems/manifests/hiera_puppet.pp
 create mode 100644 puppet/modules/rubygems/manifests/highline.pp
 create mode 100644 puppet/modules/rubygems/manifests/init.pp
 create mode 100644 puppet/modules/rubygems/manifests/ip.pp
 create mode 100644 puppet/modules/rubygems/manifests/json/v_1_4_6.pp
 create mode 100644 puppet/modules/rubygems/manifests/lockfile.pp
 create mode 100644 puppet/modules/rubygems/manifests/mail.pp
 create mode 100644 puppet/modules/rubygems/manifests/maildir.pp
 create mode 100644 puppet/modules/rubygems/manifests/markaby.pp
 create mode 100644 puppet/modules/rubygems/manifests/moneta.pp
 create mode 100644 puppet/modules/rubygems/manifests/mysql.pp
 create mode 100644 puppet/modules/rubygems/manifests/net_ldap/v_0_0_4.pp
 create mode 100644 puppet/modules/rubygems/manifests/ntlm/v_0_1_1.pp
 create mode 100644 puppet/modules/rubygems/manifests/open4.pp
 create mode 100644 puppet/modules/rubygems/manifests/pbkdf2.pp
 create mode 100644 puppet/modules/rubygems/manifests/postgres.pp
 create mode 100644 puppet/modules/rubygems/manifests/rack.pp
 create mode 100644 puppet/modules/rubygems/manifests/sinatra.pp
 create mode 100644 puppet/modules/rubygems/manifests/sqlite.pp
 create mode 100644 puppet/modules/rubygems/manifests/systemu.pp
 create mode 100644 puppet/modules/rubygems/manifests/thin.pp
 create mode 100644 puppet/modules/rubygems/manifests/tlsmail.pp
 create mode 100644 puppet/modules/rubygems/manifests/tmail.pp
 create mode 100644 puppet/modules/rubygems/manifests/xmlsimple.pp
 create mode 100644 puppet/modules/rubygems/manifests/xmpp4r.pp
 create mode 100644 puppet/modules/rubygems/manifests/ya2yaml.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/rubygems/.gitrepo b/puppet/modules/rubygems/.gitrepo
new file mode 100644
index 00000000..a6121a0f
--- /dev/null
+++ b/puppet/modules/rubygems/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_rubygems
+	branch = master
+	commit = 510a3693eab5dc78ed27d3728ee4d3b12334ea12
+	parent = b5c3c14ae094bff896d19ee37f967e8fc8c34017
+	cmdver = 0.3.0
diff --git a/puppet/modules/rubygems/files/gemrc b/puppet/modules/rubygems/files/gemrc
new file mode 100644
index 00000000..040f20ba
--- /dev/null
+++ b/puppet/modules/rubygems/files/gemrc
@@ -0,0 +1,3 @@
+---
+:sources:
+- https://rubygems.org/
diff --git a/puppet/modules/rubygems/manifests/activerecord.pp b/puppet/modules/rubygems/manifests/activerecord.pp
new file mode 100644
index 00000000..131222af
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/activerecord.pp
@@ -0,0 +1,7 @@
+class rubygems::activerecord {
+  require rubygems
+  package{'activerecord':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/activesupport.pp b/puppet/modules/rubygems/manifests/activesupport.pp
new file mode 100644
index 00000000..ae5aee70
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/activesupport.pp
@@ -0,0 +1,7 @@
+class rubygems::activesupport {
+  require rubygems
+  package{'activesupport':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/backports.pp b/puppet/modules/rubygems/manifests/backports.pp
new file mode 100644
index 00000000..4290e340
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/backports.pp
@@ -0,0 +1,7 @@
+class rubygems::backports {
+  require rubygems::devel
+  package{'backports':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/bcrypt.pp b/puppet/modules/rubygems/manifests/bcrypt.pp
new file mode 100644
index 00000000..4c646477
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/bcrypt.pp
@@ -0,0 +1,14 @@
+class rubygems::bcrypt {
+  if ($::osfamily == 'RedHat') and
+    versioncmp($::operatingsystemrelease,'6') > 0 {
+    package{'rubygem-bcrypt':
+      ensure => present,
+    }
+  } else {
+    require rubygems
+    package{'bcrypt-ruby':
+      ensure => present,
+      provider => gem,
+    }
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/brokengem.pp b/puppet/modules/rubygems/manifests/brokengem.pp
new file mode 100644
index 00000000..b3284d97
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/brokengem.pp
@@ -0,0 +1,14 @@
+define rubygems::brokengem($source,$ensure) {
+    exec { "get-gem-$name":
+        command => "/usr/bin/wget --output-document=/tmp/$name.gem $source",
+        creates => "/tmp/$name.gem",
+        before => Package[$name]
+    }
+    package{$name:
+        ensure => $ensure,
+        provider => gem,
+        source => "/tmp/$name.gem"
+    }
+}
+
+# $Id$
diff --git a/puppet/modules/rubygems/manifests/camping.pp b/puppet/modules/rubygems/manifests/camping.pp
new file mode 100644
index 00000000..f79fca13
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/camping.pp
@@ -0,0 +1,7 @@
+class rubygems::camping {
+  require rubygems::rack
+  package{'camping':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/captcha/v_0_1_2.pp b/puppet/modules/rubygems/manifests/captcha/v_0_1_2.pp
new file mode 100644
index 00000000..2a4e7123
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/captcha/v_0_1_2.pp
@@ -0,0 +1,5 @@
+class rubygems::captcha::v_0_1_2 {
+  rubygems::gem{ 'captcha-0.1.2':
+    requiresgcc => true,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/chronic_duration.pp b/puppet/modules/rubygems/manifests/chronic_duration.pp
new file mode 100644
index 00000000..c789eb51
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/chronic_duration.pp
@@ -0,0 +1,5 @@
+class rubygems::chronic_duration {
+  rubygems::gem{'chronic_duration':
+    ensure => present,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/devel.pp b/puppet/modules/rubygems/manifests/devel.pp
new file mode 100644
index 00000000..2f69f892
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/devel.pp
@@ -0,0 +1,6 @@
+class rubygems::devel {
+  include ::rubygems
+  include ruby::devel
+  include gcc
+}
+
diff --git a/puppet/modules/rubygems/manifests/fastercsv.pp b/puppet/modules/rubygems/manifests/fastercsv.pp
new file mode 100644
index 00000000..95ae0212
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/fastercsv.pp
@@ -0,0 +1,6 @@
+class rubygems::fastercsv {
+  rubygems::gem{'fastercsv':
+    ensure => present,
+    source => 'http://rubyforge.org/frs/download.php/43190/fastercsv-1.4.0.gem',
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/gd/v_0_7_4.pp b/puppet/modules/rubygems/manifests/gd/v_0_7_4.pp
new file mode 100644
index 00000000..9027ecb5
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/gd/v_0_7_4.pp
@@ -0,0 +1,5 @@
+class rubygems::gd::v_0_7_4 {
+  rubygems::gem{ 'ruby-gd-0.7.4':
+    buildflags => '--with-freetype',
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/gem.pp b/puppet/modules/rubygems/manifests/gem.pp
new file mode 100644
index 00000000..14b67850
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/gem.pp
@@ -0,0 +1,108 @@
+# Installs gems that are slightly broken
+# As a name it expects the name of the gem.
+# If you want to want to install a certain version
+# you have to append the version to the gem name:
+#
+#    install a version of mime-types:
+#       rubygems::gem{'mime-types': }
+#
+#    install version 0.0.4 of ruby-net-ldap:
+#       rubygems::gem{'ruby-net-ldap-0.0.4': }
+#
+#    uninstall polygot gem (until no such gem is anymore installed):
+#       rubygems::gem{'polygot': ensure => absent }
+#
+#    uninstall ruby-net-ldap version 0.0.3
+#       rubygems::gem{'ruby-net-ldap-0.0.3': ensure => absent }
+#
+# You can also set your own buildlfags, which will then install
+# the gem in question by the gem command.
+#
+# You can also enforce to use the gem command to manage the gem
+# by setting provider to `exec`.
+#
+define rubygems::gem(
+  $ensure = 'present',
+  $source = 'absent',
+  $provider = 'default',
+  $buildflags = 'absent',
+  $requiresgcc = false
+) {
+  require ::rubygems
+  if $requiresgcc or ($buildflags != 'absent') {
+    require ::gcc
+  }
+
+  if $name =~ /\-(\d|\.)+$/ {
+    $real_name = regsubst($name,'^(.*)-(\d|\.)+$','\1')
+    $gem_version = regsubst($name,'^(.*)-(\d+(\d|\.)+)$','\2')
+  } else {
+    $real_name = $name
+  }
+
+  if $source != 'absent' {
+    if $ensure != 'absent' {
+      require rubygems::gem::cachedir
+      exec{"get-gem-$name":
+        command => "/usr/bin/wget -O ${rubygems::gem::cachedir::dir}/$name.gem $source",
+        creates => "${rubygems::gem::cachedir::dir}/$name.gem",
+      }
+    } else {
+      file{"${rubygems::gem::cachedir::dir}/$name.gem":
+        ensure => 'absent';
+      }
+    }
+  }
+
+  if ($buildflags != 'absent') or ($provider == 'exec') {
+    if $gem_version {
+        $gem_version_str = "-v ${gem_version}"
+        $gem_version_check_str = $gem_version
+    } else {
+        $gem_version_check_str = '.*'
+    }
+
+    if $ensure == 'present' {
+        $gem_cmd = 'install'
+    } else {
+        $gem_cmd = 'uninstall -x'
+    }
+
+    if $buildflags != 'absent' {
+      $buildflags_str = "-- --build-flags ${buildflags}"
+    } else {
+      $buildflags_str = ''
+    }
+
+    exec{"manage_gem_${name}":
+        command => "gem ${gem_cmd} ${real_name} ${gem_version_str} ${buildflags_str}",
+    }
+
+    $gem_cmd_check_str = "gem list | egrep -q '^${real_name} \\(${gem_version_check_str}\\)\$'"
+    if $ensure == 'present' {
+        Exec["manage_gem_${name}"]{
+           unless => $gem_cmd_check_str
+        }
+    } else {
+        Exec["manage_gem_${name}"]{
+           onlyif => $gem_cmd_check_str
+        }
+    }
+  } else {
+    package{"$real_name":
+      ensure => $ensure ? {
+        'absent' => $ensure,
+        default => $gem_version ? {
+          undef => $ensure,
+          default => $gem_version
+        }
+      },
+      provider => gem,
+    }
+    if $source != 'absent' {
+      Package["$name"]{
+        source => "${rubygems::gem::cachedir::dir}/$name.gem"
+      }
+    }
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/gem/cachedir.pp b/puppet/modules/rubygems/manifests/gem/cachedir.pp
new file mode 100644
index 00000000..3e371e42
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/gem/cachedir.pp
@@ -0,0 +1,4 @@
+class rubygems::gem::cachedir {
+  $dir = '/var/lib/puppet/modules/rubygems_cache'
+  modules_dir{'rubygems_cache': }
+}
diff --git a/puppet/modules/rubygems/manifests/gpgme.pp b/puppet/modules/rubygems/manifests/gpgme.pp
new file mode 100644
index 00000000..e9b04a9a
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/gpgme.pp
@@ -0,0 +1,35 @@
+class rubygems::gpgme{
+  case $::operatingsystem {
+    debian,ubuntu: {
+      case $::lsbdistcodename {
+        'lenny','squeeze': {
+          # install gpgme as gem, as the squeeze deb-package is too old
+          # for i.e. gpg module
+          $provider    = 'gem'
+          $packagename = 'ruby-gpgme'
+          }
+        default:  {
+          # don't need to install gpgme as gem, debian package works
+          # fine with the gpg module
+          $provider    = 'apt'
+          $packagename = 'libgpgme-ruby'
+        }
+      }
+    }
+    default: {
+      $provider = 'gem'
+      $packagename = 'ruby-gpgme'
+    }
+  }
+
+  if $provider == 'gem' {
+    require rubygems::devel
+    require gpg::gpgme::devel
+  }
+
+  package{'ruby-gpgme':
+    ensure   => present,
+    provider => $provider,
+    name     => $packagename
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/hiera.pp b/puppet/modules/rubygems/manifests/hiera.pp
new file mode 100644
index 00000000..4c766a15
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/hiera.pp
@@ -0,0 +1,7 @@
+class rubygems::hiera{
+  require ::rubygems
+  package{'hiera':
+    ensure => installed,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/hiera_puppet.pp b/puppet/modules/rubygems/manifests/hiera_puppet.pp
new file mode 100644
index 00000000..319e7d0e
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/hiera_puppet.pp
@@ -0,0 +1,7 @@
+class rubygems::hiera_puppet {
+  require rubygems::hiera
+  package{'hiera-puppet':
+    ensure => installed,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/highline.pp b/puppet/modules/rubygems/manifests/highline.pp
new file mode 100644
index 00000000..e9da09a5
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/highline.pp
@@ -0,0 +1,14 @@
+class rubygems::highline {
+  require rubygems
+  package{'rubygem-highline':
+    ensure => present,
+  }
+
+  case $::operatingsystem {
+    debian,ubuntu: {
+      Package['rubygem-highline']{
+        name => 'ruby-highline'
+      }
+    }
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/init.pp b/puppet/modules/rubygems/manifests/init.pp
new file mode 100644
index 00000000..bca40b9e
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/init.pp
@@ -0,0 +1,31 @@
+#
+# rubygems module
+# original by luke kanies
+# http://github.com/lak
+#
+# Copyright 2008, Puzzle ITC GmbH
+# Marcel Härry haerry+puppet(at)puzzle.ch
+# Simon Josi josi+puppet(at)puzzle.ch
+#
+# This program is free software; you can redistribute
+# it and/or modify it under the terms of the GNU
+# General Public License version 3 as published by
+# the Free Software Foundation.
+#
+
+# manage rubygems basics
+class rubygems {
+  # from debian 8 on this is not anymore needed as it's part of the ruby pkg
+  if ($::operatingsystem != 'Debian') or (versioncmp($::operatingsystemrelease,'8') < 0) {
+    package{'rubygems':
+      ensure => installed,
+    }
+  }
+  file { '/etc/gemrc':
+    source => [ 'puppet:///modules/site_rubygems/gemrc',
+                'puppet:///modules/rubygems/gemrc' ],
+    mode   => '0644',
+    owner  => 'root',
+    group  => 'root',
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/ip.pp b/puppet/modules/rubygems/manifests/ip.pp
new file mode 100644
index 00000000..190d869d
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/ip.pp
@@ -0,0 +1,7 @@
+class rubygems::ip {
+  require rubygems
+  package{'ip':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/json/v_1_4_6.pp b/puppet/modules/rubygems/manifests/json/v_1_4_6.pp
new file mode 100644
index 00000000..d0901ba3
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/json/v_1_4_6.pp
@@ -0,0 +1,3 @@
+class rubygems::json::v_1_4_6 {
+  rubygems::gem{ 'json-1.4.6': }
+}
diff --git a/puppet/modules/rubygems/manifests/lockfile.pp b/puppet/modules/rubygems/manifests/lockfile.pp
new file mode 100644
index 00000000..f4ed6b0f
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/lockfile.pp
@@ -0,0 +1,7 @@
+class rubygems::lockfile {
+  require rubygems
+  package{'lockfile':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/mail.pp b/puppet/modules/rubygems/manifests/mail.pp
new file mode 100644
index 00000000..b8b50bbe
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/mail.pp
@@ -0,0 +1,19 @@
+# manage the mail rubygem
+class rubygems::mail {
+  if ($::osfamily == 'RedHat') and
+    versioncmp($::operatingsystemrelease,'6') > 0 {
+    package{'rubygem-mail':
+      ensure => present,
+    }
+  } else {
+    require rubygems::devel
+    package{'mail':
+      ensure   => present,
+      provider => gem,
+    }
+
+    if $::rubyversion == '1.8.6' {
+      require rubygems::tlsmail
+    }
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/maildir.pp b/puppet/modules/rubygems/manifests/maildir.pp
new file mode 100644
index 00000000..8773f37a
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/maildir.pp
@@ -0,0 +1,15 @@
+# manage maildir rubygem
+class rubygems::maildir {
+  if ($::osfamily == 'RedHat') and
+    versioncmp($::operatingsystemrelease,'6') > 0 {
+    package{'rubygem-maildir':
+      ensure => present,
+    }
+  } else {
+    require rubygems::devel
+    package{'maildir':
+      ensure   => present,
+      provider => gem,
+    }
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/markaby.pp b/puppet/modules/rubygems/manifests/markaby.pp
new file mode 100644
index 00000000..817969e3
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/markaby.pp
@@ -0,0 +1,7 @@
+class rubygems::markaby {
+  require rubygems
+  package{'markaby':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/moneta.pp b/puppet/modules/rubygems/manifests/moneta.pp
new file mode 100644
index 00000000..ea9bb5a6
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/moneta.pp
@@ -0,0 +1,7 @@
+class rubygems::moneta {
+  require rubygems
+  package{'moneta':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/mysql.pp b/puppet/modules/rubygems/manifests/mysql.pp
new file mode 100644
index 00000000..cc0bbbf6
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/mysql.pp
@@ -0,0 +1,5 @@
+class rubygems::mysql {
+    require ::mysql::devel
+    require gcc
+    rubygems::gem{'mysql':}
+}
diff --git a/puppet/modules/rubygems/manifests/net_ldap/v_0_0_4.pp b/puppet/modules/rubygems/manifests/net_ldap/v_0_0_4.pp
new file mode 100644
index 00000000..88e1e7b4
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/net_ldap/v_0_0_4.pp
@@ -0,0 +1,3 @@
+class rubygems::net_ldap::v_0_0_4 {
+  rubygems::gem{ 'ruby-net-ldap-0.0.4': }
+}
diff --git a/puppet/modules/rubygems/manifests/ntlm/v_0_1_1.pp b/puppet/modules/rubygems/manifests/ntlm/v_0_1_1.pp
new file mode 100644
index 00000000..fd6eade3
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/ntlm/v_0_1_1.pp
@@ -0,0 +1,3 @@
+class rubygems::ntlm::v_0_1_1 {
+  rubygems::gem{ 'rubyntlm-0.1.1': }
+}
diff --git a/puppet/modules/rubygems/manifests/open4.pp b/puppet/modules/rubygems/manifests/open4.pp
new file mode 100644
index 00000000..1e3fbb78
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/open4.pp
@@ -0,0 +1,7 @@
+class rubygems::open4 {
+  require rubygems
+  package{'open4':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/pbkdf2.pp b/puppet/modules/rubygems/manifests/pbkdf2.pp
new file mode 100644
index 00000000..b2cf1136
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/pbkdf2.pp
@@ -0,0 +1,8 @@
+class rubygems::pbkdf2{
+  require ::rubygems
+  package{'pbkdf2':
+    ensure => installed,
+    provider => gem,
+  }
+}
+
diff --git a/puppet/modules/rubygems/manifests/postgres.pp b/puppet/modules/rubygems/manifests/postgres.pp
new file mode 100644
index 00000000..8720f4ef
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/postgres.pp
@@ -0,0 +1,11 @@
+class rubygems::postgres {
+  if $::osfamily == 'RedHat' and
+    versioncmp($::operatingsystemrelease,'5') > 0 {
+    package{'rubygem-pg':
+      ensure => installed,
+    }
+  } else {
+    require postgres::devel
+    rubygems::gem{'ruby-pg':}
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/rack.pp b/puppet/modules/rubygems/manifests/rack.pp
new file mode 100644
index 00000000..953ab22b
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/rack.pp
@@ -0,0 +1,7 @@
+class rubygems::rack {
+  require rubygems
+  package{'rack':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/sinatra.pp b/puppet/modules/rubygems/manifests/sinatra.pp
new file mode 100644
index 00000000..327f829f
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/sinatra.pp
@@ -0,0 +1,7 @@
+class rubygems::sinatra {
+  require rubygems
+  package{'sinatra':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/sqlite.pp b/puppet/modules/rubygems/manifests/sqlite.pp
new file mode 100644
index 00000000..6b670152
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/sqlite.pp
@@ -0,0 +1,6 @@
+class rubygems::sqlite {
+  require rubygems::devel
+  package{'rubygem-sqlite3-ruby':
+    ensure => present,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/systemu.pp b/puppet/modules/rubygems/manifests/systemu.pp
new file mode 100644
index 00000000..62a599cf
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/systemu.pp
@@ -0,0 +1,7 @@
+class rubygems::systemu {
+  require rubygems
+  package{'systemu':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/thin.pp b/puppet/modules/rubygems/manifests/thin.pp
new file mode 100644
index 00000000..b2499d81
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/thin.pp
@@ -0,0 +1,7 @@
+class rubygems::thin {
+  require rubygems
+  package{'thin':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/tlsmail.pp b/puppet/modules/rubygems/manifests/tlsmail.pp
new file mode 100644
index 00000000..71aa6158
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/tlsmail.pp
@@ -0,0 +1,7 @@
+class rubygems::tlsmail {
+  require rubygems::devel
+  package{'tlsmail':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/tmail.pp b/puppet/modules/rubygems/manifests/tmail.pp
new file mode 100644
index 00000000..dd7117d9
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/tmail.pp
@@ -0,0 +1,7 @@
+class rubygems::tmail {
+  require rubygems::devel
+  package{'tmail':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/xmlsimple.pp b/puppet/modules/rubygems/manifests/xmlsimple.pp
new file mode 100644
index 00000000..914156b0
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/xmlsimple.pp
@@ -0,0 +1,20 @@
+# xml simple lib
+class rubygems::xmlsimple {
+  package{'rubygem-xml-simple':
+    ensure => present,
+  }
+  case $::operatingsystem {
+    debian,ubuntu: {
+      Package['rubygem-xml-simple']{
+        name => 'libxml-simple-ruby'
+      }
+    }
+  }
+  if $::operatingsystem == 'CentOS' and versioncmp($::operatingsystemrelease, '6') > 0 {
+    # not yet packaged
+    Package['rubygem-xml-simple']{
+      name     => 'xml-simple',
+      provider => gem,
+    }
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/xmpp4r.pp b/puppet/modules/rubygems/manifests/xmpp4r.pp
new file mode 100644
index 00000000..068d5825
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/xmpp4r.pp
@@ -0,0 +1,7 @@
+class rubygems::xmpp4r {
+  require ::rubygems
+  package{'xmpp4r':
+    ensure => present,
+    provider => gem,
+  }
+}
diff --git a/puppet/modules/rubygems/manifests/ya2yaml.pp b/puppet/modules/rubygems/manifests/ya2yaml.pp
new file mode 100644
index 00000000..7df362dc
--- /dev/null
+++ b/puppet/modules/rubygems/manifests/ya2yaml.pp
@@ -0,0 +1,7 @@
+class rubygems::ya2yaml {
+  require rubygems
+  package{'ya2yaml':
+    ensure => present,
+    provider => gem,
+  }
+}
-- 
cgit v1.2.3


From d8ecd5d2f933c40f2413a58e6324558d0e689b6a Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:03 -0400
Subject: git subrepo clone https://leap.se/git/puppet_ruby puppet/modules/ruby

subrepo:
  subdir:   "puppet/modules/ruby"
  merged:   "9ccd853"
upstream:
  origin:   "https://leap.se/git/puppet_ruby"
  branch:   "master"
  commit:   "9ccd853"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I8f8437218403894682afbadd714f2e4efb72f018
---
 puppet/modules/ruby/.gitrepo                   | 11 ++++
 puppet/modules/ruby/manifests/devel.pp         |  5 ++
 puppet/modules/ruby/manifests/init.pp          | 72 ++++++++++++++++++++++++++
 puppet/modules/ruby/manifests/mysql.pp         |  7 +++
 puppet/modules/ruby/manifests/postgres.pp      |  6 +++
 puppet/modules/ruby/manifests/shadow.pp        |  6 +++
 puppet/modules/ruby/manifests/shadow/base.pp   |  6 +++
 puppet/modules/ruby/manifests/shadow/debian.pp |  8 +++
 8 files changed, 121 insertions(+)
 create mode 100644 puppet/modules/ruby/.gitrepo
 create mode 100644 puppet/modules/ruby/manifests/devel.pp
 create mode 100644 puppet/modules/ruby/manifests/init.pp
 create mode 100644 puppet/modules/ruby/manifests/mysql.pp
 create mode 100644 puppet/modules/ruby/manifests/postgres.pp
 create mode 100644 puppet/modules/ruby/manifests/shadow.pp
 create mode 100644 puppet/modules/ruby/manifests/shadow/base.pp
 create mode 100644 puppet/modules/ruby/manifests/shadow/debian.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/ruby/.gitrepo b/puppet/modules/ruby/.gitrepo
new file mode 100644
index 00000000..f19ddac8
--- /dev/null
+++ b/puppet/modules/ruby/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_ruby
+	branch = master
+	commit = 9ccd853c49af7d0b57ebd9c2ea7673b193fce24b
+	parent = 10c80c65126cd84e6010495d30cb921d245f0d33
+	cmdver = 0.3.0
diff --git a/puppet/modules/ruby/manifests/devel.pp b/puppet/modules/ruby/manifests/devel.pp
new file mode 100644
index 00000000..7068a74a
--- /dev/null
+++ b/puppet/modules/ruby/manifests/devel.pp
@@ -0,0 +1,5 @@
+# install ruby header files and rake
+class ruby::devel {
+  include ruby
+  ensure_packages($ruby::ruby_dev)
+}
diff --git a/puppet/modules/ruby/manifests/init.pp b/puppet/modules/ruby/manifests/init.pp
new file mode 100644
index 00000000..8d8ae48e
--- /dev/null
+++ b/puppet/modules/ruby/manifests/init.pp
@@ -0,0 +1,72 @@
+# Class: ruby
+#
+# This class installs Ruby
+#
+# Parameters:
+#
+# version: (default installed)
+# Set the version of Ruby to install
+#
+# Sample Usage:
+#
+# For a standard install using the latest ruby, simply do:
+#
+# class { 'ruby': }
+#
+# On Debian this is equivilant to
+# $ apt-get install ruby
+#
+# To install a specific version of ruby, simply do:
+#
+# class { 'ruby':
+#    ruby_version => '1.8.7',
+# }
+#
+# Supported versions: 1.8, 1.8.7, 1.9, 1.9.1, 1.9.3
+#
+# To install the development files, you can do:
+#
+# class { 'ruby': install_dev => true }
+
+class ruby (
+  $ruby_version      = '',
+  $version           = 'installed',
+  $install_dev       = false
+)
+{
+
+  case $::operatingsystem {
+    'redhat', 'suse': {
+      $ruby_package='ruby'
+      $ruby_dev='ruby-devel'
+    }
+    'debian', 'ubuntu': {
+      case $ruby_version {
+        '1.8', '1.8.7': {
+          $ruby_package = 'ruby1.8'
+          $ruby_dev = [ 'ruby1.8-dev', 'rake' ]
+        }
+        '1.9.1': {
+          $ruby_package = 'ruby1.9.1'
+          $ruby_dev = [ 'ruby1.9.1-dev', 'rake' ]
+        }
+        '1.9', '1.9.3': {
+          $ruby_package = 'ruby1.9.3'
+          $ruby_dev = [ 'ruby-dev', 'rake' ]
+        }
+        default: {
+          $ruby_package = 'ruby'
+          $ruby_dev = [ 'ruby-dev', 'rake' ]
+        }
+      }
+    }
+  }
+
+  package{ $ruby_package:
+    ensure => $version,
+  }
+
+  if $install_dev {
+    ensure_packages($ruby_dev)
+  }
+}
diff --git a/puppet/modules/ruby/manifests/mysql.pp b/puppet/modules/ruby/manifests/mysql.pp
new file mode 100644
index 00000000..2e894789
--- /dev/null
+++ b/puppet/modules/ruby/manifests/mysql.pp
@@ -0,0 +1,7 @@
+class ruby::mysql {
+  include ruby
+  package{'ruby-mysql':
+    ensure => present,
+    require => Package['ruby'],
+  }
+}
diff --git a/puppet/modules/ruby/manifests/postgres.pp b/puppet/modules/ruby/manifests/postgres.pp
new file mode 100644
index 00000000..ec0e253a
--- /dev/null
+++ b/puppet/modules/ruby/manifests/postgres.pp
@@ -0,0 +1,6 @@
+class ruby::postgres {
+  include ruby
+  package{'ruby-postgres':
+    ensure => installed,
+  }
+}
diff --git a/puppet/modules/ruby/manifests/shadow.pp b/puppet/modules/ruby/manifests/shadow.pp
new file mode 100644
index 00000000..43f1aeab
--- /dev/null
+++ b/puppet/modules/ruby/manifests/shadow.pp
@@ -0,0 +1,6 @@
+class ruby::shadow {
+  case $::operatingsystem {
+    debian,ubuntu: { include ruby::shadow::debian }
+    default: { include ruby::shadow::base }
+  }
+}
diff --git a/puppet/modules/ruby/manifests/shadow/base.pp b/puppet/modules/ruby/manifests/shadow/base.pp
new file mode 100644
index 00000000..af8c5c92
--- /dev/null
+++ b/puppet/modules/ruby/manifests/shadow/base.pp
@@ -0,0 +1,6 @@
+class ruby::shadow::base {
+  require ::ruby
+  package{'ruby-shadow':
+    ensure => installed,
+  }
+}
diff --git a/puppet/modules/ruby/manifests/shadow/debian.pp b/puppet/modules/ruby/manifests/shadow/debian.pp
new file mode 100644
index 00000000..8182b9b1
--- /dev/null
+++ b/puppet/modules/ruby/manifests/shadow/debian.pp
@@ -0,0 +1,8 @@
+class ruby::shadow::debian inherits ruby::shadow::base {
+  Package['ruby-shadow']{
+    name =>  $::lsbdistcodename ? {
+      'wheezy' => 'libshadow-ruby1.8',
+      default  => 'ruby-shadow',
+    }
+  }
+}
-- 
cgit v1.2.3


From 95d95925e53ec98f3f5868479328a69449de3ca7 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:04 -0400
Subject: git subrepo clone https://leap.se/git/puppet_x509 puppet/modules/x509

subrepo:
  subdir:   "puppet/modules/x509"
  merged:   "19254a3"
upstream:
  origin:   "https://leap.se/git/puppet_x509"
  branch:   "master"
  commit:   "19254a3"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ia024613b147d34a7b4c888818da08152a2fa63dc
---
 puppet/modules/x509/.gitrepo               | 11 ++++++++
 puppet/modules/x509/manifests/base.pp      | 45 ++++++++++++++++++++++++++++++
 puppet/modules/x509/manifests/ca.pp        | 34 ++++++++++++++++++++++
 puppet/modules/x509/manifests/cert.pp      | 34 ++++++++++++++++++++++
 puppet/modules/x509/manifests/init.pp      |  2 ++
 puppet/modules/x509/manifests/key.pp       | 37 ++++++++++++++++++++++++
 puppet/modules/x509/manifests/variables.pp |  7 +++++
 7 files changed, 170 insertions(+)
 create mode 100644 puppet/modules/x509/.gitrepo
 create mode 100644 puppet/modules/x509/manifests/base.pp
 create mode 100644 puppet/modules/x509/manifests/ca.pp
 create mode 100644 puppet/modules/x509/manifests/cert.pp
 create mode 100644 puppet/modules/x509/manifests/init.pp
 create mode 100644 puppet/modules/x509/manifests/key.pp
 create mode 100644 puppet/modules/x509/manifests/variables.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/x509/.gitrepo b/puppet/modules/x509/.gitrepo
new file mode 100644
index 00000000..ed6eb7ac
--- /dev/null
+++ b/puppet/modules/x509/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_x509
+	branch = master
+	commit = 19254a38c1c372ae7912ea9f15500b9b1cbffe81
+	parent = d8ecd5d2f933c40f2413a58e6324558d0e689b6a
+	cmdver = 0.3.0
diff --git a/puppet/modules/x509/manifests/base.pp b/puppet/modules/x509/manifests/base.pp
new file mode 100644
index 00000000..b88cce64
--- /dev/null
+++ b/puppet/modules/x509/manifests/base.pp
@@ -0,0 +1,45 @@
+class x509::base {
+  include x509::variables
+
+  package { [ 'ssl-cert', 'ca-certificates' ]:
+    ensure => installed;
+  }
+
+  group { 'ssl-cert':
+    ensure  => present,
+    system  => true,
+    require => Package['ssl-cert'];
+  }
+
+  file {
+    $x509::variables::root:
+      ensure  => directory,
+      mode    => '0755',
+      owner   => root,
+      group   => root;
+
+    $x509::variables::keys:
+      ensure  => directory,
+      mode    => '0750',
+      owner   => root,
+      group   => ssl-cert;
+
+    $x509::variables::certs:
+      ensure  => directory,
+      mode    => '0755',
+      owner   => root,
+      group   => root;
+
+    $x509::variables::local_CAs:
+      ensure  => directory,
+      mode    => '2775',
+      owner   => root,
+      group   => root;
+  }
+
+  exec { 'update-ca-certificates':
+    command     => '/usr/sbin/update-ca-certificates',
+    refreshonly => true,
+    subscribe   => File[$x509::variables::local_CAs]
+  }
+}
diff --git a/puppet/modules/x509/manifests/ca.pp b/puppet/modules/x509/manifests/ca.pp
new file mode 100644
index 00000000..0e068cd3
--- /dev/null
+++ b/puppet/modules/x509/manifests/ca.pp
@@ -0,0 +1,34 @@
+define x509::ca (
+  $content = 'absent',
+  $source  = 'absent'
+) {
+  include x509::variables
+  include x509::base
+
+  file { "${x509::variables::local_CAs}/${name}.crt" :
+    ensure  => file,
+    mode    => '0444',
+    group   => 'ssl-cert',
+    require => Package['ca-certificates'],
+    notify  => Exec['update-ca-certificates'],
+  }
+  case $content {
+    'absent': {
+      $real_source = $source ? {
+        'absent' => [
+                     "puppet:///modules/site_x509/CAs/${::fqdn}/${name}.crt",
+                     "puppet:///modules/site_x509/CAs/${name}.crt"
+                     ],
+        default => "puppet:///$source",
+      }
+      File["${x509::variables::local_CAs}/${name}.crt"] {
+        source => $real_source
+      }
+    }
+    default: {
+      File["${x509::variables::local_CAs}/${name}.crt"] {
+        content => $content
+      }
+    }
+  }
+}
diff --git a/puppet/modules/x509/manifests/cert.pp b/puppet/modules/x509/manifests/cert.pp
new file mode 100644
index 00000000..0aafb76d
--- /dev/null
+++ b/puppet/modules/x509/manifests/cert.pp
@@ -0,0 +1,34 @@
+define x509::cert (
+  $content = 'absent',
+  $source  = 'absent'
+) {
+  include x509::variables
+  include x509::base
+
+  file { "${x509::variables::certs}/${name}.crt":
+    ensure  => file,
+    mode    => '0444',
+    group   => 'ssl-cert',
+    require => Package['ssl-cert']
+  }
+
+  case $content {
+    'absent': {
+      $real_source = $source ? {
+        'absent' => [
+                     "puppet:///modules/site_x509/certs/${::fqdn}/${name}.crt",
+                     "puppet:///modules/site_x509/certs/${name}.crt"
+                     ],
+        default => "puppet:///$source",
+      }
+      File["${x509::variables::certs}/${name}.crt"] {
+        source => $real_source
+      }
+    }
+    default: {
+      File["${x509::variables::certs}/${name}.crt"] {
+        content => $content
+      }
+    }
+  }
+}
diff --git a/puppet/modules/x509/manifests/init.pp b/puppet/modules/x509/manifests/init.pp
new file mode 100644
index 00000000..8283e482
--- /dev/null
+++ b/puppet/modules/x509/manifests/init.pp
@@ -0,0 +1,2 @@
+class x509 {
+}
diff --git a/puppet/modules/x509/manifests/key.pp b/puppet/modules/x509/manifests/key.pp
new file mode 100644
index 00000000..fd7e25fd
--- /dev/null
+++ b/puppet/modules/x509/manifests/key.pp
@@ -0,0 +1,37 @@
+define x509::key (
+  $content = 'absent',
+  $source  = 'absent',
+  $owner   = 'root',
+  $group   = 'ssl-cert'
+) {
+  include x509::variables
+  include x509::base
+
+  file { "${x509::variables::keys}/${name}.key":
+    ensure  => file,
+    mode    => '0640',
+    owner   => $owner,
+    group   => $group,
+    require => Package['ssl-cert']
+  }
+
+  case $content {
+    'absent': {
+      $real_source = $source ? {
+        'absent' => [
+                     "puppet:///modules/site_x509/keys/${::fqdn}/${name}.key",
+                     "puppet:///modules/site_x509/keys/${name}.key"
+                     ],
+        default => "puppet:///$source",
+      }
+      File["${x509::variables::keys}/${name}.key"] {
+        source => $real_source
+      }
+    }
+    default: {
+      File["${x509::variables::keys}/${name}.key"] {
+        content => $content
+      }
+    }
+  }
+}
diff --git a/puppet/modules/x509/manifests/variables.pp b/puppet/modules/x509/manifests/variables.pp
new file mode 100644
index 00000000..e6bd2359
--- /dev/null
+++ b/puppet/modules/x509/manifests/variables.pp
@@ -0,0 +1,7 @@
+class x509::variables {
+  $root           = '/etc/x509'
+  $certs          = "${root}/certs"
+  $keys           = "${root}/keys"
+  $x509_chain     = "${root}/certs"
+  $local_CAs      = '/usr/local/share/ca-certificates'
+}
-- 
cgit v1.2.3


From 4a11e48e397f1a7eb4c68a1dd1f9e3c5a11352f8 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:06 -0400
Subject: git subrepo clone https://leap.se/git/puppet_passenger
 puppet/modules/passenger

subrepo:
  subdir:   "puppet/modules/passenger"
  merged:   "47fca11"
upstream:
  origin:   "https://leap.se/git/puppet_passenger"
  branch:   "master"
  commit:   "47fca11"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Idba1129126ca0f13a4441e00d7b53e8b4f856825
---
 puppet/modules/passenger/.gitrepo                  |  11 ++
 puppet/modules/passenger/README                    |  42 +++++++
 puppet/modules/passenger/files/mod_passenger.conf  |   0
 .../passenger/files/munin/passenger_memory_stats   | 123 +++++++++++++++++++++
 .../modules/passenger/files/munin/passenger_stats  |  47 ++++++++
 puppet/modules/passenger/manifests/apache.pp       |   7 ++
 puppet/modules/passenger/manifests/apache/base.pp  |   4 +
 .../modules/passenger/manifests/apache/centos.pp   |  24 ++++
 .../modules/passenger/manifests/apache/debian.pp   |  24 ++++
 puppet/modules/passenger/manifests/init.pp         |  75 +++++++++++++
 puppet/modules/passenger/manifests/munin.pp        |  20 ++++
 11 files changed, 377 insertions(+)
 create mode 100644 puppet/modules/passenger/.gitrepo
 create mode 100644 puppet/modules/passenger/README
 create mode 100644 puppet/modules/passenger/files/mod_passenger.conf
 create mode 100755 puppet/modules/passenger/files/munin/passenger_memory_stats
 create mode 100755 puppet/modules/passenger/files/munin/passenger_stats
 create mode 100644 puppet/modules/passenger/manifests/apache.pp
 create mode 100644 puppet/modules/passenger/manifests/apache/base.pp
 create mode 100644 puppet/modules/passenger/manifests/apache/centos.pp
 create mode 100644 puppet/modules/passenger/manifests/apache/debian.pp
 create mode 100644 puppet/modules/passenger/manifests/init.pp
 create mode 100644 puppet/modules/passenger/manifests/munin.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/passenger/.gitrepo b/puppet/modules/passenger/.gitrepo
new file mode 100644
index 00000000..7a402ad5
--- /dev/null
+++ b/puppet/modules/passenger/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_passenger
+	branch = master
+	commit = 47fca117b594d30aa29d33f8d8846eeec0a88d5f
+	parent = 95d95925e53ec98f3f5868479328a69449de3ca7
+	cmdver = 0.3.0
diff --git a/puppet/modules/passenger/README b/puppet/modules/passenger/README
new file mode 100644
index 00000000..549432e2
--- /dev/null
+++ b/puppet/modules/passenger/README
@@ -0,0 +1,42 @@
+Passenger (mod_rails) puppet module
+-----------------------------------
+
+This puppet module handles a passenger setup, it installs the
+packages, and configures some munin graphs.
+
+Dependencies
+------------
+
+This module expects you to have:
+ . apache module
+
+Optional:
+ . munin module
+
+Getting started
+---------------
+
+Simply do 'include passenger' and it will be installed. 
+
+Configuration
+-------------
+
+If you need to install a specific version of passenger or
+librack-ruby, you can specify the version to be installed by providing
+a variable, for example:
+
+class { 'passenger': 
+  passenger_ensure_version => '2.2.23-2~bpo50+1',
+  librack-ruby_ensure_version = "1.0.0-2~bpo50+1"
+}
+
+If you wish to use gems, pass 'use_gems => true'.
+
+By default munin will be used, but you can disable that by passing
+'use_munin => false'.
+
+If you need to set different munin plugin configuration values, you
+can also do so as follows:
+
+$passenger_memory_munin_config = "user root\nenv.passenger_memory_stats /opt/bin/passenger-memory-stats"
+$passenger_stats_munin_config = "user root\nenv.PASSENGER_TMPDIR /var/tmp\n"
diff --git a/puppet/modules/passenger/files/mod_passenger.conf b/puppet/modules/passenger/files/mod_passenger.conf
new file mode 100644
index 00000000..e69de29b
diff --git a/puppet/modules/passenger/files/munin/passenger_memory_stats b/puppet/modules/passenger/files/munin/passenger_memory_stats
new file mode 100755
index 00000000..eb9b2843
--- /dev/null
+++ b/puppet/modules/passenger/files/munin/passenger_memory_stats
@@ -0,0 +1,123 @@
+#!/usr/bin/env ruby
+pod=<<-POD
+
+=head1 NAME
+passenger_memory_stats - Munin plugin to monitor the memory usage of passenger application servers.
+Monitors the memory consumed by passenger instances.
+
+=head1 APPLICABLE SYSTEMS
+All systems that have passenger installed.
+
+=head1 CONFIGURATION
+The plugin needs to execute passenger-memory-stats.
+This configuration section shows the defaults of the plugin:
+
+  [passenger_*]
+  user root
+  command /usr/local/bin/ruby %c
+  
+Options
+  env.passenger_memory_stats '/path/to/passenger-memory-stats'  # Path to passenger memory status.
+  env.graph_category 'App'                                      # Graph Category. Defaults to Passenger.
+
+ln -s /usr/share/munin/plugins/passenger_memory_stats /etc/munin/plugins/passenger_memory_stats
+
+=head1 INTERPRETATION
+The plugin shows the memory consumed by passenger instances.
+
+=head1 MAGIC MARKERS
+  #%# family=auto
+  #%# capabilities=autoconf
+
+=head1 VERSION
+1.5
+
+=head1 BUGS
+None known
+
+=head1 AUTHOR
+Ilya Lityuga
+Bart ten Brinke - railsdoctors.com
+
+=head1 LICENSE
+MIT
+
+POD
+
+# Globals
+GRAPH_CATEGORY          = ENV['graph_category'] || 'Passenger'
+PASSENGER_MEMORY_STATS  = ENV['passenger_memory_stats'] || '/usr/local/bin/passenger-memory-stats'
+
+# Check if this plugin can run
+def autoconf
+  begin
+    require 'rubygems'
+    gem "passenger", ">=2.0"
+  rescue Exception => e
+    puts "no (Gem not found: #{e})"
+    exit 1
+  end
+  
+  status = `#{PASSENGER_MEMORY_STATS}`
+  unless $?.success?
+    puts "no (error when executing #{PASSENGER_MEMORY_STATS})"
+    exit 1
+  end
+  
+  puts "yes"
+  exit 0
+end
+
+# Describe the graph config
+def config
+  status = `#{PASSENGER_MEMORY_STATS}`
+  memory_info = open('/proc/meminfo', 'r') do |lines|
+    lines.inject({}) do |h, line|
+      matched = line.match(/^([\w_\(\)]+):\s+(\d+)/)
+      h[matched[1].to_sym] = matched[2].to_i * 1024
+      h
+    end
+  end
+  upper_limit = memory_info[:MemTotal]
+  puts <<-CONFIG
+graph_category #{GRAPH_CATEGORY}
+graph_title Passenger memory stats
+graph_vlabel Bytes
+graph_args --base 1000 -l 0 --upper-limit #{upper_limit}
+graph_info The memory used by passenger instances on this application server
+ 
+memory.label memory
+CONFIG
+  exit 0
+end
+ 
+
+# Collect the data
+# <tt>debug</tt> Show debug information
+def run(debug = false)
+  stats = `#{PASSENGER_MEMORY_STATS}`
+  
+  unless $?.success?
+    $stderr.puts "failed executing passenger-memory-stats"
+    exit 1
+  end
+
+  puts stats if debug
+
+  #### Total private dirty RSS: 81.81 MB
+  stats =~ /RSS:\s*([\d\.]+)\s*MB\Z/m
+  memory = ($1.to_f * 1024 * 1024).to_i
+  puts "memory.value #{memory}"
+end
+ 
+
+# Main
+if ARGV[0] == "config"
+  config
+elsif ARGV[0] == "autoconf"
+  autoconf
+elsif ARGV[0] == "debug"
+  run(true)
+else
+  run
+end
diff --git a/puppet/modules/passenger/files/munin/passenger_stats b/puppet/modules/passenger/files/munin/passenger_stats
new file mode 100755
index 00000000..f06e88a0
--- /dev/null
+++ b/puppet/modules/passenger/files/munin/passenger_stats
@@ -0,0 +1,47 @@
+#!/usr/bin/env ruby
+
+PASSENGER_STATUS = ENV['passenger_status'] || '/usr/local/bin/passenger-status'
+
+def output_config
+  puts <<-END
+graph_category Passenger
+graph_title passenger status
+graph_vlabel count
+
+sessions.label sessions
+max.label max processes
+running.label running processes
+active.label active processes
+inactive.label inactive processes
+END
+  exit 0
+end
+
+def output_values
+  status = `#{PASSENGER_STATUS}`
+  unless $?.success?
+    $stderr.puts "failed executing passenger-status"
+    exit 1
+  end
+  status =~ /max\s+=\s+(\d+)/
+  puts "max.value #{$1}"
+
+  status =~ /count\s+=\s+(\d+)/
+  puts "running.value #{$1}"
+
+  status =~ /active\s+=\s+(\d+)/
+  puts "active.value #{$1}"
+
+  status =~ /inactive\s+=\s+(\d+)/
+  puts "inactive.value #{$1}"
+
+  total_sessions = 0
+  status.scan(/Sessions: (\d+)/).flatten.each { |count| total_sessions += count.to_i }
+  puts "sessions.value #{total_sessions}"
+end
+
+if ARGV[0] == "config"
+  output_config
+else
+  output_values
+end
diff --git a/puppet/modules/passenger/manifests/apache.pp b/puppet/modules/passenger/manifests/apache.pp
new file mode 100644
index 00000000..d4181ffe
--- /dev/null
+++ b/puppet/modules/passenger/manifests/apache.pp
@@ -0,0 +1,7 @@
+class passenger::apache{
+    case $operatingsystem {
+        centos: { include passenger::apache::centos }
+        debian: { include passenger::apache::debian }
+        defaults: { include passenger::apache::base }
+    }
+}
diff --git a/puppet/modules/passenger/manifests/apache/base.pp b/puppet/modules/passenger/manifests/apache/base.pp
new file mode 100644
index 00000000..441c9bd5
--- /dev/null
+++ b/puppet/modules/passenger/manifests/apache/base.pp
@@ -0,0 +1,4 @@
+class passenger::apache::base {
+   # Todo !
+    include apache
+}
diff --git a/puppet/modules/passenger/manifests/apache/centos.pp b/puppet/modules/passenger/manifests/apache/centos.pp
new file mode 100644
index 00000000..b7b80e3b
--- /dev/null
+++ b/puppet/modules/passenger/manifests/apache/centos.pp
@@ -0,0 +1,24 @@
+class passenger::apache::centos inherits passenger::apache::base {
+
+  package { 'mod_passenger':
+    ensure  => installed,
+    require => Package['apache'],
+  }
+
+  file { '/var/www/passenger_buffer':
+    ensure  => directory,
+    require => [ Package['apache'], Package['mod_passenger'] ],
+    owner   => apache,
+    group   => 0,
+    mode    => '0600';
+  }
+
+  file{ '/etc/httpd/conf.d/mod_passenger_custom.conf':
+    content => "PassengerUploadBufferDir /var/www/passenger_buffer\n",
+    require => File['/var/www/passenger_buffer'],
+    notify  => Service['apache'],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+}
diff --git a/puppet/modules/passenger/manifests/apache/debian.pp b/puppet/modules/passenger/manifests/apache/debian.pp
new file mode 100644
index 00000000..38eb3fa4
--- /dev/null
+++ b/puppet/modules/passenger/manifests/apache/debian.pp
@@ -0,0 +1,24 @@
+class passenger::apache::debian inherits passenger::apache::base {
+
+  package { 'libapache2-mod-passenger':
+    ensure  => installed,
+    require => Package['apache2'],
+  }
+
+  file { '/var/www/passenger_buffer':
+    ensure  => directory,
+    require => [ Package['apache2'], Package['libapache2-mod-passenger'] ],
+    owner   => www-data,
+    group   => 0,
+    mode    => '0600';
+  }
+
+  file { '/etc/apache2/conf.d/mod_passenger_custom.conf':
+    content => "PassengerUploadBufferDir /var/www/passenger_buffer\n",
+    require => File['/var/www/passenger_buffer'],
+    notify  => Service['apache2'],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+}
diff --git a/puppet/modules/passenger/manifests/init.pp b/puppet/modules/passenger/manifests/init.pp
new file mode 100644
index 00000000..ed9b8c31
--- /dev/null
+++ b/puppet/modules/passenger/manifests/init.pp
@@ -0,0 +1,75 @@
+# passenger module
+#
+# Copyright 2010, Riseup Networks
+# Micah Anderson micah(at)riseup.net
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 3 as
+# published by the Free Software Foundation.
+
+class passenger (
+  $use_gems = false, $manage_munin = false,
+  $passenger_ensure_version = 'installed',
+  $librack_ensure_version = 'installed',
+  $passenger_bin_path = '/usr/sbin' )
+{
+  Class['::apache'] -> Class['passenger']
+
+  if ! $use_gems {
+
+    apache::module { 'passenger':
+      ensure       => $passenger_ensure_version,
+      package_name => 'libapache2-mod-passenger';
+    }
+
+    if !defined(Package['librack-ruby']) {
+      if $::lsbdistcodename == 'squeeze' {
+        package { 'librack-ruby1.8': ensure => $librack_ensure_version }
+      }
+      else {
+        package { 'ruby-rack':
+          ensure => $librack_ensure_version;
+        }
+      }
+    }
+  }
+  else {
+    package {
+      'passenger':
+        ensure   => $passenger_ensure_version,
+        provider => gem;
+      'rack':
+        ensure   => $librack_ensure_version,
+        provider => gem;
+    }
+  }
+
+  apache::config::file { 'mod_passenger':
+    ensure => present,
+    source => [ "puppet:///modules/site_passenger/${::fqdn}/mod_passenger.conf",
+                'puppet:///modules/site_passenger/mod_passenger.conf',
+                'puppet:///modules/passenger/mod_passenger.conf',
+              ],
+  }
+
+  if $manage_munin {
+    if $passenger_memory_munin_config == '' {
+      $passenger_memory_munin_config = "user root\nenv.passenger_memory_stats ${passenger_bin_path}/passenger-memory-stats"
+    }
+
+    if $passenger_stats_munin_config == '' {
+      $passenger_stats_munin_config = "user root\nenv.passenger_status ${passenger_bin_path}/passenger-status"
+    }
+
+    munin::plugin::deploy {
+      'passenger_memory_stats':
+        source => 'passenger/munin/passenger_memory_stats',
+        config => $passenger_memory_munin_config;
+      'passenger_stats':
+        source => 'passenger/munin/passenger_stats',
+        config => $passenger_stats_munin_config;
+    }
+  }
+
+}
+
diff --git a/puppet/modules/passenger/manifests/munin.pp b/puppet/modules/passenger/manifests/munin.pp
new file mode 100644
index 00000000..36bc53f2
--- /dev/null
+++ b/puppet/modules/passenger/manifests/munin.pp
@@ -0,0 +1,20 @@
+class passenger::munin {
+
+  case $passenger_memory_munin_config { '':
+    { $passenger_memory_munin_config = "user root\nenv.passenger_memory_stats /usr/sbin/passenger-memory-stats" }
+  }
+
+  case $passenger_stats_munin_config { '':
+    { $passenger_stats_munin_config = "user root\n" }
+  }
+
+  munin::plugin::deploy {
+    'passenger_memory_stats':
+      source => 'passenger/munin/passenger_memory_stats',
+      config => $passenger_memory_munin_config;
+    'passenger_stats':
+      source => 'passenger/munin/passenger_stats',
+      config => $passenger_stats_munin_config;
+  }
+
+}
-- 
cgit v1.2.3


From 95374aacb857ed35c2fdfe6be7c0bfab86653963 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:07 -0400
Subject: git subrepo clone https://leap.se/git/puppet_augeas
 puppet/modules/augeas

subrepo:
  subdir:   "puppet/modules/augeas"
  merged:   "27e3359"
upstream:
  origin:   "https://leap.se/git/puppet_augeas"
  branch:   "master"
  commit:   "27e3359"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ifa5c7daf3f1be1793c42f873a267b7498f5c6c0f
---
 puppet/modules/augeas/.fixtures.yml                |   5 +
 puppet/modules/augeas/.gitignore                   |   7 +
 puppet/modules/augeas/.gitrepo                     |  11 ++
 puppet/modules/augeas/.puppet-lint.rc              |   5 +
 puppet/modules/augeas/.sync.yml                    |   3 +
 puppet/modules/augeas/.travis.yml                  |  30 +++
 puppet/modules/augeas/CHANGELOG.md                 |  45 +++++
 puppet/modules/augeas/Gemfile                      |  41 +++++
 puppet/modules/augeas/LICENSE                      | 201 +++++++++++++++++++++
 puppet/modules/augeas/README.md                    |  76 ++++++++
 puppet/modules/augeas/Rakefile                     |  11 ++
 .../augeas/lib/puppet/parser/functions/augeas.rb   |  68 +++++++
 puppet/modules/augeas/manifests/files.pp           |  36 ++++
 puppet/modules/augeas/manifests/init.pp            |  24 +++
 puppet/modules/augeas/manifests/lens.pp            |  79 ++++++++
 puppet/modules/augeas/manifests/packages.pp        |  14 ++
 puppet/modules/augeas/manifests/params.pp          |  37 ++++
 puppet/modules/augeas/metadata.json                |  62 +++++++
 puppet/modules/augeas/spec/.rspec                  |   6 +
 .../acceptance/nodesets/centos-7-x86_64-docker.yml |  12 ++
 .../nodesets/centos-7-x86_64-openstack.yml         |  13 ++
 .../nodesets/centos-7-x86_64-vagrant.yml           |  10 +
 .../acceptance/nodesets/debian-6-x86_64-docker.yml |  12 ++
 .../nodesets/debian-6-x86_64-vagrant.yml           |  10 +
 .../acceptance/nodesets/debian-7-x86_64-docker.yml |  12 ++
 .../nodesets/debian-7-x86_64-openstack.yml         |  13 ++
 .../nodesets/debian-7-x86_64-vagrant.yml           |  10 +
 .../acceptance/nodesets/debian-8-x86_64-docker.yml |  12 ++
 .../nodesets/debian-8-x86_64-openstack.yml         |  13 ++
 .../nodesets/ubuntu-14.04-x86_64-vagrant.yml       |  10 +
 puppet/modules/augeas/spec/classes/augeas_spec.rb  | 149 +++++++++++++++
 .../augeas/spec/defines/augeas_lens_spec.rb        | 112 ++++++++++++
 puppet/modules/augeas/spec/spec.opts               |   6 +
 puppet/modules/augeas/spec/spec_helper.rb          |  42 +++++
 .../unit/puppet/parser/functions/augeas_spec.rb    |  83 +++++++++
 35 files changed, 1280 insertions(+)
 create mode 100644 puppet/modules/augeas/.fixtures.yml
 create mode 100644 puppet/modules/augeas/.gitignore
 create mode 100644 puppet/modules/augeas/.gitrepo
 create mode 100644 puppet/modules/augeas/.puppet-lint.rc
 create mode 100644 puppet/modules/augeas/.sync.yml
 create mode 100644 puppet/modules/augeas/.travis.yml
 create mode 100644 puppet/modules/augeas/CHANGELOG.md
 create mode 100644 puppet/modules/augeas/Gemfile
 create mode 100644 puppet/modules/augeas/LICENSE
 create mode 100644 puppet/modules/augeas/README.md
 create mode 100644 puppet/modules/augeas/Rakefile
 create mode 100644 puppet/modules/augeas/lib/puppet/parser/functions/augeas.rb
 create mode 100644 puppet/modules/augeas/manifests/files.pp
 create mode 100644 puppet/modules/augeas/manifests/init.pp
 create mode 100644 puppet/modules/augeas/manifests/lens.pp
 create mode 100644 puppet/modules/augeas/manifests/packages.pp
 create mode 100644 puppet/modules/augeas/manifests/params.pp
 create mode 100644 puppet/modules/augeas/metadata.json
 create mode 100644 puppet/modules/augeas/spec/.rspec
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-docker.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/debian-6-x86_64-docker.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-docker.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/debian-8-x86_64-docker.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml
 create mode 100644 puppet/modules/augeas/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml
 create mode 100644 puppet/modules/augeas/spec/classes/augeas_spec.rb
 create mode 100644 puppet/modules/augeas/spec/defines/augeas_lens_spec.rb
 create mode 100644 puppet/modules/augeas/spec/spec.opts
 create mode 100644 puppet/modules/augeas/spec/spec_helper.rb
 create mode 100644 puppet/modules/augeas/spec/unit/puppet/parser/functions/augeas_spec.rb

(limited to 'puppet/modules')

diff --git a/puppet/modules/augeas/.fixtures.yml b/puppet/modules/augeas/.fixtures.yml
new file mode 100644
index 00000000..f074a0ff
--- /dev/null
+++ b/puppet/modules/augeas/.fixtures.yml
@@ -0,0 +1,5 @@
+fixtures:
+  repositories:
+    "stdlib": "git://github.com/puppetlabs/puppetlabs-stdlib.git"
+  symlinks:
+    "augeas": "#{source_dir}"
diff --git a/puppet/modules/augeas/.gitignore b/puppet/modules/augeas/.gitignore
new file mode 100644
index 00000000..b5b7a00d
--- /dev/null
+++ b/puppet/modules/augeas/.gitignore
@@ -0,0 +1,7 @@
+pkg/
+Gemfile.lock
+vendor/
+spec/fixtures/
+.vagrant/
+.bundle/
+coverage/
diff --git a/puppet/modules/augeas/.gitrepo b/puppet/modules/augeas/.gitrepo
new file mode 100644
index 00000000..b33003dd
--- /dev/null
+++ b/puppet/modules/augeas/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_augeas
+	branch = master
+	commit = 27e33591776f0226f78877df350d6a52995265d8
+	parent = 4a11e48e397f1a7eb4c68a1dd1f9e3c5a11352f8
+	cmdver = 0.3.0
diff --git a/puppet/modules/augeas/.puppet-lint.rc b/puppet/modules/augeas/.puppet-lint.rc
new file mode 100644
index 00000000..d8f5c59e
--- /dev/null
+++ b/puppet/modules/augeas/.puppet-lint.rc
@@ -0,0 +1,5 @@
+--fail-on-warnings
+--relative
+--no-80chars
+--no-documentation
+--no-class_inherits_from_params_class-check
diff --git a/puppet/modules/augeas/.sync.yml b/puppet/modules/augeas/.sync.yml
new file mode 100644
index 00000000..677d00cf
--- /dev/null
+++ b/puppet/modules/augeas/.sync.yml
@@ -0,0 +1,3 @@
+---
+.travis.yml:
+  forge_password: "GYBg84VC7Mx8BhAJ/56VjPU8tctatVVafGjuM9rJVmvJpbHkTz+XORHkvdVxCCkAkiq0/NZjwWpbxkQGMz0MxnXT5V/H90+h6YRHnWIEEqlW+5dR76uKZ9mO65cqk+l8UA+GUr5ZWKTS0fEJzjNR8aFM56DaM1u+SWIfjBXfE0k="
diff --git a/puppet/modules/augeas/.travis.yml b/puppet/modules/augeas/.travis.yml
new file mode 100644
index 00000000..777290cc
--- /dev/null
+++ b/puppet/modules/augeas/.travis.yml
@@ -0,0 +1,30 @@
+---
+language: ruby
+sudo: false
+cache: bundler
+bundler_args: --without system_tests
+script: ["bundle exec rake validate", "bundle exec rake lint", "bundle exec rake spec SPEC_OPTS='--format documentation'", "bundle exec rake metadata"]
+matrix:
+  fast_finish: true
+  include:
+  - rvm: 1.8.7
+    env: PUPPET_GEM_VERSION="~> 3.0" FACTER_GEM_VERSION="~> 1.7.0"
+  - rvm: 1.9.3
+    env: PUPPET_GEM_VERSION="~> 3.0"
+  - rvm: 2.0.0
+    env: PUPPET_GEM_VERSION="~> 3.0"
+  - rvm: 2.0.0
+    env: PUPPET_GEM_VERSION="~> 3.0" FUTURE_PARSER="yes"
+notifications:
+  email: false
+deploy:
+  provider: puppetforge
+  user: camptocamp
+  password:
+    secure: "GYBg84VC7Mx8BhAJ/56VjPU8tctatVVafGjuM9rJVmvJpbHkTz+XORHkvdVxCCkAkiq0/NZjwWpbxkQGMz0MxnXT5V/H90+h6YRHnWIEEqlW+5dR76uKZ9mO65cqk+l8UA+GUr5ZWKTS0fEJzjNR8aFM56DaM1u+SWIfjBXfE0k="
+  on:
+    tags: true
+    # all_branches is required to use tags
+    all_branches: true
+    # Only publish if our main Ruby target builds
+    rvm: 1.9.3
diff --git a/puppet/modules/augeas/CHANGELOG.md b/puppet/modules/augeas/CHANGELOG.md
new file mode 100644
index 00000000..3bebf66a
--- /dev/null
+++ b/puppet/modules/augeas/CHANGELOG.md
@@ -0,0 +1,45 @@
+## 2015-01-19 - Release 1.1.6
+
+- Add puppet-ling plugins
+
+##2015-01-12 - Release 1.1.5
+
+- Fix LICENSE file
+- Add some puppet-lint plugins to Gemfile
+
+##2015-01-07 - Release 1.1.4
+
+- Manage unit tests with rspec-puppet-facts
+
+##2014-12-09 - Release 1.1.0
+
+- Add future parser tests
+- Convert specs to rspec3 syntax
+- Fix metadata.json
+
+##2014-11-17 - Release 1.0.3
+
+- Lint metadata.json
+
+##2014-11-04 - Release 1.0.2
+
+- Fix path in unit tests
+- Drop Puppet 2.7 support
+
+##2014-10-28 - Release 1.0.1
+- Add path to exec in augeas::lens
+
+##2014-10-20 - Release 1.0.0
+- Linting
+- Setup automatic Forge releases
+
+##2014-10-06 - Release 0.3.2
+- Remove symlink in spec/ directory (Fix #40)
+
+##2014-09-23 - Release 0.3.1
+- Centralize metadata files
+
+##2014-07-02 - Release 0.3.0
+###Summary
+- Add purge parameter
+- Cleanup unscoped variables
diff --git a/puppet/modules/augeas/Gemfile b/puppet/modules/augeas/Gemfile
new file mode 100644
index 00000000..a3a9eca0
--- /dev/null
+++ b/puppet/modules/augeas/Gemfile
@@ -0,0 +1,41 @@
+source ENV['GEM_SOURCE'] || "https://rubygems.org"
+
+group :development, :unit_tests do
+  gem 'rake',                                              :require => false
+  gem 'rspec', '~> 3.1.0',                                 :require => false
+  gem 'rspec-puppet',                                      :require => false, :git => 'https://github.com/camptocamp/rspec-puppet', :branch => 'rspec3'
+  gem 'puppetlabs_spec_helper',                            :require => false
+  gem 'metadata-json-lint',                                :require => false
+  gem 'puppet-lint',                                       :require => false
+  gem 'puppet-lint-unquoted_string-check',                 :require => false
+  gem 'puppet-lint-empty_string-check',                    :require => false
+  gem 'puppet-lint-spaceship_operator_without_tag-check',  :require => false
+  gem 'puppet-lint-variable_contains_upcase',              :require => false
+  gem 'puppet-lint-absolute_classname-check',              :require => false
+  gem 'puppet-lint-undef_in_function-check',               :require => false
+  gem 'puppet-lint-leading_zero-check',                    :require => false
+  gem 'puppet-lint-trailing_comma-check',                  :require => false
+  gem 'puppet-lint-file_ensure-check',                     :require => false
+  gem 'puppet-lint-version_comparison-check',              :require => false
+  gem 'rspec-puppet-facts',                                :require => false
+end
+
+group :system_tests do
+  gem 'beaker',        :require => false
+  gem 'beaker-rspec',  :require => false
+  gem 'serverspec',    :require => false
+end
+
+if facterversion = ENV['FACTER_GEM_VERSION']
+  gem 'facter', facterversion, :require => false
+else
+  gem 'facter', :require => false
+end
+
+if puppetversion = ENV['PUPPET_GEM_VERSION']
+  gem 'puppet', puppetversion, :require => false
+else
+  gem 'puppet', :require => false
+end
+
+# vim:ft=ruby
diff --git a/puppet/modules/augeas/LICENSE b/puppet/modules/augeas/LICENSE
new file mode 100644
index 00000000..8d968b6c
--- /dev/null
+++ b/puppet/modules/augeas/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!) The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/puppet/modules/augeas/README.md b/puppet/modules/augeas/README.md
new file mode 100644
index 00000000..e2055b07
--- /dev/null
+++ b/puppet/modules/augeas/README.md
@@ -0,0 +1,76 @@
+# Augeas Puppet module
+
+[![Puppet Forge](http://img.shields.io/puppetforge/v/camptocamp/augeas.svg)](https://forge.puppetlabs.com/camptocamp/augeas)
+[![Build Status](https://travis-ci.org/camptocamp/puppet-augeas.png?branch=master)](https://travis-ci.org/camptocamp/puppet-augeas)
+
+**Install and configure Augeas.**
+
+This module is provided by [Camptocamp](http://www.camptocamp.com/)
+
+## Usage
+
+Simple usage:
+
+    include augeas
+
+### Classes
+
+The module provides an `augeas` class which installs and configures Augeas.
+
+
+* lets you force the augeas version by defining `$augeas_version`, otherwise puppet will
+   only ensure the packages are present;
+* lets you force the ruby library version by defining `$augeas_ruby_version`, otherwise puppet will
+   only ensure the libaugeas-ruby version will be installed according to internal critera;
+* provides an `augeas()` master-side function to manipulate strings using Augeas;
+
+Note: the `augeas` class realizes all `augeas` resources in order to ensure they are managed after the required Augeas packages.
+
+
+### Definitions
+
+#### `augeas::lens`
+
+The `augeas::lens` definition allows you to deploy an Augeas lens and any associated test files, running unit tests and not installing if they fail:
+
+Parameters:
+
+- *ensure*: present/absent
+- *lens_source*: the source for the lens
+- *test_source*: optionally, the source for the test file.
+- *stock_since*: optionally, indicate in which version of Augeas
+  the lens became stock, so it will not be deployed above that version.
+
+Example usage:
+
+     augeas::lens { 'networkmanager':
+      lens_source => 'puppet:///modules/networkmanager/lenses/networkmanager.aug',
+      test_source => 'puppet:///modules/networkmanager/lenses/test_networkmanager.aug',
+      stock_since => '1.0.0',
+     }
+
+### Functions
+
+#### `augeas()`
+
+Modifies a string using Augeas.
+
+*Example:*
+
+    augeas("proc        /proc   proc    nodev,noexec,nosuid     0       0\n", 'Fstab.lns', ['rm ./1/opt[3]'])
+
+Would result in:
+
+    "proc        /proc   proc    nodev,noexec     0       0\n"
+
+
+- *Type*: rvalue
+
+## Contributing
+
+Please report bugs and feature request using [GitHub issue
+tracker](https://github.com/camptocamp/puppet-augeas/issues).
+
+For pull requests, it is very much appreciated to check your Puppet manifest
+with [puppet-lint](https://github.com/camptocamp/puppet-augeas/issues) to follow the recommended Puppet style guidelines from the
+[Puppet Labs style guide](http://docs.puppetlabs.com/guides/style_guide.html).
diff --git a/puppet/modules/augeas/Rakefile b/puppet/modules/augeas/Rakefile
new file mode 100644
index 00000000..f87e6088
--- /dev/null
+++ b/puppet/modules/augeas/Rakefile
@@ -0,0 +1,11 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+
+Rake::Task[:lint].clear
+PuppetLint::RakeTask.new :lint do |config|
+  config.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp", "vendor/**/*.pp"]
+  config.disable_checks = ['80chars']
+  config.fail_on_warnings = true
+end
+
+PuppetSyntax.exclude_paths = ["spec/fixtures/**/*.pp", "vendor/**/*"]
diff --git a/puppet/modules/augeas/lib/puppet/parser/functions/augeas.rb b/puppet/modules/augeas/lib/puppet/parser/functions/augeas.rb
new file mode 100644
index 00000000..08026f77
--- /dev/null
+++ b/puppet/modules/augeas/lib/puppet/parser/functions/augeas.rb
@@ -0,0 +1,68 @@
+#
+# augeas.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:augeas, :type => :rvalue, :doc => <<-EOS
+Modifies a string using Augeas.
+
+*Example:*
+
+    augeas("proc        /proc   proc    nodev,noexec,nosuid     0       0\n", 'Fstab.lns', ['rm ./1/opt[3]'])
+
+Would result in:
+
+    "proc        /proc   proc    nodev,noexec     0       0\n"
+    EOS
+  ) do |arguments|
+    unless Puppet.features.augeas?
+      raise Puppet::ParseError, ('augeas(): this function requires the augeas feature. See http://projects.puppetlabs.com/projects/puppet/wiki/Puppet_Augeas#Pre-requisites for how to activate it.')
+    end
+
+    # Check that 2 arguments have been given ...
+    raise(Puppet::ParseError, 'augeas(): Wrong number of arguments ' +
+      "given (#{arguments.size} for 3)") if arguments.size != 3
+
+    content = arguments[0]
+    lens = arguments[1]
+    changes = arguments[2]
+
+    # Check arguments
+    raise(Puppet::ParseError, 'augeas(): content must be a string') unless content.is_a?(String)
+    raise(Puppet::ParseError, 'augeas(): lens must be a string') unless lens.is_a?(String)
+    raise(Puppet::ParseError, 'augeas(): changes must be an array') unless changes.is_a?(Array)
+
+    require 'augeas'
+    aug = Augeas::open(nil, nil, Augeas::NO_MODL_AUTOLOAD)
+    augeas_version = aug.get('/augeas/version')
+    raise(Puppet::ParseError, 'augeas(): requires Augeas 1.0.0 or greater') unless Puppet::Util::Package.versioncmp(augeas_version, '1.0.0') >= 0
+    raise(Puppet::ParseError, 'augeas(): requires ruby-augeas 0.5.0 or greater') unless aug.methods.include?('text_store')
+
+    result = nil
+    begin
+      aug.set('/input', content)
+      aug.text_store(lens, '/input', '/store')
+      unless aug.match("/augeas/text/store//error").empty?
+          error = aug.get("/augeas/text/store//error/message")
+          raise Puppet::ParseError, "augeas(): Failed to parse string with lens #{lens}: #{error}"
+      end
+
+      # Apply changes
+      aug.context = '/store'
+      changes.each do |c|
+        r = aug.srun(c)
+        raise Puppet::ParseError, "augeas(): Failed to apply change to tree" unless r and r[0] >= 0
+      end
+      unless aug.text_retrieve(lens, '/input', '/store', '/output')
+        error = aug.get("/augeas/text/store//error/message")
+        raise Puppet::ParseError, "augeas(): Failed to apply changes with lens #{lens}: #{error}"
+      end
+      result = aug.get("/output")
+    ensure
+      aug.close
+    end
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/augeas/manifests/files.pp b/puppet/modules/augeas/manifests/files.pp
new file mode 100644
index 00000000..c73c19bb
--- /dev/null
+++ b/puppet/modules/augeas/manifests/files.pp
@@ -0,0 +1,36 @@
+# Class: augeas::files
+#
+# Sets up directories and files for Augeas
+#
+class augeas::files {
+  $lens_dir = $augeas::lens_dir
+
+  # ensure no file not managed by puppet ends up in there.
+  file { $lens_dir:
+    ensure       => directory,
+    purge        => $::augeas::purge,
+    force        => true,
+    recurse      => true,
+    recurselimit => 1,
+    mode         => '0644',
+    owner        => 'root',
+    group        => 'root',
+  }
+
+  file { "${lens_dir}/dist":
+    ensure => directory,
+    purge  => false,
+    mode   => '0644',
+    owner  => 'root',
+    group  => 'root',
+  }
+
+  file { "${lens_dir}/tests":
+    ensure => directory,
+    purge  => $::augeas::purge,
+    force  => true,
+    mode   => '0644',
+    owner  => 'root',
+    group  => 'root',
+  }
+}
diff --git a/puppet/modules/augeas/manifests/init.pp b/puppet/modules/augeas/manifests/init.pp
new file mode 100644
index 00000000..41f4f875
--- /dev/null
+++ b/puppet/modules/augeas/manifests/init.pp
@@ -0,0 +1,24 @@
+# Class: augeas
+#
+# Install and configure Augeas
+#
+# Parameters:
+#   ['version']      - the desired version of Augeas
+#   ['ruby_version'] - the desired version of the Ruby bindings for Augeas
+#   ['lens_dir']     - the lens directory to use
+#   ['purge']        - whether to purge lens directories
+class augeas (
+  $version      = present,
+  $ruby_version = present,
+  $lens_dir     = $augeas::params::lens_dir,
+  $purge        = true,
+) inherits augeas::params {
+
+  class {'::augeas::packages': } ->
+  class {'::augeas::files': } ->
+  Class['augeas']
+
+  # lint:ignore:spaceship_operator_without_tag
+  Package['ruby-augeas', $augeas::params::augeas_pkgs] -> Augeas <| |>
+  # lint:endignore
+}
diff --git a/puppet/modules/augeas/manifests/lens.pp b/puppet/modules/augeas/manifests/lens.pp
new file mode 100644
index 00000000..b5b9acd6
--- /dev/null
+++ b/puppet/modules/augeas/manifests/lens.pp
@@ -0,0 +1,79 @@
+# Definition: augeas::lens
+#
+# Deploy an Augeas lens (and its test file).
+# Check the lens (and run the unit tests) automatically and remove the files if
+# the checks fail.
+#
+# Parameters:
+#   ['ensure']       - present/absent
+#   ['lens_source']  - the source for the lens
+#   ['test_source']  - optionally, the source for the test file.
+#   ['stock_since']  - optionally, indicate in which version of Augeas
+#                      the lens became stock, so it will not be deployed
+#                      above that version.
+#
+# Example usage:
+#
+#   augeas::lens { 'networkmanager':
+#     lens_source => 'puppet:///modules/networkmanager/lenses/networkmanager.aug',
+#     test_source => 'puppet:///modules/networkmanager/lenses/test_networkmanager.aug',
+#     stock_since => '1.0.0',
+#   }
+#
+define augeas::lens (
+  $lens_source,
+  $ensure=present,
+  $test_source=false,
+  $stock_since=false,
+) {
+  if !defined(Class['augeas']) {
+    fail('You must declare the augeas class before using augeas::lens')
+  }
+
+  File {
+    owner => 'root',
+    group => 'root',
+    mode => '0644',
+  }
+
+  Exec {
+    path => $::path,
+  }
+
+  if (!$stock_since or versioncmp($::augeasversion, $stock_since) < 0) {
+
+    validate_re(
+      $augeas::lens_dir,
+      '/.*',
+      "'${augeas::lens_dir}' is not a valid path for lens ${name}"
+    )
+
+    $lens_dest = "${augeas::lens_dir}/${name}.aug"
+    $test_dest = "${augeas::lens_dir}/tests/test_${name}.aug"
+
+    file { $lens_dest:
+      ensure => $ensure,
+      source => $lens_source,
+    }
+
+    exec { "Typecheck lens ${name}":
+      command     => "augparse -I ${augeas::lens_dir} ${lens_dest} || (rm -f ${lens_dest} && exit 1)",
+      refreshonly => true,
+      subscribe   => File[$lens_dest],
+    }
+
+    if $test_source {
+      file { $test_dest:
+        ensure => $ensure,
+        source => $test_source,
+        notify => Exec["Test lens ${name}"],
+      }
+
+      exec { "Test lens ${name}":
+        command     => "augparse -I ${augeas::lens_dir} ${test_dest} || (rm -f ${lens_dest} && rm -f ${test_dest} && exit 1)",
+        refreshonly => true,
+        subscribe   => File[$lens_dest, $test_dest],
+      }
+    }
+  }
+}
diff --git a/puppet/modules/augeas/manifests/packages.pp b/puppet/modules/augeas/manifests/packages.pp
new file mode 100644
index 00000000..ff8628df
--- /dev/null
+++ b/puppet/modules/augeas/manifests/packages.pp
@@ -0,0 +1,14 @@
+# Class: augeas::packages
+#
+# Sets up packages for Augeas
+#
+class augeas::packages {
+  package { $::augeas::params::augeas_pkgs:
+    ensure => $::augeas::version,
+  }
+
+  package { 'ruby-augeas':
+    ensure => $::augeas::ruby_version,
+    name   => $::augeas::params::ruby_pkg,
+  }
+}
diff --git a/puppet/modules/augeas/manifests/params.pp b/puppet/modules/augeas/manifests/params.pp
new file mode 100644
index 00000000..e5400339
--- /dev/null
+++ b/puppet/modules/augeas/manifests/params.pp
@@ -0,0 +1,37 @@
+# Class: augeas::params
+#
+# Default parameters for the Augeas module
+#
+class augeas::params {
+  $lens_dir = '/usr/share/augeas/lenses'
+
+  case $::osfamily {
+    'RedHat': {
+      $ruby_pkg = 'ruby-augeas'
+      $augeas_pkgs = ['augeas', 'augeas-libs']
+    }
+
+    'Suse': {
+        # RPM Sources: https://build.opensuse.org/project/show/systemsmanagement:puppet
+      # SLES 11 SP3
+      if versioncmp($::rubyversion, '1.8.7') >= 0 {
+        $ruby_pkg = 'ruby1.8-rubygem-ruby-augeas'
+      # SLES 12
+      } else {
+        $ruby_pkg = 'ruby2.1-rubygem-ruby-augeas'
+      }
+      $augeas_pkgs = ['augeas', 'augeas-lenses', 'libaugeas0' ]
+    }
+
+    'Debian': {
+      if versioncmp($::rubyversion, '1.9.1') >= 0 {
+        $ruby_pkg = 'libaugeas-ruby1.9.1'
+      } else {
+        $ruby_pkg = 'libaugeas-ruby1.8'
+      }
+      $augeas_pkgs = ['augeas-lenses', 'libaugeas0', 'augeas-tools']
+    }
+
+    default:  { fail("Unsupported OS family: ${::osfamily}") }
+  }
+}
diff --git a/puppet/modules/augeas/metadata.json b/puppet/modules/augeas/metadata.json
new file mode 100644
index 00000000..f6bfbf96
--- /dev/null
+++ b/puppet/modules/augeas/metadata.json
@@ -0,0 +1,62 @@
+{
+  "name": "camptocamp-augeas",
+  "version": "1.1.6",
+  "author": "camptocamp",
+  "summary": "Camptocamp Augeas module",
+  "license": "Apache-2.0",
+  "source": "https://github.com/camptocamp/puppet-augeas",
+  "project_page": "https://github.com/camptocamp/puppet-augeas",
+  "issues_url": "https://github.com/camptocamp/puppet-augeas/issues",
+  "description": "Augeas Module for Puppet",
+  "dependencies": [
+    {
+      "name": "puppetlabs/stdlib",
+      "version_requirement": ">= 3.2.0 <5.0.0"
+    }
+  ],
+  "requirements": [
+    {
+      "name": "pe",
+      "version_requirement": "3.x"
+    },
+    {
+      "name": "puppet",
+      "version_requirement": "3.x"
+    }
+  ],
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "Debian",
+      "operatingsystemrelease": [
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "Ubuntu",
+      "operatingsystemrelease": [
+        "10.04",
+        "12.04",
+        "14.04"
+      ]
+    },
+    {
+      "operatingsystem": "RedHat",
+      "operatingsystemrelease": [
+        "5",
+        "6"
+      ]
+    }
+  ],
+  "puppet_version": [
+    "2.7",
+    "3.0",
+    "3.1",
+    "3.2",
+    "3.3",
+    "3.4",
+    "3.5",
+    "3.6",
+    "3.7"
+  ]
+}
diff --git a/puppet/modules/augeas/spec/.rspec b/puppet/modules/augeas/spec/.rspec
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/augeas/spec/.rspec
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-docker.yml b/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-docker.yml
new file mode 100644
index 00000000..599a681f
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-docker.yml
@@ -0,0 +1,12 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : docker
+    image: centos:7
+    # This stops the image from being deleted on completion, speeding up the process.
+    docker_preserve_image: true
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml b/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml
new file mode 100644
index 00000000..37dfc5f9
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml
@@ -0,0 +1,13 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : openstack
+    flavor: m1.small
+    image: centos-7-x86_64-genericcloud-20140929_01
+    user: centos
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml b/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml
new file mode 100644
index 00000000..fe0f83b8
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : vagrant
+    box : puppetlabs/centos-7.0-64-nocm
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/debian-6-x86_64-docker.yml b/puppet/modules/augeas/spec/acceptance/nodesets/debian-6-x86_64-docker.yml
new file mode 100644
index 00000000..0296d129
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/debian-6-x86_64-docker.yml
@@ -0,0 +1,12 @@
+HOSTS:
+  debian-6-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: debian-6-amd64
+    hypervisor : docker
+    image: debian:6
+    # This stops the image from being deleted on completion, speeding up the process.
+    docker_preserve_image: true
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml b/puppet/modules/augeas/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml
new file mode 100644
index 00000000..23dae1b0
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  debian-6-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: debian-6-amd64
+    hypervisor : vagrant
+    box : puppetlabs/debian-6.0.10-64-nocm
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-docker.yml b/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-docker.yml
new file mode 100644
index 00000000..ef1c9b22
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-docker.yml
@@ -0,0 +1,12 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : docker
+    image: debian:7
+    # This stops the image from being deleted on completion, speeding up the process.
+    docker_preserve_image: true
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml b/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml
new file mode 100644
index 00000000..e52336be
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml
@@ -0,0 +1,13 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: debian-7-amd64-20141121
+    user: debian
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml b/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml
new file mode 100644
index 00000000..86c2165d
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : vagrant
+    box : puppetlabs/debian-7.8-64-nocm
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/debian-8-x86_64-docker.yml b/puppet/modules/augeas/spec/acceptance/nodesets/debian-8-x86_64-docker.yml
new file mode 100644
index 00000000..28c3e02f
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/debian-8-x86_64-docker.yml
@@ -0,0 +1,12 @@
+HOSTS:
+  debian-8-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: debian-8-amd64
+    hypervisor : docker
+    image: debian:8
+    # This stops the image from being deleted on completion, speeding up the process.
+    docker_preserve_image: true
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml b/puppet/modules/augeas/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml
new file mode 100644
index 00000000..194ca460
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml
@@ -0,0 +1,13 @@
+HOSTS:
+  debian-8-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: debian-8-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: debian-8-amd64-20141121
+    user: debian
+CONFIG:
+  type: foss
+  openstack_network: default
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml b/puppet/modules/augeas/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml
new file mode 100644
index 00000000..a3edb70f
--- /dev/null
+++ b/puppet/modules/augeas/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-14.04-x64:
+    default_apply_opts:
+      strict_variables:
+    platform: ubuntu-14.04-amd64
+    hypervisor : vagrant
+    box : puppetlabs/ubuntu-14.04-64-nocm
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/augeas/spec/classes/augeas_spec.rb b/puppet/modules/augeas/spec/classes/augeas_spec.rb
new file mode 100644
index 00000000..ab4241f4
--- /dev/null
+++ b/puppet/modules/augeas/spec/classes/augeas_spec.rb
@@ -0,0 +1,149 @@
+require 'spec_helper'
+
+describe 'augeas' do
+
+  context 'when on an unsupported Operating System' do
+    let (:facts) do
+      {
+        :osfamily => 'MS-DOS',
+      }
+    end
+
+    it 'should fail' do
+      expect { is_expected.to contain_package('ruby-augeas') }.to raise_error(Puppet::Error, /Unsupported OS family/)
+    end
+  end
+
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts
+      end
+
+      context 'without params' do
+        case facts[:osfamily]
+        when 'Debian'
+          it { is_expected.to contain_package('libaugeas0').with(
+            :ensure => 'present'
+          ) }
+          it { is_expected.to contain_package('augeas-tools').with(
+            :ensure => 'present'
+          ) }
+          it { is_expected.to contain_package('augeas-lenses').with(
+            :ensure => 'present'
+          ) }
+          case facts[:lsbdistcodename]
+          when 'squeeze', 'lucid', 'precise'
+            it { is_expected.to contain_package('ruby-augeas').with(
+              :ensure => 'present',
+              :name   => 'libaugeas-ruby1.8'
+            ) }
+          else
+            it { is_expected.to contain_package('ruby-augeas').with(
+              :ensure => 'present',
+              :name   => 'libaugeas-ruby1.9.1'
+            ) }
+          end
+        when 'RedHat'
+          it { is_expected.to contain_package('augeas').with(
+            :ensure => 'present'
+          ) }
+          it { is_expected.to contain_package('augeas-libs').with(
+            :ensure => 'present'
+          ) }
+          it { is_expected.to contain_package('ruby-augeas').with(
+            :ensure => 'present',
+            :name   => 'ruby-augeas'
+          ) }
+        end
+        it { is_expected.to contain_file('/usr/share/augeas/lenses').with(
+          :ensure       => 'directory',
+          :purge        => 'true',
+          :force        => 'true',
+          :recurse      => 'true',
+          :recurselimit => 1
+        ) }
+        it { is_expected.to contain_file('/usr/share/augeas/lenses/dist').with(
+          :ensure       => 'directory',
+          :purge        => 'false'
+        ) }
+        it { is_expected.to contain_file('/usr/share/augeas/lenses/tests').with(
+          :ensure       => 'directory',
+          :purge        => 'true',
+          :force        => 'true'
+        ).without(:recurse) }
+      end
+
+      context 'when versions are specified' do
+        let (:params) do
+          {
+            :version      => '1.2.3',
+            :ruby_version => '3.2.1',
+          }
+        end
+
+        case facts[:osfamily]
+        when 'Debian'
+          it { is_expected.to contain_package('libaugeas0').with(
+            :ensure => '1.2.3'
+          ) }
+          it { is_expected.to contain_package('augeas-tools').with(
+            :ensure => '1.2.3'
+          ) }
+          it { is_expected.to contain_package('augeas-lenses').with(
+            :ensure => '1.2.3'
+          ) }
+          case facts[:lsbdistcodename]
+          when 'squeeze', 'lucid', 'precise'
+            it { is_expected.to contain_package('ruby-augeas').with(
+              :ensure => '3.2.1',
+              :name   => 'libaugeas-ruby1.8'
+            ) }
+          else
+            it { is_expected.to contain_package('ruby-augeas').with(
+              :ensure => '3.2.1',
+              :name   => 'libaugeas-ruby1.9.1'
+            ) }
+          end
+        when 'RedHat'
+          it { is_expected.to contain_package('augeas').with(
+            :ensure => '1.2.3'
+          ) }
+          it { is_expected.to contain_package('augeas-libs').with(
+            :ensure => '1.2.3'
+          ) }
+          it { is_expected.to contain_package('ruby-augeas').with(
+            :ensure => '3.2.1',
+            :name   => 'ruby-augeas'
+          ) }
+        end
+
+      end
+
+      context 'with a non standard lens_dir' do
+        let (:params) do
+          {
+            :lens_dir => '/opt/augeas/lenses',
+          }
+        end
+
+        it { is_expected.to contain_file('/opt/augeas/lenses').with(
+          :ensure       => 'directory',
+          :purge        => 'true',
+          :force        => 'true',
+          :recurse      => 'true',
+          :recurselimit => 1
+        ) }
+        it { is_expected.to contain_file('/opt/augeas/lenses/dist').with(
+          :ensure       => 'directory',
+          :purge        => 'false'
+        ) }
+        it { is_expected.to contain_file('/opt/augeas/lenses/tests').with(
+          :ensure       => 'directory',
+          :purge        => 'true',
+          :force        => 'true'
+        ).without(:recurse) }
+      end
+    end
+  end
+end
diff --git a/puppet/modules/augeas/spec/defines/augeas_lens_spec.rb b/puppet/modules/augeas/spec/defines/augeas_lens_spec.rb
new file mode 100644
index 00000000..7feeefbd
--- /dev/null
+++ b/puppet/modules/augeas/spec/defines/augeas_lens_spec.rb
@@ -0,0 +1,112 @@
+require 'spec_helper'
+
+describe 'augeas::lens' do
+  let (:title) { 'foo' }
+
+  context 'when not declaring augeas class first' do
+    let (:params) do
+      {
+        :lens_source => '/tmp/foo.aug',
+      }
+    end
+
+    it 'should error' do
+      expect {
+        is_expected.to contain_file('/usr/share/augeas/lenses/foo.aug')
+      }.to raise_error(Puppet::Error, /You must declare the augeas class/)
+    end
+  end
+
+  context 'when declaring augeas class first' do
+
+    on_supported_os.each do |os, facts|
+      context "on #{os}" do
+        let(:facts) do
+          facts.merge({
+            :augeasversion => :undef,
+          })
+        end
+
+        context 'With standard augeas version' do
+
+          let(:pre_condition) do
+            "class { '::augeas': }"
+          end
+
+          context 'when no lens_source is passed' do
+            it 'should error' do
+              expect {
+                is_expected.to contain_file('/usr/share/augeas/lenses/foo.aug')
+              }.to raise_error(Puppet::Error, /Must pass lens_source/)
+            end
+          end
+
+          context 'when lens_source is passed' do
+            let (:params) do
+              {
+                :lens_source => '/tmp/foo.aug',
+              }
+            end
+
+            it { is_expected.to contain_file('/usr/share/augeas/lenses/foo.aug') }
+            it { is_expected.to contain_exec('Typecheck lens foo') }
+            it { is_expected.not_to contain_file('/usr/share/augeas/lenses/tests/test_foo.aug') }
+            it { is_expected.not_to contain_exec('Test lens foo') }
+          end
+
+          context 'when lens_source and test_source are passed' do
+            let (:params) do
+              {
+                :lens_source => '/tmp/foo.aug',
+                :test_source => '/tmp/test_foo.aug',
+              }
+            end
+
+            it { is_expected.to contain_file('/usr/share/augeas/lenses/foo.aug') }
+            it { is_expected.to contain_exec('Typecheck lens foo') }
+            it { is_expected.to contain_file('/usr/share/augeas/lenses/tests/test_foo.aug') }
+            it { is_expected.to contain_exec('Test lens foo') }
+          end
+        end
+
+        context 'when stock_since is passed and augeas is older' do
+          let (:params) do
+            {
+              :lens_source => '/tmp/foo.aug',
+              :stock_since => '1.2.3',
+            }
+          end
+
+          let(:pre_condition) do
+            "class { '::augeas': version => '1.0.0' }"
+          end
+
+          it { is_expected.to contain_file('/usr/share/augeas/lenses/foo.aug') }
+          it { is_expected.to contain_exec('Typecheck lens foo') }
+        end
+
+        context 'when stock_since is passed and augeas is newer' do
+          let (:params) do
+            {
+              :lens_source => '/tmp/foo.aug',
+              :stock_since => '1.2.3',
+            }
+          end
+
+          let(:pre_condition) do
+            "class { '::augeas': version => '1.3.0' }"
+          end
+
+          it do
+            pending "undefined method `negative_failure_message'"
+            is_expected.not_to contain_file('/usr/share/augeas/lenses/foo.aug')
+          end
+          it do
+            pending "undefined method `negative_failure_message'"
+            is_expected.not_to contain_exec('Typecheck lens foo')
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/augeas/spec/spec.opts b/puppet/modules/augeas/spec/spec.opts
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/augeas/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/augeas/spec/spec_helper.rb b/puppet/modules/augeas/spec/spec_helper.rb
new file mode 100644
index 00000000..86cc740a
--- /dev/null
+++ b/puppet/modules/augeas/spec/spec_helper.rb
@@ -0,0 +1,42 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
+require 'rspec-puppet-facts'
+include RspecPuppetFacts
+
+
+RSpec.configure do |c|
+  c.include PuppetlabsSpec::Files
+
+  c.before :each do
+    # Store any environment variables away to be restored later
+    @old_env = {}
+    ENV.each_key {|k| @old_env[k] = ENV[k]}
+
+    Puppet.settings[:strict_variables]=true if Gem::Version.new(Puppet::PUPPETVERSION) >= Gem::Version.new('3.5')
+    Puppet.features.stubs(:root?).returns(true)
+  end
+
+  c.after :each do
+    PuppetlabsSpec::Files.cleanup
+  end
+end
+
+require 'pathname'
+dir = Pathname.new(__FILE__).parent
+Puppet[:modulepath] = File.join(dir, 'fixtures', 'modules')
+
+# There's no real need to make this version dependent, but it helps find
+# regressions in Puppet
+#
+# 1. Workaround for issue #16277 where default settings aren't initialised from
+# a spec and so the libdir is never initialised (3.0.x)
+# 2. Workaround for 2.7.20 that now only loads types for the current node
+# environment (#13858) so Puppet[:modulepath] seems to get ignored
+# 3. Workaround for 3.5 where context hasn't been configured yet,
+# ticket https://tickets.puppetlabs.com/browse/MODULES-823
+#
+ver = Gem::Version.new(Puppet.version.split('-').first)
+if Gem::Requirement.new("~> 2.7.20") =~ ver || Gem::Requirement.new("~> 3.0.0") =~ ver || Gem::Requirement.new("~> 3.5") =~ ver
+  puts "augeasproviders: setting Puppet[:libdir] to work around broken type autoloading"
+  # libdir is only a single dir, so it can only workaround loading of one external module
+  Puppet[:libdir] = "#{Puppet[:modulepath]}/augeasproviders_core/lib"
+end
diff --git a/puppet/modules/augeas/spec/unit/puppet/parser/functions/augeas_spec.rb b/puppet/modules/augeas/spec/unit/puppet/parser/functions/augeas_spec.rb
new file mode 100644
index 00000000..b34fa5b5
--- /dev/null
+++ b/puppet/modules/augeas/spec/unit/puppet/parser/functions/augeas_spec.rb
@@ -0,0 +1,83 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe 'the augeas function' do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should fail if the augeas feature is not present" do
+    Puppet.features.expects(:augeas?).returns(false)
+    expect { scope.function_augeas([]) }.to raise_error(Puppet::ParseError, /requires the augeas feature/)
+  end
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("augeas")).to eq("function_augeas")
+  end
+
+  context "when passing wrong arguments" do
+    before :each do
+      Puppet.features.stubs(:augeas?).returns(true)
+    end
+
+    it "should raise a ParseError if there are no arguments" do
+      expect { scope.function_augeas([]) }.to raise_error(Puppet::ParseError, /Wrong number of arguments/)
+    end
+
+    it "should raise a ParseError if content is not a string" do
+      expect { scope.function_augeas([['foo'], 'Fstab.lns', []]) }.to raise_error(Puppet::ParseError, /content must be a string/)
+    end
+
+    it "should raise a ParseError if lens is not a string" do
+      expect { scope.function_augeas(['foo', ['Fstab.lns'], []]) }.to raise_error(Puppet::ParseError, /lens must be a string/)
+    end
+
+    it "should raise a ParseError if changes is not an array" do
+      expect { scope.function_augeas(['foo', 'Fstab.lns', 'changes']) }.to raise_error(Puppet::ParseError, /changes must be an array/)
+    end
+  end
+
+  if Puppet.features.augeas?
+    context "when passing invalid input" do
+      it "should fail to parse input with lens" do
+        expect { scope.function_augeas(['foo', 'Fstab.lns', []]) }.to raise_error(Puppet::ParseError, /Failed to parse string with lens Fstab.lns:/)
+      end
+    end
+
+    context "when passing illegal changes" do
+      it "should fail to apply illegal change" do
+        expect { scope.function_augeas(["\n", 'Fstab.lns', ['foo bar']]) }.to raise_error(Puppet::ParseError, /Failed to apply change to tree/)
+      end
+    end
+
+    context "when generating an invalid tree" do
+      it "should fail to apply changes with wrong tree" do
+        expect { scope.function_augeas(["\n", 'Fstab.lns', ['set ./1/opt 3']]) }.to raise_error(Puppet::ParseError, /Failed to apply changes with lens Fstab.lns:/)
+      end
+    end
+
+    context "when applying valid changes" do
+      it "should remove the 3rd option" do
+        result = scope.function_augeas(["proc        /proc   proc    nodev,noexec,nosuid     0       0\n", 'Fstab.lns', ['rm ./1/opt[3]']])
+        expect(result.class).to eq(String)
+        #result.should == "proc       /proc   proc    nodev,noexec     0       0\n"
+      end
+
+      it "should set a 4th option" do
+        result = scope.function_augeas(["proc        /proc   proc    nodev,noexec,nosuid     0       0\n", 'Fstab.lns', ['ins opt after ./1/opt[last()]', 'set ./1/opt[last()] nofoo']])
+        expect(result.class).to eq(String)
+        #result.should == "proc       /proc   proc    nodev,noexec,nosuid,nofoo     0       0\n"
+      end
+    end
+
+    context "when using old libs" do
+      it "should not work with Augeas prior to 1.0.0" do
+        Augeas.any_instance.expects(:get).with('/augeas/version').returns('0.10.0')
+        expect { scope.function_augeas(["\n", 'Fstab.lns', []]) }.to raise_error(Puppet::ParseError, /requires Augeas 1\.0\.0/)
+      end
+
+      it "should not work with ruby-augeas prior to 0.5.0" do
+        Augeas.any_instance.expects(:methods).returns([])
+        expect { scope.function_augeas(["\n", 'Fstab.lns', []]) }.to raise_error(Puppet::ParseError, /requires ruby-augeas 0\.5\.0/)
+      end
+    end
+  end
+end
-- 
cgit v1.2.3


From 40ea2656f072e23bbbccd22c39fb29a36390fa3a Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:08 -0400
Subject: git subrepo clone https://leap.se/git/puppet_stdlib
 puppet/modules/stdlib

subrepo:
  subdir:   "puppet/modules/stdlib"
  merged:   "7112363"
upstream:
  origin:   "https://leap.se/git/puppet_stdlib"
  branch:   "master"
  commit:   "7112363"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I032e3e7c2984bf53b717373df495c039bb6f41b3
---
 puppet/modules/stdlib/.fixtures.yml                |   3 +
 puppet/modules/stdlib/.gemspec                     |  40 ++
 puppet/modules/stdlib/.gitignore                   |   9 +
 puppet/modules/stdlib/.gitrepo                     |  11 +
 puppet/modules/stdlib/.project                     |  23 +
 puppet/modules/stdlib/.rspec                       |   4 +
 puppet/modules/stdlib/.sync.yml                    |   9 +
 puppet/modules/stdlib/.travis.yml                  |  18 +
 puppet/modules/stdlib/CHANGELOG.md                 | 500 ++++++++++++++
 puppet/modules/stdlib/CONTRIBUTING.md              | 220 ++++++
 puppet/modules/stdlib/Gemfile                      |  35 +
 puppet/modules/stdlib/LICENSE                      |  19 +
 puppet/modules/stdlib/README.markdown              | 741 +++++++++++++++++++++
 puppet/modules/stdlib/README_DEVELOPER.markdown    |  35 +
 puppet/modules/stdlib/README_SPECS.markdown        |   7 +
 puppet/modules/stdlib/RELEASE_PROCESS.markdown     |  24 +
 puppet/modules/stdlib/Rakefile                     |  18 +
 puppet/modules/stdlib/lib/facter/facter_dot_d.rb   | 202 ++++++
 .../stdlib/lib/facter/netmask_cidr_interface.rb    |  22 +
 puppet/modules/stdlib/lib/facter/pe_version.rb     |  53 ++
 puppet/modules/stdlib/lib/facter/puppet_vardir.rb  |  26 +
 puppet/modules/stdlib/lib/facter/root_home.rb      |  32 +
 .../stdlib/lib/facter/util/puppet_settings.rb      |  21 +
 .../modules/stdlib/lib/puppet/functions/type_of.rb |  17 +
 .../stdlib/lib/puppet/parser/functions/abs.rb      |  36 +
 .../lib/puppet/parser/functions/any2array.rb       |  33 +
 .../stdlib/lib/puppet/parser/functions/base64.rb   |  37 +
 .../stdlib/lib/puppet/parser/functions/basename.rb |  34 +
 .../stdlib/lib/puppet/parser/functions/bool2num.rb |  26 +
 .../stdlib/lib/puppet/parser/functions/bool2str.rb |  27 +
 .../lib/puppet/parser/functions/camelcase.rb       |  33 +
 .../lib/puppet/parser/functions/capitalize.rb      |  33 +
 .../stdlib/lib/puppet/parser/functions/chomp.rb    |  34 +
 .../stdlib/lib/puppet/parser/functions/chop.rb     |  36 +
 .../stdlib/lib/puppet/parser/functions/concat.rb   |  41 ++
 .../stdlib/lib/puppet/parser/functions/count.rb    |  22 +
 .../lib/puppet/parser/functions/deep_merge.rb      |  44 ++
 .../puppet/parser/functions/defined_with_params.rb |  35 +
 .../stdlib/lib/puppet/parser/functions/delete.rb   |  49 ++
 .../lib/puppet/parser/functions/delete_at.rb       |  49 ++
 .../puppet/parser/functions/delete_undef_values.rb |  34 +
 .../lib/puppet/parser/functions/delete_values.rb   |  26 +
 .../lib/puppet/parser/functions/difference.rb      |  36 +
 .../stdlib/lib/puppet/parser/functions/dirname.rb  |  15 +
 .../stdlib/lib/puppet/parser/functions/downcase.rb |  32 +
 .../stdlib/lib/puppet/parser/functions/empty.rb    |  27 +
 .../lib/puppet/parser/functions/ensure_packages.rb |  35 +
 .../lib/puppet/parser/functions/ensure_resource.rb |  46 ++
 .../stdlib/lib/puppet/parser/functions/flatten.rb  |  33 +
 .../stdlib/lib/puppet/parser/functions/floor.rb    |  25 +
 .../lib/puppet/parser/functions/fqdn_rotate.rb     |  45 ++
 .../lib/puppet/parser/functions/get_module_path.rb |  17 +
 .../stdlib/lib/puppet/parser/functions/getparam.rb |  35 +
 .../stdlib/lib/puppet/parser/functions/getvar.rb   |  29 +
 .../stdlib/lib/puppet/parser/functions/grep.rb     |  33 +
 .../puppet/parser/functions/has_interface_with.rb  |  68 ++
 .../lib/puppet/parser/functions/has_ip_address.rb  |  25 +
 .../lib/puppet/parser/functions/has_ip_network.rb  |  25 +
 .../stdlib/lib/puppet/parser/functions/has_key.rb  |  28 +
 .../stdlib/lib/puppet/parser/functions/hash.rb     |  41 ++
 .../lib/puppet/parser/functions/intersection.rb    |  34 +
 .../stdlib/lib/puppet/parser/functions/is_array.rb |  22 +
 .../stdlib/lib/puppet/parser/functions/is_bool.rb  |  22 +
 .../lib/puppet/parser/functions/is_domain_name.rb  |  50 ++
 .../stdlib/lib/puppet/parser/functions/is_float.rb |  30 +
 .../parser/functions/is_function_available.rb      |  26 +
 .../stdlib/lib/puppet/parser/functions/is_hash.rb  |  22 +
 .../lib/puppet/parser/functions/is_integer.rb      |  45 ++
 .../lib/puppet/parser/functions/is_ip_address.rb   |  32 +
 .../lib/puppet/parser/functions/is_mac_address.rb  |  27 +
 .../lib/puppet/parser/functions/is_numeric.rb      |  75 +++
 .../lib/puppet/parser/functions/is_string.rb       |  26 +
 .../stdlib/lib/puppet/parser/functions/join.rb     |  41 ++
 .../puppet/parser/functions/join_keys_to_values.rb |  47 ++
 .../stdlib/lib/puppet/parser/functions/keys.rb     |  26 +
 .../stdlib/lib/puppet/parser/functions/loadyaml.rb |  20 +
 .../stdlib/lib/puppet/parser/functions/lstrip.rb   |  32 +
 .../stdlib/lib/puppet/parser/functions/max.rb      |  21 +
 .../stdlib/lib/puppet/parser/functions/member.rb   |  62 ++
 .../stdlib/lib/puppet/parser/functions/merge.rb    |  34 +
 .../stdlib/lib/puppet/parser/functions/min.rb      |  21 +
 .../stdlib/lib/puppet/parser/functions/num2bool.rb |  43 ++
 .../lib/puppet/parser/functions/obfuscate_email.rb |  16 +
 .../lib/puppet/parser/functions/parsejson.rb       |  24 +
 .../lib/puppet/parser/functions/parseyaml.rb       |  24 +
 .../stdlib/lib/puppet/parser/functions/pick.rb     |  29 +
 .../lib/puppet/parser/functions/pick_default.rb    |  35 +
 .../stdlib/lib/puppet/parser/functions/prefix.rb   |  45 ++
 .../stdlib/lib/puppet/parser/functions/private.rb  |  29 +
 .../stdlib/lib/puppet/parser/functions/range.rb    |  88 +++
 .../stdlib/lib/puppet/parser/functions/reject.rb   |  31 +
 .../stdlib/lib/puppet/parser/functions/reverse.rb  |  27 +
 .../stdlib/lib/puppet/parser/functions/rstrip.rb   |  31 +
 .../stdlib/lib/puppet/parser/functions/shuffle.rb  |  45 ++
 .../stdlib/lib/puppet/parser/functions/size.rb     |  48 ++
 .../stdlib/lib/puppet/parser/functions/sort.rb     |  27 +
 .../stdlib/lib/puppet/parser/functions/squeeze.rb  |  36 +
 .../stdlib/lib/puppet/parser/functions/str2bool.rb |  46 ++
 .../lib/puppet/parser/functions/str2saltedsha1.rb  |  32 +
 .../puppet/parser/functions/str2saltedsha512.rb    |  32 +
 .../puppet/parser/functions/str2sha1_and_salt.rb   |  36 +
 .../puppet/parser/functions/str_and_salt2sha1.rb   |  32 +
 .../stdlib/lib/puppet/parser/functions/strftime.rb | 107 +++
 .../stdlib/lib/puppet/parser/functions/strip.rb    |  38 ++
 .../stdlib/lib/puppet/parser/functions/suffix.rb   |  45 ++
 .../stdlib/lib/puppet/parser/functions/swapcase.rb |  38 ++
 .../stdlib/lib/puppet/parser/functions/time.rb     |  49 ++
 .../stdlib/lib/puppet/parser/functions/to_bytes.rb |  31 +
 .../stdlib/lib/puppet/parser/functions/type.rb     |  19 +
 .../stdlib/lib/puppet/parser/functions/type3x.rb   |  51 ++
 .../stdlib/lib/puppet/parser/functions/union.rb    |  34 +
 .../stdlib/lib/puppet/parser/functions/unique.rb   |  50 ++
 .../stdlib/lib/puppet/parser/functions/upcase.rb   |  40 ++
 .../lib/puppet/parser/functions/uriescape.rb       |  34 +
 .../parser/functions/validate_absolute_path.rb     |  69 ++
 .../lib/puppet/parser/functions/validate_array.rb  |  33 +
 .../lib/puppet/parser/functions/validate_augeas.rb |  83 +++
 .../lib/puppet/parser/functions/validate_bool.rb   |  34 +
 .../lib/puppet/parser/functions/validate_cmd.rb    |  63 ++
 .../lib/puppet/parser/functions/validate_hash.rb   |  33 +
 .../parser/functions/validate_ipv4_address.rb      |  48 ++
 .../parser/functions/validate_ipv6_address.rb      |  49 ++
 .../lib/puppet/parser/functions/validate_re.rb     |  40 ++
 .../puppet/parser/functions/validate_slength.rb    |  71 ++
 .../lib/puppet/parser/functions/validate_string.rb |  38 ++
 .../stdlib/lib/puppet/parser/functions/values.rb   |  39 ++
 .../lib/puppet/parser/functions/values_at.rb       |  99 +++
 .../stdlib/lib/puppet/parser/functions/zip.rb      |  39 ++
 .../stdlib/lib/puppet/provider/file_line/ruby.rb   |  85 +++
 puppet/modules/stdlib/lib/puppet/type/anchor.rb    |  46 ++
 puppet/modules/stdlib/lib/puppet/type/file_line.rb |  75 +++
 puppet/modules/stdlib/manifests/init.pp            |  20 +
 puppet/modules/stdlib/manifests/stages.pp          |  43 ++
 puppet/modules/stdlib/metadata.json                | 113 ++++
 puppet/modules/stdlib/spec/acceptance/abs_spec.rb  |  30 +
 .../stdlib/spec/acceptance/any2array_spec.rb       |  49 ++
 .../modules/stdlib/spec/acceptance/base64_spec.rb  |  18 +
 .../stdlib/spec/acceptance/bool2num_spec.rb        |  34 +
 puppet/modules/stdlib/spec/acceptance/build_csv.rb |  83 +++
 .../stdlib/spec/acceptance/capitalize_spec.rb      |  33 +
 .../modules/stdlib/spec/acceptance/chomp_spec.rb   |  21 +
 puppet/modules/stdlib/spec/acceptance/chop_spec.rb |  45 ++
 .../modules/stdlib/spec/acceptance/concat_spec.rb  |  40 ++
 .../modules/stdlib/spec/acceptance/count_spec.rb   |  30 +
 .../stdlib/spec/acceptance/deep_merge_spec.rb      |  20 +
 .../spec/acceptance/defined_with_params_spec.rb    |  22 +
 .../stdlib/spec/acceptance/delete_at_spec.rb       |  19 +
 .../modules/stdlib/spec/acceptance/delete_spec.rb  |  19 +
 .../spec/acceptance/delete_undef_values_spec.rb    |  19 +
 .../stdlib/spec/acceptance/delete_values_spec.rb   |  25 +
 .../stdlib/spec/acceptance/difference_spec.rb      |  26 +
 .../modules/stdlib/spec/acceptance/dirname_spec.rb |  42 ++
 .../stdlib/spec/acceptance/downcase_spec.rb        |  39 ++
 .../modules/stdlib/spec/acceptance/empty_spec.rb   |  39 ++
 .../stdlib/spec/acceptance/ensure_packages_spec.rb |  22 +
 .../stdlib/spec/acceptance/ensure_resource_spec.rb |  22 +
 .../modules/stdlib/spec/acceptance/flatten_spec.rb |  39 ++
 .../modules/stdlib/spec/acceptance/floor_spec.rb   |  39 ++
 .../stdlib/spec/acceptance/fqdn_rotate_spec.rb     |  47 ++
 .../stdlib/spec/acceptance/get_module_path_spec.rb |  27 +
 .../stdlib/spec/acceptance/getparam_spec.rb        |  24 +
 .../modules/stdlib/spec/acceptance/getvar_spec.rb  |  26 +
 puppet/modules/stdlib/spec/acceptance/grep_spec.rb |  26 +
 .../spec/acceptance/has_interface_with_spec.rb     |  54 ++
 .../stdlib/spec/acceptance/has_ip_address_spec.rb  |  33 +
 .../stdlib/spec/acceptance/has_ip_network_spec.rb  |  33 +
 .../modules/stdlib/spec/acceptance/has_key_spec.rb |  41 ++
 puppet/modules/stdlib/spec/acceptance/hash_spec.rb |  26 +
 .../stdlib/spec/acceptance/intersection_spec.rb    |  27 +
 .../stdlib/spec/acceptance/is_array_spec.rb        |  67 ++
 .../modules/stdlib/spec/acceptance/is_bool_spec.rb |  81 +++
 .../stdlib/spec/acceptance/is_domain_name_spec.rb  |  83 +++
 .../stdlib/spec/acceptance/is_float_spec.rb        |  86 +++
 .../spec/acceptance/is_function_available_spec.rb  |  58 ++
 .../modules/stdlib/spec/acceptance/is_hash_spec.rb |  63 ++
 .../stdlib/spec/acceptance/is_integer_spec.rb      |  95 +++
 .../stdlib/spec/acceptance/is_ip_address_spec.rb   |  80 +++
 .../stdlib/spec/acceptance/is_mac_address_spec.rb  |  38 ++
 .../stdlib/spec/acceptance/is_numeric_spec.rb      |  95 +++
 .../stdlib/spec/acceptance/is_string_spec.rb       | 102 +++
 .../spec/acceptance/join_keys_to_values_spec.rb    |  24 +
 puppet/modules/stdlib/spec/acceptance/join_spec.rb |  26 +
 puppet/modules/stdlib/spec/acceptance/keys_spec.rb |  23 +
 .../stdlib/spec/acceptance/loadyaml_spec.rb        |  33 +
 .../modules/stdlib/spec/acceptance/lstrip_spec.rb  |  34 +
 puppet/modules/stdlib/spec/acceptance/max_spec.rb  |  20 +
 .../modules/stdlib/spec/acceptance/member_spec.rb  |  54 ++
 .../modules/stdlib/spec/acceptance/merge_spec.rb   |  23 +
 puppet/modules/stdlib/spec/acceptance/min_spec.rb  |  20 +
 .../spec/acceptance/nodesets/centos-59-x64.yml     |  10 +
 .../spec/acceptance/nodesets/centos-6-vcloud.yml   |  15 +
 .../spec/acceptance/nodesets/centos-64-x64-pe.yml  |  12 +
 .../spec/acceptance/nodesets/centos-64-x64.yml     |  10 +
 .../spec/acceptance/nodesets/centos-65-x64.yml     |  10 +
 .../stdlib/spec/acceptance/nodesets/default.yml    |  10 +
 .../spec/acceptance/nodesets/fedora-18-x64.yml     |  10 +
 .../spec/acceptance/nodesets/sles-11-x64.yml       |  10 +
 .../nodesets/ubuntu-server-10044-x64.yml           |  10 +
 .../nodesets/ubuntu-server-12042-x64.yml           |  10 +
 .../acceptance/nodesets/ubuntu-server-1404-x64.yml |  11 +
 .../spec/acceptance/nodesets/windows-2003-i386.yml |  26 +
 .../acceptance/nodesets/windows-2003-x86_64.yml    |  26 +
 .../acceptance/nodesets/windows-2008-x86_64.yml    |  26 +
 .../acceptance/nodesets/windows-2008r2-x86_64.yml  |  26 +
 .../acceptance/nodesets/windows-2012-x86_64.yml    |  26 +
 .../acceptance/nodesets/windows-2012r2-x86_64.yml  |  26 +
 .../stdlib/spec/acceptance/num2bool_spec.rb        |  76 +++
 .../stdlib/spec/acceptance/parsejson_spec.rb       |  34 +
 .../stdlib/spec/acceptance/parseyaml_spec.rb       |  35 +
 .../stdlib/spec/acceptance/pick_default_spec.rb    |  54 ++
 puppet/modules/stdlib/spec/acceptance/pick_spec.rb |  44 ++
 .../modules/stdlib/spec/acceptance/prefix_spec.rb  |  42 ++
 .../modules/stdlib/spec/acceptance/range_spec.rb   |  36 +
 .../modules/stdlib/spec/acceptance/reject_spec.rb  |  42 ++
 .../modules/stdlib/spec/acceptance/reverse_spec.rb |  23 +
 .../modules/stdlib/spec/acceptance/rstrip_spec.rb  |  34 +
 .../modules/stdlib/spec/acceptance/shuffle_spec.rb |  34 +
 puppet/modules/stdlib/spec/acceptance/size_spec.rb |  55 ++
 puppet/modules/stdlib/spec/acceptance/sort_spec.rb |  34 +
 .../modules/stdlib/spec/acceptance/squeeze_spec.rb |  47 ++
 .../stdlib/spec/acceptance/str2bool_spec.rb        |  31 +
 .../spec/acceptance/str2saltedsha512_spec.rb       |  22 +
 .../stdlib/spec/acceptance/strftime_spec.rb        |  22 +
 .../modules/stdlib/spec/acceptance/strip_spec.rb   |  34 +
 .../modules/stdlib/spec/acceptance/suffix_spec.rb  |  42 ++
 .../stdlib/spec/acceptance/swapcase_spec.rb        |  22 +
 puppet/modules/stdlib/spec/acceptance/time_spec.rb |  36 +
 .../stdlib/spec/acceptance/to_bytes_spec.rb        |  27 +
 puppet/modules/stdlib/spec/acceptance/type_spec.rb |  37 +
 .../modules/stdlib/spec/acceptance/union_spec.rb   |  24 +
 .../modules/stdlib/spec/acceptance/unique_spec.rb  |  33 +
 .../stdlib/spec/acceptance/unsupported_spec.rb     |  11 +
 .../modules/stdlib/spec/acceptance/upcase_spec.rb  |  33 +
 .../stdlib/spec/acceptance/uriescape_spec.rb       |  23 +
 .../spec/acceptance/validate_absolute_path_spec.rb |  31 +
 .../stdlib/spec/acceptance/validate_array_spec.rb  |  37 +
 .../stdlib/spec/acceptance/validate_augeas_spec.rb |  63 ++
 .../stdlib/spec/acceptance/validate_bool_spec.rb   |  37 +
 .../stdlib/spec/acceptance/validate_cmd_spec.rb    |  52 ++
 .../stdlib/spec/acceptance/validate_hash_spec.rb   |  37 +
 .../spec/acceptance/validate_ipv4_address_spec.rb  |  31 +
 .../spec/acceptance/validate_ipv6_address_spec.rb  |  31 +
 .../stdlib/spec/acceptance/validate_re_spec.rb     |  47 ++
 .../spec/acceptance/validate_slength_spec.rb       |  72 ++
 .../stdlib/spec/acceptance/validate_string_spec.rb |  36 +
 .../stdlib/spec/acceptance/values_at_spec.rb       |  73 ++
 .../modules/stdlib/spec/acceptance/values_spec.rb  |  35 +
 puppet/modules/stdlib/spec/acceptance/zip_spec.rb  |  86 +++
 puppet/modules/stdlib/spec/classes/anchor_spec.rb  |  30 +
 .../modules/stdlib/spec/fixtures/dscacheutil/root  |   8 +
 puppet/modules/stdlib/spec/functions/abs_spec.rb   |  25 +
 .../stdlib/spec/functions/any2array_spec.rb        |  55 ++
 .../modules/stdlib/spec/functions/base64_spec.rb   |  34 +
 .../modules/stdlib/spec/functions/bool2num_spec.rb |  38 ++
 .../stdlib/spec/functions/capitalize_spec.rb       |  28 +
 puppet/modules/stdlib/spec/functions/chomp_spec.rb |  28 +
 puppet/modules/stdlib/spec/functions/chop_spec.rb  |  28 +
 .../modules/stdlib/spec/functions/concat_spec.rb   |  50 ++
 puppet/modules/stdlib/spec/functions/count_spec.rb |  31 +
 .../stdlib/spec/functions/deep_merge_spec.rb       | 105 +++
 .../spec/functions/defined_with_params_spec.rb     |  37 +
 .../stdlib/spec/functions/delete_at_spec.rb        |  25 +
 .../modules/stdlib/spec/functions/delete_spec.rb   |  61 ++
 .../spec/functions/delete_undef_values_spec.rb     |  41 ++
 .../stdlib/spec/functions/delete_values_spec.rb    |  36 +
 .../stdlib/spec/functions/difference_spec.rb       |  19 +
 .../modules/stdlib/spec/functions/dirname_spec.rb  |  24 +
 .../modules/stdlib/spec/functions/downcase_spec.rb |  33 +
 puppet/modules/stdlib/spec/functions/empty_spec.rb |  32 +
 .../stdlib/spec/functions/ensure_packages_spec.rb  |  81 +++
 .../stdlib/spec/functions/ensure_resource_spec.rb  | 113 ++++
 .../modules/stdlib/spec/functions/flatten_spec.rb  |  27 +
 puppet/modules/stdlib/spec/functions/floor_spec.rb |  39 ++
 .../stdlib/spec/functions/fqdn_rotate_spec.rb      |  43 ++
 .../stdlib/spec/functions/get_module_path_spec.rb  |  46 ++
 .../modules/stdlib/spec/functions/getparam_spec.rb |  76 +++
 .../modules/stdlib/spec/functions/getvar_spec.rb   |  37 +
 puppet/modules/stdlib/spec/functions/grep_spec.rb  |  19 +
 .../spec/functions/has_interface_with_spec.rb      |  64 ++
 .../stdlib/spec/functions/has_ip_address_spec.rb   |  39 ++
 .../stdlib/spec/functions/has_ip_network_spec.rb   |  36 +
 .../modules/stdlib/spec/functions/has_key_spec.rb  |  42 ++
 puppet/modules/stdlib/spec/functions/hash_spec.rb  |  19 +
 .../stdlib/spec/functions/intersection_spec.rb     |  19 +
 .../modules/stdlib/spec/functions/is_array_spec.rb |  29 +
 .../modules/stdlib/spec/functions/is_bool_spec.rb  |  44 ++
 .../stdlib/spec/functions/is_domain_name_spec.rb   |  64 ++
 .../modules/stdlib/spec/functions/is_float_spec.rb |  33 +
 .../stdlib/spec/functions/is_function_available.rb |  31 +
 .../modules/stdlib/spec/functions/is_hash_spec.rb  |  29 +
 .../stdlib/spec/functions/is_integer_spec.rb       |  69 ++
 .../stdlib/spec/functions/is_ip_address_spec.rb    |  39 ++
 .../stdlib/spec/functions/is_mac_address_spec.rb   |  29 +
 .../stdlib/spec/functions/is_numeric_spec.rb       | 119 ++++
 .../stdlib/spec/functions/is_string_spec.rb        |  34 +
 .../spec/functions/join_keys_to_values_spec.rb     |  40 ++
 puppet/modules/stdlib/spec/functions/join_spec.rb  |  19 +
 puppet/modules/stdlib/spec/functions/keys_spec.rb  |  21 +
 .../modules/stdlib/spec/functions/loadyaml_spec.rb |  25 +
 .../modules/stdlib/spec/functions/lstrip_spec.rb   |  28 +
 puppet/modules/stdlib/spec/functions/max_spec.rb   |  27 +
 .../modules/stdlib/spec/functions/member_spec.rb   |  34 +
 puppet/modules/stdlib/spec/functions/merge_spec.rb |  52 ++
 puppet/modules/stdlib/spec/functions/min_spec.rb   |  27 +
 .../modules/stdlib/spec/functions/num2bool_spec.rb |  67 ++
 .../stdlib/spec/functions/parsejson_spec.rb        |  22 +
 .../stdlib/spec/functions/parseyaml_spec.rb        |  24 +
 .../stdlib/spec/functions/pick_default_spec.rb     |  58 ++
 puppet/modules/stdlib/spec/functions/pick_spec.rb  |  34 +
 .../modules/stdlib/spec/functions/prefix_spec.rb   |  28 +
 .../modules/stdlib/spec/functions/private_spec.rb  |  55 ++
 puppet/modules/stdlib/spec/functions/range_spec.rb |  86 +++
 .../modules/stdlib/spec/functions/reject_spec.rb   |  20 +
 .../modules/stdlib/spec/functions/reverse_spec.rb  |  28 +
 .../modules/stdlib/spec/functions/rstrip_spec.rb   |  33 +
 .../modules/stdlib/spec/functions/shuffle_spec.rb  |  33 +
 puppet/modules/stdlib/spec/functions/size_spec.rb  |  24 +
 puppet/modules/stdlib/spec/functions/sort_spec.rb  |  24 +
 .../modules/stdlib/spec/functions/squeeze_spec.rb  |  24 +
 .../modules/stdlib/spec/functions/str2bool_spec.rb |  31 +
 .../stdlib/spec/functions/str2saltedsha512_spec.rb |  45 ++
 .../modules/stdlib/spec/functions/strftime_spec.rb |  29 +
 puppet/modules/stdlib/spec/functions/strip_spec.rb |  27 +
 .../modules/stdlib/spec/functions/suffix_spec.rb   |  27 +
 .../modules/stdlib/spec/functions/swapcase_spec.rb |  28 +
 puppet/modules/stdlib/spec/functions/time_spec.rb  |  29 +
 .../modules/stdlib/spec/functions/to_bytes_spec.rb |  83 +++
 .../modules/stdlib/spec/functions/type3x_spec.rb   |  43 ++
 puppet/modules/stdlib/spec/functions/type_spec.rb  |  44 ++
 puppet/modules/stdlib/spec/functions/union_spec.rb |  19 +
 .../modules/stdlib/spec/functions/unique_spec.rb   |  33 +
 .../modules/stdlib/spec/functions/upcase_spec.rb   |  33 +
 .../stdlib/spec/functions/uriescape_spec.rb        |  33 +
 .../spec/functions/validate_absolute_path_spec.rb  | 104 +++
 .../stdlib/spec/functions/validate_array_spec.rb   |  38 ++
 .../stdlib/spec/functions/validate_augeas_spec.rb  | 103 +++
 .../stdlib/spec/functions/validate_bool_spec.rb    |  51 ++
 .../stdlib/spec/functions/validate_cmd_spec.rb     |  85 +++
 .../stdlib/spec/functions/validate_hash_spec.rb    |  43 ++
 .../spec/functions/validate_ipv4_address_spec.rb   |  64 ++
 .../spec/functions/validate_ipv6_address_spec.rb   |  67 ++
 .../stdlib/spec/functions/validate_re_spec.rb      |  77 +++
 .../stdlib/spec/functions/validate_slength_spec.rb |  67 ++
 .../stdlib/spec/functions/validate_string_spec.rb  |  60 ++
 .../stdlib/spec/functions/values_at_spec.rb        |  38 ++
 .../modules/stdlib/spec/functions/values_spec.rb   |  31 +
 puppet/modules/stdlib/spec/functions/zip_spec.rb   |  31 +
 .../stdlib/spec/lib/puppet_spec/compiler.rb        |  47 ++
 .../stdlib/spec/lib/puppet_spec/database.rb        |  30 +
 .../modules/stdlib/spec/lib/puppet_spec/files.rb   |  61 ++
 .../stdlib/spec/lib/puppet_spec/fixtures.rb        |  29 +
 .../stdlib/spec/lib/puppet_spec/matchers.rb        | 121 ++++
 .../modules/stdlib/spec/lib/puppet_spec/modules.rb |  27 +
 puppet/modules/stdlib/spec/lib/puppet_spec/pops.rb |  17 +
 .../modules/stdlib/spec/lib/puppet_spec/scope.rb   |  15 +
 .../stdlib/spec/lib/puppet_spec/settings.rb        |  16 +
 .../modules/stdlib/spec/lib/puppet_spec/verbose.rb |  10 +
 .../spec/monkey_patches/alias_should_to_must.rb    |   9 +
 .../spec/monkey_patches/publicize_methods.rb       |  11 +
 puppet/modules/stdlib/spec/spec.opts               |   6 +
 puppet/modules/stdlib/spec/spec_helper.rb          |  34 +
 .../modules/stdlib/spec/spec_helper_acceptance.rb  |  50 ++
 .../stdlib/spec/unit/facter/facter_dot_d_spec.rb   |  32 +
 .../stdlib/spec/unit/facter/pe_version_spec.rb     |  76 +++
 .../stdlib/spec/unit/facter/root_home_spec.rb      |  52 ++
 .../spec/unit/facter/util/puppet_settings_spec.rb  |  36 +
 .../spec/unit/puppet/functions/type_of_spec.rb     |  33 +
 .../unit/puppet/parser/functions/basename_spec.rb  |  46 ++
 .../unit/puppet/parser/functions/bool2str_spec.rb  |  46 ++
 .../unit/puppet/parser/functions/camelcase_spec.rb |  24 +
 .../puppet/parser/functions/str2saltedsha1_spec.rb |  45 ++
 .../unit/puppet/provider/file_line/ruby_spec.rb    | 225 +++++++
 .../stdlib/spec/unit/puppet/type/anchor_spec.rb    |  11 +
 .../stdlib/spec/unit/puppet/type/file_line_spec.rb |  70 ++
 puppet/modules/stdlib/tests/file_line.pp           |   9 +
 puppet/modules/stdlib/tests/has_interface_with.pp  |  10 +
 puppet/modules/stdlib/tests/has_ip_address.pp      |   3 +
 puppet/modules/stdlib/tests/has_ip_network.pp      |   4 +
 puppet/modules/stdlib/tests/init.pp                |   1 +
 379 files changed, 16003 insertions(+)
 create mode 100644 puppet/modules/stdlib/.fixtures.yml
 create mode 100644 puppet/modules/stdlib/.gemspec
 create mode 100644 puppet/modules/stdlib/.gitignore
 create mode 100644 puppet/modules/stdlib/.gitrepo
 create mode 100644 puppet/modules/stdlib/.project
 create mode 100644 puppet/modules/stdlib/.rspec
 create mode 100644 puppet/modules/stdlib/.sync.yml
 create mode 100644 puppet/modules/stdlib/.travis.yml
 create mode 100644 puppet/modules/stdlib/CHANGELOG.md
 create mode 100644 puppet/modules/stdlib/CONTRIBUTING.md
 create mode 100644 puppet/modules/stdlib/Gemfile
 create mode 100644 puppet/modules/stdlib/LICENSE
 create mode 100644 puppet/modules/stdlib/README.markdown
 create mode 100644 puppet/modules/stdlib/README_DEVELOPER.markdown
 create mode 100644 puppet/modules/stdlib/README_SPECS.markdown
 create mode 100644 puppet/modules/stdlib/RELEASE_PROCESS.markdown
 create mode 100644 puppet/modules/stdlib/Rakefile
 create mode 100644 puppet/modules/stdlib/lib/facter/facter_dot_d.rb
 create mode 100644 puppet/modules/stdlib/lib/facter/netmask_cidr_interface.rb
 create mode 100644 puppet/modules/stdlib/lib/facter/pe_version.rb
 create mode 100644 puppet/modules/stdlib/lib/facter/puppet_vardir.rb
 create mode 100644 puppet/modules/stdlib/lib/facter/root_home.rb
 create mode 100644 puppet/modules/stdlib/lib/facter/util/puppet_settings.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/functions/type_of.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/abs.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/any2array.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/base64.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/basename.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/bool2num.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/bool2str.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/camelcase.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/capitalize.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/chomp.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/chop.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/concat.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/count.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/delete.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/delete_at.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/delete_values.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/difference.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/dirname.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/downcase.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/empty.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/flatten.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/floor.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/getparam.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/getvar.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/grep.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/has_key.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/hash.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/intersection.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_array.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_bool.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_float.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_hash.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_integer.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/is_string.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/join.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/keys.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/lstrip.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/max.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/member.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/merge.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/min.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/num2bool.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/obfuscate_email.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/parsejson.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/pick.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/pick_default.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/prefix.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/private.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/range.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/reject.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/reverse.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/rstrip.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/shuffle.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/size.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/sort.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/squeeze.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/str2bool.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/str2saltedsha1.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/str2sha1_and_salt.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/str_and_salt2sha1.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/strftime.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/strip.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/suffix.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/swapcase.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/time.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/type.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/type3x.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/union.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/unique.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/upcase.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/uriescape.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_array.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_re.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/validate_string.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/values.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/values_at.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/parser/functions/zip.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/provider/file_line/ruby.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/type/anchor.rb
 create mode 100644 puppet/modules/stdlib/lib/puppet/type/file_line.rb
 create mode 100644 puppet/modules/stdlib/manifests/init.pp
 create mode 100644 puppet/modules/stdlib/manifests/stages.pp
 create mode 100644 puppet/modules/stdlib/metadata.json
 create mode 100755 puppet/modules/stdlib/spec/acceptance/abs_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/any2array_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/base64_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/bool2num_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/build_csv.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/capitalize_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/chomp_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/chop_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/concat_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/count_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/deep_merge_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/defined_with_params_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/delete_at_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/delete_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/delete_values_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/difference_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/dirname_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/downcase_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/empty_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/ensure_packages_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/ensure_resource_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/flatten_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/floor_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/get_module_path_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/getparam_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/getvar_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/grep_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/has_interface_with_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/has_ip_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/has_ip_network_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/has_key_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/hash_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/intersection_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_array_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_bool_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_domain_name_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_float_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_function_available_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_hash_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_integer_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_ip_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_mac_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_numeric_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/is_string_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/join_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/keys_spec.rb
 create mode 100644 puppet/modules/stdlib/spec/acceptance/loadyaml_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/lstrip_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/max_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/member_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/merge_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/min_spec.rb
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/centos-59-x64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/centos-6-vcloud.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/centos-64-x64-pe.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/centos-64-x64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/centos-65-x64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/default.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/fedora-18-x64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/sles-11-x64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/windows-2003-i386.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/windows-2003-x86_64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/windows-2008-x86_64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/windows-2008r2-x86_64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/windows-2012-x86_64.yml
 create mode 100644 puppet/modules/stdlib/spec/acceptance/nodesets/windows-2012r2-x86_64.yml
 create mode 100755 puppet/modules/stdlib/spec/acceptance/num2bool_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/parsejson_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/parseyaml_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/pick_default_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/pick_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/prefix_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/range_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/reject_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/reverse_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/rstrip_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/shuffle_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/size_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/sort_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/squeeze_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/str2bool_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/strftime_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/strip_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/suffix_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/swapcase_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/time_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/to_bytes_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/type_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/union_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/unique_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/unsupported_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/upcase_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/uriescape_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_array_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_augeas_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_bool_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_cmd_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_hash_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_re_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_slength_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/validate_string_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/values_at_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/values_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/acceptance/zip_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/classes/anchor_spec.rb
 create mode 100644 puppet/modules/stdlib/spec/fixtures/dscacheutil/root
 create mode 100755 puppet/modules/stdlib/spec/functions/abs_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/any2array_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/base64_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/bool2num_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/capitalize_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/chomp_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/chop_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/concat_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/count_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/deep_merge_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/defined_with_params_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/delete_at_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/delete_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/delete_undef_values_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/delete_values_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/difference_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/dirname_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/downcase_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/empty_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/ensure_packages_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/ensure_resource_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/flatten_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/floor_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/fqdn_rotate_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/get_module_path_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/getparam_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/getvar_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/grep_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/has_interface_with_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/has_ip_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/has_ip_network_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/has_key_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/hash_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/intersection_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_array_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_bool_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_domain_name_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_float_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_function_available.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_hash_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_integer_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_ip_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_mac_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_numeric_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/is_string_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/join_keys_to_values_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/join_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/keys_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/loadyaml_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/lstrip_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/max_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/member_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/merge_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/min_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/num2bool_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/parsejson_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/parseyaml_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/pick_default_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/pick_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/prefix_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/private_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/range_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/reject_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/reverse_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/rstrip_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/shuffle_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/size_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/sort_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/squeeze_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/str2bool_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/str2saltedsha512_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/strftime_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/strip_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/suffix_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/swapcase_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/time_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/to_bytes_spec.rb
 create mode 100644 puppet/modules/stdlib/spec/functions/type3x_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/type_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/union_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/unique_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/upcase_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/uriescape_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_absolute_path_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_array_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_augeas_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_bool_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_cmd_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_hash_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_re_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_slength_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/validate_string_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/values_at_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/values_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/functions/zip_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/compiler.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/database.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/files.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/fixtures.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/matchers.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/modules.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/pops.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/scope.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/settings.rb
 create mode 100755 puppet/modules/stdlib/spec/lib/puppet_spec/verbose.rb
 create mode 100755 puppet/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb
 create mode 100755 puppet/modules/stdlib/spec/monkey_patches/publicize_methods.rb
 create mode 100644 puppet/modules/stdlib/spec/spec.opts
 create mode 100755 puppet/modules/stdlib/spec/spec_helper.rb
 create mode 100755 puppet/modules/stdlib/spec/spec_helper_acceptance.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/facter/pe_version_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/facter/root_home_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb
 create mode 100644 puppet/modules/stdlib/spec/unit/puppet/functions/type_of_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/puppet/parser/functions/basename_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/puppet/parser/functions/bool2str_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/puppet/parser/functions/camelcase_spec.rb
 create mode 100644 puppet/modules/stdlib/spec/unit/puppet/parser/functions/str2saltedsha1_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb
 create mode 100755 puppet/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb
 create mode 100644 puppet/modules/stdlib/tests/file_line.pp
 create mode 100644 puppet/modules/stdlib/tests/has_interface_with.pp
 create mode 100644 puppet/modules/stdlib/tests/has_ip_address.pp
 create mode 100644 puppet/modules/stdlib/tests/has_ip_network.pp
 create mode 100644 puppet/modules/stdlib/tests/init.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/stdlib/.fixtures.yml b/puppet/modules/stdlib/.fixtures.yml
new file mode 100644
index 00000000..37b73775
--- /dev/null
+++ b/puppet/modules/stdlib/.fixtures.yml
@@ -0,0 +1,3 @@
+fixtures:
+  symlinks:
+    stdlib: "#{source_dir}"
diff --git a/puppet/modules/stdlib/.gemspec b/puppet/modules/stdlib/.gemspec
new file mode 100644
index 00000000..e2749509
--- /dev/null
+++ b/puppet/modules/stdlib/.gemspec
@@ -0,0 +1,40 @@
+#
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = "puppetmodule-stdlib"
+
+  s.version = "4.0.2"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Puppet Labs"]
+  s.date = "2013-04-12"
+  s.description = [ 'This Gem format of the stdlib module is intended to make',
+                    'it easier for _module authors_ to resolve dependencies',
+                    'using a Gemfile when running automated testing jobs like',
+                    'Travis or Jenkins.  The recommended best practice for',
+                    'installation by end users is to use the `puppet module',
+                    'install` command to install stdlib from the [Puppet',
+                    'Forge](http://forge.puppetlabs.com/puppetlabs/stdlib).' ].join(' ')
+  s.email = "puppet-dev@puppetlabs.com"
+  s.executables = []
+  s.files = [ 'CHANGELOG', 'CONTRIBUTING.md', 'Gemfile', 'LICENSE', 'Modulefile',
+              'README.markdown', 'README_DEVELOPER.markdown', 'RELEASE_PROCESS.markdown',
+              'Rakefile', 'spec/spec.opts' ]
+  s.files += Dir['lib/**/*.rb'] + Dir['manifests/**/*.pp'] + Dir['tests/**/*.pp'] + Dir['spec/**/*.rb']
+  s.homepage = "http://forge.puppetlabs.com/puppetlabs/stdlib"
+  s.rdoc_options = ["--title", "Puppet Standard Library Development Gem", "--main", "README.markdown", "--line-numbers"]
+  s.require_paths = ["lib"]
+  s.rubyforge_project = "puppetmodule-stdlib"
+  s.rubygems_version = "1.8.24"
+  s.summary = "This gem provides a way to make the standard library available for other module spec testing tasks."
+
+  if s.respond_to? :specification_version then
+    s.specification_version = 3
+
+    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+    else
+    end
+  else
+  end
+end
diff --git a/puppet/modules/stdlib/.gitignore b/puppet/modules/stdlib/.gitignore
new file mode 100644
index 00000000..b5db85e0
--- /dev/null
+++ b/puppet/modules/stdlib/.gitignore
@@ -0,0 +1,9 @@
+pkg/
+Gemfile.lock
+vendor/
+spec/fixtures/
+.vagrant/
+.bundle/
+coverage/
+.idea/
+*.iml
diff --git a/puppet/modules/stdlib/.gitrepo b/puppet/modules/stdlib/.gitrepo
new file mode 100644
index 00000000..300f04b0
--- /dev/null
+++ b/puppet/modules/stdlib/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_stdlib
+	branch = master
+	commit = 71123634744b9fe2ec7d6a3e38e9789fd84801e3
+	parent = 95374aacb857ed35c2fdfe6be7c0bfab86653963
+	cmdver = 0.3.0
diff --git a/puppet/modules/stdlib/.project b/puppet/modules/stdlib/.project
new file mode 100644
index 00000000..4e2c033a
--- /dev/null
+++ b/puppet/modules/stdlib/.project
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<projectDescription>
+	<name>stdlib</name>
+	<comment></comment>
+	<projects>
+	</projects>
+	<buildSpec>
+		<buildCommand>
+			<name>org.cloudsmith.geppetto.pp.dsl.ui.modulefileBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+		<buildCommand>
+			<name>org.eclipse.xtext.ui.shared.xtextBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
+	</buildSpec>
+	<natures>
+		<nature>org.cloudsmith.geppetto.pp.dsl.ui.puppetNature</nature>
+		<nature>org.eclipse.xtext.ui.shared.xtextNature</nature>
+	</natures>
+</projectDescription>
diff --git a/puppet/modules/stdlib/.rspec b/puppet/modules/stdlib/.rspec
new file mode 100644
index 00000000..7ab5f55c
--- /dev/null
+++ b/puppet/modules/stdlib/.rspec
@@ -0,0 +1,4 @@
+--color
+--format
+progress
+--backtrace
diff --git a/puppet/modules/stdlib/.sync.yml b/puppet/modules/stdlib/.sync.yml
new file mode 100644
index 00000000..21e872e0
--- /dev/null
+++ b/puppet/modules/stdlib/.sync.yml
@@ -0,0 +1,9 @@
+---
+.travis.yml:
+  script: "\"bundle exec rake validate && bundle exec rake lint && bundle exec rake spec SPEC_OPTS='--color --format documentation'\""
+Rakefile:
+  unmanaged: true
+Gemfile:
+  unmanaged: true
+spec/spec_helper.rb:
+  unmanaged: true
diff --git a/puppet/modules/stdlib/.travis.yml b/puppet/modules/stdlib/.travis.yml
new file mode 100644
index 00000000..503e1844
--- /dev/null
+++ b/puppet/modules/stdlib/.travis.yml
@@ -0,0 +1,18 @@
+---
+sudo: false
+language: ruby
+bundler_args: --without system_tests
+script: "bundle exec rake validate && bundle exec rake lint && bundle exec rake spec SPEC_OPTS='--color --format documentation'"
+matrix:
+  fast_finish: true
+  include:
+  - rvm: 1.8.7
+    env: PUPPET_GEM_VERSION="~> 2.7.0" FACTER_GEM_VERSION="~> 1.6.0"
+  - rvm: 1.8.7
+    env: PUPPET_GEM_VERSION="~> 2.7.0" FACTER_GEM_VERSION="~> 1.7.0"
+  - rvm: 1.9.3
+    env: PUPPET_GEM_VERSION="~> 3.0"
+  - rvm: 2.0.0
+    env: PUPPET_GEM_VERSION="~> 3.0"
+notifications:
+  email: false
diff --git a/puppet/modules/stdlib/CHANGELOG.md b/puppet/modules/stdlib/CHANGELOG.md
new file mode 100644
index 00000000..13856950
--- /dev/null
+++ b/puppet/modules/stdlib/CHANGELOG.md
@@ -0,0 +1,500 @@
+##2015-01-14 - Supported Release 4.6.0
+###Summary
+
+Improved functionality and preparing for Puppet Next with new parser
+
+####Features
+- MODULES-444: concat can now take more than two arrays
+- basename function added to have Ruby File.basename functionality
+- delete function can now take an array of items to remove
+- MODULES-1473: deprecate type function in favor of type_of
+
+####Bugfixes
+- Several test case fixes
+- Ensure_resource is more verbose on debug mode
+
+##2015-01-14 - Supported Release 4.5.1
+###Summary
+
+This release changes the temporary facter_dot_d cache locations outside of the /tmp directory due to a possible security vunerability. CVE-2015-1029
+
+####Bugfixes
+- Facter_dot_d cache will now be stored in puppet libdir instead of tmp
+
+##2014-12-15 - Supported Release 4.5.0
+###Summary
+
+This release improves functionality of the member function and adds improved future parser support.
+
+####Features
+- MODULES-1329: Update member() to allow the variable to be an array.
+- Sync .travis.yml, Gemfile, Rakefile, and CONTRIBUTING.md via modulesync
+
+####Bugfixes
+- Fix range() to work with numeric ranges with the future parser
+- Accurately express SLES support in metadata.json (was missing 10SP4 and 12)
+- Don't require `line` to match the `match` parameter
+
+##2014-11-10 - Supported Release 4.4.0
+###Summary
+This release has an overhauled readme, new private manifest function, and fixes many future parser bugs.
+
+####Features
+- All new shiny README
+- New `private()` function for making private manifests (yay!)
+
+####Bugfixes
+- Code reuse in `bool2num()` and `zip()`
+- Fix many functions to handle `generate()` no longer returning a string on new puppets
+- `concat()` no longer modifies the first argument (whoops)
+- strict variable support for `getvar()`, `member()`, `values_at`, and `has_interface_with()`
+- `to_bytes()` handles PB and EB now
+- Fix `tempfile` ruby requirement for `validate_augeas()` and `validate_cmd()`
+- Fix `validate_cmd()` for windows
+- Correct `validate_string()` docs to reflect non-handling of `undef`
+- Fix `file_line` matching on older rubies
+
+
+##2014-07-15 - Supported Release 4.3.2
+###Summary
+
+This release merely updates metadata.json so the module can be uninstalled and
+upgraded via the puppet module command.
+
+##2014-07-14 - Supported Release 4.3.1
+### Summary
+This supported release updates the metadata.json to work around upgrade behavior of the PMT.
+
+#### Bugfixes
+- Synchronize metadata.json with PMT-generated metadata to pass checksums
+
+##2014-06-27 - Supported Release 4.3.0
+### Summary
+This release is the first supported release of the stdlib 4 series. It remains
+backwards-compatible with the stdlib 3 series. It adds two new functions, one bugfix, and many testing updates.
+
+#### Features
+- New `bool2str()` function
+- New `camalcase()` function
+
+#### Bugfixes
+- Fix `has_interface_with()` when interfaces fact is nil
+
+##2014-06-04 - Release 4.2.2
+### Summary
+
+This release adds PE3.3 support in the metadata and fixes a few tests.
+
+## 2014-05-08 - Release - 4.2.1
+### Summary
+This release moves a stray symlink that can cause problems.
+
+## 2014-05-08 - Release - 4.2.0
+### Summary
+This release adds many new functions and fixes, and continues to be backwards compatible with stdlib 3.x
+
+#### Features
+- New `base64()` function
+- New `deep_merge()` function
+- New `delete_undef_values()` function
+- New `delete_values()` function
+- New `difference()` function
+- New `intersection()` function
+- New `is_bool()` function
+- New `pick_default()` function
+- New `union()` function
+- New `validate_ipv4_address` function
+- New `validate_ipv6_address` function
+- Update `ensure_packages()` to take an option hash as a second parameter.
+- Update `range()` to take an optional third argument for range step
+- Update `validate_slength()` to take an optional third argument for minimum length
+- Update `file_line` resource to take `after` and `multiple` attributes
+
+#### Bugfixes
+- Correct `is_string`, `is_domain_name`, `is_array`, `is_float`, and `is_function_available` for parsing odd types such as bools and hashes.
+- Allow facts.d facts to contain `=` in the value
+- Fix `root_home` fact on darwin systems
+- Fix `concat()` to work with a second non-array argument
+- Fix `floor()` to work with integer strings
+- Fix `is_integer()` to return true if passed integer strings
+- Fix `is_numeric()` to return true if passed integer strings
+- Fix `merge()` to work with empty strings
+- Fix `pick()` to raise the correct error type
+- Fix `uriescape()` to use the default URI.escape list
+- Add/update unit & acceptance tests.
+
+
+##2014-03-04 - Supported Release - 3.2.1
+###Summary
+This is a supported release
+
+####Bugfixes
+- Fixed `is_integer`/`is_float`/`is_numeric` for checking the value of arithmatic expressions.
+
+####Known bugs
+* No known bugs
+
+---
+
+##### 2013-05-06 - Jeff McCune <jeff@puppetlabs.com> - 4.1.0
+
+ * (#20582) Restore facter\_dot\_d to stdlib for PE users (3b887c8)
+ * (maint) Update Gemfile with GEM\_FACTER\_VERSION (f44d535)
+
+##### 2013-05-06 - Alex Cline <acline@us.ibm.com> - 4.1.0
+
+ * Terser method of string to array conversion courtesy of ethooz. (d38bce0)
+
+##### 2013-05-06 - Alex Cline <acline@us.ibm.com> 4.1.0
+
+ * Refactor ensure\_resource expectations (b33cc24)
+
+##### 2013-05-06 - Alex Cline <acline@us.ibm.com> 4.1.0
+
+ * Changed str-to-array conversion and removed abbreviation. (de253db)
+
+##### 2013-05-03 - Alex Cline <acline@us.ibm.com> 4.1.0
+
+ * (#20548) Allow an array of resource titles to be passed into the ensure\_resource function (e08734a)
+
+##### 2013-05-02 - Raphaël Pinson <raphael.pinson@camptocamp.com> - 4.1.0
+
+ * Add a dirname function (2ba9e47)
+
+##### 2013-04-29 - Mark Smith-Guerrero <msmithgu@gmail.com> - 4.1.0
+
+ * (maint) Fix a small typo in hash() description (928036a)
+
+##### 2013-04-12 - Jeff McCune <jeff@puppetlabs.com> - 4.0.2
+
+ * Update user information in gemspec to make the intent of the Gem clear.
+
+##### 2013-04-11 - Jeff McCune <jeff@puppetlabs.com> - 4.0.1
+
+ * Fix README function documentation (ab3e30c)
+
+##### 2013-04-11 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0
+
+ * stdlib 4.0 drops support with Puppet 2.7
+ * stdlib 4.0 preserves support with Puppet 3
+
+##### 2013-04-11 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0
+
+ * Add ability to use puppet from git via bundler (9c5805f)
+
+##### 2013-04-10 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0
+
+ * (maint) Make stdlib usable as a Ruby GEM (e81a45e)
+
+##### 2013-04-10 - Erik Dalén <dalen@spotify.com> - 4.0.0
+
+ * Add a count function (f28550e)
+
+##### 2013-03-31 - Amos Shapira <ashapira@atlassian.com> - 4.0.0
+
+ * (#19998) Implement any2array (7a2fb80)
+
+##### 2013-03-29 - Steve Huff <shuff@vecna.org> - 4.0.0
+
+ * (19864) num2bool match fix (8d217f0)
+
+##### 2013-03-20 - Erik Dalén <dalen@spotify.com> - 4.0.0
+
+ * Allow comparisons of Numeric and number as String (ff5dd5d)
+
+##### 2013-03-26 - Richard Soderberg <rsoderberg@mozilla.com> - 4.0.0
+
+ * add suffix function to accompany the prefix function (88a93ac)
+
+##### 2013-03-19 - Kristof Willaert <kristof.willaert@gmail.com> - 4.0.0
+
+ * Add floor function implementation and unit tests (0527341)
+
+##### 2012-04-03 - Eric Shamow <eric@puppetlabs.com> - 4.0.0
+
+ * (#13610) Add is\_function\_available to stdlib (961dcab)
+
+##### 2012-12-17 - Justin Lambert <jlambert@eml.cc> - 4.0.0
+
+ * str2bool should return a boolean if called with a boolean (5d5a4d4)
+
+##### 2012-10-23 - Uwe Stuehler <ustuehler@team.mobile.de> - 4.0.0
+
+ * Fix number of arguments check in flatten() (e80207b)
+
+##### 2013-03-11 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0
+
+ * Add contributing document (96e19d0)
+
+##### 2013-03-04 - Raphaël Pinson <raphael.pinson@camptocamp.com> - 4.0.0
+
+ * Add missing documentation for validate\_augeas and validate\_cmd to README.markdown (a1510a1)
+
+##### 2013-02-14 - Joshua Hoblitt <jhoblitt@cpan.org> - 4.0.0
+
+ * (#19272) Add has\_element() function (95cf3fe)
+
+##### 2013-02-07 - Raphaël Pinson <raphael.pinson@camptocamp.com> - 4.0.0
+
+ * validate\_cmd(): Use Puppet::Util::Execution.execute when available (69248df)
+
+##### 2012-12-06 - Raphaël Pinson <raphink@gmail.com> - 4.0.0
+
+ * Add validate\_augeas function (3a97c23)
+
+##### 2012-12-06 - Raphaël Pinson <raphink@gmail.com> - 4.0.0
+
+ * Add validate\_cmd function (6902cc5)
+
+##### 2013-01-14 - David Schmitt <david@dasz.at> - 4.0.0
+
+ * Add geppetto project definition (b3fc0a3)
+
+##### 2013-01-02 - Jaka Hudoklin <jakahudoklin@gmail.com> - 4.0.0
+
+ * Add getparam function to get defined resource parameters (20e0e07)
+
+##### 2013-01-05 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0
+
+ * (maint) Add Travis CI Support (d082046)
+
+##### 2012-12-04 - Jeff McCune <jeff@puppetlabs.com> - 4.0.0
+
+ * Clarify that stdlib 3 supports Puppet 3 (3a6085f)
+
+##### 2012-11-30 - Erik Dalén <dalen@spotify.com> - 4.0.0
+
+ * maint: style guideline fixes (7742e5f)
+
+##### 2012-11-09 - James Fryman <james@frymanet.com> - 4.0.0
+
+ * puppet-lint cleanup (88acc52)
+
+##### 2012-11-06 - Joe Julian <me@joejulian.name> - 4.0.0
+
+ * Add function, uriescape, to URI.escape strings. Redmine #17459 (fd52b8d)
+
+##### 2012-09-18 - Chad Metcalf <chad@wibidata.com> - 3.2.0
+
+ * Add an ensure\_packages function. (8a8c09e)
+
+##### 2012-11-23 - Erik Dalén <dalen@spotify.com> - 3.2.0
+
+ * (#17797) min() and max() functions (9954133)
+
+##### 2012-05-23 - Peter Meier <peter.meier@immerda.ch> - 3.2.0
+
+ * (#14670) autorequire a file\_line resource's path (dfcee63)
+
+##### 2012-11-19 - Joshua Harlan Lifton <lifton@puppetlabs.com> - 3.2.0
+
+ * Add join\_keys\_to\_values function (ee0f2b3)
+
+##### 2012-11-17 - Joshua Harlan Lifton <lifton@puppetlabs.com> - 3.2.0
+
+ * Extend delete function for strings and hashes (7322e4d)
+
+##### 2012-08-03 - Gary Larizza <gary@puppetlabs.com> - 3.2.0
+
+ * Add the pick() function (ba6dd13)
+
+##### 2012-03-20 - Wil Cooley <wcooley@pdx.edu> - 3.2.0
+
+ * (#13974) Add predicate functions for interface facts (f819417)
+
+##### 2012-11-06 - Joe Julian <me@joejulian.name> - 3.2.0
+
+ * Add function, uriescape, to URI.escape strings. Redmine #17459 (70f4a0e)
+
+##### 2012-10-25 - Jeff McCune <jeff@puppetlabs.com> - 3.1.1
+
+ * (maint) Fix spec failures resulting from Facter API changes (97f836f)
+
+##### 2012-10-23 - Matthaus Owens <matthaus@puppetlabs.com> - 3.1.0
+
+ * Add PE facts to stdlib (cdf3b05)
+
+##### 2012-08-16 - Jeff McCune <jeff@puppetlabs.com> - 3.0.1
+
+ * Fix accidental removal of facts\_dot\_d.rb in 3.0.0 release
+
+##### 2012-08-16 - Jeff McCune <jeff@puppetlabs.com> - 3.0.0
+
+ * stdlib 3.0 drops support with Puppet 2.6
+ * stdlib 3.0 preserves support with Puppet 2.7
+
+##### 2012-08-07 - Dan Bode <dan@puppetlabs.com> - 3.0.0
+
+ * Add function ensure\_resource and defined\_with\_params (ba789de)
+
+##### 2012-07-10 - Hailee Kenney <hailee@puppetlabs.com> - 3.0.0
+
+ * (#2157) Remove facter\_dot\_d for compatibility with external facts (f92574f)
+
+##### 2012-04-10 - Chris Price <chris@puppetlabs.com> - 3.0.0
+
+ * (#13693) moving logic from local spec\_helper to puppetlabs\_spec\_helper (85f96df)
+
+##### 2012-10-25 - Jeff McCune <jeff@puppetlabs.com> - 2.5.1
+
+ * (maint) Fix spec failures resulting from Facter API changes (97f836f)
+
+##### 2012-10-23 - Matthaus Owens <matthaus@puppetlabs.com> - 2.5.0
+
+ * Add PE facts to stdlib (cdf3b05)
+
+##### 2012-08-15 - Dan Bode <dan@puppetlabs.com> - 2.5.0
+
+ * Explicitly load functions used by ensure\_resource (9fc3063)
+
+##### 2012-08-13 - Dan Bode <dan@puppetlabs.com> - 2.5.0
+
+ * Add better docs about duplicate resource failures (97d327a)
+
+##### 2012-08-13 - Dan Bode <dan@puppetlabs.com> - 2.5.0
+
+ * Handle undef for parameter argument (4f8b133)
+
+##### 2012-08-07 - Dan Bode <dan@puppetlabs.com> - 2.5.0
+
+ * Add function ensure\_resource and defined\_with\_params (a0cb8cd)
+
+##### 2012-08-20 - Jeff McCune <jeff@puppetlabs.com> - 2.5.0
+
+ * Disable tests that fail on 2.6.x due to #15912 (c81496e)
+
+##### 2012-08-20 - Jeff McCune <jeff@puppetlabs.com> - 2.5.0
+
+ * (Maint) Fix mis-use of rvalue functions as statements (4492913)
+
+##### 2012-08-20 - Jeff McCune <jeff@puppetlabs.com> - 2.5.0
+
+ * Add .rspec file to repo root (88789e8)
+
+##### 2012-06-07 - Chris Price <chris@puppetlabs.com> - 2.4.0
+
+ * Add support for a 'match' parameter to file\_line (a06c0d8)
+
+##### 2012-08-07 - Erik Dalén <dalen@spotify.com> - 2.4.0
+
+ * (#15872) Add to\_bytes function (247b69c)
+
+##### 2012-07-19 - Jeff McCune <jeff@puppetlabs.com> - 2.4.0
+
+ * (Maint) use PuppetlabsSpec::PuppetInternals.scope (master) (deafe88)
+
+##### 2012-07-10 - Hailee Kenney <hailee@puppetlabs.com> - 2.4.0
+
+ * (#2157) Make facts\_dot\_d compatible with external facts (5fb0ddc)
+
+##### 2012-03-16 - Steve Traylen <steve.traylen@cern.ch> - 2.4.0
+
+ * (#13205) Rotate array/string randomley based on fqdn, fqdn\_rotate() (fef247b)
+
+##### 2012-05-22 - Peter Meier <peter.meier@immerda.ch> - 2.3.3
+
+ * fix regression in #11017 properly (f0a62c7)
+
+##### 2012-05-10 - Jeff McCune <jeff@puppetlabs.com> - 2.3.3
+
+ * Fix spec tests using the new spec\_helper (7d34333)
+
+##### 2012-05-10 - Puppet Labs <support@puppetlabs.com> - 2.3.2
+
+ * Make file\_line default to ensure => present (1373e70)
+ * Memoize file\_line spec instance variables (20aacc5)
+ * Fix spec tests using the new spec\_helper (1ebfa5d)
+ * (#13595) initialize\_everything\_for\_tests couples modules Puppet ver (3222f35)
+ * (#13439) Fix MRI 1.9 issue with spec\_helper (15c5fd1)
+ * (#13439) Fix test failures with Puppet 2.6.x (665610b)
+ * (#13439) refactor spec helper for compatibility with both puppet 2.7 and master (82194ca)
+ * (#13494) Specify the behavior of zero padded strings (61891bb)
+
+##### 2012-03-29 Puppet Labs <support@puppetlabs.com> - 2.1.3
+
+* (#11607) Add Rakefile to enable spec testing
+* (#12377) Avoid infinite loop when retrying require json
+
+##### 2012-03-13 Puppet Labs <support@puppetlabs.com> - 2.3.1
+
+* (#13091) Fix LoadError bug with puppet apply and puppet\_vardir fact
+
+##### 2012-03-12 Puppet Labs <support@puppetlabs.com> - 2.3.0
+
+* Add a large number of new Puppet functions
+* Backwards compatibility preserved with 2.2.x
+
+##### 2011-12-30 Puppet Labs <support@puppetlabs.com> - 2.2.1
+
+* Documentation only release for the Forge
+
+##### 2011-12-30 Puppet Labs <support@puppetlabs.com> - 2.1.2
+
+* Documentation only release for PE 2.0.x
+
+##### 2011-11-08 Puppet Labs <support@puppetlabs.com> - 2.2.0
+
+* #10285 - Refactor json to use pson instead.
+* Maint  - Add watchr autotest script
+* Maint  - Make rspec tests work with Puppet 2.6.4
+* #9859  - Add root\_home fact and tests
+
+##### 2011-08-18 Puppet Labs <support@puppetlabs.com> - 2.1.1
+
+* Change facts.d paths to match Facter 2.0 paths.
+* /etc/facter/facts.d
+* /etc/puppetlabs/facter/facts.d
+
+##### 2011-08-17 Puppet Labs <support@puppetlabs.com> - 2.1.0
+
+* Add R.I. Pienaar's facts.d custom facter fact
+* facts defined in /etc/facts.d and /etc/puppetlabs/facts.d are
+  automatically loaded now.
+
+##### 2011-08-04 Puppet Labs <support@puppetlabs.com> - 2.0.0
+
+* Rename whole\_line to file\_line
+* This is an API change and as such motivating a 2.0.0 release according to semver.org.
+
+##### 2011-08-04 Puppet Labs <support@puppetlabs.com> - 1.1.0
+
+* Rename append\_line to whole\_line
+* This is an API change and as such motivating a 1.1.0 release.
+
+##### 2011-08-04 Puppet Labs <support@puppetlabs.com> - 1.0.0
+
+* Initial stable release
+* Add validate\_array and validate\_string functions
+* Make merge() function work with Ruby 1.8.5
+* Add hash merging function
+* Add has\_key function
+* Add loadyaml() function
+* Add append\_line native
+
+##### 2011-06-21 Jeff McCune <jeff@puppetlabs.com> - 0.1.7
+
+* Add validate\_hash() and getvar() functions
+
+##### 2011-06-15 Jeff McCune <jeff@puppetlabs.com> - 0.1.6
+
+* Add anchor resource type to provide containment for composite classes
+
+##### 2011-06-03 Jeff McCune <jeff@puppetlabs.com> - 0.1.5
+
+* Add validate\_bool() function to stdlib
+
+##### 0.1.4 2011-05-26 Jeff McCune <jeff@puppetlabs.com>
+
+* Move most stages after main
+
+##### 0.1.3 2011-05-25 Jeff McCune <jeff@puppetlabs.com>
+
+* Add validate\_re() function
+
+##### 0.1.2 2011-05-24 Jeff McCune <jeff@puppetlabs.com>
+
+* Update to add annotated tag
+
+##### 0.1.1 2011-05-24 Jeff McCune <jeff@puppetlabs.com>
+
+* Add stdlib::stages class with a standard set of stages
diff --git a/puppet/modules/stdlib/CONTRIBUTING.md b/puppet/modules/stdlib/CONTRIBUTING.md
new file mode 100644
index 00000000..f1cbde4b
--- /dev/null
+++ b/puppet/modules/stdlib/CONTRIBUTING.md
@@ -0,0 +1,220 @@
+Checklist (and a short version for the impatient)
+=================================================
+
+  * Commits:
+
+    - Make commits of logical units.
+
+    - Check for unnecessary whitespace with "git diff --check" before
+      committing.
+
+    - Commit using Unix line endings (check the settings around "crlf" in
+      git-config(1)).
+
+    - Do not check in commented out code or unneeded files.
+
+    - The first line of the commit message should be a short
+      description (50 characters is the soft limit, excluding ticket
+      number(s)), and should skip the full stop.
+
+    - Associate the issue in the message. The first line should include
+      the issue number in the form "(#XXXX) Rest of message".
+
+    - The body should provide a meaningful commit message, which:
+
+      - uses the imperative, present tense: "change", not "changed" or
+        "changes".
+
+      - includes motivation for the change, and contrasts its
+        implementation with the previous behavior.
+
+    - Make sure that you have tests for the bug you are fixing, or
+      feature you are adding.
+
+    - Make sure the test suites passes after your commit:
+      `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below
+
+    - When introducing a new feature, make sure it is properly
+      documented in the README.md
+
+  * Submission:
+
+    * Pre-requisites:
+
+      - Make sure you have a [GitHub account](https://github.com/join)
+
+      - [Create a ticket](https://tickets.puppetlabs.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppetlabs.com/browse/) you are patching for.
+
+    * Preferred method:
+
+      - Fork the repository on GitHub.
+
+      - Push your changes to a topic branch in your fork of the
+        repository. (the format ticket/1234-short_description_of_change is
+        usually preferred for this project).
+
+      - Submit a pull request to the repository in the puppetlabs
+        organization.
+
+The long version
+================
+
+  1.  Make separate commits for logically separate changes.
+
+      Please break your commits down into logically consistent units
+      which include new or changed tests relevant to the rest of the
+      change.  The goal of doing this is to make the diff easier to
+      read for whoever is reviewing your code.  In general, the easier
+      your diff is to read, the more likely someone will be happy to
+      review it and get it into the code base.
+
+      If you are going to refactor a piece of code, please do so as a
+      separate commit from your feature or bug fix changes.
+
+      We also really appreciate changes that include tests to make
+      sure the bug is not re-introduced, and that the feature is not
+      accidentally broken.
+
+      Describe the technical detail of the change(s).  If your
+      description starts to get too long, that is a good sign that you
+      probably need to split up your commit into more finely grained
+      pieces.
+
+      Commits which plainly describe the things which help
+      reviewers check the patch and future developers understand the
+      code are much more likely to be merged in with a minimum of
+      bike-shedding or requested changes.  Ideally, the commit message
+      would include information, and be in a form suitable for
+      inclusion in the release notes for the version of Puppet that
+      includes them.
+
+      Please also check that you are not introducing any trailing
+      whitespace or other "whitespace errors".  You can do this by
+      running "git diff --check" on your changes before you commit.
+
+  2.  Sending your patches
+
+      To submit your changes via a GitHub pull request, we _highly_
+      recommend that you have them on a topic branch, instead of
+      directly on "master".
+      It makes things much easier to keep track of, especially if
+      you decide to work on another thing before your first change
+      is merged in.
+
+      GitHub has some pretty good
+      [general documentation](http://help.github.com/) on using
+      their site.  They also have documentation on
+      [creating pull requests](http://help.github.com/send-pull-requests/).
+
+      In general, after pushing your topic branch up to your
+      repository on GitHub, you can switch to the branch in the
+      GitHub UI and click "Pull Request" towards the top of the page
+      in order to open a pull request.
+
+
+  3.  Update the related GitHub issue.
+
+      If there is a GitHub issue associated with the change you
+      submitted, then you should update the ticket to include the
+      location of your branch, along with any other commentary you
+      may wish to make.
+
+Testing
+=======
+
+Getting Started
+---------------
+
+Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby
+package manager such as [bundler](http://bundler.io/) what Ruby packages,
+or Gems, are required to build, develop, and test this software.
+
+Please make sure you have [bundler installed](http://bundler.io/#getting-started)
+on your system, then use it to install all dependencies needed for this project,
+by running
+
+```shell
+% bundle install
+Fetching gem metadata from https://rubygems.org/........
+Fetching gem metadata from https://rubygems.org/..
+Using rake (10.1.0)
+Using builder (3.2.2)
+-- 8><-- many more --><8 --
+Using rspec-system-puppet (2.2.0)
+Using serverspec (0.6.3)
+Using rspec-system-serverspec (1.0.0)
+Using bundler (1.3.5)
+Your bundle is complete!
+Use `bundle show [gemname]` to see where a bundled gem is installed.
+```
+
+NOTE some systems may require you to run this command with sudo.
+
+If you already have those gems installed, make sure they are up-to-date:
+
+```shell
+% bundle update
+```
+
+With all dependencies in place and up-to-date we can now run the tests:
+
+```shell
+% rake spec
+```
+
+This will execute all the [rspec tests](http://rspec-puppet.com/) tests
+under [spec/defines](./spec/defines), [spec/classes](./spec/classes),
+and so on. rspec tests may have the same kind of dependencies as the
+module they are testing. While the module defines in its [Modulefile](./Modulefile),
+rspec tests define them in [.fixtures.yml](./fixtures.yml).
+
+Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker)
+tests. These tests spin up a virtual machine under
+[VirtualBox](https://www.virtualbox.org/)) with, controlling it with
+[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test
+scenarios. In order to run these, you will need both of those tools
+installed on your system.
+
+You can run them by issuing the following command
+
+```shell
+% rake spec_clean
+% rspec spec/acceptance
+```
+
+This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml),
+install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb)
+and then run all the tests under [spec/acceptance](./spec/acceptance).
+
+Writing Tests
+-------------
+
+XXX getting started writing tests.
+
+If you have commit access to the repository
+===========================================
+
+Even if you have commit access to the repository, you will still need to
+go through the process above, and have someone else review and merge
+in your changes.  The rule is that all changes must be reviewed by a
+developer on the project (that did not write the code) to ensure that
+all changes go through a code review process.
+
+Having someone other than the author of the topic branch recorded as
+performing the merge is the record that they performed the code
+review.
+
+
+Additional Resources
+====================
+
+* [Getting additional help](http://puppetlabs.com/community/get-help)
+
+* [Writing tests](http://projects.puppetlabs.com/projects/puppet/wiki/Development_Writing_Tests)
+
+* [Patchwork](https://patchwork.puppetlabs.com)
+
+* [General GitHub documentation](http://help.github.com/)
+
+* [GitHub pull request documentation](http://help.github.com/send-pull-requests/)
+
diff --git a/puppet/modules/stdlib/Gemfile b/puppet/modules/stdlib/Gemfile
new file mode 100644
index 00000000..74a16f38
--- /dev/null
+++ b/puppet/modules/stdlib/Gemfile
@@ -0,0 +1,35 @@
+source ENV['GEM_SOURCE'] || 'https://rubygems.org'
+
+def location_for(place, fake_version = nil)
+  if place =~ /^(git[:@][^#]*)#(.*)/
+    [fake_version, { :git => $1, :branch => $2, :require => false }].compact
+  elsif place =~ /^file:\/\/(.*)/
+    ['>= 0', { :path => File.expand_path($1), :require => false }]
+  else
+    [place, { :require => false }]
+  end
+end
+
+group :development, :unit_tests do
+  gem 'rake', '~> 10.1.0',       :require => false
+  gem 'rspec-puppet',            :require => false
+  gem 'puppetlabs_spec_helper',  :require => false
+  gem 'puppet-lint',             :require => false
+  gem 'pry',                     :require => false
+  gem 'simplecov',               :require => false
+end
+
+group :system_tests do
+  gem 'beaker-rspec',            :require => false
+  gem 'serverspec',              :require => false
+end
+
+ENV['GEM_PUPPET_VERSION'] ||= ENV['PUPPET_GEM_VERSION']
+puppetversion = ENV['GEM_PUPPET_VERSION']
+if puppetversion
+  gem 'puppet', *location_for(puppetversion)
+else
+  gem 'puppet', :require => false
+end
+
+# vim:ft=ruby
diff --git a/puppet/modules/stdlib/LICENSE b/puppet/modules/stdlib/LICENSE
new file mode 100644
index 00000000..ec0587c0
--- /dev/null
+++ b/puppet/modules/stdlib/LICENSE
@@ -0,0 +1,19 @@
+Copyright (C) 2011 Puppet Labs Inc
+
+and some parts:
+
+Copyright (C) 2011 Krzysztof Wilczynski
+
+Puppet Labs can be contacted at: info@puppetlabs.com
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/puppet/modules/stdlib/README.markdown b/puppet/modules/stdlib/README.markdown
new file mode 100644
index 00000000..e9a1f4e4
--- /dev/null
+++ b/puppet/modules/stdlib/README.markdown
@@ -0,0 +1,741 @@
+#stdlib
+
+[![Build Status](https://travis-ci.org/puppetlabs/puppetlabs-stdlib.png?branch=master)](https://travis-ci.org/puppetlabs/puppetlabs-stdlib)
+
+####Table of Contents
+
+1. [Overview](#overview)
+2. [Module Description - What the module does and why it is useful](#module-description)
+3. [Setup - The basics of getting started with stdlib](#setup)
+4. [Usage - Configuration options and additional functionality](#usage)
+5. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
+5. [Limitations - OS compatibility, etc.](#limitations)
+6. [Development - Guide for contributing to the module](#development)
+
+##Overview
+
+Adds a standard library of resources for Puppet modules.
+
+##Module Description
+
+This module provides a standard library of resources for the development of Puppet
+modules. Puppet modules make heavy use of this standard library. The stdlib module adds the following resources to Puppet:
+
+ * Stages
+ * Facts
+ * Functions
+ * Defined resource types
+ * Types
+ * Providers
+
+> *Note:* As of version 3.7, Puppet Enterprise no longer includes the stdlib module. If you're running Puppet Enterprise, you should install the most recent release of stdlib for compatibility with Puppet modules.
+
+##Setup
+
+Installing the stdlib module adds the functions, facts, and resources of this standard library to Puppet.
+
+##Usage
+
+After you've installed stdlib, all of its functions, facts, and resources are available for module use or development.
+
+If you want to use a standardized set of run stages for Puppet, `include stdlib` in your manifest.
+
+## Reference
+
+### Classes
+
+#### Public Classes
+
+* `stdlib`: Most of stdlib's features are automatically loaded by Puppet. To use standardized run stages in Puppet, declare this class in your manifest with `include stdlib`.
+
+  When declared, stdlib declares all other classes in the module. The only other class currently included in the module is `stdlib::stages`.
+
+  The stdlib class has no parameters.
+
+#### Private Classes
+
+* `stdlib::stages`: This class manages a standard set of run stages for Puppet. It is managed by the stdlib class and should not be declared independently.
+
+  The `stdlib::stages` class declares various run stages for deploying infrastructure, language runtimes, and application layers. The high level stages are (in order):
+
+  * setup
+  * main
+  * runtime
+  * setup_infra
+  * deploy_infra
+  * setup_app
+  * deploy_app
+  * deploy
+
+  Sample usage:
+
+  ```
+  node default {
+    include stdlib
+    class { java: stage => 'runtime' }
+  }
+  ```
+
+### Resources
+
+* `file_line`: This resource ensures that a given line, including whitespace at the beginning and end, is contained within a file. If the line is not contained in the given file, Puppet will add the line. Multiple resources can be declared to manage multiple lines in the same file. You can also use match to replace existing lines.
+
+  ```
+  file_line { 'sudo_rule':
+    path => '/etc/sudoers',
+    line => '%sudo ALL=(ALL) ALL',
+  }
+  file_line { 'sudo_rule_nopw':
+    path => '/etc/sudoers',
+    line => '%sudonopw ALL=(ALL) NOPASSWD: ALL',
+  }
+  ```
+
+  * `after`: Specify the line after which Puppet will add any new lines. (Existing lines are added in place.) Optional.
+  * `ensure`: Ensures whether the resource is present. Valid values are 'present', 'absent'.
+ * `line`: The line to be added to the file located by the `path` parameter.
+ * `match`: A regular expression to run against existing lines in the file; if a match is found, we replace that line rather than adding a new line. Optional.
+ * `multiple`: Determine if match can change multiple lines. Valid values are 'true', 'false'. Optional.
+ * `name`: An arbitrary name used as the identity of the resource.
+ * `path`: The file in which Puppet will ensure the line specified by the line parameter.
+
+### Functions
+
+* `abs`: Returns the absolute value of a number; for example, '-34.56' becomes '34.56'. Takes a single integer and float value as an argument. *Type*: rvalue
+
+* `any2array`: This converts any object to an array containing that object. Empty argument lists are converted to an empty array. Arrays are left untouched. Hashes are converted to arrays of alternating keys and values. *Type*: rvalue
+
+* `base64`: Converts a string to and from base64 encoding.
+Requires an action ('encode', 'decode') and either a plain or base64-encoded
+string. *Type*: rvalue
+
+* `basename`: Returns the `basename` of a path (optionally stripping an extension). For example:
+  * ('/path/to/a/file.ext') returns 'file.ext'
+  * ('relative/path/file.ext') returns 'file.ext'
+  * ('/path/to/a/file.ext', '.ext') returns 'file'
+
+  *Type*: rvalue
+
+* `bool2num`: Converts a boolean to a number. Converts values:
+  * 'false', 'f', '0', 'n', and 'no' to 0.
+  * 'true', 't', '1', 'y', and 'yes' to 1.
+  Requires a single boolean or string as an input. *Type*: rvalue
+
+* `capitalize`: Capitalizes the first letter of a string or array of strings.
+Requires either a single string or an array as an input. *Type*: rvalue
+
+* `chomp`: Removes the record separator from the end of a string or an array of
+strings; for example, 'hello\n' becomes 'hello'. Requires a single string or array as an input. *Type*: rvalue
+
+* `chop`: Returns a new string with the last character removed. If the string ends with '\r\n', both characters are removed. Applying `chop` to an empty string returns an empty string. If you want to merely remove record separators, then you should use the `chomp` function. Requires a string or an array of strings as input. *Type*: rvalue
+
+* `concat`: Appends the contents of multiple arrays onto array 1. For example:
+  * `concat(['1','2','3'],'4')` results in: ['1','2','3','4'].
+  * `concat(['1','2','3'],'4',['5','6','7'])` results in: ['1','2','3','4','5','6','7'].
+
+* `count`: Takes an array as first argument and an optional second argument. Count the number of elements in array that matches second argument. If called with only an array, it counts the number of elements that are **not** nil/undef. *Type*: rvalue
+
+* `defined_with_params`: Takes a resource reference and an optional hash of attributes. Returns 'true' if a resource with the specified attributes has already been added to the catalog. Returns 'false' otherwise.
+
+  ```
+  user { 'dan':
+    ensure => present,
+  }
+
+  if ! defined_with_params(User[dan], {'ensure' => 'present' }) {
+    user { 'dan': ensure => present, }
+  }
+  ```
+
+  *Type*: rvalue
+
+* `delete`: Deletes all instances of a given element from an array, substring from a
+string, or key from a hash. For example, `delete(['a','b','c','b'], 'b')` returns ['a','c']; `delete('abracadabra', 'bra')` returns 'acada'. `delete({'a' => 1,'b' => 2,'c' => 3},['b','c'])` returns {'a'=> 1} *Type*: rvalue
+
+* `delete_at`: Deletes a determined indexed value from an array. For example, `delete_at(['a','b','c'], 1)` returns ['a','c']. *Type*: rvalue
+
+* `delete_values`: Deletes all instances of a given value from a hash. For example, `delete_values({'a'=>'A','b'=>'B','c'=>'C','B'=>'D'}, 'B')` returns {'a'=>'A','c'=>'C','B'=>'D'} *Type*: rvalue
+
+* `delete_undef_values`: Deletes all instances of the undef value from an array or hash. For example, `$hash = delete_undef_values({a=>'A', b=>'', c=>undef, d => false})` returns {a => 'A', b => '', d => false}. *Type*: rvalue
+
+* `difference`: Returns the difference between two arrays.
+The returned array is a copy of the original array, removing any items that
+also appear in the second array. For example, `difference(["a","b","c"],["b","c","d"])` returns ["a"].
+
+* `dirname`: Returns the `dirname` of a path. For example, `dirname('/path/to/a/file.ext')` returns '/path/to/a'.
+
+* `downcase`: Converts the case of a string or of all strings in an array to lowercase. *Type*: rvalue
+
+* `empty`: Returns 'true' if the variable is empty. *Type*: rvalue
+
+* `ensure_packages`: Takes a list of packages and only installs them if they don't already exist. It optionally takes a hash as a second parameter to be passed as the third argument to the `ensure_resource()` function. *Type*: statement
+
+* `ensure_resource`: Takes a resource type, title, and a list of attributes that describe a resource.
+
+  ```
+  user { 'dan':
+    ensure => present,
+  }
+  ```
+
+  This example only creates the resource if it does not already exist:
+
+    `ensure_resource('user', 'dan', {'ensure' => 'present' })`
+
+  If the resource already exists, but does not match the specified parameters, this function attempts to recreate the resource, leading to a duplicate resource definition error.
+
+  An array of resources can also be passed in, and each will be created with the type and parameters specified if it doesn't already exist.
+
+  `ensure_resource('user', ['dan','alex'], {'ensure' => 'present'})`
+
+  *Type*: statement
+
+* `flatten`: This function flattens any deeply nested arrays and returns a single flat array as a result. For example, `flatten(['a', ['b', ['c']]])` returns ['a','b','c']. *Type*: rvalue
+
+* `floor`: Returns the largest integer less than or equal to the argument.
+Takes a single numeric value as an argument. *Type*: rvalue
+
+* `fqdn_rotate`: Rotates an array a random number of times based on a node's fqdn. *Type*: rvalue
+
+* `get_module_path`: Returns the absolute path of the specified module for the current environment.
+
+  `$module_path = get_module_path('stdlib')`
+
+  *Type*: rvalue
+
+* `getparam`: Takes a resource reference and the name of the parameter and
+returns the value of the resource's parameter. For example, the following code returns 'param_value'.
+
+  *Example:*
+
+  ```
+  define example_resource($param) {
+  }
+
+  example_resource { "example_resource_instance":
+    param => "param_value"
+  }
+
+  getparam(Example_resource["example_resource_instance"], "param")
+  ```
+
+  *Type*: rvalue
+
+* `getvar`: Lookup a variable in a remote namespace.
+
+  For example:
+
+  ```
+  $foo = getvar('site::data::foo')
+  # Equivalent to $foo = $site::data::foo
+  ```
+
+  This is useful if the namespace itself is stored in a string:
+
+  ```
+  $datalocation = 'site::data'
+  $bar = getvar("${datalocation}::bar")
+  # Equivalent to $bar = $site::data::bar
+  ```
+
+  *Type*: rvalue
+
+* `grep`: This function searches through an array and returns any elements that match the provided regular expression. For example, `grep(['aaa','bbb','ccc','aaaddd'], 'aaa')` returns ['aaa','aaaddd']. *Type*: rvalue
+
+* `has_interface_with`: Returns boolean based on kind and value:
+  * macaddress
+  * netmask
+  * ipaddress
+  * network
+
+  *Examples:*
+
+  ```
+  has_interface_with("macaddress", "x:x:x:x:x:x")
+  has_interface_with("ipaddress", "127.0.0.1")    => true
+  ```
+
+  If no kind is given, then the presence of the interface is checked:
+
+  ```
+  has_interface_with("lo")                        => true
+  ```
+
+  *Type*: rvalue
+
+* `has_ip_address`: Returns true if the client has the requested IP address on some interface. This function iterates through the `interfaces` fact and checks the `ipaddress_IFACE` facts, performing a simple string comparison. *Type*: rvalue
+
+* `has_ip_network`: Returns true if the client has an IP address within the requested network. This function iterates through the 'interfaces' fact and checks the 'network_IFACE' facts, performing a simple string comparision. *Type*: rvalue
+
+* `has_key`: Determine if a hash has a certain key value.
+
+  *Example*:
+
+  ```
+  $my_hash = {'key_one' => 'value_one'}
+  if has_key($my_hash, 'key_two') {
+    notice('we will not reach here')
+  }
+  if has_key($my_hash, 'key_one') {
+    notice('this will be printed')
+  }
+  ```
+
+  *Type*: rvalue
+
+* `hash`: This function converts an array into a hash. For example, `hash(['a',1,'b',2,'c',3])` returns {'a'=>1,'b'=>2,'c'=>3}. *Type*: rvalue
+
+* `intersection`: This function returns an array an intersection of two. For example, `intersection(["a","b","c"],["b","c","d"])` returns ["b","c"].
+
+* `is_array`: Returns 'true' if the variable passed to this function is an array. *Type*: rvalue
+
+* `is_bool`: Returns 'true' if the variable passed to this function is a boolean. *Type*: rvalue
+
+* `is_domain_name`: Returns 'true' if the string passed to this function is a syntactically correct domain name. *Type*: rvalue
+
+* `is_float`: Returns 'true' if the variable passed to this function is a float. *Type*: rvalue
+
+* `is_function_available`: This function accepts a string as an argument and determines whether the Puppet runtime has access to a function by that name. It returns 'true' if the function exists, 'false' if not. *Type*: rvalue
+
+* `is_hash`: Returns 'true' if the variable passed to this function is a hash. *Type*: rvalue
+
+* `is_integer`: Returns 'true' if the variable returned to this string is an integer. *Type*: rvalue
+
+* `is_ip_address`: Returns 'true' if the string passed to this function is a valid IP address. *Type*: rvalue
+
+* `is_mac_address`: Returns 'true' if the string passed to this function is a valid MAC address. *Type*: rvalue
+
+* `is_numeric`: Returns 'true' if the variable passed to this function is a number. *Type*: rvalue
+
+* `is_string`: Returns 'true' if the variable passed to this function is a string. *Type*: rvalue
+
+* `join`: This function joins an array into a string using a separator. For example, `join(['a','b','c'], ",")` results in: "a,b,c". *Type*: rvalue
+
+* `join_keys_to_values`: This function joins each key of a hash to that key's corresponding value with a separator. Keys and values are cast to strings. The return value is an array in which each element is one joined key/value pair. For example, `join_keys_to_values({'a'=>1,'b'=>2}, " is ")` results in ["a is 1","b is 2"]. *Type*: rvalue
+
+* `keys`: Returns the keys of a hash as an array. *Type*: rvalue
+
+* `loadyaml`: Load a YAML file containing an array, string, or hash, and return the data in the corresponding native data type. For example:
+
+  ```
+  $myhash = loadyaml('/etc/puppet/data/myhash.yaml')
+  ```
+
+  *Type*: rvalue
+
+* `lstrip`: Strips leading spaces to the left of a string. *Type*: rvalue
+
+* `max`: Returns the highest value of all arguments. Requires at least one argument. *Type*: rvalue
+
+* `member`: This function determines if a variable is a member of an array. The variable can be either a string, array, or fixnum. For example, `member(['a','b'], 'b')` and `member(['a','b','c'], ['b','c'])` return 'true', while `member(['a','b'], 'c')`  and `member(['a','b','c'], ['c','d'])` return 'false'. *Type*: rvalue
+
+* `merge`: Merges two or more hashes together and returns the resulting hash.
+
+  *Example*:
+
+  ```
+  $hash1 = {'one' => 1, 'two' => 2}
+  $hash2 = {'two' => 'dos', 'three' => 'tres'}
+  $merged_hash = merge($hash1, $hash2)
+  # The resulting hash is equivalent to:
+  # $merged_hash =  {'one' => 1, 'two' => 'dos', 'three' => 'tres'}
+  ```
+
+  When there is a duplicate key, the key in the rightmost hash "wins." *Type*: rvalue
+
+* `min`: Returns the lowest value of all arguments. Requires at least one argument. *Type*: rvalue
+
+* `num2bool`: This function converts a number or a string representation of a number into a true boolean. Zero or anything non-numeric becomes 'false'. Numbers greater than 0 become 'true'. *Type*: rvalue
+
+* `parsejson`: This function accepts JSON as a string and converts into the correct Puppet structure. *Type*: rvalue
+
+* `parseyaml`: This function accepts YAML as a string and converts it into the correct Puppet structure. *Type*: rvalue
+
+* `pick`: From a list of values, returns the first value that is not undefined or an empty string. Takes any number of arguments, and raises an error if all values are undefined or empty.
+
+  ```
+  $real_jenkins_version = pick($::jenkins_version, '1.449')
+  ```
+
+ *Type*: rvalue
+
+* `prefix`: This function applies a prefix to all elements in an array. For example, `prefix(['a','b','c'], 'p')` returns ['pa','pb','pc']. *Type*: rvalue
+
+
+* `private`: This function sets the current class or definition as private.
+Calling the class or definition from outside the current module will fail. For example, `private()` called in class `foo::bar` outputs the following message if class is called from outside module `foo`:
+
+  ```
+  Class foo::bar is private
+  ```
+
+  You can specify the error message you want to use:
+
+  ```
+  private("You're not supposed to do that!")
+  ```
+
+  *Type*: statement
+
+* `range`: When given range in the form of '(start, stop)', `range` extrapolates a range as an array. For example, `range("0", "9")` returns [0,1,2,3,4,5,6,7,8,9]. Zero-padded strings are converted to integers automatically, so `range("00", "09")` returns [0,1,2,3,4,5,6,7,8,9].
+
+  Non-integer strings are accepted; `range("a", "c")` returns ["a","b","c"], and `range("host01", "host10")` returns ["host01", "host02", ..., "host09", "host10"].
+
+  *Type*: rvalue
+
+* `reject`: This function searches through an array and rejects all elements that match the provided regular expression. For example, `reject(['aaa','bbb','ccc','aaaddd'], 'aaa')` returns ['bbb','ccc']. *Type*: rvalue
+
+* `reverse`: Reverses the order of a string or array. *Type*: rvalue
+
+* `rstrip`: Strips leading spaces to the right of the string.*Type*: rvalue
+
+* `shuffle`: Randomizes the order of a string or array elements. *Type*: rvalue
+
+* `size`: Returns the number of elements in a string or array. *Type*: rvalue
+
+* `sort`: Sorts strings and arrays lexically. *Type*: rvalue
+
+* `squeeze`: Returns a new string where runs of the same character that occur in this set are replaced by a single character. *Type*: rvalue
+
+* `str2bool`: This converts a string to a boolean. This attempts to convert strings that contain values such as '1', 't', 'y', and 'yes' to 'true' and strings that contain values such as '0', 'f', 'n', and 'no' to 'false'. *Type*: rvalue
+
+* `str2saltedsha512`: This converts a string to a salted-SHA512 password hash, used for OS X versions >= 10.7. Given any string, this function returns a hex version of a salted-SHA512 password hash, which can be inserted into your Puppet
+manifests as a valid password attribute. *Type*: rvalue
+
+* `strftime`: This function returns formatted time. For example,  `strftime("%s")` returns the time since epoch, and `strftime("%Y=%m-%d")` returns the date. *Type*: rvalue
+
+  *Format:*
+
+    * `%a`: The abbreviated weekday name ('Sun')
+    * `%A`: The  full  weekday  name ('Sunday')
+    * `%b`: The abbreviated month name ('Jan')
+    * `%B`: The  full  month  name ('January')
+    * `%c`: The preferred local date and time representation
+    * `%C`: Century (20 in 2009)
+    * `%d`: Day of the month (01..31)
+    * `%D`: Date (%m/%d/%y)
+    * `%e`: Day of the month, blank-padded ( 1..31)
+    * `%F`: Equivalent to %Y-%m-%d (the ISO 8601 date format)
+    * `%h`: Equivalent to %b
+    * `%H`: Hour of the day, 24-hour clock (00..23)
+    * `%I`: Hour of the day, 12-hour clock (01..12)
+    * `%j`: Day of the year (001..366)
+    * `%k`: Hour, 24-hour clock, blank-padded ( 0..23)
+    * `%l`: Hour, 12-hour clock, blank-padded ( 0..12)
+    * `%L`: Millisecond of the second (000..999)
+    * `%m`: Month of the year (01..12)
+    * `%M`: Minute of the hour (00..59)
+    * `%n`: Newline (\n)
+    * `%N`: Fractional seconds digits, default is 9 digits (nanosecond)
+      * `%3N`: Millisecond (3 digits)
+      * `%6N`: Microsecond (6 digits)
+      * `%9N`: Nanosecond (9 digits)
+    * `%p`: Meridian indicator ('AM'  or  'PM')
+    * `%P`: Meridian indicator ('am'  or  'pm')
+    * `%r`: Time, 12-hour (same as %I:%M:%S %p)
+    * `%R`: Time, 24-hour (%H:%M)
+    * `%s`: Number of seconds since 1970-01-01 00:00:00 UTC.
+    * `%S`: Second of the minute (00..60)
+    * `%t`: Tab character (	)
+    * `%T`: Time, 24-hour (%H:%M:%S)
+    * `%u`: Day of the week as a decimal, Monday being 1. (1..7)
+    * `%U`: Week  number  of the current year, starting with the first Sunday as the first day of the first week (00..53)
+    * `%v`: VMS date (%e-%b-%Y)
+    * `%V`: Week number of year according to ISO 8601 (01..53)
+    * `%W`: Week  number of the current year, starting with the first Monday as the first day of the first week (00..53)
+    * `%w`: Day of the week (Sunday is 0, 0..6)
+    * `%x`: Preferred representation for the date alone, no time
+    * `%X`: Preferred representation for the time alone, no date
+    * `%y`: Year without a century (00..99)
+    * `%Y`: Year with century
+    * `%z`: Time zone as  hour offset from UTC (e.g. +0900)
+    * `%Z`: Time zone name
+    * `%%`: Literal '%' character
+
+
+* `strip`: This function removes leading and trailing whitespace from a string or from every string inside an array. For example, `strip("    aaa   ")` results in "aaa". *Type*: rvalue
+
+* `suffix`: This function applies a suffix to all elements in an array. For example, `suffix(['a','b','c'], 'p')` returns ['ap','bp','cp']. *Type*: rvalue
+
+* `swapcase`: This function swaps the existing case of a string. For example, `swapcase("aBcD")` results in "AbCd". *Type*: rvalue
+
+* `time`: This function returns the current time since epoch as an integer. For example, `time()` returns something like '1311972653'. *Type*: rvalue
+
+* `to_bytes`: Converts the argument into bytes, for example 4 kB becomes 4096.
+Takes a single string value as an argument. *Type*: rvalue
+
+* `type3x`: Returns a string description of the type when passed a value. Type can be a string, array, hash, float, integer, or boolean. This function will be removed when puppet 3 support is dropped and the new type system may be used. *Type*: rvalue
+
+* `type_of`: Returns the literal type when passed a value. Requires the new
+  parser. Useful for comparison of types with `<=` such as in `if
+  type_of($some_value) <= Array[String] { ... }` (which is equivalent to `if
+  $some_value =~ Array[String] { ... }`) *Type*: rvalue
+
+* `union`: This function returns a union of two arrays. For example, `union(["a","b","c"],["b","c","d"])` returns ["a","b","c","d"].
+
+* `unique`: This function removes duplicates from strings and arrays. For example, `unique("aabbcc")` returns 'abc'.
+
+You can also use this with arrays. For example, `unique(["a","a","b","b","c","c"])` returns ["a","b","c"]. *Type*: rvalue
+
+* `upcase`: Converts a string or an array of strings to uppercase. For example, `upcase("abcd")` returns 'ABCD'. *Type*: rvalue
+
+* `uriescape`: Urlencodes a string or array of strings. Requires either a single string or an array as an input. *Type*: rvalue
+
+* `validate_absolute_path`: Validate the string represents an absolute path in the filesystem.  This function works for Windows and Unix style paths.
+
+    The following values will pass:
+
+    ```
+    $my_path = 'C:/Program Files (x86)/Puppet Labs/Puppet'
+    validate_absolute_path($my_path)
+    $my_path2 = '/var/lib/puppet'
+    validate_absolute_path($my_path2)
+    $my_path3 = ['C:/Program Files (x86)/Puppet Labs/Puppet','C:/Program Files/Puppet Labs/Puppet']
+    validate_absolute_path($my_path3)
+    $my_path4 = ['/var/lib/puppet','/usr/share/puppet']
+    validate_absolute_path($my_path4)
+    ```
+
+    The following values will fail, causing compilation to abort:
+
+    ```
+    validate_absolute_path(true)
+    validate_absolute_path('../var/lib/puppet')
+    validate_absolute_path('var/lib/puppet')
+    validate_absolute_path([ 'var/lib/puppet', '/var/foo' ])
+    validate_absolute_path([ '/var/lib/puppet', 'var/foo' ])
+    $undefined = undef
+    validate_absolute_path($undefined)
+    ```
+
+    *Type*: statement
+
+* `validate_array`: Validate that all passed values are array data structures. Abort catalog compilation if any value fails this check.
+
+  The following values will pass:
+
+  ```
+  $my_array = [ 'one', 'two' ]
+  validate_array($my_array)
+  ```
+
+  The following values will fail, causing compilation to abort:
+
+  ```
+  validate_array(true)
+  validate_array('some_string')
+  $undefined = undef
+  validate_array($undefined)
+  ```
+
+  *Type*: statement
+
+* `validate_augeas`: Performs validation of a string using an Augeas lens.
+The first argument of this function should be the string to test, and the second argument should be the name of the Augeas lens to use. If Augeas fails to parse the string with the lens, the compilation aborts with a parse error.
+
+  A third optional argument lists paths which should **not** be found in the file. The `$file` variable points to the location of the temporary file being tested in the Augeas tree.
+
+  For example, to make sure your passwd content never contains user `foo`:
+
+  ```
+  validate_augeas($passwdcontent, 'Passwd.lns', ['$file/foo'])
+  ```
+
+  To ensure that no users use the '/bin/barsh' shell:
+
+  ```
+  validate_augeas($passwdcontent, 'Passwd.lns', ['$file/*[shell="/bin/barsh"]']
+  ```
+
+  You can pass a fourth argument as the error message raised and shown to the user:
+
+  ```
+  validate_augeas($sudoerscontent, 'Sudoers.lns', [], 'Failed to validate sudoers content with Augeas')
+  ```
+
+  *Type*: statement
+
+* `validate_bool`: Validate that all passed values are either true or false. Abort catalog compilation if any value fails this check.
+
+  The following values will pass:
+
+  ```
+  $iamtrue = true
+  validate_bool(true)
+  validate_bool(true, true, false, $iamtrue)
+  ```
+
+  The following values will fail, causing compilation to abort:
+
+  ```
+  $some_array = [ true ]
+  validate_bool("false")
+  validate_bool("true")
+  validate_bool($some_array)
+  ```
+
+  *Type*: statement
+
+* `validate_cmd`: Performs validation of a string with an external command. The first argument of this function should be a string to test, and the second argument should be a path to a test command taking a % as a placeholder for the file path (will default to the end of the command if no % placeholder given). If the command, launched against a tempfile containing the passed string, returns a non-null value, compilation will abort with a parse error.
+
+If a third argument is specified, this will be the error message raised and seen by the user.
+
+  ```
+  # Defaults to end of path
+  validate_cmd($sudoerscontent, '/usr/sbin/visudo -c -f', 'Visudo failed to validate sudoers content')
+  ```
+  ```
+  # % as file location
+  validate_cmd($haproxycontent, '/usr/sbin/haproxy -f % -c', 'Haproxy failed to validate config content')
+  ```
+
+  *Type*: statement
+
+* `validate_hash`: Validates that all passed values are hash data structures. Abort catalog compilation if any value fails this check.
+
+  The following values will pass:
+
+  ```
+  $my_hash = { 'one' => 'two' }
+  validate_hash($my_hash)
+  ```
+
+  The following values will fail, causing compilation to abort:
+
+  ```
+  validate_hash(true)
+  validate_hash('some_string')
+  $undefined = undef
+  validate_hash($undefined)
+  ```
+
+  *Type*: statement
+
+* `validate_re`: Performs simple validation of a string against one or more regular expressions. The first argument of this function should be the string to
+test, and the second argument should be a stringified regular expression
+(without the // delimiters) or an array of regular expressions. If none
+of the regular expressions match the string passed in, compilation aborts with a parse error.
+
+  You can pass a third argument as the error message raised and shown to the user.
+
+  The following strings validate against the regular expressions:
+
+  ```
+  validate_re('one', '^one$')
+  validate_re('one', [ '^one', '^two' ])
+  ```
+
+  The following string fails to validate, causing compilation to abort:
+
+  ```
+  validate_re('one', [ '^two', '^three' ])
+  ```
+
+  To set the error message:
+
+  ```
+  validate_re($::puppetversion, '^2.7', 'The $puppetversion fact value does not match 2.7')
+  ```
+
+  *Type*: statement
+
+* `validate_slength`: Validates that the first argument is a string (or an array of strings), and is less than or equal to the length of the second argument. It fails if the first argument is not a string or array of strings, or if arg 2 is not convertable to a number.
+
+  The following values pass:
+
+  ```
+  validate_slength("discombobulate",17)
+  validate_slength(["discombobulate","moo"],17)
+  ```
+
+  The following values fail:
+
+  ```
+  validate_slength("discombobulate",1)
+  validate_slength(["discombobulate","thermometer"],5)
+  ```
+
+  *Type*: statement
+
+* `validate_string`: Validates that all passed values are string data structures. Aborts catalog compilation if any value fails this check.
+
+  The following values pass:
+
+  ```
+  $my_string = "one two"
+  validate_string($my_string, 'three')
+  ```
+
+  The following values fail, causing compilation to abort:
+
+  ```
+  validate_string(true)
+  validate_string([ 'some', 'array' ])
+  $undefined = undef
+  validate_string($undefined)
+  ```
+
+  *Type*: statement
+
+* `values`: When given a hash, this function returns the values of that hash.
+
+  *Examples:*
+
+  ```
+  $hash = {
+    'a' => 1,
+    'b' => 2,
+    'c' => 3,
+  }
+  values($hash)
+  ```
+
+  The example above returns [1,2,3].
+
+  *Type*: rvalue
+
+* `values_at`: Finds value inside an array based on location. The first argument is the array you want to analyze, and the second element can be a combination of:
+
+  * A single numeric index
+  * A range in the form of 'start-stop' (eg. 4-9)
+  * An array combining the above
+
+  For example, `values_at(['a','b','c'], 2)` returns ['c']; `values_at(['a','b','c'], ["0-1"])` returns ['a','b']; and `values_at(['a','b','c','d','e'], [0, "2-3"])` returns ['a','c','d'].
+
+  *Type*: rvalue
+
+* `zip`: Takes one element from first array and merges corresponding elements from second array. This generates a sequence of n-element arrays, where n is one more than the count of arguments. For example, `zip(['1','2','3'],['4','5','6'])` results in ["1", "4"], ["2", "5"], ["3", "6"]. *Type*: rvalue
+
+##Limitations
+
+As of Puppet Enterprise version 3.7, the stdlib module is no longer included in PE. PE users should install the most recent release of stdlib for compatibility with Puppet modules.
+
+###Version Compatibility
+
+Versions | Puppet 2.6 | Puppet 2.7 | Puppet 3.x | Puppet 4.x |
+:---------------|:-----:|:---:|:---:|:----:
+**stdlib 2.x**  | **yes** | **yes** | no | no
+**stdlib 3.x**  | no    | **yes**  | **yes** | no
+**stdlib 4.x**  | no    | **yes**  | **yes** | no
+**stdlib 5.x**  | no    | no  | **yes**  | **yes**
+
+**stdlib 5.x**: When released, stdlib 5.x will drop support for Puppet 2.7.x. Please see [this discussion](https://github.com/puppetlabs/puppetlabs-stdlib/pull/176#issuecomment-30251414).
+
+##Development
+
+Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can’t access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
+
+We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
+
+You can read the complete module contribution guide on the [Puppet Labs wiki](http://projects.puppetlabs.com/projects/module-site/wiki/Module_contributing).
+
+To report or research a bug with any part of this module, please go to
+[http://tickets.puppetlabs.com/browse/PUP](http://tickets.puppetlabs.com/browse/PUP).
+
+##Contributors
+
+The list of contributors can be found at: https://github.com/puppetlabs/puppetlabs-stdlib/graphs/contributors
+
+
+
+
diff --git a/puppet/modules/stdlib/README_DEVELOPER.markdown b/puppet/modules/stdlib/README_DEVELOPER.markdown
new file mode 100644
index 00000000..04349ed7
--- /dev/null
+++ b/puppet/modules/stdlib/README_DEVELOPER.markdown
@@ -0,0 +1,35 @@
+Puppet Specific Facts
+=====================
+
+Facter is meant to stand alone and apart from Puppet.  However, Facter often
+runs inside Puppet and all custom facts included in the stdlib module will
+almost always be evaluated in the context of Puppet and Facter working
+together.
+
+Still, we don't want to write custom facts that blow up in the users face if
+Puppet is not loaded in memory.  This is often the case if the user runs
+`facter` without also supplying the `--puppet` flag.
+
+Ah! But Jeff, the custom fact won't be in the `$LOAD_PATH` unless the user
+supplies `--facter`! You might say...
+
+Not (always) true I say!  If the user happens to have a CWD of
+`<modulepath>/stdlib/lib` then the facts will automatically be evaluated and
+blow up.
+
+In any event, it's pretty easy to write a fact that has no value if Puppet is
+not loaded.  Simply do it like this:
+
+    Facter.add(:node_vardir) do
+      setcode do
+        # This will be nil if Puppet is not available.
+        Facter::Util::PuppetSettings.with_puppet do
+          Puppet[:vardir]
+        end
+      end
+    end
+
+The `Facter::Util::PuppetSettings.with_puppet` method accepts a block and
+yields to it only if the Puppet library is loaded.  If the Puppet library is
+not loaded, then the method silently returns `nil` which Facter interprets as
+an undefined fact value.  The net effect is that the fact won't be set.
diff --git a/puppet/modules/stdlib/README_SPECS.markdown b/puppet/modules/stdlib/README_SPECS.markdown
new file mode 100644
index 00000000..917b6310
--- /dev/null
+++ b/puppet/modules/stdlib/README_SPECS.markdown
@@ -0,0 +1,7 @@
+NOTE
+====
+
+This project's specs depend on puppet core, and thus they require the
+`puppetlabs_spec_helper` project.  For more information please see the README
+in that project, which can be found here: [puppetlabs spec
+helper](https://github.com/puppetlabs/puppetlabs_spec_helper)
diff --git a/puppet/modules/stdlib/RELEASE_PROCESS.markdown b/puppet/modules/stdlib/RELEASE_PROCESS.markdown
new file mode 100644
index 00000000..0f9328ed
--- /dev/null
+++ b/puppet/modules/stdlib/RELEASE_PROCESS.markdown
@@ -0,0 +1,24 @@
+# Contributing to this module #
+
+ * Work in a topic branch
+ * Submit a github pull request
+ * Address any comments / feeback
+ * Merge into master using --no-ff
+
+# Releasing this module #
+
+ * This module adheres to http://semver.org/
+ * Look for API breaking changes using git diff vX.Y.Z..master
+   * If no API breaking changes, the minor version may be bumped.
+   * If there are API breaking changes, the major version must be bumped.
+   * If there are only small minor changes, the patch version may be bumped.
+ * Update the CHANGELOG
+ * Update the Modulefile
+ * Commit these changes with a message along the lines of "Update CHANGELOG and
+   Modulefile for release"
+ * Create an annotated tag with git tag -a vX.Y.Z -m 'version X.Y.Z' (NOTE the
+   leading v as per semver.org)
+ * Push the tag with git push origin --tags
+ * Build a new package with puppet-module or the rake build task if it exists
+ * Publish the new package to the forge
+ * Bonus points for an announcement to puppet-users.
diff --git a/puppet/modules/stdlib/Rakefile b/puppet/modules/stdlib/Rakefile
new file mode 100644
index 00000000..4ed1327a
--- /dev/null
+++ b/puppet/modules/stdlib/Rakefile
@@ -0,0 +1,18 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
+
+desc "Validate manifests, templates, and ruby files in lib."
+task :validate do
+  Dir['manifests/**/*.pp'].each do |manifest|
+    sh "puppet parser validate --noop #{manifest}"
+  end
+  Dir['lib/**/*.rb'].each do |lib_file|
+    sh "ruby -c #{lib_file}"
+  end
+  Dir['templates/**/*.erb'].each do |template|
+    sh "erb -P -x -T '-' #{template} | ruby -c"
+  end
+end
diff --git a/puppet/modules/stdlib/lib/facter/facter_dot_d.rb b/puppet/modules/stdlib/lib/facter/facter_dot_d.rb
new file mode 100644
index 00000000..b0584370
--- /dev/null
+++ b/puppet/modules/stdlib/lib/facter/facter_dot_d.rb
@@ -0,0 +1,202 @@
+# A Facter plugin that loads facts from /etc/facter/facts.d
+# and /etc/puppetlabs/facter/facts.d.
+#
+# Facts can be in the form of JSON, YAML or Text files
+# and any executable that returns key=value pairs.
+#
+# In the case of scripts you can also create a file that
+# contains a cache TTL.  For foo.sh store the ttl as just
+# a number in foo.sh.ttl
+#
+# The cache is stored in /tmp/facts_cache.yaml as a mode
+# 600 file and will have the end result of not calling your
+# fact scripts more often than is needed
+
+class Facter::Util::DotD
+  require 'yaml'
+
+  def initialize(dir="/etc/facts.d", cache_file=File.join(Puppet[:libdir], "facts_dot_d.cache"))
+    @dir = dir
+    @cache_file = cache_file
+    @cache = nil
+    @types = {".txt" => :txt, ".json" => :json, ".yaml" => :yaml}
+  end
+
+  def entries
+    Dir.entries(@dir).reject { |f| f =~ /^\.|\.ttl$/ }.sort.map { |f| File.join(@dir, f) }
+  rescue
+    []
+  end
+
+  def fact_type(file)
+    extension = File.extname(file)
+
+    type = @types[extension] || :unknown
+
+    type = :script if type == :unknown && File.executable?(file)
+
+    return type
+  end
+
+  def txt_parser(file)
+    File.readlines(file).each do |line|
+      if line =~ /^([^=]+)=(.+)$/
+        var = $1; val = $2
+
+        Facter.add(var) do
+          setcode { val }
+        end
+      end
+    end
+  rescue Exception => e
+    Facter.warn("Failed to handle #{file} as text facts: #{e.class}: #{e}")
+  end
+
+  def json_parser(file)
+    begin
+      require 'json'
+    rescue LoadError
+      retry if require 'rubygems'
+      raise
+    end
+
+    JSON.load(File.read(file)).each_pair do |f, v|
+      Facter.add(f) do
+        setcode { v }
+      end
+    end
+  rescue Exception => e
+    Facter.warn("Failed to handle #{file} as json facts: #{e.class}: #{e}")
+  end
+
+  def yaml_parser(file)
+    require 'yaml'
+
+    YAML.load_file(file).each_pair do |f, v|
+      Facter.add(f) do
+        setcode { v }
+      end
+    end
+  rescue Exception => e
+    Facter.warn("Failed to handle #{file} as yaml facts: #{e.class}: #{e}")
+  end
+
+  def script_parser(file)
+    result = cache_lookup(file)
+    ttl = cache_time(file)
+
+    unless result
+      result = Facter::Util::Resolution.exec(file)
+
+      if ttl > 0
+        Facter.debug("Updating cache for #{file}")
+        cache_store(file, result)
+        cache_save!
+      end
+    else
+      Facter.debug("Using cached data for #{file}")
+    end
+
+    result.split("\n").each do |line|
+      if line =~ /^(.+)=(.+)$/
+        var = $1; val = $2
+
+        Facter.add(var) do
+          setcode { val }
+        end
+      end
+    end
+  rescue Exception => e
+    Facter.warn("Failed to handle #{file} as script facts: #{e.class}: #{e}")
+    Facter.debug(e.backtrace.join("\n\t"))
+  end
+
+  def cache_save!
+    cache = load_cache
+    File.open(@cache_file, "w", 0600) { |f| f.write(YAML.dump(cache)) }
+  rescue
+  end
+
+  def cache_store(file, data)
+    load_cache
+
+    @cache[file] = {:data => data, :stored => Time.now.to_i}
+  rescue
+  end
+
+  def cache_lookup(file)
+    cache = load_cache
+
+    return nil if cache.empty?
+
+    ttl = cache_time(file)
+
+    if cache[file]
+      now = Time.now.to_i
+
+      return cache[file][:data] if ttl == -1
+      return cache[file][:data] if (now - cache[file][:stored]) <= ttl
+      return nil
+    else
+      return nil
+    end
+  rescue
+    return nil
+  end
+
+  def cache_time(file)
+    meta = file + ".ttl"
+
+    return File.read(meta).chomp.to_i
+  rescue
+    return 0
+  end
+
+  def load_cache
+    unless @cache
+      if File.exist?(@cache_file)
+        @cache = YAML.load_file(@cache_file)
+      else
+        @cache = {}
+      end
+    end
+
+    return @cache
+  rescue
+    @cache = {}
+    return @cache
+  end
+
+  def create
+    entries.each do |fact|
+      type = fact_type(fact)
+      parser = "#{type}_parser"
+
+      if respond_to?("#{type}_parser")
+        Facter.debug("Parsing #{fact} using #{parser}")
+
+        send(parser, fact)
+      end
+    end
+  end
+end
+
+
+mdata = Facter.version.match(/(\d+)\.(\d+)\.(\d+)/)
+if mdata
+  (major, minor, patch) = mdata.captures.map { |v| v.to_i }
+  if major < 2
+    # Facter 1.7 introduced external facts support directly
+    unless major == 1 and minor > 6
+      Facter::Util::DotD.new("/etc/facter/facts.d").create
+      Facter::Util::DotD.new("/etc/puppetlabs/facter/facts.d").create
+
+      # Windows has a different configuration directory that defaults to a vendor
+      # specific sub directory of the %COMMON_APPDATA% directory.
+      if Dir.const_defined? 'COMMON_APPDATA' then
+        windows_facts_dot_d = File.join(Dir::COMMON_APPDATA, 'PuppetLabs', 'facter', 'facts.d')
+        Facter::Util::DotD.new(windows_facts_dot_d).create
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/facter/netmask_cidr_interface.rb b/puppet/modules/stdlib/lib/facter/netmask_cidr_interface.rb
new file mode 100644
index 00000000..d628d08c
--- /dev/null
+++ b/puppet/modules/stdlib/lib/facter/netmask_cidr_interface.rb
@@ -0,0 +1,22 @@
+# adds netmask facts for each interface in cidr notation
+# i.e.:
+# ...
+# netmask_cidr_eth2 => 24
+# netmask_cidr_lo => 8
+# netmask_cidr_tun0 => 32
+# netmask_cidr_virbr0 => 24
+# ...
+
+require 'facter/util/ip'
+
+Facter::Util::IP.get_interfaces.each do |interface|
+  netmask = Facter.value("netmask_#{interface}")
+  if netmask != nil
+    Facter.add("netmask_cidr_" + interface ) do
+      setcode do
+        cidr_netmask=IPAddr.new(netmask).to_i.to_s(2).count("1")
+        cidr_netmask
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/facter/pe_version.rb b/puppet/modules/stdlib/lib/facter/pe_version.rb
new file mode 100644
index 00000000..0cc0f64e
--- /dev/null
+++ b/puppet/modules/stdlib/lib/facter/pe_version.rb
@@ -0,0 +1,53 @@
+# Fact: is_pe, pe_version, pe_major_version, pe_minor_version, pe_patch_version
+#
+# Purpose: Return various facts about the PE state of the system
+#
+# Resolution: Uses a regex match against puppetversion to determine whether the
+#   machine has Puppet Enterprise installed, and what version (overall, major,
+#   minor, patch) is installed.
+#
+# Caveats:
+#
+Facter.add("pe_version") do
+  setcode do
+    pe_ver = Facter.value("puppetversion").match(/Puppet Enterprise (\d+\.\d+\.\d+)/)
+    pe_ver[1] if pe_ver
+  end
+end
+
+Facter.add("is_pe") do
+  setcode do
+    if Facter.value(:pe_version).to_s.empty? then
+      false
+    else
+      true
+    end
+  end
+end
+
+Facter.add("pe_major_version") do
+  confine :is_pe => true
+  setcode do
+    if pe_version = Facter.value(:pe_version)
+      pe_version.to_s.split('.')[0]
+    end
+  end
+end
+
+Facter.add("pe_minor_version") do
+  confine :is_pe => true
+  setcode do
+    if pe_version = Facter.value(:pe_version)
+      pe_version.to_s.split('.')[1]
+    end
+  end
+end
+
+Facter.add("pe_patch_version") do
+  confine :is_pe => true
+  setcode do
+    if pe_version = Facter.value(:pe_version)
+      pe_version.to_s.split('.')[2]
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/facter/puppet_vardir.rb b/puppet/modules/stdlib/lib/facter/puppet_vardir.rb
new file mode 100644
index 00000000..0e6af40e
--- /dev/null
+++ b/puppet/modules/stdlib/lib/facter/puppet_vardir.rb
@@ -0,0 +1,26 @@
+# This facter fact returns the value of the Puppet vardir setting for the node
+# running puppet or puppet agent.  The intent is to enable Puppet modules to
+# automatically have insight into a place where they can place variable data,
+# regardless of the node's platform.
+#
+# The value should be directly usable in a File resource path attribute.
+
+
+begin
+  require 'facter/util/puppet_settings'
+rescue LoadError => e
+  # puppet apply does not add module lib directories to the $LOAD_PATH (See
+  # #4248). It should (in the future) but for the time being we need to be
+  # defensive which is what this rescue block is doing.
+  rb_file = File.join(File.dirname(__FILE__), 'util', 'puppet_settings.rb')
+  load rb_file if File.exists?(rb_file) or raise e
+end
+
+Facter.add(:puppet_vardir) do
+  setcode do
+    # This will be nil if Puppet is not available.
+    Facter::Util::PuppetSettings.with_puppet do
+      Puppet[:vardir]
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/facter/root_home.rb b/puppet/modules/stdlib/lib/facter/root_home.rb
new file mode 100644
index 00000000..b4f87ff2
--- /dev/null
+++ b/puppet/modules/stdlib/lib/facter/root_home.rb
@@ -0,0 +1,32 @@
+# A facter fact to determine the root home directory.
+# This varies on PE supported platforms and may be
+# reconfigured by the end user.
+
+module Facter::Util::RootHome
+  class << self
+  def get_root_home
+    root_ent = Facter::Util::Resolution.exec("getent passwd root")
+    # The home directory is the sixth element in the passwd entry
+    # If the platform doesn't have getent, root_ent will be nil and we should
+    # return it straight away.
+    root_ent && root_ent.split(":")[5]
+  end
+  end
+end
+
+Facter.add(:root_home) do
+  setcode { Facter::Util::RootHome.get_root_home }
+end
+
+Facter.add(:root_home) do
+  confine :kernel => :darwin
+  setcode do
+    str = Facter::Util::Resolution.exec("dscacheutil -q user -a name root")
+    hash = {}
+    str.split("\n").each do |pair|
+      key,value = pair.split(/:/)
+      hash[key] = value
+    end
+    hash['dir'].strip
+  end
+end
diff --git a/puppet/modules/stdlib/lib/facter/util/puppet_settings.rb b/puppet/modules/stdlib/lib/facter/util/puppet_settings.rb
new file mode 100644
index 00000000..1ad94521
--- /dev/null
+++ b/puppet/modules/stdlib/lib/facter/util/puppet_settings.rb
@@ -0,0 +1,21 @@
+module Facter
+  module Util
+    module PuppetSettings
+      # This method is intended to provide a convenient way to evaluate a
+      # Facter code block only if Puppet is loaded.  This is to account for the
+      # situation where the fact happens to be in the load path, but Puppet is
+      # not loaded for whatever reason.  Perhaps the user is simply running
+      # facter without the --puppet flag and they happen to be working in a lib
+      # directory of a module.
+      def self.with_puppet
+        begin
+          Module.const_get("Puppet")
+        rescue NameError
+          nil
+        else
+          yield
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/functions/type_of.rb b/puppet/modules/stdlib/lib/puppet/functions/type_of.rb
new file mode 100644
index 00000000..02cdd4db
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/functions/type_of.rb
@@ -0,0 +1,17 @@
+# Returns the type when passed a value.
+#
+# @example how to compare values' types
+#   # compare the types of two values
+#   if type_of($first_value) != type_of($second_value) { fail("first_value and second_value are different types") }
+# @example how to compare against an abstract type
+#   unless type_of($first_value) <= Numeric { fail("first_value must be Numeric") }
+#   unless type_of{$first_value) <= Collection[1] { fail("first_value must be an Array or Hash, and contain at least one element") }
+#
+# See the documentation for "The Puppet Type System" for more information about types.
+# See the `assert_type()` function for flexible ways to assert the type of a value.
+#
+Puppet::Functions.create_function(:type_of) do
+  def type_of(value)
+    Puppet::Pops::Types::TypeCalculator.infer_set(value)
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/abs.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/abs.rb
new file mode 100644
index 00000000..11d2d7fe
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/abs.rb
@@ -0,0 +1,36 @@
+#
+# abs.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:abs, :type => :rvalue, :doc => <<-EOS
+    Returns the absolute value of a number, for example -34.56 becomes
+    34.56. Takes a single integer and float value as an argument.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "abs(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    # Numbers in Puppet are often string-encoded which is troublesome ...
+    if value.is_a?(String)
+      if value.match(/^-?(?:\d+)(?:\.\d+){1}$/)
+        value = value.to_f
+      elsif value.match(/^-?\d+$/)
+        value = value.to_i
+      else
+        raise(Puppet::ParseError, 'abs(): Requires float or ' +
+          'integer to work with')
+      end
+    end
+
+    # We have numeric value to handle ...
+    result = value.abs
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/any2array.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/any2array.rb
new file mode 100644
index 00000000..e71407e8
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/any2array.rb
@@ -0,0 +1,33 @@
+#
+# any2array.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:any2array, :type => :rvalue, :doc => <<-EOS
+This converts any object to an array containing that object. Empty argument
+lists are converted to an empty array. Arrays are left untouched. Hashes are
+converted to arrays of alternating keys and values.
+    EOS
+  ) do |arguments|
+
+    if arguments.empty?
+        return []
+    end
+
+    if arguments.length == 1
+        if arguments[0].kind_of?(Array)
+            return arguments[0]
+        elsif arguments[0].kind_of?(Hash)
+            result = []
+            arguments[0].each do |key, value|
+                result << key << value
+            end
+            return result
+        end
+    end
+
+    return arguments
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/base64.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/base64.rb
new file mode 100644
index 00000000..617ba31b
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/base64.rb
@@ -0,0 +1,37 @@
+module Puppet::Parser::Functions
+
+  newfunction(:base64, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args|
+
+    Base64 encode or decode a string based on the command and the string submitted
+
+    Usage:
+
+      $encodestring = base64('encode','thestring')
+      $decodestring = base64('decode','dGhlc3RyaW5n')
+
+    ENDHEREDOC
+
+    require 'base64'
+
+    raise Puppet::ParseError, ("base64(): Wrong number of arguments (#{args.length}; must be = 2)") unless args.length == 2
+
+    actions = ['encode','decode']
+
+    unless actions.include?(args[0])
+      raise Puppet::ParseError, ("base64(): the first argument must be one of 'encode' or 'decode'")
+    end
+
+    unless args[1].is_a?(String)
+      raise Puppet::ParseError, ("base64(): the second argument must be a string to base64")
+    end
+
+    case args[0]
+      when 'encode'
+        result = Base64.encode64(args[1])
+      when 'decode'
+        result = Base64.decode64(args[1])
+    end
+
+    return result
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/basename.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/basename.rb
new file mode 100644
index 00000000..f7e44384
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/basename.rb
@@ -0,0 +1,34 @@
+module Puppet::Parser::Functions
+  newfunction(:basename, :type => :rvalue, :doc => <<-EOS
+    Strips directory (and optional suffix) from a filename
+    EOS
+  ) do |arguments|
+
+    if arguments.size < 1 then
+      raise(Puppet::ParseError, "basename(): No arguments given")
+    elsif arguments.size > 2 then
+      raise(Puppet::ParseError, "basename(): Too many arguments given (#{arguments.size})")
+    else
+
+      unless arguments[0].is_a?(String)
+        raise(Puppet::ParseError, 'basename(): Requires string as first argument')
+      end
+
+      if arguments.size == 1 then
+        rv = File.basename(arguments[0])
+      elsif arguments.size == 2 then
+
+        unless arguments[1].is_a?(String)
+          raise(Puppet::ParseError, 'basename(): Requires string as second argument')
+        end
+
+        rv = File.basename(arguments[0], arguments[1])
+      end
+
+    end
+
+    return rv
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/bool2num.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/bool2num.rb
new file mode 100644
index 00000000..6ad6cf4e
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/bool2num.rb
@@ -0,0 +1,26 @@
+#
+# bool2num.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:bool2num, :type => :rvalue, :doc => <<-EOS
+    Converts a boolean to a number. Converts the values:
+      false, f, 0, n, and no to 0
+      true, t, 1, y, and yes to 1
+    Requires a single boolean or string as an input.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "bool2num(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = function_str2bool([arguments[0]])
+
+    # We have real boolean values as well ...
+    result = value ? 1 : 0
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/bool2str.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/bool2str.rb
new file mode 100644
index 00000000..fcd37917
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/bool2str.rb
@@ -0,0 +1,27 @@
+#
+# bool2str.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:bool2str, :type => :rvalue, :doc => <<-EOS
+    Converts a boolean to a string.
+    Requires a single boolean as an input.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "bool2str(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+    klass = value.class
+
+    # We can have either true or false, and nothing else
+    unless [FalseClass, TrueClass].include?(klass)
+      raise(Puppet::ParseError, 'bool2str(): Requires a boolean to work with')
+    end
+
+    return value.to_s
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/camelcase.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/camelcase.rb
new file mode 100644
index 00000000..d7f43f7a
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/camelcase.rb
@@ -0,0 +1,33 @@
+#
+#  camelcase.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:camelcase, :type => :rvalue, :doc => <<-EOS
+Converts the case of a string or all strings in an array to camel case.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "camelcase(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+    klass = value.class
+
+    unless [Array, String].include?(klass)
+      raise(Puppet::ParseError, 'camelcase(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? i.split('_').map{|e| e.capitalize}.join : i }
+    else
+      result = value.split('_').map{|e| e.capitalize}.join
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/capitalize.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/capitalize.rb
new file mode 100644
index 00000000..98b2d16c
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/capitalize.rb
@@ -0,0 +1,33 @@
+#
+#  capitalize.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:capitalize, :type => :rvalue, :doc => <<-EOS
+    Capitalizes the first letter of a string or array of strings.
+    Requires either a single string or an array as an input.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "capitalize(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'capitalize(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? i.capitalize : i }
+    else
+      result = value.capitalize
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/chomp.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/chomp.rb
new file mode 100644
index 00000000..c55841e3
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/chomp.rb
@@ -0,0 +1,34 @@
+#
+#  chomp.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:chomp, :type => :rvalue, :doc => <<-'EOS'
+    Removes the record separator from the end of a string or an array of
+    strings, for example `hello\n` becomes `hello`.
+    Requires a single string or array as an input.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "chomp(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'chomp(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? i.chomp : i }
+    else
+      result = value.chomp
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/chop.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/chop.rb
new file mode 100644
index 00000000..b24ab785
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/chop.rb
@@ -0,0 +1,36 @@
+#
+#  chop.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:chop, :type => :rvalue, :doc => <<-'EOS'
+    Returns a new string with the last character removed. If the string ends
+    with `\r\n`, both characters are removed. Applying chop to an empty
+    string returns an empty string. If you wish to merely remove record
+    separators then you should use the `chomp` function.
+    Requires a string or array of strings as input.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "chop(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'chop(): Requires either an ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? i.chop : i }
+    else
+      result = value.chop
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/concat.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/concat.rb
new file mode 100644
index 00000000..618e62d4
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/concat.rb
@@ -0,0 +1,41 @@
+#
+# concat.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:concat, :type => :rvalue, :doc => <<-EOS
+Appends the contents of multiple arrays into array 1.
+
+*Example:*
+
+    concat(['1','2','3'],['4','5','6'],['7','8','9'])
+
+Would result in:
+
+  ['1','2','3','4','5','6','7','8','9']
+    EOS
+  ) do |arguments|
+
+    # Check that more than 2 arguments have been given ...
+    raise(Puppet::ParseError, "concat(): Wrong number of arguments " +
+      "given (#{arguments.size} for < 2)") if arguments.size < 2
+
+    a = arguments[0]
+
+    # Check that the first parameter is an array
+    unless a.is_a?(Array)
+      raise(Puppet::ParseError, 'concat(): Requires array to work with')
+    end
+
+    result = a
+    arguments.shift
+
+    arguments.each do |x|
+      result = result + Array(x)
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/count.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/count.rb
new file mode 100644
index 00000000..52de1b8a
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/count.rb
@@ -0,0 +1,22 @@
+module Puppet::Parser::Functions
+  newfunction(:count, :type => :rvalue, :arity => -2, :doc => <<-EOS
+Takes an array as first argument and an optional second argument.
+Count the number of elements in array that matches second argument.
+If called with only an array it counts the number of elements that are not nil/undef.
+    EOS
+  ) do |args|
+
+    if (args.size > 2) then
+      raise(ArgumentError, "count(): Wrong number of arguments "+
+        "given #{args.size} for 1 or 2.")
+    end
+
+    collection, item = args
+
+    if item then
+      collection.count item
+    else
+      collection.count { |obj| obj != nil && obj != :undef && obj != '' }
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb
new file mode 100644
index 00000000..6df32e9c
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/deep_merge.rb
@@ -0,0 +1,44 @@
+module Puppet::Parser::Functions
+  newfunction(:deep_merge, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args|
+    Recursively merges two or more hashes together and returns the resulting hash.
+
+    For example:
+
+        $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } }
+        $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } }
+        $merged_hash = deep_merge($hash1, $hash2)
+        # The resulting hash is equivalent to:
+        # $merged_hash = { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } }
+
+    When there is a duplicate key that is a hash, they are recursively merged.
+    When there is a duplicate key that is not a hash, the key in the rightmost hash will "win."
+
+    ENDHEREDOC
+
+    if args.length < 2
+      raise Puppet::ParseError, ("deep_merge(): wrong number of arguments (#{args.length}; must be at least 2)")
+    end
+
+    deep_merge = Proc.new do |hash1,hash2|
+      hash1.merge(hash2) do |key,old_value,new_value|
+        if old_value.is_a?(Hash) && new_value.is_a?(Hash)
+          deep_merge.call(old_value, new_value)
+        else
+          new_value
+        end
+      end
+    end
+
+    result = Hash.new
+    args.each do |arg|
+      next if arg.is_a? String and arg.empty? # empty string is synonym for puppet's undef
+      # If the argument was not a hash, skip it.
+      unless arg.is_a?(Hash)
+        raise Puppet::ParseError, "deep_merge: unexpected argument type #{arg.class}, only expects hash arguments"
+      end
+
+      result = deep_merge.call(result, arg)
+    end
+    return( result )
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb
new file mode 100644
index 00000000..d7df306c
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/defined_with_params.rb
@@ -0,0 +1,35 @@
+# Test whether a given class or definition is defined
+require 'puppet/parser/functions'
+
+Puppet::Parser::Functions.newfunction(:defined_with_params,
+                                      :type => :rvalue,
+                                      :doc => <<-'ENDOFDOC'
+Takes a resource reference and an optional hash of attributes.
+
+Returns true if a resource with the specified attributes has already been added
+to the catalog, and false otherwise.
+
+    user { 'dan':
+      ensure => present,
+    }
+
+    if ! defined_with_params(User[dan], {'ensure' => 'present' }) {
+      user { 'dan': ensure => present, }
+    }
+ENDOFDOC
+) do |vals|
+  reference, params = vals
+  raise(ArgumentError, 'Must specify a reference') unless reference
+  if (! params) || params == ''
+    params = {}
+  end
+  ret = false
+  if resource = findresource(reference.to_s)
+    matches = params.collect do |key, value|
+      resource[key] == value
+    end
+    ret = params.empty? || !matches.include?(false)
+  end
+  Puppet.debug("Resource #{reference} was not determined to be defined")
+  ret
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/delete.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/delete.rb
new file mode 100644
index 00000000..f548b444
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/delete.rb
@@ -0,0 +1,49 @@
+#
+# delete.rb
+#
+
+# TODO(Krzysztof Wilczynski): We need to add support for regular expression ...
+
+module Puppet::Parser::Functions
+  newfunction(:delete, :type => :rvalue, :doc => <<-EOS
+Deletes all instances of a given element from an array, substring from a
+string, or key from a hash.
+
+*Examples:*
+
+    delete(['a','b','c','b'], 'b')
+    Would return: ['a','c']
+
+    delete({'a'=>1,'b'=>2,'c'=>3}, 'b')
+    Would return: {'a'=>1,'c'=>3}
+
+    delete({'a'=>1,'b'=>2,'c'=>3}, ['b','c'])
+    Would return: {'a'=>1}
+
+    delete('abracadabra', 'bra')
+    Would return: 'acada'
+  EOS
+  ) do |arguments|
+
+    if (arguments.size != 2) then
+      raise(Puppet::ParseError, "delete(): Wrong number of arguments "+
+                                  "given #{arguments.size} for 2.")
+    end
+
+    collection = arguments[0].dup
+    Array(arguments[1]).each do |item|
+      case collection
+        when Array, Hash
+          collection.delete item
+        when String
+          collection.gsub! item, ''
+        else
+          raise(TypeError, "delete(): First argument must be an Array, " +
+                             "String, or Hash. Given an argument of class #{collection.class}.")
+      end
+    end
+    collection
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/delete_at.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/delete_at.rb
new file mode 100644
index 00000000..3eb4b537
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/delete_at.rb
@@ -0,0 +1,49 @@
+#
+# delete_at.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:delete_at, :type => :rvalue, :doc => <<-EOS
+Deletes a determined indexed value from an array.
+
+*Examples:*
+
+    delete_at(['a','b','c'], 1)
+
+Would return: ['a','c']
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "delete_at(): Wrong number of arguments " +
+      "given (#{arguments.size} for 2)") if arguments.size < 2
+
+    array = arguments[0]
+
+    unless array.is_a?(Array)
+      raise(Puppet::ParseError, 'delete_at(): Requires array to work with')
+    end
+
+    index = arguments[1]
+
+    if index.is_a?(String) and not index.match(/^\d+$/)
+      raise(Puppet::ParseError, 'delete_at(): You must provide ' +
+        'non-negative numeric index')
+    end
+
+    result = array.clone
+
+    # Numbers in Puppet are often string-encoded which is troublesome ...
+    index = index.to_i
+
+    if index > result.size - 1 # First element is at index 0 is it not?
+      raise(Puppet::ParseError, 'delete_at(): Given index ' +
+        'exceeds size of array given')
+    end
+
+    result.delete_at(index) # We ignore the element that got deleted ...
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb
new file mode 100644
index 00000000..f94d4da8
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/delete_undef_values.rb
@@ -0,0 +1,34 @@
+module Puppet::Parser::Functions
+  newfunction(:delete_undef_values, :type => :rvalue, :doc => <<-EOS
+Returns a copy of input hash or array with all undefs deleted.
+
+*Examples:*
+
+    $hash = delete_undef_values({a=>'A', b=>'', c=>undef, d => false})
+
+Would return: {a => 'A', b => '', d => false}
+
+    $array = delete_undef_values(['A','',undef,false])
+
+Would return: ['A','',false]
+
+      EOS
+    ) do |args|
+
+    raise(Puppet::ParseError,
+          "delete_undef_values(): Wrong number of arguments given " +
+          "(#{args.size})") if args.size < 1
+
+    unless args[0].is_a? Array or args[0].is_a? Hash
+      raise(Puppet::ParseError,
+            "delete_undef_values(): expected an array or hash, got #{args[0]} type  #{args[0].class} ")
+    end
+    result = args[0].dup
+    if result.is_a?(Hash)
+      result.delete_if {|key, val| val.equal? :undef}
+    elsif result.is_a?(Array)
+      result.delete :undef
+    end
+    result
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/delete_values.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/delete_values.rb
new file mode 100644
index 00000000..f6c8c0e6
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/delete_values.rb
@@ -0,0 +1,26 @@
+module Puppet::Parser::Functions
+  newfunction(:delete_values, :type => :rvalue, :doc => <<-EOS
+Deletes all instances of a given value from a hash.
+
+*Examples:*
+
+    delete_values({'a'=>'A','b'=>'B','c'=>'C','B'=>'D'}, 'B')
+
+Would return: {'a'=>'A','c'=>'C','B'=>'D'}
+
+      EOS
+    ) do |arguments|
+
+    raise(Puppet::ParseError,
+          "delete_values(): Wrong number of arguments given " +
+          "(#{arguments.size} of 2)") if arguments.size != 2
+
+    hash, item = arguments
+
+    if not hash.is_a?(Hash)
+      raise(TypeError, "delete_values(): First argument must be a Hash. " + \
+                       "Given an argument of class #{hash.class}.")
+    end
+    hash.dup.delete_if { |key, val| item == val }
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/difference.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/difference.rb
new file mode 100644
index 00000000..cd258f75
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/difference.rb
@@ -0,0 +1,36 @@
+#
+# difference.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:difference, :type => :rvalue, :doc => <<-EOS
+This function returns the difference between two arrays.
+The returned array is a copy of the original array, removing any items that
+also appear in the second array.
+
+*Examples:*
+
+    difference(["a","b","c"],["b","c","d"])
+
+Would return: ["a"]
+    EOS
+  ) do |arguments|
+
+    # Two arguments are required
+    raise(Puppet::ParseError, "difference(): Wrong number of arguments " +
+      "given (#{arguments.size} for 2)") if arguments.size != 2
+
+    first = arguments[0]
+    second = arguments[1]
+
+    unless first.is_a?(Array) && second.is_a?(Array)
+      raise(Puppet::ParseError, 'difference(): Requires 2 arrays')
+    end
+
+    result = first - second
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/dirname.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/dirname.rb
new file mode 100644
index 00000000..ea8cc1e0
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/dirname.rb
@@ -0,0 +1,15 @@
+module Puppet::Parser::Functions
+  newfunction(:dirname, :type => :rvalue, :doc => <<-EOS
+    Returns the dirname of a path.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "dirname(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    path = arguments[0]
+    return File.dirname(path)
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/downcase.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/downcase.rb
new file mode 100644
index 00000000..040b84f5
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/downcase.rb
@@ -0,0 +1,32 @@
+#
+#  downcase.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:downcase, :type => :rvalue, :doc => <<-EOS
+Converts the case of a string or all strings in an array to lower case.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "downcase(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'downcase(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? i.downcase : i }
+    else
+      result = value.downcase
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/empty.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/empty.rb
new file mode 100644
index 00000000..cca620fa
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/empty.rb
@@ -0,0 +1,27 @@
+#
+# empty.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:empty, :type => :rvalue, :doc => <<-EOS
+Returns true if the variable is empty.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "empty(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(Hash) || value.is_a?(String)
+      raise(Puppet::ParseError, 'empty(): Requires either ' +
+        'array, hash or string to work with')
+    end
+
+    result = value.empty?
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb
new file mode 100644
index 00000000..f1da4aaa
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/ensure_packages.rb
@@ -0,0 +1,35 @@
+#
+# ensure_packages.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:ensure_packages, :type => :statement, :doc => <<-EOS
+Takes a list of packages and only installs them if they don't already exist.
+It optionally takes a hash as a second parameter that will be passed as the
+third argument to the ensure_resource() function.
+    EOS
+  ) do |arguments|
+
+    if arguments.size > 2 or arguments.size == 0
+      raise(Puppet::ParseError, "ensure_packages(): Wrong number of arguments " +
+        "given (#{arguments.size} for 1 or 2)")
+    elsif arguments.size == 2 and !arguments[1].is_a?(Hash) 
+      raise(Puppet::ParseError, 'ensure_packages(): Requires second argument to be a Hash')
+    end
+
+    packages = Array(arguments[0])
+
+    if arguments[1]
+      defaults = { 'ensure' => 'present' }.merge(arguments[1])
+    else
+      defaults = { 'ensure' => 'present' }
+    end
+
+    Puppet::Parser::Functions.function(:ensure_resource)
+    packages.each { |package_name|
+      function_ensure_resource(['package', package_name, defaults ])
+    }
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb
new file mode 100644
index 00000000..1ba6a447
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/ensure_resource.rb
@@ -0,0 +1,46 @@
+# Test whether a given class or definition is defined
+require 'puppet/parser/functions'
+
+Puppet::Parser::Functions.newfunction(:ensure_resource,
+                                      :type => :statement,
+                                      :doc => <<-'ENDOFDOC'
+Takes a resource type, title, and a list of attributes that describe a
+resource.
+
+    user { 'dan':
+      ensure => present,
+    }
+
+This example only creates the resource if it does not already exist:
+
+    ensure_resource('user', 'dan', {'ensure' => 'present' })
+
+If the resource already exists but does not match the specified parameters,
+this function will attempt to recreate the resource leading to a duplicate
+resource definition error.
+
+An array of resources can also be passed in and each will be created with
+the type and parameters specified if it doesn't already exist.
+
+    ensure_resource('user', ['dan','alex'], {'ensure' => 'present'})
+
+ENDOFDOC
+) do |vals|
+  type, title, params = vals
+  raise(ArgumentError, 'Must specify a type') unless type
+  raise(ArgumentError, 'Must specify a title') unless title
+  params ||= {}
+
+  items = [title].flatten
+
+  items.each do |item|
+    Puppet::Parser::Functions.function(:defined_with_params)
+    if function_defined_with_params(["#{type}[#{item}]", params])
+      Puppet.debug("Resource #{type}[#{item}] with params #{params} not created because it already exists")
+    else
+      Puppet.debug("Create new resource #{type}[#{item}] with params #{params}")
+      Puppet::Parser::Functions.function(:create_resources)
+      function_create_resources([type.capitalize, { item => params }])
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/flatten.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/flatten.rb
new file mode 100644
index 00000000..a1ed1832
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/flatten.rb
@@ -0,0 +1,33 @@
+#
+# flatten.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:flatten, :type => :rvalue, :doc => <<-EOS
+This function flattens any deeply nested arrays and returns a single flat array
+as a result.
+
+*Examples:*
+
+    flatten(['a', ['b', ['c']]])
+
+Would return: ['a','b','c']
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "flatten(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size != 1
+
+    array = arguments[0]
+
+    unless array.is_a?(Array)
+      raise(Puppet::ParseError, 'flatten(): Requires array to work with')
+    end
+
+    result = array.flatten
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/floor.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/floor.rb
new file mode 100644
index 00000000..9a6f014d
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/floor.rb
@@ -0,0 +1,25 @@
+module Puppet::Parser::Functions
+  newfunction(:floor, :type => :rvalue, :doc => <<-EOS
+    Returns the largest integer less or equal to the argument.
+    Takes a single numeric value as an argument.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "floor(): Wrong number of arguments " +
+          "given (#{arguments.size} for 1)") if arguments.size != 1
+
+    begin
+      arg = Float(arguments[0])
+    rescue TypeError, ArgumentError => e
+      raise(Puppet::ParseError, "floor(): Wrong argument type " +
+            "given (#{arguments[0]} for Numeric)")
+    end
+
+    raise(Puppet::ParseError, "floor(): Wrong argument type " +
+          "given (#{arg.class} for Numeric)") if arg.is_a?(Numeric) == false
+
+    arg.floor
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb
new file mode 100644
index 00000000..7f4d37d0
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/fqdn_rotate.rb
@@ -0,0 +1,45 @@
+#
+# fqdn_rotate.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:fqdn_rotate, :type => :rvalue, :doc => <<-EOS
+Rotates an array a random number of times based on a nodes fqdn.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "fqdn_rotate(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+    require 'digest/md5'
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'fqdn_rotate(): Requires either ' +
+        'array or string to work with')
+    end
+
+    result = value.clone
+
+    string = value.is_a?(String) ? true : false
+
+    # Check whether it makes sense to rotate ...
+    return result if result.size <= 1
+
+    # We turn any string value into an array to be able to rotate ...
+    result = string ? result.split('') : result
+
+    elements = result.size
+
+    srand(Digest::MD5.hexdigest([lookupvar('::fqdn'),arguments].join(':')).hex)
+    rand(elements).times {
+       result.push result.shift
+    }
+
+    result = string ? result.join : result
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb
new file mode 100644
index 00000000..1421b91f
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/get_module_path.rb
@@ -0,0 +1,17 @@
+module Puppet::Parser::Functions
+  newfunction(:get_module_path, :type =>:rvalue, :doc => <<-EOT
+    Returns the absolute path of the specified module for the current
+    environment.
+
+    Example:
+      $module_path = get_module_path('stdlib')
+  EOT
+  ) do |args|
+    raise(Puppet::ParseError, "get_module_path(): Wrong number of arguments, expects one") unless args.size == 1
+    if module_path = Puppet::Module.find(args[0], compiler.environment.to_s)
+      module_path.path
+    else
+      raise(Puppet::ParseError, "Could not find module #{args[0]} in environment #{compiler.environment}")
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/getparam.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/getparam.rb
new file mode 100644
index 00000000..6d510069
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/getparam.rb
@@ -0,0 +1,35 @@
+# Test whether a given class or definition is defined
+require 'puppet/parser/functions'
+
+Puppet::Parser::Functions.newfunction(:getparam,
+                                      :type => :rvalue,
+                                      :doc => <<-'ENDOFDOC'
+Takes a resource reference and name of the parameter and
+returns value of resource's parameter.
+
+*Examples:*
+
+    define example_resource($param) {
+    }
+
+    example_resource { "example_resource_instance":
+        param => "param_value"
+    }
+
+    getparam(Example_resource["example_resource_instance"], "param")
+
+Would return: param_value
+ENDOFDOC
+) do |vals|
+  reference, param = vals
+  raise(ArgumentError, 'Must specify a reference') unless reference
+  raise(ArgumentError, 'Must specify name of a parameter') unless param and param.instance_of? String
+
+  return '' if param.empty?
+
+  if resource = findresource(reference.to_s)
+    return resource[param] if resource[param]
+  end
+
+  return ''
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/getvar.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/getvar.rb
new file mode 100644
index 00000000..fb336b6a
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/getvar.rb
@@ -0,0 +1,29 @@
+module Puppet::Parser::Functions
+
+  newfunction(:getvar, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args|
+    Lookup a variable in a remote namespace.
+
+    For example:
+
+        $foo = getvar('site::data::foo')
+        # Equivalent to $foo = $site::data::foo
+
+    This is useful if the namespace itself is stored in a string:
+
+        $datalocation = 'site::data'
+        $bar = getvar("${datalocation}::bar")
+        # Equivalent to $bar = $site::data::bar
+    ENDHEREDOC
+
+    unless args.length == 1
+      raise Puppet::ParseError, ("getvar(): wrong number of arguments (#{args.length}; must be 1)")
+    end
+
+    begin
+      self.lookupvar("#{args[0]}")
+    rescue Puppet::ParseError # Eat the exception if strict_variables = true is set
+    end
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/grep.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/grep.rb
new file mode 100644
index 00000000..ceba9ecc
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/grep.rb
@@ -0,0 +1,33 @@
+#
+# grep.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:grep, :type => :rvalue, :doc => <<-EOS
+This function searches through an array and returns any elements that match
+the provided regular expression.
+
+*Examples:*
+
+    grep(['aaa','bbb','ccc','aaaddd'], 'aaa')
+
+Would return:
+
+    ['aaa','aaaddd']
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 2) then
+      raise(Puppet::ParseError, "grep(): Wrong number of arguments "+
+        "given #{arguments.size} for 2")
+    end
+
+    a = arguments[0]
+    pattern = Regexp.new(arguments[1])
+
+    a.grep(pattern)
+
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb
new file mode 100644
index 00000000..36915246
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/has_interface_with.rb
@@ -0,0 +1,68 @@
+#
+# has_interface_with
+#
+
+module Puppet::Parser::Functions
+  newfunction(:has_interface_with, :type => :rvalue, :doc => <<-EOS
+Returns boolean based on kind and value:
+  * macaddress
+  * netmask
+  * ipaddress
+  * network
+
+has_interface_with("macaddress", "x:x:x:x:x:x")
+has_interface_with("ipaddress", "127.0.0.1")    => true
+etc.
+
+If no "kind" is given, then the presence of the interface is checked:
+has_interface_with("lo")                        => true
+    EOS
+  ) do |args|
+
+    raise(Puppet::ParseError, "has_interface_with(): Wrong number of arguments " +
+          "given (#{args.size} for 1 or 2)") if args.size < 1 or args.size > 2
+
+    interfaces = lookupvar('interfaces')
+
+    # If we do not have any interfaces, then there are no requested attributes
+    return false if (interfaces == :undefined || interfaces.nil?)
+
+    interfaces = interfaces.split(',')
+
+    if args.size == 1
+      return interfaces.member?(args[0])
+    end
+
+    kind, value = args
+
+    # Bug with 3.7.1 - 3.7.3  when using future parser throws :undefined_variable
+    # https://tickets.puppetlabs.com/browse/PUP-3597
+    factval = nil
+    catch :undefined_variable do
+      factval = lookupvar(kind)
+    end
+    if factval == value
+      return true
+    end
+
+    result = false
+    interfaces.each do |iface|
+      iface.downcase!
+      factval = nil
+      begin
+        # Bug with 3.7.1 - 3.7.3 when using future parser throws :undefined_variable
+        # https://tickets.puppetlabs.com/browse/PUP-3597
+        catch :undefined_variable do
+          factval = lookupvar("#{kind}_#{iface}")
+        end
+      rescue Puppet::ParseError # Eat the exception if strict_variables = true is set
+      end
+      if value == factval
+        result = true
+        break
+      end
+    end
+
+    result
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb
new file mode 100644
index 00000000..842c8ec6
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/has_ip_address.rb
@@ -0,0 +1,25 @@
+#
+# has_ip_address
+#
+
+module Puppet::Parser::Functions
+  newfunction(:has_ip_address, :type => :rvalue, :doc => <<-EOS
+Returns true if the client has the requested IP address on some interface.
+
+This function iterates through the 'interfaces' fact and checks the
+'ipaddress_IFACE' facts, performing a simple string comparison.
+    EOS
+  ) do |args|
+
+    raise(Puppet::ParseError, "has_ip_address(): Wrong number of arguments " +
+          "given (#{args.size} for 1)") if args.size != 1
+
+    Puppet::Parser::Functions.autoloader.load(:has_interface_with) \
+      unless Puppet::Parser::Functions.autoloader.loaded?(:has_interface_with)
+
+    function_has_interface_with(['ipaddress', args[0]])
+
+  end
+end
+
+# vim:sts=2 sw=2
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb
new file mode 100644
index 00000000..9ccf9024
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/has_ip_network.rb
@@ -0,0 +1,25 @@
+#
+# has_ip_network
+#
+
+module Puppet::Parser::Functions
+  newfunction(:has_ip_network, :type => :rvalue, :doc => <<-EOS
+Returns true if the client has an IP address within the requested network.
+
+This function iterates through the 'interfaces' fact and checks the
+'network_IFACE' facts, performing a simple string comparision.
+    EOS
+  ) do |args|
+
+    raise(Puppet::ParseError, "has_ip_network(): Wrong number of arguments " +
+          "given (#{args.size} for 1)") if args.size != 1
+
+    Puppet::Parser::Functions.autoloader.load(:has_interface_with) \
+      unless Puppet::Parser::Functions.autoloader.loaded?(:has_interface_with)
+
+    function_has_interface_with(['network', args[0]])
+
+  end
+end
+
+# vim:sts=2 sw=2
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/has_key.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/has_key.rb
new file mode 100644
index 00000000..4657cc29
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/has_key.rb
@@ -0,0 +1,28 @@
+module Puppet::Parser::Functions
+
+  newfunction(:has_key, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args|
+    Determine if a hash has a certain key value.
+
+    Example:
+
+        $my_hash = {'key_one' => 'value_one'}
+        if has_key($my_hash, 'key_two') {
+          notice('we will not reach here')
+        }
+        if has_key($my_hash, 'key_one') {
+          notice('this will be printed')
+        }
+
+    ENDHEREDOC
+
+    unless args.length == 2
+      raise Puppet::ParseError, ("has_key(): wrong number of arguments (#{args.length}; must be 2)")
+    end
+    unless args[0].is_a?(Hash)
+      raise Puppet::ParseError, "has_key(): expects the first argument to be a hash, got #{args[0].inspect} which is of type #{args[0].class}"
+    end
+    args[0].has_key?(args[1])
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/hash.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/hash.rb
new file mode 100644
index 00000000..8cc4823b
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/hash.rb
@@ -0,0 +1,41 @@
+#
+# hash.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:hash, :type => :rvalue, :doc => <<-EOS
+This function converts an array into a hash.
+
+*Examples:*
+
+    hash(['a',1,'b',2,'c',3])
+
+Would return: {'a'=>1,'b'=>2,'c'=>3}
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "hash(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    array = arguments[0]
+
+    unless array.is_a?(Array)
+      raise(Puppet::ParseError, 'hash(): Requires array to work with')
+    end
+
+    result = {}
+
+    begin
+      # This is to make it compatible with older version of Ruby ...
+      array  = array.flatten
+      result = Hash[*array]
+    rescue Exception
+      raise(Puppet::ParseError, 'hash(): Unable to compute ' +
+        'hash from array given')
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/intersection.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/intersection.rb
new file mode 100644
index 00000000..48f02e9d
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/intersection.rb
@@ -0,0 +1,34 @@
+#
+# intersection.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:intersection, :type => :rvalue, :doc => <<-EOS
+This function returns an array an intersection of two.
+
+*Examples:*
+
+    intersection(["a","b","c"],["b","c","d"])
+
+Would return: ["b","c"]
+    EOS
+  ) do |arguments|
+
+    # Two arguments are required
+    raise(Puppet::ParseError, "intersection(): Wrong number of arguments " +
+      "given (#{arguments.size} for 2)") if arguments.size != 2
+
+    first = arguments[0]
+    second = arguments[1]
+
+    unless first.is_a?(Array) && second.is_a?(Array)
+      raise(Puppet::ParseError, 'intersection(): Requires 2 arrays')
+    end
+
+    result = first & second
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_array.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_array.rb
new file mode 100644
index 00000000..b39e184a
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_array.rb
@@ -0,0 +1,22 @@
+#
+# is_array.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_array, :type => :rvalue, :doc => <<-EOS
+Returns true if the variable passed to this function is an array.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "is_array(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    type = arguments[0]
+
+    result = type.is_a?(Array)
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_bool.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_bool.rb
new file mode 100644
index 00000000..8bbdbc8a
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_bool.rb
@@ -0,0 +1,22 @@
+#
+# is_bool.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_bool, :type => :rvalue, :doc => <<-EOS
+Returns true if the variable passed to this function is a boolean.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "is_bool(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size != 1
+
+    type = arguments[0]
+
+    result = type.is_a?(TrueClass) || type.is_a?(FalseClass)
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb
new file mode 100644
index 00000000..b3fee965
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_domain_name.rb
@@ -0,0 +1,50 @@
+#
+# is_domain_name.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_domain_name, :type => :rvalue, :doc => <<-EOS
+Returns true if the string passed to this function is a syntactically correct domain name.
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "is_domain_name(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    domain = arguments[0]
+
+    # Limits (rfc1035, 3.1)
+    domain_max_length=255
+    label_min_length=1
+    label_max_length=63
+
+    # Only allow string types
+    return false unless domain.is_a?(String)
+
+    # Allow ".", it is the top level domain
+    return true if domain == '.'
+
+    # Remove the final dot, if present.
+    domain.chomp!('.')
+
+    # Check the whole domain
+    return false if domain.empty?
+    return false if domain.length > domain_max_length
+
+    # Check each label in the domain
+    labels = domain.split('.')
+    vlabels = labels.each do |label|
+      break if label.length < label_min_length
+      break if label.length > label_max_length
+      break if label[-1..-1] == '-'
+      break if label[0..0] == '-'
+      break unless /^[a-z\d-]+$/i.match(label)
+    end
+    return vlabels == labels
+
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_float.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_float.rb
new file mode 100644
index 00000000..a2da9438
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_float.rb
@@ -0,0 +1,30 @@
+#
+# is_float.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_float, :type => :rvalue, :doc => <<-EOS
+Returns true if the variable passed to this function is a float.
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "is_float(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    value = arguments[0]
+
+    # Only allow Numeric or String types
+    return false unless value.is_a?(Numeric) or value.is_a?(String)
+
+    if value != value.to_f.to_s and !value.is_a? Float then
+      return false
+    else
+      return true
+    end
+
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb
new file mode 100644
index 00000000..6da82c8c
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_function_available.rb
@@ -0,0 +1,26 @@
+#
+# is_function_available.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_function_available, :type => :rvalue, :doc => <<-EOS
+This function accepts a string as an argument, determines whether the
+Puppet runtime has access to a function by that name.  It returns a
+true if the function exists, false if not.
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "is_function_available?(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    # Only allow String types
+    return false unless arguments[0].is_a?(String)
+
+    function = Puppet::Parser::Functions.function(arguments[0].to_sym)
+    function.is_a?(String) and not function.empty?
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_hash.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_hash.rb
new file mode 100644
index 00000000..ad907f08
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_hash.rb
@@ -0,0 +1,22 @@
+#
+# is_hash.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_hash, :type => :rvalue, :doc => <<-EOS
+Returns true if the variable passed to this function is a hash.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "is_hash(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size != 1
+
+    type = arguments[0]
+
+    result = type.is_a?(Hash)
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_integer.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_integer.rb
new file mode 100644
index 00000000..c03d28df
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_integer.rb
@@ -0,0 +1,45 @@
+#
+# is_integer.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_integer, :type => :rvalue, :doc => <<-EOS
+Returns true if the variable passed to this function is an Integer or
+a decimal (base 10) integer in String form. The string may
+start with a '-' (minus). A value of '0' is allowed, but a leading '0' digit may not
+be followed by other digits as this indicates that the value is octal (base 8).
+
+If given any other argument `false` is returned.
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "is_integer(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    value = arguments[0]
+
+    # Regex is taken from the lexer of puppet
+    # puppet/pops/parser/lexer.rb but modified to match also
+    # negative values and disallow numbers prefixed with multiple
+    # 0's
+    #
+    # TODO these parameter should be a constant but I'm not sure
+    # if there is no risk to declare it inside of the module
+    # Puppet::Parser::Functions
+
+    # Integer numbers like
+    # -1234568981273
+    # 47291
+    numeric = %r{^-?(?:(?:[1-9]\d*)|0)$}
+
+    if value.is_a? Integer or (value.is_a? String and value.match numeric)
+      return true
+    else
+      return false
+    end
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb
new file mode 100644
index 00000000..a90adabe
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_ip_address.rb
@@ -0,0 +1,32 @@
+#
+# is_ip_address.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_ip_address, :type => :rvalue, :doc => <<-EOS
+Returns true if the string passed to this function is a valid IP address.
+    EOS
+  ) do |arguments|
+
+    require 'ipaddr'
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "is_ip_address(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    begin
+      ip = IPAddr.new(arguments[0])
+    rescue ArgumentError
+      return false
+    end
+
+    if ip.ipv4? or ip.ipv6? then
+      return true
+    else
+      return false
+    end
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb
new file mode 100644
index 00000000..1b3088a2
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_mac_address.rb
@@ -0,0 +1,27 @@
+#
+# is_mac_address.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_mac_address, :type => :rvalue, :doc => <<-EOS
+Returns true if the string passed to this function is a valid mac address.
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "is_mac_address(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    mac = arguments[0]
+
+    if /^[a-fA-F0-9]{1,2}:[a-fA-F0-9]{1,2}:[a-fA-F0-9]{1,2}:[a-fA-F0-9]{1,2}:[a-fA-F0-9]{1,2}:[a-fA-F0-9]{1,2}$/.match(mac) then
+      return true
+    else
+      return false
+    end
+
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb
new file mode 100644
index 00000000..e7e1d2a7
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_numeric.rb
@@ -0,0 +1,75 @@
+#
+# is_numeric.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_numeric, :type => :rvalue, :doc => <<-EOS
+Returns true if the given argument is a Numeric (Integer or Float),
+or a String containing either a valid integer in decimal base 10 form, or
+a valid floating point string representation.
+
+The function recognizes only decimal (base 10) integers and float but not
+integers in hex (base 16) or octal (base 8) form.
+
+The string representation may start with a '-' (minus). If a decimal '.' is used,
+it must be followed by at least one digit.
+
+Valid examples:
+
+  77435
+  10e-12
+  -8475
+  0.2343
+  -23.561e3
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "is_numeric(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    value = arguments[0]
+
+    # Regex is taken from the lexer of puppet
+    # puppet/pops/parser/lexer.rb but modified to match also
+    # negative values and disallow invalid octal numbers or
+    # numbers prefixed with multiple 0's (except in hex numbers)
+    #
+    # TODO these parameters should be constants but I'm not sure
+    # if there is no risk to declare them inside of the module
+    # Puppet::Parser::Functions
+
+    # TODO decide if this should be used
+    # HEX numbers like
+    # 0xaa230F
+    # 0X1234009C
+    # 0x0012
+    # -12FcD
+    #numeric_hex = %r{^-?0[xX][0-9A-Fa-f]+$}
+
+    # TODO decide if this should be used
+    # OCTAL numbers like
+    # 01234567
+    # -045372
+    #numeric_oct = %r{^-?0[1-7][0-7]*$}
+
+    # Integer/Float numbers like
+    # -0.1234568981273
+    # 47291
+    # 42.12345e-12
+    numeric = %r{^-?(?:(?:[1-9]\d*)|0)(?:\.\d+)?(?:[eE]-?\d+)?$}
+
+    if value.is_a? Numeric or (value.is_a? String and (
+      value.match(numeric) #or
+    #  value.match(numeric_hex) or
+    #  value.match(numeric_oct)
+    ))
+      return true
+    else
+      return false
+    end
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/is_string.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/is_string.rb
new file mode 100644
index 00000000..f5bef045
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/is_string.rb
@@ -0,0 +1,26 @@
+#
+# is_string.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:is_string, :type => :rvalue, :doc => <<-EOS
+Returns true if the variable passed to this function is a string.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "is_string(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    type = arguments[0]
+
+    result = type.is_a?(String)
+
+    if result and (type == type.to_f.to_s or type == type.to_i.to_s) then
+      return false
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/join.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/join.rb
new file mode 100644
index 00000000..6c0a6ba0
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/join.rb
@@ -0,0 +1,41 @@
+#
+# join.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:join, :type => :rvalue, :doc => <<-EOS
+This function joins an array into a string using a separator.
+
+*Examples:*
+
+    join(['a','b','c'], ",")
+
+Would result in: "a,b,c"
+    EOS
+  ) do |arguments|
+
+    # Technically we support two arguments but only first is mandatory ...
+    raise(Puppet::ParseError, "join(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    array = arguments[0]
+
+    unless array.is_a?(Array)
+      raise(Puppet::ParseError, 'join(): Requires array to work with')
+    end
+
+    suffix = arguments[1] if arguments[1]
+
+    if suffix
+      unless suffix.is_a?(String)
+        raise(Puppet::ParseError, 'join(): Requires string to work with')
+      end
+    end
+
+    result = suffix ? array.join(suffix) : array.join
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb
new file mode 100644
index 00000000..e9924fe2
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/join_keys_to_values.rb
@@ -0,0 +1,47 @@
+#
+# join.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:join_keys_to_values, :type => :rvalue, :doc => <<-EOS
+This function joins each key of a hash to that key's corresponding value with a
+separator. Keys and values are cast to strings. The return value is an array in
+which each element is one joined key/value pair.
+
+*Examples:*
+
+    join_keys_to_values({'a'=>1,'b'=>2}, " is ")
+
+Would result in: ["a is 1","b is 2"]
+    EOS
+  ) do |arguments|
+
+    # Validate the number of arguments.
+    if arguments.size != 2
+      raise(Puppet::ParseError, "join_keys_to_values(): Takes exactly two " +
+            "arguments, but #{arguments.size} given.")
+    end
+
+    # Validate the first argument.
+    hash = arguments[0]
+    if not hash.is_a?(Hash)
+      raise(TypeError, "join_keys_to_values(): The first argument must be a " +
+            "hash, but a #{hash.class} was given.")
+    end
+
+    # Validate the second argument.
+    separator = arguments[1]
+    if not separator.is_a?(String)
+      raise(TypeError, "join_keys_to_values(): The second argument must be a " +
+            "string, but a #{separator.class} was given.")
+    end
+
+    # Join the keys to their values.
+    hash.map do |k,v|
+      String(k) + separator + String(v)
+    end
+
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/keys.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/keys.rb
new file mode 100644
index 00000000..f0d13b64
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/keys.rb
@@ -0,0 +1,26 @@
+#
+# keys.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:keys, :type => :rvalue, :doc => <<-EOS
+Returns the keys of a hash as an array.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "keys(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    hash = arguments[0]
+
+    unless hash.is_a?(Hash)
+      raise(Puppet::ParseError, 'keys(): Requires hash to work with')
+    end
+
+    result = hash.keys
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb
new file mode 100644
index 00000000..10c40050
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/loadyaml.rb
@@ -0,0 +1,20 @@
+module Puppet::Parser::Functions
+
+  newfunction(:loadyaml, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args|
+    Load a YAML file containing an array, string, or hash, and return the data
+    in the corresponding native data type.
+
+    For example:
+
+        $myhash = loadyaml('/etc/puppet/data/myhash.yaml')
+    ENDHEREDOC
+
+    unless args.length == 1
+      raise Puppet::ParseError, ("loadyaml(): wrong number of arguments (#{args.length}; must be 1)")
+    end
+
+    YAML.load_file(args[0])
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/lstrip.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/lstrip.rb
new file mode 100644
index 00000000..624e4c84
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/lstrip.rb
@@ -0,0 +1,32 @@
+#
+#  lstrip.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:lstrip, :type => :rvalue, :doc => <<-EOS
+Strips leading spaces to the left of a string.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "lstrip(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'lstrip(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? i.lstrip : i }
+    else
+      result = value.lstrip
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/max.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/max.rb
new file mode 100644
index 00000000..60fb94ac
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/max.rb
@@ -0,0 +1,21 @@
+module Puppet::Parser::Functions
+  newfunction(:max, :type => :rvalue, :doc => <<-EOS
+    Returns the highest value of all arguments.
+    Requires at least one argument.
+    EOS
+  ) do |args|
+
+    raise(Puppet::ParseError, "max(): Wrong number of arguments " +
+          "need at least one") if args.size == 0
+
+    # Sometimes we get numbers as numerics and sometimes as strings.
+    # We try to compare them as numbers when possible
+    return args.max do |a,b|
+      if a.to_s =~ /\A-?\d+(.\d+)?\z/ and b.to_s =~ /\A-?\d+(.\d+)?\z/ then
+        a.to_f <=> b.to_f
+      else
+        a.to_s <=> b.to_s
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/member.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/member.rb
new file mode 100644
index 00000000..88609ce5
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/member.rb
@@ -0,0 +1,62 @@
+#
+# member.rb
+#
+
+# TODO(Krzysztof Wilczynski): We need to add support for regular expression ...
+# TODO(Krzysztof Wilczynski): Support for strings and hashes too ...
+
+module Puppet::Parser::Functions
+  newfunction(:member, :type => :rvalue, :doc => <<-EOS
+This function determines if a variable is a member of an array.
+The variable can be a string, fixnum, or array.
+
+*Examples:*
+
+    member(['a','b'], 'b')
+
+Would return: true
+
+    member(['a', 'b', 'c'], ['a', 'b'])
+
+would return: true
+
+    member(['a','b'], 'c')
+
+Would return: false
+
+    member(['a', 'b', 'c'], ['d', 'b'])
+
+would return: false
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "member(): Wrong number of arguments " +
+      "given (#{arguments.size} for 2)") if arguments.size < 2
+
+    array = arguments[0]
+
+    unless array.is_a?(Array)
+      raise(Puppet::ParseError, 'member(): Requires array to work with')
+    end
+
+    unless arguments[1].is_a? String or arguments[1].is_a? Fixnum or arguments[1].is_a? Array
+      raise(Puppet::ParseError, 'member(): Item to search for must be a string, fixnum, or array')
+    end
+
+    if arguments[1].is_a? String or arguments[1].is_a? Fixnum
+      item = Array(arguments[1])
+    else
+      item = arguments[1]
+    end
+
+
+    raise(Puppet::ParseError, 'member(): You must provide item ' +
+      'to search for within array given') if item.respond_to?('empty?') && item.empty?
+
+    result = (item - array).empty?
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/merge.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/merge.rb
new file mode 100644
index 00000000..1b39f206
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/merge.rb
@@ -0,0 +1,34 @@
+module Puppet::Parser::Functions
+  newfunction(:merge, :type => :rvalue, :doc => <<-'ENDHEREDOC') do |args|
+    Merges two or more hashes together and returns the resulting hash.
+
+    For example:
+
+        $hash1 = {'one' => 1, 'two', => 2}
+        $hash2 = {'two' => 'dos', 'three', => 'tres'}
+        $merged_hash = merge($hash1, $hash2)
+        # The resulting hash is equivalent to:
+        # $merged_hash =  {'one' => 1, 'two' => 'dos', 'three' => 'tres'}
+
+    When there is a duplicate key, the key in the rightmost hash will "win."
+
+    ENDHEREDOC
+
+    if args.length < 2
+      raise Puppet::ParseError, ("merge(): wrong number of arguments (#{args.length}; must be at least 2)")
+    end
+
+    # The hash we accumulate into
+    accumulator = Hash.new
+    # Merge into the accumulator hash
+    args.each do |arg|
+      next if arg.is_a? String and arg.empty? # empty string is synonym for puppet's undef
+      unless arg.is_a?(Hash)
+        raise Puppet::ParseError, "merge: unexpected argument type #{arg.class}, only expects hash arguments"
+      end
+      accumulator.merge!(arg)
+    end
+    # Return the fully merged hash
+    accumulator
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/min.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/min.rb
new file mode 100644
index 00000000..6bd6ebf2
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/min.rb
@@ -0,0 +1,21 @@
+module Puppet::Parser::Functions
+  newfunction(:min, :type => :rvalue, :doc => <<-EOS
+    Returns the lowest value of all arguments.
+    Requires at least one argument.
+    EOS
+  ) do |args|
+
+    raise(Puppet::ParseError, "min(): Wrong number of arguments " +
+          "need at least one") if args.size == 0
+
+    # Sometimes we get numbers as numerics and sometimes as strings.
+    # We try to compare them as numbers when possible
+    return args.min do |a,b|
+      if a.to_s =~ /\A^-?\d+(.\d+)?\z/ and b.to_s =~ /\A-?\d+(.\d+)?\z/ then
+        a.to_f <=> b.to_f
+      else
+        a.to_s <=> b.to_s
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/num2bool.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/num2bool.rb
new file mode 100644
index 00000000..af0e6ed7
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/num2bool.rb
@@ -0,0 +1,43 @@
+#
+# num2bool.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:num2bool, :type => :rvalue, :doc => <<-EOS
+This function converts a number or a string representation of a number into a
+true boolean. Zero or anything non-numeric becomes false. Numbers higher then 0
+become true.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "num2bool(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size != 1
+
+    number = arguments[0]
+
+    case number
+    when Numeric
+      # Yay, it's a number
+    when String
+      begin
+        number = Float(number)
+      rescue ArgumentError => ex
+        raise(Puppet::ParseError, "num2bool(): '#{number}' does not look like a number: #{ex.message}")
+      end
+    else
+      begin
+        number = number.to_s
+      rescue NoMethodError => ex
+        raise(Puppet::ParseError, "num2bool(): Unable to parse argument: #{ex.message}")
+      end
+    end
+
+    # Truncate Floats
+    number = number.to_i
+
+    # Return true for any positive number and false otherwise
+    return number > 0
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/obfuscate_email.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/obfuscate_email.rb
new file mode 100644
index 00000000..4e4cb826
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/obfuscate_email.rb
@@ -0,0 +1,16 @@
+module Puppet::Parser::Functions
+  newfunction(:obfuscate_email, :type => :rvalue, :doc => <<-EOS
+Given:
+  a comma seperated email string in form of 'john@doe.com, doe@john.com'
+
+This function will return all emails obfuscated in form of 'john {at} doe {dot} com, doe {at} john {dot} com' 
+Works with multiple email adresses as well as with a single email adress.
+
+    EOS
+  ) do |args|
+      args[0].gsub('@', ' {at} ').gsub('.', ' {dot} ')
+    end
+end
+
+# vim: set ts=2 sw=2 et :
+# encoding: utf-8
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/parsejson.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/parsejson.rb
new file mode 100644
index 00000000..a9a16a45
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/parsejson.rb
@@ -0,0 +1,24 @@
+#
+# parsejson.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:parsejson, :type => :rvalue, :doc => <<-EOS
+This function accepts JSON as a string and converts into the correct Puppet
+structure.
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "parsejson(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    json = arguments[0]
+
+    # PSON is natively available in puppet
+    PSON.load(json)
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb
new file mode 100644
index 00000000..53d54faf
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/parseyaml.rb
@@ -0,0 +1,24 @@
+#
+# parseyaml.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:parseyaml, :type => :rvalue, :doc => <<-EOS
+This function accepts YAML as a string and converts it into the correct
+Puppet structure.
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "parseyaml(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    require 'yaml'
+
+    YAML::load(arguments[0])
+
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/pick.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/pick.rb
new file mode 100644
index 00000000..fdd0aefd
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/pick.rb
@@ -0,0 +1,29 @@
+module Puppet::Parser::Functions
+ newfunction(:pick, :type => :rvalue, :doc => <<-EOS
+
+This function is similar to a coalesce function in SQL in that it will return
+the first value in a list of values that is not undefined or an empty string
+(two things in Puppet that will return a boolean false value). Typically,
+this function is used to check for a value in the Puppet Dashboard/Enterprise
+Console, and failover to a default value like the following:
+
+  $real_jenkins_version = pick($::jenkins_version, '1.449')
+
+The value of $real_jenkins_version will first look for a top-scope variable
+called 'jenkins_version' (note that parameters set in the Puppet Dashboard/
+Enterprise Console are brought into Puppet as top-scope variables), and,
+failing that, will use a default value of 1.449.
+
+EOS
+) do |args|
+   args = args.compact
+   args.delete(:undef)
+   args.delete(:undefined)
+   args.delete("")
+   if args[0].to_s.empty? then
+     fail Puppet::ParseError, "pick(): must receive at least one non empty value"
+   else
+     return args[0]
+   end
+ end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/pick_default.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/pick_default.rb
new file mode 100644
index 00000000..36e33abf
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/pick_default.rb
@@ -0,0 +1,35 @@
+module Puppet::Parser::Functions
+ newfunction(:pick_default, :type => :rvalue, :doc => <<-EOS
+
+This function is similar to a coalesce function in SQL in that it will return
+the first value in a list of values that is not undefined or an empty string
+(two things in Puppet that will return a boolean false value). If no value is
+found, it will return the last argument.
+
+Typically, this function is used to check for a value in the Puppet
+Dashboard/Enterprise Console, and failover to a default value like the
+following:
+
+  $real_jenkins_version = pick_default($::jenkins_version, '1.449')
+
+The value of $real_jenkins_version will first look for a top-scope variable
+called 'jenkins_version' (note that parameters set in the Puppet Dashboard/
+Enterprise Console are brought into Puppet as top-scope variables), and,
+failing that, will use a default value of 1.449.
+
+Note that, contrary to the pick() function, the pick_default does not fail if
+all arguments are empty. This allows pick_default to use an empty value as
+default.
+
+EOS
+) do |args|
+   fail "Must receive at least one argument." if args.empty?
+   default = args.last
+   args = args[0..-2].compact
+   args.delete(:undef)
+   args.delete(:undefined)
+   args.delete("")
+   args << default
+   return args[0]
+ end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/prefix.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/prefix.rb
new file mode 100644
index 00000000..d02286af
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/prefix.rb
@@ -0,0 +1,45 @@
+#
+# prefix.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:prefix, :type => :rvalue, :doc => <<-EOS
+This function applies a prefix to all elements in an array.
+
+*Examples:*
+
+    prefix(['a','b','c'], 'p')
+
+Will return: ['pa','pb','pc']
+    EOS
+  ) do |arguments|
+
+    # Technically we support two arguments but only first is mandatory ...
+    raise(Puppet::ParseError, "prefix(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    array = arguments[0]
+
+    unless array.is_a?(Array)
+      raise Puppet::ParseError, "prefix(): expected first argument to be an Array, got #{array.inspect}"
+    end
+
+    prefix = arguments[1] if arguments[1]
+
+    if prefix
+      unless prefix.is_a?(String)
+        raise Puppet::ParseError, "prefix(): expected second argument to be a String, got #{prefix.inspect}"
+      end
+    end
+
+    # Turn everything into string same as join would do ...
+    result = array.collect do |i|
+      i = i.to_s
+      prefix ? prefix + i : i
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/private.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/private.rb
new file mode 100644
index 00000000..60210d33
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/private.rb
@@ -0,0 +1,29 @@
+#
+# private.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:private, :doc => <<-'EOS'
+    Sets the current class or definition as private.
+    Calling the class or definition from outside the current module will fail.
+    EOS
+  ) do |args|
+
+    raise(Puppet::ParseError, "private(): Wrong number of arguments "+
+      "given (#{args.size}}) for 0 or 1)") if args.size > 1
+
+    scope = self
+    if scope.lookupvar('module_name') != scope.lookupvar('caller_module_name')
+      message = nil
+      if args[0] and args[0].is_a? String
+        message = args[0]
+      else
+        manifest_name = scope.source.name
+        manifest_type = scope.source.type
+        message = (manifest_type.to_s == 'hostclass') ? 'Class' : 'Definition'
+        message += " #{manifest_name} is private"
+      end
+      raise(Puppet::ParseError, message)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/range.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/range.rb
new file mode 100644
index 00000000..49fba21c
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/range.rb
@@ -0,0 +1,88 @@
+#
+# range.rb
+#
+
+# TODO(Krzysztof Wilczynski): We probably need to approach numeric values differently ...
+
+module Puppet::Parser::Functions
+  newfunction(:range, :type => :rvalue, :doc => <<-EOS
+When given range in the form of (start, stop) it will extrapolate a range as
+an array.
+
+*Examples:*
+
+    range("0", "9")
+
+Will return: [0,1,2,3,4,5,6,7,8,9]
+
+    range("00", "09")
+
+Will return: [0,1,2,3,4,5,6,7,8,9] (Zero padded strings are converted to
+integers automatically)
+
+    range("a", "c")
+
+Will return: ["a","b","c"]
+
+    range("host01", "host10")
+
+Will return: ["host01", "host02", ..., "host09", "host10"]
+
+Passing a third argument will cause the generated range to step by that
+interval, e.g.
+
+    range("0", "9", "2")
+
+Will return: [0,2,4,6,8]
+    EOS
+  ) do |arguments|
+
+    # We support more than one argument but at least one is mandatory ...
+    raise(Puppet::ParseError, "range(): Wrong number of " +
+      "arguments given (#{arguments.size} for 1)") if arguments.size < 1
+
+    if arguments.size > 1
+      start = arguments[0]
+      stop  = arguments[1]
+      step  = arguments[2].nil? ? 1 : arguments[2].to_i.abs
+
+      type = '..' # We select simplest type for Range available in Ruby ...
+
+    elsif arguments.size > 0
+      value = arguments[0]
+
+      if m = value.match(/^(\w+)(\.\.\.?|\-)(\w+)$/)
+        start = m[1]
+        stop  = m[3]
+
+        type = m[2]
+
+      elsif value.match(/^.+$/)
+        raise(Puppet::ParseError, 'range(): Unable to compute range ' +
+          'from the value given')
+      else
+        raise(Puppet::ParseError, 'range(): Unknown format of range given')
+      end
+    end
+
+    # Check whether we have integer value if so then make it so ...
+    if start.to_s.match(/^\d+$/)
+      start = start.to_i
+      stop  = stop.to_i
+    else
+      start = start.to_s
+      stop  = stop.to_s
+    end
+
+    range = case type
+      when /^(\.\.|\-)$/ then (start .. stop)
+      when /^(\.\.\.)$/  then (start ... stop) # Exclusive of last element ...
+    end
+
+    result = range.step(step).collect { |i| i } # Get them all ... Pokemon ...
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/reject.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/reject.rb
new file mode 100644
index 00000000..1953ffcf
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/reject.rb
@@ -0,0 +1,31 @@
+#
+# reject.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:reject, :type => :rvalue, :doc => <<-EOS) do |args|
+This function searches through an array and rejects all elements that match
+the provided regular expression.
+
+*Examples:*
+
+    reject(['aaa','bbb','ccc','aaaddd'], 'aaa')
+
+Would return:
+
+    ['bbb','ccc']
+EOS
+
+    if (args.size != 2)
+      raise Puppet::ParseError,
+        "reject(): Wrong number of arguments given #{args.size} for 2"
+    end
+
+    ary = args[0]
+    pattern = Regexp.new(args[1])
+
+    ary.reject { |e| e =~ pattern }
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/reverse.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/reverse.rb
new file mode 100644
index 00000000..7f1018f6
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/reverse.rb
@@ -0,0 +1,27 @@
+#
+# reverse.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:reverse, :type => :rvalue, :doc => <<-EOS
+Reverses the order of a string or array.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "reverse(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'reverse(): Requires either ' +
+        'array or string to work with')
+    end
+
+    result = value.reverse
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/rstrip.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/rstrip.rb
new file mode 100644
index 00000000..0cf8d222
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/rstrip.rb
@@ -0,0 +1,31 @@
+#
+#  rstrip.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:rstrip, :type => :rvalue, :doc => <<-EOS
+Strips leading spaces to the right of the string.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "rstrip(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'rstrip(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      result = value.collect { |i| i.is_a?(String) ? i.rstrip : i }
+    else
+      result = value.rstrip
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/shuffle.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/shuffle.rb
new file mode 100644
index 00000000..30c663db
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/shuffle.rb
@@ -0,0 +1,45 @@
+#
+# shuffle.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:shuffle, :type => :rvalue, :doc => <<-EOS
+Randomizes the order of a string or array elements.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "shuffle(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'shuffle(): Requires either ' +
+        'array or string to work with')
+    end
+
+    result = value.clone
+
+    string = value.is_a?(String) ? true : false
+
+    # Check whether it makes sense to shuffle ...
+    return result if result.size <= 1
+
+    # We turn any string value into an array to be able to shuffle ...
+    result = string ? result.split('') : result
+
+    elements = result.size
+
+    # Simple implementation of Fisher–Yates in-place shuffle ...
+    elements.times do |i|
+      j = rand(elements - i) + i
+      result[j], result[i] = result[i], result[j]
+    end
+
+    result = string ? result.join : result
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/size.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/size.rb
new file mode 100644
index 00000000..cc207e3f
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/size.rb
@@ -0,0 +1,48 @@
+#
+# size.rb
+#
+
+# TODO(Krzysztof Wilczynski): Support for hashes would be nice too ...
+
+module Puppet::Parser::Functions
+  newfunction(:size, :type => :rvalue, :doc => <<-EOS
+Returns the number of elements in a string or array.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "size(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    item = arguments[0]
+
+    if item.is_a?(String)
+
+      begin
+        #
+        # Check whether your item is a numeric value or not ...
+        # This will take care about positive and/or negative numbers
+        # for both integer and floating-point values ...
+        #
+        # Please note that Puppet has no notion of hexadecimal
+        # nor octal numbers for its DSL at this point in time ...
+        #
+        Float(item)
+
+        raise(Puppet::ParseError, 'size(): Requires either ' +
+          'string or array to work with')
+
+      rescue ArgumentError
+        result = item.size
+      end
+
+    elsif item.is_a?(Array)
+      result = item.size
+    else
+      raise(Puppet::ParseError, 'size(): Unknown type given')
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/sort.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/sort.rb
new file mode 100644
index 00000000..cefbe546
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/sort.rb
@@ -0,0 +1,27 @@
+#
+# sort.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:sort, :type => :rvalue, :doc => <<-EOS
+Sorts strings and arrays lexically.
+    EOS
+  ) do |arguments|
+
+    if (arguments.size != 1) then
+      raise(Puppet::ParseError, "sort(): Wrong number of arguments "+
+        "given #{arguments.size} for 1")
+    end
+
+    value = arguments[0]
+
+    if value.is_a?(Array) then
+      value.sort
+    elsif value.is_a?(String) then
+      value.split("").sort.join("")
+    end
+
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/squeeze.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/squeeze.rb
new file mode 100644
index 00000000..81fadfdb
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/squeeze.rb
@@ -0,0 +1,36 @@
+#
+# squeeze.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:squeeze, :type => :rvalue, :doc => <<-EOS
+Returns a new string where runs of the same character that occur in this set are replaced by a single character.
+    EOS
+  ) do |arguments|
+
+    if ((arguments.size != 2) and (arguments.size != 1)) then
+      raise(Puppet::ParseError, "squeeze(): Wrong number of arguments "+
+        "given #{arguments.size} for 2 or 1")
+    end
+
+    item = arguments[0]
+    squeezeval = arguments[1]
+
+    if item.is_a?(Array) then
+      if squeezeval then
+        item.collect { |i| i.squeeze(squeezeval) }
+      else
+        item.collect { |i| i.squeeze }
+      end
+    else
+      if squeezeval then
+        item.squeeze(squeezeval)
+      else
+        item.squeeze
+      end
+    end
+
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/str2bool.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/str2bool.rb
new file mode 100644
index 00000000..446732ec
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/str2bool.rb
@@ -0,0 +1,46 @@
+#
+# str2bool.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:str2bool, :type => :rvalue, :doc => <<-EOS
+This converts a string to a boolean. This attempt to convert strings that
+contain things like: y, 1, t, true to 'true' and strings that contain things
+like: 0, f, n, false, no to 'false'.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "str2bool(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    string = arguments[0]
+
+    # If string is already Boolean, return it
+    if !!string == string
+      return string
+    end
+
+    unless string.is_a?(String)
+      raise(Puppet::ParseError, 'str2bool(): Requires either ' +
+        'string to work with')
+    end
+
+    # We consider all the yes, no, y, n and so on too ...
+    result = case string
+      #
+      # This is how undef looks like in Puppet ...
+      # We yield false in this case.
+      #
+      when /^$/, '' then false # Empty string will be false ...
+      when /^(1|t|y|true|yes)$/  then true
+      when /^(0|f|n|false|no)$/  then false
+      when /^(undef|undefined)$/ then false # This is not likely to happen ...
+      else
+        raise(Puppet::ParseError, 'str2bool(): Unknown type of boolean given')
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/str2saltedsha1.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/str2saltedsha1.rb
new file mode 100644
index 00000000..e51a861a
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/str2saltedsha1.rb
@@ -0,0 +1,32 @@
+#
+# str2saltedsha1.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:str2saltedsha1, :type => :rvalue, :doc => <<-EOS
+This converts a string to a salted-SHA1 password hash (which is used for
+OS X versions >= 10.7). Given any simple string, you will get a hex version
+of a salted-SHA1 password hash that can be inserted into your Puppet
+manifests as a valid password attribute.
+    EOS
+  ) do |arguments|
+    require 'digest/sha2'
+
+    raise(Puppet::ParseError, "str2saltedsha1(): Wrong number of arguments " +
+      "passed (#{arguments.size} but we require 1)") if arguments.size != 1
+
+    password = arguments[0]
+
+    unless password.is_a?(String)
+      raise(Puppet::ParseError, 'str2saltedsha1(): Requires a ' +
+        "String argument, you passed: #{password.class}")
+    end
+
+    seedint    = rand(2**31 - 1)
+    seedstring = Array(seedint).pack("L")
+    saltedpass = Digest::SHA1.digest(seedstring + password)
+    (seedstring + saltedpass).unpack('H*')[0]
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb
new file mode 100644
index 00000000..7fe7b012
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/str2saltedsha512.rb
@@ -0,0 +1,32 @@
+#
+# str2saltedsha512.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:str2saltedsha512, :type => :rvalue, :doc => <<-EOS
+This converts a string to a salted-SHA512 password hash (which is used for
+OS X versions >= 10.7). Given any simple string, you will get a hex version
+of a salted-SHA512 password hash that can be inserted into your Puppet
+manifests as a valid password attribute.
+    EOS
+  ) do |arguments|
+    require 'digest/sha2'
+
+    raise(Puppet::ParseError, "str2saltedsha512(): Wrong number of arguments " +
+      "passed (#{arguments.size} but we require 1)") if arguments.size != 1
+
+    password = arguments[0]
+
+    unless password.is_a?(String)
+      raise(Puppet::ParseError, 'str2saltedsha512(): Requires a ' +
+        "String argument, you passed: #{password.class}")
+    end
+
+    seedint    = rand(2**31 - 1)
+    seedstring = Array(seedint).pack("L")
+    saltedpass = Digest::SHA512.digest(seedstring + password)
+    (seedstring + saltedpass).unpack('H*')[0]
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/str2sha1_and_salt.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/str2sha1_and_salt.rb
new file mode 100644
index 00000000..9ec382d0
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/str2sha1_and_salt.rb
@@ -0,0 +1,36 @@
+#
+# str2saltedsha1.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:str2sha1_and_salt, :type => :rvalue, :doc => <<-EOS
+This converts a string to an array containing the salted SHA1 password hash in
+the first field, and the salt itself in second field of the returned array. 
+This combination is used i.e. for couchdb passwords.
+    EOS
+  ) do |arguments|
+    require 'digest/sha1'
+
+    raise(Puppet::ParseError, "str2saltedsha1(): Wrong number of arguments " +
+      "passed (#{arguments.size} but we require 1)") if arguments.size != 1
+
+    password = arguments[0]
+
+    unless password.is_a?(String)
+      raise(Puppet::ParseError, 'str2saltedsha1(): Requires a ' +
+        "String argument, you passed: #{password.class}")
+    end
+
+    seedint    = rand(2**31 - 1)
+    seedstring = Array(seedint).pack("L")
+    salt       = Digest::MD5.hexdigest(seedstring)
+    saltedpass = Digest::SHA1.hexdigest(password + salt)
+
+    array = Array.new
+    array << saltedpass
+    array << salt 
+    return array 
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/str_and_salt2sha1.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/str_and_salt2sha1.rb
new file mode 100644
index 00000000..71d69cf5
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/str_and_salt2sha1.rb
@@ -0,0 +1,32 @@
+#
+# str_and_salt2sha1.rb 
+#
+
+module Puppet::Parser::Functions
+  newfunction(:str_and_salt2sha1, :type => :rvalue, :doc => <<-EOS
+This converts a string to an array containing the salted SHA1 password hash in
+the first field, and the salt itself in second field of the returned array. 
+This combination is used i.e. for couchdb passwords.
+    EOS
+  ) do |arguments|
+    require 'digest/sha1'
+
+    raise(Puppet::ParseError, "str_and_salt2sha1(): Wrong number of arguments " +
+      "passed (#{arguments.size} but we require 1)") if arguments.size != 1
+
+    str_and_salt = arguments[0]
+
+    unless str_and_salt.is_a?(Array)
+      raise(Puppet::ParseError, 'str_and_salt2sha1(): Requires a ' +
+        "Array argument, you passed: #{password.class}")
+    end
+
+    str  = str_and_salt[0]
+    salt = str_and_salt[1]
+    sha1 = Digest::SHA1.hexdigest(str+ salt)
+
+    return sha1
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/strftime.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/strftime.rb
new file mode 100644
index 00000000..0b52adec
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/strftime.rb
@@ -0,0 +1,107 @@
+#
+# strftime.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:strftime, :type => :rvalue, :doc => <<-EOS
+This function returns formatted time.
+
+*Examples:*
+
+To return the time since epoch:
+
+    strftime("%s")
+
+To return the date:
+
+    strftime("%Y-%m-%d")
+
+*Format meaning:*
+
+    %a - The abbreviated weekday name (``Sun'')
+    %A - The  full  weekday  name (``Sunday'')
+    %b - The abbreviated month name (``Jan'')
+    %B - The  full  month  name (``January'')
+    %c - The preferred local date and time representation
+    %C - Century (20 in 2009)
+    %d - Day of the month (01..31)
+    %D - Date (%m/%d/%y)
+    %e - Day of the month, blank-padded ( 1..31)
+    %F - Equivalent to %Y-%m-%d (the ISO 8601 date format)
+    %h - Equivalent to %b
+    %H - Hour of the day, 24-hour clock (00..23)
+    %I - Hour of the day, 12-hour clock (01..12)
+    %j - Day of the year (001..366)
+    %k - hour, 24-hour clock, blank-padded ( 0..23)
+    %l - hour, 12-hour clock, blank-padded ( 0..12)
+    %L - Millisecond of the second (000..999)
+    %m - Month of the year (01..12)
+    %M - Minute of the hour (00..59)
+    %n - Newline (\n)
+    %N - Fractional seconds digits, default is 9 digits (nanosecond)
+            %3N  millisecond (3 digits)
+            %6N  microsecond (6 digits)
+            %9N  nanosecond (9 digits)
+    %p - Meridian indicator (``AM''  or  ``PM'')
+    %P - Meridian indicator (``am''  or  ``pm'')
+    %r - time, 12-hour (same as %I:%M:%S %p)
+    %R - time, 24-hour (%H:%M)
+    %s - Number of seconds since 1970-01-01 00:00:00 UTC.
+    %S - Second of the minute (00..60)
+    %t - Tab character (\t)
+    %T - time, 24-hour (%H:%M:%S)
+    %u - Day of the week as a decimal, Monday being 1. (1..7)
+    %U - Week  number  of the current year,
+            starting with the first Sunday as the first
+            day of the first week (00..53)
+    %v - VMS date (%e-%b-%Y)
+    %V - Week number of year according to ISO 8601 (01..53)
+    %W - Week  number  of the current year,
+            starting with the first Monday as the first
+            day of the first week (00..53)
+    %w - Day of the week (Sunday is 0, 0..6)
+    %x - Preferred representation for the date alone, no time
+    %X - Preferred representation for the time alone, no date
+    %y - Year without a century (00..99)
+    %Y - Year with century
+    %z - Time zone as  hour offset from UTC (e.g. +0900)
+    %Z - Time zone name
+    %% - Literal ``%'' character
+    EOS
+  ) do |arguments|
+
+    # Technically we support two arguments but only first is mandatory ...
+    raise(Puppet::ParseError, "strftime(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    format = arguments[0]
+
+    raise(Puppet::ParseError, 'strftime(): You must provide ' +
+      'format for evaluation') if format.empty?
+
+    # The Time Zone argument is optional ...
+    time_zone = arguments[1] if arguments[1]
+
+    time = Time.new
+
+    # There is probably a better way to handle Time Zone ...
+    if time_zone and not time_zone.empty?
+      original_zone = ENV['TZ']
+
+      local_time = time.clone
+      local_time = local_time.utc
+
+      ENV['TZ'] = time_zone
+
+      time = local_time.localtime
+
+      ENV['TZ'] = original_zone
+    end
+
+    result = time.strftime(format)
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/strip.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/strip.rb
new file mode 100644
index 00000000..3fac47d5
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/strip.rb
@@ -0,0 +1,38 @@
+#
+#  strip.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:strip, :type => :rvalue, :doc => <<-EOS
+This function removes leading and trailing whitespace from a string or from
+every string inside an array.
+
+*Examples:*
+
+    strip("    aaa   ")
+
+Would result in: "aaa"
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "strip(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'strip(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      result = value.collect { |i| i.is_a?(String) ? i.strip : i }
+    else
+      result = value.strip
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/suffix.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/suffix.rb
new file mode 100644
index 00000000..f7792d6f
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/suffix.rb
@@ -0,0 +1,45 @@
+#
+# suffix.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:suffix, :type => :rvalue, :doc => <<-EOS
+This function applies a suffix to all elements in an array.
+
+*Examples:*
+
+    suffix(['a','b','c'], 'p')
+
+Will return: ['ap','bp','cp']
+    EOS
+  ) do |arguments|
+
+    # Technically we support two arguments but only first is mandatory ...
+    raise(Puppet::ParseError, "suffix(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    array = arguments[0]
+
+    unless array.is_a?(Array)
+      raise Puppet::ParseError, "suffix(): expected first argument to be an Array, got #{array.inspect}"
+    end
+
+    suffix = arguments[1] if arguments[1]
+
+    if suffix
+      unless suffix.is_a? String
+        raise Puppet::ParseError, "suffix(): expected second argument to be a String, got #{suffix.inspect}"
+      end
+    end
+
+    # Turn everything into string same as join would do ...
+    result = array.collect do |i|
+      i = i.to_s
+      suffix ? i + suffix : i
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/swapcase.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/swapcase.rb
new file mode 100644
index 00000000..eb7fe137
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/swapcase.rb
@@ -0,0 +1,38 @@
+#
+#  swapcase.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:swapcase, :type => :rvalue, :doc => <<-EOS
+This function will swap the existing case of a string.
+
+*Examples:*
+
+    swapcase("aBcD")
+
+Would result in: "AbCd"
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "swapcase(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'swapcase(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? i.swapcase : i }
+    else
+      result = value.swapcase
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/time.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/time.rb
new file mode 100644
index 00000000..0cddaf86
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/time.rb
@@ -0,0 +1,49 @@
+#
+# time.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:time, :type => :rvalue, :doc => <<-EOS
+This function will return the current time since epoch as an integer.
+
+*Examples:*
+
+    time()
+
+Will return something like: 1311972653
+    EOS
+  ) do |arguments|
+
+    # The Time Zone argument is optional ...
+    time_zone = arguments[0] if arguments[0]
+
+    if (arguments.size != 0) and (arguments.size != 1) then
+      raise(Puppet::ParseError, "time(): Wrong number of arguments "+
+        "given #{arguments.size} for 0 or 1")
+    end
+
+    time = Time.new
+
+    # There is probably a better way to handle Time Zone ...
+    if time_zone and not time_zone.empty?
+      original_zone = ENV['TZ']
+
+      local_time = time.clone
+      local_time = local_time.utc
+
+      ENV['TZ'] = time_zone
+
+      time = local_time.localtime
+
+      ENV['TZ'] = original_zone
+    end
+
+    # Calling Time#to_i on a receiver changes it.  Trust me I am the Doctor.
+    result = time.strftime('%s')
+    result = result.to_i
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb
new file mode 100644
index 00000000..df490ea8
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/to_bytes.rb
@@ -0,0 +1,31 @@
+module Puppet::Parser::Functions
+  newfunction(:to_bytes, :type => :rvalue, :doc => <<-EOS
+    Converts the argument into bytes, for example 4 kB becomes 4096.
+    Takes a single string value as an argument.
+    These conversions reflect a layperson's understanding of
+    1 MB = 1024 KB, when in fact 1 MB = 1000 KB, and 1 MiB = 1024 KiB.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "to_bytes(): Wrong number of arguments " +
+          "given (#{arguments.size} for 1)") if arguments.size != 1
+
+    arg = arguments[0]
+
+    return arg if arg.is_a? Numeric
+
+    value,prefix = */([0-9.e+-]*)\s*([^bB]?)/.match(arg)[1,2]
+
+    value = value.to_f
+    case prefix
+    when '' then return value.to_i
+    when 'k' then return (value*(1<<10)).to_i
+    when 'M' then return (value*(1<<20)).to_i
+    when 'G' then return (value*(1<<30)).to_i
+    when 'T' then return (value*(1<<40)).to_i
+    when 'P' then return (value*(1<<50)).to_i
+    when 'E' then return (value*(1<<60)).to_i
+    else raise Puppet::ParseError, "to_bytes(): Unknown prefix #{prefix}"
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/type.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/type.rb
new file mode 100644
index 00000000..016529b0
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/type.rb
@@ -0,0 +1,19 @@
+#
+# type.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:type, :type => :rvalue, :doc => <<-EOS
+  DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.
+    EOS
+  ) do |args|
+
+    warning("type() DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.")
+    if ! Puppet::Parser::Functions.autoloader.loaded?(:type3x)
+      Puppet::Parser::Functions.autoloader.load(:type3x)
+    end
+    function_type3x(args + [false])
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/type3x.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/type3x.rb
new file mode 100644
index 00000000..0800b4a3
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/type3x.rb
@@ -0,0 +1,51 @@
+#
+# type3x.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:type3x, :type => :rvalue, :doc => <<-EOS
+DEPRECATED: This function will be removed when puppet 3 support is dropped; please migrate to the new parser's typing system.
+
+Returns the type when passed a value. Type can be one of:
+
+* string
+* array
+* hash
+* float
+* integer
+* boolean
+    EOS
+  ) do |args|
+    raise(Puppet::ParseError, "type3x(): Wrong number of arguments " +
+      "given (#{args.size} for 1)") if args.size < 1
+
+    value = args[0]
+
+    klass = value.class
+
+    if not [TrueClass, FalseClass, Array, Bignum, Fixnum, Float, Hash, String].include?(klass)
+      raise(Puppet::ParseError, 'type3x(): Unknown type')
+    end
+
+    klass = klass.to_s # Ugly ...
+
+    # We note that Integer is the parent to Bignum and Fixnum ...
+    result = case klass
+      when /^(?:Big|Fix)num$/ then 'integer'
+      when /^(?:True|False)Class$/ then 'boolean'
+      else klass
+    end
+
+    if result == "String" then
+      if value == value.to_i.to_s then
+        result = "Integer"
+      elsif value == value.to_f.to_s then
+        result = "Float"
+      end
+    end
+
+    return result.downcase
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/union.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/union.rb
new file mode 100644
index 00000000..c91bb805
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/union.rb
@@ -0,0 +1,34 @@
+#
+# union.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:union, :type => :rvalue, :doc => <<-EOS
+This function returns a union of two arrays.
+
+*Examples:*
+
+    union(["a","b","c"],["b","c","d"])
+
+Would return: ["a","b","c","d"]
+    EOS
+  ) do |arguments|
+
+    # Two arguments are required
+    raise(Puppet::ParseError, "union(): Wrong number of arguments " +
+      "given (#{arguments.size} for 2)") if arguments.size != 2
+
+    first = arguments[0]
+    second = arguments[1]
+
+    unless first.is_a?(Array) && second.is_a?(Array)
+      raise(Puppet::ParseError, 'union(): Requires 2 arrays')
+    end
+
+    result = first | second
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/unique.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/unique.rb
new file mode 100644
index 00000000..cf770f3b
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/unique.rb
@@ -0,0 +1,50 @@
+#
+# unique.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:unique, :type => :rvalue, :doc => <<-EOS
+This function will remove duplicates from strings and arrays.
+
+*Examples:*
+
+    unique("aabbcc")
+
+Will return:
+
+    abc
+
+You can also use this with arrays:
+
+    unique(["a","a","b","b","c","c"])
+
+This returns:
+
+    ["a","b","c"]
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "unique(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'unique(): Requires either ' +
+        'array or string to work with')
+    end
+
+    result = value.clone
+
+    string = value.is_a?(String) ? true : false
+
+    # We turn any string value into an array to be able to shuffle ...
+    result = string ? result.split('') : result
+    result = result.uniq # Remove duplicates ...
+    result = string ? result.join : result
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/upcase.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/upcase.rb
new file mode 100644
index 00000000..4302b29e
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/upcase.rb
@@ -0,0 +1,40 @@
+#
+# upcase.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:upcase, :type => :rvalue, :doc => <<-EOS
+Converts a string or an array of strings to uppercase.
+
+*Examples:*
+
+    upcase("abcd")
+
+Will return:
+
+    ASDF
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "upcase(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'upcase(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? i.upcase : i }
+    else
+      result = value.upcase
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/uriescape.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/uriescape.rb
new file mode 100644
index 00000000..a486eee5
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/uriescape.rb
@@ -0,0 +1,34 @@
+#
+#  uriescape.rb
+#
+require 'uri'
+
+module Puppet::Parser::Functions
+  newfunction(:uriescape, :type => :rvalue, :doc => <<-EOS
+    Urlencodes a string or array of strings.
+    Requires either a single string or an array as an input.
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "uriescape(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    value = arguments[0]
+
+    unless value.is_a?(Array) || value.is_a?(String)
+      raise(Puppet::ParseError, 'uriescape(): Requires either ' +
+        'array or string to work with')
+    end
+
+    if value.is_a?(Array)
+      # Numbers in Puppet are often string-encoded which is troublesome ...
+      result = value.collect { |i| i.is_a?(String) ? URI.escape(i,unsafe) : i }
+    else
+      result = URI.escape(value)
+    end
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb
new file mode 100644
index 00000000..b6966809
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_absolute_path.rb
@@ -0,0 +1,69 @@
+module Puppet::Parser::Functions
+  newfunction(:validate_absolute_path, :doc => <<-'ENDHEREDOC') do |args|
+    Validate the string represents an absolute path in the filesystem.  This function works
+    for windows and unix style paths.
+
+    The following values will pass:
+
+        $my_path = 'C:/Program Files (x86)/Puppet Labs/Puppet'
+        validate_absolute_path($my_path)
+        $my_path2 = '/var/lib/puppet'
+        validate_absolute_path($my_path2)
+        $my_path3 = ['C:/Program Files (x86)/Puppet Labs/Puppet','C:/Program Files/Puppet Labs/Puppet']
+        validate_absolute_path($my_path3)
+        $my_path4 = ['/var/lib/puppet','/usr/share/puppet']
+        validate_absolute_path($my_path4)
+
+    The following values will fail, causing compilation to abort:
+
+        validate_absolute_path(true)
+        validate_absolute_path('../var/lib/puppet')
+        validate_absolute_path('var/lib/puppet')
+        validate_absolute_path([ 'var/lib/puppet', '/var/foo' ])
+        validate_absolute_path([ '/var/lib/puppet', 'var/foo' ])
+        $undefined = undef
+        validate_absolute_path($undefined)
+
+    ENDHEREDOC
+
+    require 'puppet/util'
+
+    unless args.length > 0 then
+      raise Puppet::ParseError, ("validate_absolute_path(): wrong number of arguments (#{args.length}; must be > 0)")
+    end
+
+    args.each do |arg|
+      # put arg to candidate var to be able to replace it
+      candidates = arg
+      # if arg is just a string with a path to test, convert it to an array
+      # to avoid test code duplication
+      unless arg.is_a?(Array) then
+        candidates = Array.new(1,arg)
+      end
+      # iterate over all pathes within the candidates array
+      candidates.each do |path|
+        # This logic was borrowed from
+        # [lib/puppet/file_serving/base.rb](https://github.com/puppetlabs/puppet/blob/master/lib/puppet/file_serving/base.rb)
+        # Puppet 2.7 and beyond will have Puppet::Util.absolute_path? Fall back to a back-ported implementation otherwise.
+        if Puppet::Util.respond_to?(:absolute_path?) then
+          unless Puppet::Util.absolute_path?(path, :posix) or Puppet::Util.absolute_path?(path, :windows)
+            raise Puppet::ParseError, ("#{path.inspect} is not an absolute path.")
+          end
+        else
+          # This code back-ported from 2.7.x's lib/puppet/util.rb Puppet::Util.absolute_path?
+          # Determine in a platform-specific way whether a path is absolute. This
+          # defaults to the local platform if none is specified.
+          # Escape once for the string literal, and once for the regex.
+          slash = '[\\\\/]'
+          name = '[^\\\\/]+'
+          regexes = {
+            :windows => %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i,
+            :posix => %r!^/!,
+          }
+          rval = (!!(path =~ regexes[:posix])) || (!!(path =~ regexes[:windows]))
+          rval or raise Puppet::ParseError, ("#{path.inspect} is not an absolute path.")
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_array.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_array.rb
new file mode 100644
index 00000000..34b51182
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_array.rb
@@ -0,0 +1,33 @@
+module Puppet::Parser::Functions
+
+  newfunction(:validate_array, :doc => <<-'ENDHEREDOC') do |args|
+    Validate that all passed values are array data structures. Abort catalog
+    compilation if any value fails this check.
+
+    The following values will pass:
+
+        $my_array = [ 'one', 'two' ]
+        validate_array($my_array)
+
+    The following values will fail, causing compilation to abort:
+
+        validate_array(true)
+        validate_array('some_string')
+        $undefined = undef
+        validate_array($undefined)
+
+    ENDHEREDOC
+
+    unless args.length > 0 then
+      raise Puppet::ParseError, ("validate_array(): wrong number of arguments (#{args.length}; must be > 0)")
+    end
+
+    args.each do |arg|
+      unless arg.is_a?(Array)
+        raise Puppet::ParseError, ("#{arg.inspect} is not an Array.  It looks to be a #{arg.class}")
+      end
+    end
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb
new file mode 100644
index 00000000..4ea4fe07
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_augeas.rb
@@ -0,0 +1,83 @@
+require 'tempfile'
+
+module Puppet::Parser::Functions
+  newfunction(:validate_augeas, :doc => <<-'ENDHEREDOC') do |args|
+    Perform validation of a string using an Augeas lens
+    The first argument of this function should be a string to
+    test, and the second argument should be the name of the Augeas lens to use.
+    If Augeas fails to parse the string with the lens, the compilation will
+    abort with a parse error.
+
+    A third argument can be specified, listing paths which should
+    not be found in the file. The `$file` variable points to the location
+    of the temporary file being tested in the Augeas tree.
+
+    For example, if you want to make sure your passwd content never contains
+    a user `foo`, you could write:
+
+        validate_augeas($passwdcontent, 'Passwd.lns', ['$file/foo'])
+
+    Or if you wanted to ensure that no users used the '/bin/barsh' shell,
+    you could use:
+
+        validate_augeas($passwdcontent, 'Passwd.lns', ['$file/*[shell="/bin/barsh"]']
+
+    If a fourth argument is specified, this will be the error message raised and
+    seen by the user.
+
+    A helpful error message can be returned like this:
+
+        validate_augeas($sudoerscontent, 'Sudoers.lns', [], 'Failed to validate sudoers content with Augeas')
+
+    ENDHEREDOC
+    unless Puppet.features.augeas?
+      raise Puppet::ParseError, ("validate_augeas(): this function requires the augeas feature. See http://projects.puppetlabs.com/projects/puppet/wiki/Puppet_Augeas#Pre-requisites for how to activate it.")
+    end
+
+    if (args.length < 2) or (args.length > 4) then
+      raise Puppet::ParseError, ("validate_augeas(): wrong number of arguments (#{args.length}; must be 2, 3, or 4)")
+    end
+
+    msg = args[3] || "validate_augeas(): Failed to validate content against #{args[1].inspect}"
+
+    require 'augeas'
+    aug = Augeas::open(nil, nil, Augeas::NO_MODL_AUTOLOAD)
+    begin
+      content = args[0]
+
+      # Test content in a temporary file
+      tmpfile = Tempfile.new("validate_augeas")
+      begin
+        tmpfile.write(content)
+      ensure
+        tmpfile.close
+      end
+
+      # Check for syntax
+      lens = args[1]
+      aug.transform(
+        :lens => lens,
+        :name => 'Validate_augeas',
+        :incl => tmpfile.path
+      )
+      aug.load!
+
+      unless aug.match("/augeas/files#{tmpfile.path}//error").empty?
+        error = aug.get("/augeas/files#{tmpfile.path}//error/message")
+        msg += " with error: #{error}"
+        raise Puppet::ParseError, (msg)
+      end
+
+      # Launch unit tests
+      tests = args[2] || []
+      aug.defvar('file', "/files#{tmpfile.path}")
+      tests.each do |t|
+        msg += " testing path #{t}"
+        raise Puppet::ParseError, (msg) unless aug.match(t).empty?
+      end
+    ensure
+      aug.close
+      tmpfile.unlink
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb
new file mode 100644
index 00000000..59a08056
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_bool.rb
@@ -0,0 +1,34 @@
+module Puppet::Parser::Functions
+
+  newfunction(:validate_bool, :doc => <<-'ENDHEREDOC') do |args|
+    Validate that all passed values are either true or false. Abort catalog
+    compilation if any value fails this check.
+
+    The following values will pass:
+
+        $iamtrue = true
+        validate_bool(true)
+        validate_bool(true, true, false, $iamtrue)
+
+    The following values will fail, causing compilation to abort:
+
+        $some_array = [ true ]
+        validate_bool("false")
+        validate_bool("true")
+        validate_bool($some_array)
+
+    ENDHEREDOC
+
+    unless args.length > 0 then
+      raise Puppet::ParseError, ("validate_bool(): wrong number of arguments (#{args.length}; must be > 0)")
+    end
+
+    args.each do |arg|
+      unless function_is_bool([arg])
+        raise Puppet::ParseError, ("#{arg.inspect} is not a boolean.  It looks to be a #{arg.class}")
+      end
+    end
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb
new file mode 100644
index 00000000..5df3c609
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_cmd.rb
@@ -0,0 +1,63 @@
+require 'puppet/util/execution'
+require 'tempfile'
+
+module Puppet::Parser::Functions
+  newfunction(:validate_cmd, :doc => <<-'ENDHEREDOC') do |args|
+    Perform validation of a string with an external command.
+    The first argument of this function should be a string to
+    test, and the second argument should be a path to a test command
+    taking a % as a placeholder for the file path (will default to the end).
+    If the command, launched against a tempfile containing the passed string,
+    returns a non-null value, compilation will abort with a parse error.
+
+    If a third argument is specified, this will be the error message raised and
+    seen by the user.
+
+    A helpful error message can be returned like this:
+
+    Example:
+
+        # Defaults to end of path
+        validate_cmd($sudoerscontent, '/usr/sbin/visudo -c -f', 'Visudo failed to validate sudoers content')
+
+        # % as file location
+        validate_cmd($haproxycontent, '/usr/sbin/haproxy -f % -c', 'Haproxy failed to validate config content')
+
+    ENDHEREDOC
+    if (args.length < 2) or (args.length > 3) then
+      raise Puppet::ParseError, ("validate_cmd(): wrong number of arguments (#{args.length}; must be 2 or 3)")
+    end
+
+    msg = args[2] || "validate_cmd(): failed to validate content with command #{args[1].inspect}"
+
+    content = args[0]
+    checkscript = args[1]
+
+    # Test content in a temporary file
+    tmpfile = Tempfile.new("validate_cmd")
+    begin
+      tmpfile.write(content)
+      tmpfile.close
+
+      if checkscript =~ /\s%(\s|$)/
+        check_with_correct_location = checkscript.gsub(/%/,tmpfile.path)
+      else
+        check_with_correct_location = "#{checkscript} #{tmpfile.path}"
+      end
+
+      if Puppet::Util::Execution.respond_to?('execute')
+        Puppet::Util::Execution.execute(check_with_correct_location)
+      else
+        Puppet::Util.execute(check_with_correct_location)
+      end
+    rescue Puppet::ExecutionFailure => detail
+      msg += "\n#{detail}"
+      raise Puppet::ParseError, msg
+    rescue Exception => detail
+      msg += "\n#{detail.class.name} #{detail}"
+      raise Puppet::ParseError, msg
+    ensure
+      tmpfile.unlink
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb
new file mode 100644
index 00000000..9bdd5432
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_hash.rb
@@ -0,0 +1,33 @@
+module Puppet::Parser::Functions
+
+  newfunction(:validate_hash, :doc => <<-'ENDHEREDOC') do |args|
+    Validate that all passed values are hash data structures. Abort catalog
+    compilation if any value fails this check.
+
+    The following values will pass:
+
+        $my_hash = { 'one' => 'two' }
+        validate_hash($my_hash)
+
+    The following values will fail, causing compilation to abort:
+
+        validate_hash(true)
+        validate_hash('some_string')
+        $undefined = undef
+        validate_hash($undefined)
+
+    ENDHEREDOC
+
+    unless args.length > 0 then
+      raise Puppet::ParseError, ("validate_hash(): wrong number of arguments (#{args.length}; must be > 0)")
+    end
+
+    args.each do |arg|
+      unless arg.is_a?(Hash)
+        raise Puppet::ParseError, ("#{arg.inspect} is not a Hash.  It looks to be a #{arg.class}")
+      end
+    end
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb
new file mode 100644
index 00000000..fc02748e
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_ipv4_address.rb
@@ -0,0 +1,48 @@
+module Puppet::Parser::Functions
+
+  newfunction(:validate_ipv4_address, :doc => <<-ENDHEREDOC
+    Validate that all values passed are valid IPv4 addresses.
+    Fail compilation if any value fails this check.
+
+    The following values will pass:
+
+    $my_ip = "1.2.3.4"
+    validate_ipv4_address($my_ip)
+    validate_bool("8.8.8.8", "172.16.0.1", $my_ip)
+
+    The following values will fail, causing compilation to abort:
+
+    $some_array = [ 1, true, false, "garbage string", "3ffe:505:2" ]
+    validate_ipv4_address($some_array)
+
+    ENDHEREDOC
+  ) do |args|
+
+    require "ipaddr"
+    rescuable_exceptions = [ ArgumentError ]
+
+    if defined?(IPAddr::InvalidAddressError)
+      rescuable_exceptions << IPAddr::InvalidAddressError
+    end
+
+    unless args.length > 0 then
+      raise Puppet::ParseError, ("validate_ipv4_address(): wrong number of arguments (#{args.length}; must be > 0)")
+    end
+
+    args.each do |arg|
+      unless arg.is_a?(String)
+        raise Puppet::ParseError, "#{arg.inspect} is not a string."
+      end
+
+      begin
+        unless IPAddr.new(arg).ipv4?
+          raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv4 address."
+        end
+      rescue *rescuable_exceptions
+        raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv4 address."
+      end
+    end
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb
new file mode 100644
index 00000000..b0f2558d
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_ipv6_address.rb
@@ -0,0 +1,49 @@
+module Puppet::Parser::Functions
+
+  newfunction(:validate_ipv6_address, :doc => <<-ENDHEREDOC
+    Validate that all values passed are valid IPv6 addresses.
+    Fail compilation if any value fails this check.
+
+    The following values will pass:
+
+    $my_ip = "3ffe:505:2"
+    validate_ipv6_address(1)
+    validate_ipv6_address($my_ip)
+    validate_bool("fe80::baf6:b1ff:fe19:7507", $my_ip)
+
+    The following values will fail, causing compilation to abort:
+
+    $some_array = [ true, false, "garbage string", "1.2.3.4" ]
+    validate_ipv6_address($some_array)
+
+    ENDHEREDOC
+  ) do |args|
+
+    require "ipaddr"
+    rescuable_exceptions = [ ArgumentError ]
+
+    if defined?(IPAddr::InvalidAddressError)
+      rescuable_exceptions << IPAddr::InvalidAddressError
+    end
+
+    unless args.length > 0 then
+      raise Puppet::ParseError, ("validate_ipv6_address(): wrong number of arguments (#{args.length}; must be > 0)")
+    end
+
+    args.each do |arg|
+      unless arg.is_a?(String)
+        raise Puppet::ParseError, "#{arg.inspect} is not a string."
+      end
+
+      begin
+        unless IPAddr.new(arg).ipv6?
+          raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv6 address."
+        end
+      rescue *rescuable_exceptions
+        raise Puppet::ParseError, "#{arg.inspect} is not a valid IPv6 address."
+      end
+    end
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_re.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_re.rb
new file mode 100644
index 00000000..ca25a702
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_re.rb
@@ -0,0 +1,40 @@
+module Puppet::Parser::Functions
+  newfunction(:validate_re, :doc => <<-'ENDHEREDOC') do |args|
+    Perform simple validation of a string against one or more regular
+    expressions. The first argument of this function should be a string to
+    test, and the second argument should be a stringified regular expression
+    (without the // delimiters) or an array of regular expressions.  If none
+    of the regular expressions match the string passed in, compilation will
+    abort with a parse error.
+
+    If a third argument is specified, this will be the error message raised and
+    seen by the user.
+
+    The following strings will validate against the regular expressions:
+
+        validate_re('one', '^one$')
+        validate_re('one', [ '^one', '^two' ])
+
+    The following strings will fail to validate, causing compilation to abort:
+
+        validate_re('one', [ '^two', '^three' ])
+
+    A helpful error message can be returned like this:
+
+        validate_re($::puppetversion, '^2.7', 'The $puppetversion fact value does not match 2.7')
+
+    ENDHEREDOC
+    if (args.length < 2) or (args.length > 3) then
+      raise Puppet::ParseError, ("validate_re(): wrong number of arguments (#{args.length}; must be 2 or 3)")
+    end
+
+    msg = args[2] || "validate_re(): #{args[0].inspect} does not match #{args[1].inspect}"
+
+    # We're using a flattened array here because we can't call String#any? in
+    # Ruby 1.9 like we can in Ruby 1.8
+    raise Puppet::ParseError, (msg) unless [args[1]].flatten.any? do |re_str|
+      args[0] =~ Regexp.compile(re_str)
+    end
+
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb
new file mode 100644
index 00000000..7d534f37
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_slength.rb
@@ -0,0 +1,71 @@
+module Puppet::Parser::Functions
+
+  newfunction(:validate_slength, :doc => <<-'ENDHEREDOC') do |args|
+    Validate that the first argument is a string (or an array of strings), and
+    less/equal to than the length of the second argument. An optional third
+    parameter can be given a the minimum length. It fails if the first
+    argument is not a string or array of strings, and if arg 2 and arg 3 are
+    not convertable to a number.
+
+    The following values will pass:
+
+      validate_slength("discombobulate",17)
+      validate_slength(["discombobulate","moo"],17)
+      validate_slength(["discombobulate","moo"],17,3)
+
+    The following valueis will not:
+
+      validate_slength("discombobulate",1)
+      validate_slength(["discombobulate","thermometer"],5)
+      validate_slength(["discombobulate","moo"],17,10)
+
+    ENDHEREDOC
+
+    raise Puppet::ParseError, "validate_slength(): Wrong number of arguments (#{args.length}; must be 2 or 3)" unless args.length == 2 or args.length == 3
+
+    input, max_length, min_length = *args
+
+    begin
+      max_length = Integer(max_length)
+      raise ArgumentError if max_length <= 0
+    rescue ArgumentError, TypeError
+      raise Puppet::ParseError, "validate_slength(): Expected second argument to be a positive Numeric, got #{max_length}:#{max_length.class}"
+    end
+
+    if min_length
+      begin
+        min_length = Integer(min_length)
+        raise ArgumentError if min_length < 0
+    rescue ArgumentError, TypeError
+        raise Puppet::ParseError, "validate_slength(): Expected third argument to be unset or a positive Numeric, got #{min_length}:#{min_length.class}"
+      end
+    else
+      min_length = 0
+    end
+
+    if min_length > max_length
+      raise Puppet::ParseError, "validate_slength(): Expected second argument to be larger than third argument"
+    end
+
+    validator = lambda do |str|
+      unless str.length <= max_length and str.length >= min_length
+        raise Puppet::ParseError, "validate_slength(): Expected length of #{input.inspect} to be between #{min_length} and #{max_length}, was #{input.length}"
+      end
+    end
+
+    case input
+    when String
+      validator.call(input)
+    when Array
+      input.each_with_index do |arg, pos|
+        if arg.is_a? String
+          validator.call(arg)
+        else
+          raise Puppet::ParseError, "validate_slength(): Expected element at array position #{pos} to be a String, got #{arg.class}"
+        end
+      end
+    else
+      raise Puppet::ParseError, "validate_slength(): Expected first argument to be a String or Array, got #{input.class}"
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/validate_string.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_string.rb
new file mode 100644
index 00000000..c841f6ab
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/validate_string.rb
@@ -0,0 +1,38 @@
+module Puppet::Parser::Functions
+
+  newfunction(:validate_string, :doc => <<-'ENDHEREDOC') do |args|
+    Validate that all passed values are string data structures. Abort catalog
+    compilation if any value fails this check.
+
+    The following values will pass:
+
+        $my_string = "one two"
+        validate_string($my_string, 'three')
+
+    The following values will fail, causing compilation to abort:
+
+        validate_string(true)
+        validate_string([ 'some', 'array' ])
+        
+    Note: validate_string(undef) will not fail in this version of the
+    functions API (incl. current and future parser). Instead, use:
+    
+        if $var == undef {
+          fail('...')
+        }
+    
+    ENDHEREDOC
+
+    unless args.length > 0 then
+      raise Puppet::ParseError, ("validate_string(): wrong number of arguments (#{args.length}; must be > 0)")
+    end
+
+    args.each do |arg|
+      unless arg.is_a?(String)
+        raise Puppet::ParseError, ("#{arg.inspect} is not a string.  It looks to be a #{arg.class}")
+      end
+    end
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/values.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/values.rb
new file mode 100644
index 00000000..16067561
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/values.rb
@@ -0,0 +1,39 @@
+#
+# values.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:values, :type => :rvalue, :doc => <<-EOS
+When given a hash this function will return the values of that hash.
+
+*Examples:*
+
+    $hash = {
+      'a' => 1,
+      'b' => 2,
+      'c' => 3,
+    }
+    values($hash)
+
+This example would return:
+
+    [1,2,3]
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "values(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size < 1
+
+    hash = arguments[0]
+
+    unless hash.is_a?(Hash)
+      raise(Puppet::ParseError, 'values(): Requires hash to work with')
+    end
+
+    result = hash.values
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/values_at.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/values_at.rb
new file mode 100644
index 00000000..f350f539
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/values_at.rb
@@ -0,0 +1,99 @@
+#
+# values_at.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:values_at, :type => :rvalue, :doc => <<-EOS
+Finds value inside an array based on location.
+
+The first argument is the array you want to analyze, and the second element can
+be a combination of:
+
+* A single numeric index
+* A range in the form of 'start-stop' (eg. 4-9)
+* An array combining the above
+
+*Examples*:
+
+    values_at(['a','b','c'], 2)
+
+Would return ['c'].
+
+    values_at(['a','b','c'], ["0-1"])
+
+Would return ['a','b'].
+
+    values_at(['a','b','c','d','e'], [0, "2-3"])
+
+Would return ['a','c','d'].
+    EOS
+  ) do |arguments|
+
+    raise(Puppet::ParseError, "values_at(): Wrong number of " +
+      "arguments given (#{arguments.size} for 2)") if arguments.size < 2
+
+    array = arguments.shift
+
+    unless array.is_a?(Array)
+      raise(Puppet::ParseError, 'values_at(): Requires array to work with')
+    end
+
+    indices = [arguments.shift].flatten() # Get them all ... Pokemon ...
+
+    if not indices or indices.empty?
+      raise(Puppet::ParseError, 'values_at(): You must provide ' +
+        'at least one positive index to collect')
+    end
+
+    result       = []
+    indices_list = []
+
+    indices.each do |i|
+      i = i.to_s
+      if m = i.match(/^(\d+)(\.\.\.?|\-)(\d+)$/)
+        start = m[1].to_i
+        stop  = m[3].to_i
+
+        type = m[2]
+
+        if start > stop
+          raise(Puppet::ParseError, 'values_at(): Stop index in ' +
+            'given indices range is smaller than the start index')
+        elsif stop > array.size - 1 # First element is at index 0 is it not?
+          raise(Puppet::ParseError, 'values_at(): Stop index in ' +
+            'given indices range exceeds array size')
+        end
+
+        range = case type
+          when /^(\.\.|\-)$/ then (start .. stop)
+          when /^(\.\.\.)$/  then (start ... stop) # Exclusive of last element ...
+        end
+
+        range.each { |i| indices_list << i.to_i }
+      else
+        # Only positive numbers allowed in this case ...
+        if not i.match(/^\d+$/)
+          raise(Puppet::ParseError, 'values_at(): Unknown format ' +
+            'of given index')
+        end
+
+        # In Puppet numbers are often string-encoded ...
+        i = i.to_i
+
+        if i > array.size - 1 # Same story.  First element is at index 0 ...
+          raise(Puppet::ParseError, 'values_at(): Given index ' +
+            'exceeds array size')
+        end
+
+        indices_list << i
+      end
+    end
+
+    # We remove nil values as they make no sense in Puppet DSL ...
+    result = indices_list.collect { |i| array[i] }.compact
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/parser/functions/zip.rb b/puppet/modules/stdlib/lib/puppet/parser/functions/zip.rb
new file mode 100644
index 00000000..3074f282
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/parser/functions/zip.rb
@@ -0,0 +1,39 @@
+#
+# zip.rb
+#
+
+module Puppet::Parser::Functions
+  newfunction(:zip, :type => :rvalue, :doc => <<-EOS
+Takes one element from first array and merges corresponding elements from second array. This generates a sequence of n-element arrays, where n is one more than the count of arguments.
+
+*Example:*
+
+    zip(['1','2','3'],['4','5','6'])
+
+Would result in:
+
+    ["1", "4"], ["2", "5"], ["3", "6"]
+    EOS
+  ) do |arguments|
+
+    # Technically we support three arguments but only first is mandatory ...
+    raise(Puppet::ParseError, "zip(): Wrong number of arguments " +
+      "given (#{arguments.size} for 2)") if arguments.size < 2
+
+    a = arguments[0]
+    b = arguments[1]
+
+    unless a.is_a?(Array) and b.is_a?(Array)
+      raise(Puppet::ParseError, 'zip(): Requires array to work with')
+    end
+
+    flatten = function_str2bool([arguments[2]]) if arguments[2]
+
+    result = a.zip(b)
+    result = flatten ? result.flatten : result
+
+    return result
+  end
+end
+
+# vim: set ts=2 sw=2 et :
diff --git a/puppet/modules/stdlib/lib/puppet/provider/file_line/ruby.rb b/puppet/modules/stdlib/lib/puppet/provider/file_line/ruby.rb
new file mode 100644
index 00000000..ae1a8b3d
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/provider/file_line/ruby.rb
@@ -0,0 +1,85 @@
+Puppet::Type.type(:file_line).provide(:ruby) do
+  def exists?
+    lines.find do |line|
+      line.chomp == resource[:line].chomp
+    end
+  end
+
+  def create
+    if resource[:match]
+      handle_create_with_match
+    elsif resource[:after]
+      handle_create_with_after
+    else
+      append_line
+    end
+  end
+
+  def destroy
+    local_lines = lines
+    File.open(resource[:path],'w') do |fh|
+      fh.write(local_lines.reject{|l| l.chomp == resource[:line] }.join(''))
+    end
+  end
+
+  private
+  def lines
+    # If this type is ever used with very large files, we should
+    #  write this in a different way, using a temp
+    #  file; for now assuming that this type is only used on
+    #  small-ish config files that can fit into memory without
+    #  too much trouble.
+    @lines ||= File.readlines(resource[:path])
+  end
+
+  def handle_create_with_match()
+    regex = resource[:match] ? Regexp.new(resource[:match]) : nil
+    match_count = count_matches(regex)
+    if match_count > 1 && resource[:multiple].to_s != 'true'
+     raise Puppet::Error, "More than one line in file '#{resource[:path]}' matches pattern '#{resource[:match]}'"
+    end
+    File.open(resource[:path], 'w') do |fh|
+      lines.each do |l|
+        fh.puts(regex.match(l) ? resource[:line] : l)
+      end
+
+      if (match_count == 0)
+        fh.puts(resource[:line])
+      end
+    end
+  end
+
+  def handle_create_with_after
+    regex = Regexp.new(resource[:after])
+    count = count_matches(regex)
+    case count
+    when 1 # find the line to put our line after
+      File.open(resource[:path], 'w') do |fh|
+        lines.each do |l|
+          fh.puts(l)
+          if regex.match(l) then
+            fh.puts(resource[:line])
+          end
+        end
+      end
+    when 0 # append the line to the end of the file
+      append_line
+    else
+      raise Puppet::Error, "#{count} lines match pattern '#{resource[:after]}' in file '#{resource[:path]}'.  One or no line must match the pattern."
+    end
+  end
+
+  def count_matches(regex)
+    lines.select{|l| l.match(regex)}.size
+  end
+
+  ##
+  # append the line to the file.
+  #
+  # @api private
+  def append_line
+    File.open(resource[:path], 'a') do |fh|
+      fh.puts resource[:line]
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/type/anchor.rb b/puppet/modules/stdlib/lib/puppet/type/anchor.rb
new file mode 100644
index 00000000..fe1e5aa1
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/type/anchor.rb
@@ -0,0 +1,46 @@
+Puppet::Type.newtype(:anchor) do
+  desc <<-'ENDOFDESC'
+  A simple resource type intended to be used as an anchor in a composite class.
+
+  In Puppet 2.6, when a class declares another class, the resources in the
+  interior class are not contained by the exterior class. This interacts badly
+  with the pattern of composing complex modules from smaller classes, as it
+  makes it impossible for end users to specify order relationships between the
+  exterior class and other modules.
+
+  The anchor type lets you work around this. By sandwiching any interior
+  classes between two no-op resources that _are_ contained by the exterior
+  class, you can ensure that all resources in the module are contained.
+
+      class ntp {
+        # These classes will have the correct order relationship with each
+        # other. However, without anchors, they won't have any order
+        # relationship to Class['ntp'].
+        class { 'ntp::package': }
+        -> class { 'ntp::config': }
+        -> class { 'ntp::service': }
+
+        # These two resources "anchor" the composed classes within the ntp
+        # class.
+        anchor { 'ntp::begin': } -> Class['ntp::package']
+        Class['ntp::service']    -> anchor { 'ntp::end': }
+      }
+
+  This allows the end user of the ntp module to establish require and before
+  relationships with Class['ntp']:
+
+      class { 'ntp': } -> class { 'mcollective': }
+      class { 'mcollective': } -> class { 'ntp': }
+
+  ENDOFDESC
+
+  newparam :name do
+    desc "The name of the anchor resource."
+  end
+
+  def refresh
+    # We don't do anything with them, but we need this to
+    #   show that we are "refresh aware" and not break the
+    #   chain of propagation.
+  end
+end
diff --git a/puppet/modules/stdlib/lib/puppet/type/file_line.rb b/puppet/modules/stdlib/lib/puppet/type/file_line.rb
new file mode 100644
index 00000000..df263e6a
--- /dev/null
+++ b/puppet/modules/stdlib/lib/puppet/type/file_line.rb
@@ -0,0 +1,75 @@
+Puppet::Type.newtype(:file_line) do
+
+  desc <<-EOT
+    Ensures that a given line is contained within a file.  The implementation
+    matches the full line, including whitespace at the beginning and end.  If
+    the line is not contained in the given file, Puppet will add the line to
+    ensure the desired state.  Multiple resources may be declared to manage
+    multiple lines in the same file.
+
+    Example:
+
+        file_line { 'sudo_rule':
+          path => '/etc/sudoers',
+          line => '%sudo ALL=(ALL) ALL',
+        }
+        file_line { 'sudo_rule_nopw':
+          path => '/etc/sudoers',
+          line => '%sudonopw ALL=(ALL) NOPASSWD: ALL',
+        }
+
+    In this example, Puppet will ensure both of the specified lines are
+    contained in the file /etc/sudoers.
+
+    **Autorequires:** If Puppet is managing the file that will contain the line
+    being managed, the file_line resource will autorequire that file.
+
+  EOT
+
+  ensurable do
+    defaultvalues
+    defaultto :present
+  end
+
+  newparam(:name, :namevar => true) do
+    desc 'An arbitrary name used as the identity of the resource.'
+  end
+
+  newparam(:match) do
+    desc 'An optional regular expression to run against existing lines in the file;\n' +
+        'if a match is found, we replace that line rather than adding a new line.'
+  end
+
+  newparam(:multiple) do
+    desc 'An optional value to determine if match can change multiple lines.'
+    newvalues(true, false)
+  end
+
+  newparam(:after) do
+    desc 'An optional value used to specify the line after which we will add any new lines. (Existing lines are added in place)'
+  end
+
+  newparam(:line) do
+    desc 'The line to be appended to the file located by the path parameter.'
+  end
+
+  newparam(:path) do
+    desc 'The file Puppet will ensure contains the line specified by the line parameter.'
+    validate do |value|
+      unless (Puppet.features.posix? and value =~ /^\//) or (Puppet.features.microsoft_windows? and (value =~ /^.:\// or value =~ /^\/\/[^\/]+\/[^\/]+/))
+        raise(Puppet::Error, "File paths must be fully qualified, not '#{value}'")
+      end
+    end
+  end
+
+  # Autorequire the file resource if it's being managed
+  autorequire(:file) do
+    self[:path]
+  end
+
+  validate do
+    unless self[:line] and self[:path]
+      raise(Puppet::Error, "Both line and path are required attributes")
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/manifests/init.pp b/puppet/modules/stdlib/manifests/init.pp
new file mode 100644
index 00000000..500ad770
--- /dev/null
+++ b/puppet/modules/stdlib/manifests/init.pp
@@ -0,0 +1,20 @@
+# Class: stdlib
+#
+# This module manages stdlib. Most of stdlib's features are automatically
+# loaded by Puppet, but this class should be declared in order to use the
+# standardized run stages.
+#
+# Parameters: none
+#
+# Actions:
+#
+#   Declares all other classes in the stdlib module. Currently, this consists
+#   of stdlib::stages.
+#
+# Requires: nothing
+#
+class stdlib {
+
+  class { 'stdlib::stages': }
+
+}
diff --git a/puppet/modules/stdlib/manifests/stages.pp b/puppet/modules/stdlib/manifests/stages.pp
new file mode 100644
index 00000000..eb15fd65
--- /dev/null
+++ b/puppet/modules/stdlib/manifests/stages.pp
@@ -0,0 +1,43 @@
+# Class: stdlib::stages
+#
+# This class manages a standard set of run stages for Puppet. It is managed by
+# the stdlib class, and should not be declared independently.
+#
+# The high level stages are (in order):
+#
+#  * setup
+#  * main
+#  * runtime
+#  * setup_infra
+#  * deploy_infra
+#  * setup_app
+#  * deploy_app
+#  * deploy
+#
+# Parameters: none
+#
+# Actions:
+#
+#   Declares various run-stages for deploying infrastructure,
+#   language runtimes, and application layers.
+#
+# Requires: nothing
+#
+# Sample Usage:
+#
+#  node default {
+#    include stdlib
+#    class { java: stage => 'runtime' }
+#  }
+#
+class stdlib::stages {
+
+  stage { 'setup':  before => Stage['main'] }
+  stage { 'runtime': require => Stage['main'] }
+  -> stage { 'setup_infra': }
+  -> stage { 'deploy_infra': }
+  -> stage { 'setup_app': }
+  -> stage { 'deploy_app': }
+  -> stage { 'deploy': }
+
+}
diff --git a/puppet/modules/stdlib/metadata.json b/puppet/modules/stdlib/metadata.json
new file mode 100644
index 00000000..27def9c0
--- /dev/null
+++ b/puppet/modules/stdlib/metadata.json
@@ -0,0 +1,113 @@
+{
+  "name": "puppetlabs-stdlib",
+  "version": "4.5.1",
+  "author": "puppetlabs",
+  "summary": "Standard library of resources for Puppet modules.",
+  "license": "Apache-2.0",
+  "source": "https://github.com/puppetlabs/puppetlabs-stdlib",
+  "project_page": "https://github.com/puppetlabs/puppetlabs-stdlib",
+  "issues_url": "https://tickets.puppetlabs.com/browse/MODULES",
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "RedHat",
+      "operatingsystemrelease": [
+        "4",
+        "5",
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "CentOS",
+      "operatingsystemrelease": [
+        "4",
+        "5",
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "OracleLinux",
+      "operatingsystemrelease": [
+        "4",
+        "5",
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "Scientific",
+      "operatingsystemrelease": [
+        "4",
+        "5",
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "SLES",
+      "operatingsystemrelease": [
+        "10 SP4",
+        "11 SP1",
+        "12"
+      ]
+    },
+    {
+      "operatingsystem": "Debian",
+      "operatingsystemrelease": [
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "Ubuntu",
+      "operatingsystemrelease": [
+        "10.04",
+        "12.04",
+        "14.04"
+      ]
+    },
+    {
+      "operatingsystem": "Solaris",
+      "operatingsystemrelease": [
+        "10",
+        "11"
+      ]
+    },
+    {
+      "operatingsystem": "Windows",
+      "operatingsystemrelease": [
+        "Server 2003",
+        "Server 2003 R2",
+        "Server 2008",
+        "Server 2008 R2",
+        "Server 2012",
+        "Server 2012 R2",
+        "7",
+        "8"
+      ]
+    },
+    {
+      "operatingsystem": "AIX",
+      "operatingsystemrelease": [
+        "5.3",
+        "6.1",
+        "7.1"
+      ]
+    }
+  ],
+  "requirements": [
+    {
+      "name": "pe",
+      "version_requirement": "3.x"
+    },
+    {
+      "name": "puppet",
+      "version_requirement": ">=2.7.20 <4.0.0"
+    }
+  ],
+  "description": "Standard Library for Puppet Modules",
+  "dependencies": [
+  
+  ]
+}
diff --git a/puppet/modules/stdlib/spec/acceptance/abs_spec.rb b/puppet/modules/stdlib/spec/acceptance/abs_spec.rb
new file mode 100755
index 00000000..6e41e2fd
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/abs_spec.rb
@@ -0,0 +1,30 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'abs function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should accept a string' do
+      pp = <<-EOS
+      $input  = '-34.56'
+      $output = abs($input)
+      notify { "$output": }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: 34.56/)
+      end
+    end
+
+    it 'should accept a float' do
+      pp = <<-EOS
+      $input  = -34.56
+      $output = abs($input)
+      notify { "$output": }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: 34.56/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/any2array_spec.rb b/puppet/modules/stdlib/spec/acceptance/any2array_spec.rb
new file mode 100755
index 00000000..18ea4cd9
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/any2array_spec.rb
@@ -0,0 +1,49 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'any2array function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should create an empty array' do
+      pp = <<-EOS
+      $input = ''
+      $output = any2array($input)
+      validate_array($output)
+      notify { "Output: ${output}": }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: Output: /)
+      end
+    end
+
+    it 'should leave arrays modified' do
+      pp = <<-EOS
+      $input = ['test', 'array']
+      $output = any2array($input)
+      validate_array($output)
+      notify { "Output: ${output}": }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: Output: (\[|)test(,\s|)array(\]|)/)
+      end
+    end
+
+    it 'should turn a hash into an array' do
+      pp = <<-EOS
+      $input = {'test' => 'array'}
+      $output = any2array($input)
+
+      validate_array($output)
+      # Check each element of the array is a plain string.
+      validate_string($output[0])
+      validate_string($output[1])
+      notify { "Output: ${output}": }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: Output: (\[|)test(,\s|)array(\]|)/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/base64_spec.rb b/puppet/modules/stdlib/spec/acceptance/base64_spec.rb
new file mode 100755
index 00000000..97e1738e
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/base64_spec.rb
@@ -0,0 +1,18 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'base64 function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should encode then decode a string' do
+      pp = <<-EOS
+      $encodestring = base64('encode', 'thestring')
+      $decodestring = base64('decode', $encodestring)
+      notify { $decodestring: }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/thestring/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/bool2num_spec.rb b/puppet/modules/stdlib/spec/acceptance/bool2num_spec.rb
new file mode 100755
index 00000000..52ff75bc
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/bool2num_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'bool2num function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    ['false', 'f', '0', 'n', 'no'].each do |bool|
+      it "should convert a given boolean, #{bool}, to 0" do
+        pp = <<-EOS
+        $input = "#{bool}"
+        $output = bool2num($input)
+        notify { "$output": }
+        EOS
+
+        apply_manifest(pp, :catch_failures => true) do |r|
+          expect(r.stdout).to match(/Notice: 0/)
+        end
+      end
+    end
+
+    ['true', 't', '1', 'y', 'yes'].each do |bool|
+      it "should convert a given boolean, #{bool}, to 1" do
+        pp = <<-EOS
+        $input = "#{bool}"
+        $output = bool2num($input)
+        notify { "$output": }
+        EOS
+
+        apply_manifest(pp, :catch_failures => true) do |r|
+          expect(r.stdout).to match(/Notice: 1/)
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/build_csv.rb b/puppet/modules/stdlib/spec/acceptance/build_csv.rb
new file mode 100755
index 00000000..62ecbf13
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/build_csv.rb
@@ -0,0 +1,83 @@
+#!/usr/bin/env ruby
+# vim: set sw=2 sts=2 et tw=80 :
+require 'rspec'
+
+#XXX Super ugly hack to keep from starting beaker nodes
+module Kernel
+  # make an alias of the original require
+  alias_method :original_require, :require
+  # rewrite require
+  def require name
+    original_require name if name != 'spec_helper_acceptance'
+  end
+end
+UNSUPPORTED_PLATFORMS = []
+def fact(*args) [] end
+#XXX End hax
+
+# Get a list of functions for test coverage
+function_list = Dir[File.join(File.dirname(__FILE__),"..","..","lib","puppet","parser","functions","*.rb")].collect do |function_rb|
+  File.basename(function_rb,".rb")
+end
+
+## Configure rspec to parse tests
+options = RSpec::Core::ConfigurationOptions.new(['spec/acceptance'])
+configuration = RSpec::configuration
+world = RSpec::world
+options.parse_options
+options.configure(configuration)
+configuration.load_spec_files
+
+## Collect up tests and example groups into a hash
+def get_tests(children)
+  children.inject({}) do |memo,c|
+    memo[c.description] = Hash.new
+    memo[c.description]["groups"] = get_tests(c.children) unless c.children.empty?
+    memo[c.description]["tests"] = c.examples.collect { |e|
+      e.description unless e.pending?
+    }.compact unless c.examples.empty?
+    memo[c.description]["pending_tests"] = c.examples.collect { |e|
+      e.description if e.pending?
+    }.compact unless c.examples.empty?
+    memo
+  end
+end
+
+def count_test_types_in(type,group)
+  return 0 if group.nil?
+  group.inject(0) do |m,(k,v)|
+    m += v.length if k == type
+    m += count_tests_in(v) if v.is_a?(Hash)
+    m
+  end
+end
+def count_tests_in(group)
+  count_test_types_in('tests',group)
+end
+def count_pending_tests_in(group)
+  count_test_types_in('pending_tests',group)
+end
+
+# Convert tests hash to csv format
+def to_csv(function_list,tests)
+  function_list.collect do |function_name|
+    if v = tests["#{function_name} function"]
+      positive_tests = count_tests_in(v["groups"]["success"])
+      negative_tests = count_tests_in(v["groups"]["failure"])
+      pending_tests  =
+        count_pending_tests_in(v["groups"]["failure"]) +
+        count_pending_tests_in(v["groups"]["failure"])
+    else
+      positive_tests = 0
+      negative_tests = 0
+      pending_tests  = 0
+    end
+    sprintf("%-25s, %-9d, %-9d, %-9d", function_name,positive_tests,negative_tests,pending_tests)
+  end.compact
+end
+
+tests = get_tests(world.example_groups)
+csv = to_csv(function_list,tests)
+percentage_tested = "#{tests.count*100/function_list.count}%"
+printf("%-25s,  %-9s, %-9s, %-9s\n","#{percentage_tested} have tests.","Positive","Negative","Pending")
+puts csv
diff --git a/puppet/modules/stdlib/spec/acceptance/capitalize_spec.rb b/puppet/modules/stdlib/spec/acceptance/capitalize_spec.rb
new file mode 100755
index 00000000..e5e7b7bf
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/capitalize_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'capitalize function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should capitalize the first letter of a string' do
+      pp = <<-EOS
+      $input = 'this is a string'
+      $output = capitalize($input)
+      notify { $output: }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: This is a string/)
+      end
+    end
+
+    it 'should capitalize the first letter of an array of strings' do
+      pp = <<-EOS
+      $input = ['this', 'is', 'a', 'string']
+      $output = capitalize($input)
+      notify { $output: }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: This/)
+        expect(r.stdout).to match(/Notice: Is/)
+        expect(r.stdout).to match(/Notice: A/)
+        expect(r.stdout).to match(/Notice: String/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/chomp_spec.rb b/puppet/modules/stdlib/spec/acceptance/chomp_spec.rb
new file mode 100755
index 00000000..f6c15956
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/chomp_spec.rb
@@ -0,0 +1,21 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'chomp function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should eat the newline' do
+      pp = <<-EOS
+      $input = "test\n"
+      if size($input) != 5 {
+        fail("Size of ${input} is not 5.")
+      }
+      $output = chomp($input)
+      if size($output) != 4 {
+        fail("Size of ${input} is not 4.")
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/chop_spec.rb b/puppet/modules/stdlib/spec/acceptance/chop_spec.rb
new file mode 100755
index 00000000..a16a7102
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/chop_spec.rb
@@ -0,0 +1,45 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'chop function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should eat the last character' do
+      pp = <<-EOS
+      $input = "test"
+      if size($input) != 4 {
+        fail("Size of ${input} is not 4.")
+      }
+      $output = chop($input)
+      if size($output) != 3 {
+        fail("Size of ${input} is not 3.")
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+
+    it 'should eat the last two characters of \r\n' do
+      pp = <<-'EOS'
+      $input = "test\r\n"
+      if size($input) != 6 {
+        fail("Size of ${input} is not 6.")
+      }
+      $output = chop($input)
+      if size($output) != 4 {
+        fail("Size of ${input} is not 4.")
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+
+    it 'should not fail on empty strings' do
+      pp = <<-EOS
+      $input = ""
+      $output = chop($input)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/concat_spec.rb b/puppet/modules/stdlib/spec/acceptance/concat_spec.rb
new file mode 100755
index 00000000..06b649f1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/concat_spec.rb
@@ -0,0 +1,40 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'concat function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should concat one array to another' do
+      pp = <<-EOS
+      $output = concat(['1','2','3'],['4','5','6'])
+      validate_array($output)
+      if size($output) != 6 {
+        fail("${output} should have 6 elements.")
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'should concat arrays and primitives to array' do
+      pp = <<-EOS
+      $output = concat(['1','2','3'],'4','5','6',['7','8','9'])
+      validate_array($output)
+      if size($output) != 9 {
+        fail("${output} should have 9 elements.")
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'should concat multiple arrays to one' do
+      pp = <<-EOS
+      $output = concat(['1','2','3'],['4','5','6'],['7','8','9'])
+      validate_array($output)
+      if size($output) != 9 {
+        fail("${output} should have 9 elements.")
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/count_spec.rb b/puppet/modules/stdlib/spec/acceptance/count_spec.rb
new file mode 100755
index 00000000..fe7ca9dc
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/count_spec.rb
@@ -0,0 +1,30 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'count function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should count elements in an array' do
+      pp = <<-EOS
+      $input = [1,2,3,4]
+      $output = count($input)
+      notify { "$output": }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: 4/)
+      end
+    end
+
+    it 'should count elements in an array that match a second argument' do
+      pp = <<-EOS
+      $input = [1,1,1,2]
+      $output = count($input, 1)
+      notify { "$output": }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: 3/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/deep_merge_spec.rb b/puppet/modules/stdlib/spec/acceptance/deep_merge_spec.rb
new file mode 100755
index 00000000..c0f9b126
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/deep_merge_spec.rb
@@ -0,0 +1,20 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'deep_merge function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should deep merge two hashes' do
+      pp = <<-EOS
+      $hash1 = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } }
+      $hash2 = {'two' => 'dos', 'three' => { 'five' => 5 } }
+      $merged_hash = deep_merge($hash1, $hash2)
+
+      if $merged_hash != { 'one' => 1, 'two' => 'dos', 'three' => { 'four' => 4, 'five' => 5 } } {
+        fail("Hash was incorrectly merged.")
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/defined_with_params_spec.rb b/puppet/modules/stdlib/spec/acceptance/defined_with_params_spec.rb
new file mode 100755
index 00000000..fc544508
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/defined_with_params_spec.rb
@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'defined_with_params function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should successfully notify' do
+      pp = <<-EOS
+      user { 'dan':
+        ensure => present,
+      }
+
+      if defined_with_params(User[dan], {'ensure' => 'present' }) {
+        notify { 'User defined with ensure=>present': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: User defined with ensure=>present/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/delete_at_spec.rb b/puppet/modules/stdlib/spec/acceptance/delete_at_spec.rb
new file mode 100755
index 00000000..db0c01f7
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/delete_at_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'delete_at function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should delete elements of the array' do
+      pp = <<-EOS
+      $output = delete_at(['a','b','c','b'], 1)
+      if $output == ['a','c','b'] {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/delete_spec.rb b/puppet/modules/stdlib/spec/acceptance/delete_spec.rb
new file mode 100755
index 00000000..a28604ce
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/delete_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'delete function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should delete elements of the array' do
+      pp = <<-EOS
+      $output = delete(['a','b','c','b'], 'b')
+      if $output == ['a','c'] {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb b/puppet/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb
new file mode 100755
index 00000000..b7eda192
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/delete_undef_values_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'delete_undef_values function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should delete elements of the array' do
+      pp = <<-EOS
+      $output = delete_undef_values({a=>'A', b=>'', c=>undef, d => false})
+      if $output == { a => 'A', b => '', d => false } {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/delete_values_spec.rb b/puppet/modules/stdlib/spec/acceptance/delete_values_spec.rb
new file mode 100755
index 00000000..6d2369c3
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/delete_values_spec.rb
@@ -0,0 +1,25 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'delete_values function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should delete elements of the hash' do
+      pp = <<-EOS
+      $a = { 'a' => 'A', 'b' => 'B', 'B' => 'C', 'd' => 'B' }
+      $b = { 'a' => 'A', 'B' => 'C' }
+      $o = delete_values($a, 'B')
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles non-hash arguments'
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/difference_spec.rb b/puppet/modules/stdlib/spec/acceptance/difference_spec.rb
new file mode 100755
index 00000000..2fae5c43
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/difference_spec.rb
@@ -0,0 +1,26 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'difference function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'returns non-duplicates in the first array' do
+      pp = <<-EOS
+      $a = ['a','b','c']
+      $b = ['b','c','d']
+      $c = ['a']
+      $o = difference($a, $b)
+      if $o == $c {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles non-array arguments'
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/dirname_spec.rb b/puppet/modules/stdlib/spec/acceptance/dirname_spec.rb
new file mode 100755
index 00000000..97913ddb
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/dirname_spec.rb
@@ -0,0 +1,42 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'dirname function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    context 'absolute path' do
+      it 'returns the dirname' do
+        pp = <<-EOS
+        $a = '/path/to/a/file.txt'
+        $b = '/path/to/a'
+        $o = dirname($a)
+        if $o == $b {
+          notify { 'output correct': }
+        }
+        EOS
+
+        apply_manifest(pp, :catch_failures => true) do |r|
+          expect(r.stdout).to match(/Notice: output correct/)
+        end
+      end
+    end
+    context 'relative path' do
+      it 'returns the dirname' do
+        pp = <<-EOS
+        $a = 'path/to/a/file.txt'
+        $b = 'path/to/a'
+        $o = dirname($a)
+        if $o == $b {
+          notify { 'output correct': }
+        }
+        EOS
+
+        apply_manifest(pp, :catch_failures => true) do |r|
+          expect(r.stdout).to match(/Notice: output correct/)
+        end
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/downcase_spec.rb b/puppet/modules/stdlib/spec/acceptance/downcase_spec.rb
new file mode 100755
index 00000000..bc4e7069
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/downcase_spec.rb
@@ -0,0 +1,39 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'downcase function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'returns the downcase' do
+      pp = <<-EOS
+      $a = 'AOEU'
+      $b = 'aoeu'
+      $o = downcase($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'doesn\'t affect lowercase words' do
+      pp = <<-EOS
+      $a = 'aoeu aoeu'
+      $b = 'aoeu aoeu'
+      $o = downcase($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/empty_spec.rb b/puppet/modules/stdlib/spec/acceptance/empty_spec.rb
new file mode 100755
index 00000000..8b46aacd
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/empty_spec.rb
@@ -0,0 +1,39 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'empty function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'recognizes empty strings' do
+      pp = <<-EOS
+      $a = ''
+      $b = true
+      $o = empty($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'recognizes non-empty strings' do
+      pp = <<-EOS
+      $a = 'aoeu'
+      $b = false
+      $o = empty($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/ensure_packages_spec.rb b/puppet/modules/stdlib/spec/acceptance/ensure_packages_spec.rb
new file mode 100755
index 00000000..aedcfb55
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/ensure_packages_spec.rb
@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'ensure_packages function', :unless => fact('osfamily') =~ /windows/i do
+  describe 'success' do
+    it 'ensure_packages a package' do
+      apply_manifest('package { "rake": ensure => absent, provider => "gem", }')
+      pp = <<-EOS
+      $a = "rake"
+      ensure_packages($a,{'provider' => 'gem'})
+      EOS
+
+      apply_manifest(pp, :expect_changes => true)
+    end
+    it 'ensures a package already declared'
+    it 'takes defaults arguments'
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/ensure_resource_spec.rb b/puppet/modules/stdlib/spec/acceptance/ensure_resource_spec.rb
new file mode 100755
index 00000000..1cee53db
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/ensure_resource_spec.rb
@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'ensure_resource function', :unless => fact('osfamily') =~ /windows/i do
+  describe 'success' do
+    it 'ensure_resource a package' do
+      apply_manifest('package { "rake": ensure => absent, provider => "gem", }')
+      pp = <<-EOS
+      $a = "rake"
+      ensure_resource('package', $a, {'provider' => 'gem'})
+      EOS
+
+      apply_manifest(pp, :expect_changes => true)
+    end
+    it 'ensures a resource already declared'
+    it 'takes defaults arguments'
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/flatten_spec.rb b/puppet/modules/stdlib/spec/acceptance/flatten_spec.rb
new file mode 100755
index 00000000..c4d66e04
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/flatten_spec.rb
@@ -0,0 +1,39 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'flatten function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'flattens arrays' do
+      pp = <<-EOS
+      $a = ["a","b",["c",["d","e"],"f","g"]]
+      $b = ["a","b","c","d","e","f","g"]
+      $o = flatten($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'does not affect flat arrays' do
+      pp = <<-EOS
+      $a = ["a","b","c","d","e","f","g"]
+      $b = ["a","b","c","d","e","f","g"]
+      $o = flatten($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/floor_spec.rb b/puppet/modules/stdlib/spec/acceptance/floor_spec.rb
new file mode 100755
index 00000000..0dcdad9c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/floor_spec.rb
@@ -0,0 +1,39 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'floor function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'floors floats' do
+      pp = <<-EOS
+      $a = 12.8
+      $b = 12
+      $o = floor($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'floors integers' do
+      pp = <<-EOS
+      $a = 7
+      $b = 7
+      $o = floor($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-numbers'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb b/puppet/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb
new file mode 100755
index 00000000..753068bf
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/fqdn_rotate_spec.rb
@@ -0,0 +1,47 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'fqdn_rotate function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    let(:facts_d) do
+      if fact('is_pe', '--puppet') == "true"
+        if fact('osfamily') =~ /windows/i
+          if fact('kernelmajversion').to_f < 6.0
+            'C:/Documents and Settings/All Users/Application Data/PuppetLabs/facter/facts.d'
+          else
+            'C:/ProgramData/PuppetLabs/facter/facts.d'
+          end
+        else
+          '/etc/puppetlabs/facter/facts.d'
+        end
+      else
+        '/etc/facter/facts.d'
+      end
+    end
+    after :each do
+      shell("if [ -f '#{facts_d}/fqdn.txt' ] ; then rm '#{facts_d}/fqdn.txt' ; fi")
+    end
+    before :each do
+      #No need to create on windows, PE creates by default
+      if fact('osfamily') !~ /windows/i
+        shell("mkdir -p '#{facts_d}'")
+      end
+    end
+    it 'fqdn_rotates floats' do
+      shell("echo fqdn=fakehost.localdomain > '#{facts_d}/fqdn.txt'")
+      pp = <<-EOS
+      $a = ['a','b','c','d']
+      $o = fqdn_rotate($a)
+      notice(inline_template('fqdn_rotate is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/fqdn_rotate is \["c", "d", "a", "b"\]/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-numbers'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/get_module_path_spec.rb b/puppet/modules/stdlib/spec/acceptance/get_module_path_spec.rb
new file mode 100755
index 00000000..6ac690c1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/get_module_path_spec.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'get_module_path function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'get_module_paths dne' do
+      pp = <<-EOS
+      $a = $::is_pe ? {
+        'true'  => '/etc/puppetlabs/puppet/modules/dne',
+        'false' => '/etc/puppet/modules/dne',
+      }
+      $o = get_module_path('dne')
+      if $o == $a {
+        notify { 'output correct': }
+      } else {
+        notify { "failed; module path is '$o'": }
+      }
+      EOS
+
+      apply_manifest(pp, :expect_failures => true)
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-numbers'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/getparam_spec.rb b/puppet/modules/stdlib/spec/acceptance/getparam_spec.rb
new file mode 100755
index 00000000..b1a677ec
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/getparam_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'getparam function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'getparam a notify' do
+      pp = <<-EOS
+      notify { 'rspec':
+        message => 'custom rspec message',
+      }
+      $o = getparam(Notify['rspec'], 'message')
+      notice(inline_template('getparam is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/getparam is "custom rspec message"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/getvar_spec.rb b/puppet/modules/stdlib/spec/acceptance/getvar_spec.rb
new file mode 100755
index 00000000..333c467f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/getvar_spec.rb
@@ -0,0 +1,26 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'getvar function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'getvars from classes' do
+      pp = <<-EOS
+      class a::data { $foo = 'aoeu' }
+      include a::data
+      $b = 'aoeu'
+      $o = getvar("a::data::foo")
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-numbers'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/grep_spec.rb b/puppet/modules/stdlib/spec/acceptance/grep_spec.rb
new file mode 100755
index 00000000..b39d48ec
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/grep_spec.rb
@@ -0,0 +1,26 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'grep function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'greps arrays' do
+      pp = <<-EOS
+      $a = ['aaabbb','bbbccc','dddeee']
+      $b = 'bbb'
+      $c = ['aaabbb','bbbccc']
+      $o = grep($a,$b)
+      if $o == $c {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/has_interface_with_spec.rb b/puppet/modules/stdlib/spec/acceptance/has_interface_with_spec.rb
new file mode 100755
index 00000000..95901930
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/has_interface_with_spec.rb
@@ -0,0 +1,54 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'has_interface_with function', :unless => ((UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem'))) or (fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do
+  describe 'success' do
+    it 'has_interface_with existing ipaddress' do
+      pp = <<-EOS
+      $a = $::ipaddress
+      $o = has_interface_with('ipaddress', $a)
+      notice(inline_template('has_interface_with is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/has_interface_with is true/)
+      end
+    end
+    it 'has_interface_with absent ipaddress' do
+      pp = <<-EOS
+      $a = '128.0.0.1'
+      $o = has_interface_with('ipaddress', $a)
+      notice(inline_template('has_interface_with is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/has_interface_with is false/)
+      end
+    end
+    it 'has_interface_with existing interface' do
+      pp = <<-EOS
+      if $osfamily == 'Solaris' or $osfamily == 'Darwin' {
+        $a = 'lo0'
+      }elsif $osfamily == 'windows' {
+        $a = $::kernelmajversion ? {
+          /6\.(2|3|4)/ => 'Ethernet0',
+          /6\.(0|1)/ => 'Local_Area_Connection',
+          /5\.(1|2)/  => undef, #Broken current in facter
+        }
+      }else {
+        $a = 'lo'
+      }
+      $o = has_interface_with($a)
+      notice(inline_template('has_interface_with is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/has_interface_with is true/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/has_ip_address_spec.rb b/puppet/modules/stdlib/spec/acceptance/has_ip_address_spec.rb
new file mode 100755
index 00000000..149a10dc
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/has_ip_address_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'has_ip_address function', :unless => ((UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem'))) or (fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do
+  describe 'success' do
+    it 'has_ip_address existing ipaddress' do
+      pp = <<-EOS
+      $a = '127.0.0.1'
+      $o = has_ip_address($a)
+      notice(inline_template('has_ip_address is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/has_ip_address is true/)
+      end
+    end
+    it 'has_ip_address absent ipaddress' do
+      pp = <<-EOS
+      $a = '128.0.0.1'
+      $o = has_ip_address($a)
+      notice(inline_template('has_ip_address is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/has_ip_address is false/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/has_ip_network_spec.rb b/puppet/modules/stdlib/spec/acceptance/has_ip_network_spec.rb
new file mode 100755
index 00000000..7d2f34ed
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/has_ip_network_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'has_ip_network function', :unless => ((UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem'))) or (fact('osfamily') == 'windows') or (fact('osfamily') == 'AIX')) do
+  describe 'success' do
+    it 'has_ip_network existing ipaddress' do
+      pp = <<-EOS
+      $a = '127.0.0.0'
+      $o = has_ip_network($a)
+      notice(inline_template('has_ip_network is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/has_ip_network is true/)
+      end
+    end
+    it 'has_ip_network absent ipaddress' do
+      pp = <<-EOS
+      $a = '128.0.0.0'
+      $o = has_ip_network($a)
+      notice(inline_template('has_ip_network is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/has_ip_network is false/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/has_key_spec.rb b/puppet/modules/stdlib/spec/acceptance/has_key_spec.rb
new file mode 100755
index 00000000..c8557cbe
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/has_key_spec.rb
@@ -0,0 +1,41 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'has_key function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'has_keys in hashes' do
+      pp = <<-EOS
+      $a = { 'aaa' => 'bbb','bbb' => 'ccc','ddd' => 'eee' }
+      $b = 'bbb'
+      $c = true
+      $o = has_key($a,$b)
+      if $o == $c {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'has_keys not in hashes' do
+      pp = <<-EOS
+      $a = { 'aaa' => 'bbb','bbb' => 'ccc','ddd' => 'eee' }
+      $b = 'ccc'
+      $c = false
+      $o = has_key($a,$b)
+      if $o == $c {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-hashes'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/hash_spec.rb b/puppet/modules/stdlib/spec/acceptance/hash_spec.rb
new file mode 100755
index 00000000..ed53834b
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/hash_spec.rb
@@ -0,0 +1,26 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'hash function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'hashs arrays' do
+      pp = <<-EOS
+      $a = ['aaa','bbb','bbb','ccc','ddd','eee']
+      $b = { 'aaa' => 'bbb', 'bbb' => 'ccc', 'ddd' => 'eee' }
+      $o = hash($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'handles odd-length arrays'
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/intersection_spec.rb b/puppet/modules/stdlib/spec/acceptance/intersection_spec.rb
new file mode 100755
index 00000000..66b86529
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/intersection_spec.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'intersection function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'intersections arrays' do
+      pp = <<-EOS
+      $a = ['aaa','bbb','ccc']
+      $b = ['bbb','ccc','ddd','eee']
+      $c = ['bbb','ccc']
+      $o = intersection($a,$b)
+      if $o == $c {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'intersections empty arrays'
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_array_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_array_spec.rb
new file mode 100755
index 00000000..9c6bad73
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_array_spec.rb
@@ -0,0 +1,67 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_array function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_arrays arrays' do
+      pp = <<-EOS
+      $a = ['aaa','bbb','ccc']
+      $b = true
+      $o = is_array($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_arrays empty arrays' do
+      pp = <<-EOS
+      $a = []
+      $b = true
+      $o = is_array($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_arrays strings' do
+      pp = <<-EOS
+      $a = "aoeu"
+      $b = false
+      $o = is_array($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_arrays hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'bbb'}
+      $b = false
+      $o = is_array($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_bool_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_bool_spec.rb
new file mode 100755
index 00000000..60079f95
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_bool_spec.rb
@@ -0,0 +1,81 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_bool function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_bools arrays' do
+      pp = <<-EOS
+      $a = ['aaa','bbb','ccc']
+      $b = false
+      $o = is_bool($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_bools true' do
+      pp = <<-EOS
+      $a = true
+      $b = true
+      $o = is_bool($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_bools false' do
+      pp = <<-EOS
+      $a = false
+      $b = true
+      $o = is_bool($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_bools strings' do
+      pp = <<-EOS
+      $a = "true"
+      $b = false
+      $o = is_bool($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_bools hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'bbb'}
+      $b = false
+      $o = is_bool($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_domain_name_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_domain_name_spec.rb
new file mode 100755
index 00000000..e0f03fa8
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_domain_name_spec.rb
@@ -0,0 +1,83 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_domain_name function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_domain_names arrays' do
+      pp = <<-EOS
+      $a = ['aaa.com','bbb','ccc']
+      $o = is_domain_name($a)
+      notice(inline_template('is_domain_name is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_domain_name is false/)
+      end
+    end
+    it 'is_domain_names true' do
+      pp = <<-EOS
+      $a = true
+      $o = is_domain_name($a)
+      notice(inline_template('is_domain_name is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_domain_name is false/)
+      end
+    end
+    it 'is_domain_names false' do
+      pp = <<-EOS
+      $a = false
+      $o = is_domain_name($a)
+      notice(inline_template('is_domain_name is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_domain_name is false/)
+      end
+    end
+    it 'is_domain_names strings with hyphens' do
+      pp = <<-EOS
+      $a = "3foo-bar.2bar-fuzz.com"
+      $b = true
+      $o = is_domain_name($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_domain_names strings beginning with hyphens' do
+      pp = <<-EOS
+      $a = "-bar.2bar-fuzz.com"
+      $b = false
+      $o = is_domain_name($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_domain_names hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'www.com'}
+      $o = is_domain_name($a)
+      notice(inline_template('is_domain_name is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_domain_name is false/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_float_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_float_spec.rb
new file mode 100755
index 00000000..338ba58d
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_float_spec.rb
@@ -0,0 +1,86 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_float function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_floats arrays' do
+      pp = <<-EOS
+      $a = ['aaa.com','bbb','ccc']
+      $o = is_float($a)
+      notice(inline_template('is_float is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_float is false/)
+      end
+    end
+    it 'is_floats true' do
+      pp = <<-EOS
+      $a = true
+      $o = is_float($a)
+      notice(inline_template('is_float is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_float is false/)
+      end
+    end
+    it 'is_floats strings' do
+      pp = <<-EOS
+      $a = "3.5"
+      $b = true
+      $o = is_float($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_floats floats' do
+      pp = <<-EOS
+      $a = 3.5
+      $b = true
+      $o = is_float($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_floats integers' do
+      pp = <<-EOS
+      $a = 3
+      $b = false
+      $o = is_float($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_floats hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'www.com'}
+      $o = is_float($a)
+      notice(inline_template('is_float is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_float is false/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_function_available_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_function_available_spec.rb
new file mode 100755
index 00000000..2b5dd6d1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_function_available_spec.rb
@@ -0,0 +1,58 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_function_available function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_function_availables arrays' do
+      pp = <<-EOS
+      $a = ['fail','include','require']
+      $o = is_function_available($a)
+      notice(inline_template('is_function_available is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_function_available is false/)
+      end
+    end
+    it 'is_function_availables true' do
+      pp = <<-EOS
+      $a = true
+      $o = is_function_available($a)
+      notice(inline_template('is_function_available is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_function_available is false/)
+      end
+    end
+    it 'is_function_availables strings' do
+      pp = <<-EOS
+      $a = "fail"
+      $b = true
+      $o = is_function_available($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_function_availables function_availables' do
+      pp = <<-EOS
+      $a = "is_function_available"
+      $o = is_function_available($a)
+      notice(inline_template('is_function_available is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_function_available is true/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_hash_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_hash_spec.rb
new file mode 100755
index 00000000..2ef310ab
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_hash_spec.rb
@@ -0,0 +1,63 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_hash function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_hashs arrays' do
+      pp = <<-EOS
+      $a = ['aaa','bbb','ccc']
+      $o = is_hash($a)
+      notice(inline_template('is_hash is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_hash is false/)
+      end
+    end
+    it 'is_hashs empty hashs' do
+      pp = <<-EOS
+      $a = {}
+      $b = true
+      $o = is_hash($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_hashs strings' do
+      pp = <<-EOS
+      $a = "aoeu"
+      $b = false
+      $o = is_hash($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_hashs hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'bbb'}
+      $b = true
+      $o = is_hash($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_integer_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_integer_spec.rb
new file mode 100755
index 00000000..bf6902b9
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_integer_spec.rb
@@ -0,0 +1,95 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_integer function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_integers arrays' do
+      pp = <<-EOS
+      $a = ['aaa.com','bbb','ccc']
+      $b = false
+      $o = is_integer($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_integers true' do
+      pp = <<-EOS
+      $a = true
+      $b = false
+      $o = is_integer($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_integers strings' do
+      pp = <<-EOS
+      $a = "3"
+      $b = true
+      $o = is_integer($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_integers floats' do
+      pp = <<-EOS
+      $a = 3.5
+      $b = false
+      $o = is_integer($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_integers integers' do
+      pp = <<-EOS
+      $a = 3
+      $b = true
+      $o = is_integer($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_integers hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'www.com'}
+      $b = false
+      $o = is_integer($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_ip_address_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_ip_address_spec.rb
new file mode 100755
index 00000000..ed7a8543
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_ip_address_spec.rb
@@ -0,0 +1,80 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_ip_address function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_ip_addresss ipv4' do
+      pp = <<-EOS
+      $a = '1.2.3.4'
+      $b = true
+      $o = is_ip_address($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_ip_addresss ipv6' do
+      pp = <<-EOS
+      $a = "fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74"
+      $b = true
+      $o = is_ip_address($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_ip_addresss ipv6 compressed' do
+      pp = <<-EOS
+      $a = "fe00::1"
+      $b = true
+      $o = is_ip_address($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_ip_addresss strings' do
+      pp = <<-EOS
+      $a = "aoeu"
+      $b = false
+      $o = is_ip_address($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_ip_addresss ipv4 out of range' do
+      pp = <<-EOS
+      $a = '1.2.3.400'
+      $b = false
+      $o = is_ip_address($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_mac_address_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_mac_address_spec.rb
new file mode 100755
index 00000000..a2c892f4
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_mac_address_spec.rb
@@ -0,0 +1,38 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_mac_address function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_mac_addresss a mac' do
+      pp = <<-EOS
+      $a = '00:a0:1f:12:7f:a0'
+      $b = true
+      $o = is_mac_address($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_mac_addresss a mac out of range' do
+      pp = <<-EOS
+      $a = '00:a0:1f:12:7f:g0'
+      $b = false
+      $o = is_mac_address($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_numeric_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_numeric_spec.rb
new file mode 100755
index 00000000..21c89884
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_numeric_spec.rb
@@ -0,0 +1,95 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_numeric function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_numerics arrays' do
+      pp = <<-EOS
+      $a = ['aaa.com','bbb','ccc']
+      $b = false
+      $o = is_numeric($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_numerics true' do
+      pp = <<-EOS
+      $a = true
+      $b = false
+      $o = is_numeric($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_numerics strings' do
+      pp = <<-EOS
+      $a = "3"
+      $b = true
+      $o = is_numeric($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_numerics floats' do
+      pp = <<-EOS
+      $a = 3.5
+      $b = true
+      $o = is_numeric($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_numerics integers' do
+      pp = <<-EOS
+      $a = 3
+      $b = true
+      $o = is_numeric($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_numerics hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'www.com'}
+      $b = false
+      $o = is_numeric($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+    it 'handles non-arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/is_string_spec.rb b/puppet/modules/stdlib/spec/acceptance/is_string_spec.rb
new file mode 100755
index 00000000..94d8e967
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/is_string_spec.rb
@@ -0,0 +1,102 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'is_string function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'is_strings arrays' do
+      pp = <<-EOS
+      $a = ['aaa.com','bbb','ccc']
+      $b = false
+      $o = is_string($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_strings true' do
+      pp = <<-EOS
+      $a = true
+      $b = false
+      $o = is_string($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_strings strings' do
+      pp = <<-EOS
+      $a = "aoeu"
+      $o = is_string($a)
+      notice(inline_template('is_string is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_string is true/)
+      end
+    end
+    it 'is_strings number strings' do
+      pp = <<-EOS
+      $a = "3"
+      $o = is_string($a)
+      notice(inline_template('is_string is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/is_string is false/)
+      end
+    end
+    it 'is_strings floats' do
+      pp = <<-EOS
+      $a = 3.5
+      $b = false
+      $o = is_string($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_strings integers' do
+      pp = <<-EOS
+      $a = 3
+      $b = false
+      $o = is_string($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'is_strings hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'www.com'}
+      $b = false
+      $o = is_string($a)
+      if $o == $b {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb b/puppet/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb
new file mode 100755
index 00000000..70493fd5
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/join_keys_to_values_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'join_keys_to_values function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'join_keys_to_valuess hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'bbb','ccc'=>'ddd'}
+      $b = ':'
+      $o = join_keys_to_values($a,$b)
+      notice(inline_template('join_keys_to_values is <%= @o.sort.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/join_keys_to_values is \["aaa:bbb", "ccc:ddd"\]/)
+      end
+    end
+    it 'handles non hashes'
+    it 'handles empty hashes'
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/join_spec.rb b/puppet/modules/stdlib/spec/acceptance/join_spec.rb
new file mode 100755
index 00000000..5397ce2c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/join_spec.rb
@@ -0,0 +1,26 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'join function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'joins arrays' do
+      pp = <<-EOS
+      $a = ['aaa','bbb','ccc']
+      $b = ':'
+      $c = 'aaa:bbb:ccc'
+      $o = join($a,$b)
+      if $o == $c {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    it 'handles non arrays'
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/keys_spec.rb b/puppet/modules/stdlib/spec/acceptance/keys_spec.rb
new file mode 100755
index 00000000..176918e9
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/keys_spec.rb
@@ -0,0 +1,23 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'keys function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'keyss hashes' do
+      pp = <<-EOS
+      $a = {'aaa'=>'bbb','ccc'=>'ddd'}
+      $o = keys($a)
+      notice(inline_template('keys is <%= @o.sort.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/keys is \["aaa", "ccc"\]/)
+      end
+    end
+    it 'handles non hashes'
+    it 'handles empty hashes'
+  end
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/loadyaml_spec.rb b/puppet/modules/stdlib/spec/acceptance/loadyaml_spec.rb
new file mode 100644
index 00000000..1e910a97
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/loadyaml_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('stdlib')
+
+describe 'loadyaml function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'loadyamls array of values' do
+      shell("echo '---
+      aaa: 1
+      bbb: 2
+      ccc: 3
+      ddd: 4' > #{tmpdir}/testyaml.yaml")
+      pp = <<-EOS
+      $o = loadyaml('#{tmpdir}/testyaml.yaml')
+      notice(inline_template('loadyaml[aaa] is <%= @o["aaa"].inspect %>'))
+      notice(inline_template('loadyaml[bbb] is <%= @o["bbb"].inspect %>'))
+      notice(inline_template('loadyaml[ccc] is <%= @o["ccc"].inspect %>'))
+      notice(inline_template('loadyaml[ddd] is <%= @o["ddd"].inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/loadyaml\[aaa\] is 1/)
+        expect(r.stdout).to match(/loadyaml\[bbb\] is 2/)
+        expect(r.stdout).to match(/loadyaml\[ccc\] is 3/)
+        expect(r.stdout).to match(/loadyaml\[ddd\] is 4/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'fails with no arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/lstrip_spec.rb b/puppet/modules/stdlib/spec/acceptance/lstrip_spec.rb
new file mode 100755
index 00000000..3dc952fb
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/lstrip_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'lstrip function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'lstrips arrays' do
+      pp = <<-EOS
+      $a = ["  the   ","   public   ","   art","galleries   "]
+      # Anagram: Large picture halls, I bet
+      $o = lstrip($a)
+      notice(inline_template('lstrip is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/lstrip is \["the   ", "public   ", "art", "galleries   "\]/)
+      end
+    end
+    it 'lstrips strings' do
+      pp = <<-EOS
+      $a = "   blowzy night-frumps vex'd jack q   "
+      $o = lstrip($a)
+      notice(inline_template('lstrip is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/lstrip is "blowzy night-frumps vex'd jack q   "/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/max_spec.rb b/puppet/modules/stdlib/spec/acceptance/max_spec.rb
new file mode 100755
index 00000000..f04e3d28
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/max_spec.rb
@@ -0,0 +1,20 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'max function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'maxs arrays' do
+      pp = <<-EOS
+      $o = max("the","public","art","galleries")
+      notice(inline_template('max is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/max is "the"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/member_spec.rb b/puppet/modules/stdlib/spec/acceptance/member_spec.rb
new file mode 100755
index 00000000..fe75a078
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/member_spec.rb
@@ -0,0 +1,54 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'member function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  shared_examples 'item found' do
+    it 'should output correctly' do
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+  end
+  describe 'success' do
+    it 'members arrays' do
+      pp = <<-EOS
+      $a = ['aaa','bbb','ccc']
+      $b = 'ccc'
+      $c = true
+      $o = member($a,$b)
+      if $o == $c {
+        notify { 'output correct': }
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/Notice: output correct/)
+      end
+    end
+    describe 'members array of integers' do
+      it_should_behave_like 'item found' do
+        let(:pp) { <<-EOS
+      if member( [1,2,3,4], 4 ){
+        notify { 'output correct': }
+      }
+        EOS
+        }
+      end
+    end
+    describe 'members of mixed array' do
+      it_should_behave_like 'item found' do
+        let(:pp) { <<-EOS
+      if member( ['a','4',3], 'a' ){
+        notify { 'output correct': }
+}
+        EOS
+        }
+      end
+    end
+    it 'members arrays without members'
+  end
+
+  describe 'failure' do
+    it 'handles improper argument counts'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/merge_spec.rb b/puppet/modules/stdlib/spec/acceptance/merge_spec.rb
new file mode 100755
index 00000000..227b9942
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/merge_spec.rb
@@ -0,0 +1,23 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'merge function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'should merge two hashes' do
+      pp = <<-EOS
+      $a = {'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } }
+      $b = {'two' => 'dos', 'three' => { 'five' => 5 } }
+      $o = merge($a, $b)
+      notice(inline_template('merge[one]   is <%= @o["one"].inspect %>'))
+      notice(inline_template('merge[two]   is <%= @o["two"].inspect %>'))
+      notice(inline_template('merge[three] is <%= @o["three"].inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/merge\[one\]   is ("1"|1)/)
+        expect(r.stdout).to match(/merge\[two\]   is "dos"/)
+        expect(r.stdout).to match(/merge\[three\] is {"five"=>("5"|5)}/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/min_spec.rb b/puppet/modules/stdlib/spec/acceptance/min_spec.rb
new file mode 100755
index 00000000..509092d3
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/min_spec.rb
@@ -0,0 +1,20 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'min function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'mins arrays' do
+      pp = <<-EOS
+      $o = min("the","public","art","galleries")
+      notice(inline_template('min is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/min is "art"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/centos-59-x64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-59-x64.yml
new file mode 100644
index 00000000..2ad90b86
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-59-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-59-x64:
+    roles:
+      - master
+    platform: el-5-x86_64
+    box : centos-59-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-59-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: git
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/centos-6-vcloud.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-6-vcloud.yml
new file mode 100644
index 00000000..ca9c1d32
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-6-vcloud.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  'centos-6-vcloud':
+    roles:
+      - master
+    platform: el-6-x86_64
+    hypervisor: vcloud
+    template: centos-6-x86_64
+CONFIG:
+  type: foss
+  ssh:
+    keys: "~/.ssh/id_rsa-acceptance"
+  datastore: instance0
+  folder: Delivery/Quality Assurance/Enterprise/Dynamic
+  resourcepool: delivery/Quality Assurance/Enterprise/Dynamic
+  pooling_api: http://vcloud.delivery.puppetlabs.net/
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/centos-64-x64-pe.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-64-x64-pe.yml
new file mode 100644
index 00000000..7d9242f1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-64-x64-pe.yml
@@ -0,0 +1,12 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: el-6-x86_64
+    box : centos-64-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: pe
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/centos-64-x64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-64-x64.yml
new file mode 100644
index 00000000..05540ed8
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-64-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-64-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/centos-65-x64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-65-x64.yml
new file mode 100644
index 00000000..4e2cb809
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/centos-65-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-65-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-65-x64-vbox436-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-65-x64-virtualbox-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/default.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/default.yml
new file mode 100644
index 00000000..4e2cb809
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/default.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-65-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-65-x64-vbox436-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-65-x64-virtualbox-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/fedora-18-x64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/fedora-18-x64.yml
new file mode 100644
index 00000000..13616498
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/fedora-18-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  fedora-18-x64:
+    roles:
+      - master
+    platform: fedora-18-x86_64
+    box : fedora-18-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/fedora-18-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/sles-11-x64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/sles-11-x64.yml
new file mode 100644
index 00000000..41abe213
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/sles-11-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  sles-11-x64.local:
+    roles:
+      - master
+    platform: sles-11-x64
+    box : sles-11sp1-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/sles-11sp1-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+    type: foss
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml
new file mode 100644
index 00000000..5ca1514e
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-server-10044-x64:
+    roles:
+      - master
+    platform: ubuntu-10.04-amd64
+    box : ubuntu-server-10044-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/ubuntu-server-10044-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml
new file mode 100644
index 00000000..d065b304
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-server-12042-x64:
+    roles:
+      - master
+    platform: ubuntu-12.04-amd64
+    box : ubuntu-server-12042-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/ubuntu-server-12042-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
new file mode 100644
index 00000000..cba1cd04
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  ubuntu-server-1404-x64:
+    roles:
+      - master
+    platform: ubuntu-14.04-amd64
+    box : puppetlabs/ubuntu-14.04-64-nocm
+    box_url : https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
+    hypervisor : vagrant
+CONFIG:
+  log_level   : debug
+  type: git
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2003-i386.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2003-i386.yml
new file mode 100644
index 00000000..47dadbd5
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2003-i386.yml
@@ -0,0 +1,26 @@
+HOSTS:
+  ubuntu1204:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: ubuntu-12.04-amd64
+    template: ubuntu-1204-x86_64
+    hypervisor: vcloud
+  win2003_i386:
+    roles:
+      - agent
+      - default
+    platform: windows-2003-i386
+    template: win-2003-i386
+    hypervisor: vcloud
+CONFIG:
+  nfs_server: none
+  ssh:
+    keys: "~/.ssh/id_rsa-acceptance"
+  consoleport: 443
+  datastore: instance0
+  folder: Delivery/Quality Assurance/Enterprise/Dynamic
+  resourcepool: delivery/Quality Assurance/Enterprise/Dynamic
+  pooling_api: http://vcloud.delivery.puppetlabs.net/
+  pe_dir: http://neptune.puppetlabs.lan/3.2/ci-ready/
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2003-x86_64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2003-x86_64.yml
new file mode 100644
index 00000000..6a884bc9
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2003-x86_64.yml
@@ -0,0 +1,26 @@
+HOSTS:
+  ubuntu1204:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: ubuntu-12.04-amd64
+    template: ubuntu-1204-x86_64
+    hypervisor: vcloud
+  win2003_x86_64:
+    roles:
+      - agent
+      - default
+    platform: windows-2003-x86_64
+    template: win-2003-x86_64
+    hypervisor: vcloud
+CONFIG:
+  nfs_server: none
+  ssh:
+    keys: "~/.ssh/id_rsa-acceptance"
+  consoleport: 443
+  datastore: instance0
+  folder: Delivery/Quality Assurance/Enterprise/Dynamic
+  resourcepool: delivery/Quality Assurance/Enterprise/Dynamic
+  pooling_api: http://vcloud.delivery.puppetlabs.net/
+  pe_dir: http://neptune.puppetlabs.lan/3.2/ci-ready/
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2008-x86_64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2008-x86_64.yml
new file mode 100644
index 00000000..ae3c11dd
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2008-x86_64.yml
@@ -0,0 +1,26 @@
+HOSTS:
+  ubuntu1204:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: ubuntu-12.04-amd64
+    template: ubuntu-1204-x86_64
+    hypervisor: vcloud
+  win2008_x86_64:
+    roles:
+      - agent
+      - default
+    platform: windows-2008-x86_64
+    template: win-2008-x86_64
+    hypervisor: vcloud
+CONFIG:
+  nfs_server: none
+  ssh:
+    keys: "~/.ssh/id_rsa-acceptance"
+  consoleport: 443
+  datastore: instance0
+  folder: Delivery/Quality Assurance/Enterprise/Dynamic
+  resourcepool: delivery/Quality Assurance/Enterprise/Dynamic
+  pooling_api: http://vcloud.delivery.puppetlabs.net/
+  pe_dir: http://neptune.puppetlabs.lan/3.2/ci-ready/
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2008r2-x86_64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2008r2-x86_64.yml
new file mode 100644
index 00000000..63923ac1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2008r2-x86_64.yml
@@ -0,0 +1,26 @@
+HOSTS:
+  ubuntu1204:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: ubuntu-12.04-amd64
+    template: ubuntu-1204-x86_64
+    hypervisor: vcloud
+  win2008r2:
+    roles:
+      - agent
+      - default
+    platform: windows-2008r2-x86_64
+    template: win-2008r2-x86_64
+    hypervisor: vcloud
+CONFIG:
+  nfs_server: none
+  ssh:
+    keys: "~/.ssh/id_rsa-acceptance"
+  consoleport: 443
+  datastore: instance0
+  folder: Delivery/Quality Assurance/Enterprise/Dynamic
+  resourcepool: delivery/Quality Assurance/Enterprise/Dynamic
+  pooling_api: http://vcloud.delivery.puppetlabs.net/
+  pe_dir: http://neptune.puppetlabs.lan/3.2/ci-ready/
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2012-x86_64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2012-x86_64.yml
new file mode 100644
index 00000000..eaa4eca9
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2012-x86_64.yml
@@ -0,0 +1,26 @@
+HOSTS:
+  ubuntu1204:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: ubuntu-12.04-amd64
+    template: ubuntu-1204-x86_64
+    hypervisor: vcloud
+  win2012:
+    roles:
+      - agent
+      - default
+    platform: windows-2012-x86_64
+    template: win-2012-x86_64
+    hypervisor: vcloud
+CONFIG:
+  nfs_server: none
+  ssh:
+    keys: "~/.ssh/id_rsa-acceptance"
+  consoleport: 443
+  datastore: instance0
+  folder: Delivery/Quality Assurance/Enterprise/Dynamic
+  resourcepool: delivery/Quality Assurance/Enterprise/Dynamic
+  pooling_api: http://vcloud.delivery.puppetlabs.net/
+  pe_dir: http://neptune.puppetlabs.lan/3.2/ci-ready/
diff --git a/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2012r2-x86_64.yml b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2012r2-x86_64.yml
new file mode 100644
index 00000000..1f0ea97c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/nodesets/windows-2012r2-x86_64.yml
@@ -0,0 +1,26 @@
+HOSTS:
+  ubuntu1204:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: ubuntu-12.04-amd64
+    template: ubuntu-1204-x86_64
+    hypervisor: vcloud
+  win2012r2:
+    roles:
+      - agent
+      - default
+    platform: windows-2012r2-x86_64
+    template: win-2012r2-x86_64
+    hypervisor: vcloud
+CONFIG:
+  nfs_server: none
+  ssh:
+    keys: "~/.ssh/id_rsa-acceptance"
+  consoleport: 443
+  datastore: instance0
+  folder: Delivery/Quality Assurance/Enterprise/Dynamic
+  resourcepool: delivery/Quality Assurance/Enterprise/Dynamic
+  pooling_api: http://vcloud.delivery.puppetlabs.net/
+  pe_dir: http://neptune.puppetlabs.lan/3.2/ci-ready/
diff --git a/puppet/modules/stdlib/spec/acceptance/num2bool_spec.rb b/puppet/modules/stdlib/spec/acceptance/num2bool_spec.rb
new file mode 100755
index 00000000..1d99ba02
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/num2bool_spec.rb
@@ -0,0 +1,76 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'num2bool function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'bools positive numbers and numeric strings as true' do
+      pp = <<-EOS
+      $a = 1
+      $b = "1"
+      $c = "50"
+      $ao = num2bool($a)
+      $bo = num2bool($b)
+      $co = num2bool($c)
+      notice(inline_template('a is <%= @ao.inspect %>'))
+      notice(inline_template('b is <%= @bo.inspect %>'))
+      notice(inline_template('c is <%= @co.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/a is true/)
+        expect(r.stdout).to match(/b is true/)
+        expect(r.stdout).to match(/c is true/)
+      end
+    end
+    it 'bools negative numbers as false' do
+      pp = <<-EOS
+      $a = 0
+      $b = -0.1
+      $c = ["-50","1"]
+      $ao = num2bool($a)
+      $bo = num2bool($b)
+      $co = num2bool($c)
+      notice(inline_template('a is <%= @ao.inspect %>'))
+      notice(inline_template('b is <%= @bo.inspect %>'))
+      notice(inline_template('c is <%= @co.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/a is false/)
+        expect(r.stdout).to match(/b is false/)
+        expect(r.stdout).to match(/c is false/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'fails on words' do
+      pp = <<-EOS
+      $a = "a"
+      $ao = num2bool($a)
+      notice(inline_template('a is <%= @ao.inspect %>'))
+      EOS
+      expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/not look like a number/)
+    end
+
+    it 'fails on numberwords' do
+      pp = <<-EOS
+      $b = "1b"
+      $bo = num2bool($b)
+      notice(inline_template('b is <%= @bo.inspect %>'))
+      EOS
+      expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/not look like a number/)
+
+    end
+
+    it 'fails on non-numeric/strings' do
+      pending "The function will call .to_s.to_i on anything not a Numeric or
+      String, and results in 0. Is this intended?"
+      pp = <<-EOS
+      $c = {"c" => "-50"}
+      $co = num2bool($c)
+      notice(inline_template('c is <%= @co.inspect %>'))
+      EOS
+      expect(apply_manifest(ppc :expect_failures => true).stderr).to match(/Unable to parse/)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/parsejson_spec.rb b/puppet/modules/stdlib/spec/acceptance/parsejson_spec.rb
new file mode 100755
index 00000000..50978102
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/parsejson_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'parsejson function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'parses valid json' do
+      pp = <<-EOS
+      $a = '{"hunter": "washere", "tests": "passing"}'
+      $ao = parsejson($a)
+      $tests = $ao['tests']
+      notice(inline_template('tests are <%= @tests.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/tests are "passing"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'raises error on incorrect json' do
+      pp = <<-EOS
+      $a = '{"hunter": "washere", "tests": "passing",}'
+      $ao = parsejson($a)
+      notice(inline_template('a is <%= @ao.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :expect_failures => true) do |r|
+        expect(r.stderr).to match(/expected next name/)
+      end
+    end
+
+    it 'raises error on incorrect number of arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/parseyaml_spec.rb b/puppet/modules/stdlib/spec/acceptance/parseyaml_spec.rb
new file mode 100755
index 00000000..5819837c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/parseyaml_spec.rb
@@ -0,0 +1,35 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'parseyaml function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'parses valid yaml' do
+      pp = <<-EOS
+      $a = "---\nhunter: washere\ntests: passing\n"
+      $o = parseyaml($a)
+      $tests = $o['tests']
+      notice(inline_template('tests are <%= @tests.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/tests are "passing"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'raises error on incorrect yaml' do
+      pp = <<-EOS
+      $a = "---\nhunter: washere\ntests: passing\n:"
+      $o = parseyaml($a)
+      $tests = $o['tests']
+      notice(inline_template('tests are <%= @tests.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :expect_failures => true) do |r|
+        expect(r.stderr).to match(/(syntax error|did not find expected key)/)
+      end
+    end
+
+    it 'raises error on incorrect number of arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/pick_default_spec.rb b/puppet/modules/stdlib/spec/acceptance/pick_default_spec.rb
new file mode 100755
index 00000000..a663f54e
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/pick_default_spec.rb
@@ -0,0 +1,54 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'pick_default function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'pick_defaults a default value' do
+      pp = <<-EOS
+      $a = undef
+      $o = pick_default($a, 'default')
+      notice(inline_template('picked is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/picked is "default"/)
+      end
+    end
+    it 'pick_defaults with no value' do
+      pp = <<-EOS
+      $a = undef
+      $b = undef
+      $o = pick_default($a,$b)
+      notice(inline_template('picked is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/picked is ""/)
+      end
+    end
+    it 'pick_defaults the first set value' do
+      pp = <<-EOS
+      $a = "something"
+      $b = "long"
+      $o = pick_default($a, $b, 'default')
+      notice(inline_template('picked is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/picked is "something"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'raises error with no values' do
+      pp = <<-EOS
+      $o = pick_default()
+      notice(inline_template('picked is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :expect_failures => true) do |r|
+        expect(r.stderr).to match(/Must receive at least one argument/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/pick_spec.rb b/puppet/modules/stdlib/spec/acceptance/pick_spec.rb
new file mode 100755
index 00000000..46cf63f2
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/pick_spec.rb
@@ -0,0 +1,44 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'pick function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'picks a default value' do
+      pp = <<-EOS
+      $a = undef
+      $o = pick($a, 'default')
+      notice(inline_template('picked is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/picked is "default"/)
+      end
+    end
+    it 'picks the first set value' do
+      pp = <<-EOS
+      $a = "something"
+      $b = "long"
+      $o = pick($a, $b, 'default')
+      notice(inline_template('picked is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/picked is "something"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'raises error with all undef values' do
+      pp = <<-EOS
+      $a = undef
+      $b = undef
+      $o = pick($a, $b)
+      notice(inline_template('picked is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :expect_failures => true) do |r|
+        expect(r.stderr).to match(/must receive at least one non empty value/)
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/prefix_spec.rb b/puppet/modules/stdlib/spec/acceptance/prefix_spec.rb
new file mode 100755
index 00000000..de55530e
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/prefix_spec.rb
@@ -0,0 +1,42 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'prefix function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'prefixes array of values' do
+      pp = <<-EOS
+      $o = prefix(['a','b','c'],'p')
+      notice(inline_template('prefix is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/prefix is \["pa", "pb", "pc"\]/)
+      end
+    end
+    it 'prefixs with empty array' do
+      pp = <<-EOS
+      $o = prefix([],'p')
+      notice(inline_template('prefix is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/prefix is \[\]/)
+      end
+    end
+    it 'prefixs array of values with undef' do
+      pp = <<-EOS
+      $o = prefix(['a','b','c'], undef)
+      notice(inline_template('prefix is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/prefix is \["a", "b", "c"\]/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'fails with no arguments'
+    it 'fails when first argument is not array'
+    it 'fails when second argument is not string'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/range_spec.rb b/puppet/modules/stdlib/spec/acceptance/range_spec.rb
new file mode 100755
index 00000000..a3ccd339
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/range_spec.rb
@@ -0,0 +1,36 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'range function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'ranges letters' do
+      pp = <<-EOS
+      $o = range('a','d')
+      notice(inline_template('range is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/range is \["a", "b", "c", "d"\]/)
+      end
+    end
+    it 'ranges letters with a step' do
+      pp = <<-EOS
+      $o = range('a','d', '2')
+      notice(inline_template('range is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/range is \["a", "c"\]/)
+      end
+    end
+    it 'ranges letters with a negative step'
+    it 'ranges numbers'
+    it 'ranges numbers with a step'
+    it 'ranges numbers with a negative step'
+    it 'ranges numeric strings'
+    it 'ranges zero padded numbers'
+  end
+  describe 'failure' do
+    it 'fails with no arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/reject_spec.rb b/puppet/modules/stdlib/spec/acceptance/reject_spec.rb
new file mode 100755
index 00000000..7f16a008
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/reject_spec.rb
@@ -0,0 +1,42 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'reject function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'rejects array of values' do
+      pp = <<-EOS
+      $o = reject(['aaa','bbb','ccc','aaaddd'], 'aaa')
+      notice(inline_template('reject is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/reject is \["bbb", "ccc"\]/)
+      end
+    end
+    it 'rejects with empty array' do
+      pp = <<-EOS
+      $o = reject([],'aaa')
+      notice(inline_template('reject is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/reject is \[\]/)
+      end
+    end
+    it 'rejects array of values with undef' do
+      pp = <<-EOS
+      $o = reject(['aaa','bbb','ccc','aaaddd'], undef)
+      notice(inline_template('reject is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/reject is \[\]/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'fails with no arguments'
+    it 'fails when first argument is not array'
+    it 'fails when second argument is not string'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/reverse_spec.rb b/puppet/modules/stdlib/spec/acceptance/reverse_spec.rb
new file mode 100755
index 00000000..c3f01567
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/reverse_spec.rb
@@ -0,0 +1,23 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'reverse function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'reverses strings' do
+      pp = <<-EOS
+      $a = "the public art galleries"
+      # Anagram: Large picture halls, I bet
+      $o = reverse($a)
+      notice(inline_template('reverse is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/reverse is "seirellag tra cilbup eht"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/rstrip_spec.rb b/puppet/modules/stdlib/spec/acceptance/rstrip_spec.rb
new file mode 100755
index 00000000..b57a8b04
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/rstrip_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'rstrip function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'rstrips arrays' do
+      pp = <<-EOS
+      $a = ["  the   ","   public   ","   art","galleries   "]
+      # Anagram: Large picture halls, I bet
+      $o = rstrip($a)
+      notice(inline_template('rstrip is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/rstrip is \["  the", "   public", "   art", "galleries"\]/)
+      end
+    end
+    it 'rstrips strings' do
+      pp = <<-EOS
+      $a = "   blowzy night-frumps vex'd jack q   "
+      $o = rstrip($a)
+      notice(inline_template('rstrip is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/rstrip is "   blowzy night-frumps vex'd jack q"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/shuffle_spec.rb b/puppet/modules/stdlib/spec/acceptance/shuffle_spec.rb
new file mode 100755
index 00000000..b840d1f1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/shuffle_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'shuffle function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'shuffles arrays' do
+      pp = <<-EOS
+      $a = ["1", "2", "3", "4", "5", "6", "7", "8", "the","public","art","galleries"]
+      # Anagram: Large picture halls, I bet
+      $o = shuffle($a)
+      notice(inline_template('shuffle is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to_not match(/shuffle is \["1", "2", "3", "4", "5", "6", "7", "8", "the", "public", "art", "galleries"\]/)
+      end
+    end
+    it 'shuffles strings' do
+      pp = <<-EOS
+      $a = "blowzy night-frumps vex'd jack q"
+      $o = shuffle($a)
+      notice(inline_template('shuffle is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to_not match(/shuffle is "blowzy night-frumps vex'd jack q"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/size_spec.rb b/puppet/modules/stdlib/spec/acceptance/size_spec.rb
new file mode 100755
index 00000000..a52b778b
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/size_spec.rb
@@ -0,0 +1,55 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'size function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'single string size' do
+      pp = <<-EOS
+      $a = 'discombobulate'
+      $o = size($a)
+      notice(inline_template('size is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/size is 14/)
+      end
+    end
+    it 'with empty string' do
+      pp = <<-EOS
+      $a = ''
+      $o = size($a)
+      notice(inline_template('size is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/size is 0/)
+      end
+    end
+    it 'with undef' do
+      pp = <<-EOS
+      $a = undef
+      $o = size($a)
+      notice(inline_template('size is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/size is 0/)
+      end
+    end
+    it 'strings in array' do
+      pp = <<-EOS
+      $a = ['discombobulate', 'moo']
+      $o = size($a)
+      notice(inline_template('size is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/size is 2/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/sort_spec.rb b/puppet/modules/stdlib/spec/acceptance/sort_spec.rb
new file mode 100755
index 00000000..c85bfabd
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/sort_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'sort function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'sorts arrays' do
+      pp = <<-EOS
+      $a = ["the","public","art","galleries"]
+      # Anagram: Large picture halls, I bet
+      $o = sort($a)
+      notice(inline_template('sort is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/sort is \["art", "galleries", "public", "the"\]/)
+      end
+    end
+    it 'sorts strings' do
+      pp = <<-EOS
+      $a = "blowzy night-frumps vex'd jack q"
+      $o = sort($a)
+      notice(inline_template('sort is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/sort is "    '-abcdefghijklmnopqrstuvwxyz"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/squeeze_spec.rb b/puppet/modules/stdlib/spec/acceptance/squeeze_spec.rb
new file mode 100755
index 00000000..400a458c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/squeeze_spec.rb
@@ -0,0 +1,47 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'squeeze function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'squeezes arrays' do
+      pp = <<-EOS
+      # Real words!
+      $a = ["wallless", "laparohysterosalpingooophorectomy", "brrr", "goddessship"]
+      $o = squeeze($a)
+      notice(inline_template('squeeze is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/squeeze is \["wales", "laparohysterosalpingophorectomy", "br", "godeship"\]/)
+      end
+    end
+    it 'squeezez arrays with an argument'
+    it 'squeezes strings' do
+      pp = <<-EOS
+      $a = "wallless laparohysterosalpingooophorectomy brrr goddessship"
+      $o = squeeze($a)
+      notice(inline_template('squeeze is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/squeeze is "wales laparohysterosalpingophorectomy br godeship"/)
+      end
+    end
+
+    it 'squeezes strings with an argument' do
+      pp = <<-EOS
+      $a = "countessship duchessship governessship hostessship"
+      $o = squeeze($a, 's')
+      notice(inline_template('squeeze is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/squeeze is "counteship ducheship governeship hosteship"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/str2bool_spec.rb b/puppet/modules/stdlib/spec/acceptance/str2bool_spec.rb
new file mode 100755
index 00000000..cf549dab
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/str2bool_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'str2bool function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'works with "y"' do
+      pp = <<-EOS
+      $o = str2bool('y')
+      notice(inline_template('str2bool is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/str2bool is true/)
+      end
+    end
+    it 'works with "Y"'
+    it 'works with "yes"'
+    it 'works with "1"'
+    it 'works with "true"'
+    it 'works with "n"'
+    it 'works with "N"'
+    it 'works with "no"'
+    it 'works with "0"'
+    it 'works with "false"'
+    it 'works with undef'
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non arrays or strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb b/puppet/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb
new file mode 100755
index 00000000..993e63ba
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/str2saltedsha512_spec.rb
@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'str2saltedsha512 function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'works with "y"' do
+      pp = <<-EOS
+      $o = str2saltedsha512('password')
+      notice(inline_template('str2saltedsha512 is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/str2saltedsha512 is "[a-f0-9]{136}"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles more than one argument'
+    it 'handles non strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/strftime_spec.rb b/puppet/modules/stdlib/spec/acceptance/strftime_spec.rb
new file mode 100755
index 00000000..53b7f903
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/strftime_spec.rb
@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'strftime function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'gives the Century' do
+      pp = <<-EOS
+      $o = strftime('%C')
+      notice(inline_template('strftime is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/strftime is "20"/)
+      end
+    end
+    it 'takes a timezone argument'
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles invalid format strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/strip_spec.rb b/puppet/modules/stdlib/spec/acceptance/strip_spec.rb
new file mode 100755
index 00000000..906fd7ab
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/strip_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'strip function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'strips arrays' do
+      pp = <<-EOS
+      $a = ["  the   ","   public   ","   art","galleries   "]
+      # Anagram: Large picture halls, I bet
+      $o = strip($a)
+      notice(inline_template('strip is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/strip is \["the", "public", "art", "galleries"\]/)
+      end
+    end
+    it 'strips strings' do
+      pp = <<-EOS
+      $a = "   blowzy night-frumps vex'd jack q   "
+      $o = strip($a)
+      notice(inline_template('strip is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/strip is "blowzy night-frumps vex'd jack q"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/suffix_spec.rb b/puppet/modules/stdlib/spec/acceptance/suffix_spec.rb
new file mode 100755
index 00000000..630f866d
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/suffix_spec.rb
@@ -0,0 +1,42 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'suffix function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'suffixes array of values' do
+      pp = <<-EOS
+      $o = suffix(['a','b','c'],'p')
+      notice(inline_template('suffix is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/suffix is \["ap", "bp", "cp"\]/)
+      end
+    end
+    it 'suffixs with empty array' do
+      pp = <<-EOS
+      $o = suffix([],'p')
+      notice(inline_template('suffix is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/suffix is \[\]/)
+      end
+    end
+    it 'suffixs array of values with undef' do
+      pp = <<-EOS
+      $o = suffix(['a','b','c'], undef)
+      notice(inline_template('suffix is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/suffix is \["a", "b", "c"\]/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'fails with no arguments'
+    it 'fails when first argument is not array'
+    it 'fails when second argument is not string'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/swapcase_spec.rb b/puppet/modules/stdlib/spec/acceptance/swapcase_spec.rb
new file mode 100755
index 00000000..b7894fbe
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/swapcase_spec.rb
@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'swapcase function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'works with strings' do
+      pp = <<-EOS
+      $o = swapcase('aBcD')
+      notice(inline_template('swapcase is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/swapcase is "AbCd"/)
+      end
+    end
+    it 'works with arrays'
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non arrays or strings'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/time_spec.rb b/puppet/modules/stdlib/spec/acceptance/time_spec.rb
new file mode 100755
index 00000000..cdb29607
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/time_spec.rb
@@ -0,0 +1,36 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'time function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'gives the time' do
+      pp = <<-EOS
+      $o = time()
+      notice(inline_template('time is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        m = r.stdout.match(/time is (\d+)\D/)
+
+        # When I wrote this test
+        expect(Integer(m[1])).to be > 1398894170
+      end
+    end
+    it 'takes a timezone argument' do
+      pp = <<-EOS
+      $o = time('UTC')
+      notice(inline_template('time is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        m = r.stdout.match(/time is (\d+)\D/)
+
+        expect(Integer(m[1])).to be > 1398894170
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles more arguments'
+    it 'handles invalid timezones'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/to_bytes_spec.rb b/puppet/modules/stdlib/spec/acceptance/to_bytes_spec.rb
new file mode 100755
index 00000000..2b4c61f4
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/to_bytes_spec.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'to_bytes function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'converts kB to B' do
+      pp = <<-EOS
+      $o = to_bytes('4 kB')
+      notice(inline_template('to_bytes is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        m = r.stdout.match(/to_bytes is (\d+)\D/)
+        expect(m[1]).to eq("4096")
+      end
+    end
+    it 'works without the B in unit'
+    it 'works without a space before unit'
+    it 'works without a unit'
+    it 'converts fractions'
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non integer arguments'
+    it 'handles unknown units like uB'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/type_spec.rb b/puppet/modules/stdlib/spec/acceptance/type_spec.rb
new file mode 100755
index 00000000..67e32480
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/type_spec.rb
@@ -0,0 +1,37 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'type function', :unless => (UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) || is_future_parser_enabled?) do
+  describe 'success' do
+    it 'types arrays' do
+      pp = <<-EOS
+      $a = ["the","public","art","galleries"]
+      # Anagram: Large picture halls, I bet
+      $o = type($a)
+      notice(inline_template('type is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/type is "array"/)
+      end
+    end
+    it 'types strings' do
+      pp = <<-EOS
+      $a = "blowzy night-frumps vex'd jack q"
+      $o = type($a)
+      notice(inline_template('type is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/type is "string"/)
+      end
+    end
+    it 'types hashes'
+    it 'types integers'
+    it 'types floats'
+    it 'types booleans'
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/union_spec.rb b/puppet/modules/stdlib/spec/acceptance/union_spec.rb
new file mode 100755
index 00000000..6db8d0cf
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/union_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'union function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'unions arrays' do
+      pp = <<-EOS
+      $a = ["the","public"]
+      $b = ["art","galleries"]
+      # Anagram: Large picture halls, I bet
+      $o = union($a,$b)
+      notice(inline_template('union is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/union is \["the", "public", "art", "galleries"\]/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/unique_spec.rb b/puppet/modules/stdlib/spec/acceptance/unique_spec.rb
new file mode 100755
index 00000000..bfadad19
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/unique_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'unique function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'uniques arrays' do
+      pp = <<-EOS
+      $a = ["wallless", "wallless", "brrr", "goddessship"]
+      $o = unique($a)
+      notice(inline_template('unique is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/unique is \["wallless", "brrr", "goddessship"\]/)
+      end
+    end
+    it 'uniques strings' do
+      pp = <<-EOS
+      $a = "wallless laparohysterosalpingooophorectomy brrr goddessship"
+      $o = unique($a)
+      notice(inline_template('unique is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/unique is "wales prohytingcmbd"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/unsupported_spec.rb b/puppet/modules/stdlib/spec/acceptance/unsupported_spec.rb
new file mode 100755
index 00000000..1c559f67
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/unsupported_spec.rb
@@ -0,0 +1,11 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'unsupported distributions and OSes', :if => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  it 'should fail' do
+    pp = <<-EOS
+    class { 'mysql::server': }
+    EOS
+    expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/unsupported osfamily/i)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/upcase_spec.rb b/puppet/modules/stdlib/spec/acceptance/upcase_spec.rb
new file mode 100755
index 00000000..3d2906d7
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/upcase_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'upcase function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'upcases arrays' do
+      pp = <<-EOS
+      $a = ["wallless", "laparohysterosalpingooophorectomy", "brrr", "goddessship"]
+      $o = upcase($a)
+      notice(inline_template('upcase is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/upcase is \["WALLLESS", "LAPAROHYSTEROSALPINGOOOPHORECTOMY", "BRRR", "GODDESSSHIP"\]/)
+      end
+    end
+    it 'upcases strings' do
+      pp = <<-EOS
+      $a = "wallless laparohysterosalpingooophorectomy brrr goddessship"
+      $o = upcase($a)
+      notice(inline_template('upcase is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/upcase is "WALLLESS LAPAROHYSTEROSALPINGOOOPHORECTOMY BRRR GODDESSSHIP"/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/uriescape_spec.rb b/puppet/modules/stdlib/spec/acceptance/uriescape_spec.rb
new file mode 100755
index 00000000..7e30205e
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/uriescape_spec.rb
@@ -0,0 +1,23 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'uriescape function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'uriescape strings' do
+      pp = <<-EOS
+      $a = ":/?#[]@!$&'()*+,;= \\\"{}"
+      $o = uriescape($a)
+      notice(inline_template('uriescape is <%= @o.inspect %>'))
+      EOS
+
+      apply_manifest(pp, :catch_failures => true) do |r|
+        expect(r.stdout).to match(/uriescape is ":\/\?%23\[\]@!\$&'\(\)\*\+,;=%20%22%7B%7D"/)
+      end
+    end
+    it 'does nothing if a string is already safe'
+  end
+  describe 'failure' do
+    it 'handles no arguments'
+    it 'handles non strings or arrays'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb
new file mode 100755
index 00000000..7082e848
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_absolute_path_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_absolute_path function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    %w{
+      C:/
+      C:\\\\
+      C:\\\\WINDOWS\\\\System32
+      C:/windows/system32
+      X:/foo/bar
+      X:\\\\foo\\\\bar
+      /var/tmp
+      /var/lib/puppet
+      /var/opt/../lib/puppet
+    }.each do |path|
+      it "validates a single argument #{path}" do
+        pp = <<-EOS
+        $one = '#{path}'
+        validate_absolute_path($one)
+        EOS
+
+        apply_manifest(pp, :catch_failures => true)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+    it 'handles relative paths'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_array_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_array_spec.rb
new file mode 100755
index 00000000..b53e98c2
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_array_spec.rb
@@ -0,0 +1,37 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_array function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a single argument' do
+      pp = <<-EOS
+      $one = ['a', 'b']
+      validate_array($one)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates an multiple arguments' do
+      pp = <<-EOS
+      $one = ['a', 'b']
+      $two = [['c'], 'd']
+      validate_array($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates a non-array' do
+      {
+        %{validate_array({'a' => 'hash' })} => "Hash",
+        %{validate_array('string')}         => "String",
+        %{validate_array(false)}            => "FalseClass",
+        %{validate_array(undef)}            => "String"
+      }.each do |pp,type|
+        expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/a #{type}/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_augeas_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_augeas_spec.rb
new file mode 100755
index 00000000..71a4c842
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_augeas_spec.rb
@@ -0,0 +1,63 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_augeas function', :unless => ((UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem'))) or (fact('osfamily') == 'windows')) do
+  describe 'prep' do
+    it 'installs augeas for tests'
+  end
+  describe 'success' do
+    context 'valid inputs with no 3rd argument' do
+      {
+        'root:x:0:0:root:/root:/bin/bash\n'                        => 'Passwd.lns',
+        'proc /proc   proc    nodev,noexec,nosuid     0       0\n' => 'Fstab.lns'
+      }.each do |line,lens|
+        it "validates a single argument for #{lens}" do
+          pp = <<-EOS
+          $line = "#{line}"
+          $lens = "#{lens}"
+          validate_augeas($line, $lens)
+          EOS
+
+          apply_manifest(pp, :catch_failures => true)
+        end
+      end
+    end
+    context 'valid inputs with 3rd and 4th arguments' do
+      it "validates a restricted value" do
+        line        = 'root:x:0:0:root:/root:/bin/barsh\n'
+        lens        = 'Passwd.lns'
+        restriction = '$file/*[shell="/bin/barsh"]'
+        pp = <<-EOS
+        $line        = "#{line}"
+        $lens        = "#{lens}"
+        $restriction = ['#{restriction}']
+        validate_augeas($line, $lens, $restriction, "my custom failure message")
+        EOS
+
+        expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/my custom failure message/)
+      end
+    end
+    context 'invalid inputs' do
+      {
+        'root:x:0:0:root' => 'Passwd.lns',
+        '127.0.1.1'       => 'Hosts.lns'
+      }.each do |line,lens|
+        it "validates a single argument for #{lens}" do
+          pp = <<-EOS
+          $line = "#{line}"
+          $lens = "#{lens}"
+          validate_augeas($line, $lens)
+          EOS
+
+          apply_manifest(pp, :expect_failures => true)
+        end
+      end
+    end
+    context 'garbage inputs' do
+      it 'raises an error on invalid inputs'
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_bool_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_bool_spec.rb
new file mode 100755
index 00000000..c837f089
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_bool_spec.rb
@@ -0,0 +1,37 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_bool function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a single argument' do
+      pp = <<-EOS
+      $one = true
+      validate_bool($one)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates an multiple arguments' do
+      pp = <<-EOS
+      $one = true
+      $two = false
+      validate_bool($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates a non-bool' do
+      {
+        %{validate_bool('true')}  => "String",
+        %{validate_bool('false')} => "String",
+        %{validate_bool([true])}  => "Array",
+        %{validate_bool(undef)}   => "String",
+      }.each do |pp,type|
+        expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/a #{type}/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_cmd_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_cmd_spec.rb
new file mode 100755
index 00000000..5ac66fdb
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_cmd_spec.rb
@@ -0,0 +1,52 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_cmd function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a true command' do
+      pp = <<-EOS
+      $one = 'foo'
+      if $::osfamily == 'windows' {
+        $two = 'echo' #shell built-in
+      } else {
+        $two = '/bin/echo'
+      }
+      validate_cmd($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates a fail command' do
+      pp = <<-EOS
+      $one = 'foo'
+      if $::osfamily == 'windows' {
+        $two = 'C:/aoeu'
+      } else {
+        $two = '/bin/aoeu'
+      }
+      validate_cmd($one,$two)
+      EOS
+
+      apply_manifest(pp, :expect_failures => true)
+    end
+    it 'validates a fail command with a custom error message' do
+      pp = <<-EOS
+      $one = 'foo'
+      if $::osfamily == 'windows' {
+        $two = 'C:/aoeu'
+      } else {
+        $two = '/bin/aoeu'
+      }
+      validate_cmd($one,$two,"aoeu is dvorak")
+      EOS
+
+      apply_manifest(pp, :expect_failures => true) do |output|
+        expect(output.stderr).to match(/aoeu is dvorak/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+    it 'handles improper argument types'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_hash_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_hash_spec.rb
new file mode 100755
index 00000000..52fb615b
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_hash_spec.rb
@@ -0,0 +1,37 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_hash function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a single argument' do
+      pp = <<-EOS
+      $one = { 'a' => 1 }
+      validate_hash($one)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates an multiple arguments' do
+      pp = <<-EOS
+      $one = { 'a' => 1 }
+      $two = { 'b' => 2 }
+      validate_hash($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates a non-hash' do
+      {
+        %{validate_hash('{ "not" => "hash" }')} => "String",
+        %{validate_hash('string')}              => "String",
+        %{validate_hash(["array"])}             => "Array",
+        %{validate_hash(undef)}                 => "String",
+      }.each do |pp,type|
+        expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/a #{type}/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb
new file mode 100755
index 00000000..64841c37
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_ipv4_address_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_ipv4_address function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a single argument' do
+      pp = <<-EOS
+      $one = '1.2.3.4'
+      validate_ipv4_address($one)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates an multiple arguments' do
+      pp = <<-EOS
+      $one = '1.2.3.4'
+      $two = '5.6.7.8'
+      validate_ipv4_address($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+    it 'handles ipv6 addresses'
+    it 'handles non-ipv4 strings'
+    it 'handles numbers'
+    it 'handles no arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb
new file mode 100755
index 00000000..6426d1a5
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_ipv6_address_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_ipv6_address function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a single argument' do
+      pp = <<-EOS
+      $one = '3ffe:0505:0002::'
+      validate_ipv6_address($one)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates an multiple arguments' do
+      pp = <<-EOS
+      $one = '3ffe:0505:0002::'
+      $two = '3ffe:0505:0001::'
+      validate_ipv6_address($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+    it 'handles ipv6 addresses'
+    it 'handles non-ipv6 strings'
+    it 'handles numbers'
+    it 'handles no arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_re_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_re_spec.rb
new file mode 100755
index 00000000..22f6d47d
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_re_spec.rb
@@ -0,0 +1,47 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_re function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a string' do
+      pp = <<-EOS
+      $one = 'one'
+      $two = '^one$'
+      validate_re($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates an array' do
+      pp = <<-EOS
+      $one = 'one'
+      $two = ['^one$', '^two']
+      validate_re($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates a failed array' do
+      pp = <<-EOS
+      $one = 'one'
+      $two = ['^two$', '^three']
+      validate_re($one,$two)
+      EOS
+
+      apply_manifest(pp, :expect_failures => true)
+    end
+    it 'validates a failed array with a custom error message' do
+      pp = <<-EOS
+      $one = '3.4.3'
+      $two = '^2.7'
+      validate_re($one,$two,"The $puppetversion fact does not match 2.7")
+      EOS
+
+      expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/does not match/)
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+    it 'handles improper argument types'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_slength_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_slength_spec.rb
new file mode 100755
index 00000000..1ab2bb98
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_slength_spec.rb
@@ -0,0 +1,72 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_slength function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a single string max' do
+      pp = <<-EOS
+      $one = 'discombobulate'
+      $two = 17
+      validate_slength($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates multiple string maxes' do
+      pp = <<-EOS
+      $one = ['discombobulate', 'moo']
+      $two = 17
+      validate_slength($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates min/max of  strings in array' do
+      pp = <<-EOS
+      $one = ['discombobulate', 'moo']
+      $two = 17
+      $three = 3
+      validate_slength($one,$two,$three)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates a single string max of incorrect length' do
+      pp = <<-EOS
+      $one = 'discombobulate'
+      $two = 1
+      validate_slength($one,$two)
+      EOS
+
+      apply_manifest(pp, :expect_failures => true)
+    end
+    it 'validates multiple string maxes of incorrect length' do
+      pp = <<-EOS
+      $one = ['discombobulate', 'moo']
+      $two = 3
+      validate_slength($one,$two)
+      EOS
+
+      apply_manifest(pp, :expect_failures => true)
+    end
+    it 'validates multiple strings min/maxes of incorrect length' do
+      pp = <<-EOS
+      $one = ['discombobulate', 'moo']
+      $two = 17
+      $three = 10
+      validate_slength($one,$two,$three)
+      EOS
+
+      apply_manifest(pp, :expect_failures => true)
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+    it 'handles improper first argument type'
+    it 'handles non-strings in array of first argument'
+    it 'handles improper second argument type'
+    it 'handles improper third argument type'
+    it 'handles negative ranges'
+    it 'handles improper ranges'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/validate_string_spec.rb b/puppet/modules/stdlib/spec/acceptance/validate_string_spec.rb
new file mode 100755
index 00000000..8956f48c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/validate_string_spec.rb
@@ -0,0 +1,36 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'validate_string function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'validates a single argument' do
+      pp = <<-EOS
+      $one = 'string'
+      validate_string($one)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates an multiple arguments' do
+      pp = <<-EOS
+      $one = 'string'
+      $two = 'also string'
+      validate_string($one,$two)
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+    it 'validates a non-string' do
+      {
+        %{validate_string({ 'a' => 'hash' })} => "Hash",
+        %{validate_string(['array'])}         => "Array",
+        %{validate_string(false)}             => "FalseClass",
+      }.each do |pp,type|
+        expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/a #{type}/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/values_at_spec.rb b/puppet/modules/stdlib/spec/acceptance/values_at_spec.rb
new file mode 100755
index 00000000..da63cf30
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/values_at_spec.rb
@@ -0,0 +1,73 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'values_at function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'returns a specific value' do
+      pp = <<-EOS
+      $one = ['a','b','c','d','e']
+      $two = 1
+      $output = values_at($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b"\]/)
+    end
+    it 'returns a specific negative index value' do
+      pending("negative numbers don't work")
+      pp = <<-EOS
+      $one = ['a','b','c','d','e']
+      $two = -1
+      $output = values_at($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["e"\]/)
+    end
+    it 'returns a range of values' do
+      pp = <<-EOS
+      $one = ['a','b','c','d','e']
+      $two = "1-3"
+      $output = values_at($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b", "c", "d"\]/)
+    end
+    it 'returns a negative specific value and range of values' do
+      pp = <<-EOS
+      $one = ['a','b','c','d','e']
+      $two = ["1-3",0]
+      $output = values_at($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["b", "c", "d", "a"\]/)
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments' do
+      pp = <<-EOS
+      $one = ['a','b','c','d','e']
+      $output = values_at($one)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Wrong number of arguments/)
+    end
+    it 'handles non-indicies arguments' do
+      pp = <<-EOS
+      $one = ['a','b','c','d','e']
+      $two = []
+      $output = values_at($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/at least one positive index/)
+    end
+
+    it 'detects index ranges smaller than the start range'
+    it 'handles index ranges larger than array'
+    it 'handles non-integer indicies'
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/values_spec.rb b/puppet/modules/stdlib/spec/acceptance/values_spec.rb
new file mode 100755
index 00000000..a2eff329
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/values_spec.rb
@@ -0,0 +1,35 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+
+describe 'values function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'returns an array of values' do
+      pp = <<-EOS
+      $arg = {
+        'a' => 1,
+        'b' => 2,
+        'c' => 3,
+      }
+      $output = values($arg)
+      notice(inline_template('<%= @output.sort.inspect %>'))
+      EOS
+      if is_future_parser_enabled?
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[1, 2, 3\]/)
+      else
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["1", "2", "3"\]/)
+      end
+
+    end
+  end
+  describe 'failure' do
+    it 'handles non-hash arguments' do
+      pp = <<-EOS
+      $arg = "foo"
+      $output = values($arg)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Requires hash/)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/acceptance/zip_spec.rb b/puppet/modules/stdlib/spec/acceptance/zip_spec.rb
new file mode 100755
index 00000000..139079e3
--- /dev/null
+++ b/puppet/modules/stdlib/spec/acceptance/zip_spec.rb
@@ -0,0 +1,86 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper_acceptance'
+require 'puppet'
+
+describe 'zip function', :unless => UNSUPPORTED_PLATFORMS.include?(fact('operatingsystem')) do
+  describe 'success' do
+    it 'zips two arrays of numbers together' do
+      pp = <<-EOS
+      $one = [1,2,3,4]
+      $two = [5,6,7,8]
+      $output = zip($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+      if is_future_parser_enabled?
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, 5\], \[2, 6\], \[3, 7\], \[4, 8\]\]/)
+      else
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\["1", "5"\], \["2", "6"\], \["3", "7"\], \["4", "8"\]\]/)
+      end
+    end
+    it 'zips two arrays of numbers & bools together' do
+      pp = <<-EOS
+      $one = [1,2,"three",4]
+      $two = [true,true,false,false]
+      $output = zip($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+      if is_future_parser_enabled?
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, true\], \[2, true\], \["three", false\], \[4, false\]\]/)
+      else
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\["1", true\], \["2", true\], \["three", false\], \["4", false\]\]/)
+      end
+    end
+    it 'zips two arrays of numbers together and flattens them' do
+      # XXX This only tests the argument `true`, even though the following are valid:
+      # 1 t y true yes
+      # 0 f n false no
+      # undef undefined
+      pp = <<-EOS
+      $one = [1,2,3,4]
+      $two = [5,6,7,8]
+      $output = zip($one,$two,true)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+      if is_future_parser_enabled?
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[1, 5, 2, 6, 3, 7, 4, 8\]/)
+      else
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\["1", "5", "2", "6", "3", "7", "4", "8"\]/)
+      end
+    end
+    it 'handles unmatched length' do
+      # XXX Is this expected behavior?
+      pp = <<-EOS
+      $one = [1,2]
+      $two = [5,6,7,8]
+      $output = zip($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+      if is_future_parser_enabled?
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\[1, 5\], \[2, 6\]\]/)
+      else
+        expect(apply_manifest(pp, :catch_failures => true).stdout).to match(/\[\["1", "5"\], \["2", "6"\]\]/)
+      end
+    end
+  end
+  describe 'failure' do
+    it 'handles improper number of arguments' do
+      pp = <<-EOS
+      $one = [1,2]
+      $output = zip($one)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Wrong number of arguments/)
+    end
+    it 'handles improper argument types' do
+      pp = <<-EOS
+      $one = "a string"
+      $two = [5,6,7,8]
+      $output = zip($one,$two)
+      notice(inline_template('<%= @output.inspect %>'))
+      EOS
+
+      expect(apply_manifest(pp, :expect_failures => true).stderr).to match(/Requires array/)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/classes/anchor_spec.rb b/puppet/modules/stdlib/spec/classes/anchor_spec.rb
new file mode 100755
index 00000000..2d4455e4
--- /dev/null
+++ b/puppet/modules/stdlib/spec/classes/anchor_spec.rb
@@ -0,0 +1,30 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'puppet_spec/compiler'
+
+describe "anchorrefresh" do
+  include PuppetSpec::Compiler
+
+  let :transaction do
+    apply_compiled_manifest(<<-ANCHORCLASS)
+      class anchored {
+        anchor { 'anchored::begin': }
+        ~> anchor { 'anchored::end': }
+      }
+
+      class anchorrefresh {
+        notify { 'first': }
+        ~> class { 'anchored': }
+        ~> anchor { 'final': }
+      }
+
+      include anchorrefresh
+    ANCHORCLASS
+  end
+
+  it 'propagates events through the anchored class' do
+    resource = transaction.resource_status('Anchor[final]')
+
+    expect(resource.restarted).to eq(true)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/fixtures/dscacheutil/root b/puppet/modules/stdlib/spec/fixtures/dscacheutil/root
new file mode 100644
index 00000000..1e34519b
--- /dev/null
+++ b/puppet/modules/stdlib/spec/fixtures/dscacheutil/root
@@ -0,0 +1,8 @@
+name: root
+password: *
+uid: 0
+gid: 0
+dir: /var/root
+shell: /bin/bash
+gecos: rawr Root
+
diff --git a/puppet/modules/stdlib/spec/functions/abs_spec.rb b/puppet/modules/stdlib/spec/functions/abs_spec.rb
new file mode 100755
index 00000000..3c25ce28
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/abs_spec.rb
@@ -0,0 +1,25 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe "the abs function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("abs")).to eq("function_abs")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_abs([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should convert a negative number into a positive" do
+    result = scope.function_abs(["-34"])
+    expect(result).to(eq(34))
+  end
+
+  it "should do nothing with a positive number" do
+    result = scope.function_abs(["5678"])
+    expect(result).to(eq(5678))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/any2array_spec.rb b/puppet/modules/stdlib/spec/functions/any2array_spec.rb
new file mode 100755
index 00000000..87cd04b5
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/any2array_spec.rb
@@ -0,0 +1,55 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the any2array function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("any2array")).to eq("function_any2array")
+  end
+
+  it "should return an empty array if there is less than 1 argument" do
+    result = scope.function_any2array([])
+    expect(result).to(eq([]))
+  end
+
+  it "should convert boolean true to [ true ] " do
+    result = scope.function_any2array([true])
+    expect(result).to(eq([true]))
+  end
+
+  it "should convert one object to [object]" do
+    result = scope.function_any2array(['one'])
+    expect(result).to(eq(['one']))
+  end
+
+  it "should convert multiple objects to [objects]" do
+    result = scope.function_any2array(['one', 'two'])
+    expect(result).to(eq(['one', 'two']))
+  end
+
+  it "should return empty array it was called with" do
+    result = scope.function_any2array([[]])
+    expect(result).to(eq([]))
+  end
+
+  it "should return one-member array it was called with" do
+    result = scope.function_any2array([['string']])
+    expect(result).to(eq(['string']))
+  end
+
+  it "should return multi-member array it was called with" do
+    result = scope.function_any2array([['one', 'two']])
+    expect(result).to(eq(['one', 'two']))
+  end
+
+  it "should return members of a hash it was called with" do
+    result = scope.function_any2array([{ 'key' => 'value' }])
+    expect(result).to(eq(['key', 'value']))
+  end
+
+  it "should return an empty array if it was called with an empty hash" do
+    result = scope.function_any2array([{ }])
+    expect(result).to(eq([]))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/base64_spec.rb b/puppet/modules/stdlib/spec/functions/base64_spec.rb
new file mode 100755
index 00000000..e93fafcd
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/base64_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe "the base64 function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("base64")).to eq("function_base64")
+  end
+
+  it "should raise a ParseError if there are other than 2 arguments" do
+    expect { scope.function_base64([]) }.to(raise_error(Puppet::ParseError))
+    expect { scope.function_base64(["asdf"]) }.to(raise_error(Puppet::ParseError))
+    expect { scope.function_base64(["asdf","moo","cow"]) }.to(raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if argument 1 isn't 'encode' or 'decode'" do
+    expect { scope.function_base64(["bees","astring"]) }.to(raise_error(Puppet::ParseError, /first argument must be one of/))
+  end
+
+  it "should raise a ParseError if argument 2 isn't a string" do
+    expect { scope.function_base64(["encode",["2"]]) }.to(raise_error(Puppet::ParseError, /second argument must be a string/))
+  end
+
+  it "should encode a encoded string" do
+    result = scope.function_base64(["encode",'thestring'])
+    expect(result).to match(/\AdGhlc3RyaW5n\n\Z/)
+  end
+  it "should decode a base64 encoded string" do
+    result = scope.function_base64(["decode",'dGhlc3RyaW5n'])
+    expect(result).to eq('thestring')
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/bool2num_spec.rb b/puppet/modules/stdlib/spec/functions/bool2num_spec.rb
new file mode 100755
index 00000000..3904d7e4
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/bool2num_spec.rb
@@ -0,0 +1,38 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the bool2num function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("bool2num")).to eq("function_bool2num")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_bool2num([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should convert true to 1" do
+    result = scope.function_bool2num([true])
+    expect(result).to(eq(1))
+  end
+
+  it "should convert 'true' to 1" do
+    result = scope.function_bool2num(['true'])
+    result.should(eq(1))
+  end
+
+  it "should convert 'false' to 0" do
+    result = scope.function_bool2num(['false'])
+    expect(result).to(eq(0))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('true')
+    result = scope.function_bool2num([value])
+    result.should(eq(1))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/capitalize_spec.rb b/puppet/modules/stdlib/spec/functions/capitalize_spec.rb
new file mode 100755
index 00000000..fd0e92ba
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/capitalize_spec.rb
@@ -0,0 +1,28 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the capitalize function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("capitalize")).to eq("function_capitalize")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_capitalize([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should capitalize the beginning of a string" do
+    result = scope.function_capitalize(["abc"])
+    expect(result).to(eq("Abc"))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('abc')
+    result = scope.function_capitalize([value])
+    result.should(eq('Abc'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/chomp_spec.rb b/puppet/modules/stdlib/spec/functions/chomp_spec.rb
new file mode 100755
index 00000000..b1e1e60f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/chomp_spec.rb
@@ -0,0 +1,28 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the chomp function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("chomp")).to eq("function_chomp")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_chomp([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should chomp the end of a string" do
+    result = scope.function_chomp(["abc\n"])
+    expect(result).to(eq("abc"))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new("abc\n")
+    result = scope.function_chomp([value])
+    result.should(eq("abc"))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/chop_spec.rb b/puppet/modules/stdlib/spec/functions/chop_spec.rb
new file mode 100755
index 00000000..c8a19519
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/chop_spec.rb
@@ -0,0 +1,28 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the chop function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("chop")).to eq("function_chop")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_chop([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should chop the end of a string" do
+    result = scope.function_chop(["asdf\n"])
+    expect(result).to(eq("asdf"))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new("abc\n")
+    result = scope.function_chop([value])
+    result.should(eq('abc'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/concat_spec.rb b/puppet/modules/stdlib/spec/functions/concat_spec.rb
new file mode 100755
index 00000000..49fa6bb3
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/concat_spec.rb
@@ -0,0 +1,50 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the concat function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should raise a ParseError if the client does not provide at least two arguments" do
+    expect { scope.function_concat([]) }.to(raise_error(Puppet::ParseError))
+    expect { scope.function_concat([[1]]) }.to(raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if the first parameter is not an array" do
+    expect { scope.function_concat([1, []])}.to(raise_error(Puppet::ParseError))
+  end
+
+  it "should not raise a ParseError if the client provides more than two arguments" do
+    expect { scope.function_concat([[1],[2],[3]]) }.not_to raise_error
+  end
+
+  it "should be able to concat an array" do
+    result = scope.function_concat([['1','2','3'],['4','5','6']])
+    expect(result).to(eq(['1','2','3','4','5','6']))
+  end
+
+  it "should be able to concat a primitive to an array" do
+    result = scope.function_concat([['1','2','3'],'4'])
+    expect(result).to(eq(['1','2','3','4']))
+  end
+
+  it "should not accidentally flatten nested arrays" do
+    result = scope.function_concat([['1','2','3'],[['4','5'],'6']])
+    expect(result).to(eq(['1','2','3',['4','5'],'6']))
+  end
+
+  it "should leave the original array intact" do
+    array_original = ['1','2','3']
+    result = scope.function_concat([array_original,['4','5','6']])
+    array_original.should(eq(['1','2','3']))
+  end
+
+  it "should be able to concat multiple arrays" do
+    result = scope.function_concat([['1','2','3'],['4','5','6'],['7','8','9']])
+    expect(result).to(eq(['1','2','3','4','5','6','7','8','9']))
+  end
+
+  it "should be able to concat mix of primitives and arrays to a final array" do
+    result = scope.function_concat([['1','2','3'],'4',['5','6','7']])
+    expect(result).to(eq(['1','2','3','4','5','6','7']))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/count_spec.rb b/puppet/modules/stdlib/spec/functions/count_spec.rb
new file mode 100755
index 00000000..f8f1d484
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/count_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe "the count function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("count")).to eq("function_count")
+  end
+
+  it "should raise a ArgumentError if there is more than 2 arguments" do
+    expect { scope.function_count(['foo', 'bar', 'baz']) }.to( raise_error(ArgumentError))
+  end
+
+  it "should be able to count arrays" do
+    expect(scope.function_count([["1","2","3"]])).to(eq(3))
+  end
+
+  it "should be able to count matching elements in arrays" do
+    expect(scope.function_count([["1", "2", "2"], "2"])).to(eq(2))
+  end
+
+  it "should not count nil or empty strings" do
+    expect(scope.function_count([["foo","bar",nil,""]])).to(eq(2))
+  end
+
+  it 'does not count an undefined hash key or an out of bound array index (which are both :undef)' do
+    expect(scope.function_count([["foo",:undef,:undef]])).to eq(1)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/deep_merge_spec.rb b/puppet/modules/stdlib/spec/functions/deep_merge_spec.rb
new file mode 100755
index 00000000..7087904a
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/deep_merge_spec.rb
@@ -0,0 +1,105 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:deep_merge) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  describe 'when calling deep_merge from puppet' do
+    it "should not compile when no arguments are passed" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = '$x = deep_merge()'
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+
+    it "should not compile when 1 argument is passed" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = "$my_hash={'one' => 1}\n$x = deep_merge($my_hash)"
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+  end
+
+  describe 'when calling deep_merge on the scope instance' do
+    it 'should require all parameters are hashes' do
+      expect { new_hash = scope.function_deep_merge([{}, '2'])}.to raise_error(Puppet::ParseError, /unexpected argument type String/)
+      expect { new_hash = scope.function_deep_merge([{}, 2])}.to raise_error(Puppet::ParseError, /unexpected argument type Fixnum/)
+    end
+
+    it 'should accept empty strings as puppet undef' do
+      expect { new_hash = scope.function_deep_merge([{}, ''])}.not_to raise_error
+    end
+
+    it 'should be able to deep_merge two hashes' do
+      new_hash = scope.function_deep_merge([{'one' => '1', 'two' => '1'}, {'two' => '2', 'three' => '2'}])
+      expect(new_hash['one']).to   eq('1')
+      expect(new_hash['two']).to   eq('2')
+      expect(new_hash['three']).to eq('2')
+    end
+
+    it 'should deep_merge multiple hashes' do
+      hash = scope.function_deep_merge([{'one' => 1}, {'one' => '2'}, {'one' => '3'}])
+      expect(hash['one']).to eq('3')
+    end
+
+    it 'should accept empty hashes' do
+      expect(scope.function_deep_merge([{},{},{}])).to eq({})
+    end
+
+    it 'should deep_merge subhashes' do
+      hash = scope.function_deep_merge([{'one' => 1}, {'two' => 2, 'three' => { 'four' => 4 } }])
+      expect(hash['one']).to eq(1)
+      expect(hash['two']).to eq(2)
+      expect(hash['three']).to eq({ 'four' => 4 })
+    end
+
+    it 'should append to subhashes' do
+      hash = scope.function_deep_merge([{'one' => { 'two' => 2 } }, { 'one' => { 'three' => 3 } }])
+      expect(hash['one']).to eq({ 'two' => 2, 'three' => 3 })
+    end
+
+    it 'should append to subhashes 2' do
+      hash = scope.function_deep_merge([{'one' => 1, 'two' => 2, 'three' => { 'four' => 4 } }, {'two' => 'dos', 'three' => { 'five' => 5 } }])
+      expect(hash['one']).to eq(1)
+      expect(hash['two']).to eq('dos')
+      expect(hash['three']).to eq({ 'four' => 4, 'five' => 5 })
+    end
+
+    it 'should append to subhashes 3' do
+      hash = scope.function_deep_merge([{ 'key1' => { 'a' => 1, 'b' => 2 }, 'key2' => { 'c' => 3 } }, { 'key1' => { 'b' => 99 } }])
+      expect(hash['key1']).to eq({ 'a' => 1, 'b' => 99 })
+      expect(hash['key2']).to eq({ 'c' => 3 })
+    end
+
+    it 'should not change the original hashes' do
+      hash1 = {'one' => { 'two' => 2 } }
+      hash2 = { 'one' => { 'three' => 3 } }
+      hash = scope.function_deep_merge([hash1, hash2])
+      expect(hash1).to eq({'one' => { 'two' => 2 } })
+      expect(hash2).to eq({ 'one' => { 'three' => 3 } })
+      expect(hash['one']).to eq({ 'two' => 2, 'three' => 3 })
+    end
+
+    it 'should not change the original hashes 2' do
+      hash1 = {'one' => { 'two' => [1,2] } }
+      hash2 = { 'one' => { 'three' => 3 } }
+      hash = scope.function_deep_merge([hash1, hash2])
+      expect(hash1).to eq({'one' => { 'two' => [1,2] } })
+      expect(hash2).to eq({ 'one' => { 'three' => 3 } })
+      expect(hash['one']).to eq({ 'two' => [1,2], 'three' => 3 })
+    end
+
+    it 'should not change the original hashes 3' do
+      hash1 = {'one' => { 'two' => [1,2, {'two' => 2} ] } }
+      hash2 = { 'one' => { 'three' => 3 } }
+      hash = scope.function_deep_merge([hash1, hash2])
+      expect(hash1).to eq({'one' => { 'two' => [1,2, {'two' => 2}] } })
+      expect(hash2).to eq({ 'one' => { 'three' => 3 } })
+      expect(hash['one']).to eq({ 'two' => [1,2, {'two' => 2} ], 'three' => 3 })
+      expect(hash['one']['two']).to eq([1,2, {'two' => 2}])
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/defined_with_params_spec.rb b/puppet/modules/stdlib/spec/functions/defined_with_params_spec.rb
new file mode 100755
index 00000000..35903047
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/defined_with_params_spec.rb
@@ -0,0 +1,37 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+require 'rspec-puppet'
+describe 'defined_with_params' do
+  describe 'when a resource is not specified' do
+    it { is_expected.to run.with_params().and_raise_error(ArgumentError) }
+  end
+  describe 'when compared against a resource with no attributes' do
+    let :pre_condition do
+      'user { "dan": }'
+    end
+    it do
+      is_expected.to run.with_params('User[dan]', {}).and_return(true)
+      is_expected.to run.with_params('User[bob]', {}).and_return(false)
+      is_expected.to run.with_params('User[dan]', {'foo' => 'bar'}).and_return(false)
+    end
+  end
+
+  describe 'when compared against a resource with attributes' do
+    let :pre_condition do
+      'user { "dan": ensure => present, shell => "/bin/csh", managehome => false}'
+    end
+    it do
+      is_expected.to run.with_params('User[dan]', {}).and_return(true)
+      is_expected.to run.with_params('User[dan]', '').and_return(true)
+      is_expected.to run.with_params('User[dan]', {'ensure' => 'present'}
+                            ).and_return(true)
+      is_expected.to run.with_params('User[dan]',
+                             {'ensure' => 'present', 'managehome' => false}
+                            ).and_return(true)
+      is_expected.to run.with_params('User[dan]',
+                             {'ensure' => 'absent', 'managehome' => false}
+                            ).and_return(false)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/delete_at_spec.rb b/puppet/modules/stdlib/spec/functions/delete_at_spec.rb
new file mode 100755
index 00000000..7c20aec4
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/delete_at_spec.rb
@@ -0,0 +1,25 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the delete_at function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("delete_at")).to eq("function_delete_at")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_delete_at([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should delete an item at specified location from an array" do
+    result = scope.function_delete_at([['a','b','c'],1])
+    expect(result).to(eq(['a','c']))
+  end
+
+  it "should not change origin array passed as argument" do
+    origin_array = ['a','b','c','d']
+    result = scope.function_delete_at([origin_array, 1])
+    expect(origin_array).to(eq(['a','b','c','d']))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/delete_spec.rb b/puppet/modules/stdlib/spec/functions/delete_spec.rb
new file mode 100755
index 00000000..c8edd78e
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/delete_spec.rb
@@ -0,0 +1,61 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the delete function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("delete")).to eq("function_delete")
+  end
+
+  it "should raise a ParseError if there are fewer than 2 arguments" do
+    expect { scope.function_delete([]) }.to(raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if there are greater than 2 arguments" do
+    expect { scope.function_delete([[], 'foo', 'bar']) }.to(raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a TypeError if a number is passed as the first argument" do
+    expect { scope.function_delete([1, 'bar']) }.to(raise_error(TypeError))
+  end
+
+  it "should delete all instances of an element from an array" do
+    result = scope.function_delete([['a', 'b', 'c', 'b'], 'b'])
+    expect(result).to(eq(['a', 'c']))
+  end
+
+  it "should delete all instances of a substring from a string" do
+    result = scope.function_delete(['foobarbabarz', 'bar'])
+    expect(result).to(eq('foobaz'))
+  end
+
+  it "should delete a key from a hash" do
+    result = scope.function_delete([{'a' => 1, 'b' => 2, 'c' => 3}, 'b'])
+    expect(result).to(eq({'a' => 1, 'c' => 3}))
+  end
+
+  it 'should accept an array of items to delete' do
+    result = scope.function_delete([{'a' => 1, 'b' => 2, 'c' => 3}, ['b', 'c']])
+    expect(result).to(eq({'a' => 1}))
+  end
+
+  it "should not change origin array passed as argument" do
+    origin_array = ['a', 'b', 'c', 'd']
+    result = scope.function_delete([origin_array, 'b'])
+    expect(origin_array).to(eq(['a', 'b', 'c', 'd']))
+  end
+
+  it "should not change the origin string passed as argument" do
+    origin_string = 'foobarbabarz'
+    result = scope.function_delete([origin_string, 'bar'])
+    expect(origin_string).to(eq('foobarbabarz'))
+  end
+
+  it "should not change origin hash passed as argument" do
+    origin_hash = {'a' => 1, 'b' => 2, 'c' => 3}
+    result = scope.function_delete([origin_hash, 'b'])
+    expect(origin_hash).to(eq({'a' => 1, 'b' => 2, 'c' => 3}))
+  end
+
+end
diff --git a/puppet/modules/stdlib/spec/functions/delete_undef_values_spec.rb b/puppet/modules/stdlib/spec/functions/delete_undef_values_spec.rb
new file mode 100755
index 00000000..dc679535
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/delete_undef_values_spec.rb
@@ -0,0 +1,41 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the delete_undef_values function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("delete_undef_values")).to eq("function_delete_undef_values")
+  end
+
+  it "should raise a ParseError if there is less than 1 argument" do
+    expect { scope.function_delete_undef_values([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if the argument is not Array nor Hash" do
+    expect { scope.function_delete_undef_values(['']) }.to( raise_error(Puppet::ParseError))
+    expect { scope.function_delete_undef_values([nil]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should delete all undef items from Array and only these" do
+    result = scope.function_delete_undef_values([['a',:undef,'c','undef']])
+    expect(result).to(eq(['a','c','undef']))
+  end
+
+  it "should delete all undef items from Hash and only these" do
+    result = scope.function_delete_undef_values([{'a'=>'A','b'=>:undef,'c'=>'C','d'=>'undef'}])
+    expect(result).to(eq({'a'=>'A','c'=>'C','d'=>'undef'}))
+  end
+
+  it "should not change origin array passed as argument" do
+    origin_array = ['a',:undef,'c','undef']
+    result = scope.function_delete_undef_values([origin_array])
+    expect(origin_array).to(eq(['a',:undef,'c','undef']))
+  end
+
+  it "should not change origin hash passed as argument" do
+    origin_hash = { 'a' => 1, 'b' => :undef, 'c' => 'undef' }
+    result = scope.function_delete_undef_values([origin_hash])
+    expect(origin_hash).to(eq({ 'a' => 1, 'b' => :undef, 'c' => 'undef' }))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/delete_values_spec.rb b/puppet/modules/stdlib/spec/functions/delete_values_spec.rb
new file mode 100755
index 00000000..4f4d411b
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/delete_values_spec.rb
@@ -0,0 +1,36 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the delete_values function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("delete_values")).to eq("function_delete_values")
+  end
+
+  it "should raise a ParseError if there are fewer than 2 arguments" do
+    expect { scope.function_delete_values([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if there are greater than 2 arguments" do
+    expect { scope.function_delete_values([[], 'foo', 'bar']) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a TypeError if the argument is not a hash" do
+    expect { scope.function_delete_values([1,'bar']) }.to( raise_error(TypeError))
+    expect { scope.function_delete_values(['foo','bar']) }.to( raise_error(TypeError))
+    expect { scope.function_delete_values([[],'bar']) }.to( raise_error(TypeError))
+  end
+
+  it "should delete all instances of a value from a hash" do
+    result = scope.function_delete_values([{ 'a'=>'A', 'b'=>'B', 'B'=>'C', 'd'=>'B' },'B'])
+    expect(result).to(eq({ 'a'=>'A', 'B'=>'C' }))
+  end
+
+  it "should not change origin hash passed as argument" do
+    origin_hash = { 'a' => 1, 'b' => 2, 'c' => 3 }
+    result = scope.function_delete_values([origin_hash, 2])
+    expect(origin_hash).to(eq({ 'a' => 1, 'b' => 2, 'c' => 3 }))
+  end
+
+end
diff --git a/puppet/modules/stdlib/spec/functions/difference_spec.rb b/puppet/modules/stdlib/spec/functions/difference_spec.rb
new file mode 100755
index 00000000..24b2b1bc
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/difference_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the difference function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("difference")).to eq("function_difference")
+  end
+
+  it "should raise a ParseError if there are fewer than 2 arguments" do
+    expect { scope.function_difference([]) }.to( raise_error(Puppet::ParseError) )
+  end
+
+  it "should return the difference between two arrays" do
+    result = scope.function_difference([["a","b","c"],["b","c","d"]])
+    expect(result).to(eq(["a"]))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/dirname_spec.rb b/puppet/modules/stdlib/spec/functions/dirname_spec.rb
new file mode 100755
index 00000000..8a3bcabf
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/dirname_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the dirname function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("dirname")).to eq("function_dirname")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_dirname([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return dirname for an absolute path" do
+    result = scope.function_dirname(['/path/to/a/file.ext'])
+    expect(result).to(eq('/path/to/a'))
+  end
+
+  it "should return dirname for a relative path" do
+    result = scope.function_dirname(['path/to/a/file.ext'])
+    expect(result).to(eq('path/to/a'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/downcase_spec.rb b/puppet/modules/stdlib/spec/functions/downcase_spec.rb
new file mode 100755
index 00000000..edebc44f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/downcase_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the downcase function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("downcase")).to eq("function_downcase")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_downcase([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should downcase a string" do
+    result = scope.function_downcase(["ASFD"])
+    expect(result).to(eq("asfd"))
+  end
+
+  it "should do nothing to a string that is already downcase" do
+    result = scope.function_downcase(["asdf asdf"])
+    expect(result).to(eq("asdf asdf"))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new("ASFD")
+    result = scope.function_downcase([value])
+    result.should(eq('asfd'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/empty_spec.rb b/puppet/modules/stdlib/spec/functions/empty_spec.rb
new file mode 100755
index 00000000..6a97c4cd
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/empty_spec.rb
@@ -0,0 +1,32 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the empty function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("empty")).to eq("function_empty")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_empty([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return a true for an empty string" do
+    result = scope.function_empty([''])
+    expect(result).to(eq(true))
+  end
+
+  it "should return a false for a non-empty string" do
+    result = scope.function_empty(['asdf'])
+    expect(result).to(eq(false))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new()
+    result = scope.function_empty([value])
+    result.should(eq(true))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/ensure_packages_spec.rb b/puppet/modules/stdlib/spec/functions/ensure_packages_spec.rb
new file mode 100755
index 00000000..436be10b
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/ensure_packages_spec.rb
@@ -0,0 +1,81 @@
+#! /usr/bin/env ruby
+
+require 'spec_helper'
+require 'rspec-puppet'
+require 'puppet_spec/compiler'
+
+describe 'ensure_packages' do
+  include PuppetSpec::Compiler
+
+  before :each do
+    Puppet::Parser::Functions.autoloader.loadall
+    Puppet::Parser::Functions.function(:ensure_packages)
+    Puppet::Parser::Functions.function(:ensure_resource)
+    Puppet::Parser::Functions.function(:defined_with_params)
+    Puppet::Parser::Functions.function(:create_resources)
+  end
+
+  let :node     do Puppet::Node.new('localhost') end
+  let :compiler do Puppet::Parser::Compiler.new(node) end
+  let :scope    do
+    if Puppet.version.to_f >= 3.0
+      Puppet::Parser::Scope.new(compiler)
+    else
+      newscope = Puppet::Parser::Scope.new
+      newscope.compiler = compiler
+      newscope.source   = Puppet::Resource::Type.new(:node, :localhost)
+      newscope
+    end
+  end
+
+  describe 'argument handling' do
+    it 'fails with no arguments' do
+      expect {
+        scope.function_ensure_packages([])
+      }.to raise_error(Puppet::ParseError, /0 for 1 or 2/)
+    end
+
+    it 'accepts an array of values' do
+      scope.function_ensure_packages([['foo']])
+    end
+
+    it 'accepts a single package name as a string' do
+      scope.function_ensure_packages(['foo'])
+    end
+  end
+
+  context 'given a catalog with puppet package => absent' do
+    let :catalog do
+      compile_to_catalog(<<-EOS
+        ensure_packages(['facter'])
+        package { puppet: ensure => absent }
+      EOS
+      )
+    end
+
+    it 'has no effect on Package[puppet]' do
+      expect(catalog.resource(:package, 'puppet')['ensure']).to eq('absent')
+    end
+  end
+
+  context 'given a clean catalog' do
+    let :catalog do
+      compile_to_catalog('ensure_packages(["facter"])')
+    end
+
+    it 'declares package resources with ensure => present' do
+      expect(catalog.resource(:package, 'facter')['ensure']).to eq('present')
+    end
+  end
+
+  context 'given a clean catalog and specified defaults' do
+    let :catalog do
+      compile_to_catalog('ensure_packages(["facter"], {"provider" => "gem"})')
+    end
+
+    it 'declares package resources with ensure => present' do
+      expect(catalog.resource(:package, 'facter')['ensure']).to eq('present')
+      expect(catalog.resource(:package, 'facter')['provider']).to eq('gem')
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/ensure_resource_spec.rb b/puppet/modules/stdlib/spec/functions/ensure_resource_spec.rb
new file mode 100755
index 00000000..33bcac0d
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/ensure_resource_spec.rb
@@ -0,0 +1,113 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'rspec-puppet'
+require 'puppet_spec/compiler'
+
+describe 'ensure_resource' do
+  include PuppetSpec::Compiler
+
+  before :all do
+    Puppet::Parser::Functions.autoloader.loadall
+    Puppet::Parser::Functions.function(:ensure_packages)
+  end
+
+  let :node     do Puppet::Node.new('localhost') end
+  let :compiler do Puppet::Parser::Compiler.new(node) end
+  let :scope    do Puppet::Parser::Scope.new(compiler) end
+
+  describe 'when a type or title is not specified' do
+    it { expect { scope.function_ensure_resource([]) }.to raise_error }
+    it { expect { scope.function_ensure_resource(['type']) }.to raise_error }
+  end
+
+  describe 'when compared against a resource with no attributes' do
+    let :catalog do
+      compile_to_catalog(<<-EOS
+        user { "dan": }
+        ensure_resource('user', 'dan', {})
+      EOS
+      )
+    end
+
+    it 'should contain the the ensured resources' do
+      expect(catalog.resource(:user, 'dan').to_s).to eq('User[dan]')
+    end
+  end
+
+  describe 'works when compared against a resource with non-conflicting attributes' do
+    [
+      "ensure_resource('User', 'dan', {})",
+      "ensure_resource('User', 'dan', '')",
+      "ensure_resource('User', 'dan', {'ensure' => 'present'})",
+      "ensure_resource('User', 'dan', {'ensure' => 'present', 'managehome' => false})"
+    ].each do |ensure_resource|
+      pp = <<-EOS
+        user { "dan": ensure => present, shell => "/bin/csh", managehome => false}
+        #{ensure_resource}
+      EOS
+
+      it { expect { compile_to_catalog(pp) }.to_not raise_error }
+    end
+  end
+
+  describe 'fails when compared against a resource with conflicting attributes' do
+    pp = <<-EOS
+      user { "dan": ensure => present, shell => "/bin/csh", managehome => false}
+      ensure_resource('User', 'dan', {'ensure' => 'absent', 'managehome' => false})
+    EOS
+
+    it { expect { compile_to_catalog(pp) }.to raise_error }
+  end
+
+  describe 'when an array of new resources are passed in' do
+    let :catalog do
+      compile_to_catalog("ensure_resource('User', ['dan', 'alex'], {})")
+    end
+
+    it 'should contain the ensured resources' do
+      expect(catalog.resource('User[dan]').to_s).to eq('User[dan]')
+      expect(catalog.resource('User[alex]').to_s).to eq('User[alex]')
+    end
+  end
+
+  describe 'when an array of existing resources is compared against existing resources' do
+    pp = <<-EOS
+      user { 'dan': ensure => present; 'alex': ensure => present }
+      ensure_resource('User', ['dan', 'alex'], {})
+    EOS
+
+    let :catalog do
+      compile_to_catalog(pp)
+    end
+
+    it 'should return the existing resources' do
+      expect(catalog.resource('User[dan]').to_s).to eq('User[dan]')
+      expect(catalog.resource('User[alex]').to_s).to eq('User[alex]')
+    end
+  end
+
+  describe 'works when compared against existing resources with attributes' do
+    [
+      "ensure_resource('User', ['dan', 'alex'], {})",
+      "ensure_resource('User', ['dan', 'alex'], '')",
+      "ensure_resource('User', ['dan', 'alex'], {'ensure' => 'present'})",
+    ].each do |ensure_resource|
+      pp = <<-EOS
+        user { 'dan': ensure => present; 'alex': ensure => present }
+        #{ensure_resource}
+      EOS
+
+      it { expect { compile_to_catalog(pp) }.to_not raise_error }
+    end
+  end
+
+  describe 'fails when compared against existing resources with conflicting attributes' do
+    pp = <<-EOS
+      user { 'dan': ensure => present; 'alex': ensure => present }
+      ensure_resource('User', ['dan', 'alex'], {'ensure' => 'absent'})
+    EOS
+
+    it { expect { compile_to_catalog(pp) }.to raise_error }
+  end
+
+end
diff --git a/puppet/modules/stdlib/spec/functions/flatten_spec.rb b/puppet/modules/stdlib/spec/functions/flatten_spec.rb
new file mode 100755
index 00000000..de8c66d6
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/flatten_spec.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the flatten function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("flatten")).to eq("function_flatten")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_flatten([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if there is more than 1 argument" do
+    expect { scope.function_flatten([[], []]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should flatten a complex data structure" do
+    result = scope.function_flatten([["a","b",["c",["d","e"],"f","g"]]])
+    expect(result).to(eq(["a","b","c","d","e","f","g"]))
+  end
+
+  it "should do nothing to a structure that is already flat" do
+    result = scope.function_flatten([["a","b","c","d"]])
+    expect(result).to(eq(["a","b","c","d"]))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/floor_spec.rb b/puppet/modules/stdlib/spec/functions/floor_spec.rb
new file mode 100755
index 00000000..12a69179
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/floor_spec.rb
@@ -0,0 +1,39 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe "the floor function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("floor")).to eq("function_floor")
+  end
+
+  it "should raise a ParseError if there is less than 1 argument" do
+    expect { scope.function_floor([]) }.to( raise_error(Puppet::ParseError, /Wrong number of arguments/))
+  end
+
+  it "should should raise a ParseError if input isn't numeric (eg. String)" do
+    expect { scope.function_floor(["foo"]) }.to( raise_error(Puppet::ParseError, /Wrong argument type/))
+  end
+
+  it "should should raise a ParseError if input isn't numeric (eg. Boolean)" do
+    expect { scope.function_floor([true]) }.to( raise_error(Puppet::ParseError, /Wrong argument type/))
+  end
+
+  it "should return an integer when a numeric type is passed" do
+    result = scope.function_floor([12.4])
+    expect(result.is_a?(Integer)).to(eq(true))
+  end
+
+  it "should return the input when an integer is passed" do
+    result = scope.function_floor([7])
+    expect(result).to(eq(7))
+  end
+
+  it "should return the largest integer less than or equal to the input" do
+    result = scope.function_floor([3.8])
+    expect(result).to(eq(3))
+  end
+end
+
diff --git a/puppet/modules/stdlib/spec/functions/fqdn_rotate_spec.rb b/puppet/modules/stdlib/spec/functions/fqdn_rotate_spec.rb
new file mode 100755
index 00000000..40057d4f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/fqdn_rotate_spec.rb
@@ -0,0 +1,43 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the fqdn_rotate function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("fqdn_rotate")).to eq("function_fqdn_rotate")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_fqdn_rotate([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should rotate a string and the result should be the same size" do
+    scope.expects(:lookupvar).with("::fqdn").returns("127.0.0.1")
+    result = scope.function_fqdn_rotate(["asdf"])
+    expect(result.size).to(eq(4))
+  end
+
+  it "should rotate a string to give the same results for one host" do
+    scope.expects(:lookupvar).with("::fqdn").returns("127.0.0.1").twice
+    expect(scope.function_fqdn_rotate(["abcdefg"])).to eql(scope.function_fqdn_rotate(["abcdefg"]))
+  end
+
+  it "should rotate a string to give different values on different hosts" do
+     scope.expects(:lookupvar).with("::fqdn").returns("127.0.0.1")
+     val1 = scope.function_fqdn_rotate(["abcdefghijklmnopqrstuvwxyz01234567890987654321"])
+     scope.expects(:lookupvar).with("::fqdn").returns("127.0.0.2")
+     val2 = scope.function_fqdn_rotate(["abcdefghijklmnopqrstuvwxyz01234567890987654321"])
+     expect(val1).not_to eql(val2)
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    scope.expects(:lookupvar).with("::fqdn").returns("127.0.0.1")
+    value = AlsoString.new("asdf")
+    result = scope.function_fqdn_rotate([value])
+    result.size.should(eq(4))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/get_module_path_spec.rb b/puppet/modules/stdlib/spec/functions/get_module_path_spec.rb
new file mode 100755
index 00000000..38ce6459
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/get_module_path_spec.rb
@@ -0,0 +1,46 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:get_module_path) do
+  Internals = PuppetlabsSpec::PuppetInternals
+  class StubModule
+    attr_reader :path
+    def initialize(path)
+      @path = path
+    end
+  end
+
+  def scope(environment = "production")
+    Internals.scope(:compiler => Internals.compiler(:node => Internals.node(:environment => environment)))
+  end
+
+  it 'should only allow one argument' do
+    expect { scope.function_get_module_path([]) }.to raise_error(Puppet::ParseError, /Wrong number of arguments, expects one/)
+    expect { scope.function_get_module_path(['1','2','3']) }.to raise_error(Puppet::ParseError, /Wrong number of arguments, expects one/)
+  end
+  it 'should raise an exception when the module cannot be found' do
+    expect { scope.function_get_module_path(['foo']) }.to raise_error(Puppet::ParseError, /Could not find module/)
+  end
+  describe 'when locating a module' do
+    let(:modulepath) { "/tmp/does_not_exist" }
+    let(:path_of_module_foo) { StubModule.new("/tmp/does_not_exist/foo") }
+
+    before(:each) { Puppet[:modulepath] = modulepath }
+
+    it 'should be able to find module paths from the modulepath setting' do
+      Puppet::Module.expects(:find).with('foo', 'production').returns(path_of_module_foo)
+      expect(scope.function_get_module_path(['foo'])).to eq(path_of_module_foo.path)
+    end
+    it 'should be able to find module paths when the modulepath is a list' do
+      Puppet[:modulepath] = modulepath + ":/tmp"
+      Puppet::Module.expects(:find).with('foo', 'production').returns(path_of_module_foo)
+      expect(scope.function_get_module_path(['foo'])).to eq(path_of_module_foo.path)
+    end
+    it 'should respect the environment' do
+      skip("Disabled on Puppet 2.6.x") if Puppet.version =~ /^2\.6\b/
+      Puppet.settings[:environment] = 'danstestenv'
+      Puppet::Module.expects(:find).with('foo', 'danstestenv').returns(path_of_module_foo)
+      expect(scope('danstestenv').function_get_module_path(['foo'])).to eq(path_of_module_foo.path)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/getparam_spec.rb b/puppet/modules/stdlib/spec/functions/getparam_spec.rb
new file mode 100755
index 00000000..833c4d4f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/getparam_spec.rb
@@ -0,0 +1,76 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'rspec-puppet'
+require 'puppet_spec/compiler'
+
+describe 'getparam' do
+  include PuppetSpec::Compiler
+
+  before :each do
+    Puppet::Parser::Functions.autoloader.loadall
+    Puppet::Parser::Functions.function(:getparam)
+  end
+
+  let :node     do Puppet::Node.new('localhost') end
+  let :compiler do Puppet::Parser::Compiler.new(node) end
+  if Puppet.version.to_f >= 3.0
+    let :scope    do Puppet::Parser::Scope.new(compiler) end
+  else
+    let :scope    do
+      newscope = Puppet::Parser::Scope.new
+      newscope.compiler = compiler
+      newscope.source   = Puppet::Resource::Type.new(:node, :localhost)
+      newscope
+    end
+  end
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("getparam")).to eq("function_getparam")
+  end
+
+  describe 'when a resource is not specified' do
+    it { expect { scope.function_getparam([]) }.to raise_error }
+    it { expect { scope.function_getparam(['User[dan]']) }.to raise_error }
+    it { expect { scope.function_getparam(['User[dan]']) }.to raise_error }
+    it { expect { scope.function_getparam(['User[dan]', {}]) }.to raise_error }
+    # This seems to be OK because we just check for a string.
+    it { expect { scope.function_getparam(['User[dan]', '']) }.to_not raise_error }
+  end
+
+  describe 'when compared against a resource with no params' do
+    let :catalog do
+      compile_to_catalog(<<-EOS
+        user { "dan": }
+      EOS
+      )
+    end
+
+    it do
+      expect(scope.function_getparam(['User[dan]', 'shell'])).to eq('')
+    end
+  end
+
+  describe 'when compared against a resource with params' do
+    let :catalog do
+      compile_to_catalog(<<-EOS
+        user { 'dan': ensure => present, shell => '/bin/sh', managehome => false}
+        $test = getparam(User[dan], 'shell')
+      EOS
+      )
+    end
+
+    it do
+      resource = Puppet::Parser::Resource.new(:user, 'dan', {:scope => scope})
+      resource.set_parameter('ensure', 'present')
+      resource.set_parameter('shell', '/bin/sh')
+      resource.set_parameter('managehome', false)
+      compiler.add_resource(scope, resource)
+
+      expect(scope.function_getparam(['User[dan]', 'shell'])).to eq('/bin/sh')
+      expect(scope.function_getparam(['User[dan]', ''])).to eq('')
+      expect(scope.function_getparam(['User[dan]', 'ensure'])).to eq('present')
+      # TODO: Expected this to be false, figure out why we're getting '' back.
+      expect(scope.function_getparam(['User[dan]', 'managehome'])).to eq('')
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/getvar_spec.rb b/puppet/modules/stdlib/spec/functions/getvar_spec.rb
new file mode 100755
index 00000000..87ab9b5a
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/getvar_spec.rb
@@ -0,0 +1,37 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:getvar) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+  describe 'when calling getvar from puppet' do
+
+    it "should not compile when no arguments are passed" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = '$foo = getvar()'
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+
+    it "should not compile when too many arguments are passed" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = '$foo = getvar("foo::bar", "baz")'
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+
+    it "should lookup variables in other namespaces" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        class site::data { $foo = 'baz' }
+        include site::data
+        $foo = getvar("site::data::foo")
+        if $foo != 'baz' {
+          fail('getvar did not return what we expect')
+        }
+      ENDofPUPPETcode
+      scope.compiler.compile
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/grep_spec.rb b/puppet/modules/stdlib/spec/functions/grep_spec.rb
new file mode 100755
index 00000000..9c671dd8
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/grep_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the grep function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("grep")).to eq("function_grep")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_grep([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should grep contents from an array" do
+    result = scope.function_grep([["aaabbb","bbbccc","dddeee"], "bbb"])
+    expect(result).to(eq(["aaabbb","bbbccc"]))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/has_interface_with_spec.rb b/puppet/modules/stdlib/spec/functions/has_interface_with_spec.rb
new file mode 100755
index 00000000..23e09a95
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/has_interface_with_spec.rb
@@ -0,0 +1,64 @@
+#!/usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:has_interface_with) do
+
+  let(:scope) do
+    PuppetlabsSpec::PuppetInternals.scope
+  end
+
+  # The subject of these examples is the method itself.
+  subject do
+    function_name = Puppet::Parser::Functions.function(:has_interface_with)
+    scope.method(function_name)
+  end
+
+  # We need to mock out the Facts so we can specify how we expect this function
+  # to behave on different platforms.
+  context "On Mac OS X Systems" do
+    before :each do
+      scope.stubs(:lookupvar).with("interfaces").returns('lo0,gif0,stf0,en1,p2p0,fw0,en0,vmnet1,vmnet8,utun0')
+    end
+    it 'should have loopback (lo0)' do
+      expect(subject.call(['lo0'])).to be_truthy
+    end
+    it 'should not have loopback (lo)' do
+      expect(subject.call(['lo'])).to be_falsey
+    end
+  end
+  context "On Linux Systems" do
+    before :each do
+      scope.stubs(:lookupvar).with("interfaces").returns('eth0,lo')
+      scope.stubs(:lookupvar).with("ipaddress").returns('10.0.0.1')
+      scope.stubs(:lookupvar).with("ipaddress_lo").returns('127.0.0.1')
+      scope.stubs(:lookupvar).with("ipaddress_eth0").returns('10.0.0.1')
+      scope.stubs(:lookupvar).with('muppet').returns('kermit')
+      scope.stubs(:lookupvar).with('muppet_lo').returns('mspiggy')
+      scope.stubs(:lookupvar).with('muppet_eth0').returns('kermit')
+    end
+    it 'should have loopback (lo)' do
+      expect(subject.call(['lo'])).to be_truthy
+    end
+    it 'should not have loopback (lo0)' do
+      expect(subject.call(['lo0'])).to be_falsey
+    end
+    it 'should have ipaddress with 127.0.0.1' do
+      expect(subject.call(['ipaddress', '127.0.0.1'])).to be_truthy
+    end
+    it 'should have ipaddress with 10.0.0.1' do
+      expect(subject.call(['ipaddress', '10.0.0.1'])).to be_truthy
+    end
+    it 'should not have ipaddress with 10.0.0.2' do
+      expect(subject.call(['ipaddress', '10.0.0.2'])).to be_falsey
+    end
+    it 'should have muppet named kermit' do
+      expect(subject.call(['muppet', 'kermit'])).to be_truthy
+    end
+    it 'should have muppet named mspiggy' do
+      expect(subject.call(['muppet', 'mspiggy'])).to be_truthy
+    end
+    it 'should not have muppet named bigbird' do
+      expect(subject.call(['muppet', 'bigbird'])).to be_falsey
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/has_ip_address_spec.rb b/puppet/modules/stdlib/spec/functions/has_ip_address_spec.rb
new file mode 100755
index 00000000..0df12a7b
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/has_ip_address_spec.rb
@@ -0,0 +1,39 @@
+#!/usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:has_ip_address) do
+
+  let(:scope) do
+    PuppetlabsSpec::PuppetInternals.scope
+  end
+
+  subject do
+    function_name = Puppet::Parser::Functions.function(:has_ip_address)
+    scope.method(function_name)
+  end
+
+  context "On Linux Systems" do
+    before :each do
+      scope.stubs(:lookupvar).with('interfaces').returns('eth0,lo')
+      scope.stubs(:lookupvar).with('ipaddress').returns('10.0.2.15')
+      scope.stubs(:lookupvar).with('ipaddress_eth0').returns('10.0.2.15')
+      scope.stubs(:lookupvar).with('ipaddress_lo').returns('127.0.0.1')
+    end
+
+    it 'should have primary address (10.0.2.15)' do
+      expect(subject.call(['10.0.2.15'])).to be_truthy
+    end
+
+    it 'should have lookupback address (127.0.0.1)' do
+      expect(subject.call(['127.0.0.1'])).to be_truthy
+    end
+
+    it 'should not have other address' do
+      expect(subject.call(['192.1681.1.1'])).to be_falsey
+    end
+
+    it 'should not have "mspiggy" on an interface' do
+      expect(subject.call(['mspiggy'])).to be_falsey
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/has_ip_network_spec.rb b/puppet/modules/stdlib/spec/functions/has_ip_network_spec.rb
new file mode 100755
index 00000000..2a2578e2
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/has_ip_network_spec.rb
@@ -0,0 +1,36 @@
+#!/usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:has_ip_network) do
+
+  let(:scope) do
+    PuppetlabsSpec::PuppetInternals.scope
+  end
+
+  subject do
+    function_name = Puppet::Parser::Functions.function(:has_ip_network)
+    scope.method(function_name)
+  end
+
+  context "On Linux Systems" do
+    before :each do
+      scope.stubs(:lookupvar).with('interfaces').returns('eth0,lo')
+      scope.stubs(:lookupvar).with('network').returns(:undefined)
+      scope.stubs(:lookupvar).with('network_eth0').returns('10.0.2.0')
+      scope.stubs(:lookupvar).with('network_lo').returns('127.0.0.1')
+    end
+
+    it 'should have primary network (10.0.2.0)' do
+      expect(subject.call(['10.0.2.0'])).to be_truthy
+    end
+
+    it 'should have loopback network (127.0.0.0)' do
+      expect(subject.call(['127.0.0.1'])).to be_truthy
+    end
+
+    it 'should not have other network' do
+      expect(subject.call(['192.168.1.0'])).to be_falsey
+    end
+  end
+end
+
diff --git a/puppet/modules/stdlib/spec/functions/has_key_spec.rb b/puppet/modules/stdlib/spec/functions/has_key_spec.rb
new file mode 100755
index 00000000..6b718005
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/has_key_spec.rb
@@ -0,0 +1,42 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:has_key) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  describe 'when calling has_key from puppet' do
+    it "should not compile when no arguments are passed" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = '$x = has_key()'
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+
+    it "should not compile when 1 argument is passed" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = "$x = has_key('foo')"
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+
+    it "should require the first value to be a Hash" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = "$x = has_key('foo', 'bar')"
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /expects the first argument to be a hash/)
+    end
+  end
+
+  describe 'when calling the function has_key from a scope instance' do
+    it 'should detect existing keys' do
+      expect(scope.function_has_key([{'one' => 1}, 'one'])).to be_truthy
+    end
+
+    it 'should detect existing keys' do
+      expect(scope.function_has_key([{'one' => 1}, 'two'])).to be_falsey
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/hash_spec.rb b/puppet/modules/stdlib/spec/functions/hash_spec.rb
new file mode 100755
index 00000000..ec2988b0
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/hash_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the hash function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("hash")).to eq("function_hash")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_hash([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should convert an array to a hash" do
+    result = scope.function_hash([['a',1,'b',2,'c',3]])
+    expect(result).to(eq({'a'=>1,'b'=>2,'c'=>3}))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/intersection_spec.rb b/puppet/modules/stdlib/spec/functions/intersection_spec.rb
new file mode 100755
index 00000000..6361304f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/intersection_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the intersection function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("intersection")).to eq("function_intersection")
+  end
+
+  it "should raise a ParseError if there are fewer than 2 arguments" do
+    expect { scope.function_intersection([]) }.to( raise_error(Puppet::ParseError) )
+  end
+
+  it "should return the intersection of two arrays" do
+    result = scope.function_intersection([["a","b","c"],["b","c","d"]])
+    expect(result).to(eq(["b","c"]))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_array_spec.rb b/puppet/modules/stdlib/spec/functions/is_array_spec.rb
new file mode 100755
index 00000000..94920a4c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_array_spec.rb
@@ -0,0 +1,29 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_array function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_array")).to eq("function_is_array")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_array([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if passed an array" do
+    result = scope.function_is_array([[1,2,3]])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if passed a hash" do
+    result = scope.function_is_array([{'a'=>1}])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if passed a string" do
+    result = scope.function_is_array(["asdf"])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_bool_spec.rb b/puppet/modules/stdlib/spec/functions/is_bool_spec.rb
new file mode 100755
index 00000000..4a342ba4
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_bool_spec.rb
@@ -0,0 +1,44 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_bool function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_bool")).to eq("function_is_bool")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_bool([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if passed a TrueClass" do
+    result = scope.function_is_bool([true])
+    expect(result).to(eq(true))
+  end
+
+  it "should return true if passed a FalseClass" do
+    result = scope.function_is_bool([false])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if passed the string 'true'" do
+    result = scope.function_is_bool(['true'])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if passed the string 'false'" do
+    result = scope.function_is_bool(['false'])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if passed an array" do
+    result = scope.function_is_bool([["a","b"]])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if passed a hash" do
+    result = scope.function_is_bool([{"a" => "b"}])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_domain_name_spec.rb b/puppet/modules/stdlib/spec/functions/is_domain_name_spec.rb
new file mode 100755
index 00000000..4d05f5cd
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_domain_name_spec.rb
@@ -0,0 +1,64 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_domain_name function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_domain_name")).to eq("function_is_domain_name")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_domain_name([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if a valid short domain name" do
+    result = scope.function_is_domain_name(["x.com"])
+    expect(result).to(be_truthy)
+  end
+
+  it "should return true if the domain is ." do
+    result = scope.function_is_domain_name(["."])
+    expect(result).to(be_truthy)
+  end
+
+  it "should return true if the domain is x.com." do
+    result = scope.function_is_domain_name(["x.com."])
+    expect(result).to(be_truthy)
+  end
+
+  it "should return true if a valid domain name" do
+    result = scope.function_is_domain_name(["foo.bar.com"])
+    expect(result).to(be_truthy)
+  end
+
+  it "should allow domain parts to start with numbers" do
+    result = scope.function_is_domain_name(["3foo.2bar.com"])
+    expect(result).to(be_truthy)
+  end
+
+  it "should allow domain to end with a dot" do
+    result = scope.function_is_domain_name(["3foo.2bar.com."])
+    expect(result).to(be_truthy)
+  end
+
+  it "should allow a single part domain" do
+    result = scope.function_is_domain_name(["orange"])
+    expect(result).to(be_truthy)
+  end
+
+  it "should return false if domain parts start with hyphens" do
+    result = scope.function_is_domain_name(["-3foo.2bar.com"])
+    expect(result).to(be_falsey)
+  end
+
+  it "should return true if domain contains hyphens" do
+    result = scope.function_is_domain_name(["3foo-bar.2bar-fuzz.com"])
+    expect(result).to(be_truthy)
+  end
+
+  it "should return false if domain name contains spaces" do
+    result = scope.function_is_domain_name(["not valid"])
+    expect(result).to(be_falsey)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_float_spec.rb b/puppet/modules/stdlib/spec/functions/is_float_spec.rb
new file mode 100755
index 00000000..d926634e
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_float_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_float function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_float")).to eq("function_is_float")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_float([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if a float" do
+    result = scope.function_is_float(["0.12"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if a string" do
+    result = scope.function_is_float(["asdf"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if an integer" do
+    result = scope.function_is_float(["3"])
+    expect(result).to(eq(false))
+  end
+  it "should return true if a float is created from an arithmetical operation" do
+    result = scope.function_is_float([3.2*2])
+    expect(result).to(eq(true))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_function_available.rb b/puppet/modules/stdlib/spec/functions/is_function_available.rb
new file mode 100755
index 00000000..3a9aa1b2
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_function_available.rb
@@ -0,0 +1,31 @@
+#!/usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_function_available function" do
+  before :all do
+    Puppet::Parser::Functions.autoloader.loadall
+  end
+
+  before :each do
+    @scope = Puppet::Parser::Scope.new
+  end
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_function_available")).to eq("function_is_function_available")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { @scope.function_is_function_available([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return false if a nonexistent function is passed" do
+    result = @scope.function_is_function_available(['jeff_mccunes_left_sock'])
+    expect(result).to(eq(false))
+  end
+
+  it "should return true if an available function is passed" do
+    result = @scope.function_is_function_available(['require'])
+    expect(result).to(eq(true))
+  end
+
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_hash_spec.rb b/puppet/modules/stdlib/spec/functions/is_hash_spec.rb
new file mode 100755
index 00000000..a8494111
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_hash_spec.rb
@@ -0,0 +1,29 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_hash function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_hash")).to eq("function_is_hash")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_hash([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if passed a hash" do
+    result = scope.function_is_hash([{"a"=>1,"b"=>2}])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if passed an array" do
+    result = scope.function_is_hash([["a","b"]])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if passed a string" do
+    result = scope.function_is_hash(["asdf"])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_integer_spec.rb b/puppet/modules/stdlib/spec/functions/is_integer_spec.rb
new file mode 100755
index 00000000..f0cbca80
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_integer_spec.rb
@@ -0,0 +1,69 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_integer function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_integer")).to eq("function_is_integer")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_integer([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if an integer" do
+    result = scope.function_is_integer(["3"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return true if a negative integer" do
+    result = scope.function_is_integer(["-7"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if a float" do
+    result = scope.function_is_integer(["3.2"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if a string" do
+    result = scope.function_is_integer(["asdf"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return true if an integer is created from an arithmetical operation" do
+    result = scope.function_is_integer([3*2])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if an array" do
+    result = scope.function_is_numeric([["asdf"]])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if a hash" do
+    result = scope.function_is_numeric([{"asdf" => false}])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if a boolean" do
+    result = scope.function_is_numeric([true])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if a whitespace is in the string" do
+    result = scope.function_is_numeric([" -1324"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if it is zero prefixed" do
+    result = scope.function_is_numeric(["0001234"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if it is wrapped inside an array" do
+    result = scope.function_is_numeric([[1234]])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_ip_address_spec.rb b/puppet/modules/stdlib/spec/functions/is_ip_address_spec.rb
new file mode 100755
index 00000000..c16d12b1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_ip_address_spec.rb
@@ -0,0 +1,39 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_ip_address function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_ip_address")).to eq("function_is_ip_address")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_ip_address([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if an IPv4 address" do
+    result = scope.function_is_ip_address(["1.2.3.4"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return true if a full IPv6 address" do
+    result = scope.function_is_ip_address(["fe80:0000:cd12:d123:e2f8:47ff:fe09:dd74"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return true if a compressed IPv6 address" do
+    result = scope.function_is_ip_address(["fe00::1"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if not valid" do
+    result = scope.function_is_ip_address(["asdf"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if IP octets out of range" do
+    result = scope.function_is_ip_address(["1.1.1.300"])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_mac_address_spec.rb b/puppet/modules/stdlib/spec/functions/is_mac_address_spec.rb
new file mode 100755
index 00000000..66edd197
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_mac_address_spec.rb
@@ -0,0 +1,29 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_mac_address function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_mac_address")).to eq("function_is_mac_address")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_mac_address([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if a valid mac address" do
+    result = scope.function_is_mac_address(["00:a0:1f:12:7f:a0"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if octets are out of range" do
+    result = scope.function_is_mac_address(["00:a0:1f:12:7f:g0"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if not valid" do
+    result = scope.function_is_mac_address(["not valid"])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_numeric_spec.rb b/puppet/modules/stdlib/spec/functions/is_numeric_spec.rb
new file mode 100755
index 00000000..4176961d
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_numeric_spec.rb
@@ -0,0 +1,119 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_numeric function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_numeric")).to eq("function_is_numeric")
+  end
+
+  it "should raise a ParseError if there is less than 1 argument" do
+    expect { scope.function_is_numeric([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if an integer" do
+    result = scope.function_is_numeric(["3"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return true if a float" do
+    result = scope.function_is_numeric(["3.2"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return true if an integer is created from an arithmetical operation" do
+    result = scope.function_is_numeric([3*2])
+    expect(result).to(eq(true))
+  end
+
+  it "should return true if a float is created from an arithmetical operation" do
+    result = scope.function_is_numeric([3.2*2])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if a string" do
+    result = scope.function_is_numeric(["asdf"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if an array" do
+    result = scope.function_is_numeric([["asdf"]])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if an array of integers" do
+    result = scope.function_is_numeric([[1,2,3,4]])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if a hash" do
+    result = scope.function_is_numeric([{"asdf" => false}])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if a hash with numbers in it" do
+    result = scope.function_is_numeric([{1 => 2}])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if a boolean" do
+    result = scope.function_is_numeric([true])
+    expect(result).to(eq(false))
+  end
+
+  it "should return true if a negative float with exponent" do
+    result = scope.function_is_numeric(["-342.2315e-12"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if a negative integer with whitespaces before/after the dash" do
+    result = scope.function_is_numeric([" -  751"])
+    expect(result).to(eq(false))
+  end
+
+#  it "should return true if a hexadecimal" do
+#    result = scope.function_is_numeric(["0x52F8c"])
+#    result.should(eq(true))
+#  end
+#
+#  it "should return true if a hexadecimal with uppercase 0X prefix" do
+#    result = scope.function_is_numeric(["0X52F8c"])
+#    result.should(eq(true))
+#  end
+#
+#  it "should return false if a hexadecimal without a prefix" do
+#    result = scope.function_is_numeric(["52F8c"])
+#    result.should(eq(false))
+#  end
+#
+#  it "should return true if a octal" do
+#    result = scope.function_is_numeric(["0751"])
+#    result.should(eq(true))
+#  end
+#
+#  it "should return true if a negative hexadecimal" do
+#    result = scope.function_is_numeric(["-0x52F8c"])
+#    result.should(eq(true))
+#  end
+#
+#  it "should return true if a negative octal" do
+#    result = scope.function_is_numeric(["-0751"])
+#    result.should(eq(true))
+#  end
+#
+#  it "should return false if a negative octal with whitespaces before/after the dash" do
+#    result = scope.function_is_numeric([" -  0751"])
+#    result.should(eq(false))
+#  end
+#
+#  it "should return false if a bad hexadecimal" do
+#    result = scope.function_is_numeric(["0x23d7g"])
+#    result.should(eq(false))
+#  end
+#
+#  it "should return false if a bad octal" do
+#    result = scope.function_is_numeric(["0287"])
+#    result.should(eq(false))
+#  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/is_string_spec.rb b/puppet/modules/stdlib/spec/functions/is_string_spec.rb
new file mode 100755
index 00000000..6a0801ae
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/is_string_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the is_string function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("is_string")).to eq("function_is_string")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_is_string([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if a string" do
+    result = scope.function_is_string(["asdf"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if an integer" do
+    result = scope.function_is_string(["3"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if a float" do
+    result = scope.function_is_string(["3.23"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return false if an array" do
+    result = scope.function_is_string([["a","b","c"]])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/join_keys_to_values_spec.rb b/puppet/modules/stdlib/spec/functions/join_keys_to_values_spec.rb
new file mode 100755
index 00000000..4a9ae87a
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/join_keys_to_values_spec.rb
@@ -0,0 +1,40 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the join_keys_to_values function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("join_keys_to_values")).to eq("function_join_keys_to_values")
+  end
+
+  it "should raise a ParseError if there are fewer than two arguments" do
+    expect { scope.function_join_keys_to_values([{}]) }.to raise_error Puppet::ParseError
+  end
+
+  it "should raise a ParseError if there are greater than two arguments" do
+    expect { scope.function_join_keys_to_values([{}, 'foo', 'bar']) }.to raise_error Puppet::ParseError
+  end
+
+  it "should raise a TypeError if the first argument is an array" do
+    expect { scope.function_join_keys_to_values([[1,2], ',']) }.to raise_error TypeError
+  end
+
+  it "should raise a TypeError if the second argument is an array" do
+    expect { scope.function_join_keys_to_values([{}, [1,2]]) }.to raise_error TypeError
+  end
+
+  it "should raise a TypeError if the second argument is a number" do
+    expect { scope.function_join_keys_to_values([{}, 1]) }.to raise_error TypeError
+  end
+
+  it "should return an empty array given an empty hash" do
+    result = scope.function_join_keys_to_values([{}, ":"])
+    expect(result).to eq([])
+  end
+
+  it "should join hash's keys to its values" do
+    result = scope.function_join_keys_to_values([{'a'=>1,2=>'foo',:b=>nil}, ":"])
+    expect(result).to match_array(['a:1','2:foo','b:'])
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/join_spec.rb b/puppet/modules/stdlib/spec/functions/join_spec.rb
new file mode 100755
index 00000000..793c36fa
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/join_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the join function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("join")).to eq("function_join")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_join([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should join an array into a string" do
+    result = scope.function_join([["a","b","c"], ":"])
+    expect(result).to(eq("a:b:c"))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/keys_spec.rb b/puppet/modules/stdlib/spec/functions/keys_spec.rb
new file mode 100755
index 00000000..f2e7d428
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/keys_spec.rb
@@ -0,0 +1,21 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the keys function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("keys")).to eq("function_keys")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_keys([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return an array of keys when given a hash" do
+    result = scope.function_keys([{'a'=>1, 'b'=>2}])
+    # =~ performs 'array with same elements' (set) matching
+    # For more info see RSpec::Matchers::MatchArray
+    expect(result).to match_array(['a','b'])
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/loadyaml_spec.rb b/puppet/modules/stdlib/spec/functions/loadyaml_spec.rb
new file mode 100755
index 00000000..cdc3d6f5
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/loadyaml_spec.rb
@@ -0,0 +1,25 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the loadyaml function" do
+  include PuppetlabsSpec::Files
+
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("loadyaml")).to eq("function_loadyaml")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_loadyaml([]) }.to raise_error(Puppet::ParseError)
+  end
+
+  it "should convert YAML file to a data structure" do
+    yaml_file = tmpfilename ('yamlfile')
+    File.open(yaml_file, 'w') do |fh|
+      fh.write("---\n aaa: 1\n bbb: 2\n ccc: 3\n ddd: 4\n")
+    end
+    result = scope.function_loadyaml([yaml_file])
+    expect(result).to eq({"aaa" => 1, "bbb" => 2, "ccc" => 3, "ddd" => 4 })
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/lstrip_spec.rb b/puppet/modules/stdlib/spec/functions/lstrip_spec.rb
new file mode 100755
index 00000000..68cca1c5
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/lstrip_spec.rb
@@ -0,0 +1,28 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the lstrip function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("lstrip")).to eq("function_lstrip")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_lstrip([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should lstrip a string" do
+    result = scope.function_lstrip(["  asdf"])
+    expect(result).to(eq('asdf'))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new("  asdf")
+    result = scope.function_lstrip([value])
+    result.should(eq("asdf"))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/max_spec.rb b/puppet/modules/stdlib/spec/functions/max_spec.rb
new file mode 100755
index 00000000..c3d8a132
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/max_spec.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe "the max function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("max")).to eq("function_max")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_max([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should be able to compare strings" do
+    expect(scope.function_max(["albatross","dog","horse"])).to(eq("horse"))
+  end
+
+  it "should be able to compare numbers" do
+    expect(scope.function_max([6,8,4])).to(eq(8))
+  end
+
+  it "should be able to compare a number with a stringified number" do
+    expect(scope.function_max([1,"2"])).to(eq("2"))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/member_spec.rb b/puppet/modules/stdlib/spec/functions/member_spec.rb
new file mode 100755
index 00000000..1a1d7c66
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/member_spec.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the member function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("member")).to eq("function_member")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_member([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if a member is in an array" do
+    result = scope.function_member([["a","b","c"], "a"])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if a member is not in an array" do
+    result = scope.function_member([["a","b","c"], "d"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return true if a member array is in an array" do
+    result = scope.function_member([["a","b","c"], ["a", "b"]])
+    expect(result).to(eq(true))
+  end
+
+  it "should return false if a member array is not in an array" do
+    result = scope.function_member([["a","b","c"], ["d", "e"]])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/merge_spec.rb b/puppet/modules/stdlib/spec/functions/merge_spec.rb
new file mode 100755
index 00000000..2abf9762
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/merge_spec.rb
@@ -0,0 +1,52 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:merge) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  describe 'when calling merge from puppet' do
+    it "should not compile when no arguments are passed" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = '$x = merge()'
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+
+    it "should not compile when 1 argument is passed" do
+      skip("Fails on 2.6.x, see bug #15912") if Puppet.version =~ /^2\.6\./
+      Puppet[:code] = "$my_hash={'one' => 1}\n$x = merge($my_hash)"
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+  end
+
+  describe 'when calling merge on the scope instance' do
+    it 'should require all parameters are hashes' do
+      expect { new_hash = scope.function_merge([{}, '2'])}.to raise_error(Puppet::ParseError, /unexpected argument type String/)
+      expect { new_hash = scope.function_merge([{}, 2])}.to raise_error(Puppet::ParseError, /unexpected argument type Fixnum/)
+    end
+
+    it 'should accept empty strings as puppet undef' do
+      expect { new_hash = scope.function_merge([{}, ''])}.not_to raise_error
+    end
+
+    it 'should be able to merge two hashes' do
+      new_hash = scope.function_merge([{'one' => '1', 'two' => '1'}, {'two' => '2', 'three' => '2'}])
+      expect(new_hash['one']).to   eq('1')
+      expect(new_hash['two']).to   eq('2')
+      expect(new_hash['three']).to eq('2')
+    end
+
+    it 'should merge multiple hashes' do
+      hash = scope.function_merge([{'one' => 1}, {'one' => '2'}, {'one' => '3'}])
+      expect(hash['one']).to eq('3')
+    end
+
+    it 'should accept empty hashes' do
+      expect(scope.function_merge([{},{},{}])).to eq({})
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/min_spec.rb b/puppet/modules/stdlib/spec/functions/min_spec.rb
new file mode 100755
index 00000000..35a08900
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/min_spec.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe "the min function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("min")).to eq("function_min")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_min([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should be able to compare strings" do
+    expect(scope.function_min(["albatross","dog","horse"])).to(eq("albatross"))
+  end
+
+  it "should be able to compare numbers" do
+    expect(scope.function_min([6,8,4])).to(eq(4))
+  end
+
+  it "should be able to compare a number with a stringified number" do
+    expect(scope.function_min([1,"2"])).to(eq(1))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/num2bool_spec.rb b/puppet/modules/stdlib/spec/functions/num2bool_spec.rb
new file mode 100755
index 00000000..d0ba9354
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/num2bool_spec.rb
@@ -0,0 +1,67 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the num2bool function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("num2bool")).to eq("function_num2bool")
+  end
+
+  it "should raise a ParseError if there are no arguments" do
+    expect { scope.function_num2bool([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if there are more than 1 arguments" do
+    expect { scope.function_num2bool(["foo","bar"]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if passed something non-numeric" do
+    expect { scope.function_num2bool(["xyzzy"]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return true if passed string 1" do
+    result = scope.function_num2bool(["1"])
+    expect(result).to(be_truthy)
+  end
+
+  it "should return true if passed string 1.5" do
+    result = scope.function_num2bool(["1.5"])
+    expect(result).to(be_truthy)
+  end
+
+  it "should return true if passed number 1" do
+    result = scope.function_num2bool([1])
+    expect(result).to(be_truthy)
+  end
+
+  it "should return false if passed string 0" do
+    result = scope.function_num2bool(["0"])
+    expect(result).to(be_falsey)
+  end
+
+  it "should return false if passed number 0" do
+    result = scope.function_num2bool([0])
+    expect(result).to(be_falsey)
+  end
+
+  it "should return false if passed string -1" do
+    result = scope.function_num2bool(["-1"])
+    expect(result).to(be_falsey)
+  end
+
+  it "should return false if passed string -1.5" do
+    result = scope.function_num2bool(["-1.5"])
+    expect(result).to(be_falsey)
+  end
+
+  it "should return false if passed number -1" do
+    result = scope.function_num2bool([-1])
+    expect(result).to(be_falsey)
+  end
+
+  it "should return false if passed float -1.5" do
+    result = scope.function_num2bool([-1.5])
+    expect(result).to(be_falsey)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/parsejson_spec.rb b/puppet/modules/stdlib/spec/functions/parsejson_spec.rb
new file mode 100755
index 00000000..1dd41b96
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/parsejson_spec.rb
@@ -0,0 +1,22 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the parsejson function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("parsejson")).to eq("function_parsejson")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_parsejson([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should convert JSON to a data structure" do
+    json = <<-EOS
+["aaa","bbb","ccc"]
+EOS
+    result = scope.function_parsejson([json])
+    expect(result).to(eq(['aaa','bbb','ccc']))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/parseyaml_spec.rb b/puppet/modules/stdlib/spec/functions/parseyaml_spec.rb
new file mode 100755
index 00000000..e5f145ba
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/parseyaml_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the parseyaml function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("parseyaml")).to eq("function_parseyaml")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_parseyaml([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should convert YAML to a data structure" do
+    yaml = <<-EOS
+- aaa
+- bbb
+- ccc
+EOS
+    result = scope.function_parseyaml([yaml])
+    expect(result).to(eq(['aaa','bbb','ccc']))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/pick_default_spec.rb b/puppet/modules/stdlib/spec/functions/pick_default_spec.rb
new file mode 100755
index 00000000..db10cc35
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/pick_default_spec.rb
@@ -0,0 +1,58 @@
+#!/usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the pick_default function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("pick_default")).to eq("function_pick_default")
+  end
+
+  it 'should return the correct value' do
+    expect(scope.function_pick_default(['first', 'second'])).to eq('first')
+  end
+
+  it 'should return the correct value if the first value is empty' do
+    expect(scope.function_pick_default(['', 'second'])).to eq('second')
+  end
+
+  it 'should skip empty string values' do
+    expect(scope.function_pick_default(['', 'first'])).to eq('first')
+  end
+
+  it 'should skip :undef values' do
+    expect(scope.function_pick_default([:undef, 'first'])).to eq('first')
+  end
+
+  it 'should skip :undefined values' do
+    expect(scope.function_pick_default([:undefined, 'first'])).to eq('first')
+  end
+
+  it 'should return the empty string if it is the last possibility' do
+    expect(scope.function_pick_default([:undef, :undefined, ''])).to eq('')
+  end
+
+  it 'should return :undef if it is the last possibility' do
+    expect(scope.function_pick_default(['', :undefined, :undef])).to eq(:undef)
+  end
+
+  it 'should return :undefined if it is the last possibility' do
+    expect(scope.function_pick_default([:undef, '', :undefined])).to eq(:undefined)
+  end
+
+  it 'should return the empty string if it is the only possibility' do
+    expect(scope.function_pick_default([''])).to eq('')
+  end
+
+  it 'should return :undef if it is the only possibility' do
+    expect(scope.function_pick_default([:undef])).to eq(:undef)
+  end
+
+  it 'should return :undefined if it is the only possibility' do
+    expect(scope.function_pick_default([:undefined])).to eq(:undefined)
+  end
+
+  it 'should error if no values are passed' do
+    expect { scope.function_pick_default([]) }.to raise_error(Puppet::Error, /Must receive at least one argument./)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/pick_spec.rb b/puppet/modules/stdlib/spec/functions/pick_spec.rb
new file mode 100755
index 00000000..8be8f587
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/pick_spec.rb
@@ -0,0 +1,34 @@
+#!/usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the pick function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("pick")).to eq("function_pick")
+  end
+
+  it 'should return the correct value' do
+    expect(scope.function_pick(['first', 'second'])).to eq('first')
+  end
+
+  it 'should return the correct value if the first value is empty' do
+    expect(scope.function_pick(['', 'second'])).to eq('second')
+  end
+
+  it 'should remove empty string values' do
+    expect(scope.function_pick(['', 'first'])).to eq('first')
+  end
+
+  it 'should remove :undef values' do
+    expect(scope.function_pick([:undef, 'first'])).to eq('first')
+  end
+
+  it 'should remove :undefined values' do
+    expect(scope.function_pick([:undefined, 'first'])).to eq('first')
+  end
+
+  it 'should error if no values are passed' do
+    expect { scope.function_pick([]) }.to( raise_error(Puppet::ParseError, "pick(): must receive at least one non empty value"))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/prefix_spec.rb b/puppet/modules/stdlib/spec/functions/prefix_spec.rb
new file mode 100755
index 00000000..34cac530
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/prefix_spec.rb
@@ -0,0 +1,28 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the prefix function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "raises a ParseError if there is less than 1 arguments" do
+    expect { scope.function_prefix([]) }.to raise_error(Puppet::ParseError, /number of arguments/)
+  end
+
+  it "raises an error if the first argument is not an array" do
+    expect {
+      scope.function_prefix([Object.new])
+    }.to raise_error(Puppet::ParseError, /expected first argument to be an Array/)
+  end
+
+
+  it "raises an error if the second argument is not a string" do
+    expect {
+      scope.function_prefix([['first', 'second'], 42])
+    }.to raise_error(Puppet::ParseError, /expected second argument to be a String/)
+  end
+
+  it "returns a prefixed array" do
+    result = scope.function_prefix([['a','b','c'], 'p'])
+    expect(result).to(eq(['pa','pb','pc']))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/private_spec.rb b/puppet/modules/stdlib/spec/functions/private_spec.rb
new file mode 100755
index 00000000..c70759fa
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/private_spec.rb
@@ -0,0 +1,55 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:private) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  subject do
+    function_name = Puppet::Parser::Functions.function(:private)
+    scope.method(function_name)
+  end
+
+  context "when called from inside module" do
+    it "should not fail" do
+      scope.expects(:lookupvar).with('module_name').returns('foo')
+      scope.expects(:lookupvar).with('caller_module_name').returns('foo')
+      expect {
+        subject.call []
+      }.not_to raise_error
+    end
+  end
+
+  context "with an explicit failure message" do
+    it "prints the failure message on error" do
+      scope.expects(:lookupvar).with('module_name').returns('foo')
+      scope.expects(:lookupvar).with('caller_module_name').returns('bar')
+      expect {
+        subject.call ['failure message!']
+      }.to raise_error Puppet::ParseError, /failure message!/
+    end
+  end
+
+  context "when called from private class" do
+    it "should fail with a class error message" do
+      scope.expects(:lookupvar).with('module_name').returns('foo')
+      scope.expects(:lookupvar).with('caller_module_name').returns('bar')
+      scope.source.expects(:name).returns('foo::baz')
+      scope.source.expects(:type).returns('hostclass')
+      expect {
+        subject.call []
+      }.to raise_error Puppet::ParseError, /Class foo::baz is private/
+    end
+  end
+
+  context "when called from private definition" do
+    it "should fail with a class error message" do
+      scope.expects(:lookupvar).with('module_name').returns('foo')
+      scope.expects(:lookupvar).with('caller_module_name').returns('bar')
+      scope.source.expects(:name).returns('foo::baz')
+      scope.source.expects(:type).returns('definition')
+      expect {
+        subject.call []
+      }.to raise_error Puppet::ParseError, /Definition foo::baz is private/
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/range_spec.rb b/puppet/modules/stdlib/spec/functions/range_spec.rb
new file mode 100755
index 00000000..ef86f971
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/range_spec.rb
@@ -0,0 +1,86 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the range function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "exists" do
+    expect(Puppet::Parser::Functions.function("range")).to eq("function_range")
+  end
+
+  it "raises a ParseError if there is less than 1 arguments" do
+    expect { scope.function_range([]) }.to raise_error Puppet::ParseError, /Wrong number of arguments.*0 for 1/
+  end
+
+  describe 'with a letter range' do
+    it "returns a letter range" do
+      result = scope.function_range(["a","d"])
+      expect(result).to eq ['a','b','c','d']
+    end
+
+    it "returns a letter range given a step of 1" do
+      result = scope.function_range(["a","d","1"])
+      expect(result).to eq ['a','b','c','d']
+    end
+
+    it "returns a stepped letter range" do
+      result = scope.function_range(["a","d","2"])
+      expect(result).to eq ['a','c']
+    end
+
+    it "returns a stepped letter range given a negative step" do
+      result = scope.function_range(["a","d","-2"])
+      expect(result).to eq ['a','c']
+    end
+  end
+
+  describe 'with a number range' do
+    it "returns a number range" do
+      result = scope.function_range(["1","4"])
+      expect(result).to eq [1,2,3,4]
+    end
+
+    it "returns a number range given a step of 1" do
+      result = scope.function_range(["1","4","1"])
+      expect(result).to eq [1,2,3,4]
+    end
+
+    it "returns a stepped number range" do
+      result = scope.function_range(["1","4","2"])
+      expect(result).to eq [1,3]
+    end
+
+    it "returns a stepped number range given a negative step" do
+      result = scope.function_range(["1","4","-2"])
+      expect(result).to eq [1,3]
+    end
+  end
+
+  describe 'with a numeric-like string range' do
+    it "works with padded hostname like strings" do
+      expected = ("host01".."host10").to_a
+      expect(scope.function_range(["host01","host10"])).to eq expected
+    end
+
+    it "coerces zero padded digits to integers" do
+      expected = (0..10).to_a
+      expect(scope.function_range(["00", "10"])).to eq expected
+    end
+  end
+
+  describe 'with a numeric range' do
+    it "returns a range of numbers" do
+      expected = (1..10).to_a
+      expect(scope.function_range([1,10])).to eq expected
+    end
+    it "returns a range of numbers with step parameter" do
+      expected = (1..10).step(2).to_a
+      expect(scope.function_range([1,10,2])).to eq expected
+    end
+    it "works with mixed numeric like strings and numeric arguments" do
+      expected = (1..10).to_a
+      expect(scope.function_range(['1',10])).to eq expected
+      expect(scope.function_range([1,'10'])).to eq expected
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/reject_spec.rb b/puppet/modules/stdlib/spec/functions/reject_spec.rb
new file mode 100755
index 00000000..88a992ef
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/reject_spec.rb
@@ -0,0 +1,20 @@
+#!/usr/bin/env ruby
+
+require 'spec_helper'
+
+describe "the reject function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("reject")).to eq("function_reject")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_reject([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should reject contents from an array" do
+    result = scope.function_reject([["1111", "aaabbb","bbbccc","dddeee"], "bbb"])
+    expect(result).to(eq(["1111", "dddeee"]))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/reverse_spec.rb b/puppet/modules/stdlib/spec/functions/reverse_spec.rb
new file mode 100755
index 00000000..1f047943
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/reverse_spec.rb
@@ -0,0 +1,28 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the reverse function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("reverse")).to eq("function_reverse")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_reverse([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should reverse a string" do
+    result = scope.function_reverse(["asdfghijkl"])
+    expect(result).to(eq('lkjihgfdsa'))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('asdfghjkl')
+    result = scope.function_reverse([value])
+    result.should(eq('lkjhgfdsa'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/rstrip_spec.rb b/puppet/modules/stdlib/spec/functions/rstrip_spec.rb
new file mode 100755
index 00000000..f6b48389
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/rstrip_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the rstrip function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("rstrip")).to eq("function_rstrip")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_rstrip([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should rstrip a string" do
+    result = scope.function_rstrip(["asdf  "])
+    expect(result).to(eq('asdf'))
+  end
+
+  it "should rstrip each element in an array" do
+    result = scope.function_rstrip([["a ","b ", "c "]])
+    expect(result).to(eq(['a','b','c']))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('asdf ')
+    result = scope.function_rstrip([value])
+    result.should(eq('asdf'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/shuffle_spec.rb b/puppet/modules/stdlib/spec/functions/shuffle_spec.rb
new file mode 100755
index 00000000..a62c1fb5
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/shuffle_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the shuffle function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("shuffle")).to eq("function_shuffle")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_shuffle([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should shuffle a string and the result should be the same size" do
+    result = scope.function_shuffle(["asdf"])
+    expect(result.size).to(eq(4))
+  end
+
+  it "should shuffle a string but the sorted contents should still be the same" do
+    result = scope.function_shuffle(["adfs"])
+    expect(result.split("").sort.join("")).to(eq("adfs"))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('asdf')
+    result = scope.function_shuffle([value])
+    result.size.should(eq(4))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/size_spec.rb b/puppet/modules/stdlib/spec/functions/size_spec.rb
new file mode 100755
index 00000000..18eb48f9
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/size_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the size function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("size")).to eq("function_size")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_size([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return the size of a string" do
+    result = scope.function_size(["asdf"])
+    expect(result).to(eq(4))
+  end
+
+  it "should return the size of an array" do
+    result = scope.function_size([["a","b","c"]])
+    expect(result).to(eq(3))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/sort_spec.rb b/puppet/modules/stdlib/spec/functions/sort_spec.rb
new file mode 100755
index 00000000..4c2a66cf
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/sort_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the sort function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("sort")).to eq("function_sort")
+  end
+
+  it "should raise a ParseError if there is not 1 arguments" do
+    expect { scope.function_sort(['','']) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should sort an array" do
+    result = scope.function_sort([["a","c","b"]])
+    expect(result).to(eq(['a','b','c']))
+  end
+
+  it "should sort a string" do
+    result = scope.function_sort(["acb"])
+    expect(result).to(eq('abc'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/squeeze_spec.rb b/puppet/modules/stdlib/spec/functions/squeeze_spec.rb
new file mode 100755
index 00000000..cd0eb37f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/squeeze_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the squeeze function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("squeeze")).to eq("function_squeeze")
+  end
+
+  it "should raise a ParseError if there is less than 2 arguments" do
+    expect { scope.function_squeeze([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should squeeze a string" do
+    result = scope.function_squeeze(["aaabbbbcccc"])
+    expect(result).to(eq('abc'))
+  end
+
+  it "should squeeze all elements in an array" do
+    result = scope.function_squeeze([["aaabbbbcccc","dddfff"]])
+    expect(result).to(eq(['abc','df']))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/str2bool_spec.rb b/puppet/modules/stdlib/spec/functions/str2bool_spec.rb
new file mode 100755
index 00000000..1d205d75
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/str2bool_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the str2bool function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("str2bool")).to eq("function_str2bool")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_str2bool([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should convert string 'true' to true" do
+    result = scope.function_str2bool(["true"])
+    expect(result).to(eq(true))
+  end
+
+  it "should convert string 'undef' to false" do
+    result = scope.function_str2bool(["undef"])
+    expect(result).to(eq(false))
+  end
+
+  it "should return the boolean it was called with" do
+    result = scope.function_str2bool([true])
+    expect(result).to(eq(true))
+    result = scope.function_str2bool([false])
+    expect(result).to(eq(false))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/str2saltedsha512_spec.rb b/puppet/modules/stdlib/spec/functions/str2saltedsha512_spec.rb
new file mode 100755
index 00000000..ab7f57f1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/str2saltedsha512_spec.rb
@@ -0,0 +1,45 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the str2saltedsha512 function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("str2saltedsha512")).to eq("function_str2saltedsha512")
+  end
+
+  it "should raise a ParseError if there is less than 1 argument" do
+    expect { scope.function_str2saltedsha512([]) }.to( raise_error(Puppet::ParseError) )
+  end
+
+  it "should raise a ParseError if there is more than 1 argument" do
+    expect { scope.function_str2saltedsha512(['foo', 'bar', 'baz']) }.to( raise_error(Puppet::ParseError) )
+  end
+
+  it "should return a salted-sha512 password hash 136 characters in length" do
+    result = scope.function_str2saltedsha512(["password"])
+    expect(result.length).to(eq(136))
+  end
+
+  it "should raise an error if you pass a non-string password" do
+    expect { scope.function_str2saltedsha512([1234]) }.to( raise_error(Puppet::ParseError) )
+  end
+
+  it "should generate a valid password" do
+    # Allow the function to generate a password based on the string 'password'
+    password_hash = scope.function_str2saltedsha512(["password"])
+
+    # Separate the Salt and Password from the Password Hash
+    salt     = password_hash[0..7]
+    password = password_hash[8..-1]
+
+    # Convert the Salt and Password from Hex to Binary Data
+    str_salt     = Array(salt.lines).pack('H*')
+    str_password = Array(password.lines).pack('H*')
+
+    # Combine the Binary Salt with 'password' and compare the end result
+    saltedpass    = Digest::SHA512.digest(str_salt + 'password')
+    result        = (str_salt + saltedpass).unpack('H*')[0]
+    expect(result).to eq(password_hash)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/strftime_spec.rb b/puppet/modules/stdlib/spec/functions/strftime_spec.rb
new file mode 100755
index 00000000..ebec54b8
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/strftime_spec.rb
@@ -0,0 +1,29 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the strftime function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("strftime")).to eq("function_strftime")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_strftime([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "using %s should be higher then when I wrote this test" do
+    result = scope.function_strftime(["%s"])
+    expect(result.to_i).to(be > 1311953157)
+  end
+
+  it "using %s should be lower then 1.5 trillion" do
+    result = scope.function_strftime(["%s"])
+    expect(result.to_i).to(be < 1500000000)
+  end
+
+  it "should return a date when given %Y-%m-%d" do
+    result = scope.function_strftime(["%Y-%m-%d"])
+    expect(result).to match(/^\d{4}-\d{2}-\d{2}$/)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/strip_spec.rb b/puppet/modules/stdlib/spec/functions/strip_spec.rb
new file mode 100755
index 00000000..4ac8daf8
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/strip_spec.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the strip function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("strip")).to eq("function_strip")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_strip([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should strip a string" do
+    result = scope.function_strip([" ab cd "])
+    expect(result).to(eq('ab cd'))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new(' as df ')
+    result = scope.function_strip([value])
+    result.should(eq('as df'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/suffix_spec.rb b/puppet/modules/stdlib/spec/functions/suffix_spec.rb
new file mode 100755
index 00000000..c7783c64
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/suffix_spec.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the suffix function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "raises a ParseError if there is less than 1 arguments" do
+    expect { scope.function_suffix([]) }.to raise_error(Puppet::ParseError, /number of arguments/)
+  end
+
+  it "raises an error if the first argument is not an array" do
+    expect {
+      scope.function_suffix([Object.new])
+    }.to raise_error(Puppet::ParseError, /expected first argument to be an Array/)
+  end
+
+  it "raises an error if the second argument is not a string" do
+    expect {
+      scope.function_suffix([['first', 'second'], 42])
+    }.to raise_error(Puppet::ParseError, /expected second argument to be a String/)
+  end
+
+  it "returns a suffixed array" do
+    result = scope.function_suffix([['a','b','c'], 'p'])
+    expect(result).to(eq(['ap','bp','cp']))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/swapcase_spec.rb b/puppet/modules/stdlib/spec/functions/swapcase_spec.rb
new file mode 100755
index 00000000..791d1dfa
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/swapcase_spec.rb
@@ -0,0 +1,28 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the swapcase function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("swapcase")).to eq("function_swapcase")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_swapcase([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should swapcase a string" do
+    result = scope.function_swapcase(["aaBBccDD"])
+    expect(result).to(eq('AAbbCCdd'))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new("aaBBccDD")
+    result = scope.function_swapcase([value])
+    result.should(eq("AAbbCCdd"))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/time_spec.rb b/puppet/modules/stdlib/spec/functions/time_spec.rb
new file mode 100755
index 00000000..6e22515f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/time_spec.rb
@@ -0,0 +1,29 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the time function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("time")).to eq("function_time")
+  end
+
+  it "should raise a ParseError if there is more than 2 arguments" do
+    expect { scope.function_time(['','']) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return a number" do
+    result = scope.function_time([])
+    expect(result).to be_an(Integer)
+  end
+
+  it "should be higher then when I wrote this test" do
+    result = scope.function_time([])
+    expect(result).to(be > 1311953157)
+  end
+
+  it "should be lower then 1.5 trillion" do
+    result = scope.function_time([])
+    expect(result).to(be < 1500000000)
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/to_bytes_spec.rb b/puppet/modules/stdlib/spec/functions/to_bytes_spec.rb
new file mode 100755
index 00000000..0f6ade91
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/to_bytes_spec.rb
@@ -0,0 +1,83 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe "the to_bytes function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("to_bytes")).to eq("function_to_bytes")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_to_bytes([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should convert kB to B" do
+    result = scope.function_to_bytes(["4 kB"])
+    expect(result).to(eq(4096))
+  end
+
+  it "should convert MB to B" do
+    result = scope.function_to_bytes(["4 MB"])
+    expect(result).to(eq(4194304))
+  end
+
+  it "should convert GB to B" do
+    result = scope.function_to_bytes(["4 GB"])
+    expect(result).to(eq(4294967296))
+  end
+
+  it "should convert TB to B" do
+    result = scope.function_to_bytes(["4 TB"])
+    expect(result).to(eq(4398046511104))
+  end
+
+  it "should convert PB to B" do
+    result = scope.function_to_bytes(["4 PB"])
+    expect(result).to(eq(4503599627370496))
+  end
+
+  it "should convert PB to B" do
+    result = scope.function_to_bytes(["4 EB"])
+    expect(result).to(eq(4611686018427387904))
+  end
+
+  it "should work without B in unit" do
+    result = scope.function_to_bytes(["4 k"])
+    expect(result).to(eq(4096))
+  end
+
+  it "should work without a space before unit" do
+    result = scope.function_to_bytes(["4k"])
+    expect(result).to(eq(4096))
+  end
+
+  it "should work without a unit" do
+    result = scope.function_to_bytes(["5678"])
+    expect(result).to(eq(5678))
+  end
+
+  it "should convert fractions" do
+    result = scope.function_to_bytes(["1.5 kB"])
+    expect(result).to(eq(1536))
+  end
+
+  it "should convert scientific notation" do
+    result = scope.function_to_bytes(["1.5e2 B"])
+    expect(result).to(eq(150))
+  end
+
+  it "should do nothing with a positive number" do
+    result = scope.function_to_bytes([5678])
+    expect(result).to(eq(5678))
+  end
+
+  it "should should raise a ParseError if input isn't a number" do
+    expect { scope.function_to_bytes(["foo"]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should should raise a ParseError if prefix is unknown" do
+    expect { scope.function_to_bytes(["5 uB"]) }.to( raise_error(Puppet::ParseError))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/type3x_spec.rb b/puppet/modules/stdlib/spec/functions/type3x_spec.rb
new file mode 100644
index 00000000..d21236a6
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/type3x_spec.rb
@@ -0,0 +1,43 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the type3x function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("type3x")).to eq("function_type3x")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_type3x([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return string when given a string" do
+    result = scope.function_type3x(["aaabbbbcccc"])
+    expect(result).to(eq('string'))
+  end
+
+  it "should return array when given an array" do
+    result = scope.function_type3x([["aaabbbbcccc","asdf"]])
+    expect(result).to(eq('array'))
+  end
+
+  it "should return hash when given a hash" do
+    result = scope.function_type3x([{"a"=>1,"b"=>2}])
+    expect(result).to(eq('hash'))
+  end
+
+  it "should return integer when given an integer" do
+    result = scope.function_type3x(["1"])
+    expect(result).to(eq('integer'))
+  end
+
+  it "should return float when given a float" do
+    result = scope.function_type3x(["1.34"])
+    expect(result).to(eq('float'))
+  end
+
+  it "should return boolean when given a boolean" do
+    result = scope.function_type3x([true])
+    expect(result).to(eq('boolean'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/type_spec.rb b/puppet/modules/stdlib/spec/functions/type_spec.rb
new file mode 100755
index 00000000..b683fcfa
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/type_spec.rb
@@ -0,0 +1,44 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the type function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("type")).to eq("function_type")
+  end
+
+  it "should give a deprecation warning when called" do
+    scope.expects(:warning).with("type() DEPRECATED: This function will cease to function on Puppet 4; please use type3x() before upgrading to puppet 4 for backwards-compatibility, or migrate to the new parser's typing system.")
+    scope.function_type(["aoeu"])
+  end
+
+  it "should return string when given a string" do
+    result = scope.function_type(["aaabbbbcccc"])
+    expect(result).to(eq('string'))
+  end
+
+  it "should return array when given an array" do
+    result = scope.function_type([["aaabbbbcccc","asdf"]])
+    expect(result).to(eq('array'))
+  end
+
+  it "should return hash when given a hash" do
+    result = scope.function_type([{"a"=>1,"b"=>2}])
+    expect(result).to(eq('hash'))
+  end
+
+  it "should return integer when given an integer" do
+    result = scope.function_type(["1"])
+    expect(result).to(eq('integer'))
+  end
+
+  it "should return float when given a float" do
+    result = scope.function_type(["1.34"])
+    expect(result).to(eq('float'))
+  end
+
+  it "should return boolean when given a boolean" do
+    result = scope.function_type([true])
+    expect(result).to(eq('boolean'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/union_spec.rb b/puppet/modules/stdlib/spec/functions/union_spec.rb
new file mode 100755
index 00000000..706f4cbc
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/union_spec.rb
@@ -0,0 +1,19 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the union function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("union")).to eq("function_union")
+  end
+
+  it "should raise a ParseError if there are fewer than 2 arguments" do
+    expect { scope.function_union([]) }.to( raise_error(Puppet::ParseError) )
+  end
+
+  it "should join two arrays together" do
+    result = scope.function_union([["a","b","c"],["b","c","d"]])
+    expect(result).to(eq(["a","b","c","d"]))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/unique_spec.rb b/puppet/modules/stdlib/spec/functions/unique_spec.rb
new file mode 100755
index 00000000..7cd3a566
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/unique_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the unique function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("unique")).to eq("function_unique")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_unique([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should remove duplicate elements in a string" do
+    result = scope.function_unique(["aabbc"])
+    expect(result).to(eq('abc'))
+  end
+
+  it "should remove duplicate elements in an array" do
+    result = scope.function_unique([["a","a","b","b","c"]])
+    expect(result).to(eq(['a','b','c']))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('aabbc')
+    result = scope.function_unique([value])
+    result.should(eq('abc'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/upcase_spec.rb b/puppet/modules/stdlib/spec/functions/upcase_spec.rb
new file mode 100755
index 00000000..3cf8b055
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/upcase_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the upcase function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("upcase")).to eq("function_upcase")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_upcase([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should upcase a string" do
+    result = scope.function_upcase(["abc"])
+    expect(result).to(eq('ABC'))
+  end
+
+  it "should do nothing if a string is already upcase" do
+    result = scope.function_upcase(["ABC"])
+    expect(result).to(eq('ABC'))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('abc')
+    result = scope.function_upcase([value])
+    result.should(eq('ABC'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/uriescape_spec.rb b/puppet/modules/stdlib/spec/functions/uriescape_spec.rb
new file mode 100755
index 00000000..2321e5ab
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/uriescape_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the uriescape function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("uriescape")).to eq("function_uriescape")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_uriescape([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should uriescape a string" do
+    result = scope.function_uriescape([":/?#[]@!$&'()*+,;= \"{}"])
+    expect(result).to(eq(':/?%23[]@!$&\'()*+,;=%20%22%7B%7D'))
+  end
+
+  it "should do nothing if a string is already safe" do
+    result = scope.function_uriescape(["ABCdef"])
+    expect(result).to(eq('ABCdef'))
+  end
+
+  it "should accept objects which extend String" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('abc')
+    result = scope.function_uriescape([value])
+    result.should(eq('abc'))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_absolute_path_spec.rb b/puppet/modules/stdlib/spec/functions/validate_absolute_path_spec.rb
new file mode 100755
index 00000000..36c836bd
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_absolute_path_spec.rb
@@ -0,0 +1,104 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:validate_absolute_path) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  # The subject of these examples is the method itself.
+  subject do
+    # This makes sure the function is loaded within each test
+    function_name = Puppet::Parser::Functions.function(:validate_absolute_path)
+    scope.method(function_name)
+  end
+
+  describe "Valid Paths" do
+    def self.valid_paths
+      %w{
+        C:/
+        C:\\
+        C:\\WINDOWS\\System32
+        C:/windows/system32
+        X:/foo/bar
+        X:\\foo\\bar
+        /var/tmp
+        /var/lib/puppet
+        /var/opt/../lib/puppet
+      }
+    end
+
+    context "Without Puppet::Util.absolute_path? (e.g. Puppet <= 2.6)" do
+      before :each do
+        # The intent here is to mock Puppet to behave like Puppet 2.6 does.
+        # Puppet 2.6 does not have the absolute_path? method.  This is only a
+        # convenience test, stdlib should be run with the Puppet 2.6.x in the
+        # $LOAD_PATH in addition to 2.7.x and master.
+        Puppet::Util.expects(:respond_to?).with(:absolute_path?).returns(false)
+      end
+      valid_paths.each do |path|
+        it "validate_absolute_path(#{path.inspect}) should not fail" do
+          expect { subject.call [path] }.not_to raise_error
+        end
+      end
+      valid_paths do
+        it "validate_absolute_path(#{valid_paths.inspect}) should not fail" do
+          expect { subject.call [valid_paths] }.not_to raise_error
+        end
+      end
+    end
+
+    context "Puppet without mocking" do
+      valid_paths.each do |path|
+        it "validate_absolute_path(#{path.inspect}) should not fail" do
+          expect { subject.call [path] }.not_to raise_error
+        end
+      end
+      valid_paths do
+        it "validate_absolute_path(#{valid_paths.inspect}) should not fail" do
+          expect { subject.call [valid_paths] }.not_to raise_error
+        end
+      end
+    end
+  end
+
+  describe 'Invalid paths' do
+    context 'Garbage inputs' do
+      [
+        nil,
+        [ nil ],
+        [ nil, nil ],
+        { 'foo' => 'bar' },
+        { },
+        '',
+      ].each do |path|
+        it "validate_absolute_path(#{path.inspect}) should fail" do
+          expect { subject.call [path] }.to raise_error Puppet::ParseError
+        end
+      end
+    end
+
+    context 'Relative paths' do
+      def self.rel_paths 
+        %w{
+          relative1
+          .
+          ..
+          ./foo
+          ../foo
+          etc/puppetlabs/puppet
+          opt/puppet/bin
+        }
+      end
+      rel_paths.each do |path|
+        it "validate_absolute_path(#{path.inspect}) should fail" do
+          expect { subject.call [path] }.to raise_error Puppet::ParseError
+        end
+      end
+      rel_paths do
+        it "validate_absolute_path(#{rel_paths.inspect}) should fail" do
+          expect { subject.call [rel_paths] }.to raise_error Puppet::ParseError
+        end
+      end
+    end
+  end
+end
+
diff --git a/puppet/modules/stdlib/spec/functions/validate_array_spec.rb b/puppet/modules/stdlib/spec/functions/validate_array_spec.rb
new file mode 100755
index 00000000..4b31cfde
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_array_spec.rb
@@ -0,0 +1,38 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:validate_array) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+  describe 'when calling validate_array from puppet' do
+
+    %w{ true false }.each do |the_string|
+      it "should not compile when #{the_string} is a string" do
+        Puppet[:code] = "validate_array('#{the_string}')"
+        expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not an Array/)
+      end
+
+      it "should not compile when #{the_string} is a bare word" do
+        Puppet[:code] = "validate_array(#{the_string})"
+        expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not an Array/)
+      end
+    end
+
+    it "should compile when multiple array arguments are passed" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        $foo = [ ]
+        $bar = [ 'one', 'two' ]
+        validate_array($foo, $bar)
+      ENDofPUPPETcode
+      scope.compiler.compile
+    end
+
+    it "should not compile when an undef variable is passed" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        $foo = undef
+        validate_array($foo)
+      ENDofPUPPETcode
+      expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not an Array/)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_augeas_spec.rb b/puppet/modules/stdlib/spec/functions/validate_augeas_spec.rb
new file mode 100755
index 00000000..c695ba2e
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_augeas_spec.rb
@@ -0,0 +1,103 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:validate_augeas), :if => Puppet.features.augeas? do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  # The subject of these examplres is the method itself.
+  subject do
+    # This makes sure the function is loaded within each test
+    function_name = Puppet::Parser::Functions.function(:validate_augeas)
+    scope.method(function_name)
+  end
+
+  context 'Using Puppet::Parser::Scope.new' do
+
+    describe 'Garbage inputs' do
+      inputs = [
+        [ nil ],
+        [ [ nil ] ],
+        [ { 'foo' => 'bar' } ],
+        [ { } ],
+        [ '' ],
+        [ "one", "one", "MSG to User", "4th arg" ],
+      ]
+
+      inputs.each do |input|
+        it "validate_augeas(#{input.inspect}) should fail" do
+          expect { subject.call [input] }.to raise_error Puppet::ParseError
+        end
+      end
+    end
+
+    describe 'Valid inputs' do
+      inputs = [
+        [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns' ],
+        [ "proc /proc   proc    nodev,noexec,nosuid     0       0\n", 'Fstab.lns'],
+      ]
+
+      inputs.each do |input|
+        it "validate_augeas(#{input.inspect}) should not fail" do
+          expect { subject.call input }.not_to raise_error
+        end
+      end
+    end
+
+    describe "Valid inputs which should raise an exception without a message" do
+      # The intent here is to make sure valid inputs raise exceptions when they
+      # don't specify an error message to display.  This is the behvior in
+      # 2.2.x and prior.
+      inputs = [
+        [ "root:x:0:0:root\n", 'Passwd.lns' ],
+        [ "127.0.1.1\n", 'Hosts.lns' ],
+      ]
+
+      inputs.each do |input|
+        it "validate_augeas(#{input.inspect}) should fail" do
+          expect { subject.call input }.to raise_error /validate_augeas.*?matched less than it should/
+        end
+      end
+    end
+
+    describe "Nicer Error Messages" do
+      # The intent here is to make sure the function returns the 3rd argument
+      # in the exception thrown
+      inputs = [
+        [ "root:x:0:0:root\n", 'Passwd.lns', [], 'Failed to validate passwd content' ],
+        [ "127.0.1.1\n", 'Hosts.lns', [], 'Wrong hosts content' ],
+      ]
+
+      inputs.each do |input|
+        it "validate_augeas(#{input.inspect}) should fail" do
+          expect { subject.call input }.to raise_error /#{input[2]}/
+        end
+      end
+    end
+
+    describe "Passing simple unit tests" do
+      inputs = [
+        [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/foobar']],
+        [ "root:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/root/shell[.="/bin/sh"]', 'foobar']],
+      ]
+
+      inputs.each do |input|
+        it "validate_augeas(#{input.inspect}) should fail" do
+          expect { subject.call input }.not_to raise_error
+        end
+      end
+    end
+
+    describe "Failing simple unit tests" do
+      inputs = [
+        [ "foobar:x:0:0:root:/root:/bin/bash\n", 'Passwd.lns', ['$file/foobar']],
+        [ "root:x:0:0:root:/root:/bin/sh\n", 'Passwd.lns', ['$file/root/shell[.="/bin/sh"]', 'foobar']],
+      ]
+
+      inputs.each do |input|
+        it "validate_augeas(#{input.inspect}) should fail" do
+          expect { subject.call input }.to raise_error /testing path/
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_bool_spec.rb b/puppet/modules/stdlib/spec/functions/validate_bool_spec.rb
new file mode 100755
index 00000000..a352d3b5
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_bool_spec.rb
@@ -0,0 +1,51 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:validate_bool) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+  describe 'when calling validate_bool from puppet' do
+
+    %w{ true false }.each do |the_string|
+
+      it "should not compile when #{the_string} is a string" do
+        Puppet[:code] = "validate_bool('#{the_string}')"
+        expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not a boolean/)
+      end
+
+      it "should compile when #{the_string} is a bare word" do
+        Puppet[:code] = "validate_bool(#{the_string})"
+        scope.compiler.compile
+      end
+
+    end
+
+    it "should not compile when an arbitrary string is passed" do
+      Puppet[:code] = 'validate_bool("jeff and dan are awesome")'
+      expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not a boolean/)
+    end
+
+    it "should not compile when no arguments are passed" do
+      Puppet[:code] = 'validate_bool()'
+      expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+
+    it "should compile when multiple boolean arguments are passed" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        $foo = true
+        $bar = false
+        validate_bool($foo, $bar, true, false)
+      ENDofPUPPETcode
+      scope.compiler.compile
+    end
+
+    it "should compile when multiple boolean arguments are passed" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        $foo = true
+        $bar = false
+        validate_bool($foo, $bar, true, false, 'jeff')
+      ENDofPUPPETcode
+      expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not a boolean/)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_cmd_spec.rb b/puppet/modules/stdlib/spec/functions/validate_cmd_spec.rb
new file mode 100755
index 00000000..7cb9782d
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_cmd_spec.rb
@@ -0,0 +1,85 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+TESTEXE = File.exists?('/usr/bin/test') ? '/usr/bin/test' : '/bin/test'
+TOUCHEXE = File.exists?('/usr/bin/touch') ? '/usr/bin/touch' : '/bin/touch'
+
+describe Puppet::Parser::Functions.function(:validate_cmd) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  subject do
+    function_name = Puppet::Parser::Functions.function(:validate_cmd)
+    scope.method(function_name)
+  end
+
+  context 'with no % placeholder' do
+    describe "with an explicit failure message" do
+      it "prints the failure message on error" do
+        expect {
+          subject.call ['', '/bin/false', 'failure message!']
+        }.to raise_error Puppet::ParseError, /failure message!/
+      end
+    end
+
+    describe "on validation failure" do
+      it "includes the command error output" do
+        expect {
+          subject.call ['', "#{TOUCHEXE} /cant/touch/this"]
+        }.to raise_error Puppet::ParseError, /(cannot touch|o such file or)/
+      end
+
+      it "includes the command return value" do
+        expect {
+          subject.call ['', '/cant/run/this']
+        }.to raise_error Puppet::ParseError, /returned 1\b/
+      end
+    end
+
+    describe "when performing actual validation" do
+      it "can positively validate file content" do
+        expect { subject.call ["non-empty", "#{TESTEXE} -s"] }.to_not raise_error
+      end
+
+      it "can negatively validate file content" do
+        expect {
+          subject.call ["", "#{TESTEXE} -s"]
+        }.to raise_error Puppet::ParseError, /failed to validate.*test -s/
+      end
+    end
+  end
+
+  context 'with % placeholder' do
+    describe "with an explicit failure message" do
+      it "prints the failure message on error" do
+        expect {
+          subject.call ['', '/bin/false % -f', 'failure message!']
+        }.to raise_error Puppet::ParseError, /failure message!/
+      end
+    end
+    describe "on validation failure" do
+      it "includes the command error output" do
+        expect {
+          subject.call ['', "#{TOUCHEXE} /cant/touch/this"]
+        }.to raise_error Puppet::ParseError, /(cannot touch|o such file or)/
+      end
+
+      it "includes the command return value" do
+        expect {
+          subject.call ['', '/cant/run/this % -z']
+        }.to raise_error Puppet::ParseError, /Execution of '\/cant\/run\/this .+ -z' returned 1/
+      end
+    end
+
+    describe "when performing actual validation" do
+      it "can positively validate file content" do
+        expect { subject.call ["non-empty", "#{TESTEXE} -s %"] }.to_not raise_error
+      end
+
+      it "can negatively validate file content" do
+        expect {
+          subject.call ["", "#{TESTEXE} -s %"]
+        }.to raise_error Puppet::ParseError, /failed to validate.*test -s/
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_hash_spec.rb b/puppet/modules/stdlib/spec/functions/validate_hash_spec.rb
new file mode 100755
index 00000000..a0c35c23
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_hash_spec.rb
@@ -0,0 +1,43 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:validate_hash) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  describe 'when calling validate_hash from puppet' do
+
+    %w{ true false }.each do |the_string|
+
+      it "should not compile when #{the_string} is a string" do
+        Puppet[:code] = "validate_hash('#{the_string}')"
+        expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not a Hash/)
+      end
+
+      it "should not compile when #{the_string} is a bare word" do
+        Puppet[:code] = "validate_hash(#{the_string})"
+        expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not a Hash/)
+      end
+
+    end
+
+    it "should compile when multiple hash arguments are passed" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        $foo = {}
+        $bar = { 'one' => 'two' }
+        validate_hash($foo, $bar)
+      ENDofPUPPETcode
+      scope.compiler.compile
+    end
+
+    it "should not compile when an undef variable is passed" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        $foo = undef
+        validate_hash($foo)
+      ENDofPUPPETcode
+      expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not a Hash/)
+    end
+
+  end
+
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb b/puppet/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb
new file mode 100755
index 00000000..45401a42
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_ipv4_address_spec.rb
@@ -0,0 +1,64 @@
+#! /usr/bin/env ruby -S rspec
+
+require "spec_helper"
+
+describe Puppet::Parser::Functions.function(:validate_ipv4_address) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  describe "when calling validate_ipv4_address from puppet" do
+    describe "when given IPv4 address strings" do
+      it "should compile with one argument" do
+        Puppet[:code] = "validate_ipv4_address('1.2.3.4')"
+        scope.compiler.compile
+      end
+
+      it "should compile with multiple arguments" do
+        Puppet[:code] = "validate_ipv4_address('1.2.3.4', '5.6.7.8')"
+        scope.compiler.compile
+      end
+    end
+
+    describe "when given an IPv6 address" do
+      it "should not compile" do
+        Puppet[:code] = "validate_ipv4_address('3ffe:505')"
+        expect {
+          scope.compiler.compile
+        }.to raise_error(Puppet::ParseError, /not a valid IPv4 address/)
+      end
+    end
+
+    describe "when given other strings" do
+      it "should not compile" do
+        Puppet[:code] = "validate_ipv4_address('hello', 'world')"
+        expect {
+          scope.compiler.compile
+        }.to raise_error(Puppet::ParseError, /not a valid IPv4 address/)
+      end
+    end
+
+    describe "when given numbers" do
+      it "should not compile" do
+        Puppet[:code] = "validate_ipv4_address(1, 2)"
+        expect {
+          scope.compiler.compile
+        }.to raise_error(Puppet::ParseError, /is not a valid IPv4 address/)
+      end
+    end
+
+    describe "when given booleans" do
+      it "should not compile" do
+        Puppet[:code] = "validate_ipv4_address(true, false)"
+        expect {
+          scope.compiler.compile
+        }.to raise_error(Puppet::ParseError, /is not a string/)
+      end
+    end
+
+    it "should not compile when no arguments are passed" do
+      Puppet[:code] = "validate_ipv4_address()"
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb b/puppet/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb
new file mode 100755
index 00000000..a839d902
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_ipv6_address_spec.rb
@@ -0,0 +1,67 @@
+#! /usr/bin/env ruby -S rspec
+
+require "spec_helper"
+
+describe Puppet::Parser::Functions.function(:validate_ipv6_address) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  describe "when calling validate_ipv6_address from puppet" do
+    describe "when given IPv6 address strings" do
+      it "should compile with one argument" do
+        Puppet[:code] = "validate_ipv6_address('3ffe:0505:0002::')"
+        scope.compiler.compile
+      end
+
+      it "should compile with multiple arguments" do
+        Puppet[:code] = "validate_ipv6_address('3ffe:0505:0002::', '3ffe:0505:0001::')"
+        scope.compiler.compile
+      end
+    end
+
+    describe "when given an ipv4 address" do
+      it "should not compile" do
+        Puppet[:code] = "validate_ipv6_address('1.2.3.4')"
+        expect {
+          scope.compiler.compile
+        }.to raise_error(Puppet::ParseError, /not a valid IPv6 address/)
+      end
+    end
+
+    describe "when given other strings" do
+      it "should not compile" do
+        Puppet[:code] = "validate_ipv6_address('hello', 'world')"
+        expect {
+          scope.compiler.compile
+        }.to raise_error(Puppet::ParseError, /not a valid IPv6 address/)
+      end
+    end
+
+    # 1.8.7 is EOL'd and also absolutely insane about ipv6
+    unless RUBY_VERSION == '1.8.7'
+      describe "when given numbers" do
+        it "should not compile" do
+          Puppet[:code] = "validate_ipv6_address(1, 2)"
+          expect {
+            scope.compiler.compile
+          }.to raise_error(Puppet::ParseError, /not a valid IPv6 address/)
+        end
+      end
+    end
+
+    describe "when given booleans" do
+      it "should not compile" do
+        Puppet[:code] = "validate_ipv6_address(true, false)"
+        expect {
+          scope.compiler.compile
+        }.to raise_error(Puppet::ParseError, /is not a string/)
+      end
+    end
+
+    it "should not compile when no arguments are passed" do
+      Puppet[:code] = "validate_ipv6_address()"
+      expect {
+        scope.compiler.compile
+      }.to raise_error(Puppet::ParseError, /wrong number of arguments/)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_re_spec.rb b/puppet/modules/stdlib/spec/functions/validate_re_spec.rb
new file mode 100755
index 00000000..d29988bf
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_re_spec.rb
@@ -0,0 +1,77 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:validate_re) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  # The subject of these examplres is the method itself.
+  subject do
+    # This makes sure the function is loaded within each test
+    function_name = Puppet::Parser::Functions.function(:validate_re)
+    scope.method(function_name)
+  end
+
+  context 'Using Puppet::Parser::Scope.new' do
+
+    describe 'Garbage inputs' do
+      inputs = [
+        [ nil ],
+        [ [ nil ] ],
+        [ { 'foo' => 'bar' } ],
+        [ { } ],
+        [ '' ],
+        [ "one", "one", "MSG to User", "4th arg" ],
+      ]
+
+      inputs.each do |input|
+        it "validate_re(#{input.inspect}) should fail" do
+          expect { subject.call [input] }.to raise_error Puppet::ParseError
+        end
+      end
+    end
+
+    describe 'Valid inputs' do
+      inputs = [
+        [ '/full/path/to/something', '^/full' ],
+        [ '/full/path/to/something', 'full' ],
+        [ '/full/path/to/something', ['full', 'absent'] ],
+        [ '/full/path/to/something', ['full', 'absent'], 'Message to the user' ],
+      ]
+
+      inputs.each do |input|
+        it "validate_re(#{input.inspect}) should not fail" do
+          expect { subject.call input }.not_to raise_error
+        end
+      end
+    end
+    describe "Valid inputs which should raise an exception without a message" do
+      # The intent here is to make sure valid inputs raise exceptions when they
+      # don't specify an error message to display.  This is the behvior in
+      # 2.2.x and prior.
+      inputs = [
+        [ "hello", [ "bye", "later", "adios" ] ],
+        [ "greetings", "salutations" ],
+      ]
+
+      inputs.each do |input|
+        it "validate_re(#{input.inspect}) should fail" do
+          expect { subject.call input }.to raise_error /validate_re.*?does not match/
+        end
+      end
+    end
+    describe "Nicer Error Messages" do
+      # The intent here is to make sure the function returns the 3rd argument
+      # in the exception thrown
+      inputs = [
+        [ "hello", [ "bye", "later", "adios" ], "MSG to User" ],
+        [ "greetings", "salutations", "Error, greetings does not match salutations" ],
+      ]
+
+      inputs.each do |input|
+        it "validate_re(#{input.inspect}) should fail" do
+          expect { subject.call input }.to raise_error /#{input[2]}/
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_slength_spec.rb b/puppet/modules/stdlib/spec/functions/validate_slength_spec.rb
new file mode 100755
index 00000000..e23f61a2
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_slength_spec.rb
@@ -0,0 +1,67 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe "the validate_slength function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("validate_slength")).to eq("function_validate_slength")
+  end
+
+  describe "validating the input argument types" do
+    it "raises an error if there are less than two arguments" do
+      expect { scope.function_validate_slength([]) }.to raise_error Puppet::ParseError, /Wrong number of arguments/
+    end
+
+    it "raises an error if there are more than three arguments" do
+      expect { scope.function_validate_slength(['input', 1, 2, 3]) }.to raise_error Puppet::ParseError, /Wrong number of arguments/
+    end
+
+    it "raises an error if the first argument is not a string" do
+      expect { scope.function_validate_slength([Object.new, 2, 1]) }.to raise_error Puppet::ParseError, /Expected first argument.*got .*Object/
+    end
+
+    it "raises an error if the second argument cannot be cast to an Integer" do
+      expect { scope.function_validate_slength(['input', Object.new]) }.to raise_error Puppet::ParseError, /Expected second argument.*got .*Object/
+    end
+
+    it "raises an error if the third argument cannot be cast to an Integer" do
+      expect { scope.function_validate_slength(['input', 1, Object.new]) }.to raise_error Puppet::ParseError, /Expected third argument.*got .*Object/
+    end
+
+    it "raises an error if the second argument is smaller than the third argument" do
+      expect { scope.function_validate_slength(['input', 1, 2]) }.to raise_error Puppet::ParseError, /Expected second argument to be larger than third argument/
+    end
+  end
+
+  describe "validating the input string length" do
+    describe "when the input is a string" do
+      it "fails validation if the string is larger than the max length" do
+        expect { scope.function_validate_slength(['input', 1]) }.to raise_error Puppet::ParseError, /Expected length .* between 0 and 1, was 5/
+      end
+
+      it "fails validation if the string is less than the min length" do
+        expect { scope.function_validate_slength(['input', 10, 6]) }.to raise_error Puppet::ParseError, /Expected length .* between 6 and 10, was 5/
+      end
+
+      it "doesn't raise an error if the string is under the max length" do
+        scope.function_validate_slength(['input', 10])
+      end
+
+      it "doesn't raise an error if the string is equal to the max length" do
+        scope.function_validate_slength(['input', 5])
+      end
+
+      it "doesn't raise an error if the string is equal to the min length" do
+        scope.function_validate_slength(['input', 10, 5])
+      end
+    end
+
+    describe "when the input is an array" do
+      it "fails validation if one of the array elements is not a string" do
+        expect { scope.function_validate_slength([["a", "b", Object.new], 2]) }.to raise_error Puppet::ParseError, /Expected element at array position 2 .*String, got .*Object/
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/validate_string_spec.rb b/puppet/modules/stdlib/spec/functions/validate_string_spec.rb
new file mode 100755
index 00000000..3b4fb3e1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/validate_string_spec.rb
@@ -0,0 +1,60 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+describe Puppet::Parser::Functions.function(:validate_string) do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  describe 'when calling validate_string from puppet' do
+
+    %w{ foo bar baz }.each do |the_string|
+
+      it "should compile when #{the_string} is a string" do
+        Puppet[:code] = "validate_string('#{the_string}')"
+        scope.compiler.compile
+      end
+
+      it "should compile when #{the_string} is a bare word" do
+        Puppet[:code] = "validate_string(#{the_string})"
+        scope.compiler.compile
+      end
+
+    end
+
+    %w{ true false }.each do |the_string|
+      it "should compile when #{the_string} is a string" do
+        Puppet[:code] = "validate_string('#{the_string}')"
+        scope.compiler.compile
+      end
+
+      it "should not compile when #{the_string} is a bare word" do
+        Puppet[:code] = "validate_string(#{the_string})"
+        expect { scope.compiler.compile }.to raise_error(Puppet::ParseError, /is not a string/)
+      end
+    end
+
+    it "should compile when multiple string arguments are passed" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        $foo = ''
+        $bar = 'two'
+        validate_string($foo, $bar)
+      ENDofPUPPETcode
+      scope.compiler.compile
+    end
+
+    it "should compile when an explicitly undef variable is passed (NOTE THIS MAY NOT BE DESIRABLE)" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        $foo = undef
+        validate_string($foo)
+      ENDofPUPPETcode
+      scope.compiler.compile
+    end
+
+    it "should compile when an undefined variable is passed (NOTE THIS MAY NOT BE DESIRABLE)" do
+      Puppet[:code] = <<-'ENDofPUPPETcode'
+        validate_string($foobarbazishouldnotexist)
+      ENDofPUPPETcode
+      scope.compiler.compile
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/values_at_spec.rb b/puppet/modules/stdlib/spec/functions/values_at_spec.rb
new file mode 100755
index 00000000..86e3c31c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/values_at_spec.rb
@@ -0,0 +1,38 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the values_at function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("values_at")).to eq("function_values_at")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_values_at([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if you try to use a range where stop is greater then start" do
+    expect { scope.function_values_at([['a','b'],["3-1"]]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return a value at from an array" do
+    result = scope.function_values_at([['a','b','c'],"1"])
+    expect(result).to(eq(['b']))
+  end
+
+  it "should return a value at from an array when passed a range" do
+    result = scope.function_values_at([['a','b','c'],"0-1"])
+    expect(result).to(eq(['a','b']))
+  end
+
+  it "should return chosen values from an array when passed number of indexes" do
+    result = scope.function_values_at([['a','b','c'],["0","2"]])
+    expect(result).to(eq(['a','c']))
+  end
+
+  it "should return chosen values from an array when passed ranges and multiple indexes" do
+    result = scope.function_values_at([['a','b','c','d','e','f','g'],["0","2","4-5"]])
+    expect(result).to(eq(['a','c','e','f']))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/values_spec.rb b/puppet/modules/stdlib/spec/functions/values_spec.rb
new file mode 100755
index 00000000..08d21b03
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/values_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the values function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("values")).to eq("function_values")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_values([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should return values from a hash" do
+    result = scope.function_values([{'a'=>'1','b'=>'2','c'=>'3'}])
+    # =~ is the RSpec::Matchers::MatchArray matcher.
+    # A.K.A. "array with same elements" (multiset) matching
+    expect(result).to match_array(%w{ 1 2 3 })
+  end
+
+  it "should return a multiset" do
+    result = scope.function_values([{'a'=>'1','b'=>'3','c'=>'3'}])
+    expect(result).to     match_array(%w{ 1 3 3 })
+    expect(result).not_to match_array(%w{ 1 3 })
+  end
+
+  it "should raise a ParseError unless a Hash is provided" do
+    expect { scope.function_values([['a','b','c']]) }.to( raise_error(Puppet::ParseError))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/functions/zip_spec.rb b/puppet/modules/stdlib/spec/functions/zip_spec.rb
new file mode 100755
index 00000000..f265fcee
--- /dev/null
+++ b/puppet/modules/stdlib/spec/functions/zip_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the zip function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_zip([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should be able to zip an array" do
+    result = scope.function_zip([['1','2','3'],['4','5','6']])
+    expect(result).to(eq([["1", "4"], ["2", "5"], ["3", "6"]]))
+    result = scope.function_zip([['1','2','3'],['4','5','6'], false])
+    result.should(eq([["1", "4"], ["2", "5"], ["3", "6"]]))
+  end
+
+  it "should be able to zip an array and flatten" do
+    result = scope.function_zip([['1','2','3'],['4','5','6'], true])
+    result.should(eq(["1", "4", "2", "5", "3", "6"]))
+  end
+
+  it "should accept objects which extend String for the second argument" do
+    class AlsoString < String
+    end
+
+    value = AlsoString.new('false')
+    result = scope.function_zip([['1','2','3'],['4','5','6'],value])
+    result.should(eq([["1", "4"], ["2", "5"], ["3", "6"]]))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/compiler.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/compiler.rb
new file mode 100755
index 00000000..2f0ae4d7
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/compiler.rb
@@ -0,0 +1,47 @@
+#! /usr/bin/env ruby -S rspec
+module PuppetSpec::Compiler
+  def compile_to_catalog(string, node = Puppet::Node.new('foonode'))
+    Puppet[:code] = string
+    Puppet::Parser::Compiler.compile(node)
+  end
+
+  def compile_to_ral(manifest)
+    catalog = compile_to_catalog(manifest)
+    ral = catalog.to_ral
+    ral.finalize
+    ral
+  end
+
+  def compile_to_relationship_graph(manifest, prioritizer = Puppet::Graph::SequentialPrioritizer.new)
+    ral = compile_to_ral(manifest)
+    graph = Puppet::Graph::RelationshipGraph.new(prioritizer)
+    graph.populate_from(ral)
+    graph
+  end
+
+  if Puppet.version.to_f >= 3.3
+    def apply_compiled_manifest(manifest, prioritizer = Puppet::Graph::SequentialPrioritizer.new)
+      transaction = Puppet::Transaction.new(compile_to_ral(manifest),
+                                          Puppet::Transaction::Report.new("apply"),
+                                          prioritizer)
+      transaction.evaluate
+      transaction.report.finalize_report
+
+      transaction
+    end
+  else
+    def apply_compiled_manifest(manifest)
+      transaction = Puppet::Transaction.new(compile_to_ral(manifest), Puppet::Transaction::Report.new("apply"))
+      transaction.evaluate
+      transaction.report.finalize_report
+
+      transaction
+    end
+  end
+
+  def order_resources_traversed_in(relationships)
+    order_seen = []
+    relationships.traverse { |resource| order_seen << resource.ref }
+    order_seen
+  end
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/database.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/database.rb
new file mode 100755
index 00000000..f5c23417
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/database.rb
@@ -0,0 +1,30 @@
+#! /usr/bin/env ruby -S rspec
+# This just makes some nice things available at global scope, and for setup of
+# tests to use a real fake database, rather than a fake stubs-that-don't-work
+# version of the same.  Fun times.
+def sqlite?
+  if $sqlite.nil?
+    begin
+      require 'sqlite3'
+      $sqlite = true
+    rescue LoadError
+      $sqlite = false
+    end
+  end
+  $sqlite
+end
+
+def can_use_scratch_database?
+  sqlite? and Puppet.features.rails?
+end
+
+
+# This is expected to be called in your `before :each` block, and will get you
+# ready to roll with a serious database and all.  Cleanup is handled
+# automatically for you.  Nothing to do there.
+def setup_scratch_database
+  Puppet[:dbadapter] = 'sqlite3'
+  Puppet[:dblocation] = ':memory:'
+  Puppet[:railslog] = PuppetSpec::Files.tmpfile('storeconfigs.log')
+  Puppet::Rails.init
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/files.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/files.rb
new file mode 100755
index 00000000..71b38ffe
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/files.rb
@@ -0,0 +1,61 @@
+#! /usr/bin/env ruby -S rspec
+require 'fileutils'
+require 'tempfile'
+require 'tmpdir'
+require 'pathname'
+
+# A support module for testing files.
+module PuppetSpec::Files
+  def self.cleanup
+    $global_tempfiles ||= []
+    while path = $global_tempfiles.pop do
+      begin
+        Dir.unstub(:entries)
+        FileUtils.rm_rf path, :secure => true
+      rescue Errno::ENOENT
+        # nothing to do
+      end
+    end
+  end
+
+  def make_absolute(path) PuppetSpec::Files.make_absolute(path) end
+  def self.make_absolute(path)
+    path = File.expand_path(path)
+    path[0] = 'c' if Puppet.features.microsoft_windows?
+    path
+  end
+
+  def tmpfile(name, dir = nil) PuppetSpec::Files.tmpfile(name, dir) end
+  def self.tmpfile(name, dir = nil)
+    # Generate a temporary file, just for the name...
+    source = dir ? Tempfile.new(name, dir) : Tempfile.new(name)
+    path = source.path
+    source.close!
+
+    record_tmp(File.expand_path(path))
+
+    path
+  end
+
+  def file_containing(name, contents) PuppetSpec::Files.file_containing(name, contents) end
+  def self.file_containing(name, contents)
+    file = tmpfile(name)
+    File.open(file, 'wb') { |f| f.write(contents) }
+    file
+  end
+
+  def tmpdir(name) PuppetSpec::Files.tmpdir(name) end
+  def self.tmpdir(name)
+    dir = Dir.mktmpdir(name)
+
+    record_tmp(dir)
+
+    dir
+  end
+
+  def self.record_tmp(tmp)
+    # ...record it for cleanup,
+    $global_tempfiles ||= []
+    $global_tempfiles << tmp
+  end
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/fixtures.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/fixtures.rb
new file mode 100755
index 00000000..81e9775f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/fixtures.rb
@@ -0,0 +1,29 @@
+#! /usr/bin/env ruby -S rspec
+module PuppetSpec::Fixtures
+  def fixtures(*rest)
+    File.join(PuppetSpec::FIXTURE_DIR, *rest)
+  end
+  def my_fixture_dir
+    callers = caller
+    while line = callers.shift do
+      next unless found = line.match(%r{/spec/(.*)_spec\.rb:})
+      return fixtures(found[1])
+    end
+    fail "sorry, I couldn't work out your path from the caller stack!"
+  end
+  def my_fixture(name)
+    file = File.join(my_fixture_dir, name)
+    unless File.readable? file then
+      fail Puppet::DevError, "fixture '#{name}' for #{my_fixture_dir} is not readable"
+    end
+    return file
+  end
+  def my_fixtures(glob = '*', flags = 0)
+    files = Dir.glob(File.join(my_fixture_dir, glob), flags)
+    unless files.length > 0 then
+      fail Puppet::DevError, "fixture '#{glob}' for #{my_fixture_dir} had no files!"
+    end
+    block_given? and files.each do |file| yield file end
+    files
+  end
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/matchers.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/matchers.rb
new file mode 100755
index 00000000..093d77c8
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/matchers.rb
@@ -0,0 +1,121 @@
+#! /usr/bin/env ruby -S rspec
+require 'stringio'
+
+########################################################################
+# Backward compatibility for Jenkins outdated environment.
+module RSpec
+  module Matchers
+    module BlockAliases
+      alias_method :to,     :should      unless method_defined? :to
+      alias_method :to_not, :should_not  unless method_defined? :to_not
+      alias_method :not_to, :should_not  unless method_defined? :not_to
+    end
+  end
+end
+
+
+########################################################################
+# Custom matchers...
+RSpec::Matchers.define :have_matching_element do |expected|
+  match do |actual|
+    actual.any? { |item| item =~ expected }
+  end
+end
+
+
+RSpec::Matchers.define :exit_with do |expected|
+  actual = nil
+  match do |block|
+    begin
+      block.call
+    rescue SystemExit => e
+      actual = e.status
+    end
+    actual and actual == expected
+  end
+  failure_message_for_should do |block|
+    "expected exit with code #{expected} but " +
+      (actual.nil? ? " exit was not called" : "we exited with #{actual} instead")
+  end
+  failure_message_for_should_not do |block|
+    "expected that exit would not be called with #{expected}"
+  end
+  description do
+    "expect exit with #{expected}"
+  end
+end
+
+class HavePrintedMatcher
+  attr_accessor :expected, :actual
+
+  def initialize(expected)
+    case expected
+    when String, Regexp
+      @expected = expected
+    else
+      @expected = expected.to_s
+    end
+  end
+
+  def matches?(block)
+    begin
+      $stderr = $stdout = StringIO.new
+      $stdout.set_encoding('UTF-8') if $stdout.respond_to?(:set_encoding)
+      block.call
+      $stdout.rewind
+      @actual = $stdout.read
+    ensure
+      $stdout = STDOUT
+      $stderr = STDERR
+    end
+
+    if @actual then
+      case @expected
+      when String
+        @actual.include? @expected
+      when Regexp
+        @expected.match @actual
+      end
+    else
+      false
+    end
+  end
+
+  def failure_message_for_should
+    if @actual.nil? then
+      "expected #{@expected.inspect}, but nothing was printed"
+    else
+      "expected #{@expected.inspect} to be printed; got:\n#{@actual}"
+    end
+  end
+
+  def failure_message_for_should_not
+    "expected #{@expected.inspect} to not be printed; got:\n#{@actual}"
+  end
+
+  def description
+    "expect #{@expected.inspect} to be printed"
+  end
+end
+
+def have_printed(what)
+  HavePrintedMatcher.new(what)
+end
+
+RSpec::Matchers.define :equal_attributes_of do |expected|
+  match do |actual|
+    actual.instance_variables.all? do |attr|
+      actual.instance_variable_get(attr) == expected.instance_variable_get(attr)
+    end
+  end
+end
+
+RSpec::Matchers.define :be_one_of do |*expected|
+  match do |actual|
+    expected.include? actual
+  end
+
+  failure_message_for_should do |actual|
+    "expected #{actual.inspect} to be one of #{expected.map(&:inspect).join(' or ')}"
+  end
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/modules.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/modules.rb
new file mode 100755
index 00000000..910c6d94
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/modules.rb
@@ -0,0 +1,27 @@
+#! /usr/bin/env ruby -S rspec
+module PuppetSpec::Modules
+  class << self
+    def create(name, dir, options = {})
+      module_dir = File.join(dir, name)
+      FileUtils.mkdir_p(module_dir)
+
+      environment = options[:environment]
+
+      if metadata = options[:metadata]
+        metadata[:source]  ||= 'github'
+        metadata[:author]  ||= 'puppetlabs'
+        metadata[:version] ||= '9.9.9'
+        metadata[:license] ||= 'to kill'
+        metadata[:dependencies] ||= []
+
+        metadata[:name] = "#{metadata[:author]}/#{name}"
+
+        File.open(File.join(module_dir, 'metadata.json'), 'w') do |f|
+          f.write(metadata.to_pson)
+        end
+      end
+
+      Puppet::Module.new(name, module_dir, environment)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/pops.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/pops.rb
new file mode 100755
index 00000000..e056a52b
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/pops.rb
@@ -0,0 +1,17 @@
+#! /usr/bin/env ruby -S rspec
+module PuppetSpec::Pops
+  extend RSpec::Matchers::DSL
+
+  # Checks if an Acceptor has a specific issue in its list of diagnostics
+  matcher :have_issue do |expected|
+    match do |actual|
+      actual.diagnostics.index { |i| i.issue == expected } != nil
+    end
+    failure_message_for_should do |actual|
+      "expected Acceptor[#{actual.diagnostics.collect { |i| i.issue.issue_code }.join(',')}] to contain issue #{expected.issue_code}"
+    end
+    failure_message_for_should_not do |actual|
+      "expected Acceptor[#{actual.diagnostics.collect { |i| i.issue.issue_code }.join(',')}] to not contain issue #{expected.issue_code}"
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/scope.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/scope.rb
new file mode 100755
index 00000000..3847ede1
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/scope.rb
@@ -0,0 +1,15 @@
+#! /usr/bin/env ruby -S rspec
+
+module PuppetSpec::Scope
+  # Initialize a new scope suitable for testing.
+  #
+  def create_test_scope_for_node(node_name)
+    node = Puppet::Node.new(node_name)
+    compiler = Puppet::Parser::Compiler.new(node)
+    scope = Puppet::Parser::Scope.new(compiler)
+    scope.source = Puppet::Resource::Type.new(:node, node_name)
+    scope.parent = compiler.topscope
+    scope
+  end
+
+end
\ No newline at end of file
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/settings.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/settings.rb
new file mode 100755
index 00000000..8ddcb975
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/settings.rb
@@ -0,0 +1,16 @@
+#! /usr/bin/env ruby -S rspec
+module PuppetSpec::Settings
+
+  # It would probably be preferable to refactor defaults.rb such that the real definitions of
+  #  these settings were available as a variable, which was then accessible for use during tests.
+  #  However, I'm not doing that yet because I don't want to introduce any additional moving parts
+  #  to this already very large changeset.
+  #  Would be nice to clean this up later.  --cprice 2012-03-20
+  TEST_APP_DEFAULT_DEFINITIONS = {
+    :name         => { :default => "test", :desc => "name" },
+    :logdir       => { :type => :directory, :default => "test", :desc => "logdir" },
+    :confdir      => { :type => :directory, :default => "test", :desc => "confdir" },
+    :vardir       => { :type => :directory, :default => "test", :desc => "vardir" },
+    :rundir       => { :type => :directory, :default => "test", :desc => "rundir" },
+  }
+end
diff --git a/puppet/modules/stdlib/spec/lib/puppet_spec/verbose.rb b/puppet/modules/stdlib/spec/lib/puppet_spec/verbose.rb
new file mode 100755
index 00000000..b2683df0
--- /dev/null
+++ b/puppet/modules/stdlib/spec/lib/puppet_spec/verbose.rb
@@ -0,0 +1,10 @@
+#! /usr/bin/env ruby -S rspec
+# Support code for running stuff with warnings disabled.
+module Kernel
+  def with_verbose_disabled
+    verbose, $VERBOSE = $VERBOSE, nil
+    result = yield
+    $VERBOSE = verbose
+    return result
+  end
+end
diff --git a/puppet/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb b/puppet/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb
new file mode 100755
index 00000000..505e2409
--- /dev/null
+++ b/puppet/modules/stdlib/spec/monkey_patches/alias_should_to_must.rb
@@ -0,0 +1,9 @@
+#! /usr/bin/env ruby -S rspec
+require 'rspec'
+
+class Object
+  # This is necessary because the RAL has a 'should'
+  # method.
+  alias :must :should
+  alias :must_not :should_not
+end
diff --git a/puppet/modules/stdlib/spec/monkey_patches/publicize_methods.rb b/puppet/modules/stdlib/spec/monkey_patches/publicize_methods.rb
new file mode 100755
index 00000000..3ae59f97
--- /dev/null
+++ b/puppet/modules/stdlib/spec/monkey_patches/publicize_methods.rb
@@ -0,0 +1,11 @@
+#! /usr/bin/env ruby -S rspec
+# Some monkey-patching to allow us to test private methods.
+class Class
+    def publicize_methods(*methods)
+        saved_private_instance_methods = methods.empty? ? self.private_instance_methods : methods
+
+        self.class_eval { public(*saved_private_instance_methods) }
+        yield
+        self.class_eval { private(*saved_private_instance_methods) }
+    end
+end
diff --git a/puppet/modules/stdlib/spec/spec.opts b/puppet/modules/stdlib/spec/spec.opts
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/stdlib/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/stdlib/spec/spec_helper.rb b/puppet/modules/stdlib/spec/spec_helper.rb
new file mode 100755
index 00000000..b490ca3c
--- /dev/null
+++ b/puppet/modules/stdlib/spec/spec_helper.rb
@@ -0,0 +1,34 @@
+#! /usr/bin/env ruby -S rspec
+dir = File.expand_path(File.dirname(__FILE__))
+$LOAD_PATH.unshift File.join(dir, 'lib')
+
+# So everyone else doesn't have to include this base constant.
+module PuppetSpec
+  FIXTURE_DIR = File.join(dir = File.expand_path(File.dirname(__FILE__)), "fixtures") unless defined?(FIXTURE_DIR)
+end
+
+require 'puppet'
+require 'rspec-puppet'
+require 'puppetlabs_spec_helper/module_spec_helper'
+require 'puppet_spec/verbose'
+require 'puppet_spec/files'
+require 'puppet_spec/settings'
+require 'puppet_spec/fixtures'
+require 'puppet_spec/matchers'
+require 'puppet_spec/database'
+require 'monkey_patches/alias_should_to_must'
+require 'mocha/setup'
+
+
+
+RSpec.configure do |config|
+  config.before :each do
+    # Ensure that we don't accidentally cache facts and environment between
+    # test cases.  This requires each example group to explicitly load the
+    # facts being exercised with something like
+    # Facter.collection.loader.load(:ipaddress)
+    Facter::Util::Loader.any_instance.stubs(:load_all)
+    Facter.clear
+    Facter.clear_messages
+  end
+end
diff --git a/puppet/modules/stdlib/spec/spec_helper_acceptance.rb b/puppet/modules/stdlib/spec/spec_helper_acceptance.rb
new file mode 100755
index 00000000..3203ce9f
--- /dev/null
+++ b/puppet/modules/stdlib/spec/spec_helper_acceptance.rb
@@ -0,0 +1,50 @@
+#! /usr/bin/env ruby -S rspec
+require 'beaker-rspec'
+
+UNSUPPORTED_PLATFORMS = []
+
+unless ENV['RS_PROVISION'] == 'no' or ENV['BEAKER_provision'] == 'no'
+  foss_opts = {
+    :default_action => 'gem_install',
+    :version        => (ENV['PUPPET_VERSION'] ? ENV['PUPPET_VERSION'] : '3.7.2'),
+  }
+
+  if default.is_pe?; then install_pe; else install_puppet( foss_opts ); end
+
+  hosts.each do |host|
+    if host['platform'] !~ /windows/i
+      if host.is_pe?
+        on host, 'mkdir -p /etc/puppetlabs/facter/facts.d'
+      else
+        on host, "/bin/touch #{host['puppetpath']}/hiera.yaml"
+        on host, "mkdir -p #{host['distmoduledir']}"
+        on host, 'mkdir -p /etc/facter/facts.d'
+      end
+    end
+  end
+end
+
+RSpec.configure do |c|
+  # Project root
+  proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+
+  # Readable test descriptions
+  c.formatter = :documentation
+
+  # Configure all nodes in nodeset
+  c.before :suite do
+    if ENV['FUTURE_PARSER'] == 'true'
+      default[:default_apply_opts] ||= {}
+      default[:default_apply_opts].merge!({:parser => 'future'})
+    end
+
+    copy_root_module_to(default, :source => proj_root, :module_name => 'stdlib')
+  end
+end
+
+def is_future_parser_enabled?
+  if default[:default_apply_opts]
+    return default[:default_apply_opts][:parser] == 'future'
+  end
+  return false
+end
diff --git a/puppet/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb b/puppet/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb
new file mode 100755
index 00000000..0afadb25
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/facter/facter_dot_d_spec.rb
@@ -0,0 +1,32 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'facter/facter_dot_d'
+
+describe Facter::Util::DotD do
+
+  context 'returns a simple fact' do
+    before :each do
+      Facter.stubs(:version).returns('1.6.1')
+      subject.stubs(:entries).returns(['/etc/facter/facts.d/fake_fact.txt'])
+      File.stubs(:readlines).with('/etc/facter/facts.d/fake_fact.txt').returns(['fake_fact=fake fact'])
+      subject.create
+    end
+
+    it 'should return successfully' do
+      expect(Facter.fact(:fake_fact).value).to eq('fake fact')
+    end
+  end
+
+  context 'returns a fact with equals signs' do
+    before :each do
+      Facter.stubs(:version).returns('1.6.1')
+      subject.stubs(:entries).returns(['/etc/facter/facts.d/foo.txt'])
+      File.stubs(:readlines).with('/etc/facter/facts.d/foo.txt').returns(['foo=1+1=2'])
+      subject.create
+    end
+
+    it 'should return successfully' do
+      expect(Facter.fact(:foo).value).to eq('1+1=2')
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/facter/pe_version_spec.rb b/puppet/modules/stdlib/spec/unit/facter/pe_version_spec.rb
new file mode 100755
index 00000000..4d0349e6
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/facter/pe_version_spec.rb
@@ -0,0 +1,76 @@
+#!/usr/bin/env rspec
+
+require 'spec_helper'
+
+describe "PE Version specs" do
+  before :each do
+    # Explicitly load the pe_version.rb file which contains generated facts
+    # that cannot be automatically loaded.  Puppet 2.x implements
+    # Facter.collection.load while Facter 1.x markes Facter.collection.load as
+    # a private method.
+    if Facter.collection.respond_to? :load
+      Facter.collection.load(:pe_version)
+    else
+      Facter.collection.loader.load(:pe_version)
+    end
+  end
+
+  context "If PE is installed" do
+    %w{ 2.6.1 2.10.300 }.each do |version|
+      puppetversion = "2.7.19 (Puppet Enterprise #{version})"
+      context "puppetversion => #{puppetversion}" do
+        before :each do
+          Facter.fact(:puppetversion).stubs(:value).returns(puppetversion)
+        end
+
+        (major,minor,patch) = version.split(".")
+
+        it "Should return true" do
+          expect(Facter.fact(:is_pe).value).to eq(true)
+        end
+
+        it "Should have a version of #{version}" do
+          expect(Facter.fact(:pe_version).value).to eq(version)
+        end
+
+        it "Should have a major version of #{major}" do
+          expect(Facter.fact(:pe_major_version).value).to eq(major)
+        end
+
+        it "Should have a minor version of #{minor}" do
+          expect(Facter.fact(:pe_minor_version).value).to eq(minor)
+        end
+
+        it "Should have a patch version of #{patch}" do
+          expect(Facter.fact(:pe_patch_version).value).to eq(patch)
+        end
+      end
+    end
+  end
+
+  context "When PE is not installed" do
+    before :each do
+      Facter.fact(:puppetversion).stubs(:value).returns("2.7.19")
+    end
+
+    it "is_pe is false" do
+      expect(Facter.fact(:is_pe).value).to eq(false)
+    end
+
+    it "pe_version is nil" do
+      expect(Facter.fact(:pe_version).value).to be_nil
+    end
+
+    it "pe_major_version is nil" do
+      expect(Facter.fact(:pe_major_version).value).to be_nil
+    end
+
+    it "pe_minor_version is nil" do
+      expect(Facter.fact(:pe_minor_version).value).to be_nil
+    end
+
+    it "Should have a patch version" do
+      expect(Facter.fact(:pe_patch_version).value).to be_nil
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/facter/root_home_spec.rb b/puppet/modules/stdlib/spec/unit/facter/root_home_spec.rb
new file mode 100755
index 00000000..98fe1419
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/facter/root_home_spec.rb
@@ -0,0 +1,52 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'facter/root_home'
+
+describe Facter::Util::RootHome do
+  context "solaris" do
+    let(:root_ent) { "root:x:0:0:Super-User:/:/sbin/sh" }
+    let(:expected_root_home) { "/" }
+
+    it "should return /" do
+      Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(root_ent)
+      expect(Facter::Util::RootHome.get_root_home).to eq(expected_root_home)
+    end
+  end
+  context "linux" do
+    let(:root_ent) { "root:x:0:0:root:/root:/bin/bash" }
+    let(:expected_root_home) { "/root" }
+
+    it "should return /root" do
+      Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(root_ent)
+      expect(Facter::Util::RootHome.get_root_home).to eq(expected_root_home)
+    end
+  end
+  context "windows" do
+    before :each do
+      Facter::Util::Resolution.expects(:exec).with("getent passwd root").returns(nil)
+    end
+    it "should be nil on windows" do
+      expect(Facter::Util::RootHome.get_root_home).to be_nil
+    end
+  end
+end
+
+describe 'root_home', :type => :fact do
+  before { Facter.clear }
+  after { Facter.clear }
+
+  context "macosx" do
+    before do
+      Facter.fact(:kernel).stubs(:value).returns("Darwin")
+      Facter.fact(:osfamily).stubs(:value).returns("Darwin")
+    end
+    let(:expected_root_home) { "/var/root" }
+    sample_dscacheutil = File.read(fixtures('dscacheutil','root'))
+
+    it "should return /var/root" do
+      Facter::Util::Resolution.stubs(:exec).with("dscacheutil -q user -a name root").returns(sample_dscacheutil)
+      expect(Facter.fact(:root_home).value).to eq(expected_root_home)
+    end
+  end
+
+end
diff --git a/puppet/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb b/puppet/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb
new file mode 100755
index 00000000..c06137d7
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/facter/util/puppet_settings_spec.rb
@@ -0,0 +1,36 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'facter/util/puppet_settings'
+
+describe Facter::Util::PuppetSettings do
+
+  describe "#with_puppet" do
+    context "Without Puppet loaded" do
+      before(:each) do
+        Module.expects(:const_get).with("Puppet").raises(NameError)
+      end
+
+      it 'should be nil' do
+        expect(subject.with_puppet { Puppet[:vardir] }).to be_nil
+      end
+      it 'should not yield to the block' do
+        Puppet.expects(:[]).never
+        expect(subject.with_puppet { Puppet[:vardir] }).to be_nil
+      end
+    end
+    context "With Puppet loaded" do
+      module Puppet; end
+      let(:vardir) { "/var/lib/puppet" }
+
+      before :each do
+        Puppet.expects(:[]).with(:vardir).returns vardir
+      end
+      it 'should yield to the block' do
+        subject.with_puppet { Puppet[:vardir] }
+      end
+      it 'should return the nodes vardir' do
+        expect(subject.with_puppet { Puppet[:vardir] }).to eq vardir
+      end
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/puppet/functions/type_of_spec.rb b/puppet/modules/stdlib/spec/unit/puppet/functions/type_of_spec.rb
new file mode 100644
index 00000000..8afb6246
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/puppet/functions/type_of_spec.rb
@@ -0,0 +1,33 @@
+#! /usr/bin/env ruby -S rspec
+
+require 'spec_helper'
+
+if ENV["FUTURE_PARSER"] == 'yes' or Puppet.version >= "4"
+  require 'puppet/pops'
+  require 'puppet/loaders'
+
+  describe 'the type_of function' do
+    before(:all) do
+      loaders = Puppet::Pops::Loaders.new(Puppet::Node::Environment.create(:testing, [File.join(fixtures, "modules")]))
+      Puppet.push_context({:loaders => loaders}, "test-examples")
+    end
+
+    after(:all) do
+      Puppet::Pops::Loaders.clear
+      Puppet::pop_context()
+    end
+
+    let(:func) do
+      # Load the function from the environment modulepath's modules (ie, fixtures)
+      Puppet.lookup(:loaders).private_environment_loader.load(:function, 'type_of')
+    end
+
+    it 'gives the type of a string' do
+      expect(func.call({}, 'hello world')).to be_kind_of(Puppet::Pops::Types::PStringType)
+    end
+
+    it 'gives the type of an integer' do
+      expect(func.call({}, 5)).to be_kind_of(Puppet::Pops::Types::PIntegerType)
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/puppet/parser/functions/basename_spec.rb b/puppet/modules/stdlib/spec/unit/puppet/parser/functions/basename_spec.rb
new file mode 100755
index 00000000..8a2d0dc3
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/puppet/parser/functions/basename_spec.rb
@@ -0,0 +1,46 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the basename function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    Puppet::Parser::Functions.function("basename").should == "function_basename"
+  end
+
+  it "should raise a ParseError if there is less than 1 argument" do
+    lambda { scope.function_basename([]) }.should( raise_error(Puppet::ParseError))
+  end
+
+  it "should raise a ParseError if there are more than 2 arguments" do
+    lambda { scope.function_basename(['a', 'b', 'c']) }.should( raise_error(Puppet::ParseError))
+  end
+
+  it "should return basename for an absolute path" do
+    result = scope.function_basename(['/path/to/a/file.ext'])
+    result.should(eq('file.ext'))
+  end
+
+  it "should return basename for a relative path" do
+    result = scope.function_basename(['path/to/a/file.ext'])
+    result.should(eq('file.ext'))
+  end
+
+  it "should strip extention when extension specified (absolute path)" do
+    result = scope.function_basename(['/path/to/a/file.ext', '.ext'])
+    result.should(eq('file'))
+  end
+
+  it "should strip extention when extension specified (relative path)" do
+    result = scope.function_basename(['path/to/a/file.ext', '.ext'])
+    result.should(eq('file'))
+  end
+
+  it "should complain about non-string first argument" do
+    lambda { scope.function_basename([[]]) }.should( raise_error(Puppet::ParseError))
+  end
+
+  it "should complain about non-string second argument" do
+    lambda { scope.function_basename(['/path/to/a/file.ext', []]) }.should( raise_error(Puppet::ParseError))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/puppet/parser/functions/bool2str_spec.rb b/puppet/modules/stdlib/spec/unit/puppet/parser/functions/bool2str_spec.rb
new file mode 100755
index 00000000..b8788918
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/puppet/parser/functions/bool2str_spec.rb
@@ -0,0 +1,46 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the bool2str function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("bool2str")).to eq("function_bool2str")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_bool2str([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should convert true to 'true'" do
+    result = scope.function_bool2str([true])
+    expect(result).to(eq('true'))
+  end
+
+  it "should convert true to a string" do
+    result = scope.function_bool2str([true])
+    expect(result.class).to(eq(String))
+  end
+
+  it "should convert false to 'false'" do
+    result = scope.function_bool2str([false])
+    expect(result).to(eq('false'))
+  end
+
+  it "should convert false to a string" do
+    result = scope.function_bool2str([false])
+    expect(result.class).to(eq(String))
+  end
+
+  it "should not accept a string" do
+    expect { scope.function_bool2str(["false"]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should not accept a nil value" do
+    expect { scope.function_bool2str([nil]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should not accept an undef" do
+    expect { scope.function_bool2str([:undef]) }.to( raise_error(Puppet::ParseError))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/puppet/parser/functions/camelcase_spec.rb b/puppet/modules/stdlib/spec/unit/puppet/parser/functions/camelcase_spec.rb
new file mode 100755
index 00000000..70382adb
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/puppet/parser/functions/camelcase_spec.rb
@@ -0,0 +1,24 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the camelcase function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    expect(Puppet::Parser::Functions.function("camelcase")).to eq("function_camelcase")
+  end
+
+  it "should raise a ParseError if there is less than 1 arguments" do
+    expect { scope.function_camelcase([]) }.to( raise_error(Puppet::ParseError))
+  end
+
+  it "should capitalize the beginning of a normal string" do
+    result = scope.function_camelcase(["abc"])
+    expect(result).to(eq("Abc"))
+  end
+
+  it "should camelcase an underscore-delimited string" do
+    result = scope.function_camelcase(["aa_bb_cc"])
+    expect(result).to(eq("AaBbCc"))
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/puppet/parser/functions/str2saltedsha1_spec.rb b/puppet/modules/stdlib/spec/unit/puppet/parser/functions/str2saltedsha1_spec.rb
new file mode 100644
index 00000000..753cb24a
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/puppet/parser/functions/str2saltedsha1_spec.rb
@@ -0,0 +1,45 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+
+describe "the str2saltedsha1 function" do
+  let(:scope) { PuppetlabsSpec::PuppetInternals.scope }
+
+  it "should exist" do
+    Puppet::Parser::Functions.function("str2saltedsha1").should == "function_str2saltedsha1"
+  end
+
+  it "should raise a ParseError if there is less than 1 argument" do
+    expect { scope.function_str2saltedsha1([]) }.should( raise_error(Puppet::ParseError) )
+  end
+
+  it "should raise a ParseError if there is more than 1 argument" do
+    expect { scope.function_str2saltedsha1(['foo', 'bar', 'baz']) }.should( raise_error(Puppet::ParseError) )
+  end
+
+  it "should return a salted-sha1 password hash 136 characters in length" do
+    result = scope.function_str2saltedsha1(["password"])
+    result.length.should(eq(136))
+  end
+
+  it "should raise an error if you pass a non-string password" do
+    expect { scope.function_str2saltedsha1([1234]) }.should( raise_error(Puppet::ParseError) )
+  end
+
+  it "should generate a valid password" do
+    # Allow the function to generate a password based on the string 'password'
+    password_hash = scope.function_str2saltedsha1(["password"])
+
+    # Separate the Salt and Password from the Password Hash
+    salt     = password_hash[0..7]
+    password = password_hash[8..-1]
+
+    # Convert the Salt and Password from Hex to Binary Data
+    str_salt     = Array(salt.lines).pack('H*')
+    str_password = Array(password.lines).pack('H*')
+
+    # Combine the Binary Salt with 'password' and compare the end result
+    saltedpass    = Digest::SHA1.digest(str_salt + 'password')
+    result        = (str_salt + saltedpass).unpack('H*')[0]
+    result.should == password_hash
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb b/puppet/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb
new file mode 100755
index 00000000..d2a129c3
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/puppet/provider/file_line/ruby_spec.rb
@@ -0,0 +1,225 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'tempfile'
+provider_class = Puppet::Type.type(:file_line).provider(:ruby)
+describe provider_class do
+  context "when adding" do
+    let :tmpfile do
+      tmp = Tempfile.new('tmp')
+      path = tmp.path
+      tmp.close!
+      path
+    end
+    let :resource do
+      Puppet::Type::File_line.new(
+        {:name => 'foo', :path => tmpfile, :line => 'foo'}
+      )
+    end
+    let :provider do
+      provider_class.new(resource)
+    end
+
+    it 'should detect if the line exists in the file' do
+      File.open(tmpfile, 'w') do |fh|
+        fh.write('foo')
+      end
+      expect(provider.exists?).to be_truthy
+    end
+    it 'should detect if the line does not exist in the file' do
+      File.open(tmpfile, 'w') do |fh|
+        fh.write('foo1')
+      end
+      expect(provider.exists?).to be_nil
+    end
+    it 'should append to an existing file when creating' do
+      provider.create
+      expect(File.read(tmpfile).chomp).to eq('foo')
+    end
+  end
+
+  context "when matching" do
+    before :each do
+      # TODO: these should be ported over to use the PuppetLabs spec_helper
+      #  file fixtures once the following pull request has been merged:
+      # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files
+      tmp = Tempfile.new('tmp')
+      @tmpfile = tmp.path
+      tmp.close!
+      @resource = Puppet::Type::File_line.new(
+          {
+           :name => 'foo',
+           :path => @tmpfile,
+           :line => 'foo = bar',
+           :match => '^foo\s*=.*$',
+          }
+      )
+      @provider = provider_class.new(@resource)
+    end
+
+    describe 'using match' do
+      it 'should raise an error if more than one line matches, and should not have modified the file' do
+        File.open(@tmpfile, 'w') do |fh|
+          fh.write("foo1\nfoo=blah\nfoo2\nfoo=baz")
+        end
+        expect(@provider.exists?).to be_nil
+        expect { @provider.create }.to raise_error(Puppet::Error, /More than one line.*matches/)
+        expect(File.read(@tmpfile)).to eql("foo1\nfoo=blah\nfoo2\nfoo=baz")
+      end
+
+      it 'should replace all lines that matches' do
+        @resource = Puppet::Type::File_line.new(
+          {
+            :name => 'foo',
+            :path => @tmpfile,
+            :line => 'foo = bar',
+            :match => '^foo\s*=.*$',
+            :multiple => true
+          }
+        )
+        @provider = provider_class.new(@resource)
+        File.open(@tmpfile, 'w') do |fh|
+          fh.write("foo1\nfoo=blah\nfoo2\nfoo=baz")
+        end
+        expect(@provider.exists?).to be_nil
+        @provider.create
+        expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2\nfoo = bar")
+      end
+
+      it 'should raise an error with invalid values' do
+        expect {
+          @resource = Puppet::Type::File_line.new(
+            {
+              :name => 'foo',
+              :path => @tmpfile,
+              :line => 'foo = bar',
+              :match => '^foo\s*=.*$',
+              :multiple => 'asgadga'
+            }
+          )
+        }.to raise_error(Puppet::Error, /Invalid value "asgadga"\. Valid values are true, false\./)
+      end
+
+      it 'should replace a line that matches' do
+        File.open(@tmpfile, 'w') do |fh|
+          fh.write("foo1\nfoo=blah\nfoo2")
+        end
+        expect(@provider.exists?).to be_nil
+        @provider.create
+        expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2")
+      end
+      it 'should add a new line if no lines match' do
+        File.open(@tmpfile, 'w') do |fh|
+          fh.write("foo1\nfoo2")
+        end
+        expect(@provider.exists?).to be_nil
+        @provider.create
+        expect(File.read(@tmpfile)).to eql("foo1\nfoo2\nfoo = bar\n")
+      end
+      it 'should do nothing if the exact line already exists' do
+        File.open(@tmpfile, 'w') do |fh|
+          fh.write("foo1\nfoo = bar\nfoo2")
+        end
+        expect(@provider.exists?).to be_truthy
+        @provider.create
+        expect(File.read(@tmpfile).chomp).to eql("foo1\nfoo = bar\nfoo2")
+      end
+    end
+
+    describe 'using after' do
+      let :resource do
+        Puppet::Type::File_line.new(
+          {
+            :name  => 'foo',
+            :path  => @tmpfile,
+            :line  => 'inserted = line',
+            :after => '^foo1',
+          }
+        )
+      end
+
+      let :provider do
+        provider_class.new(resource)
+      end
+
+      context 'with one line matching the after expression' do
+        before :each do
+          File.open(@tmpfile, 'w') do |fh|
+            fh.write("foo1\nfoo = blah\nfoo2\nfoo = baz")
+          end
+        end
+
+        it 'inserts the specified line after the line matching the "after" expression' do
+          provider.create
+          expect(File.read(@tmpfile).chomp).to eql("foo1\ninserted = line\nfoo = blah\nfoo2\nfoo = baz")
+        end
+      end
+
+      context 'with two lines matching the after expression' do
+        before :each do
+          File.open(@tmpfile, 'w') do |fh|
+            fh.write("foo1\nfoo = blah\nfoo2\nfoo1\nfoo = baz")
+          end
+        end
+
+        it 'errors out stating "One or no line must match the pattern"' do
+          expect { provider.create }.to raise_error(Puppet::Error, /One or no line must match the pattern/)
+        end
+      end
+
+      context 'with no lines matching the after expression' do
+        let :content do
+          "foo3\nfoo = blah\nfoo2\nfoo = baz\n"
+        end
+
+        before :each do
+          File.open(@tmpfile, 'w') do |fh|
+            fh.write(content)
+          end
+        end
+
+        it 'appends the specified line to the file' do
+          provider.create
+          expect(File.read(@tmpfile)).to eq(content << resource[:line] << "\n")
+        end
+      end
+    end
+  end
+
+  context "when removing" do
+    before :each do
+      # TODO: these should be ported over to use the PuppetLabs spec_helper
+      #  file fixtures once the following pull request has been merged:
+      # https://github.com/puppetlabs/puppetlabs-stdlib/pull/73/files
+      tmp = Tempfile.new('tmp')
+      @tmpfile = tmp.path
+      tmp.close!
+      @resource = Puppet::Type::File_line.new(
+        {:name => 'foo', :path => @tmpfile, :line => 'foo', :ensure => 'absent' }
+      )
+      @provider = provider_class.new(@resource)
+    end
+    it 'should remove the line if it exists' do
+      File.open(@tmpfile, 'w') do |fh|
+        fh.write("foo1\nfoo\nfoo2")
+      end
+      @provider.destroy
+      expect(File.read(@tmpfile)).to eql("foo1\nfoo2")
+    end
+
+    it 'should remove the line without touching the last new line' do
+      File.open(@tmpfile, 'w') do |fh|
+        fh.write("foo1\nfoo\nfoo2\n")
+      end
+      @provider.destroy
+      expect(File.read(@tmpfile)).to eql("foo1\nfoo2\n")
+    end
+
+    it 'should remove any occurence of the line' do
+      File.open(@tmpfile, 'w') do |fh|
+        fh.write("foo1\nfoo\nfoo2\nfoo\nfoo")
+      end
+      @provider.destroy
+      expect(File.read(@tmpfile)).to eql("foo1\nfoo2\n")
+    end
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb b/puppet/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb
new file mode 100755
index 00000000..c738a272
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/puppet/type/anchor_spec.rb
@@ -0,0 +1,11 @@
+#!/usr/bin/env ruby
+
+require 'spec_helper'
+
+anchor = Puppet::Type.type(:anchor).new(:name => "ntp::begin")
+
+describe anchor do
+  it "should stringify normally" do
+    expect(anchor.to_s).to eq("Anchor[ntp::begin]")
+  end
+end
diff --git a/puppet/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb b/puppet/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb
new file mode 100755
index 00000000..410d0bfe
--- /dev/null
+++ b/puppet/modules/stdlib/spec/unit/puppet/type/file_line_spec.rb
@@ -0,0 +1,70 @@
+#! /usr/bin/env ruby -S rspec
+require 'spec_helper'
+require 'tempfile'
+describe Puppet::Type.type(:file_line) do
+  let :file_line do
+    Puppet::Type.type(:file_line).new(:name => 'foo', :line => 'line', :path => '/tmp/path')
+  end
+  it 'should accept a line and path' do
+    file_line[:line] = 'my_line'
+    expect(file_line[:line]).to eq('my_line')
+    file_line[:path] = '/my/path'
+    expect(file_line[:path]).to eq('/my/path')
+  end
+  it 'should accept a match regex' do
+    file_line[:match] = '^foo.*$'
+    expect(file_line[:match]).to eq('^foo.*$')
+  end
+  it 'should accept a match regex that does not match the specified line' do
+    expect {
+      Puppet::Type.type(:file_line).new(
+          :name   => 'foo',
+          :path   => '/my/path',
+          :line   => 'foo=bar',
+          :match  => '^bar=blah$'
+    )}.not_to raise_error
+  end
+  it 'should accept a match regex that does match the specified line' do
+    expect {
+      Puppet::Type.type(:file_line).new(
+          :name   => 'foo',
+          :path   => '/my/path',
+          :line   => 'foo=bar',
+          :match  => '^\s*foo=.*$'
+      )}.not_to raise_error
+  end
+  it 'should accept posix filenames' do
+    file_line[:path] = '/tmp/path'
+    expect(file_line[:path]).to eq('/tmp/path')
+  end
+  it 'should not accept unqualified path' do
+    expect { file_line[:path] = 'file' }.to raise_error(Puppet::Error, /File paths must be fully qualified/)
+  end
+  it 'should require that a line is specified' do
+    expect { Puppet::Type.type(:file_line).new(:name => 'foo', :path => '/tmp/file') }.to raise_error(Puppet::Error, /Both line and path are required attributes/)
+  end
+  it 'should require that a file is specified' do
+    expect { Puppet::Type.type(:file_line).new(:name => 'foo', :line => 'path') }.to raise_error(Puppet::Error, /Both line and path are required attributes/)
+  end
+  it 'should default to ensure => present' do
+    expect(file_line[:ensure]).to eq :present
+  end
+
+  it "should autorequire the file it manages" do
+    catalog = Puppet::Resource::Catalog.new
+    file = Puppet::Type.type(:file).new(:name => "/tmp/path")
+    catalog.add_resource file
+    catalog.add_resource file_line
+
+    relationship = file_line.autorequire.find do |rel|
+      (rel.source.to_s == "File[/tmp/path]") and (rel.target.to_s == file_line.to_s)
+    end
+    expect(relationship).to be_a Puppet::Relationship
+  end
+
+  it "should not autorequire the file it manages if it is not managed" do
+    catalog = Puppet::Resource::Catalog.new
+    catalog.add_resource file_line
+    expect(file_line.autorequire).to be_empty
+  end
+end
diff --git a/puppet/modules/stdlib/tests/file_line.pp b/puppet/modules/stdlib/tests/file_line.pp
new file mode 100644
index 00000000..eea693e1
--- /dev/null
+++ b/puppet/modules/stdlib/tests/file_line.pp
@@ -0,0 +1,9 @@
+# This is a simple smoke test
+# of the file_line resource type.
+file { '/tmp/dansfile':
+  ensure => present
+}->
+file_line { 'dans_line':
+  line => 'dan is awesome',
+  path => '/tmp/dansfile',
+}
diff --git a/puppet/modules/stdlib/tests/has_interface_with.pp b/puppet/modules/stdlib/tests/has_interface_with.pp
new file mode 100644
index 00000000..e1f1353c
--- /dev/null
+++ b/puppet/modules/stdlib/tests/has_interface_with.pp
@@ -0,0 +1,10 @@
+include stdlib
+info('has_interface_with(\'lo\'):', has_interface_with('lo'))
+info('has_interface_with(\'loX\'):', has_interface_with('loX'))
+info('has_interface_with(\'ipaddress\', \'127.0.0.1\'):', has_interface_with('ipaddress', '127.0.0.1'))
+info('has_interface_with(\'ipaddress\', \'127.0.0.100\'):', has_interface_with('ipaddress', '127.0.0.100'))
+info('has_interface_with(\'network\', \'127.0.0.0\'):', has_interface_with('network', '127.0.0.0'))
+info('has_interface_with(\'network\', \'128.0.0.0\'):', has_interface_with('network', '128.0.0.0'))
+info('has_interface_with(\'netmask\', \'255.0.0.0\'):', has_interface_with('netmask', '255.0.0.0'))
+info('has_interface_with(\'netmask\', \'256.0.0.0\'):', has_interface_with('netmask', '256.0.0.0'))
+
diff --git a/puppet/modules/stdlib/tests/has_ip_address.pp b/puppet/modules/stdlib/tests/has_ip_address.pp
new file mode 100644
index 00000000..8429a885
--- /dev/null
+++ b/puppet/modules/stdlib/tests/has_ip_address.pp
@@ -0,0 +1,3 @@
+include stdlib
+info('has_ip_address(\'192.168.1.256\'):', has_ip_address('192.168.1.256'))
+info('has_ip_address(\'127.0.0.1\'):', has_ip_address('127.0.0.1'))
diff --git a/puppet/modules/stdlib/tests/has_ip_network.pp b/puppet/modules/stdlib/tests/has_ip_network.pp
new file mode 100644
index 00000000..a15d8c01
--- /dev/null
+++ b/puppet/modules/stdlib/tests/has_ip_network.pp
@@ -0,0 +1,4 @@
+include stdlib
+info('has_ip_network(\'127.0.0.0\'):', has_ip_network('127.0.0.0'))
+info('has_ip_network(\'128.0.0.0\'):', has_ip_network('128.0.0.0'))
+
diff --git a/puppet/modules/stdlib/tests/init.pp b/puppet/modules/stdlib/tests/init.pp
new file mode 100644
index 00000000..9675d837
--- /dev/null
+++ b/puppet/modules/stdlib/tests/init.pp
@@ -0,0 +1 @@
+include stdlib
-- 
cgit v1.2.3


From f5775156d8d8800247b8917ab6212c7eed16a124 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:10 -0400
Subject: git subrepo clone https://leap.se/git/puppet_unbound
 puppet/modules/unbound

subrepo:
  subdir:   "puppet/modules/unbound"
  merged:   "a26b91d"
upstream:
  origin:   "https://leap.se/git/puppet_unbound"
  branch:   "master"
  commit:   "a26b91d"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I83719264de2c716035d34599d541cadd42319b74
---
 puppet/modules/unbound/.gitrepo                    |  11 ++
 puppet/modules/unbound/LICENSE                     |  13 +++
 puppet/modules/unbound/Modulefile                  |  10 ++
 puppet/modules/unbound/README                      |  79 ++++++++++++++
 puppet/modules/unbound/manifests/anchor.pp         |  26 +++++
 puppet/modules/unbound/manifests/forward.pp        |  32 ++++++
 puppet/modules/unbound/manifests/init.pp           | 117 +++++++++++++++++++++
 puppet/modules/unbound/manifests/package.pp        |  15 +++
 puppet/modules/unbound/manifests/params.pp         |  42 ++++++++
 puppet/modules/unbound/manifests/root_hints.pp     |  35 ++++++
 puppet/modules/unbound/manifests/service.pp        |  22 ++++
 .../modules/unbound/manifests/service/openbsd.pp   |  21 ++++
 puppet/modules/unbound/manifests/ssl.pp            |  25 +++++
 puppet/modules/unbound/manifests/stub.pp           |  32 ++++++
 puppet/modules/unbound/metadata.json               |  50 +++++++++
 puppet/modules/unbound/spec/spec_helper.rb         |  17 +++
 puppet/modules/unbound/templates/unbound.conf.erb  |   8 ++
 puppet/modules/unbound/tests/anchor.pp             |   2 +
 puppet/modules/unbound/tests/forward.pp            |   7 ++
 puppet/modules/unbound/tests/init.pp               |  26 +++++
 puppet/modules/unbound/tests/package.pp            |   2 +
 puppet/modules/unbound/tests/params.pp             |   1 +
 puppet/modules/unbound/tests/root_hints.pp         |   2 +
 puppet/modules/unbound/tests/service.pp            |   2 +
 puppet/modules/unbound/tests/service/openbsd.pp    |   1 +
 puppet/modules/unbound/tests/ssl.pp                |   2 +
 puppet/modules/unbound/tests/stub.pp               |   7 ++
 27 files changed, 607 insertions(+)
 create mode 100644 puppet/modules/unbound/.gitrepo
 create mode 100644 puppet/modules/unbound/LICENSE
 create mode 100644 puppet/modules/unbound/Modulefile
 create mode 100644 puppet/modules/unbound/README
 create mode 100644 puppet/modules/unbound/manifests/anchor.pp
 create mode 100644 puppet/modules/unbound/manifests/forward.pp
 create mode 100644 puppet/modules/unbound/manifests/init.pp
 create mode 100644 puppet/modules/unbound/manifests/package.pp
 create mode 100644 puppet/modules/unbound/manifests/params.pp
 create mode 100644 puppet/modules/unbound/manifests/root_hints.pp
 create mode 100644 puppet/modules/unbound/manifests/service.pp
 create mode 100644 puppet/modules/unbound/manifests/service/openbsd.pp
 create mode 100644 puppet/modules/unbound/manifests/ssl.pp
 create mode 100644 puppet/modules/unbound/manifests/stub.pp
 create mode 100644 puppet/modules/unbound/metadata.json
 create mode 100644 puppet/modules/unbound/spec/spec_helper.rb
 create mode 100644 puppet/modules/unbound/templates/unbound.conf.erb
 create mode 100644 puppet/modules/unbound/tests/anchor.pp
 create mode 100644 puppet/modules/unbound/tests/forward.pp
 create mode 100644 puppet/modules/unbound/tests/init.pp
 create mode 100644 puppet/modules/unbound/tests/package.pp
 create mode 100644 puppet/modules/unbound/tests/params.pp
 create mode 100644 puppet/modules/unbound/tests/root_hints.pp
 create mode 100644 puppet/modules/unbound/tests/service.pp
 create mode 100644 puppet/modules/unbound/tests/service/openbsd.pp
 create mode 100644 puppet/modules/unbound/tests/ssl.pp
 create mode 100644 puppet/modules/unbound/tests/stub.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/unbound/.gitrepo b/puppet/modules/unbound/.gitrepo
new file mode 100644
index 00000000..863c109f
--- /dev/null
+++ b/puppet/modules/unbound/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_unbound
+	branch = master
+	commit = a26b91dfea3189e6777629fa00d54f51dc41f4d4
+	parent = 40ea2656f072e23bbbccd22c39fb29a36390fa3a
+	cmdver = 0.3.0
diff --git a/puppet/modules/unbound/LICENSE b/puppet/modules/unbound/LICENSE
new file mode 100644
index 00000000..b0dfc82b
--- /dev/null
+++ b/puppet/modules/unbound/LICENSE
@@ -0,0 +1,13 @@
+Copyright (c) 2012 Martin Oppegaard <martin.oppegaard at gmail dot com>
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/puppet/modules/unbound/Modulefile b/puppet/modules/unbound/Modulefile
new file mode 100644
index 00000000..93c593ad
--- /dev/null
+++ b/puppet/modules/unbound/Modulefile
@@ -0,0 +1,10 @@
+name 'oppegaard-unbound'
+version '0.1.0'
+author 'Martin Oppegaard'
+license 'ISC'
+summary 'The unbound module manages unbound'
+description 'This module manages unbound, the reqursive caching DNS resolver.
+    It manages the package, service, configuration file, control keys and support
+    files.'
+dependency 'puppetlabs/stdlib', '>= 3.2.0'
+dependency 'oppegaard/openbsd', '>= 0.1.0'
diff --git a/puppet/modules/unbound/README b/puppet/modules/unbound/README
new file mode 100644
index 00000000..529f37f0
--- /dev/null
+++ b/puppet/modules/unbound/README
@@ -0,0 +1,79 @@
+== Class: unbound
+
+The unbound class manages unbound, the reqursive caching DNS resolver.
+It manages the package, service, configuration file, control keys and
+support files.
+
+Supported operating systems are OpenBSD, Debian and Ubuntu.  Tested on OpenBSD
+5.2 with Puppet 2.7.14 and Debian Sid with Puppet 2.7.18-2.
+
+The configuration file is concatenated from samples of server et. al.,
+stub-zone and forward-zone.  The latter two are created independently
+from the server settings, by defines which can be used by other classes
+and modules.
+
+Control keys can be created with the unbound-control-setup program,
+and is enabled by default.  These are neccessary to be able to control
+unbound (restart, reload etc) with the unbound-control program.
+
+The auto-trust-anchor-file 'root.key' can be created with the unbound-anchor
+program, and is enabled by default.
+
+The root-hints files named.cache can be managed, but have to be provided by
+the user.  See the documentation in manifests/root_hints.pp for how to proceede.
+This functionality is not enabled by default.
+
+=== Parameters
+
+[*settings*]
+Hash containing the settings as key value pairs.
+
+[*ssl*]
+Mange unbound-control certificates?  True or false, true by default.
+
+[*anchor*]
+Manage root.key? True or false, true by default.
+
+[*root_hints*]
+Manage named.cache?  True or false, false by default.
+
+=== Examples
+
+class { 'unbound':
+  root_hints => true,
+  settings => {
+    server => {
+      verbosity => '1',
+      interface => [
+        '127.0.0.1',
+        '::1',
+        $::ipaddress,
+      ],
+      outgoing-interface => $::ipaddress,
+      access-control => [
+        '127.0.0.0/8 allow',
+        '::1 allow',
+        '10.0.0.0/8 allow',
+      ],
+      root-hints => '"/var/unbound/etc/named.cache"',
+      private-address => [
+        '10.0.0.0/8',
+        '172.16.0.0/12',
+        '192.168.0.0/16',
+      ],
+      private-domain => "\"$::domain\"",
+      auto-trust-anchor-file => '"/var/unbound/etc/root.key"',
+    },
+    python => { },
+    remote-control => {
+      control-enable => 'yes',
+      control-interface => [
+        '127.0.0.1',
+        '::1',
+      ],
+    },
+  }
+}
+
+See manifests/stub.pp and manifests/forward.pp for examples on how to create
+sub zones and forward zones repectively.
diff --git a/puppet/modules/unbound/manifests/anchor.pp b/puppet/modules/unbound/manifests/anchor.pp
new file mode 100644
index 00000000..e890722e
--- /dev/null
+++ b/puppet/modules/unbound/manifests/anchor.pp
@@ -0,0 +1,26 @@
+# == Class: unbound::anchor
+#
+# The unbound::anchor class manages the "root.key" file, and creates it with
+# the unbound-anchor program.
+#
+# === Examples
+#
+# include unbound::anchor
+#
+class unbound::anchor {
+  include unbound::params
+
+  file { $unbound::params::anchor:
+    owner => $unbound::params::user,
+    group => $unbound::params::group,
+    mode => '0644',
+    require => Exec[$unbound::params::unbound_anchor],
+  }
+
+  exec { $unbound::params::unbound_anchor:
+    command => "${unbound::params::unbound_anchor} -a ${unbound::params::anchor}",
+    creates => $unbound::params::anchor,
+    returns => 1,
+    before => Class['unbound::service'],
+  }
+}
diff --git a/puppet/modules/unbound/manifests/forward.pp b/puppet/modules/unbound/manifests/forward.pp
new file mode 100644
index 00000000..740c004d
--- /dev/null
+++ b/puppet/modules/unbound/manifests/forward.pp
@@ -0,0 +1,32 @@
+# == Define: unbound::forward
+#
+# Creates a forward-zone.  $settings is a hash containing the settings.
+# The name of the resource is used as the 'name' of the zone.
+#
+# === Parameters
+#
+# [*settings*]
+# Hash containing the settings as key value pairs.
+#
+# === Examples
+#
+# unbound::forward { 'example.com':
+#   settings => {
+#     forward-addr => '10.0.0.1',
+#   },
+# }
+#
+define unbound::forward (
+  $settings,
+) {
+  include unbound
+
+  $zone_name = { name => "\"${title}\"" }
+  $real_settings = { forward-zone => merge($zone_name, $settings) }
+
+  concat::fragment { "unbound ${title}":
+    target => $unbound::params::config,
+    content => template('unbound/unbound.conf.erb'),
+    order => 3,
+  }
+}
diff --git a/puppet/modules/unbound/manifests/init.pp b/puppet/modules/unbound/manifests/init.pp
new file mode 100644
index 00000000..ecb7970a
--- /dev/null
+++ b/puppet/modules/unbound/manifests/init.pp
@@ -0,0 +1,117 @@
+# == Class: unbound
+#
+# The unbound class manages unbound, the reqursive caching dns resolver.
+# It manages the package, service, configuration file, control keys and
+# support files.
+#
+# The configuration file is concatenated from samples of server et. al.,
+# stub-zone and forward-zone.  The latter two are created independently
+# from the server settings, by defines which can be used by other classes
+# and modules.
+#
+# Control keys can be created with the unbound-control-setup program,
+# and is enabled by default.  These are neccessary to be able to control
+# unbound (restart, reload etc) with the unbound-control program.
+#
+# The auto-trust-anchor-file 'root.key' can be created with the unbound-anchor
+# program, and is enabled by default.
+#
+# The root-hints files named.cache can be managed, but have to be provided by
+# the user.  See the documentation in manifests/root_hints.pp for how to proceede.
+# This functionality is not enabled by default.
+#
+# === Parameters
+#
+# [*settings*]
+# Hash containing the settings as key value pairs.
+#
+# [*ssl*]
+# Mange unbound-control certificates?  True or false, true by default.
+#
+# [*anchor*]
+# Manage root.key? True or false, true by default.
+#
+# [*root_hints*]
+# Manage named.cache?  True or false, false by default.
+#
+# === Examples
+#
+# class { 'unbound':
+#   root_hints => true,
+#   settings => {
+#     server => {
+#       verbosity => '1',
+#       interface => [
+#         '127.0.0.1',
+#         '::1',
+#         $::ipaddress,
+#       ],
+#       outgoing-interface => $::ipaddress,
+#       access-control => [
+#         '127.0.0.0/8 allow',
+#         '::1 allow',
+#         '10.0.0.0/8 allow',
+#       ],
+#       root-hints => '"/var/unbound/etc/named.cache"',
+#       private-address => [
+#         '10.0.0.0/8',
+#         '172.16.0.0/12',
+#         '192.168.0.0/16',
+#       ],
+#       private-domain => "\"$::domain\"",
+#       auto-trust-anchor-file => '"/var/unbound/etc/root.key"',
+#     },
+#     python => { },
+#     remote-control => {
+#       control-enable => 'yes',
+#       control-interface => [
+#         '127.0.0.1',
+#         '::1',
+#       ],
+#     },
+#   }
+# }
+#
+# See manifests/stub.pp and manifests/forward.pp for examples on how to create
+# sub zones and forward zones repectively.
+#
+class unbound (
+  $settings,
+  $anchor = true,
+  $root_hints = false,
+  $ssl = true,
+) inherits unbound::params {
+
+  include concat::setup
+  include unbound::package
+  include unbound::service
+
+  validate_hash($settings)
+  validate_bool($anchor)
+  validate_bool($root_hints)
+  validate_bool($ssl)
+
+  if $anchor {
+    include unbound::anchor
+  }
+
+  if $root_hints {
+    include unbound::root_hints
+  }
+
+  if $ssl {
+    include unbound::ssl
+  }
+
+  $real_settings = $settings
+
+  concat { $unbound::params::config:
+    require => Class['unbound::package'],
+  }
+
+  concat::fragment { 'unbound server':
+    target => $unbound::params::config,
+    content => template('unbound/unbound.conf.erb'),
+    order => 1,
+  }
+}
diff --git a/puppet/modules/unbound/manifests/package.pp b/puppet/modules/unbound/manifests/package.pp
new file mode 100644
index 00000000..b9b44f16
--- /dev/null
+++ b/puppet/modules/unbound/manifests/package.pp
@@ -0,0 +1,15 @@
+# == Class: unbound::package
+#
+# Manages the unbound package.
+#
+# === Examples
+#
+# include unbound::package
+#
+class unbound::package {
+  include unbound::params
+
+  package { $unbound::params::package:
+    ensure => installed,
+  }
+}
diff --git a/puppet/modules/unbound/manifests/params.pp b/puppet/modules/unbound/manifests/params.pp
new file mode 100644
index 00000000..fc043e24
--- /dev/null
+++ b/puppet/modules/unbound/manifests/params.pp
@@ -0,0 +1,42 @@
+class unbound::params {
+  case $::osfamily {
+    'OpenBSD': {
+      $package = 'unbound'
+      $service = 'unbound'
+      $hasstatus = true
+      $dir = '/var/unbound/etc'
+      $logfile = '/var/unbound/dev/log'
+      $control_setup = '/usr/local/sbin/unbound-control-setup'
+      $unbound_anchor = '/usr/local/sbin/unbound-anchor'
+      $extended_service = 'unbound::service::openbsd'
+      $unbound_flags = ''
+      $user = '_unbound'
+      $group = '_unbound'
+    }
+    'ubuntu', 'debian': {
+      $package = 'unbound'
+      $service = 'unbound'
+      $hasstatus = true
+      $dir = '/etc/unbound'
+      $logfile = ''
+      $control_setup = '/usr/sbin/unbound-control-setup'
+      $unbound_anchor = '/usr/sbin/unbound-anchor'
+      $unbound_flags = ''
+      $user = 'unbound'
+      $group = 'unbound'
+    }
+    default: {
+      fail("Class[unbound] is not supported by your operating system: ${::operatingsystem}")
+    }
+  }
+
+  $config = "${dir}/unbound.conf"
+  $control_certs = [
+    "${dir}/unbound_control.key",
+    "${dir}/unbound_control.pem",
+    "${dir}/unbound_server.key",
+    "${dir}/unbound_server.pem",
+  ]
+  $anchor = "${dir}/root.key"
+  $root_hints = "${dir}/named.cache"
+}
diff --git a/puppet/modules/unbound/manifests/root_hints.pp b/puppet/modules/unbound/manifests/root_hints.pp
new file mode 100644
index 00000000..12594956
--- /dev/null
+++ b/puppet/modules/unbound/manifests/root_hints.pp
@@ -0,0 +1,35 @@
+# == Class: unbound::root_hints
+#
+# The unbound::root_hints class manages the root-hints named.cache file.
+# The default mount point is /module_data, which should be installed
+# and populated with a the named.cache file before implementing this
+# class.  See unbound.conf(5) or the default configuration file for
+# how to retrieve such a file.
+#
+# === Parameters
+#
+# [*_mount*]
+#   Meta parameter for specifying an alternate mount path.
+#
+# === Examples
+#
+#  class { 'unbound::root_hints':
+#    $_mount = '/modules/unbound',
+#  }
+#
+#  include unbound::root_hints
+#
+class unbound::root_hints (
+    $_mount = "/module_data/unbound",
+) {
+  include unbound::params
+
+  file { $unbound::params::root_hints:
+    ensure => file,
+    owner => $unbound::params::user,
+    group => $unbound::params::group,
+    mode => '0644',
+    source => "puppet://${_mount}/named.cache",
+    before => Class['unbound::service'],
+  }
+}
diff --git a/puppet/modules/unbound/manifests/service.pp b/puppet/modules/unbound/manifests/service.pp
new file mode 100644
index 00000000..f96f453e
--- /dev/null
+++ b/puppet/modules/unbound/manifests/service.pp
@@ -0,0 +1,22 @@
+# == Class: unbound::service
+#
+# Manages the unbound service.  If $unbound::params::extended_service
+# is true then OS specific service things are included.
+#
+# === Examples
+#
+# include unbound::service
+#
+class unbound::service {
+  include unbound::params
+
+  if $unbound::params::extended_service {
+    class { $unbound::params::extended_service: }
+  }
+
+  service { $unbound::params::service:
+    ensure    => running,
+    hasstatus => $unbound::params::hasstatus,
+    subscribe => File[$unbound::params::config],
+  }
+}
diff --git a/puppet/modules/unbound/manifests/service/openbsd.pp b/puppet/modules/unbound/manifests/service/openbsd.pp
new file mode 100644
index 00000000..916a7ce9
--- /dev/null
+++ b/puppet/modules/unbound/manifests/service/openbsd.pp
@@ -0,0 +1,21 @@
+# == Class: unbound::service::openbsd
+#
+# Service things specific for OpenBSD.  Sets the unbound_flags variable in
+# /etc/rc.conf.local, and appends the path to the log device to syslogd_flags.
+#
+# === Examples
+#
+# include unbound::service::openbsd
+#
+class unbound::service::openbsd {
+  rcconf { 'unbound_flags':
+    value => $unbound::params::unbound_flags,
+  }
+
+  # syslogd_flags needs one -a dir per chrooted service.  Each can be a separate
+  # line, so don't use rcconf.
+  file_line { 'unbound syslogd_flags':
+      path => '/etc/rc.conf.local',
+      line => "syslogd_flags=\"\${syslogd_flags} -a ${unbound::params::logfile}\"";
+  }
+}
diff --git a/puppet/modules/unbound/manifests/ssl.pp b/puppet/modules/unbound/manifests/ssl.pp
new file mode 100644
index 00000000..e0cff172
--- /dev/null
+++ b/puppet/modules/unbound/manifests/ssl.pp
@@ -0,0 +1,25 @@
+# == Class: unbound::ssl
+#
+# unbound::ssl creates ssl certificates for controlling unbound with unbound-control,
+# using the unbound-control-setup program.  Furthermore, the class manages the mode and user of the certificates themselves.
+#
+# === Examples
+#
+#  include unbound::ssl
+#
+class unbound::ssl {
+  include unbound::params
+
+  file { $unbound::params::control_certs:
+    owner => $unbound::params::user,
+    group => $unbound::params::gruop,
+    mode => '0440',
+    require => Exec[$unbound::params::control_setup],
+  }
+
+  exec { $unbound::params::control_setup:
+    command => "${unbound::params::control_setup} -d ${unbound::params::dir}",
+    creates => $unbound::params::control_certs,
+    before => Class['unbound::service'],
+  }
+}
diff --git a/puppet/modules/unbound/manifests/stub.pp b/puppet/modules/unbound/manifests/stub.pp
new file mode 100644
index 00000000..02797fdb
--- /dev/null
+++ b/puppet/modules/unbound/manifests/stub.pp
@@ -0,0 +1,32 @@
+# == Define: unbound::stub
+#
+# Creates a stub-zone.  $settings is a hash containing the settings.
+# The name of the resource is used as the 'name' of the zone.
+#
+# === Parameters
+#
+# [*settings*]
+# Hash containing the settings as key value pairs.
+#
+# === Examples
+#
+# unbound::stub { $::domain:
+#   settings => {
+#     stub-addr => '192.168.1.1',
+#   },
+# }
+#
+define unbound::stub (
+  $settings,
+) {
+  include unbound::params
+
+  $zone_name = { name => "\"${title}\"" }
+  $real_settings = { stub-zone => merge($zone_name, $settings) }
+
+  concat::fragment { "unbound ${title}":
+    target => $unbound::params::config,
+    content => template('unbound/unbound.conf.erb'),
+    order => 2,
+  }
+}
diff --git a/puppet/modules/unbound/metadata.json b/puppet/modules/unbound/metadata.json
new file mode 100644
index 00000000..3c20ad4f
--- /dev/null
+++ b/puppet/modules/unbound/metadata.json
@@ -0,0 +1,50 @@
+{
+  "source": "UNKNOWN",
+  "types": [
+
+  ],
+  "project_page": "UNKNOWN",
+  "checksums": {
+    "manifests/service.pp": "baf263d0a562d6543c7418acf1e79cc2",
+    "tests/anchor.pp": "c6d270f2a0f448d7cebb6aed28b60998",
+    "LICENSE": "f8a2562cac0b3859771886422f703d27",
+    "spec/spec_helper.rb": "a55d1e6483344f8ec6963fcb2c220372",
+    "tests/service/openbsd.pp": "624a9db21c7bf277eec24186c490f4a5",
+    "Modulefile": "f1f67d825f8ef998667be8164f18744c",
+    "manifests/package.pp": "53a9d2e732f5690967f31e90d4eaaa99",
+    "manifests/init.pp": "92245e6671f2c3aef459c766c3df522d",
+    "tests/ssl.pp": "25439a06abaef7b5a2d778719a3d8c95",
+    "tests/service.pp": "106da53de4dd52a3e24d61af51263c00",
+    "tests/root_hints.pp": "7c9a9faa7350d023a00538812b9e3383",
+    "manifests/service/openbsd.pp": "fec14ed74ccf3a4c9a9d39a9870b992e",
+    "manifests/params.pp": "b949b2ac149f62130b0462a268c2a3ea",
+    "README": "6b5a94def03194686b83121ee218debd",
+    "tests/forward.pp": "29b51124459bc4fa265681cb0873afb7",
+    "manifests/root_hints.pp": "8c6879c961c8684dae69dbd13cea5efe",
+    "tests/params.pp": "f8662ff6d212159f10aac3186d010605",
+    "manifests/ssl.pp": "cc6e32a92c843bebbe5c05d7dc530c9b",
+    "tests/stub.pp": "34ca449ff833e3b1719d23f2875385d8",
+    "tests/init.pp": "9105221e2b9c942579d7e88f41a89b10",
+    "manifests/forward.pp": "07b209d883cf9ce1888a8427357a367f",
+    "tests/package.pp": "e1236eb6d345f5368f054f0e847a6a76",
+    "templates/unbound.conf.erb": "f5ee6f6444ad705c8494b8ec04e21d5b",
+    "manifests/stub.pp": "a0421e88c96df10cca872715c808ad5a",
+    "manifests/anchor.pp": "4ddf763591743e0505bf62a859e11a2d"
+  },
+  "license": "ISC",
+  "dependencies": [
+    {
+      "version_requirement": ">= 3.2.0",
+      "name": "puppetlabs/stdlib"
+    },
+    {
+      "version_requirement": ">= 0.1.0",
+      "name": "oppegaard/openbsd"
+    }
+  ],
+  "version": "0.1.0",
+  "summary": "The unbound module manages unbound",
+  "description": "This module manages unbound, the reqursive caching DNS resolver.\n    It manages the package, service, configuration file, control keys and support\n    files.",
+  "author": "Martin Oppegaard",
+  "name": "oppegaard-unbound"
+}
\ No newline at end of file
diff --git a/puppet/modules/unbound/spec/spec_helper.rb b/puppet/modules/unbound/spec/spec_helper.rb
new file mode 100644
index 00000000..5fda5887
--- /dev/null
+++ b/puppet/modules/unbound/spec/spec_helper.rb
@@ -0,0 +1,17 @@
+dir = File.expand_path(File.dirname(__FILE__))
+$LOAD_PATH.unshift File.join(dir, 'lib')
+
+require 'mocha'
+require 'puppet'
+require 'rspec'
+require 'spec/autorun'
+
+Spec::Runner.configure do |config|
+    config.mock_with :mocha
+end
+
+# We need this because the RAL uses 'should' as a method.  This
+# allows us the same behaviour but with a different method name.
+class Object
+    alias :must :should
+end
diff --git a/puppet/modules/unbound/templates/unbound.conf.erb b/puppet/modules/unbound/templates/unbound.conf.erb
new file mode 100644
index 00000000..ad93965c
--- /dev/null
+++ b/puppet/modules/unbound/templates/unbound.conf.erb
@@ -0,0 +1,8 @@
+<% @real_settings.sort.each do |section, settings| -%>
+<%=   "#{section}:"                                %>
+<%  settings.sort.each do |key, val|              -%>
+<%    [val].flatten.each do |val|                 -%>
+<%=     " #{key}: #{val}"                          %>
+<%     end                                        -%>
+<%  end                                            %>
+<% end                                            -%>
diff --git a/puppet/modules/unbound/tests/anchor.pp b/puppet/modules/unbound/tests/anchor.pp
new file mode 100644
index 00000000..ce73902a
--- /dev/null
+++ b/puppet/modules/unbound/tests/anchor.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::anchor
diff --git a/puppet/modules/unbound/tests/forward.pp b/puppet/modules/unbound/tests/forward.pp
new file mode 100644
index 00000000..0d245e61
--- /dev/null
+++ b/puppet/modules/unbound/tests/forward.pp
@@ -0,0 +1,7 @@
+include concat::setup
+include unbound
+unbound::forward { 'example.com':
+  settings => {
+    forward-addr => '127.0.0.1',
+  },
+}
diff --git a/puppet/modules/unbound/tests/init.pp b/puppet/modules/unbound/tests/init.pp
new file mode 100644
index 00000000..89af1770
--- /dev/null
+++ b/puppet/modules/unbound/tests/init.pp
@@ -0,0 +1,26 @@
+# The baseline for module testing used by Puppet Labs is that each manifest
+# should have a corresponding test manifest that declares that class or defined
+# type.
+#
+# Tests are then run by using puppet apply --noop (to check for compilation errors
+# and view a log of events) or by fully applying the test in a virtual environment
+# (to compare the resulting system state to the desired state).
+#
+# Learn more about module testing here: http://docs.puppetlabs.com/guides/tests_smoke.html
+#
+include concat::setup
+include unbound::package
+include unbound::service
+include unbound::anchor
+include unbound::ssl
+
+class { 'unbound':
+  anchor => false,
+  root_hints => false,
+  ssl => false,
+  settings => {
+    server => { },
+    python => { },
+    remote-control => { },
+  },
+}
diff --git a/puppet/modules/unbound/tests/package.pp b/puppet/modules/unbound/tests/package.pp
new file mode 100644
index 00000000..0360b52f
--- /dev/null
+++ b/puppet/modules/unbound/tests/package.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::package
diff --git a/puppet/modules/unbound/tests/params.pp b/puppet/modules/unbound/tests/params.pp
new file mode 100644
index 00000000..7cd72bd3
--- /dev/null
+++ b/puppet/modules/unbound/tests/params.pp
@@ -0,0 +1 @@
+include unbound::params
diff --git a/puppet/modules/unbound/tests/root_hints.pp b/puppet/modules/unbound/tests/root_hints.pp
new file mode 100644
index 00000000..3ce21ed1
--- /dev/null
+++ b/puppet/modules/unbound/tests/root_hints.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::root_hints
diff --git a/puppet/modules/unbound/tests/service.pp b/puppet/modules/unbound/tests/service.pp
new file mode 100644
index 00000000..0fb73df1
--- /dev/null
+++ b/puppet/modules/unbound/tests/service.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::service
diff --git a/puppet/modules/unbound/tests/service/openbsd.pp b/puppet/modules/unbound/tests/service/openbsd.pp
new file mode 100644
index 00000000..3e8696c0
--- /dev/null
+++ b/puppet/modules/unbound/tests/service/openbsd.pp
@@ -0,0 +1 @@
+include unbound::service::openbsd
diff --git a/puppet/modules/unbound/tests/ssl.pp b/puppet/modules/unbound/tests/ssl.pp
new file mode 100644
index 00000000..d7111977
--- /dev/null
+++ b/puppet/modules/unbound/tests/ssl.pp
@@ -0,0 +1,2 @@
+include unbound::params
+include unbound::ssl
diff --git a/puppet/modules/unbound/tests/stub.pp b/puppet/modules/unbound/tests/stub.pp
new file mode 100644
index 00000000..b1477f9d
--- /dev/null
+++ b/puppet/modules/unbound/tests/stub.pp
@@ -0,0 +1,7 @@
+include concat::setup
+include unbound::params
+unbound::stub { 'example.com':
+  settings => {
+    stub-addr => '127.0.0.1',
+  },
+}
-- 
cgit v1.2.3


From 26aac7ccf240b06d65616bdd00ae472d980aaea9 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:11 -0400
Subject: git subrepo clone https://leap.se/git/puppet_nagios
 puppet/modules/nagios

subrepo:
  subdir:   "puppet/modules/nagios"
  merged:   "e6fee3c"
upstream:
  origin:   "https://leap.se/git/puppet_nagios"
  branch:   "master"
  commit:   "e6fee3c"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ib7105f359ea2c3ae6490bff4fcecbede2511eaf0
---
 puppet/modules/nagios/.gitrepo                     |   11 +
 puppet/modules/nagios/LICENSE                      |  674 ++++
 puppet/modules/nagios/README                       |  305 ++
 puppet/modules/nagios/README.pnp4nagios            |   65 +
 puppet/modules/nagios/files/configs/CentOS/cgi.cfg |  280 ++
 .../modules/nagios/files/configs/CentOS/nagios.cfg |  949 +++++
 .../files/configs/CentOS/private/resource.cfg.i386 |   34 +
 .../configs/CentOS/private/resource.cfg.x86_64     |   34 +
 puppet/modules/nagios/files/configs/Debian/cgi.cfg |  330 ++
 .../modules/nagios/files/configs/Debian/nagios.cfg | 1288 +++++++
 .../configs/Debian/private/resource.cfg.amd64      |   31 +
 .../files/configs/Debian/private/resource.cfg.i386 |   31 +
 .../configs/Debian/private/resource.cfg.x86_64     |   31 +
 puppet/modules/nagios/files/configs/apache2.conf   |   67 +
 puppet/modules/nagios/files/configs/cgi.cfg        |    1 +
 puppet/modules/nagios/files/configs/nagios.cfg     |    1 +
 .../nagios/files/configs/nagios_templates.cfg      |   49 +
 puppet/modules/nagios/files/htpasswd.users         |    0
 .../nagios/files/irc_bot/riseup-nagios-client.pl   |   72 +
 .../nagios/files/irc_bot/riseup-nagios-server.pl   |  239 ++
 puppet/modules/nagios/files/munin/nagios_hosts     |   32 +
 puppet/modules/nagios/files/munin/nagios_perf      |   38 +
 puppet/modules/nagios/files/munin/nagios_svc       |   37 +
 puppet/modules/nagios/files/nrpe/nrpe_commands.cfg |    5 +
 puppet/modules/nagios/files/nsca/nsca.cfg          |  197 +
 puppet/modules/nagios/files/nsca/send_nsca.cfg     |   65 +
 .../files/plugin_data/sks-keyservers.netCA.pem     |   32 +
 puppet/modules/nagios/files/plugins/check_dns2     |  102 +
 puppet/modules/nagios/files/plugins/check_dnsbl    |  107 +
 puppet/modules/nagios/files/plugins/check_gpg      |  115 +
 .../modules/nagios/files/plugins/check_horde_login |   94 +
 .../modules/nagios/files/plugins/check_imap_login  |   80 +
 .../nagios/files/plugins/check_jabber_login        |   30 +
 .../nagios/files/plugins/check_mysql_health        | 3780 ++++++++++++++++++++
 .../nagios/files/plugins/check_openvpn_server.pl   |  109 +
 .../modules/nagios/files/plugins/check_pop3_login  |   83 +
 puppet/modules/nagios/files/pnp4nagios/action.gif  |  Bin 0 -> 1536 bytes
 puppet/modules/nagios/files/pnp4nagios/apache.conf |   31 +
 puppet/modules/nagios/files/pnp4nagios/npcd        |    8 +
 .../pnp4nagios/pnp4nagios-popup-templates.cfg      |   31 +
 .../files/pnp4nagios/pnp4nagios-templates.cfg      |   33 +
 .../nagios/files/pnp4nagios/status-header.ssi      |    8 +
 puppet/modules/nagios/images/nagiosgraph.gif       |  Bin 0 -> 1252 bytes
 puppet/modules/nagios/manifests/apache.pp          |   15 +
 puppet/modules/nagios/manifests/base.pp            |  144 +
 puppet/modules/nagios/manifests/centos.pp          |   42 +
 .../modules/nagios/manifests/command/imap_pop3.pp  |   30 +
 puppet/modules/nagios/manifests/command/nrpe.pp    |   14 +
 .../nagios/manifests/command/nrpe_timeout.pp       |   11 +
 puppet/modules/nagios/manifests/command/smtp.pp    |   22 +
 puppet/modules/nagios/manifests/debian.pp          |   54 +
 puppet/modules/nagios/manifests/debian/apache.pp   |   22 +
 puppet/modules/nagios/manifests/defaults.pp        |   12 +
 .../modules/nagios/manifests/defaults/commands.pp  |  145 +
 .../nagios/manifests/defaults/contactgroups.pp     |    9 +
 .../modules/nagios/manifests/defaults/contacts.pp  |   15 +
 .../nagios/manifests/defaults/host_templates.pp    |   24 +
 .../nagios/manifests/defaults/hostgroups.pp        |   11 +
 .../modules/nagios/manifests/defaults/plugins.pp   |   10 +
 .../nagios/manifests/defaults/pnp4nagios.pp        |   14 +
 .../nagios/manifests/defaults/service_templates.pp |   32 +
 .../modules/nagios/manifests/defaults/templates.pp |   17 +
 .../nagios/manifests/defaults/timeperiods.pp       |   33 +
 puppet/modules/nagios/manifests/defaults/vars.pp   |   11 +
 puppet/modules/nagios/manifests/headless.pp        |    5 +
 puppet/modules/nagios/manifests/init.pp            |   56 +
 puppet/modules/nagios/manifests/irc_bot.pp         |   50 +
 puppet/modules/nagios/manifests/irc_bot/base.pp    |   41 +
 puppet/modules/nagios/manifests/irc_bot/centos.pp  |    9 +
 puppet/modules/nagios/manifests/irc_bot/debian.pp  |    8 +
 puppet/modules/nagios/manifests/irc_bot/disable.pp |    8 +
 puppet/modules/nagios/manifests/lighttpd.pp        |   12 +
 puppet/modules/nagios/manifests/munin.pp           |   19 +
 puppet/modules/nagios/manifests/nrpe.pp            |   41 +
 puppet/modules/nagios/manifests/nrpe/base.pp       |   58 +
 puppet/modules/nagios/manifests/nrpe/command.pp    |   34 +
 puppet/modules/nagios/manifests/nrpe/debian.pp     |    6 +
 puppet/modules/nagios/manifests/nrpe/freebsd.pp    |   16 +
 puppet/modules/nagios/manifests/nrpe/linux.pp      |    9 +
 puppet/modules/nagios/manifests/nrpe/xinetd.pp     |   11 +
 puppet/modules/nagios/manifests/nsca.pp            |    3 +
 puppet/modules/nagios/manifests/nsca/client.pp     |   18 +
 puppet/modules/nagios/manifests/nsca/server.pp     |   24 +
 puppet/modules/nagios/manifests/plugin.pp          |   28 +
 puppet/modules/nagios/manifests/plugin/deploy.pp   |   41 +
 .../modules/nagios/manifests/plugin/scriptpaths.pp |    6 +
 puppet/modules/nagios/manifests/plugins/gpg.pp     |   30 +
 .../nagios/manifests/plugins/horde_login.pp        |   11 +
 puppet/modules/nagios/manifests/plugins/jabber.pp  |   10 +
 .../modules/nagios/manifests/plugins/mail_login.pp |   10 +
 puppet/modules/nagios/manifests/pnp4nagios.pp      |   68 +
 .../modules/nagios/manifests/pnp4nagios/popup.pp   |   24 +
 puppet/modules/nagios/manifests/service.pp         |   91 +
 puppet/modules/nagios/manifests/service/dns.pp     |   19 +
 .../modules/nagios/manifests/service/dns_host.pp   |   22 +
 puppet/modules/nagios/manifests/service/gpgkey.pp  |   49 +
 .../nagios/manifests/service/horde_login.pp        |   18 +
 puppet/modules/nagios/manifests/service/http.pp    |   54 +
 puppet/modules/nagios/manifests/service/imap.pp    |   34 +
 .../modules/nagios/manifests/service/imap_login.pp |   22 +
 puppet/modules/nagios/manifests/service/mysql.pp   |   58 +
 puppet/modules/nagios/manifests/service/ntp.pp     |    9 +
 puppet/modules/nagios/manifests/service/passive.pp |   18 +
 puppet/modules/nagios/manifests/service/ping.pp    |    9 +
 puppet/modules/nagios/manifests/service/pop.pp     |   32 +
 .../modules/nagios/manifests/service/pop3_login.pp |   22 +
 puppet/modules/nagios/manifests/service/smtp.pp    |   50 +
 puppet/modules/nagios/manifests/service/ssmtp.pp   |   32 +
 puppet/modules/nagios/manifests/storeconfigs.pp    |   61 +
 puppet/modules/nagios/manifests/stored_config.pp   |   19 +
 puppet/modules/nagios/manifests/target.pp          |   32 +
 puppet/modules/nagios/manifests/target/fqdn.pp     |   12 +
 .../templates/irc_bot/CentOS/nagios-nsa.sh.erb     |  104 +
 .../templates/irc_bot/Debian/nagios-nsa.sh.erb     |   72 +
 .../modules/nagios/templates/irc_bot/nsa.cfg.erb   |   15 +
 puppet/modules/nagios/templates/nrpe/nrpe.cfg      |  203 ++
 .../modules/nagios/templates/nrpe/nrpe_command.erb |    2 +
 117 files changed, 11911 insertions(+)
 create mode 100644 puppet/modules/nagios/.gitrepo
 create mode 100644 puppet/modules/nagios/LICENSE
 create mode 100644 puppet/modules/nagios/README
 create mode 100644 puppet/modules/nagios/README.pnp4nagios
 create mode 100644 puppet/modules/nagios/files/configs/CentOS/cgi.cfg
 create mode 100644 puppet/modules/nagios/files/configs/CentOS/nagios.cfg
 create mode 100644 puppet/modules/nagios/files/configs/CentOS/private/resource.cfg.i386
 create mode 100644 puppet/modules/nagios/files/configs/CentOS/private/resource.cfg.x86_64
 create mode 100644 puppet/modules/nagios/files/configs/Debian/cgi.cfg
 create mode 100644 puppet/modules/nagios/files/configs/Debian/nagios.cfg
 create mode 100644 puppet/modules/nagios/files/configs/Debian/private/resource.cfg.amd64
 create mode 100644 puppet/modules/nagios/files/configs/Debian/private/resource.cfg.i386
 create mode 100644 puppet/modules/nagios/files/configs/Debian/private/resource.cfg.x86_64
 create mode 100644 puppet/modules/nagios/files/configs/apache2.conf
 create mode 120000 puppet/modules/nagios/files/configs/cgi.cfg
 create mode 120000 puppet/modules/nagios/files/configs/nagios.cfg
 create mode 100644 puppet/modules/nagios/files/configs/nagios_templates.cfg
 create mode 100644 puppet/modules/nagios/files/htpasswd.users
 create mode 100644 puppet/modules/nagios/files/irc_bot/riseup-nagios-client.pl
 create mode 100644 puppet/modules/nagios/files/irc_bot/riseup-nagios-server.pl
 create mode 100644 puppet/modules/nagios/files/munin/nagios_hosts
 create mode 100644 puppet/modules/nagios/files/munin/nagios_perf
 create mode 100644 puppet/modules/nagios/files/munin/nagios_svc
 create mode 100644 puppet/modules/nagios/files/nrpe/nrpe_commands.cfg
 create mode 100644 puppet/modules/nagios/files/nsca/nsca.cfg
 create mode 100644 puppet/modules/nagios/files/nsca/send_nsca.cfg
 create mode 100644 puppet/modules/nagios/files/plugin_data/sks-keyservers.netCA.pem
 create mode 100644 puppet/modules/nagios/files/plugins/check_dns2
 create mode 100644 puppet/modules/nagios/files/plugins/check_dnsbl
 create mode 100644 puppet/modules/nagios/files/plugins/check_gpg
 create mode 100644 puppet/modules/nagios/files/plugins/check_horde_login
 create mode 100644 puppet/modules/nagios/files/plugins/check_imap_login
 create mode 100644 puppet/modules/nagios/files/plugins/check_jabber_login
 create mode 100755 puppet/modules/nagios/files/plugins/check_mysql_health
 create mode 100755 puppet/modules/nagios/files/plugins/check_openvpn_server.pl
 create mode 100644 puppet/modules/nagios/files/plugins/check_pop3_login
 create mode 100644 puppet/modules/nagios/files/pnp4nagios/action.gif
 create mode 100644 puppet/modules/nagios/files/pnp4nagios/apache.conf
 create mode 100644 puppet/modules/nagios/files/pnp4nagios/npcd
 create mode 100644 puppet/modules/nagios/files/pnp4nagios/pnp4nagios-popup-templates.cfg
 create mode 100644 puppet/modules/nagios/files/pnp4nagios/pnp4nagios-templates.cfg
 create mode 100644 puppet/modules/nagios/files/pnp4nagios/status-header.ssi
 create mode 100644 puppet/modules/nagios/images/nagiosgraph.gif
 create mode 100644 puppet/modules/nagios/manifests/apache.pp
 create mode 100644 puppet/modules/nagios/manifests/base.pp
 create mode 100644 puppet/modules/nagios/manifests/centos.pp
 create mode 100644 puppet/modules/nagios/manifests/command/imap_pop3.pp
 create mode 100644 puppet/modules/nagios/manifests/command/nrpe.pp
 create mode 100644 puppet/modules/nagios/manifests/command/nrpe_timeout.pp
 create mode 100644 puppet/modules/nagios/manifests/command/smtp.pp
 create mode 100644 puppet/modules/nagios/manifests/debian.pp
 create mode 100644 puppet/modules/nagios/manifests/debian/apache.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/commands.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/contactgroups.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/contacts.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/host_templates.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/hostgroups.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/plugins.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/pnp4nagios.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/service_templates.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/templates.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/timeperiods.pp
 create mode 100644 puppet/modules/nagios/manifests/defaults/vars.pp
 create mode 100644 puppet/modules/nagios/manifests/headless.pp
 create mode 100644 puppet/modules/nagios/manifests/init.pp
 create mode 100644 puppet/modules/nagios/manifests/irc_bot.pp
 create mode 100644 puppet/modules/nagios/manifests/irc_bot/base.pp
 create mode 100644 puppet/modules/nagios/manifests/irc_bot/centos.pp
 create mode 100644 puppet/modules/nagios/manifests/irc_bot/debian.pp
 create mode 100644 puppet/modules/nagios/manifests/irc_bot/disable.pp
 create mode 100644 puppet/modules/nagios/manifests/lighttpd.pp
 create mode 100644 puppet/modules/nagios/manifests/munin.pp
 create mode 100644 puppet/modules/nagios/manifests/nrpe.pp
 create mode 100644 puppet/modules/nagios/manifests/nrpe/base.pp
 create mode 100644 puppet/modules/nagios/manifests/nrpe/command.pp
 create mode 100644 puppet/modules/nagios/manifests/nrpe/debian.pp
 create mode 100644 puppet/modules/nagios/manifests/nrpe/freebsd.pp
 create mode 100644 puppet/modules/nagios/manifests/nrpe/linux.pp
 create mode 100644 puppet/modules/nagios/manifests/nrpe/xinetd.pp
 create mode 100644 puppet/modules/nagios/manifests/nsca.pp
 create mode 100644 puppet/modules/nagios/manifests/nsca/client.pp
 create mode 100644 puppet/modules/nagios/manifests/nsca/server.pp
 create mode 100644 puppet/modules/nagios/manifests/plugin.pp
 create mode 100644 puppet/modules/nagios/manifests/plugin/deploy.pp
 create mode 100644 puppet/modules/nagios/manifests/plugin/scriptpaths.pp
 create mode 100644 puppet/modules/nagios/manifests/plugins/gpg.pp
 create mode 100644 puppet/modules/nagios/manifests/plugins/horde_login.pp
 create mode 100644 puppet/modules/nagios/manifests/plugins/jabber.pp
 create mode 100644 puppet/modules/nagios/manifests/plugins/mail_login.pp
 create mode 100644 puppet/modules/nagios/manifests/pnp4nagios.pp
 create mode 100644 puppet/modules/nagios/manifests/pnp4nagios/popup.pp
 create mode 100644 puppet/modules/nagios/manifests/service.pp
 create mode 100644 puppet/modules/nagios/manifests/service/dns.pp
 create mode 100644 puppet/modules/nagios/manifests/service/dns_host.pp
 create mode 100644 puppet/modules/nagios/manifests/service/gpgkey.pp
 create mode 100644 puppet/modules/nagios/manifests/service/horde_login.pp
 create mode 100644 puppet/modules/nagios/manifests/service/http.pp
 create mode 100644 puppet/modules/nagios/manifests/service/imap.pp
 create mode 100644 puppet/modules/nagios/manifests/service/imap_login.pp
 create mode 100644 puppet/modules/nagios/manifests/service/mysql.pp
 create mode 100644 puppet/modules/nagios/manifests/service/ntp.pp
 create mode 100644 puppet/modules/nagios/manifests/service/passive.pp
 create mode 100644 puppet/modules/nagios/manifests/service/ping.pp
 create mode 100644 puppet/modules/nagios/manifests/service/pop.pp
 create mode 100644 puppet/modules/nagios/manifests/service/pop3_login.pp
 create mode 100644 puppet/modules/nagios/manifests/service/smtp.pp
 create mode 100644 puppet/modules/nagios/manifests/service/ssmtp.pp
 create mode 100644 puppet/modules/nagios/manifests/storeconfigs.pp
 create mode 100644 puppet/modules/nagios/manifests/stored_config.pp
 create mode 100644 puppet/modules/nagios/manifests/target.pp
 create mode 100644 puppet/modules/nagios/manifests/target/fqdn.pp
 create mode 100644 puppet/modules/nagios/templates/irc_bot/CentOS/nagios-nsa.sh.erb
 create mode 100644 puppet/modules/nagios/templates/irc_bot/Debian/nagios-nsa.sh.erb
 create mode 100644 puppet/modules/nagios/templates/irc_bot/nsa.cfg.erb
 create mode 100644 puppet/modules/nagios/templates/nrpe/nrpe.cfg
 create mode 100644 puppet/modules/nagios/templates/nrpe/nrpe_command.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/nagios/.gitrepo b/puppet/modules/nagios/.gitrepo
new file mode 100644
index 00000000..b832fa2a
--- /dev/null
+++ b/puppet/modules/nagios/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_nagios
+	branch = master
+	commit = e6fee3c731f68ccf8b6add8ada2162c7ad2b8407
+	parent = f5775156d8d8800247b8917ab6212c7eed16a124
+	cmdver = 0.3.0
diff --git a/puppet/modules/nagios/LICENSE b/puppet/modules/nagios/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/nagios/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/nagios/README b/puppet/modules/nagios/README
new file mode 100644
index 00000000..0c42b4a7
--- /dev/null
+++ b/puppet/modules/nagios/README
@@ -0,0 +1,305 @@
+Introduction/Notes
+==================
+
+This modules was inspired and based on the work of David Schmitt
+The immerda project group adapted and improved this module.
+Mainly we made it using the new native puppet nagios commands
+as well we made it more modular to fit for multidistro usage.
+
+In it's current form, this module can be used on CentOS and Debian.
+
+
+Overview
+========
+
+To use the nagios resources in an puppetmaster setup you need to activate
+[storeconfigs](https://docs.puppetlabs.com/puppet/latest/reference/configuration.html#storeconfigs) on the puppetmaster.
+You can also use this module in a masterless setup, please set the
+`storeconfigs` parameter to `false` when declaring the nafios class.
+
+You need to be running version 0.25 or later of puppet.
+
+
+Monitor
+-------
+
+On one node the "nagios" class has to be included. By default this installs
+apache using the "apache" module. To use lighttpd instead, set the "httpd"
+parameter to the "nagios" class to "lighttpd", or, if the web server is not to
+be managed by puppet, set the "httpd" parameter to "absent".
+
+
+Hosts
+-----
+
+On a node which shall be monitored with nagios, include the "nagios::target".
+This just creates a host declaration for this host's "$::ipaddress" fact. If
+the $::ipaddress of your target is not the one you wish to modify, you can use
+"nagios::target::fqdn" instead, which will use the $::fqdn fact of the host instead.
+
+Pass the $parents variable to the target class for enabling the reachability
+features of nagios. If a node needs more customisation, use the
+native "@@nagios_host" type directly (the double-ampersand declares the object
+as an exported resource).
+
+To monitor hosts not managed by puppet, add "nagios_host" objects to the
+monitoring node. The required parameters are "alias", "address" and "use". If
+you don't specify a proper nagios template with the "use" parameter, some extra
+parameters are needed. You may look up the nagios documentation for this.
+
+
+Services
+--------
+
+Services can be monitored by using the "nagios::service" component.
+
+The simplest form is:
+
+    nagios::service { 'check_http':
+        check_command => 'http_port!80',
+    }
+
+The intention being obviously to put such declarations into a component defining
+a service, thereby being automatically applied together with all instances of
+the service.
+
+Obviously, the check command must either be defined using nagios_command objects
+(some are supplied in nagios::defaults::commands) or in the nagios configuration
+files directly.
+
+NRPE client configuration
+=========================
+
+To setup a machine as an NRPE client, the class 'nagios::nrpe' should be used:
+
+    class { 'nagios::nrpe':
+      allowed_hosts => '10.2.3.4,10.5.6.7',
+    }
+
+The class can take the following parameters to change configuration or
+configuration directory:
+
+ * $cfg_dir : Defines the path to the NRPE configuration. The default is to use
+   the path used by packages per your distro.
+
+ * $pid_file : Sets the path of the PID file. The default value is the path
+   used by init script shipped with your distro's packages.
+
+ * $plugin_dir : Defines the path in which nagios plugins that are to be
+   executed with NRPE commands are stored. The default value is the path where
+   your distro's nagios package stores plugins.
+
+ * $server_address : The IP address to which the NRPE client daemon should
+   bind. The default behaviour is to bind to all IPs.
+
+ * $allowed_hosts : A string containing a comma-separated list of host IPs that
+   are allowed to request NRPE commands to be run. The default value is to
+   allow only 127.0.0.1, so you might want to pass in a list of additional host
+   IPs.
+
+ * $dont_blame : A string that enables ('1') or disables ('0') NRPE command
+   arguments. Enabling arguments can lead to potentials of shell escapes so it
+   should be used with caution and only if absolutely needed. This is disabled
+   by default.
+
+NRPE Services
+-------------
+
+Some Nagios services need to be checked via NRPE. The following will make the
+nagios server define a service that will check the NRPE command 'check_cpu' on
+the current node:
+
+    nagios::service { 'CPU Usage':
+      use_nrpe => true,
+      check_command => "check_cpu",
+      nrpe_args => "-t 60"
+    }
+
+NRPE Commands
+-------------
+
+To be able to call NRPE commands on a host, one needs to define that command
+and what it is going to execute:
+
+    nagios::nrpe::command { 'debsums':
+      check_command => '/usr/lib/nagios/plugins/check_debsums openssh-server'
+    }
+
+
+Upgrade Notes
+=============
+
+The nagios::target bits have been reworked, the notable changes that
+may affect an upgrade are:
+
+. previous versions had nagios::target::nat which used the $::fqdn for
+the address part of nagios::target, this has been renamed to
+nagios::target::fqdn to be more clear. if you were using
+nagios::target::nat then you will need to change those references to
+::fqdn
+
+. previous versions of this module used $::fqdn for the nagios::target
+address, now it is using $::ipaddress. If you need $::fqdn, use
+nagios::target::fqdn instead of nagios::target
+
+. previous versions of nagios_host used the parameter named 'ip', that
+has been changed to 'address'
+
+
+IRC bot
+=======
+
+Notifications can easily be sent to an IRC channel by using a bot. To do so,
+simply include 'nagios::irc_bot' on the nagios server and define the right
+$nagios_nsa_* variables (see the 'Variables' section below).
+
+You can then use the notification commands 'notify-by-irc' and
+'host-notify-by-irc' with service and host definitions to make them report
+state changes over IRC.
+
+Caveats
+=======
+
+
+Consistency/Validation/Verification
+-----------------------------------
+
+After convergance of the configuration, the system is obviously consistent.
+That is, all defined services are monitored. The problem is though, that it is
+neither automatically valid - it is not guaranteed that all components declare a
+nagios::service - and even if the configuration is valid it definitly is
+unverified, since that is always a judgment call for an external observer.
+
+
+Removal of nagios objects
+-------------------------
+
+This module does not automatically purge nagios objects such as hosts and
+services that become absent from the manifests. One must set ensure => absent
+to guarantee the removal of nagios objects from the configuration as desired.
+
+
+Templates not supported using native types
+------------------------------------------
+
+Templates of hosts and services cannot yet be defined using native types. In
+this module, they are provided using a file resource by the class
+nagios::defaults::templates
+
+See : http://projects.reductivelabs.com/issues/1180
+
+
+Variables
+=========
+
+Options to change the behavior of the nagios class:
+
+- allow_external_cmd: Set to true, if you'd like to ensure that your http
+                      daemon can write to the external command file. You
+                      may also need to flip "check_external_commands" in
+                      "nagios.cfg" to enable this functionality.
+
+For the irc_bot class:
+
+- nsa_socket: This optional variable can be used to specify the path to
+              the socket file that the IRC daemon should use.
+
+- nsa_server: When using the IRC bot, this defines the server address of
+              the IRC network on which the bot will connect.
+
+- nsa_port: Defines the port number on the IRC server on which the bot
+            should connect. When this variable is not set, the port used
+            by default is 6667.
+
+- nsa_nickname: This is the nickname that the IRC bot will take.
+
+- nsa_password: Some networks require a password to connect to them.
+                This defines such a password.
+
+- nsa_channel: The name of the channel that the IRC bot will join and
+               will post notifications to.
+
+- nsa_pidfile: This optional variable can be used to define the path to
+               the file that will contain the process ID of the IRC bot
+               daemon.
+- nsa_realname: The IRC bot user's real name that will be displayed. By
+                default, the real name is 'Nagios'.
+
+- nsa_usenotices: The IRC bot will by default "say" to the channel the
+                  nagios message, but you can switch this variable to
+                  'notice' if you would prefer them to be sent as IRC
+                  NOTICE messages.
+
+PNP4Nagios integration
+======================
+
+For PNP4Nagios integration information, please see README.pnp4nagios
+
+Examples
+========
+
+Usage example:
+
+~~~
+node nagios {
+
+  class { 'nagios': } -> class { 'nagios::defaults': }
+
+  # Declare another nagios command
+  nagios::command { http_port:
+     command_line => '/usr/lib/nagios/plugins/check_http -p $ARG1$ -H $HOSTADDRESS$ -I $HOSTADDRESS$'
+  }
+
+  # Declare unmanaged hosts
+  nagios_host {
+    'router01.mydomain.com':
+      alias   => 'router01',
+      notes   => 'MyDomain Gateway',
+      address => '10.0.0.1',
+      use     => 'generic-host';
+    'router02.mydomain.com':
+      alias   => 'router02',
+      address => '192.168.0.1',
+      parents => 'router01',
+      use     => 'generic-host';
+  }
+
+}
+
+
+node target {
+
+  # Monitor this host
+  class{'nagios::target':
+   parents = 'router01'
+  }
+
+  # monitor a service
+  $apache2_port = 8080
+  include apache2
+
+  # This actually does this somewhere:
+  #nagios::service { "http_${apache2_port}":
+  #       check_command => "http_port!${apache2_port}"
+  #}
+
+}
+~~~
+
+TODO
+====
+
+- Provide a default http vhost
+- Add facility to deploy nagios plugins
+- Add more useful commands and services
+- When Puppet will support them, supply nagios templates using native types
+
+
+License
+=======
+
+Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+See the file LICENSE in the top directory for the full license.
+
+Copyright (C) 2010 Riseup Networks <micah@riseup.net>
+
diff --git a/puppet/modules/nagios/README.pnp4nagios b/puppet/modules/nagios/README.pnp4nagios
new file mode 100644
index 00000000..dd407021
--- /dev/null
+++ b/puppet/modules/nagios/README.pnp4nagios
@@ -0,0 +1,65 @@
+PNP4Nagios integration
+======================
+
+As of 2012/01 debian packages for pnp4nagios are availible from lenny-backports on.
+
+See http://docs.pnp4nagios.org/pnp-0.6/start for installation notes.
+
+Integration in the nagios/icinga webinterface is configured by including either
+the nagios::pnp4nagios or the nagios::pnp4nagios::popup class, the later one
+includes fancy popups when you hoover over the extra service action image.  For
+hosts you need to use the host-pnp definition, for services the srv-pnp def.
+i.e.
+
+    @@nagios_service { "ping_example_node":
+        use => "generic-service,srv-pnp",
+        ...
+
+    nagios_host { 'example_node':
+            use => 'generic-host,host-pnp',
+            ...
+
+In the default config files the "Bulk Mode with NPCD" is used
+(see http://docs.pnp4nagios.org/en/pnp-0.6/config for more infos about the different
+modes).
+
+Include the nagios::pnp4nagios::popup class for fancy popups when you hoover over
+the extra service action image.
+
+
+Please include this in your nagios.cfg:
+
+process_performance_data=1
+
+#http://docs.pnp4nagios.org/en/pnp-0.6/config#bulk_mode_mit_npcd 
+#
+# Service Performance-Data
+#
+service_perfdata_file=/var/lib/nagios3/service-perfdata
+service_perfdata_file_template=DATATYPE::SERVICEPERFDATA\tTIMET::$TIMET$\tHOSTNAME::$HOSTNAME$\tSERVICEDESC::$SERVICEDESC$\tSERVICEPERFDATA::$SERVICEPERFDATA$\tSERVICECHECKCOMMAND::$SERVICECHECKCOMMAND$\tHOSTSTATE::$HOSTSTATE$\tHOSTSTATETYPE::$HOSTSTATETYPE$\tSERVICESTATE::$SERVICESTATE$\tSERVICESTATETYPE::$SERVICESTATETYPE$
+service_perfdata_file_mode=a
+service_perfdata_file_processing_interval=15
+service_perfdata_file_processing_command=process-service-perfdata-file-pnp4nagios-bulk-npcd
+
+#
+# Host Performance-Data
+# 
+host_perfdata_file=/var/lib/nagios3/host-perfdata
+host_perfdata_file_template=DATATYPE::HOSTPERFDATA\tTIMET::$TIMET$\tHOSTNAME::$HOSTNAME$\tHOSTPERFDATA::$HOSTPERFDATA$\tHOSTCHECKCOMMAND::$HOSTCHECKCOMMAND$\tHOSTSTATE::$HOSTSTATE$\tHOSTSTATETYPE::$HOSTSTATETYPE$
+host_perfdata_file_mode=a
+host_perfdata_file_processing_interval=15
+host_perfdata_file_processing_command=process-host-perfdata-file-pnp4nagios-bulk-npcd
+
+
+For hosts you need to use the host-pnp definition, for services the srv-pnp def.
+i.e.
+
+    @@nagios_service { "ping_example_node":
+        use => "generic-service,srv-pnp",
+        ...
+
+    nagios_host { 'example_node':
+            use => 'generic-host,host-pnp',
+            ...
+
+
diff --git a/puppet/modules/nagios/files/configs/CentOS/cgi.cfg b/puppet/modules/nagios/files/configs/CentOS/cgi.cfg
new file mode 100644
index 00000000..cd625d4c
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/CentOS/cgi.cfg
@@ -0,0 +1,280 @@
+#################################################################
+#
+# CGI.CFG - Sample CGI Configuration File for Nagios 2.9
+#
+# Last Modified: 11-21-2006
+#
+#################################################################
+
+
+# MAIN CONFIGURATION FILE
+# This tells the CGIs where to find your main configuration file.
+# The CGIs will read the main and host config files for any other
+# data they might need.
+
+main_config_file=/etc/nagios/nagios.cfg
+
+
+
+# PHYSICAL HTML PATH
+# This is the path where the HTML files for Nagios reside.  This
+# value is used to locate the logo images needed by the statusmap
+# and statuswrl CGIs.
+
+physical_html_path=/usr/share/nagios/share
+
+
+
+# URL HTML PATH
+# This is the path portion of the URL that corresponds to the
+# physical location of the Nagios HTML files (as defined above).
+# This value is used by the CGIs to locate the online documentation
+# and graphics.  If you access the Nagios pages with an URL like
+# http://www.myhost.com/nagios, this value should be '/nagios'
+# (without the quotes).
+
+url_html_path=/nagios
+
+
+
+# CONTEXT-SENSITIVE HELP
+# This option determines whether or not a context-sensitive
+# help icon will be displayed for most of the CGIs.
+# Values: 0 = disables context-sensitive help
+#         1 = enables context-sensitive help
+
+show_context_help=0
+
+
+
+# NAGIOS PROCESS CHECK COMMAND
+# This is the full path and filename of the program used to check
+# the status of the Nagios process.  It is used only by the CGIs
+# and is completely optional.  However, if you don't use it, you'll
+# see warning messages in the CGIs about the Nagios process
+# not running and you won't be able to execute any commands from
+# the web interface.  The program should follow the same rules
+# as plugins; the return codes are the same as for the plugins,
+# it should have timeout protection, it should output something
+# to STDIO, etc.
+#
+# Note: The command line for the check_nagios plugin below may
+# have to be tweaked a bit, as different versions of the plugin
+# use different command line arguments/syntaxes.
+
+#nagios_check_command=/usr/lib64/nagios/plugins/check_nagios /var/log/nagios/status.dat 5 '/usr/sbin/nagios'
+
+
+
+# AUTHENTICATION USAGE
+# This option controls whether or not the CGIs will use any 
+# authentication when displaying host and service information, as
+# well as committing commands to Nagios for processing.  
+#
+# Read the HTML documentation to learn how the authorization works!
+#
+# NOTE: It is a really *bad* idea to disable authorization, unless
+# you plan on removing the command CGI (cmd.cgi)!  Failure to do
+# so will leave you wide open to kiddies messing with Nagios and
+# possibly hitting you with a denial of service attack by filling up
+# your drive by continuously writing to your command file!
+#
+# Setting this value to 0 will cause the CGIs to *not* use
+# authentication (bad idea), while any other value will make them
+# use the authentication functions (the default).
+
+use_authentication=1
+
+
+
+# DEFAULT USER
+# Setting this variable will define a default user name that can
+# access pages without authentication.  This allows people within a
+# secure domain (i.e., behind a firewall) to see the current status
+# without authenticating.  You may want to use this to avoid basic
+# authentication if you are not using a secure server since basic
+# authentication transmits passwords in the clear.
+#
+# Important:  Do not define a default username unless you are
+# running a secure web server and are sure that everyone who has
+# access to the CGIs has been authenticated in some manner!  If you
+# define this variable, anyone who has not authenticated to the web
+# server will inherit all rights you assign to this user!
+ 
+#default_user_name=guest
+
+
+
+# SYSTEM/PROCESS INFORMATION ACCESS
+# This option is a comma-delimited list of all usernames that
+# have access to viewing the Nagios process information as
+# provided by the Extended Information CGI (extinfo.cgi).  By
+# default, *no one* has access to this unless you choose to
+# not use authorization.  You may use an asterisk (*) to
+# authorize any user who has authenticated to the web server.
+
+#authorized_for_system_information=nagiosadmin,theboss,jdoe
+authorized_for_system_information=admin
+
+# CONFIGURATION INFORMATION ACCESS
+# This option is a comma-delimited list of all usernames that
+# can view ALL configuration information (hosts, commands, etc).
+# By default, users can only view configuration information
+# for the hosts and services they are contacts for. You may use
+# an asterisk (*) to authorize any user who has authenticated
+# to the web server.
+
+#authorized_for_configuration_information=nagiosadmin,jdoe
+authorized_for_configuration_information=admin
+
+
+
+# SYSTEM/PROCESS COMMAND ACCESS
+# This option is a comma-delimited list of all usernames that
+# can issue shutdown and restart commands to Nagios via the
+# command CGI (cmd.cgi).  Users in this list can also change
+# the program mode to active or standby. By default, *no one*
+# has access to this unless you choose to not use authorization.
+# You may use an asterisk (*) to authorize any user who has
+# authenticated to the web server.
+
+#authorized_for_system_commands=nagiosadmin
+authorized_for_system_commands=admin
+
+
+
+# GLOBAL HOST/SERVICE VIEW ACCESS
+# These two options are comma-delimited lists of all usernames that
+# can view information for all hosts and services that are being
+# monitored.  By default, users can only view information
+# for hosts or services that they are contacts for (unless you
+# you choose to not use authorization). You may use an asterisk (*)
+# to authorize any user who has authenticated to the web server.
+
+
+#authorized_for_all_services=nagiosadmin,guest
+authorized_for_all_services=admin
+#authorized_for_all_hosts=nagiosadmin,guest
+authorized_for_all_hosts=admin
+
+
+
+# GLOBAL HOST/SERVICE COMMAND ACCESS
+# These two options are comma-delimited lists of all usernames that
+# can issue host or service related commands via the command
+# CGI (cmd.cgi) for all hosts and services that are being monitored. 
+# By default, users can only issue commands for hosts or services 
+# that they are contacts for (unless you you choose to not use 
+# authorization).  You may use an asterisk (*) to authorize any
+# user who has authenticated to the web server.
+
+#authorized_for_all_service_commands=nagiosadmin
+authorized_for_all_service_commands=admin
+#authorized_for_all_host_commands=nagiosadmin
+authorized_for_all_host_commands=admin
+
+
+
+
+# STATUSMAP BACKGROUND IMAGE
+# This option allows you to specify an image to be used as a 
+# background in the statusmap CGI.  It is assumed that the image
+# resides in the HTML images path (i.e. /usr/local/nagios/share/images).
+# This path is automatically determined by appending "/images"
+# to the path specified by the 'physical_html_path' directive.
+# Note:  The image file may be in GIF, PNG, JPEG, or GD2 format.
+# However, I recommend that you convert your image to GD2 format
+# (uncompressed), as this will cause less CPU load when the CGI
+# generates the image.
+
+#statusmap_background_image=smbackground.gd2
+
+
+
+# DEFAULT STATUSMAP LAYOUT METHOD
+# This option allows you to specify the default layout method
+# the statusmap CGI should use for drawing hosts.  If you do
+# not use this option, the default is to use user-defined
+# coordinates.  Valid options are as follows:
+#	0 = User-defined coordinates
+#	1 = Depth layers
+#       2 = Collapsed tree
+#       3 = Balanced tree
+#       4 = Circular
+#       5 = Circular (Marked Up)
+
+default_statusmap_layout=5
+
+
+
+# DEFAULT STATUSWRL LAYOUT METHOD
+# This option allows you to specify the default layout method
+# the statuswrl (VRML) CGI should use for drawing hosts.  If you
+# do not use this option, the default is to use user-defined
+# coordinates.  Valid options are as follows:
+#	0 = User-defined coordinates
+#       2 = Collapsed tree
+#       3 = Balanced tree
+#       4 = Circular
+
+default_statuswrl_layout=4
+
+
+
+# STATUSWRL INCLUDE
+# This option allows you to include your own objects in the 
+# generated VRML world.  It is assumed that the file
+# resides in the HTML path (i.e. /usr/local/nagios/share).
+
+#statuswrl_include=myworld.wrl
+
+
+
+# PING SYNTAX
+# This option determines what syntax should be used when
+# attempting to ping a host from the WAP interface (using
+# the statuswml CGI.  You must include the full path to
+# the ping binary, along with all required options.  The
+# $HOSTADDRESS$ macro is substituted with the address of
+# the host before the command is executed.
+# Please note that the syntax for the ping binary is
+# notorious for being different on virtually ever *NIX
+# OS and distribution, so you may have to tweak this to
+# work on your system.
+
+ping_syntax=/bin/ping -n -U -c 5 $HOSTADDRESS$
+
+
+
+# REFRESH RATE
+# This option allows you to specify the refresh rate in seconds
+# of various CGIs (status, statusmap, extinfo, and outages).  
+
+refresh_rate=90
+
+
+
+# SOUND OPTIONS
+# These options allow you to specify an optional audio file
+# that should be played in your browser window when there are
+# problems on the network.  The audio files are used only in
+# the status CGI.  Only the sound for the most critical problem
+# will be played.  Order of importance (higher to lower) is as
+# follows: unreachable hosts, down hosts, critical services,
+# warning services, and unknown services. If there are no
+# visible problems, the sound file optionally specified by
+# 'normal_sound' variable will be played.
+#
+#
+# <varname>=<sound_file>
+#
+# Note: All audio files must be placed in the /media subdirectory
+# under the HTML path (i.e. /usr/local/nagios/share/media/).
+
+#host_unreachable_sound=hostdown.wav
+#host_down_sound=hostdown.wav
+#service_critical_sound=critical.wav
+#service_warning_sound=warning.wav
+#service_unknown_sound=warning.wav
+#normal_sound=noproblem.wav
+
diff --git a/puppet/modules/nagios/files/configs/CentOS/nagios.cfg b/puppet/modules/nagios/files/configs/CentOS/nagios.cfg
new file mode 100644
index 00000000..b88e3db7
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/CentOS/nagios.cfg
@@ -0,0 +1,949 @@
+##############################################################################
+#
+# NAGIOS.CFG - Sample Main Config File for Nagios 2.10
+#
+# Read the documentation for more information on this configuration
+# file.  I've provided some comments here, but things may not be so
+# clear without further explanation.
+#
+# Last Modified: 12-21-2006
+#
+##############################################################################
+
+
+# LOG FILE
+# This is the main log file where service and host events are logged
+# for historical purposes.  This should be the first option specified 
+# in the config file!!!
+
+log_file=/var/log/nagios/nagios.log
+
+
+
+# OBJECT CONFIGURATION FILE(S)
+# This is the configuration file in which you define hosts, host
+# groups, contacts, contact groups, services, etc.  I guess it would
+# be better called an object definition file, but for historical
+# reasons it isn't.  You can split object definitions into several
+# different config files by using multiple cfg_file statements here.
+# Nagios will read and process all the config files you define.
+# This can be very useful if you want to keep command definitions 
+# separate from host and contact definitions...
+
+# Puppet-managed configuration files
+cfg_file=/etc/nagios/nagios_templates.cfg
+cfg_file=/etc/nagios/nagios_command.cfg
+cfg_file=/etc/nagios/nagios_contact.cfg
+cfg_file=/etc/nagios/nagios_contactgroup.cfg
+cfg_file=/etc/nagios/nagios_host.cfg
+cfg_file=/etc/nagios/nagios_hostdependency.cfg
+cfg_file=/etc/nagios/nagios_hostescalation.cfg
+cfg_file=/etc/nagios/nagios_hostextinfo.cfg
+cfg_file=/etc/nagios/nagios_hostgroup.cfg
+cfg_file=/etc/nagios/nagios_hostgroupescalation.cfg
+cfg_file=/etc/nagios/nagios_service.cfg
+cfg_file=/etc/nagios/nagios_servicedependency.cfg
+cfg_file=/etc/nagios/nagios_serviceescalation.cfg
+cfg_file=/etc/nagios/nagios_serviceextinfo.cfg
+cfg_file=/etc/nagios/nagios_servicegroup.cfg
+cfg_file=/etc/nagios/nagios_timeperiod.cfg
+
+# OBJECT CACHE FILE
+# This option determines where object definitions are cached when
+# Nagios starts/restarts.  The CGIs read object definitions from 
+# this cache file (rather than looking at the object config files
+# directly) in order to prevent inconsistencies that can occur
+# when the config files are modified after Nagios starts.
+
+object_cache_file=/var/log/nagios/objects.cache
+
+
+
+# RESOURCE FILE
+# This is an optional resource file that contains $USERx$ macro
+# definitions. Multiple resource files can be specified by using
+# multiple resource_file definitions.  The CGIs will not attempt to
+# read the contents of resource files, so information that is
+# considered to be sensitive (usernames, passwords, etc) can be
+# defined as macros in this file and restrictive permissions (600)
+# can be placed on this file.
+
+resource_file=/etc/nagios/private/resource.cfg
+
+
+
+# STATUS FILE
+# This is where the current status of all monitored services and
+# hosts is stored.  Its contents are read and processed by the CGIs.
+# The contents of the status file are deleted every time Nagios
+#  restarts.
+
+status_file=/var/log/nagios/status.dat
+
+
+
+# NAGIOS USER
+# This determines the effective user that Nagios should run as.  
+# You can either supply a username or a UID.
+
+nagios_user=nagios
+
+
+
+# NAGIOS GROUP
+# This determines the effective group that Nagios should run as.  
+# You can either supply a group name or a GID.
+
+nagios_group=nagios
+
+
+
+# EXTERNAL COMMAND OPTION
+# This option allows you to specify whether or not Nagios should check
+# for external commands (in the command file defined below).  By default
+# Nagios will *not* check for external commands, just to be on the
+# cautious side.  If you want to be able to use the CGI command interface
+# you will have to enable this.  Setting this value to 0 disables command
+# checking (the default), other values enable it.
+
+check_external_commands=0
+
+
+
+# EXTERNAL COMMAND CHECK INTERVAL
+# This is the interval at which Nagios should check for external commands.
+# This value works of the interval_length you specify later.  If you leave
+# that at its default value of 60 (seconds), a value of 1 here will cause
+# Nagios to check for external commands every minute.  If you specify a
+# number followed by an "s" (i.e. 15s), this will be interpreted to mean
+# actual seconds rather than a multiple of the interval_length variable.
+# Note: In addition to reading the external command file at regularly 
+# scheduled intervals, Nagios will also check for external commands after
+# event handlers are executed.
+# NOTE: Setting this value to -1 causes Nagios to check the external
+# command file as often as possible.
+
+#command_check_interval=15s
+command_check_interval=-1
+
+
+
+# EXTERNAL COMMAND FILE
+# This is the file that Nagios checks for external command requests.
+# It is also where the command CGI will write commands that are submitted
+# by users, so it must be writeable by the user that the web server
+# is running as (usually 'nobody').  Permissions should be set at the 
+# directory level instead of on the file, as the file is deleted every
+# time its contents are processed.
+
+command_file=/var/spool/nagios/cmd/nagios.cmd
+
+
+
+# EXTERNAL COMMAND BUFFER SLOTS
+# This settings is used to tweak the number of items or "slots" that
+# the Nagios daemon should allocate to the buffer that holds incoming 
+# external commands before they are processed.  As external commands 
+# are processed by the daemon, they are removed from the buffer.  
+
+external_command_buffer_slots=4096
+
+
+
+# COMMENT FILE
+# This is the file that Nagios will use for storing host and service
+# comments.
+
+comment_file=/var/log/nagios/comments.dat
+
+
+
+# DOWNTIME FILE
+# This is the file that Nagios will use for storing host and service
+# downtime data.
+
+downtime_file=/var/log/nagios/downtime.dat
+
+
+
+# LOCK FILE
+# This is the lockfile that Nagios will use to store its PID number
+# in when it is running in daemon mode.
+
+lock_file=/var/run/nagios.pid
+
+
+
+# TEMP FILE
+# This is a temporary file that is used as scratch space when Nagios
+# updates the status log, cleans the comment file, etc.  This file
+# is created, used, and deleted throughout the time that Nagios is
+# running.
+
+temp_file=/var/log/nagios/nagios.tmp
+
+
+
+# EVENT BROKER OPTIONS
+# Controls what (if any) data gets sent to the event broker.
+# Values:  0      = Broker nothing
+#         -1      = Broker everything
+#         <other> = See documentation
+
+event_broker_options=-1
+
+
+
+# EVENT BROKER MODULE(S)
+# This directive is used to specify an event broker module that should
+# by loaded by Nagios at startup.  Use multiple directives if you want
+# to load more than one module.  Arguments that should be passed to
+# the module at startup are seperated from the module path by a space.
+#
+# Example:
+#
+#   broker_module=<modulepath> [moduleargs]
+
+#broker_module=/somewhere/module1.o
+#broker_module=/somewhere/module2.o arg1 arg2=3 debug=0
+
+
+
+
+# LOG ROTATION METHOD
+# This is the log rotation method that Nagios should use to rotate
+# the main log file. Values are as follows..
+#	n	= None - don't rotate the log
+#	h	= Hourly rotation (top of the hour)
+#	d	= Daily rotation (midnight every day)
+#	w	= Weekly rotation (midnight on Saturday evening)
+#	m	= Monthly rotation (midnight last day of month)
+
+log_rotation_method=d
+
+
+
+# LOG ARCHIVE PATH
+# This is the directory where archived (rotated) log files should be 
+# placed (assuming you've chosen to do log rotation).
+
+log_archive_path=/var/log/nagios/archives
+
+
+
+# LOGGING OPTIONS
+# If you want messages logged to the syslog facility, as well as the
+# NetAlarm log file set this option to 1.  If not, set it to 0.
+
+use_syslog=1
+
+
+
+# NOTIFICATION LOGGING OPTION
+# If you don't want notifications to be logged, set this value to 0.
+# If notifications should be logged, set the value to 1.
+
+log_notifications=1
+
+
+
+# SERVICE RETRY LOGGING OPTION
+# If you don't want service check retries to be logged, set this value
+# to 0.  If retries should be logged, set the value to 1.
+
+log_service_retries=1
+
+
+
+# HOST RETRY LOGGING OPTION
+# If you don't want host check retries to be logged, set this value to
+# 0.  If retries should be logged, set the value to 1.
+
+log_host_retries=1
+
+
+
+# EVENT HANDLER LOGGING OPTION
+# If you don't want host and service event handlers to be logged, set
+# this value to 0.  If event handlers should be logged, set the value
+# to 1.
+
+log_event_handlers=1
+
+
+
+# INITIAL STATES LOGGING OPTION
+# If you want Nagios to log all initial host and service states to
+# the main log file (the first time the service or host is checked)
+# you can enable this option by setting this value to 1.  If you
+# are not using an external application that does long term state
+# statistics reporting, you do not need to enable this option.  In
+# this case, set the value to 0.
+
+log_initial_states=0
+
+
+
+# EXTERNAL COMMANDS LOGGING OPTION
+# If you don't want Nagios to log external commands, set this value
+# to 0.  If external commands should be logged, set this value to 1.
+# Note: This option does not include logging of passive service
+# checks - see the option below for controlling whether or not
+# passive checks are logged.
+
+log_external_commands=1
+
+
+
+# PASSIVE CHECKS LOGGING OPTION
+# If you don't want Nagios to log passive host and service checks, set
+# this value to 0.  If passive checks should be logged, set
+# this value to 1.
+
+log_passive_checks=1
+
+
+
+# GLOBAL HOST AND SERVICE EVENT HANDLERS
+# These options allow you to specify a host and service event handler
+# command that is to be run for every host or service state change.
+# The global event handler is executed immediately prior to the event
+# handler that you have optionally specified in each host or
+# service definition. The command argument is the short name of a
+# command definition that you define in your host configuration file.
+# Read the HTML docs for more information.
+
+#global_host_event_handler=somecommand
+#global_service_event_handler=somecommand
+
+
+
+# SERVICE INTER-CHECK DELAY METHOD
+# This is the method that Nagios should use when initially
+# "spreading out" service checks when it starts monitoring.  The
+# default is to use smart delay calculation, which will try to
+# space all service checks out evenly to minimize CPU load.
+# Using the dumb setting will cause all checks to be scheduled
+# at the same time (with no delay between them)!  This is not a
+# good thing for production, but is useful when testing the
+# parallelization functionality.
+#	n	= None - don't use any delay between checks
+#	d	= Use a "dumb" delay of 1 second between checks
+#	s	= Use "smart" inter-check delay calculation
+#       x.xx    = Use an inter-check delay of x.xx seconds
+
+service_inter_check_delay_method=s
+
+
+
+# MAXIMUM SERVICE CHECK SPREAD
+# This variable determines the timeframe (in minutes) from the
+# program start time that an initial check of all services should
+# be completed.  Default is 30 minutes.
+
+max_service_check_spread=30
+
+
+
+# SERVICE CHECK INTERLEAVE FACTOR
+# This variable determines how service checks are interleaved.
+# Interleaving the service checks allows for a more even
+# distribution of service checks and reduced load on remote
+# hosts.  Setting this value to 1 is equivalent to how versions
+# of Nagios previous to 0.0.5 did service checks.  Set this
+# value to s (smart) for automatic calculation of the interleave
+# factor unless you have a specific reason to change it.
+#       s       = Use "smart" interleave factor calculation
+#       x       = Use an interleave factor of x, where x is a
+#                 number greater than or equal to 1.
+
+service_interleave_factor=s
+
+
+
+# HOST INTER-CHECK DELAY METHOD
+# This is the method that Nagios should use when initially
+# "spreading out" host checks when it starts monitoring.  The
+# default is to use smart delay calculation, which will try to
+# space all host checks out evenly to minimize CPU load.
+# Using the dumb setting will cause all checks to be scheduled
+# at the same time (with no delay between them)!
+#	n	= None - don't use any delay between checks
+#	d	= Use a "dumb" delay of 1 second between checks
+#	s	= Use "smart" inter-check delay calculation
+#       x.xx    = Use an inter-check delay of x.xx seconds
+
+host_inter_check_delay_method=s
+
+
+
+# MAXIMUM HOST CHECK SPREAD
+# This variable determines the timeframe (in minutes) from the
+# program start time that an initial check of all hosts should
+# be completed.  Default is 30 minutes.
+
+max_host_check_spread=30
+
+
+
+# MAXIMUM CONCURRENT SERVICE CHECKS
+# This option allows you to specify the maximum number of 
+# service checks that can be run in parallel at any given time.
+# Specifying a value of 1 for this variable essentially prevents
+# any service checks from being parallelized.  A value of 0
+# will not restrict the number of concurrent checks that are
+# being executed.
+
+max_concurrent_checks=0
+
+
+
+# SERVICE CHECK REAPER FREQUENCY
+# This is the frequency (in seconds!) that Nagios will process
+# the results of services that have been checked.
+
+service_reaper_frequency=10
+
+
+
+# CHECK RESULT BUFFER SLOTS
+# This settings is used to tweak the number of items or "slots" that
+# the Nagios daemon should allocate to the buffer that holds 
+# service check results before they are processed.  As check results
+# are processed by the daemon, they are removed from the buffer.  
+
+check_result_buffer_slots=4096
+
+
+
+# AUTO-RESCHEDULING OPTION
+# This option determines whether or not Nagios will attempt to
+# automatically reschedule active host and service checks to
+# "smooth" them out over time.  This can help balance the load on
+# the monitoring server.  
+# WARNING: THIS IS AN EXPERIMENTAL FEATURE - IT CAN DEGRADE
+# PERFORMANCE, RATHER THAN INCREASE IT, IF USED IMPROPERLY
+
+auto_reschedule_checks=0
+
+
+
+# AUTO-RESCHEDULING INTERVAL
+# This option determines how often (in seconds) Nagios will
+# attempt to automatically reschedule checks.  This option only
+# has an effect if the auto_reschedule_checks option is enabled.
+# Default is 30 seconds.
+# WARNING: THIS IS AN EXPERIMENTAL FEATURE - IT CAN DEGRADE
+# PERFORMANCE, RATHER THAN INCREASE IT, IF USED IMPROPERLY
+
+auto_rescheduling_interval=30
+
+
+
+
+# AUTO-RESCHEDULING WINDOW
+# This option determines the "window" of time (in seconds) that
+# Nagios will look at when automatically rescheduling checks.
+# Only host and service checks that occur in the next X seconds
+# (determined by this variable) will be rescheduled. This option
+# only has an effect if the auto_reschedule_checks option is
+# enabled.  Default is 180 seconds (3 minutes).
+# WARNING: THIS IS AN EXPERIMENTAL FEATURE - IT CAN DEGRADE
+# PERFORMANCE, RATHER THAN INCREASE IT, IF USED IMPROPERLY
+
+auto_rescheduling_window=180
+
+
+
+# SLEEP TIME
+# This is the number of seconds to sleep between checking for system
+# events and service checks that need to be run.
+
+sleep_time=0.25
+
+
+
+# TIMEOUT VALUES
+# These options control how much time Nagios will allow various
+# types of commands to execute before killing them off.  Options
+# are available for controlling maximum time allotted for
+# service checks, host checks, event handlers, notifications, the
+# ocsp command, and performance data commands.  All values are in
+# seconds.
+
+service_check_timeout=60
+host_check_timeout=30
+event_handler_timeout=30
+notification_timeout=30
+ocsp_timeout=5
+perfdata_timeout=5
+
+
+
+# RETAIN STATE INFORMATION
+# This setting determines whether or not Nagios will save state
+# information for services and hosts before it shuts down.  Upon
+# startup Nagios will reload all saved service and host state
+# information before starting to monitor.  This is useful for 
+# maintaining long-term data on state statistics, etc, but will
+# slow Nagios down a bit when it (re)starts.  Since its only
+# a one-time penalty, I think its well worth the additional
+# startup delay.
+
+retain_state_information=1
+
+
+
+# STATE RETENTION FILE
+# This is the file that Nagios should use to store host and
+# service state information before it shuts down.  The state 
+# information in this file is also read immediately prior to
+# starting to monitor the network when Nagios is restarted.
+# This file is used only if the preserve_state_information
+# variable is set to 1.
+
+state_retention_file=/var/log/nagios/retention.dat
+
+
+
+# RETENTION DATA UPDATE INTERVAL
+# This setting determines how often (in minutes) that Nagios
+# will automatically save retention data during normal operation.
+# If you set this value to 0, Nagios will not save retention
+# data at regular interval, but it will still save retention
+# data before shutting down or restarting.  If you have disabled
+# state retention, this option has no effect.
+
+retention_update_interval=60
+
+
+
+# USE RETAINED PROGRAM STATE
+# This setting determines whether or not Nagios will set 
+# program status variables based on the values saved in the
+# retention file.  If you want to use retained program status
+# information, set this value to 1.  If not, set this value
+# to 0.
+
+use_retained_program_state=1
+
+
+
+# USE RETAINED SCHEDULING INFO
+# This setting determines whether or not Nagios will retain
+# the scheduling info (next check time) for hosts and services
+# based on the values saved in the retention file.  If you
+# If you want to use retained scheduling info, set this
+# value to 1.  If not, set this value to 0.
+
+use_retained_scheduling_info=0
+
+
+
+# INTERVAL LENGTH
+# This is the seconds per unit interval as used in the
+# host/contact/service configuration files.  Setting this to 60 means
+# that each interval is one minute long (60 seconds).  Other settings
+# have not been tested much, so your mileage is likely to vary...
+
+interval_length=60
+
+
+
+# AGGRESSIVE HOST CHECKING OPTION
+# If you don't want to turn on aggressive host checking features, set
+# this value to 0 (the default).  Otherwise set this value to 1 to
+# enable the aggressive check option.  Read the docs for more info
+# on what aggressive host check is or check out the source code in
+# base/checks.c
+
+use_aggressive_host_checking=0
+
+
+
+# SERVICE CHECK EXECUTION OPTION
+# This determines whether or not Nagios will actively execute
+# service checks when it initially starts.  If this option is 
+# disabled, checks are not actively made, but Nagios can still
+# receive and process passive check results that come in.  Unless
+# you're implementing redundant hosts or have a special need for
+# disabling the execution of service checks, leave this enabled!
+# Values: 1 = enable checks, 0 = disable checks
+
+execute_service_checks=1
+
+
+
+# PASSIVE SERVICE CHECK ACCEPTANCE OPTION
+# This determines whether or not Nagios will accept passive
+# service checks results when it initially (re)starts.
+# Values: 1 = accept passive checks, 0 = reject passive checks
+
+accept_passive_service_checks=1
+
+
+
+# HOST CHECK EXECUTION OPTION
+# This determines whether or not Nagios will actively execute
+# host checks when it initially starts.  If this option is 
+# disabled, checks are not actively made, but Nagios can still
+# receive and process passive check results that come in.  Unless
+# you're implementing redundant hosts or have a special need for
+# disabling the execution of host checks, leave this enabled!
+# Values: 1 = enable checks, 0 = disable checks
+
+execute_host_checks=1
+
+
+
+# PASSIVE HOST CHECK ACCEPTANCE OPTION
+# This determines whether or not Nagios will accept passive
+# host checks results when it initially (re)starts.
+# Values: 1 = accept passive checks, 0 = reject passive checks
+
+accept_passive_host_checks=1
+
+
+
+# NOTIFICATIONS OPTION
+# This determines whether or not Nagios will sent out any host or
+# service notifications when it is initially (re)started.
+# Values: 1 = enable notifications, 0 = disable notifications
+
+enable_notifications=1
+
+
+
+# EVENT HANDLER USE OPTION
+# This determines whether or not Nagios will run any host or
+# service event handlers when it is initially (re)started.  Unless
+# you're implementing redundant hosts, leave this option enabled.
+# Values: 1 = enable event handlers, 0 = disable event handlers
+
+enable_event_handlers=1
+
+
+
+# PROCESS PERFORMANCE DATA OPTION
+# This determines whether or not Nagios will process performance
+# data returned from service and host checks.  If this option is
+# enabled, host performance data will be processed using the
+# host_perfdata_command (defined below) and service performance
+# data will be processed using the service_perfdata_command (also
+# defined below).  Read the HTML docs for more information on
+# performance data.
+# Values: 1 = process performance data, 0 = do not process performance data
+
+process_performance_data=0
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA PROCESSING COMMANDS
+# These commands are run after every host and service check is
+# performed.  These commands are executed only if the
+# enable_performance_data option (above) is set to 1.  The command
+# argument is the short name of a command definition that you 
+# define in your host configuration file.  Read the HTML docs for
+# more information on performance data.
+
+#host_perfdata_command=process-host-perfdata
+#service_perfdata_command=process-service-perfdata
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILES
+# These files are used to store host and service performance data.
+# Performance data is only written to these files if the
+# enable_performance_data option (above) is set to 1.
+
+#host_perfdata_file=/tmp/host-perfdata
+#service_perfdata_file=/tmp/service-perfdata
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILE TEMPLATES
+# These options determine what data is written (and how) to the
+# performance data files.  The templates may contain macros, special
+# characters (\t for tab, \r for carriage return, \n for newline)
+# and plain text.  A newline is automatically added after each write
+# to the performance data file.  Some examples of what you can do are
+# shown below.
+
+#host_perfdata_file_template=[HOSTPERFDATA]\t$TIMET$\t$HOSTNAME$\t$HOSTEXECUTIONTIME$\t$HOSTOUTPUT$\t$HOSTPERFDATA$
+#service_perfdata_file_template=[SERVICEPERFDATA]\t$TIMET$\t$HOSTNAME$\t$SERVICEDESC$\t$SERVICEEXECUTIONTIME$\t$SERVICELATENCY$\t$SERVICEOUTPUT$\t$SERVICEPERFDATA$
+
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILE MODES
+# This option determines whether or not the host and service
+# performance data files are opened in write ("w") or append ("a")
+# mode.  Unless you are the files are named pipes, you will probably
+# want to use the default mode of append ("a").
+
+#host_perfdata_file_mode=a
+#service_perfdata_file_mode=a
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILE PROCESSING INTERVAL
+# These options determine how often (in seconds) the host and service
+# performance data files are processed using the commands defined
+# below.  A value of 0 indicates the files should not be periodically
+# processed.
+
+#host_perfdata_file_processing_interval=0
+#service_perfdata_file_processing_interval=0
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILE PROCESSING COMMANDS
+# These commands are used to periodically process the host and
+# service performance data files.  The interval at which the
+# processing occurs is determined by the options above.
+
+#host_perfdata_file_processing_command=process-host-perfdata-file
+#service_perfdata_file_processing_command=process-service-perfdata-file
+
+
+
+# OBSESS OVER SERVICE CHECKS OPTION
+# This determines whether or not Nagios will obsess over service
+# checks and run the ocsp_command defined below.  Unless you're
+# planning on implementing distributed monitoring, do not enable
+# this option.  Read the HTML docs for more information on
+# implementing distributed monitoring.
+# Values: 1 = obsess over services, 0 = do not obsess (default)
+
+obsess_over_services=0
+
+
+
+# OBSESSIVE COMPULSIVE SERVICE PROCESSOR COMMAND
+# This is the command that is run for every service check that is
+# processed by Nagios.  This command is executed only if the
+# obsess_over_service option (above) is set to 1.  The command 
+# argument is the short name of a command definition that you
+# define in your host configuration file. Read the HTML docs for
+# more information on implementing distributed monitoring.
+
+#ocsp_command=somecommand
+
+
+
+# ORPHANED SERVICE CHECK OPTION
+# This determines whether or not Nagios will periodically 
+# check for orphaned services.  Since service checks are not
+# rescheduled until the results of their previous execution 
+# instance are processed, there exists a possibility that some
+# checks may never get rescheduled.  This seems to be a rare
+# problem and should not happen under normal circumstances.
+# If you have problems with service checks never getting
+# rescheduled, you might want to try enabling this option.
+# Values: 1 = enable checks, 0 = disable checks
+
+check_for_orphaned_services=1
+
+
+
+# SERVICE FRESHNESS CHECK OPTION
+# This option determines whether or not Nagios will periodically
+# check the "freshness" of service results.  Enabling this option
+# is useful for ensuring passive checks are received in a timely
+# manner.
+# Values: 1 = enabled freshness checking, 0 = disable freshness checking
+
+check_service_freshness=1
+
+
+
+# SERVICE FRESHNESS CHECK INTERVAL
+# This setting determines how often (in seconds) Nagios will
+# check the "freshness" of service check results.  If you have
+# disabled service freshness checking, this option has no effect.
+
+service_freshness_check_interval=60
+
+
+
+# HOST FRESHNESS CHECK OPTION
+# This option determines whether or not Nagios will periodically
+# check the "freshness" of host results.  Enabling this option
+# is useful for ensuring passive checks are received in a timely
+# manner.
+# Values: 1 = enabled freshness checking, 0 = disable freshness checking
+
+check_host_freshness=0
+
+
+
+# HOST FRESHNESS CHECK INTERVAL
+# This setting determines how often (in seconds) Nagios will
+# check the "freshness" of host check results.  If you have
+# disabled host freshness checking, this option has no effect.
+
+host_freshness_check_interval=60
+
+
+
+# AGGREGATED STATUS UPDATES
+# This option determines whether or not Nagios will 
+# aggregate updates of host, service, and program status
+# data.  Normally, status data is updated immediately when
+# a change occurs.  This can result in high CPU loads if
+# you are monitoring a lot of services.  If you want Nagios
+# to only refresh status data every few seconds, disable
+# this option.
+# Values: 1 = enable aggregate updates, 0 = disable aggregate updates
+
+aggregate_status_updates=1
+
+
+
+# AGGREGATED STATUS UPDATE INTERVAL
+# Combined with the aggregate_status_updates option,
+# this option determines the frequency (in seconds!) that
+# Nagios will periodically dump program, host, and 
+# service status data.  If you are not using aggregated
+# status data updates, this option has no effect.
+
+status_update_interval=15
+
+
+
+# FLAP DETECTION OPTION
+# This option determines whether or not Nagios will try
+# and detect hosts and services that are "flapping".  
+# Flapping occurs when a host or service changes between
+# states too frequently.  When Nagios detects that a 
+# host or service is flapping, it will temporarily suppress
+# notifications for that host/service until it stops
+# flapping.  Flap detection is very experimental, so read
+# the HTML documentation before enabling this feature!
+# Values: 1 = enable flap detection
+#         0 = disable flap detection (default)
+
+enable_flap_detection=0
+
+
+
+# FLAP DETECTION THRESHOLDS FOR HOSTS AND SERVICES
+# Read the HTML documentation on flap detection for
+# an explanation of what this option does.  This option
+# has no effect if flap detection is disabled.
+
+low_service_flap_threshold=5.0
+high_service_flap_threshold=20.0
+low_host_flap_threshold=5.0
+high_host_flap_threshold=20.0
+
+
+
+# DATE FORMAT OPTION
+# This option determines how short dates are displayed. Valid options
+# include:
+#	us		(MM-DD-YYYY HH:MM:SS)
+#	euro    	(DD-MM-YYYY HH:MM:SS)
+#	iso8601		(YYYY-MM-DD HH:MM:SS)
+#	strict-iso8601	(YYYY-MM-DDTHH:MM:SS)
+#
+
+date_format=us
+
+
+
+# P1.PL FILE LOCATION
+# This value determines where the p1.pl perl script (used by the
+# embedded Perl interpreter) is located.  If you didn't compile
+# Nagios with embedded Perl support, this option has no effect.
+
+p1_file=/usr/sbin/p1.pl
+
+
+
+# ILLEGAL OBJECT NAME CHARACTERS
+# This option allows you to specify illegal characters that cannot
+# be used in host names, service descriptions, or names of other
+# object types.
+
+illegal_object_name_chars=`~!$%^&*|'"<>?,()=
+
+
+
+# ILLEGAL MACRO OUTPUT CHARACTERS
+# This option allows you to specify illegal characters that are
+# stripped from macros before being used in notifications, event
+# handlers, etc.  This DOES NOT affect macros used in service or
+# host check commands.
+# The following macros are stripped of the characters you specify:
+#	$HOSTOUTPUT$
+#	$HOSTPERFDATA$
+#	$HOSTACKAUTHOR$
+#	$HOSTACKCOMMENT$
+#	$SERVICEOUTPUT$
+#	$SERVICEPERFDATA$
+#	$SERVICEACKAUTHOR$
+#	$SERVICEACKCOMMENT$
+
+illegal_macro_output_chars=`~$&|'"<>
+
+
+
+# REGULAR EXPRESSION MATCHING
+# This option controls whether or not regular expression matching
+# takes place in the object config files.  Regular expression
+# matching is used to match host, hostgroup, service, and service
+# group names/descriptions in some fields of various object types.
+# Values: 1 = enable regexp matching, 0 = disable regexp matching
+
+use_regexp_matching=0
+
+
+
+# "TRUE" REGULAR EXPRESSION MATCHING
+# This option controls whether or not "true" regular expression 
+# matching takes place in the object config files.  This option
+# only has an effect if regular expression matching is enabled
+# (see above).  If this option is DISABLED, regular expression
+# matching only occurs if a string contains wildcard characters
+# (* and ?).  If the option is ENABLED, regexp matching occurs
+# all the time (which can be annoying).
+# Values: 1 = enable true matching, 0 = disable true matching
+
+use_true_regexp_matching=0
+
+
+
+
+# ADMINISTRATOR EMAIL ADDRESS
+# The email address of the administrator of *this* machine (the one
+# doing the monitoring).  Nagios never uses this value itself, but
+# you can access this value by using the $ADMINEMAIL$ macro in your
+# notification commands.
+
+admin_email=nagios
+
+
+
+# ADMINISTRATOR PAGER NUMBER/ADDRESS
+# The pager number/address for the administrator of *this* machine.
+# Nagios never uses this value itself, but you can access this
+# value by using the $ADMINPAGER$ macro in your notification
+# commands.
+
+admin_pager=pagenagios
+
+
+
+# DAEMON CORE DUMP OPTION
+# This option determines whether or not Nagios is allowed to create
+# a core dump when it runs as a daemon.  Note that it is generally
+# considered bad form to allow this, but it may be useful for
+# debugging purposes.
+# Values: 1 - Allow core dumps
+#         0 - Do not allow core dumps (default)
+
+daemon_dumps_core=0
+
+
+
diff --git a/puppet/modules/nagios/files/configs/CentOS/private/resource.cfg.i386 b/puppet/modules/nagios/files/configs/CentOS/private/resource.cfg.i386
new file mode 100644
index 00000000..0ccf2e17
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/CentOS/private/resource.cfg.i386
@@ -0,0 +1,34 @@
+###########################################################################
+#
+# RESOURCE.CFG - Sample Resource File for Nagios 2.9
+#
+# Last Modified: 09-10-2003
+#
+# You can define $USERx$ macros in this file, which can in turn be used
+# in command definitions in your host config file(s).  $USERx$ macros are
+# useful for storing sensitive information such as usernames, passwords, 
+# etc.  They are also handy for specifying the path to plugins and 
+# event handlers - if you decide to move the plugins or event handlers to
+# a different directory in the future, you can just update one or two
+# $USERx$ macros, instead of modifying a lot of command definitions.
+#
+# The CGIs will not attempt to read the contents of resource files, so
+# you can set restrictive permissions (600 or 660) on them.
+#
+# Nagios supports up to 32 $USERx$ macros ($USER1$ through $USER32$)
+#
+# Resource files may also be used to store configuration directives for
+# external data sources like MySQL...
+#
+###########################################################################
+
+# Sets $USER1$ to be the path to the plugins
+$USER1$=/usr/lib/nagios/plugins
+
+# Sets $USER2$ to be the path to event handlers
+#$USER2$=/usr/lib64/nagios/plugins/eventhandlers
+
+# Store some usernames and passwords (hidden from the CGIs)
+#$USER3$=someuser
+#$USER4$=somepassword
+
diff --git a/puppet/modules/nagios/files/configs/CentOS/private/resource.cfg.x86_64 b/puppet/modules/nagios/files/configs/CentOS/private/resource.cfg.x86_64
new file mode 100644
index 00000000..b9f0841c
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/CentOS/private/resource.cfg.x86_64
@@ -0,0 +1,34 @@
+###########################################################################
+#
+# RESOURCE.CFG - Sample Resource File for Nagios 2.9
+#
+# Last Modified: 09-10-2003
+#
+# You can define $USERx$ macros in this file, which can in turn be used
+# in command definitions in your host config file(s).  $USERx$ macros are
+# useful for storing sensitive information such as usernames, passwords, 
+# etc.  They are also handy for specifying the path to plugins and 
+# event handlers - if you decide to move the plugins or event handlers to
+# a different directory in the future, you can just update one or two
+# $USERx$ macros, instead of modifying a lot of command definitions.
+#
+# The CGIs will not attempt to read the contents of resource files, so
+# you can set restrictive permissions (600 or 660) on them.
+#
+# Nagios supports up to 32 $USERx$ macros ($USER1$ through $USER32$)
+#
+# Resource files may also be used to store configuration directives for
+# external data sources like MySQL...
+#
+###########################################################################
+
+# Sets $USER1$ to be the path to the plugins
+$USER1$=/usr/lib64/nagios/plugins
+
+# Sets $USER2$ to be the path to event handlers
+#$USER2$=/usr/lib64/nagios/plugins/eventhandlers
+
+# Store some usernames and passwords (hidden from the CGIs)
+#$USER3$=someuser
+#$USER4$=somepassword
+
diff --git a/puppet/modules/nagios/files/configs/Debian/cgi.cfg b/puppet/modules/nagios/files/configs/Debian/cgi.cfg
new file mode 100644
index 00000000..103db8a1
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/Debian/cgi.cfg
@@ -0,0 +1,330 @@
+#################################################################
+#
+# CGI.CFG - Sample CGI Configuration File for Nagios 
+#
+#################################################################
+
+
+# MAIN CONFIGURATION FILE
+# This tells the CGIs where to find your main configuration file.
+# The CGIs will read the main and host config files for any other
+# data they might need.
+
+main_config_file=/etc/nagios3/nagios.cfg
+
+
+
+# PHYSICAL HTML PATH
+# This is the path where the HTML files for Nagios reside.  This
+# value is used to locate the logo images needed by the statusmap
+# and statuswrl CGIs.
+
+physical_html_path=/usr/share/nagios3/htdocs
+
+
+
+# URL HTML PATH
+# This is the path portion of the URL that corresponds to the
+# physical location of the Nagios HTML files (as defined above).
+# This value is used by the CGIs to locate the online documentation
+# and graphics.  If you access the Nagios pages with an URL like
+# http://www.myhost.com/nagios, this value should be '/nagios'
+# (without the quotes).
+
+url_html_path=/nagios3
+
+
+
+# CONTEXT-SENSITIVE HELP
+# This option determines whether or not a context-sensitive
+# help icon will be displayed for most of the CGIs.
+# Values: 0 = disables context-sensitive help
+#         1 = enables context-sensitive help
+
+show_context_help=1
+
+
+
+# PENDING STATES OPTION
+# This option determines what states should be displayed in the web
+# interface for hosts/services that have not yet been checked.
+# Values: 0 = leave hosts/services that have not been check yet in their original state
+#         1 = mark hosts/services that have not been checked yet as PENDING
+
+use_pending_states=1
+
+nagios_check_command=/usr/lib/nagios/plugins/check_nagios /var/cache/nagios3/status.dat 5 '/usr/sbin/nagios3'
+
+
+# AUTHENTICATION USAGE
+# This option controls whether or not the CGIs will use any 
+# authentication when displaying host and service information, as
+# well as committing commands to Nagios for processing.  
+#
+# Read the HTML documentation to learn how the authorization works!
+#
+# NOTE: It is a really *bad* idea to disable authorization, unless
+# you plan on removing the command CGI (cmd.cgi)!  Failure to do
+# so will leave you wide open to kiddies messing with Nagios and
+# possibly hitting you with a denial of service attack by filling up
+# your drive by continuously writing to your command file!
+#
+# Setting this value to 0 will cause the CGIs to *not* use
+# authentication (bad idea), while any other value will make them
+# use the authentication functions (the default).
+
+use_authentication=1
+
+
+
+
+# x509 CERT AUTHENTICATION
+# When enabled, this option allows you to use x509 cert (SSL)
+# authentication in the CGIs.  This is an advanced option and should
+# not be enabled unless you know what you're doing.
+
+use_ssl_authentication=0
+
+
+
+
+# DEFAULT USER
+# Setting this variable will define a default user name that can
+# access pages without authentication.  This allows people within a
+# secure domain (i.e., behind a firewall) to see the current status
+# without authenticating.  You may want to use this to avoid basic
+# authentication if you are not using a secure server since basic
+# authentication transmits passwords in the clear.
+#
+# Important:  Do not define a default username unless you are
+# running a secure web server and are sure that everyone who has
+# access to the CGIs has been authenticated in some manner!  If you
+# define this variable, anyone who has not authenticated to the web
+# server will inherit all rights you assign to this user!
+ 
+#default_user_name=guest
+
+
+
+# SYSTEM/PROCESS INFORMATION ACCESS
+# This option is a comma-delimited list of all usernames that
+# have access to viewing the Nagios process information as
+# provided by the Extended Information CGI (extinfo.cgi).  By
+# default, *no one* has access to this unless you choose to
+# not use authorization.  You may use an asterisk (*) to
+# authorize any user who has authenticated to the web server.
+
+authorized_for_system_information=nagiosadmin
+
+
+
+# CONFIGURATION INFORMATION ACCESS
+# This option is a comma-delimited list of all usernames that
+# can view ALL configuration information (hosts, commands, etc).
+# By default, users can only view configuration information
+# for the hosts and services they are contacts for. You may use
+# an asterisk (*) to authorize any user who has authenticated
+# to the web server.
+
+authorized_for_configuration_information=nagiosadmin
+
+
+
+# SYSTEM/PROCESS COMMAND ACCESS
+# This option is a comma-delimited list of all usernames that
+# can issue shutdown and restart commands to Nagios via the
+# command CGI (cmd.cgi).  Users in this list can also change
+# the program mode to active or standby. By default, *no one*
+# has access to this unless you choose to not use authorization.
+# You may use an asterisk (*) to authorize any user who has
+# authenticated to the web server.
+
+authorized_for_system_commands=nagiosadmin
+
+
+
+# GLOBAL HOST/SERVICE VIEW ACCESS
+# These two options are comma-delimited lists of all usernames that
+# can view information for all hosts and services that are being
+# monitored.  By default, users can only view information
+# for hosts or services that they are contacts for (unless you
+# you choose to not use authorization). You may use an asterisk (*)
+# to authorize any user who has authenticated to the web server.
+
+
+authorized_for_all_services=nagiosadmin
+authorized_for_all_hosts=nagiosadmin
+
+
+
+# GLOBAL HOST/SERVICE COMMAND ACCESS
+# These two options are comma-delimited lists of all usernames that
+# can issue host or service related commands via the command
+# CGI (cmd.cgi) for all hosts and services that are being monitored. 
+# By default, users can only issue commands for hosts or services 
+# that they are contacts for (unless you you choose to not use 
+# authorization).  You may use an asterisk (*) to authorize any
+# user who has authenticated to the web server.
+
+authorized_for_all_service_commands=nagiosadmin
+authorized_for_all_host_commands=nagiosadmin
+
+
+
+
+# STATUSMAP BACKGROUND IMAGE
+# This option allows you to specify an image to be used as a 
+# background in the statusmap CGI.  It is assumed that the image
+# resides in the HTML images path (i.e. /usr/local/nagios/share/images).
+# This path is automatically determined by appending "/images"
+# to the path specified by the 'physical_html_path' directive.
+# Note:  The image file may be in GIF, PNG, JPEG, or GD2 format.
+# However, I recommend that you convert your image to GD2 format
+# (uncompressed), as this will cause less CPU load when the CGI
+# generates the image.
+
+#statusmap_background_image=smbackground.gd2
+
+
+
+# DEFAULT STATUSMAP LAYOUT METHOD
+# This option allows you to specify the default layout method
+# the statusmap CGI should use for drawing hosts.  If you do
+# not use this option, the default is to use user-defined
+# coordinates.  Valid options are as follows:
+#	0 = User-defined coordinates
+#	1 = Depth layers
+#       2 = Collapsed tree
+#       3 = Balanced tree
+#       4 = Circular
+#       5 = Circular (Marked Up)
+
+default_statusmap_layout=5
+
+
+
+# DEFAULT STATUSWRL LAYOUT METHOD
+# This option allows you to specify the default layout method
+# the statuswrl (VRML) CGI should use for drawing hosts.  If you
+# do not use this option, the default is to use user-defined
+# coordinates.  Valid options are as follows:
+#	0 = User-defined coordinates
+#       2 = Collapsed tree
+#       3 = Balanced tree
+#       4 = Circular
+
+default_statuswrl_layout=4
+
+
+
+# STATUSWRL INCLUDE
+# This option allows you to include your own objects in the 
+# generated VRML world.  It is assumed that the file
+# resides in the HTML path (i.e. /usr/local/nagios/share).
+
+#statuswrl_include=myworld.wrl
+
+
+
+# PING SYNTAX
+# This option determines what syntax should be used when
+# attempting to ping a host from the WAP interface (using
+# the statuswml CGI.  You must include the full path to
+# the ping binary, along with all required options.  The
+# $HOSTADDRESS$ macro is substituted with the address of
+# the host before the command is executed.
+# Please note that the syntax for the ping binary is
+# notorious for being different on virtually ever *NIX
+# OS and distribution, so you may have to tweak this to
+# work on your system.
+
+ping_syntax=/bin/ping -n -U -c 5 $HOSTADDRESS$
+
+
+
+# REFRESH RATE
+# This option allows you to specify the refresh rate in seconds
+# of various CGIs (status, statusmap, extinfo, and outages).  
+
+refresh_rate=90
+
+
+
+# ESCAPE HTML TAGS
+# This option determines whether HTML tags in host and service
+# status output is escaped in the web interface.  If enabled,
+# your plugin output will not be able to contain clickable links.
+
+escape_html_tags=1
+
+
+
+
+# SOUND OPTIONS
+# These options allow you to specify an optional audio file
+# that should be played in your browser window when there are
+# problems on the network.  The audio files are used only in
+# the status CGI.  Only the sound for the most critical problem
+# will be played.  Order of importance (higher to lower) is as
+# follows: unreachable hosts, down hosts, critical services,
+# warning services, and unknown services. If there are no
+# visible problems, the sound file optionally specified by
+# 'normal_sound' variable will be played.
+#
+#
+# <varname>=<sound_file>
+#
+# Note: All audio files must be placed in the /media subdirectory
+# under the HTML path (i.e. /usr/local/nagios/share/media/).
+
+#host_unreachable_sound=hostdown.wav
+#host_down_sound=hostdown.wav
+#service_critical_sound=critical.wav
+#service_warning_sound=warning.wav
+#service_unknown_sound=warning.wav
+#normal_sound=noproblem.wav
+
+
+
+# URL TARGET FRAMES
+# These options determine the target frames in which notes and 
+# action URLs will open.
+
+action_url_target=_blank
+notes_url_target=_blank
+
+
+
+
+# LOCK AUTHOR NAMES OPTION
+# This option determines whether users can change the author name 
+# when submitting comments, scheduling downtime.  If disabled, the 
+# author names will be locked into their contact name, as defined in Nagios.
+# Values: 0 = allow editing author names
+#         1 = lock author names (disallow editing)
+
+lock_author_names=1
+
+
+
+
+# SPLUNK INTEGRATION OPTIONS
+# These options allow you to enable integration with Splunk
+# in the web interface.  If enabled, you'll be presented with
+# "Splunk It" links in various places in the CGIs (log file,
+# alert history, host/service detail, etc).  Useful if you're
+# trying to research why a particular problem occurred.
+# For more information on Splunk, visit http://www.splunk.com/
+
+# This option determines whether the Splunk integration is enabled
+# Values: 0 = disable Splunk integration
+#         1 = enable Splunk integration
+
+#enable_splunk_integration=1
+
+
+# This option should be the URL used to access your instance of Splunk
+
+#splunk_url=http://127.0.0.1:8000/
+
+
diff --git a/puppet/modules/nagios/files/configs/Debian/nagios.cfg b/puppet/modules/nagios/files/configs/Debian/nagios.cfg
new file mode 100644
index 00000000..291a4741
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/Debian/nagios.cfg
@@ -0,0 +1,1288 @@
+##############################################################################
+#
+# NAGIOS.CFG - Sample Main Config File for Nagios 
+#
+#
+##############################################################################
+
+
+# LOG FILE
+# This is the main log file where service and host events are logged
+# for historical purposes.  This should be the first option specified 
+# in the config file!!!
+
+log_file=/var/log/nagios3/nagios.log
+
+
+
+# OBJECT CONFIGURATION FILE(S)
+# These are the object configuration files in which you define hosts,
+# host groups, contacts, contact groups, services, etc.
+# You can split your object definitions across several config files
+# if you wish (as shown below), or keep them all in a single config file.
+#cfg_file=/etc/nagios3/commands.cfg
+
+# Puppet-managed configuration files
+cfg_file=/etc/nagios3/nagios_templates.cfg
+cfg_file=/etc/nagios3/nagios_command.cfg
+cfg_file=/etc/nagios3/nagios_contact.cfg
+cfg_file=/etc/nagios3/nagios_contactgroup.cfg
+cfg_file=/etc/nagios3/nagios_host.cfg
+cfg_file=/etc/nagios3/nagios_hostdependency.cfg
+cfg_file=/etc/nagios3/nagios_hostescalation.cfg
+cfg_file=/etc/nagios3/nagios_hostextinfo.cfg
+cfg_file=/etc/nagios3/nagios_hostgroup.cfg
+cfg_file=/etc/nagios3/nagios_hostgroupescalation.cfg
+cfg_file=/etc/nagios3/nagios_service.cfg
+cfg_file=/etc/nagios3/nagios_servicedependency.cfg
+cfg_file=/etc/nagios3/nagios_serviceescalation.cfg
+cfg_file=/etc/nagios3/nagios_serviceextinfo.cfg
+cfg_file=/etc/nagios3/nagios_servicegroup.cfg
+cfg_file=/etc/nagios3/nagios_timeperiod.cfg
+
+# Debian also defaults to using the check commands defined by the debian
+# nagios-plugins package
+cfg_dir=/etc/nagios-plugins/config
+
+
+
+# OBJECT CACHE FILE
+# This option determines where object definitions are cached when
+# Nagios starts/restarts.  The CGIs read object definitions from 
+# this cache file (rather than looking at the object config files
+# directly) in order to prevent inconsistencies that can occur
+# when the config files are modified after Nagios starts.
+
+object_cache_file=/var/cache/nagios3/objects.cache
+
+
+
+# PRE-CACHED OBJECT FILE
+# This options determines the location of the precached object file.
+# If you run Nagios with the -p command line option, it will preprocess
+# your object configuration file(s) and write the cached config to this
+# file.  You can then start Nagios with the -u option to have it read
+# object definitions from this precached file, rather than the standard
+# object configuration files (see the cfg_file and cfg_dir options above).
+# Using a precached object file can speed up the time needed to (re)start 
+# the Nagios process if you've got a large and/or complex configuration.
+# Read the documentation section on optimizing Nagios to find our more
+# about how this feature works.
+
+precached_object_file=/var/lib/nagios3/objects.precache
+
+
+
+# RESOURCE FILE
+# This is an optional resource file that contains $USERx$ macro
+# definitions. Multiple resource files can be specified by using
+# multiple resource_file definitions.  The CGIs will not attempt to
+# read the contents of resource files, so information that is
+# considered to be sensitive (usernames, passwords, etc) can be
+# defined as macros in this file and restrictive permissions (600)
+# can be placed on this file.
+
+resource_file=/etc/nagios3/resource.cfg
+
+
+
+# STATUS FILE
+# This is where the current status of all monitored services and
+# hosts is stored.  Its contents are read and processed by the CGIs.
+# The contents of the status file are deleted every time Nagios
+#  restarts.
+
+status_file=/var/cache/nagios3/status.dat
+
+
+
+# STATUS FILE UPDATE INTERVAL
+# This option determines the frequency (in seconds) that
+# Nagios will periodically dump program, host, and 
+# service status data.
+
+status_update_interval=10
+
+
+
+# NAGIOS USER
+# This determines the effective user that Nagios should run as.  
+# You can either supply a username or a UID.
+
+nagios_user=nagios
+
+
+
+# NAGIOS GROUP
+# This determines the effective group that Nagios should run as.  
+# You can either supply a group name or a GID.
+
+nagios_group=nagios
+
+
+
+# EXTERNAL COMMAND OPTION
+# This option allows you to specify whether or not Nagios should check
+# for external commands (in the command file defined below).  By default
+# Nagios will *not* check for external commands, just to be on the
+# cautious side.  If you want to be able to use the CGI command interface
+# you will have to enable this.
+# Values: 0 = disable commands, 1 = enable commands
+
+check_external_commands=0
+
+
+
+# EXTERNAL COMMAND CHECK INTERVAL
+# This is the interval at which Nagios should check for external commands.
+# This value works of the interval_length you specify later.  If you leave
+# that at its default value of 60 (seconds), a value of 1 here will cause
+# Nagios to check for external commands every minute.  If you specify a
+# number followed by an "s" (i.e. 15s), this will be interpreted to mean
+# actual seconds rather than a multiple of the interval_length variable.
+# Note: In addition to reading the external command file at regularly 
+# scheduled intervals, Nagios will also check for external commands after
+# event handlers are executed.
+# NOTE: Setting this value to -1 causes Nagios to check the external
+# command file as often as possible.
+
+#command_check_interval=15s
+command_check_interval=-1
+
+
+
+# EXTERNAL COMMAND FILE
+# This is the file that Nagios checks for external command requests.
+# It is also where the command CGI will write commands that are submitted
+# by users, so it must be writeable by the user that the web server
+# is running as (usually 'nobody').  Permissions should be set at the 
+# directory level instead of on the file, as the file is deleted every
+# time its contents are processed.
+# Debian Users: In case you didn't read README.Debian yet, _NOW_ is the
+# time to do it.
+
+command_file=/var/lib/nagios3/rw/nagios.cmd
+
+
+
+# EXTERNAL COMMAND BUFFER SLOTS
+# This settings is used to tweak the number of items or "slots" that
+# the Nagios daemon should allocate to the buffer that holds incoming 
+# external commands before they are processed.  As external commands 
+# are processed by the daemon, they are removed from the buffer.  
+
+external_command_buffer_slots=4096
+
+
+
+# LOCK FILE
+# This is the lockfile that Nagios will use to store its PID number
+# in when it is running in daemon mode.
+
+lock_file=/var/run/nagios3/nagios3.pid
+
+
+
+# TEMP FILE
+# This is a temporary file that is used as scratch space when Nagios
+# updates the status log, cleans the comment file, etc.  This file
+# is created, used, and deleted throughout the time that Nagios is
+# running.
+
+temp_file=/var/cache/nagios3/nagios.tmp
+
+
+
+# TEMP PATH
+# This is path where Nagios can create temp files for service and
+# host check results, etc.
+
+temp_path=/tmp
+
+
+
+# EVENT BROKER OPTIONS
+# Controls what (if any) data gets sent to the event broker.
+# Values:  0      = Broker nothing
+#         -1      = Broker everything
+#         <other> = See documentation
+
+event_broker_options=-1
+
+
+
+# EVENT BROKER MODULE(S)
+# This directive is used to specify an event broker module that should
+# by loaded by Nagios at startup.  Use multiple directives if you want
+# to load more than one module.  Arguments that should be passed to
+# the module at startup are seperated from the module path by a space.
+#
+#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+# WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING !!! WARNING
+#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+#
+# Do NOT overwrite modules while they are being used by Nagios or Nagios
+# will crash in a fiery display of SEGFAULT glory.  This is a bug/limitation
+# either in dlopen(), the kernel, and/or the filesystem.  And maybe Nagios...
+#
+# The correct/safe way of updating a module is by using one of these methods:
+#    1. Shutdown Nagios, replace the module file, restart Nagios
+#    2. Delete the original module file, move the new module file into place, restart Nagios
+#
+# Example:
+#
+#   broker_module=<modulepath> [moduleargs]
+
+#broker_module=/somewhere/module1.o
+#broker_module=/somewhere/module2.o arg1 arg2=3 debug=0
+
+
+
+# LOG ROTATION METHOD
+# This is the log rotation method that Nagios should use to rotate
+# the main log file. Values are as follows..
+#	n	= None - don't rotate the log
+#	h	= Hourly rotation (top of the hour)
+#	d	= Daily rotation (midnight every day)
+#	w	= Weekly rotation (midnight on Saturday evening)
+#	m	= Monthly rotation (midnight last day of month)
+
+log_rotation_method=d
+
+
+
+# LOG ARCHIVE PATH
+# This is the directory where archived (rotated) log files should be 
+# placed (assuming you've chosen to do log rotation).
+
+log_archive_path=/var/log/nagios3/archives
+
+
+
+# LOGGING OPTIONS
+# If you want messages logged to the syslog facility, as well as the
+# Nagios log file set this option to 1.  If not, set it to 0.
+
+use_syslog=1
+
+
+
+# NOTIFICATION LOGGING OPTION
+# If you don't want notifications to be logged, set this value to 0.
+# If notifications should be logged, set the value to 1.
+
+log_notifications=1
+
+
+
+# SERVICE RETRY LOGGING OPTION
+# If you don't want service check retries to be logged, set this value
+# to 0.  If retries should be logged, set the value to 1.
+
+log_service_retries=1
+
+
+
+# HOST RETRY LOGGING OPTION
+# If you don't want host check retries to be logged, set this value to
+# 0.  If retries should be logged, set the value to 1.
+
+log_host_retries=1
+
+
+
+# EVENT HANDLER LOGGING OPTION
+# If you don't want host and service event handlers to be logged, set
+# this value to 0.  If event handlers should be logged, set the value
+# to 1.
+
+log_event_handlers=1
+
+
+
+# INITIAL STATES LOGGING OPTION
+# If you want Nagios to log all initial host and service states to
+# the main log file (the first time the service or host is checked)
+# you can enable this option by setting this value to 1.  If you
+# are not using an external application that does long term state
+# statistics reporting, you do not need to enable this option.  In
+# this case, set the value to 0.
+
+log_initial_states=0
+
+
+
+# EXTERNAL COMMANDS LOGGING OPTION
+# If you don't want Nagios to log external commands, set this value
+# to 0.  If external commands should be logged, set this value to 1.
+# Note: This option does not include logging of passive service
+# checks - see the option below for controlling whether or not
+# passive checks are logged.
+
+log_external_commands=1
+
+
+
+# PASSIVE CHECKS LOGGING OPTION
+# If you don't want Nagios to log passive host and service checks, set
+# this value to 0.  If passive checks should be logged, set
+# this value to 1.
+
+log_passive_checks=1
+
+
+
+# GLOBAL HOST AND SERVICE EVENT HANDLERS
+# These options allow you to specify a host and service event handler
+# command that is to be run for every host or service state change.
+# The global event handler is executed immediately prior to the event
+# handler that you have optionally specified in each host or
+# service definition. The command argument is the short name of a
+# command definition that you define in your host configuration file.
+# Read the HTML docs for more information.
+
+#global_host_event_handler=somecommand
+#global_service_event_handler=somecommand
+
+
+
+# SERVICE INTER-CHECK DELAY METHOD
+# This is the method that Nagios should use when initially
+# "spreading out" service checks when it starts monitoring.  The
+# default is to use smart delay calculation, which will try to
+# space all service checks out evenly to minimize CPU load.
+# Using the dumb setting will cause all checks to be scheduled
+# at the same time (with no delay between them)!  This is not a
+# good thing for production, but is useful when testing the
+# parallelization functionality.
+#	n	= None - don't use any delay between checks
+#	d	= Use a "dumb" delay of 1 second between checks
+#	s	= Use "smart" inter-check delay calculation
+#       x.xx    = Use an inter-check delay of x.xx seconds
+
+service_inter_check_delay_method=s
+
+
+
+# MAXIMUM SERVICE CHECK SPREAD
+# This variable determines the timeframe (in minutes) from the
+# program start time that an initial check of all services should
+# be completed.  Default is 30 minutes.
+
+max_service_check_spread=30
+
+
+
+# SERVICE CHECK INTERLEAVE FACTOR
+# This variable determines how service checks are interleaved.
+# Interleaving the service checks allows for a more even
+# distribution of service checks and reduced load on remote
+# hosts.  Setting this value to 1 is equivalent to how versions
+# of Nagios previous to 0.0.5 did service checks.  Set this
+# value to s (smart) for automatic calculation of the interleave
+# factor unless you have a specific reason to change it.
+#       s       = Use "smart" interleave factor calculation
+#       x       = Use an interleave factor of x, where x is a
+#                 number greater than or equal to 1.
+
+service_interleave_factor=s
+
+
+
+# HOST INTER-CHECK DELAY METHOD
+# This is the method that Nagios should use when initially
+# "spreading out" host checks when it starts monitoring.  The
+# default is to use smart delay calculation, which will try to
+# space all host checks out evenly to minimize CPU load.
+# Using the dumb setting will cause all checks to be scheduled
+# at the same time (with no delay between them)!
+#	n	= None - don't use any delay between checks
+#	d	= Use a "dumb" delay of 1 second between checks
+#	s	= Use "smart" inter-check delay calculation
+#       x.xx    = Use an inter-check delay of x.xx seconds
+
+host_inter_check_delay_method=s
+
+
+
+# MAXIMUM HOST CHECK SPREAD
+# This variable determines the timeframe (in minutes) from the
+# program start time that an initial check of all hosts should
+# be completed.  Default is 30 minutes.
+
+max_host_check_spread=30
+
+
+
+# MAXIMUM CONCURRENT SERVICE CHECKS
+# This option allows you to specify the maximum number of 
+# service checks that can be run in parallel at any given time.
+# Specifying a value of 1 for this variable essentially prevents
+# any service checks from being parallelized.  A value of 0
+# will not restrict the number of concurrent checks that are
+# being executed.
+
+max_concurrent_checks=0
+
+
+
+# HOST AND SERVICE CHECK REAPER FREQUENCY
+# This is the frequency (in seconds!) that Nagios will process
+# the results of host and service checks.
+
+check_result_reaper_frequency=10
+
+
+
+
+# MAX CHECK RESULT REAPER TIME
+# This is the max amount of time (in seconds) that  a single
+# check result reaper event will be allowed to run before 
+# returning control back to Nagios so it can perform other
+# duties.
+
+max_check_result_reaper_time=30
+
+
+
+
+# CHECK RESULT PATH
+# This is directory where Nagios stores the results of host and
+# service checks that have not yet been processed.
+#
+# Note: Make sure that only one instance of Nagios has access
+# to this directory!  
+
+check_result_path=/var/lib/nagios3/spool/checkresults
+
+
+
+
+# MAX CHECK RESULT FILE AGE
+# This option determines the maximum age (in seconds) which check
+# result files are considered to be valid.  Files older than this 
+# threshold will be mercilessly deleted without further processing.
+
+max_check_result_file_age=3600
+
+
+
+
+# CACHED HOST CHECK HORIZON
+# This option determines the maximum amount of time (in seconds)
+# that the state of a previous host check is considered current.
+# Cached host states (from host checks that were performed more
+# recently that the timeframe specified by this value) can immensely
+# improve performance in regards to the host check logic.
+# Too high of a value for this option may result in inaccurate host
+# states being used by Nagios, while a lower value may result in a
+# performance hit for host checks.  Use a value of 0 to disable host
+# check caching.
+
+cached_host_check_horizon=15
+
+
+
+# CACHED SERVICE CHECK HORIZON
+# This option determines the maximum amount of time (in seconds)
+# that the state of a previous service check is considered current.
+# Cached service states (from service checks that were performed more
+# recently that the timeframe specified by this value) can immensely
+# improve performance in regards to predictive dependency checks.
+# Use a value of 0 to disable service check caching.
+
+cached_service_check_horizon=15
+
+
+
+# ENABLE PREDICTIVE HOST DEPENDENCY CHECKS
+# This option determines whether or not Nagios will attempt to execute
+# checks of hosts when it predicts that future dependency logic test
+# may be needed.  These predictive checks can help ensure that your
+# host dependency logic works well.
+# Values:
+#  0 = Disable predictive checks
+#  1 = Enable predictive checks (default)
+
+enable_predictive_host_dependency_checks=1
+
+
+
+# ENABLE PREDICTIVE SERVICE DEPENDENCY CHECKS
+# This option determines whether or not Nagios will attempt to execute
+# checks of service when it predicts that future dependency logic test
+# may be needed.  These predictive checks can help ensure that your
+# service dependency logic works well.
+# Values:
+#  0 = Disable predictive checks
+#  1 = Enable predictive checks (default)
+
+enable_predictive_service_dependency_checks=1
+
+
+
+# SOFT STATE DEPENDENCIES
+# This option determines whether or not Nagios will use soft state 
+# information when checking host and service dependencies. Normally 
+# Nagios will only use the latest hard host or service state when 
+# checking dependencies. If you want it to use the latest state (regardless
+# of whether its a soft or hard state type), enable this option. 
+# Values:
+#  0 = Don't use soft state dependencies (default) 
+#  1 = Use soft state dependencies 
+
+soft_state_dependencies=0
+
+
+
+# TIME CHANGE ADJUSTMENT THRESHOLDS
+# These options determine when Nagios will react to detected changes
+# in system time (either forward or backwards).
+
+#time_change_threshold=900
+
+
+
+# AUTO-RESCHEDULING OPTION
+# This option determines whether or not Nagios will attempt to
+# automatically reschedule active host and service checks to
+# "smooth" them out over time.  This can help balance the load on
+# the monitoring server.  
+# WARNING: THIS IS AN EXPERIMENTAL FEATURE - IT CAN DEGRADE
+# PERFORMANCE, RATHER THAN INCREASE IT, IF USED IMPROPERLY
+
+auto_reschedule_checks=0
+
+
+
+# AUTO-RESCHEDULING INTERVAL
+# This option determines how often (in seconds) Nagios will
+# attempt to automatically reschedule checks.  This option only
+# has an effect if the auto_reschedule_checks option is enabled.
+# Default is 30 seconds.
+# WARNING: THIS IS AN EXPERIMENTAL FEATURE - IT CAN DEGRADE
+# PERFORMANCE, RATHER THAN INCREASE IT, IF USED IMPROPERLY
+
+auto_rescheduling_interval=30
+
+
+
+# AUTO-RESCHEDULING WINDOW
+# This option determines the "window" of time (in seconds) that
+# Nagios will look at when automatically rescheduling checks.
+# Only host and service checks that occur in the next X seconds
+# (determined by this variable) will be rescheduled. This option
+# only has an effect if the auto_reschedule_checks option is
+# enabled.  Default is 180 seconds (3 minutes).
+# WARNING: THIS IS AN EXPERIMENTAL FEATURE - IT CAN DEGRADE
+# PERFORMANCE, RATHER THAN INCREASE IT, IF USED IMPROPERLY
+
+auto_rescheduling_window=180
+
+
+
+# SLEEP TIME
+# This is the number of seconds to sleep between checking for system
+# events and service checks that need to be run.
+
+sleep_time=0.25
+
+
+
+# TIMEOUT VALUES
+# These options control how much time Nagios will allow various
+# types of commands to execute before killing them off.  Options
+# are available for controlling maximum time allotted for
+# service checks, host checks, event handlers, notifications, the
+# ocsp command, and performance data commands.  All values are in
+# seconds.
+
+service_check_timeout=60
+host_check_timeout=30
+event_handler_timeout=30
+notification_timeout=30
+ocsp_timeout=5
+perfdata_timeout=5
+
+
+
+# RETAIN STATE INFORMATION
+# This setting determines whether or not Nagios will save state
+# information for services and hosts before it shuts down.  Upon
+# startup Nagios will reload all saved service and host state
+# information before starting to monitor.  This is useful for 
+# maintaining long-term data on state statistics, etc, but will
+# slow Nagios down a bit when it (re)starts.  Since its only
+# a one-time penalty, I think its well worth the additional
+# startup delay.
+
+retain_state_information=1
+
+
+
+# STATE RETENTION FILE
+# This is the file that Nagios should use to store host and
+# service state information before it shuts down.  The state 
+# information in this file is also read immediately prior to
+# starting to monitor the network when Nagios is restarted.
+# This file is used only if the preserve_state_information
+# variable is set to 1.
+
+state_retention_file=/var/lib/nagios3/retention.dat
+
+
+
+# RETENTION DATA UPDATE INTERVAL
+# This setting determines how often (in minutes) that Nagios
+# will automatically save retention data during normal operation.
+# If you set this value to 0, Nagios will not save retention
+# data at regular interval, but it will still save retention
+# data before shutting down or restarting.  If you have disabled
+# state retention, this option has no effect.
+
+retention_update_interval=60
+
+
+
+# USE RETAINED PROGRAM STATE
+# This setting determines whether or not Nagios will set 
+# program status variables based on the values saved in the
+# retention file.  If you want to use retained program status
+# information, set this value to 1.  If not, set this value
+# to 0.
+
+use_retained_program_state=1
+
+
+
+# USE RETAINED SCHEDULING INFO
+# This setting determines whether or not Nagios will retain
+# the scheduling info (next check time) for hosts and services
+# based on the values saved in the retention file.  If you
+# If you want to use retained scheduling info, set this
+# value to 1.  If not, set this value to 0.
+
+use_retained_scheduling_info=1
+
+
+
+# RETAINED ATTRIBUTE MASKS (ADVANCED FEATURE)
+# The following variables are used to specify specific host and
+# service attributes that should *not* be retained by Nagios during
+# program restarts.
+#
+# The values of the masks are bitwise ANDs of values specified
+# by the "MODATTR_" definitions found in include/common.h.  
+# For example, if you do not want the current enabled/disabled state
+# of flap detection and event handlers for hosts to be retained, you
+# would use a value of 24 for the host attribute mask...
+# MODATTR_EVENT_HANDLER_ENABLED (8) + MODATTR_FLAP_DETECTION_ENABLED (16) = 24
+
+# This mask determines what host attributes are not retained
+retained_host_attribute_mask=0
+
+# This mask determines what service attributes are not retained
+retained_service_attribute_mask=0
+
+# These two masks determine what process attributes are not retained.
+# There are two masks, because some process attributes have host and service
+# options.  For example, you can disable active host checks, but leave active
+# service checks enabled.
+retained_process_host_attribute_mask=0
+retained_process_service_attribute_mask=0
+
+# These two masks determine what contact attributes are not retained.
+# There are two masks, because some contact attributes have host and
+# service options.  For example, you can disable host notifications for
+# a contact, but leave service notifications enabled for them.
+retained_contact_host_attribute_mask=0
+retained_contact_service_attribute_mask=0
+
+
+
+# INTERVAL LENGTH
+# This is the seconds per unit interval as used in the
+# host/contact/service configuration files.  Setting this to 60 means
+# that each interval is one minute long (60 seconds).  Other settings
+# have not been tested much, so your mileage is likely to vary...
+
+interval_length=60
+
+
+
+# AGGRESSIVE HOST CHECKING OPTION
+# If you don't want to turn on aggressive host checking features, set
+# this value to 0 (the default).  Otherwise set this value to 1 to
+# enable the aggressive check option.  Read the docs for more info
+# on what aggressive host check is or check out the source code in
+# base/checks.c
+
+use_aggressive_host_checking=0
+
+
+
+# SERVICE CHECK EXECUTION OPTION
+# This determines whether or not Nagios will actively execute
+# service checks when it initially starts.  If this option is 
+# disabled, checks are not actively made, but Nagios can still
+# receive and process passive check results that come in.  Unless
+# you're implementing redundant hosts or have a special need for
+# disabling the execution of service checks, leave this enabled!
+# Values: 1 = enable checks, 0 = disable checks
+
+execute_service_checks=1
+
+
+
+# PASSIVE SERVICE CHECK ACCEPTANCE OPTION
+# This determines whether or not Nagios will accept passive
+# service checks results when it initially (re)starts.
+# Values: 1 = accept passive checks, 0 = reject passive checks
+
+accept_passive_service_checks=1
+
+
+
+# HOST CHECK EXECUTION OPTION
+# This determines whether or not Nagios will actively execute
+# host checks when it initially starts.  If this option is 
+# disabled, checks are not actively made, but Nagios can still
+# receive and process passive check results that come in.  Unless
+# you're implementing redundant hosts or have a special need for
+# disabling the execution of host checks, leave this enabled!
+# Values: 1 = enable checks, 0 = disable checks
+
+execute_host_checks=1
+
+
+
+# PASSIVE HOST CHECK ACCEPTANCE OPTION
+# This determines whether or not Nagios will accept passive
+# host checks results when it initially (re)starts.
+# Values: 1 = accept passive checks, 0 = reject passive checks
+
+accept_passive_host_checks=1
+
+
+
+# NOTIFICATIONS OPTION
+# This determines whether or not Nagios will sent out any host or
+# service notifications when it is initially (re)started.
+# Values: 1 = enable notifications, 0 = disable notifications
+
+enable_notifications=1
+
+
+
+# EVENT HANDLER USE OPTION
+# This determines whether or not Nagios will run any host or
+# service event handlers when it is initially (re)started.  Unless
+# you're implementing redundant hosts, leave this option enabled.
+# Values: 1 = enable event handlers, 0 = disable event handlers
+
+enable_event_handlers=1
+
+
+
+# PROCESS PERFORMANCE DATA OPTION
+# This determines whether or not Nagios will process performance
+# data returned from service and host checks.  If this option is
+# enabled, host performance data will be processed using the
+# host_perfdata_command (defined below) and service performance
+# data will be processed using the service_perfdata_command (also
+# defined below).  Read the HTML docs for more information on
+# performance data.
+# Values: 1 = process performance data, 0 = do not process performance data
+
+process_performance_data=0
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA PROCESSING COMMANDS
+# These commands are run after every host and service check is
+# performed.  These commands are executed only if the
+# enable_performance_data option (above) is set to 1.  The command
+# argument is the short name of a command definition that you 
+# define in your host configuration file.  Read the HTML docs for
+# more information on performance data.
+
+#host_perfdata_command=process-host-perfdata
+#service_perfdata_command=process-service-perfdata
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILES
+# These files are used to store host and service performance data.
+# Performance data is only written to these files if the
+# enable_performance_data option (above) is set to 1.
+
+#host_perfdata_file=/tmp/host-perfdata
+#service_perfdata_file=/tmp/service-perfdata
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILE TEMPLATES
+# These options determine what data is written (and how) to the
+# performance data files.  The templates may contain macros, special
+# characters (\t for tab, \r for carriage return, \n for newline)
+# and plain text.  A newline is automatically added after each write
+# to the performance data file.  Some examples of what you can do are
+# shown below.
+
+#host_perfdata_file_template=[HOSTPERFDATA]\t$TIMET$\t$HOSTNAME$\t$HOSTEXECUTIONTIME$\t$HOSTOUTPUT$\t$HOSTPERFDATA$
+#service_perfdata_file_template=[SERVICEPERFDATA]\t$TIMET$\t$HOSTNAME$\t$SERVICEDESC$\t$SERVICEEXECUTIONTIME$\t$SERVICELATENCY$\t$SERVICEOUTPUT$\t$SERVICEPERFDATA$
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILE MODES
+# This option determines whether or not the host and service
+# performance data files are opened in write ("w") or append ("a")
+# mode. If you want to use named pipes, you should use the special
+# pipe ("p") mode which avoid blocking at startup, otherwise you will
+# likely want the defult append ("a") mode.
+
+#host_perfdata_file_mode=a
+#service_perfdata_file_mode=a
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILE PROCESSING INTERVAL
+# These options determine how often (in seconds) the host and service
+# performance data files are processed using the commands defined
+# below.  A value of 0 indicates the files should not be periodically
+# processed.
+
+#host_perfdata_file_processing_interval=0
+#service_perfdata_file_processing_interval=0
+
+
+
+# HOST AND SERVICE PERFORMANCE DATA FILE PROCESSING COMMANDS
+# These commands are used to periodically process the host and
+# service performance data files.  The interval at which the
+# processing occurs is determined by the options above.
+
+#host_perfdata_file_processing_command=process-host-perfdata-file
+#service_perfdata_file_processing_command=process-service-perfdata-file
+
+
+
+# OBSESS OVER SERVICE CHECKS OPTION
+# This determines whether or not Nagios will obsess over service
+# checks and run the ocsp_command defined below.  Unless you're
+# planning on implementing distributed monitoring, do not enable
+# this option.  Read the HTML docs for more information on
+# implementing distributed monitoring.
+# Values: 1 = obsess over services, 0 = do not obsess (default)
+
+obsess_over_services=0
+
+
+
+# OBSESSIVE COMPULSIVE SERVICE PROCESSOR COMMAND
+# This is the command that is run for every service check that is
+# processed by Nagios.  This command is executed only if the
+# obsess_over_services option (above) is set to 1.  The command 
+# argument is the short name of a command definition that you
+# define in your host configuration file. Read the HTML docs for
+# more information on implementing distributed monitoring.
+
+#ocsp_command=somecommand
+
+
+
+# OBSESS OVER HOST CHECKS OPTION
+# This determines whether or not Nagios will obsess over host
+# checks and run the ochp_command defined below.  Unless you're
+# planning on implementing distributed monitoring, do not enable
+# this option.  Read the HTML docs for more information on
+# implementing distributed monitoring.
+# Values: 1 = obsess over hosts, 0 = do not obsess (default)
+
+obsess_over_hosts=0
+
+
+
+# OBSESSIVE COMPULSIVE HOST PROCESSOR COMMAND
+# This is the command that is run for every host check that is
+# processed by Nagios.  This command is executed only if the
+# obsess_over_hosts option (above) is set to 1.  The command 
+# argument is the short name of a command definition that you
+# define in your host configuration file. Read the HTML docs for
+# more information on implementing distributed monitoring.
+
+#ochp_command=somecommand
+
+
+
+# TRANSLATE PASSIVE HOST CHECKS OPTION
+# This determines whether or not Nagios will translate
+# DOWN/UNREACHABLE passive host check results into their proper
+# state for this instance of Nagios.  This option is useful
+# if you have distributed or failover monitoring setup.  In
+# these cases your other Nagios servers probably have a different
+# "view" of the network, with regards to the parent/child relationship
+# of hosts.  If a distributed monitoring server thinks a host
+# is DOWN, it may actually be UNREACHABLE from the point of
+# this Nagios instance.  Enabling this option will tell Nagios
+# to translate any DOWN or UNREACHABLE host states it receives
+# passively into the correct state from the view of this server.
+# Values: 1 = perform translation, 0 = do not translate (default)
+
+translate_passive_host_checks=0
+
+
+
+# PASSIVE HOST CHECKS ARE SOFT OPTION
+# This determines whether or not Nagios will treat passive host
+# checks as being HARD or SOFT.  By default, a passive host check
+# result will put a host into a HARD state type.  This can be changed
+# by enabling this option.
+# Values: 0 = passive checks are HARD, 1 = passive checks are SOFT
+
+passive_host_checks_are_soft=0
+
+
+
+# ORPHANED HOST/SERVICE CHECK OPTIONS
+# These options determine whether or not Nagios will periodically 
+# check for orphaned host service checks.  Since service checks are
+# not rescheduled until the results of their previous execution 
+# instance are processed, there exists a possibility that some
+# checks may never get rescheduled.  A similar situation exists for
+# host checks, although the exact scheduling details differ a bit
+# from service checks.  Orphaned checks seem to be a rare
+# problem and should not happen under normal circumstances.
+# If you have problems with service checks never getting
+# rescheduled, make sure you have orphaned service checks enabled.
+# Values: 1 = enable checks, 0 = disable checks
+
+check_for_orphaned_services=1
+check_for_orphaned_hosts=1
+
+
+
+# SERVICE FRESHNESS CHECK OPTION
+# This option determines whether or not Nagios will periodically
+# check the "freshness" of service results.  Enabling this option
+# is useful for ensuring passive checks are received in a timely
+# manner.
+# Values: 1 = enabled freshness checking, 0 = disable freshness checking
+
+check_service_freshness=1
+
+
+
+# SERVICE FRESHNESS CHECK INTERVAL
+# This setting determines how often (in seconds) Nagios will
+# check the "freshness" of service check results.  If you have
+# disabled service freshness checking, this option has no effect.
+
+service_freshness_check_interval=60
+
+
+
+# HOST FRESHNESS CHECK OPTION
+# This option determines whether or not Nagios will periodically
+# check the "freshness" of host results.  Enabling this option
+# is useful for ensuring passive checks are received in a timely
+# manner.
+# Values: 1 = enabled freshness checking, 0 = disable freshness checking
+
+check_host_freshness=0
+
+
+
+# HOST FRESHNESS CHECK INTERVAL
+# This setting determines how often (in seconds) Nagios will
+# check the "freshness" of host check results.  If you have
+# disabled host freshness checking, this option has no effect.
+
+host_freshness_check_interval=60
+
+
+
+
+# ADDITIONAL FRESHNESS THRESHOLD LATENCY
+# This setting determines the number of seconds that Nagios
+# will add to any host and service freshness thresholds that
+# it calculates (those not explicitly specified by the user).
+
+additional_freshness_latency=15
+
+
+
+
+# FLAP DETECTION OPTION
+# This option determines whether or not Nagios will try
+# and detect hosts and services that are "flapping".  
+# Flapping occurs when a host or service changes between
+# states too frequently.  When Nagios detects that a 
+# host or service is flapping, it will temporarily suppress
+# notifications for that host/service until it stops
+# flapping.  Flap detection is very experimental, so read
+# the HTML documentation before enabling this feature!
+# Values: 1 = enable flap detection
+#         0 = disable flap detection (default)
+
+enable_flap_detection=1
+
+
+
+# FLAP DETECTION THRESHOLDS FOR HOSTS AND SERVICES
+# Read the HTML documentation on flap detection for
+# an explanation of what this option does.  This option
+# has no effect if flap detection is disabled.
+
+low_service_flap_threshold=5.0
+high_service_flap_threshold=20.0
+low_host_flap_threshold=5.0
+high_host_flap_threshold=20.0
+
+
+
+# DATE FORMAT OPTION
+# This option determines how short dates are displayed. Valid options
+# include:
+#	us		(MM-DD-YYYY HH:MM:SS)
+#	euro    	(DD-MM-YYYY HH:MM:SS)
+#	iso8601		(YYYY-MM-DD HH:MM:SS)
+#	strict-iso8601	(YYYY-MM-DDTHH:MM:SS)
+#
+
+date_format=iso8601
+
+
+
+
+# TIMEZONE OFFSET
+# This option is used to override the default timezone that this
+# instance of Nagios runs in.  If not specified, Nagios will use
+# the system configured timezone.
+#
+# NOTE: In order to display the correct timezone in the CGIs, you
+# will also need to alter the Apache directives for the CGI path 
+# to include your timezone.  Example:
+#
+#   <Directory "/usr/local/nagios/sbin/">
+#      SetEnv TZ "Australia/Brisbane"
+#      ...
+#   </Directory>
+
+#use_timezone=US/Mountain
+#use_timezone=Australia/Brisbane
+
+
+
+
+# P1.PL FILE LOCATION
+# This value determines where the p1.pl perl script (used by the
+# embedded Perl interpreter) is located.  If you didn't compile
+# Nagios with embedded Perl support, this option has no effect.
+
+p1_file=/usr/lib/nagios3/p1.pl
+
+
+
+# EMBEDDED PERL INTERPRETER OPTION
+# This option determines whether or not the embedded Perl interpreter
+# will be enabled during runtime.  This option has no effect if Nagios
+# has not been compiled with support for embedded Perl.
+# Values: 0 = disable interpreter, 1 = enable interpreter
+
+enable_embedded_perl=1
+
+
+
+# EMBEDDED PERL USAGE OPTION
+# This option determines whether or not Nagios will process Perl plugins
+# and scripts with the embedded Perl interpreter if the plugins/scripts
+# do not explicitly indicate whether or not it is okay to do so. Read
+# the HTML documentation on the embedded Perl interpreter for more 
+# information on how this option works.
+
+use_embedded_perl_implicitly=1
+
+
+
+# ILLEGAL OBJECT NAME CHARACTERS
+# This option allows you to specify illegal characters that cannot
+# be used in host names, service descriptions, or names of other
+# object types.
+
+illegal_object_name_chars=`~!$%^&*|'"<>?,()=
+
+
+
+# ILLEGAL MACRO OUTPUT CHARACTERS
+# This option allows you to specify illegal characters that are
+# stripped from macros before being used in notifications, event
+# handlers, etc.  This DOES NOT affect macros used in service or
+# host check commands.
+# The following macros are stripped of the characters you specify:
+#	$HOSTOUTPUT$
+#	$HOSTPERFDATA$
+#	$HOSTACKAUTHOR$
+#	$HOSTACKCOMMENT$
+#	$SERVICEOUTPUT$
+#	$SERVICEPERFDATA$
+#	$SERVICEACKAUTHOR$
+#	$SERVICEACKCOMMENT$
+
+illegal_macro_output_chars=`~$&|'"<>
+
+
+
+# REGULAR EXPRESSION MATCHING
+# This option controls whether or not regular expression matching
+# takes place in the object config files.  Regular expression
+# matching is used to match host, hostgroup, service, and service
+# group names/descriptions in some fields of various object types.
+# Values: 1 = enable regexp matching, 0 = disable regexp matching
+
+use_regexp_matching=0
+
+
+
+# "TRUE" REGULAR EXPRESSION MATCHING
+# This option controls whether or not "true" regular expression 
+# matching takes place in the object config files.  This option
+# only has an effect if regular expression matching is enabled
+# (see above).  If this option is DISABLED, regular expression
+# matching only occurs if a string contains wildcard characters
+# (* and ?).  If the option is ENABLED, regexp matching occurs
+# all the time (which can be annoying).
+# Values: 1 = enable true matching, 0 = disable true matching
+
+use_true_regexp_matching=0
+
+
+
+# ADMINISTRATOR EMAIL/PAGER ADDRESSES
+# The email and pager address of a global administrator (likely you).
+# Nagios never uses these values itself, but you can access them by
+# using the $ADMINEMAIL$ and $ADMINPAGER$ macros in your notification
+# commands.
+
+admin_email=root@localhost
+admin_pager=pageroot@localhost
+
+
+
+# DAEMON CORE DUMP OPTION
+# This option determines whether or not Nagios is allowed to create
+# a core dump when it runs as a daemon.  Note that it is generally
+# considered bad form to allow this, but it may be useful for
+# debugging purposes.  Enabling this option doesn't guarantee that
+# a core file will be produced, but that's just life...
+# Values: 1 - Allow core dumps
+#         0 - Do not allow core dumps (default)
+
+daemon_dumps_core=0
+
+
+
+# LARGE INSTALLATION TWEAKS OPTION
+# This option determines whether or not Nagios will take some shortcuts
+# which can save on memory and CPU usage in large Nagios installations.
+# Read the documentation for more information on the benefits/tradeoffs
+# of enabling this option.
+# Values: 1 - Enabled tweaks
+#         0 - Disable tweaks (default)
+
+use_large_installation_tweaks=0
+
+
+
+# ENABLE ENVIRONMENT MACROS
+# This option determines whether or not Nagios will make all standard
+# macros available as environment variables when host/service checks
+# and system commands (event handlers, notifications, etc.) are
+# executed.  Enabling this option can cause performance issues in 
+# large installations, as it will consume a bit more memory and (more
+# importantly) consume more CPU.
+# Values: 1 - Enable environment variable macros (default)
+#         0 - Disable environment variable macros
+
+enable_environment_macros=1
+
+
+
+# CHILD PROCESS MEMORY OPTION
+# This option determines whether or not Nagios will free memory in
+# child processes (processed used to execute system commands and host/
+# service checks).  If you specify a value here, it will override
+# program defaults.
+# Value: 1 - Free memory in child processes
+#        0 - Do not free memory in child processes
+
+#free_child_process_memory=1
+
+
+
+# CHILD PROCESS FORKING BEHAVIOR
+# This option determines how Nagios will fork child processes
+# (used to execute system commands and host/service checks).  Normally
+# child processes are fork()ed twice, which provides a very high level
+# of isolation from problems.  Fork()ing once is probably enough and will
+# save a great deal on CPU usage (in large installs), so you might
+# want to consider using this.  If you specify a value here, it will
+# program defaults.
+# Value: 1 - Child processes fork() twice
+#        0 - Child processes fork() just once
+
+#child_processes_fork_twice=1
+
+
+
+# DEBUG LEVEL
+# This option determines how much (if any) debugging information will
+# be written to the debug file.  OR values together to log multiple
+# types of information.
+# Values: 
+#          -1 = Everything
+#          0 = Nothing
+#	   1 = Functions
+#          2 = Configuration
+#          4 = Process information
+#	   8 = Scheduled events
+#          16 = Host/service checks
+#          32 = Notifications
+#          64 = Event broker
+#          128 = External commands
+#          256 = Commands
+#          512 = Scheduled downtime
+#          1024 = Comments
+#          2048 = Macros
+
+debug_level=0
+
+
+
+# DEBUG VERBOSITY
+# This option determines how verbose the debug log out will be.
+# Values: 0 = Brief output
+#         1 = More detailed
+#         2 = Very detailed
+
+debug_verbosity=1
+
+
+
+# DEBUG FILE
+# This option determines where Nagios should write debugging information.
+
+debug_file=/var/lib/nagios3/nagios.debug
+
+
+
+# MAX DEBUG FILE SIZE
+# This option determines the maximum size (in bytes) of the debug file.  If
+# the file grows larger than this size, it will be renamed with a .old
+# extension.  If a file already exists with a .old extension it will
+# automatically be deleted.  This helps ensure your disk space usage doesn't
+# get out of control when debugging Nagios.
+
+max_debug_file_size=1000000
+
+
diff --git a/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.amd64 b/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.amd64
new file mode 100644
index 00000000..3ed732bb
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.amd64
@@ -0,0 +1,31 @@
+###########################################################################
+#
+# RESOURCE.CFG - Resource File for Nagios 
+#
+# You can define $USERx$ macros in this file, which can in turn be used
+# in command definitions in your host config file(s).  $USERx$ macros are
+# useful for storing sensitive information such as usernames, passwords, 
+# etc.  They are also handy for specifying the path to plugins and 
+# event handlers - if you decide to move the plugins or event handlers to
+# a different directory in the future, you can just update one or two
+# $USERx$ macros, instead of modifying a lot of command definitions.
+#
+# The CGIs will not attempt to read the contents of resource files, so
+# you can set restrictive permissions (600 or 660) on them.
+#
+# Nagios supports up to 32 $USERx$ macros ($USER1$ through $USER32$)
+#
+# Resource files may also be used to store configuration directives for
+# external data sources like MySQL...
+#
+###########################################################################
+
+# Sets $USER1$ to be the path to the plugins
+$USER1$=/usr/lib/nagios/plugins
+
+# Sets $USER2$ to be the path to event handlers
+#$USER2$=/usr/lib/nagios/plugins/eventhandlers
+
+# Store some usernames and passwords (hidden from the CGIs)
+#$USER3$=someuser
+#$USER4$=somepassword
diff --git a/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.i386 b/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.i386
new file mode 100644
index 00000000..3ed732bb
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.i386
@@ -0,0 +1,31 @@
+###########################################################################
+#
+# RESOURCE.CFG - Resource File for Nagios 
+#
+# You can define $USERx$ macros in this file, which can in turn be used
+# in command definitions in your host config file(s).  $USERx$ macros are
+# useful for storing sensitive information such as usernames, passwords, 
+# etc.  They are also handy for specifying the path to plugins and 
+# event handlers - if you decide to move the plugins or event handlers to
+# a different directory in the future, you can just update one or two
+# $USERx$ macros, instead of modifying a lot of command definitions.
+#
+# The CGIs will not attempt to read the contents of resource files, so
+# you can set restrictive permissions (600 or 660) on them.
+#
+# Nagios supports up to 32 $USERx$ macros ($USER1$ through $USER32$)
+#
+# Resource files may also be used to store configuration directives for
+# external data sources like MySQL...
+#
+###########################################################################
+
+# Sets $USER1$ to be the path to the plugins
+$USER1$=/usr/lib/nagios/plugins
+
+# Sets $USER2$ to be the path to event handlers
+#$USER2$=/usr/lib/nagios/plugins/eventhandlers
+
+# Store some usernames and passwords (hidden from the CGIs)
+#$USER3$=someuser
+#$USER4$=somepassword
diff --git a/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.x86_64 b/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.x86_64
new file mode 100644
index 00000000..3ed732bb
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/Debian/private/resource.cfg.x86_64
@@ -0,0 +1,31 @@
+###########################################################################
+#
+# RESOURCE.CFG - Resource File for Nagios 
+#
+# You can define $USERx$ macros in this file, which can in turn be used
+# in command definitions in your host config file(s).  $USERx$ macros are
+# useful for storing sensitive information such as usernames, passwords, 
+# etc.  They are also handy for specifying the path to plugins and 
+# event handlers - if you decide to move the plugins or event handlers to
+# a different directory in the future, you can just update one or two
+# $USERx$ macros, instead of modifying a lot of command definitions.
+#
+# The CGIs will not attempt to read the contents of resource files, so
+# you can set restrictive permissions (600 or 660) on them.
+#
+# Nagios supports up to 32 $USERx$ macros ($USER1$ through $USER32$)
+#
+# Resource files may also be used to store configuration directives for
+# external data sources like MySQL...
+#
+###########################################################################
+
+# Sets $USER1$ to be the path to the plugins
+$USER1$=/usr/lib/nagios/plugins
+
+# Sets $USER2$ to be the path to event handlers
+#$USER2$=/usr/lib/nagios/plugins/eventhandlers
+
+# Store some usernames and passwords (hidden from the CGIs)
+#$USER3$=someuser
+#$USER4$=somepassword
diff --git a/puppet/modules/nagios/files/configs/apache2.conf b/puppet/modules/nagios/files/configs/apache2.conf
new file mode 100644
index 00000000..f0f8b2f3
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/apache2.conf
@@ -0,0 +1,67 @@
+# apache configuration for nagios 3.x
+# note to users of nagios 1.x and 2.x:
+#	throughout this file are commented out sections which preserve
+#	backwards compatibility with bookmarks/config for older nagios versios.
+#	simply look for lines following "nagios 1.x:" and "nagios 2.x" comments.
+
+ScriptAlias /cgi-bin/nagios3 /usr/lib/cgi-bin/nagios3
+ScriptAlias /nagios3/cgi-bin /usr/lib/cgi-bin/nagios3
+# nagios 1.x:
+#ScriptAlias /cgi-bin/nagios /usr/lib/cgi-bin/nagios3
+#ScriptAlias /nagios/cgi-bin /usr/lib/cgi-bin/nagios3
+# nagios 2.x: 
+#ScriptAlias /cgi-bin/nagios2 /usr/lib/cgi-bin/nagios3
+#ScriptAlias /nagios2/cgi-bin /usr/lib/cgi-bin/nagios3
+
+# Where the stylesheets (config files) reside
+Alias /nagios3/stylesheets /etc/nagios3/stylesheets
+# nagios 1.x:
+#Alias /nagios/stylesheets /etc/nagios3/stylesheets
+# nagios 2.x:
+#Alias /nagios2/stylesheets /etc/nagios3/stylesheets
+
+# Where the HTML pages live
+Alias /nagios3 /usr/share/nagios3/htdocs
+# nagios 2.x: 
+#Alias /nagios2 /usr/share/nagios3/htdocs
+# nagios 1.x:
+#Alias /nagios /usr/share/nagios3/htdocs
+
+<DirectoryMatch (/usr/share/nagios3/htdocs|/usr/lib/cgi-bin/nagios3|/etc/nagios3/stylesheets)>
+	Options FollowSymLinks
+
+	DirectoryIndex index.php index.html
+
+	AllowOverride AuthConfig
+
+
+    <IfVersion < 2.3>
+        Order Allow,Deny
+        Allow From All
+    </IfVersion>
+
+    <IfVersion >= 2.3>
+        Require all denied
+    </IfVersion>
+
+	AuthName "Nagios Access"
+	AuthType Basic
+	AuthUserFile /etc/nagios3/htpasswd.users
+	# nagios 1.x:
+	#AuthUserFile /etc/nagios/htpasswd.users
+	require valid-user
+</DirectoryMatch>
+
+<Directory /usr/share/nagios3/htdocs>
+	Options	+ExecCGI	
+</Directory>
+
+# Enable this ScriptAlias if you want to enable the grouplist patch.
+# See http://apan.sourceforge.net/download.html for more info
+# It allows you to see a clickable list of all hostgroups in the
+# left pane of the Nagios web interface
+# XXX This is not tested for nagios 2.x use at your own peril
+#ScriptAlias /nagios3/side.html /usr/lib/cgi-bin/nagios3/grouplist.cgi
+# nagios 1.x:
+#ScriptAlias /nagios/side.html /usr/lib/cgi-bin/nagios3/grouplist.cgi
+
diff --git a/puppet/modules/nagios/files/configs/cgi.cfg b/puppet/modules/nagios/files/configs/cgi.cfg
new file mode 120000
index 00000000..db9667b3
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/cgi.cfg
@@ -0,0 +1 @@
+Debian/cgi.cfg
\ No newline at end of file
diff --git a/puppet/modules/nagios/files/configs/nagios.cfg b/puppet/modules/nagios/files/configs/nagios.cfg
new file mode 120000
index 00000000..1409b9e8
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/nagios.cfg
@@ -0,0 +1 @@
+Debian/nagios.cfg
\ No newline at end of file
diff --git a/puppet/modules/nagios/files/configs/nagios_templates.cfg b/puppet/modules/nagios/files/configs/nagios_templates.cfg
new file mode 100644
index 00000000..98596713
--- /dev/null
+++ b/puppet/modules/nagios/files/configs/nagios_templates.cfg
@@ -0,0 +1,49 @@
+define host{
+    name                            generic-host    ; The name of this host template
+    notifications_enabled           1       ; Host notifications are enabled
+    event_handler_enabled           1       ; Host event handler is enabled
+    flap_detection_enabled          1       ; Flap detection is enabled
+    failure_prediction_enabled      1       ; Failure prediction is enabled
+    process_perf_data               1       ; Process performance data
+    retain_status_information       1       ; Retain status information across program restarts
+    retain_nonstatus_information    1       ; Retain non-status information across program restarts
+    check_command                   check-host-alive
+    max_check_attempts              10
+    notification_interval           0
+    notification_period             24x7
+    notification_options            d,u,r
+    contact_groups                  admins
+    register                        0       ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL HOST, JUST A TEMPLATE!
+}
+
+define service{
+    name                            generic-service ; The 'name' of this service template
+    active_checks_enabled           1       ; Active service checks are enabled
+    passive_checks_enabled          1       ; Passive service checks are enabled/accepted
+    parallelize_check               1       ; Active service checks should be parallelized (disabling this can lead to major performance problems)
+    obsess_over_service             1       ; We should obsess over this service (if necessary)
+    check_freshness                 0       ; Default is to NOT check service 'freshness'
+    notifications_enabled           1       ; Service notifications are enabled
+    event_handler_enabled           1       ; Service event handler is enabled
+    flap_detection_enabled          1       ; Flap detection is enabled
+    failure_prediction_enabled      1       ; Failure prediction is enabled
+    process_perf_data               1       ; Process performance data
+    retain_status_information       1       ; Retain status information across program restarts
+    retain_nonstatus_information    1       ; Retain non-status information across program restarts
+    notification_interval           0		; Only send notifications on status change by default.
+    is_volatile                     0
+    check_period                    24x7
+    normal_check_interval           5
+    retry_check_interval            1
+    max_check_attempts              4
+    notification_period             24x7
+    notification_options            w,u,c,r
+    contact_groups                  admins
+    register                        0       ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL SERVICE, JUST A TEMPLATE!
+}
+
+define service{
+    name                            passive-service
+    use                             generic-service
+    active_checks_enabled           0
+}
diff --git a/puppet/modules/nagios/files/htpasswd.users b/puppet/modules/nagios/files/htpasswd.users
new file mode 100644
index 00000000..e69de29b
diff --git a/puppet/modules/nagios/files/irc_bot/riseup-nagios-client.pl b/puppet/modules/nagios/files/irc_bot/riseup-nagios-client.pl
new file mode 100644
index 00000000..2467058d
--- /dev/null
+++ b/puppet/modules/nagios/files/irc_bot/riseup-nagios-client.pl
@@ -0,0 +1,72 @@
+#!/usr/bin/perl -w
+
+# ##############################################################################
+# Infrabot-Client - a simple Infrabot client which sends it's whole command
+# line arguments to a local UNIX domain socket.
+# ##############################################################################
+
+use strict;
+use IO::Socket;
+
+
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# >> CONFIGURATION >>
+
+# Read a configuration file
+#   The arg can be a relative or full path, or
+#   it can be a file located somewhere in @INC.
+sub ReadCfg
+{
+    my $file = $_[0];
+
+    our $err;
+
+    {   # Put config data into a separate namespace
+        package CFG;
+
+        # Process the contents of the config file
+        my $rc = do($file);
+
+        # Check for errors
+        if ($@) {
+            $::err = "ERROR: Failure compiling '$file' - $@";
+        } elsif (! defined($rc)) {
+            $::err = "ERROR: Failure reading '$file' - $!";
+        } elsif (! $rc) {
+            $::err = "ERROR: Failure processing '$file'";
+        }
+    }
+
+    return ($err);
+}
+
+# Get our configuration information
+if (my $err = ReadCfg('/etc/nagios_nsa.cfg')) {
+    print(STDERR $err, "\n");
+    exit(1);
+}
+
+# << CONFIGURATION <<
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+if (@ARGV == 0) {
+	print "Hey - specify a message, sucker!\n";
+	exit(1);
+}
+
+unless (-S $CFG::Nsa{'socket'}) {
+	die "Socket '$CFG::Nsa{'socket'}' doesn't exist or isn't a socket!\n";
+}
+
+unless (-r $CFG::Nsa{'socket'}) {
+	die "Socket '$CFG::Nsa{'socket'}' can't be read!\n";
+}
+
+my $sock = IO::Socket::UNIX->new (
+	Peer    => $CFG::Nsa{'socket'},
+	Type    => SOCK_DGRAM,
+	Timeout => 10
+) || die "Can't open socket '$CFG::Nsa{'socket'}'!\n";
+
+print $sock "@ARGV";
+close($sock);
diff --git a/puppet/modules/nagios/files/irc_bot/riseup-nagios-server.pl b/puppet/modules/nagios/files/irc_bot/riseup-nagios-server.pl
new file mode 100644
index 00000000..5d65e6dd
--- /dev/null
+++ b/puppet/modules/nagios/files/irc_bot/riseup-nagios-server.pl
@@ -0,0 +1,239 @@
+#!/usr/bin/perl -w
+
+# ##############################################################################
+# a simple IRC bot which dispatches messages received via local domain sockets
+# ##############################################################################
+
+
+######
+## THIS NEEDS TO BE PORTED TO THE NEW FRAMEWORKS!
+##
+## STICKY POINTS: the addfh() function doesn't exist in BasicBot or POE::Component::IRC
+##
+## people suggested we use Anyevent::IRC and POE::Kernel ->select_read and POE::Wheel namespace
+##
+## in the meantime, inspiration for extensions can be found here: http://svn.foswiki.org/trunk/WikiBot/mozbot.pl
+
+use strict;
+use File::Basename;
+
+BEGIN {
+	unshift @INC, dirname($0);
+}
+
+my $VERSION = '0.2';
+my $running = 1;
+
+# Read a configuration file
+#   The arg can be a relative or full path, or
+#   it can be a file located somewhere in @INC.
+sub ReadCfg
+{
+    my $file = $_[0];
+
+    our $err;
+
+    {   # Put config data into a separate namespace
+        package CFG;
+
+        # Process the contents of the config file
+        my $rc = do($file);
+
+        # Check for errors
+        if ($@) {
+            $::err = "ERROR: Failure compiling '$file' - $@";
+        } elsif (! defined($rc)) {
+            $::err = "ERROR: Failure reading '$file' - $!";
+        } elsif (! $rc) {
+            $::err = "ERROR: Failure processing '$file'";
+        }
+    }
+
+    return ($err);
+}
+
+# Get our configuration information
+if (my $err = ReadCfg('/etc/nagios_nsa.cfg')) {
+    print(STDERR $err, "\n");
+    exit(1);
+}
+
+use POSIX qw(setsid);
+use IO::Socket;
+use Net::IRC;
+
+sub new {
+	my $self = {
+		socket => undef,
+		irc => undef,
+		conn => undef,
+		commandfile => undef,
+	};
+
+	return bless($self, __PACKAGE__);
+}
+
+sub daemonize {
+	my $self = shift;
+	my $pid;
+
+	chdir '/' or die "Can't chdir to /: $!";
+
+	open STDIN, '/dev/null' or die "Can't read /dev/null: $!";
+	open STDOUT, '>/dev/null' or die "Can't write to /dev/null: $!";
+
+	defined ($pid = fork) or die "Can't fork: $!";
+
+	if ($pid && $CFG::Nsa{'pidfile'}) { # write pid of child
+		open PID, ">$CFG::Nsa{'pidfile'}" or die "Can't open pid file: $!";
+		print PID $pid;
+		close PID;
+	}
+	exit if $pid;
+	setsid or die "Can't start a new session: $!";
+
+	#open STDERR, '>&STDOUT' or die "Can't dup stdout: $!";
+}
+
+sub run {
+	my $self = shift;
+
+	$self->{irc}->do_one_loop();
+}
+
+sub shutdown {
+	my $sig = shift;
+
+	print STDERR "Received SIG$sig, shutting down...\n";
+	$running = 0;
+}
+
+sub socket_has_data {
+    my $self = shift;
+    
+    $self->{socket}->recv(my $data, 1024);
+    if ($CFG::Nsa{'usenotices'}) {
+	$self->{conn}->notice($CFG::Nsa{'channel'}, $data);
+    } else {
+	$self->{conn}->privmsg($CFG::Nsa{'channel'}, $data);
+    }
+}
+
+sub irc_on_connect {
+	my $self = shift;
+
+	print STDERR "Joining channel '$CFG::Nsa{'channel'}'...\n";
+	$self->join($CFG::Nsa{'channel'});
+}
+
+sub irc_on_msg {
+    my ($self, $event) = @_;
+    my $data = join(' ', $event->args);
+    #my $nick = quotemeta($nicks[$nick]);
+    my $to = $event->to;
+    #my $channel = &toToChannel($self, @$to);
+    #my $cmdChar = $commandChar{default}; # FIXME: should look up for CURRENT channel first!
+    #if ( exists $commandChar{$channel} ) { $cmdChar = $commandChar{$channel}; }
+    my $msg = parse_msg($event);
+    if (defined($msg)) {
+      #$self->privmsg($event->nick, "alright, sending this message to nagios, hope it figures it out: $msg");
+    } else {
+      $self->privmsg($event->nick, "can't parse $data, you want 'ack host service comment'\n");
+    }
+}
+
+sub irc_on_public {
+    my ($self, $event) = @_;
+    my $data = join(' ', $event->args);
+    my $to = $event->to;
+    if ($data =~ s/([^:]*):\s+//) {
+      if ($1 eq $CFG::Nsa{'nickname'}) {
+        my $msg = parse_msg($event);
+        if (defined($msg)) {
+          #$self->privmsg($event->to, "alright, sending this message to nagios, hope it figures it out: $msg");
+        } else {
+          $self->privmsg($event->to, "can't parse $data, you want 'ack host service comment'\n");
+        }
+      } else {
+        #print STDERR "ignoring message $data, not for me (me being $1)\n";
+      }
+    } else {
+      #print STDERR "ignoring message $data\n";
+    }
+}
+
+sub parse_msg {
+    my $event= shift;
+    my $data = join(' ', $event->args);
+    my $msg;
+    if ($data =~ m/([^:]*:)?\s*ack(?:knowledge)?\s+([a-zA-Z0-9\-\.]+)(?:\s+([-\w\.]+)(?:\s+([\w\s]+))?)?/) {
+      #print STDERR "writing to nagios scoket ". $CFG::Nsa{'commandfile'} . "\n";
+      open(my $cmdfile, ">", $CFG::Nsa{'commandfile'}) || die "Can't open Nagios commandfile: $CFG::Nsa{'commandfile'}!\n";
+      my $host = $2;
+      my ($service, $comment) = (undef, "no comment (from irc)");
+      if ($4) {
+        $service = $3;
+	$comment = $4;
+      } elsif ($3) {
+        $service = $3;
+      }
+      my $user = $event->nick;
+      $msg = '[' . time() . '] ';
+      if (defined($service)) {
+        $msg .= "ACKNOWLEDGE_SVC_PROBLEM;$host;$service;1;1;1;$user;$comment\n";
+      } else {
+        $msg .= "ACKNOWLEDGE_HOST_PROBLEM;$host;1;1;1;$user;$comment\n";
+      }
+      print {$cmdfile} $msg;
+      close($cmdfile);
+    }
+    return $msg;
+}
+
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+my $bot = &new;
+
+if (-e $CFG::Nsa{'socket'}) {
+	die "Socket '$CFG::Nsa{'socket'}' exists!\n";
+}
+
+$bot->{socket} = IO::Socket::UNIX->new (
+	Local  => $CFG::Nsa{'socket'},
+	Type   => SOCK_DGRAM,
+	Listen => 5
+) || die "Can't create socket '$CFG::Nsa{'socket'}'!\n";
+
+$SIG{INT} = $SIG{TERM} = \&shutdown;
+
+$bot->daemonize();
+$bot->{irc} = new Net::IRC;
+
+$bot->{conn} = $bot->{irc}->newconn (
+	Server   => $CFG::Nsa{'server'},
+	Port     => $CFG::Nsa{'port'},
+	Nick     => $CFG::Nsa{'nickname'},
+	Username => $CFG::Nsa{'nickname'},
+	Password => $CFG::Nsa{'password'},
+	Ircname  => $CFG::Nsa{'realname'} . " (NSA $VERSION)",
+) || die "Can't connect to server '$CFG::Nsa{'server'}'!\n";
+
+$bot->{conn}->add_global_handler(376, \&irc_on_connect);
+$bot->{conn}->add_global_handler('nomotd', \&irc_on_connect);
+$bot->{conn}->add_global_handler('msg', \&irc_on_msg);
+$bot->{conn}->add_global_handler('public', \&irc_on_public);
+#$bot->{conn}->add_global_handler('notice', \&irc_on_msg);
+$bot->{irc}->addfh($bot->{socket}, \&socket_has_data, 'r', $bot);
+
+while ($running) {
+	$bot->run();
+}
+
+close($bot->{socket});
+unlink($CFG::Nsa{'socket'});
+
+exit(0);
+
+1;
+
+__END__
diff --git a/puppet/modules/nagios/files/munin/nagios_hosts b/puppet/modules/nagios/files/munin/nagios_hosts
new file mode 100644
index 00000000..3fa00f1d
--- /dev/null
+++ b/puppet/modules/nagios/files/munin/nagios_hosts
@@ -0,0 +1,32 @@
+#!/bin/bash
+
+if [ -z "$nag_stats_binary" ]; then
+    nag_stats_binary=/usr/sbin/nagios3stats
+fi
+
+if [ "$1" = "config" ]; then
+	echo 'graph_title Nagios host stats'
+	echo 'graph_args --base 1000 -l 0'
+	echo 'graph_vlabel hosts'
+	echo 'graph_category nagios'
+	echo 'graph_info The number of hosts checked by nagios'
+	echo 'up.label up'
+	echo 'up.draw AREA'
+	echo 'up.info number of hosts UP'
+	echo 'down.label down'
+	echo 'down.draw STACK'
+	echo 'down.info number of hosts DOWN'
+	echo 'unr.label unr'
+	echo 'unr.draw STACK'
+	echo 'unr.info number of hosts UNREACHABLE'
+
+	exit 0
+fi
+
+echo -n 'up.value '
+$nag_stats_binary --mrtg --data NUMHSTUP
+echo -n 'down.value '
+$nag_stats_binary --mrtg --data NUMHSTDOWN
+echo -n 'unr.value '
+$nag_stats_binary --mrtg --data NUMHSTUNR
+
diff --git a/puppet/modules/nagios/files/munin/nagios_perf b/puppet/modules/nagios/files/munin/nagios_perf
new file mode 100644
index 00000000..609d62f4
--- /dev/null
+++ b/puppet/modules/nagios/files/munin/nagios_perf
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+if [ -z "$nag_stats_binary" ]; then
+    nag_stats_binary=/usr/sbin/nagios3stats
+fi
+
+NAME=$(basename $0)
+
+TYPE=${NAME##nagios_perf_}
+
+[ "x$TYPE" = 'xhosts' ] && TYPE_ABBR=HST
+[ "x$TYPE" = 'xsvc' ] && TYPE_ABBR=SVC
+[ -z "$TYPE_ABBR" ] && echo "unknown type $TYPE" >&2 && exit 1
+
+if [ "$1" = "config" ]; then
+	echo "graph_title Nagios $TYPE performance stats"
+	echo "graph_args --base 1000"
+	echo "graph_vlabel seconds"
+	echo "graph_category nagios"
+	echo "graph_info Check performance statistics"
+
+	echo "act_lat_$TYPE_ABBR.label act lat"
+	echo "act_lat_$TYPE_ABBR.type GAUGE"
+	echo "act_lat_$TYPE_ABBR.draw AREA"
+	echo "act_lat_$TYPE_ABBR.cdef act_lat_$TYPE_ABBR,1000,/"
+	echo "act_lat_$TYPE_ABBR.info average latency of active checks over the last 5 minutes"
+
+	echo "act_ext_$TYPE_ABBR.label act ext"
+	echo "act_ext_$TYPE_ABBR.type GAUGE"
+	echo "act_ext_$TYPE_ABBR.draw LINE1"
+	echo "act_ext_$TYPE_ABBR.cdef act_ext_$TYPE_ABBR,1000,/"
+	echo "act_ext_$TYPE_ABBR.info average execution time of active checks over the last 5 minutes"
+
+	exit 0
+fi
+
+echo "act_lat_$TYPE_ABBR.value " $($nag_stats_binary --mrtg --data AVGACT${TYPE_ABBR}LAT)
+echo "act_ext_$TYPE_ABBR.value " $($nag_stats_binary --mrtg --data AVGACT${TYPE_ABBR}EXT)
diff --git a/puppet/modules/nagios/files/munin/nagios_svc b/puppet/modules/nagios/files/munin/nagios_svc
new file mode 100644
index 00000000..97c8bfc1
--- /dev/null
+++ b/puppet/modules/nagios/files/munin/nagios_svc
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+if [ -z "$nag_stats_binary" ]; then
+    nag_stats_binary=/usr/sbin/nagios3stats
+fi
+
+if [ "$1" = "config" ]; then
+	echo 'graph_title Nagios service stats'
+	echo 'graph_args --base 1000 -l 0'
+	echo 'graph_vlabel services'
+	echo 'graph_category nagios'
+	echo 'graph_info The number of services checked by nagios'
+	echo 'ok.label ok'
+	echo 'ok.draw AREA'
+	echo 'ok.info number of services OK'
+	echo 'warn.label warn'
+	echo 'warn.draw STACK'
+	echo 'warn.info number of services WARNING'
+	echo 'crit.label crit'
+	echo 'crit.draw STACK'
+	echo 'crit.info number of services CRITICAL'
+	echo 'unkn.label unkn'
+	echo 'unkn.draw STACK'
+	echo 'unkn.info number of services UNKNOWN'
+
+	exit 0
+fi
+
+echo -n 'ok.value '
+$nag_stats_binary --mrtg --data NUMSVCOK
+echo -n 'warn.value '
+$nag_stats_binary --mrtg --data NUMSVCWARN
+echo -n 'crit.value '
+$nag_stats_binary --mrtg --data NUMSVCCRIT
+echo -n 'unkn.value '
+$nag_stats_binary --mrtg --data NUMSVCUNKN
+
diff --git a/puppet/modules/nagios/files/nrpe/nrpe_commands.cfg b/puppet/modules/nagios/files/nrpe/nrpe_commands.cfg
new file mode 100644
index 00000000..b725a36a
--- /dev/null
+++ b/puppet/modules/nagios/files/nrpe/nrpe_commands.cfg
@@ -0,0 +1,5 @@
+# default plugins
+command[check_users]=/usr/lib/nagios/plugins/check_users $ARG1$ 
+command[check_disk]=/usr/lib/nagios/plugins/check_disk $ARG1$ -x "/dev" -x "/dev/shm" -x "/lib/init/rw" 
+command[check_apt]=sudo /usr/lib/nagios/plugins/check_apt -u $ARG1$
+command[check_swap]=/usr/lib/nagios/plugins/check_swap $ARG1$ 
diff --git a/puppet/modules/nagios/files/nsca/nsca.cfg b/puppet/modules/nagios/files/nsca/nsca.cfg
new file mode 100644
index 00000000..0b019ea1
--- /dev/null
+++ b/puppet/modules/nagios/files/nsca/nsca.cfg
@@ -0,0 +1,197 @@
+# This file is managed by Puppet.
+#
+####################################################
+# Sample NSCA Daemon Config File 
+# Written by: Ethan Galstad (nagios@nagios.org)
+# 
+# Last Modified: 04-03-2006
+####################################################
+
+
+# PID FILE
+# The name of the file in which the NSCA daemon should write it's process ID
+# number.  The file is only written if the NSCA daemon is started by the root
+# user as a single- or multi-process daemon.
+
+pid_file=/var/run/nsca.pid
+
+
+
+# PORT NUMBER
+# Port number we should wait for connections on.
+# This must be a non-priveledged port (i.e. > 1024).
+
+server_port=5667
+
+
+
+# SERVER ADDRESS
+# Address that NSCA has to bind to in case there are
+# more as one interface and we do not want NSCA to bind
+# (thus listen) on all interfaces.
+
+#server_address=192.168.1.1
+
+
+
+# NSCA USER
+# This determines the effective user that the NSCA daemon should run as.  
+# You can either supply a username or a UID.
+# 
+# NOTE: This option is ignored if NSCA is running under either inetd or xinetd
+
+nsca_user=nagios
+
+
+
+# NSCA GROUP
+# This determines the effective group that the NSCA daemon should run as.  
+# You can either supply a group name or a GID.
+# 
+# NOTE: This option is ignored if NSCA is running under either inetd or xinetd
+
+nsca_group=nogroup
+
+
+
+# NSCA CHROOT
+# If specified, determines a directory into which the nsca daemon
+# will perform a chroot(2) operation before dropping its privileges.
+# for the security conscious this can add a layer of protection in
+# the event that the nagios daemon is compromised.  
+# 
+# NOTE: if you specify this option, the command file will be opened
+#       relative to this directory.
+
+#nsca_chroot=/var/run/nagios/rw
+
+
+
+# DEBUGGING OPTION
+# This option determines whether or not debugging
+# messages are logged to the syslog facility. 
+# Values: 0 = debugging off, 1 = debugging on
+
+debug=0
+
+
+
+# COMMAND FILE
+# This is the location of the Nagios command file that the daemon
+# should write all service check results that it receives.
+# Note to debian users: nagios 1.x and nagios 2.x have
+# different default locations for this file.  this is the
+# default location for nagios 1.x:
+#command_file=/var/run/nagios/nagios.cmd
+# and this is the default location for nagios2:
+#command_file=/var/lib/nagios2/rw/nagios.cmd
+# and this is the default location for nagios3:
+command_file=/var/lib/nagios3/rw/nagios.cmd
+
+# ALTERNATE DUMP FILE
+# This is used to specify an alternate file the daemon should
+# write service check results to in the event the command file
+# does not exist.  It is important to note that the command file
+# is implemented as a named pipe and only exists when Nagios is
+# running.  You may want to modify the startup script for Nagios
+# to dump the contents of this file into the command file after
+# it starts Nagios.  Or you may simply choose to ignore any
+# check results received while Nagios was not running...
+
+alternate_dump_file=/var/run/nagios/nsca.dump
+
+
+# AGGREGATED WRITES OPTION
+# This option determines whether or not the nsca daemon will
+# aggregate writes to the external command file for client
+# connections that contain multiple check results.  If you
+# are queueing service check results on remote hosts and
+# sending them to the nsca daemon in bulk, you will probably
+# want to enable bulk writes, as this will be a bit more
+# efficient.
+# Values: 0 = do not aggregate writes, 1 = aggregate writes
+
+aggregate_writes=0
+
+
+
+# APPEND TO FILE OPTION
+# This option determines whether or not the nsca daemon will
+# will open the external command file for writing or appending.
+# This option should almost *always* be set to 0!
+# Values: 0 = open file for writing, 1 = open file for appending
+
+append_to_file=0
+
+
+
+# MAX PACKET AGE OPTION
+# This option is used by the nsca daemon to determine when client
+# data is too old to be valid.  Keeping this value as small as
+# possible is recommended, as it helps prevent the possibility of
+# "replay" attacks.  This value needs to be at least as long as
+# the time it takes your clients to send their data to the server.
+# Values are in seconds.  The max packet age cannot exceed 15
+# minutes (900 seconds).  If this variable is set to zero (0), no
+# packets will be rejected based on their age.
+
+max_packet_age=30
+
+
+
+# DECRYPTION PASSWORD
+# This is the password/passphrase that should be used to descrypt the
+# incoming packets.  Note that all clients must encrypt the packets
+# they send using the same password!
+# IMPORTANT: You don't want all the users on this system to be able
+# to read the password you specify here, so make sure to set
+# restrictive permissions on this config file!
+
+#password=
+
+
+
+# DECRYPTION METHOD
+# This option determines the method by which the nsca daemon will
+# decrypt the packets it receives from the clients.  The decryption
+# method you choose will be a balance between security and performance,
+# as strong encryption methods consume more processor resources.
+# You should evaluate your security needs when choosing a decryption
+# method.
+#
+# Note: The decryption method you specify here must match the
+#       encryption method the nsca clients use (as specified in
+#       the send_nsca.cfg file)!!
+# Values:
+#
+# 	0 = None	(Do NOT use this option)
+#       1 = Simple XOR  (No security, just obfuscation, but very fast)
+#
+#       2 = DES
+#       3 = 3DES (Triple DES)
+#	4 = CAST-128
+#	5 = CAST-256
+#	6 = xTEA
+#	7 = 3WAY
+#	8 = BLOWFISH
+#	9 = TWOFISH
+#	10 = LOKI97
+#	11 = RC2
+#	12 = ARCFOUR
+#
+#	14 = RIJNDAEL-128
+#	15 = RIJNDAEL-192
+#	16 = RIJNDAEL-256
+#
+#	19 = WAKE
+#	20 = SERPENT
+#
+#	22 = ENIGMA (Unix crypt)
+#	23 = GOST
+#	24 = SAFER64
+#	25 = SAFER128
+#	26 = SAFER+
+#
+
+decryption_method=1
+
diff --git a/puppet/modules/nagios/files/nsca/send_nsca.cfg b/puppet/modules/nagios/files/nsca/send_nsca.cfg
new file mode 100644
index 00000000..8127226b
--- /dev/null
+++ b/puppet/modules/nagios/files/nsca/send_nsca.cfg
@@ -0,0 +1,65 @@
+# This file is managed by Puppet.
+#
+####################################################
+# Sample NSCA Client Config File 
+# Written by: Ethan Galstad (nagios@nagios.org)
+# 
+# Last Modified: 02-21-2002
+####################################################
+
+
+# ENCRYPTION PASSWORD
+# This is the password/passphrase that should be used to encrypt the
+# outgoing packets.  Note that the nsca daemon must use the same 
+# password when decrypting the packet!
+# IMPORTANT: You don't want all the users on this system to be able
+# to read the password you specify here, so make sure to set
+# restrictive permissions on this config file!
+
+#password=
+
+
+
+# ENCRYPTION METHOD
+# This option determines the method by which the send_nsca client will
+# encrypt the packets it sends to the nsca daemon.  The encryption
+# method you choose will be a balance between security and performance,
+# as strong encryption methods consume more processor resources.
+# You should evaluate your security needs when choosing an encryption
+# method.
+#
+# Note: The encryption method you specify here must match the
+#       decryption method the nsca daemon uses (as specified in
+#       the nsca.cfg file)!!
+# Values:
+# 	0 = None	(Do NOT use this option)
+#       1 = Simple XOR  (No security, just obfuscation, but very fast)
+#
+#       2 = DES
+#       3 = 3DES (Triple DES)
+#	4 = CAST-128
+#	5 = CAST-256
+#	6 = xTEA
+#	7 = 3WAY
+#	8 = BLOWFISH
+#	9 = TWOFISH
+#	10 = LOKI97
+#	11 = RC2
+#	12 = ARCFOUR
+#
+#	14 = RIJNDAEL-128
+#	15 = RIJNDAEL-192
+#	16 = RIJNDAEL-256
+#
+#	19 = WAKE
+#	20 = SERPENT
+#
+#	22 = ENIGMA (Unix crypt)
+#	23 = GOST
+#	24 = SAFER64
+#	25 = SAFER128
+#	26 = SAFER+
+#
+
+encryption_method=1
+
diff --git a/puppet/modules/nagios/files/plugin_data/sks-keyservers.netCA.pem b/puppet/modules/nagios/files/plugin_data/sks-keyservers.netCA.pem
new file mode 100644
index 00000000..24a2ad2e
--- /dev/null
+++ b/puppet/modules/nagios/files/plugin_data/sks-keyservers.netCA.pem
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFizCCA3OgAwIBAgIJAK9zyLTPn4CPMA0GCSqGSIb3DQEBBQUAMFwxCzAJBgNV
+BAYTAk5PMQ0wCwYDVQQIDARPc2xvMR4wHAYDVQQKDBVza3Mta2V5c2VydmVycy5u
+ZXQgQ0ExHjAcBgNVBAMMFXNrcy1rZXlzZXJ2ZXJzLm5ldCBDQTAeFw0xMjEwMDkw
+MDMzMzdaFw0yMjEwMDcwMDMzMzdaMFwxCzAJBgNVBAYTAk5PMQ0wCwYDVQQIDARP
+c2xvMR4wHAYDVQQKDBVza3Mta2V5c2VydmVycy5uZXQgQ0ExHjAcBgNVBAMMFXNr
+cy1rZXlzZXJ2ZXJzLm5ldCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
+ggIBANdsWy4PXWNUCkS3L//nrd0GqN3dVwoBGZ6w94Tw2jPDPifegwxQozFXkG6I
+6A4TK1CJLXPvfz0UP0aBYyPmTNadDinaB9T4jIwd4rnxl+59GiEmqkN3IfPsv5Jj
+MkKUmJnvOT0DEVlEaO1UZIwx5WpfprB3mR81/qm4XkAgmYrmgnLXd/pJDAMk7y1F
+45b5zWofiD5l677lplcIPRbFhpJ6kDTODXh/XEdtF71EAeaOdEGOvyGDmCO0GWqS
+FDkMMPTlieLA/0rgFTcz4xwUYj/cD5e0ZBuSkYsYFAU3hd1cGfBue0cPZaQH2HYx
+Qk4zXD8S3F4690fRhr+tki5gyG6JDR67aKp3BIGLqm7f45WkX1hYp+YXywmEziM4
+aSbGYhx8hoFGfq9UcfPEvp2aoc8u5sdqjDslhyUzM1v3m3ZGbhwEOnVjljY6JJLx
+MxagxnZZSAY424ZZ3t71E/Mn27dm2w+xFRuoy8JEjv1d+BT3eChM5KaNwrj0IO/y
+u8kFIgWYA1vZ/15qMT+tyJTfyrNVV/7Df7TNeWyNqjJ5rBmt0M6NpHG7CrUSkBy9
+p8JhimgjP5r0FlEkgg+lyD+V79H98gQfVgP3pbJICz0SpBQf2F/2tyS4rLm+49rP
+fcOajiXEuyhpcmzgusAj/1FjrtlynH1r9mnNaX4e+rLWzvU5AgMBAAGjUDBOMB0G
+A1UdDgQWBBTkwyoJFGfYTVISTpM8E+igjdq28zAfBgNVHSMEGDAWgBTkwyoJFGfY
+TVISTpM8E+igjdq28zAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4ICAQAR
+OXnYwu3g1ZjHyley3fZI5aLPsaE17cOImVTehC8DcIphm2HOMR/hYTTL+V0G4P+u
+gH+6xeRLKSHMHZTtSBIa6GDL03434y9CBuwGvAFCMU2GV8w92/Z7apkAhdLToZA/
+X/iWP2jeaVJhxgEcH8uPrnSlqoPBcKC9PrgUzQYfSZJkLmB+3jEa3HKruy1abJP5
+gAdQvwvcPpvYRnIzUc9fZODsVmlHVFBCl2dlu/iHh2h4GmL4Da2rRkUMlbVTdioB
+UYIvMycdOkpH5wJftzw7cpjsudGas0PARDXCFfGyKhwBRFY7Xp7lbjtU5Rz0Gc04
+lPrhDf0pFE98Aw4jJRpFeWMjpXUEaG1cq7D641RpgcMfPFvOHY47rvDTS7XJOaUT
+BwRjmDt896s6vMDcaG/uXJbQjuzmmx3W2Idyh3s5SI0GTHb0IwMKYb4eBUIpQOnB
+cE77VnCYqKvN1NVYAqhWjXbY7XasZvszCRcOG+W3FqNaHOK/n/0ueb0uijdLan+U
+f4p1bjbAox8eAOQS/8a3bzkJzdyBNUKGx1BIK2IBL9bn/HravSDOiNRSnZ/R3l9G
+ZauX0tu7IIDlRCILXSyeazu0aj/vdT3YFQXPcvt5Fkf5wiNTo53f72/jYEJd6qph
+WrpoKqrwGwTpRUCMhYIUt65hsTxCiJJ5nKe39h46sg==
+-----END CERTIFICATE-----
diff --git a/puppet/modules/nagios/files/plugins/check_dns2 b/puppet/modules/nagios/files/plugins/check_dns2
new file mode 100644
index 00000000..21956315
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_dns2
@@ -0,0 +1,102 @@
+#!/bin/bash
+# Written by Damien Gy
+# damien.gy+nagiosexchange(AT)gmail.com
+# 2007-09-28
+
+PROGNAME=`basename $0`
+REVISION=1.00
+TMP=/tmp/tmpdig
+DIG=/usr/bin/dig
+
+print_revision() {
+	echo $PROGNAME $REVISION
+}
+
+print_usage() {
+	echo "Usage:"
+	echo "	$PROGNAME -c|--check <host> <type> <server>"
+	echo "	$PROGNAME -h|--help"
+	echo "	$PROGNAME -v|--version"
+}
+
+print_help() {
+	print_revision
+	echo ""
+	print_usage
+	echo "Where:"
+	echo "	host	the name of the resource record to be looked up"
+	echo "	type	indicates the query required (any, a, mx, etc.)"
+	echo "	server	the name or IP address of the name server to query"
+	echo ""
+	echo "	-h|--help	prints this help screen"
+	echo ""
+	echo "	-v|--version	prints version and license information"
+	echo ""
+	echo " Created by Damien Gy, questions or problems e-mail damien.gy+nagiosexchange(AT)gmail.com"
+	echo ""
+}
+
+check_dns() {
+
+	if [ $# -ne 3 ]
+	then
+	        echo "Number of arguments incorrect"
+	        exit 3
+	fi
+	if [ ! -e $DIG ]
+	then
+		echo "$DIG not found"
+		exit 3
+	fi
+	$DIG $1 $2 @$3 > $TMP
+
+	if ( grep "status" $TMP > /dev/null )
+	then
+	        # DNS server answered
+	        if ( grep "NOERROR" $TMP > /dev/null )
+	        then
+	                echo "DNS OK "`grep "time:" $TMP`
+	                rm -f $TMP
+	                exit 0
+	        else
+	                echo "WARNING "`grep "time:" $TMP`
+	                rm -f $TMP
+	                exit 1
+	        fi
+
+	else
+	        # no answer
+	        echo "CRITICAL - Connection timed out"
+	        rm -f $TMP
+	        exit 2
+	fi
+}
+
+case "$1" in
+--help)
+                print_help
+        exit 0
+        ;;
+-h)
+                print_help
+        exit 0
+        ;;
+--version)
+                print_revision
+        exit 0
+        ;;
+-v)
+                print_revision
+        exit 0
+        ;;
+--check)
+                check_dns $2 $3 $4
+        ;;
+-c)
+                check_dns $2 $3 $4
+        ;;
+*)
+                print_usage
+        exit 3
+
+esac
diff --git a/puppet/modules/nagios/files/plugins/check_dnsbl b/puppet/modules/nagios/files/plugins/check_dnsbl
new file mode 100644
index 00000000..93cea375
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_dnsbl
@@ -0,0 +1,107 @@
+#!/bin/sh
+#
+# dnsbl-check-nagios.sh
+#
+# (c) 2009 Damon Tajeddini & heise Netze
+#
+STATE_OK=0
+STATE_WARNING=1
+STATE_CRITICAL=2
+STATE_UNKNOWN=3
+STATE_DEPENDENT=4
+
+FOUND_ADRESS=0
+
+DNSBLlist=`grep -v ^# <<!
+cbl.abuseat.org
+dnsbl.ahbl.org
+ircbl.ahbl.org
+virbl.dnsbl.bit.nl
+blackholes.five-ten-sg.com
+dnsbl.inps.de
+ix.dnsbl.manitu.net
+no-more-funn.moensted.dk
+combined.njabl.org
+dnsbl.njabl.org
+dnsbl.sorbs.net
+bl.spamcannibal.org
+bl.spamcop.net
+sbl.spamhaus.org
+xbl.spamhaus.org
+pbl.spamhaus.org
+dnsbl-1.uceprotect.net
+# dnsbl-2.uceprotect.net
+# dnsbl-3.uceprotect.net
+psbl.surriel.com
+l2.apews.org
+dnsrbl.swinog.ch
+db.wpbl.info
+!`
+
+# reverse IP address
+convertIP()
+{
+ set `IFS=".";echo $1`
+ echo $4.$3.$2.$1
+}
+
+usage()
+{
+ echo "Usage: $0 [-H] <host>] [-p]"
+ echo "    -H  check Host "
+ echo "    -p  print list of DNSBLs"
+ exit 3
+}
+
+# Checks the IP with list of DNSBL servers
+check()
+{
+  count=0;
+  for i in $DNSBLlist
+  do
+    count=$(($count + 1))
+    if nslookup $ip_arpa.$i | grep -q "127.0.0." ;
+    then
+      FOUND_ADRESS=$(($FOUND_ADRESS + 1))
+      echo "DNSBL-Alarm: $ip is listed on $i"
+    fi
+  done
+  if [ $FOUND_ADRESS -ge 1 ]
+  then
+    exit 1
+  fi
+  echo "OK - $ip not on $count DNSBLs"
+  exit 0
+}
+
+case $1 in
+  -H)
+    if [ -z "$2" ]
+    then
+      echo "ip address missing"
+      exit
+    fi
+    ip=$2
+    ip_arpa=`convertIP $ip`
+    check;;
+
+  -p)
+    for i in $DNSBLlist
+    do
+      echo $i
+    done
+    exit $STATE_WARNING
+    exit;;
+
+  --help)
+    usage
+    exit;;
+
+  *)
+    if [ -z "$1" ]
+    then
+      usage
+    fi
+    echo "unknown command: $1"
+    exit;;
+esac
diff --git a/puppet/modules/nagios/files/plugins/check_gpg b/puppet/modules/nagios/files/plugins/check_gpg
new file mode 100644
index 00000000..eb9fa51f
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_gpg
@@ -0,0 +1,115 @@
+#!/bin/bash
+#
+# Nagios plugin that checks whether a key ID has expired, or will expire within
+# a certain time.
+#
+# note: the plugin will issue a critical state if the required key has been
+# revoked.
+#
+# usage: check_gpg [-w <num_days>] [--gnupg-homedir <path>] <key_id>
+#
+# <key_id> is any PGP key ID that GnuPG accepts with "gpg --list-key <key_id>"
+#
+# The option -w parameter lets you specify the number of days within which key
+# expiry will trigger a warning. e.g. if <key_id> expires within <num_days>
+# days, make nagios issue a warning.
+#
+# num_days must be an integer value
+#
+# optionally, if the keyring directory you want GPG to use is not located in
+# the user's ~/.gnupg, you can specify the path to the keyring directory with
+# the --gnupg-homedir parameter.
+#
+# Thanks a bunch to Daniel Kahn Gillmor for providing example commands that
+# made up most of the core of this plugin.
+#
+# Copyleft Gabriel Filion
+#
+# This plugin is released under the GPL v3+ license. To get a copy of the
+# license text visit: https://www.gnu.org/licenses/gpl-3.0.txt
+#
+SECS_IN_DAY=86400
+
+function debug () {
+  if [ -n "$DEBUG" ]; then
+      echo "$1" >&2
+  fi
+}
+
+debug "got args: $*"
+
+now=$(date +%s)
+debug "current timestamp: $now"
+
+warning_threshold=
+homedir=
+homedir_path=~/.gnupg
+for arg in $*; do
+    case $arg in
+        "-w")
+            if [ -z "$2" ]; then
+                echo "UNKNOWN: argument -w got no value. integer needed"
+                exit 3
+            fi
+            if [ "`echo $2 | egrep ^[[:digit:]]+$`" = "" ]; then
+                echo "UNKNOWN: invalid value '$2' passed to -w. integer needed"
+                exit 3
+            fi
+            warning_threshold=$(( $now + ($2*$SECS_IN_DAY) ))
+            debug "setting warning_threshold to '$warning_threshold'"
+
+            shift 2
+        ;;
+        "--gnupg-homedir")
+            if [ -z "$2" ]; then
+                echo "UNKNOWN: argument --gnupg-homedir got no value. path needed"
+                exit 3
+            fi
+            if [ ! -d "$2" ]; then
+                echo "UNKNOWN: homedir '$2' does not exist or is not a directory"
+                exit 3
+            fi
+            homedir_path=$2
+            homedir="--homedir ${homedir_path}"
+            debug "setting homedir to '$homedir_path'"
+
+            shift 2
+        ;;
+    esac
+done
+
+if [ -z "$1" ]; then
+    echo "UNKNOWN: must provide a key ID"
+    exit 3
+fi
+key="$1"
+
+# GPG is too stupid to error out when asked to refresh a key that's not in the
+# local keyring so we need to perform another call to verify this first.
+output=$( { gpg $homedir --list-key "$key" >/dev/null && gpg $homedir --refresh --keyserver hkps://hkps.pool.sks-keyservers.net --keyserver-options ca-cert-file=$homedir_path/sks-keyservers.netCA.pem "$key" >/dev/null; } 2>&1 )
+if [ $? -ne 0 ]; then
+    echo "UNKNOWN: $output"
+    exit 3
+fi
+
+if [ "$(gpg $homedir --check-sig "$key" | grep "^rev!")" != "" ]; then
+    echo "CRITICAL: key '$key' has been revoked!"
+    exit 1
+fi
+
+for expiry in $(gpg $homedir --with-colons --fixed-list-mode --list-key "$key" 2>/dev/null | awk -F: '/^pub:/{ print $7 }');
+do
+    debug "expiry value: $expiry"
+
+    if [ "$now" -gt "$expiry" ] ; then
+        printf "CRITICAL: %s has expired on %s\n" "$key" "$(date -d "$expiry seconds")";
+        exit 1;
+    fi;
+    if [ -n "$warning_threshold" ] && [ "$warning_threshold" -gt "$expiry" ]; then
+        remaining=$(( ($expiry-$now) / $SECS_IN_DAY ))
+        printf "WARNING: %s expires in %s days\n" "$key" "$remaining";
+        exit 2;
+    fi
+done
+
+echo "OK: key '$key' has not expired."
diff --git a/puppet/modules/nagios/files/plugins/check_horde_login b/puppet/modules/nagios/files/plugins/check_horde_login
new file mode 100644
index 00000000..8c821e48
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_horde_login
@@ -0,0 +1,94 @@
+#!/bin/env python
+# vi:si:et:sw=4:sts=4:ts=4
+# -*- coding: UTF-8 -*-
+# -*- Mode: Python -*-
+#
+# Copyright (C) 2015 mh <mh@immerda.ch>
+
+# This file may be distributed and/or modified under the terms of
+# the GNU General Public License version 2 as published by
+# the Free Software Foundation.
+# This file is distributed without any warranty; without even the implied
+# warranty of merchantability or fitness for a particular purpose.
+#
+
+import sys, os, requests, getopt
+from time import time
+
+def usage():
+    print sys.argv[0] + " -u username "+ \
+                          "-p password " + \
+                          "-s server path" + \
+                          "[-w warning_in_s] " + \
+                          "[-c critical_in_s]"
+    sys.exit(1)
+
+def main():
+    try:
+        opts, args = getopt.getopt(sys.argv[1:], "u:p:s:h:w:c")
+    except getopt.GetoptError:
+        usage()
+        return 3
+
+    user = url = password = None
+    warning = 5
+    critical = 10
+
+    for o, a in opts:
+        if o == "-u":
+            user = a
+        elif o == "-p":
+            password = a
+        elif o == "-w":
+            warning = a
+        elif o == "-c":
+            critical = a
+        elif o == "-s":
+            url = a + "/login.php"
+        elif o == '-h':
+            usage()
+
+    if user == None or password == None or url == None:
+        usage()
+
+    params = { 'horde_user':         user,
+               'horde_pass':         password,
+               'horde_select_view':  'auto',
+               'anchor_string':      '',
+               'app':                '',
+               'login_post':         1,
+               'new_lang':           'en_US',
+               'url':                '',
+             }
+
+
+    timestamp = time()
+    try:
+      r = requests.post(url, data=params, allow_redirects=False)
+    except Exception, e:
+      print "CRITICAL Horde Login Failed: %s" % e
+      sys.exit(2)
+
+    timestamp = time() - timestamp
+    if r.status_code == 302:
+        if timestamp < warning:
+          status = "OK"
+          exitcode = 0
+        if timestamp >= warning:
+          status = "WARNING"
+          exitcode = 1
+        if timestamp >= critical:
+          status = "CRITICAL"
+          exitcode = 2
+    else:
+        status   = "ERROR"
+        exitcode = 2
+    # on a successfully login we are redirected to the mailbox
+    print '%s Horde Login | response_time=%.3fs;%.3f;%.3f' % (status, timestamp, warning, critical)
+    sys.exit(exitcode)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
+
+
diff --git a/puppet/modules/nagios/files/plugins/check_imap_login b/puppet/modules/nagios/files/plugins/check_imap_login
new file mode 100644
index 00000000..d059822b
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_imap_login
@@ -0,0 +1,80 @@
+#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+# -*- Mode: Python -*-
+#
+# Copyright (C) 2006 Bertera Pietro <pietro@bertera.it>
+# Response time monitoring with perfdata modification by Ivan Savcic <isavcic@gmail.com> and Milos Buncic, 2012.
+# From: https://github.com/isavcic/check_imap_login
+
+# This file may be distributed and/or modified under the terms of
+# the GNU General Public License version 2 as published by
+# the Free Software Foundation.
+# This file is distributed without any warranty; without even the implied
+# warranty of merchantability or fitness for a particular purpose.
+
+import sys, os, imaplib, getopt
+from time import time
+
+def usage():
+	print sys.argv[0] + " -u <user> -p <password> -H <host> [-s] -w <warning threshold (sec)> -c <critical threshold (sec)>\n -s is for using IMAPS"
+
+def main():
+	try:
+		opts, args = getopt.getopt(sys.argv[1:], "u:p:sH:w:c:")
+	except getopt.GetoptError:
+		usage()
+		return 3
+    
+	user = host = password = use_ssl = warning = critical = None
+
+	for o, a in opts:
+		if o == "-u":
+			user = a
+		elif o == "-p":
+			password = a
+		elif o == "-s":
+			use_ssl = True
+		elif o == "-H":
+			host = a
+		elif o == "-w":
+			warning = float(a)
+		elif o == "-c":
+			critical = float(a)
+
+	if user == None or password == None or host == None or warning == None or critical == None:
+		usage()
+		return 1
+    
+	if use_ssl:
+		M = imaplib.IMAP4_SSL(host=host)
+	else:
+		M = imaplib.IMAP4(host)
+    
+	timestamp = time()
+	
+	try:	
+		M.login(user, password)
+	except Exception, e:
+		print "CRITICAL IMAP Login Failed: %s" % e
+		return 2
+
+	M.logout()
+
+	timestamp = time() - timestamp
+
+	if timestamp < warning:
+		status = "OK"
+		exitcode = 0
+	if timestamp >= warning:
+		status = "WARNING"
+		exitcode = 1
+	if timestamp >= critical:
+		status = "CRITICAL"
+		exitcode = 2
+
+	print '%s IMAP Login | response_time=%.3fs;%.3f;%.3f' % (status, timestamp, warning, critical)
+
+	return exitcode
+
+if __name__ == "__main__":
+	sys.exit(main())
diff --git a/puppet/modules/nagios/files/plugins/check_jabber_login b/puppet/modules/nagios/files/plugins/check_jabber_login
new file mode 100644
index 00000000..dac0e1fe
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_jabber_login
@@ -0,0 +1,30 @@
+#!/usr/bin/env ruby
+require 'rubygems'
+require 'xmpp4r'
+
+
+def usage
+  puts "#{$0} jabberid password"
+  exit 3
+end
+
+usage unless ARGV.size == 2
+
+begin
+      my_client = Jabber::Client.new(ARGV[0])
+      my_client.connect
+      my_client.auth(ARGV[1])
+rescue Jabber::ClientAuthenticationFailure => detail
+  puts "CRITICAL: Login Error"
+  exit 2
+rescue Errno::ECONNREFUSED => detail
+  puts "CRITICAL: Connection refused"
+  exit 2
+rescue SocketError => detail
+  puts "CRITICAL: Socket Error"
+  exit 2
+#rescue 
+#  puts "CRITICAL: Unknown Error"
+#  exit 2
+end
+puts "OK: Login for #{ARGV[0]} successfull"
diff --git a/puppet/modules/nagios/files/plugins/check_mysql_health b/puppet/modules/nagios/files/plugins/check_mysql_health
new file mode 100755
index 00000000..9292ae09
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_mysql_health
@@ -0,0 +1,3780 @@
+#! /usr/bin/perl -w
+# nagios: -epn
+
+my %ERRORS=( OK => 0, WARNING => 1, CRITICAL => 2, UNKNOWN => 3 );
+my %ERRORCODES=( 0 => 'OK', 1 => 'WARNING', 2 => 'CRITICAL', 3 => 'UNKNOWN' );
+package DBD::MySQL::Server::Instance::Innodb;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Server::Instance);
+
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    handle => $params{handle},
+    internals => undef,
+    warningrange => $params{warningrange},
+    criticalrange => $params{criticalrange},
+  };
+  bless $self, $class;
+  $self->init(%params);
+  return $self;
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  $self->init_nagios();
+  if ($params{mode} =~ /server::instance::innodb/) {
+    $self->{internals} =
+        DBD::MySQL::Server::Instance::Innodb::Internals->new(%params);
+  }
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  if ($params{mode} =~ /server::instance::innodb/) {
+    $self->{internals}->nagios(%params);
+    $self->merge_nagios($self->{internals});
+  }
+}
+
+
+package DBD::MySQL::Server::Instance::Innodb::Internals;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Server::Instance::Innodb);
+
+our $internals; # singleton, nur ein einziges mal instantiierbar
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  unless ($internals) {
+    $internals = {
+      handle => $params{handle},
+      bufferpool_hitrate => undef,
+      wait_free => undef,
+      log_waits => undef,
+      have_innodb => undef,
+      warningrange => $params{warningrange},
+      criticalrange => $params{criticalrange},
+    };
+    bless($internals, $class);
+    $internals->init(%params);
+  }
+  return($internals);
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  my $dummy;
+  $self->debug("enter init");
+  $self->init_nagios();
+  ($dummy, $self->{have_innodb}) 
+      = $self->{handle}->fetchrow_array(q{
+      SHOW VARIABLES LIKE 'have_innodb'
+  });
+  if ($self->{have_innodb} eq "NO") {
+    $self->add_nagios_critical("the innodb engine has a problem (have_innodb=no)");
+  } elsif ($self->{have_innodb} eq "DISABLED") {
+    # add_nagios_ok later
+  } elsif ($params{mode} =~ /server::instance::innodb::bufferpool::hitrate/) {
+    ($dummy, $self->{bufferpool_reads}) 
+        = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Innodb_buffer_pool_reads'
+    });
+    ($dummy, $self->{bufferpool_read_requests}) 
+        = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Innodb_buffer_pool_read_requests'
+    });
+    if (! defined $self->{bufferpool_reads}) {
+      $self->add_nagios_critical("no innodb buffer pool info available");
+    } else {
+      $self->valdiff(\%params, qw(bufferpool_reads
+          bufferpool_read_requests));
+      $self->{bufferpool_hitrate_now} =
+          $self->{delta_bufferpool_read_requests} > 0 ?
+          100 - (100 * $self->{delta_bufferpool_reads} / 
+              $self->{delta_bufferpool_read_requests}) : 100;
+      $self->{bufferpool_hitrate} =
+          $self->{bufferpool_read_requests} > 0 ?
+          100 - (100 * $self->{bufferpool_reads} /
+              $self->{bufferpool_read_requests}) : 100;
+    }
+  } elsif ($params{mode} =~ /server::instance::innodb::bufferpool::waitfree/) {
+    ($dummy, $self->{bufferpool_wait_free})
+        = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Innodb_buffer_pool_wait_free'
+    });
+    if (! defined $self->{bufferpool_wait_free}) {
+      $self->add_nagios_critical("no innodb buffer pool info available");
+    } else {
+      $self->valdiff(\%params, qw(bufferpool_wait_free));
+      $self->{bufferpool_wait_free_rate} =
+          $self->{delta_bufferpool_wait_free} / $self->{delta_timestamp};
+    }
+  } elsif ($params{mode} =~ /server::instance::innodb::logwaits/) {
+    ($dummy, $self->{log_waits})
+        = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Innodb_log_waits'
+    });
+    if (! defined $self->{log_waits}) {
+      $self->add_nagios_critical("no innodb log info available");
+    } else {
+      $self->valdiff(\%params, qw(log_waits));
+      $self->{log_waits_rate} =
+          $self->{delta_log_waits} / $self->{delta_timestamp};
+    }
+  } elsif ($params{mode} =~ /server::instance::innodb::needoptimize/) {
+#fragmentation=$(($datafree * 100 / $datalength))
+
+#http://www.electrictoolbox.com/optimize-tables-mysql-php/
+    my  @result = $self->{handle}->fetchall_array(q{
+SHOW TABLE STATUS WHERE Data_free / Data_length > 0.1 AND Data_free > 102400
+});
+printf "%s\n", Data::Dumper::Dumper(\@result);
+
+  }
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  my $now = $params{lookback} ? '_now' : '';
+  if ($self->{have_innodb} eq "DISABLED") {
+    $self->add_nagios_ok("the innodb engine has been disabled");
+  } elsif (! $self->{nagios_level}) {
+    if ($params{mode} =~ /server::instance::innodb::bufferpool::hitrate/) {
+      my $refkey = 'bufferpool_hitrate'.($params{lookback} ? '_now' : '');
+      $self->add_nagios(
+          $self->check_thresholds($self->{$refkey}, "99:", "95:"),
+              sprintf "innodb buffer pool hitrate at %.2f%%", $self->{$refkey});
+      $self->add_perfdata(sprintf "bufferpool_hitrate=%.2f%%;%s;%s;0;100",
+          $self->{bufferpool_hitrate},
+          $self->{warningrange}, $self->{criticalrange});
+      $self->add_perfdata(sprintf "bufferpool_hitrate_now=%.2f%%",
+          $self->{bufferpool_hitrate_now});
+    } elsif ($params{mode} =~ /server::instance::innodb::bufferpool::waitfree/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{bufferpool_wait_free_rate}, "1", "10"),
+          sprintf "%ld innodb buffer pool waits in %ld seconds (%.4f/sec)",
+          $self->{delta_bufferpool_wait_free}, $self->{delta_timestamp},
+          $self->{bufferpool_wait_free_rate});
+      $self->add_perfdata(sprintf "bufferpool_free_waits_rate=%.4f;%s;%s;0;100",
+          $self->{bufferpool_wait_free_rate},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::innodb::logwaits/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{log_waits_rate}, "1", "10"),
+          sprintf "%ld innodb log waits in %ld seconds (%.4f/sec)",
+          $self->{delta_log_waits}, $self->{delta_timestamp},
+          $self->{log_waits_rate});
+      $self->add_perfdata(sprintf "innodb_log_waits_rate=%.4f;%s;%s;0;100",
+          $self->{log_waits_rate},
+          $self->{warningrange}, $self->{criticalrange});
+    }
+  }
+}
+
+
+
+
+package DBD::MySQL::Server::Instance::MyISAM;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Server::Instance);
+
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    handle => $params{handle},
+    internals => undef,
+    warningrange => $params{warningrange},
+    criticalrange => $params{criticalrange},
+  };
+  bless $self, $class;
+  $self->init(%params);
+  return $self;
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  $self->init_nagios();
+  if ($params{mode} =~ /server::instance::myisam/) {
+    $self->{internals} =
+        DBD::MySQL::Server::Instance::MyISAM::Internals->new(%params);
+  }
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  if ($params{mode} =~ /server::instance::myisam/) {
+    $self->{internals}->nagios(%params);
+    $self->merge_nagios($self->{internals});
+  }
+}
+
+
+package DBD::MySQL::Server::Instance::MyISAM::Internals;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Server::Instance::MyISAM);
+
+our $internals; # singleton, nur ein einziges mal instantiierbar
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  unless ($internals) {
+    $internals = {
+      handle => $params{handle},
+      keycache_hitrate => undef,
+      warningrange => $params{warningrange},
+      criticalrange => $params{criticalrange},
+    };
+    bless($internals, $class);
+    $internals->init(%params);
+  }
+  return($internals);
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  my $dummy;
+  $self->debug("enter init");
+  $self->init_nagios();
+  if ($params{mode} =~ /server::instance::myisam::keycache::hitrate/) {
+    ($dummy, $self->{key_reads})
+        = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Key_reads'
+    });
+    ($dummy, $self->{key_read_requests})
+        = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Key_read_requests'
+    });
+    if (! defined $self->{key_read_requests}) {
+      $self->add_nagios_critical("no myisam keycache info available");
+    } else {
+      $self->valdiff(\%params, qw(key_reads key_read_requests));
+      $self->{keycache_hitrate} =
+          $self->{key_read_requests} > 0 ?
+          100 - (100 * $self->{key_reads} /
+              $self->{key_read_requests}) : 100;
+      $self->{keycache_hitrate_now} =
+          $self->{delta_key_read_requests} > 0 ?
+          100 - (100 * $self->{delta_key_reads} /
+              $self->{delta_key_read_requests}) : 100;
+    }
+  } elsif ($params{mode} =~ /server::instance::myisam::sonstnochwas/) {
+  }
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  if (! $self->{nagios_level}) {
+    if ($params{mode} =~ /server::instance::myisam::keycache::hitrate/) {
+      my $refkey = 'keycache_hitrate'.($params{lookback} ? '_now' : '');
+      $self->add_nagios(
+          $self->check_thresholds($self->{$refkey}, "99:", "95:"),
+              sprintf "myisam keycache hitrate at %.2f%%", $self->{$refkey});
+      $self->add_perfdata(sprintf "keycache_hitrate=%.2f%%;%s;%s",
+          $self->{keycache_hitrate},
+          $self->{warningrange}, $self->{criticalrange});
+      $self->add_perfdata(sprintf "keycache_hitrate_now=%.2f%%;%s;%s",
+          $self->{keycache_hitrate_now},
+          $self->{warningrange}, $self->{criticalrange});
+    }
+  }
+}
+
+
+package DBD::MySQL::Server::Instance::Replication;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Server::Instance);
+
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    handle => $params{handle},
+    internals => undef,
+    warningrange => $params{warningrange},
+    criticalrange => $params{criticalrange},
+  };
+  bless $self, $class;
+  $self->init(%params);
+  return $self;
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  $self->init_nagios();
+  if ($params{mode} =~ /server::instance::replication/) {
+    $self->{internals} =
+        DBD::MySQL::Server::Instance::Replication::Internals->new(%params);
+  }
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  if ($params{mode} =~ /server::instance::replication/) {
+    $self->{internals}->nagios(%params);
+    $self->merge_nagios($self->{internals});
+  }
+}
+
+
+package DBD::MySQL::Server::Instance::Replication::Internals;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Server::Instance::Replication);
+
+our $internals; # singleton, nur ein einziges mal instantiierbar
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  unless ($internals) {
+    $internals = {
+      handle => $params{handle},
+      seconds_behind_master => undef,
+      slave_io_running => undef,
+      slave_sql_running => undef,
+      warningrange => $params{warningrange},
+      criticalrange => $params{criticalrange},
+    };
+    bless($internals, $class);
+    $internals->init(%params);
+  }
+  return($internals);
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  $self->debug("enter init");
+  $self->init_nagios();
+  if ($params{mode} =~ /server::instance::replication::slavelag/) {
+    # "show slave status", "Seconds_Behind_Master"
+    my $slavehash = $self->{handle}->selectrow_hashref(q{
+            SHOW SLAVE STATUS
+        });
+    if ((! defined $slavehash->{Seconds_Behind_Master}) && 
+        (lc $slavehash->{Slave_IO_Running} eq 'no')) {
+      $self->add_nagios_critical(
+          "unable to get slave lag, because io thread is not running");
+    } elsif (! defined $slavehash->{Seconds_Behind_Master}) {
+      $self->add_nagios_critical(sprintf "unable to get replication info%s",
+          $self->{handle}->{errstr} ? $self->{handle}->{errstr} : "");
+    } else {
+      $self->{seconds_behind_master} = $slavehash->{Seconds_Behind_Master};
+    }
+  } elsif ($params{mode} =~ /server::instance::replication::slaveiorunning/) {
+    # "show slave status", "Slave_IO_Running"
+    my $slavehash = $self->{handle}->selectrow_hashref(q{
+            SHOW SLAVE STATUS
+        });
+    if (! defined $slavehash->{Slave_IO_Running}) {
+      $self->add_nagios_critical(sprintf "unable to get replication info%s",
+          $self->{handle}->{errstr} ? $self->{handle}->{errstr} : "");
+    } else {
+      $self->{slave_io_running} = $slavehash->{Slave_IO_Running};
+    }
+  } elsif ($params{mode} =~ /server::instance::replication::slavesqlrunning/) {
+    # "show slave status", "Slave_SQL_Running"
+    my $slavehash = $self->{handle}->selectrow_hashref(q{
+            SHOW SLAVE STATUS
+        });
+    if (! defined $slavehash->{Slave_SQL_Running}) {
+      $self->add_nagios_critical(sprintf "unable to get replication info%s",
+          $self->{handle}->{errstr} ? $self->{handle}->{errstr} : "");
+    } else {
+      $self->{slave_sql_running} = $slavehash->{Slave_SQL_Running};
+    }
+  }
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  if (! $self->{nagios_level}) {
+    if ($params{mode} =~ /server::instance::replication::slavelag/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{seconds_behind_master}, "10", "20"),
+          sprintf "Slave is %d seconds behind master",
+          $self->{seconds_behind_master});
+      $self->add_perfdata(sprintf "slave_lag=%d;%s;%s",
+          $self->{seconds_behind_master},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::replication::slaveiorunning/) {
+      if (lc $self->{slave_io_running} eq "yes") {
+        $self->add_nagios_ok("Slave io is running");
+      } else {
+        $self->add_nagios_critical("Slave io is not running");
+      }
+    } elsif ($params{mode} =~ /server::instance::replication::slavesqlrunning/) {
+      if (lc $self->{slave_sql_running} eq "yes") {
+        $self->add_nagios_ok("Slave sql is running");
+      } else {
+        $self->add_nagios_critical("Slave sql is not running");
+      }
+    }
+  }
+}
+
+
+
+package DBD::MySQL::Server::Instance;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Server);
+
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    handle => $params{handle},
+    uptime => $params{uptime},
+    warningrange => $params{warningrange},
+    criticalrange => $params{criticalrange},
+    threads_connected => undef,
+    threads_created => undef,
+    connections => undef,
+    threadcache_hitrate => undef,
+    querycache_hitrate => undef,
+    lowmem_prunes_per_sec => undef,
+    slow_queries_per_sec => undef,
+    longrunners => undef,
+    tablecache_hitrate => undef,
+    index_usage => undef,
+    engine_innodb => undef,
+    engine_myisam => undef,
+    replication => undef,
+  };
+  bless $self, $class;
+  $self->init(%params);
+  return $self;
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  my $dummy;
+  $self->init_nagios();
+  if ($params{mode} =~ /server::instance::connectedthreads/) {
+    ($dummy, $self->{threads_connected}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Threads_connected'
+    });
+  } elsif ($params{mode} =~ /server::instance::createdthreads/) {
+    ($dummy, $self->{threads_created}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Threads_created'
+    });
+    $self->valdiff(\%params, qw(threads_created));
+    $self->{threads_created_per_sec} = $self->{delta_threads_created} /
+        $self->{delta_timestamp};
+  } elsif ($params{mode} =~ /server::instance::runningthreads/) {
+    ($dummy, $self->{threads_running}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Threads_running'
+    });
+  } elsif ($params{mode} =~ /server::instance::cachedthreads/) {
+    ($dummy, $self->{threads_cached}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Threads_cached'
+    });
+  } elsif ($params{mode} =~ /server::instance::abortedconnects/) {
+    ($dummy, $self->{connects_aborted}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Aborted_connects'
+    });
+    $self->valdiff(\%params, qw(connects_aborted));
+    $self->{connects_aborted_per_sec} = $self->{delta_connects_aborted} /
+        $self->{delta_timestamp};
+  } elsif ($params{mode} =~ /server::instance::abortedclients/) {
+    ($dummy, $self->{clients_aborted}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Aborted_clients'
+    });
+    $self->valdiff(\%params, qw(clients_aborted));
+    $self->{clients_aborted_per_sec} = $self->{delta_clients_aborted} /
+        $self->{delta_timestamp};
+  } elsif ($params{mode} =~ /server::instance::threadcachehitrate/) {
+    ($dummy, $self->{threads_created}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Threads_created'
+    });
+    ($dummy, $self->{connections}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Connections'
+    });
+    $self->valdiff(\%params, qw(threads_created connections));
+    if ($self->{delta_connections} > 0) {
+      $self->{threadcache_hitrate_now} = 
+          100 - ($self->{delta_threads_created} * 100.0 /
+          $self->{delta_connections});
+    } else {
+      $self->{threadcache_hitrate_now} = 100;
+    }
+    $self->{threadcache_hitrate} = 100 - 
+        ($self->{threads_created} * 100.0 / $self->{connections});
+    $self->{connections_per_sec} = $self->{delta_connections} /
+        $self->{delta_timestamp};
+  } elsif ($params{mode} =~ /server::instance::querycachehitrate/) {
+    ($dummy, $self->{com_select}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Com_select'
+    });
+    ($dummy, $self->{qcache_hits}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Qcache_hits'
+    });
+    #    SHOW VARIABLES WHERE Variable_name = 'have_query_cache' for 5.x, but LIKE is compatible
+    ($dummy, $self->{have_query_cache}) = $self->{handle}->fetchrow_array(q{
+        SHOW VARIABLES LIKE 'have_query_cache'
+    });
+    #    SHOW VARIABLES WHERE Variable_name = 'query_cache_size'
+    ($dummy, $self->{query_cache_size}) = $self->{handle}->fetchrow_array(q{
+        SHOW VARIABLES LIKE 'query_cache_size'
+    });
+    $self->valdiff(\%params, qw(com_select qcache_hits));
+    $self->{querycache_hitrate_now} = 
+        ($self->{delta_com_select} + $self->{delta_qcache_hits}) > 0 ?
+        100 * $self->{delta_qcache_hits} /
+            ($self->{delta_com_select} + $self->{delta_qcache_hits}) :
+        0;
+    $self->{querycache_hitrate} =
+        100 * $self->{qcache_hits} / ($self->{com_select} + $self->{qcache_hits});
+    $self->{selects_per_sec} =
+        $self->{delta_com_select} / $self->{delta_timestamp};
+  } elsif ($params{mode} =~ /server::instance::querycachelowmemprunes/) {
+    ($dummy, $self->{lowmem_prunes}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Qcache_lowmem_prunes'
+    });
+    $self->valdiff(\%params, qw(lowmem_prunes));
+    $self->{lowmem_prunes_per_sec} = $self->{delta_lowmem_prunes} / 
+        $self->{delta_timestamp};
+  } elsif ($params{mode} =~ /server::instance::slowqueries/) {
+    ($dummy, $self->{slow_queries}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Slow_queries'
+    });
+    $self->valdiff(\%params, qw(slow_queries));
+    $self->{slow_queries_per_sec} = $self->{delta_slow_queries} / 
+        $self->{delta_timestamp};
+  } elsif ($params{mode} =~ /server::instance::longprocs/) {
+    if (DBD::MySQL::Server::return_first_server()->version_is_minimum("5.1")) {
+      ($self->{longrunners}) = $self->{handle}->fetchrow_array(q{
+          SELECT
+              COUNT(*)
+          FROM
+              information_schema.processlist
+          WHERE user <> 'replication' 
+          AND id <> CONNECTION_ID() 
+          AND time > 60 
+          AND command <> 'Sleep'
+      });
+    } else {
+      $self->{longrunners} = 0 if ! defined $self->{longrunners};
+      foreach ($self->{handle}->fetchall_array(q{
+          SHOW PROCESSLIST
+      })) {
+        my($id, $user, $host, $db, $command, $tme, $state, $info) = @{$_};
+        if (($user ne 'replication') &&
+            ($tme > 60) &&
+            ($command ne 'Sleep')) {
+          $self->{longrunners}++;
+        }
+      }
+    }
+  } elsif ($params{mode} =~ /server::instance::tablecachehitrate/) {
+    ($dummy, $self->{open_tables}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Open_tables'
+    });
+    ($dummy, $self->{opened_tables}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Opened_tables'
+    });
+    if (DBD::MySQL::Server::return_first_server()->version_is_minimum("5.1.3")) {
+      #      SHOW VARIABLES WHERE Variable_name = 'table_open_cache'
+      ($dummy, $self->{table_cache}) = $self->{handle}->fetchrow_array(q{
+          SHOW VARIABLES LIKE 'table_open_cache'
+      });
+    } else {
+      #    SHOW VARIABLES WHERE Variable_name = 'table_cache'
+      ($dummy, $self->{table_cache}) = $self->{handle}->fetchrow_array(q{
+          SHOW VARIABLES LIKE 'table_cache'
+      });
+    }
+    $self->{table_cache} ||= 0;
+    #$self->valdiff(\%params, qw(open_tables opened_tables table_cache));
+    # _now ist hier sinnlos, da opened_tables waechst, aber open_tables wieder 
+    # schrumpfen kann weil tabellen geschlossen werden.
+    if ($self->{opened_tables} != 0 && $self->{table_cache} != 0) {
+      $self->{tablecache_hitrate} = 
+          100 * $self->{open_tables} / $self->{opened_tables};
+      $self->{tablecache_fillrate} = 
+          100 * $self->{open_tables} / $self->{table_cache};
+    } elsif ($self->{opened_tables} == 0 && $self->{table_cache} != 0) {
+      $self->{tablecache_hitrate} = 100;
+      $self->{tablecache_fillrate} = 
+          100 * $self->{open_tables} / $self->{table_cache};
+    } else {
+      $self->{tablecache_hitrate} = 0;
+      $self->{tablecache_fillrate} = 0;
+      $self->add_nagios_critical("no table cache");
+    }
+  } elsif ($params{mode} =~ /server::instance::tablelockcontention/) {
+    ($dummy, $self->{table_locks_waited}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Table_locks_waited'
+    });
+    ($dummy, $self->{table_locks_immediate}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Table_locks_immediate'
+    });
+    $self->valdiff(\%params, qw(table_locks_waited table_locks_immediate));
+    $self->{table_lock_contention} = 
+        ($self->{table_locks_waited} + $self->{table_locks_immediate}) > 0 ?
+        100 * $self->{table_locks_waited} / 
+        ($self->{table_locks_waited} + $self->{table_locks_immediate}) :
+        100;
+    $self->{table_lock_contention_now} = 
+        ($self->{delta_table_locks_waited} + $self->{delta_table_locks_immediate}) > 0 ?
+        100 * $self->{delta_table_locks_waited} / 
+        ($self->{delta_table_locks_waited} + $self->{delta_table_locks_immediate}) :
+        100;
+  } elsif ($params{mode} =~ /server::instance::tableindexusage/) {
+    # http://johnjacobm.wordpress.com/2007/06/
+    # formula for calculating the percentage of full table scans
+    ($dummy, $self->{handler_read_first}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Handler_read_first'
+    });
+    ($dummy, $self->{handler_read_key}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Handler_read_key'
+    });
+    ($dummy, $self->{handler_read_next}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Handler_read_next'
+    });
+    ($dummy, $self->{handler_read_prev}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Handler_read_prev'
+    });
+    ($dummy, $self->{handler_read_rnd}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Handler_read_rnd'
+    });
+    ($dummy, $self->{handler_read_rnd_next}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Handler_read_rnd_next'
+    });
+    $self->valdiff(\%params, qw(handler_read_first handler_read_key
+        handler_read_next handler_read_prev handler_read_rnd
+        handler_read_rnd_next));
+    my $delta_reads = $self->{delta_handler_read_first} +
+        $self->{delta_handler_read_key} +
+        $self->{delta_handler_read_next} +
+        $self->{delta_handler_read_prev} +
+        $self->{delta_handler_read_rnd} +
+        $self->{delta_handler_read_rnd_next};
+    my $reads = $self->{handler_read_first} +
+        $self->{handler_read_key} +
+        $self->{handler_read_next} +
+        $self->{handler_read_prev} +
+        $self->{handler_read_rnd} +
+        $self->{handler_read_rnd_next};
+    $self->{index_usage_now} = ($delta_reads == 0) ? 0 :
+        100 - (100.0 * ($self->{delta_handler_read_rnd} +
+        $self->{delta_handler_read_rnd_next}) /
+        $delta_reads);
+    $self->{index_usage} = ($reads == 0) ? 0 :
+        100 - (100.0 * ($self->{handler_read_rnd} +
+        $self->{handler_read_rnd_next}) /
+        $reads);
+  } elsif ($params{mode} =~ /server::instance::tabletmpondisk/) {
+    ($dummy, $self->{created_tmp_tables}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Created_tmp_tables'
+    });
+    ($dummy, $self->{created_tmp_disk_tables}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Created_tmp_disk_tables'
+    });
+    $self->valdiff(\%params, qw(created_tmp_tables created_tmp_disk_tables));
+    $self->{pct_tmp_on_disk} = $self->{created_tmp_tables} > 0 ?
+        100 * $self->{created_tmp_disk_tables} / $self->{created_tmp_tables} :
+        100;
+    $self->{pct_tmp_on_disk_now} = $self->{delta_created_tmp_tables} > 0 ?
+        100 * $self->{delta_created_tmp_disk_tables} / $self->{delta_created_tmp_tables} :
+        100;
+  } elsif ($params{mode} =~ /server::instance::openfiles/) {
+    ($dummy, $self->{open_files_limit}) = $self->{handle}->fetchrow_array(q{
+        SHOW VARIABLES LIKE 'open_files_limit'
+    });
+    ($dummy, $self->{open_files}) = $self->{handle}->fetchrow_array(q{
+        SHOW /*!50000 global */ STATUS LIKE 'Open_files'
+    });
+    $self->{pct_open_files} = 100 * $self->{open_files} / $self->{open_files_limit};
+  } elsif ($params{mode} =~ /server::instance::needoptimize/) {
+    $self->{fragmented} = [];
+    #http://www.electrictoolbox.com/optimize-tables-mysql-php/
+    my  @result = $self->{handle}->fetchall_array(q{
+        SHOW TABLE STATUS
+    });
+    foreach (@result) {
+      my ($name, $engine, $data_length, $data_free) =
+          ($_->[0], $_->[1], $_->[6 ], $_->[9]);
+      next if ($params{name} && $params{name} ne $name);
+      my $fragmentation = $data_length ? $data_free * 100 / $data_length : 0;
+      push(@{$self->{fragmented}},
+          [$name, $fragmentation, $data_length, $data_free]);
+    }
+  } elsif ($params{mode} =~ /server::instance::myisam/) {
+    $self->{engine_myisam} = DBD::MySQL::Server::Instance::MyISAM->new(
+        %params
+    );
+  } elsif ($params{mode} =~ /server::instance::innodb/) {
+    $self->{engine_innodb} = DBD::MySQL::Server::Instance::Innodb->new(
+        %params
+    );
+  } elsif ($params{mode} =~ /server::instance::replication/) {
+    $self->{replication} = DBD::MySQL::Server::Instance::Replication->new(
+        %params
+    );
+  }
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  if (! $self->{nagios_level}) {
+    if ($params{mode} =~ /server::instance::connectedthreads/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{threads_connected}, 10, 20),
+          sprintf "%d client connection threads", $self->{threads_connected});
+      $self->add_perfdata(sprintf "threads_connected=%d;%d;%d",
+          $self->{threads_connected},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::createdthreads/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{threads_created_per_sec}, 10, 20),
+          sprintf "%.2f threads created/sec", $self->{threads_created_per_sec});
+      $self->add_perfdata(sprintf "threads_created_per_sec=%.2f;%.2f;%.2f",
+          $self->{threads_created_per_sec},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::runningthreads/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{threads_running}, 10, 20),
+          sprintf "%d running threads", $self->{threads_running});
+      $self->add_perfdata(sprintf "threads_running=%d;%d;%d",
+          $self->{threads_running},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::cachedthreads/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{threads_cached}, 10, 20),
+          sprintf "%d cached threads", $self->{threads_cached});
+      $self->add_perfdata(sprintf "threads_cached=%d;%d;%d",
+          $self->{threads_cached},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::abortedconnects/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{connects_aborted_per_sec}, 1, 5),
+          sprintf "%.2f aborted connections/sec", $self->{connects_aborted_per_sec});
+      $self->add_perfdata(sprintf "connects_aborted_per_sec=%.2f;%.2f;%.2f",
+          $self->{connects_aborted_per_sec},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::abortedclients/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{clients_aborted_per_sec}, 1, 5),
+          sprintf "%.2f aborted (client died) connections/sec", $self->{clients_aborted_per_sec});
+      $self->add_perfdata(sprintf "clients_aborted_per_sec=%.2f;%.2f;%.2f",
+          $self->{clients_aborted_per_sec},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::threadcachehitrate/) {
+      my $refkey = 'threadcache_hitrate'.($params{lookback} ? '_now' : '');
+      $self->add_nagios(
+          $self->check_thresholds($self->{$refkey}, "90:", "80:"),
+          sprintf "thread cache hitrate %.2f%%", $self->{$refkey});
+      $self->add_perfdata(sprintf "thread_cache_hitrate=%.2f%%;%s;%s",
+          $self->{threadcache_hitrate},
+          $self->{warningrange}, $self->{criticalrange});
+      $self->add_perfdata(sprintf "thread_cache_hitrate_now=%.2f%%",
+          $self->{threadcache_hitrate_now});
+      $self->add_perfdata(sprintf "connections_per_sec=%.2f",
+          $self->{connections_per_sec});
+    } elsif ($params{mode} =~ /server::instance::querycachehitrate/) {
+      my $refkey = 'querycache_hitrate'.($params{lookback} ? '_now' : '');
+      if ((lc $self->{have_query_cache} eq 'yes') && ($self->{query_cache_size})) {
+        $self->add_nagios(
+            $self->check_thresholds($self->{$refkey}, "90:", "80:"),
+            sprintf "query cache hitrate %.2f%%", $self->{$refkey});
+      } else {
+        $self->check_thresholds($self->{$refkey}, "90:", "80:");
+        $self->add_nagios_ok(
+            sprintf "query cache hitrate %.2f%% (because it's turned off)",
+            $self->{querycache_hitrate});
+      }
+      $self->add_perfdata(sprintf "qcache_hitrate=%.2f%%;%s;%s",
+          $self->{querycache_hitrate},
+          $self->{warningrange}, $self->{criticalrange});
+      $self->add_perfdata(sprintf "qcache_hitrate_now=%.2f%%",
+          $self->{querycache_hitrate_now});
+      $self->add_perfdata(sprintf "selects_per_sec=%.2f",
+          $self->{selects_per_sec});
+    } elsif ($params{mode} =~ /server::instance::querycachelowmemprunes/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{lowmem_prunes_per_sec}, "1", "10"),
+          sprintf "%d query cache lowmem prunes in %d seconds (%.2f/sec)",
+          $self->{delta_lowmem_prunes}, $self->{delta_timestamp},
+          $self->{lowmem_prunes_per_sec});
+      $self->add_perfdata(sprintf "qcache_lowmem_prunes_rate=%.2f;%s;%s",
+          $self->{lowmem_prunes_per_sec},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::slowqueries/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{slow_queries_per_sec}, "0.1", "1"),
+          sprintf "%d slow queries in %d seconds (%.2f/sec)",
+          $self->{delta_slow_queries}, $self->{delta_timestamp},
+          $self->{slow_queries_per_sec});
+      $self->add_perfdata(sprintf "slow_queries_rate=%.2f%%;%s;%s",
+          $self->{slow_queries_per_sec},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::longprocs/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{longrunners}, 10, 20),
+          sprintf "%d long running processes", $self->{longrunners});
+      $self->add_perfdata(sprintf "long_running_procs=%d;%d;%d",
+          $self->{longrunners},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /server::instance::tablecachehitrate/) {
+      if ($self->{tablecache_fillrate} < 95) {
+        $self->add_nagios_ok(
+            sprintf "table cache hitrate %.2f%%, %.2f%% filled",
+                $self->{tablecache_hitrate},
+                $self->{tablecache_fillrate});
+        $self->check_thresholds($self->{tablecache_hitrate}, "99:", "95:");
+      } else {
+        $self->add_nagios(
+            $self->check_thresholds($self->{tablecache_hitrate}, "99:", "95:"),
+            sprintf "table cache hitrate %.2f%%", $self->{tablecache_hitrate});
+      }
+      $self->add_perfdata(sprintf "tablecache_hitrate=%.2f%%;%s;%s",
+          $self->{tablecache_hitrate},
+          $self->{warningrange}, $self->{criticalrange});
+      $self->add_perfdata(sprintf "tablecache_fillrate=%.2f%%",
+          $self->{tablecache_fillrate});
+    } elsif ($params{mode} =~ /server::instance::tablelockcontention/) {
+      my $refkey = 'table_lock_contention'.($params{lookback} ? '_now' : '');
+      if ($self->{uptime} > 10800) { # MySQL Bug #30599
+        $self->add_nagios(
+            $self->check_thresholds($self->{$refkey}, "1", "2"),
+                sprintf "table lock contention %.2f%%", $self->{$refkey});
+      } else {
+        $self->check_thresholds($self->{$refkey}, "1", "2");
+        $self->add_nagios_ok(
+            sprintf "table lock contention %.2f%% (uptime < 10800)",
+            $self->{$refkey});
+      }
+      $self->add_perfdata(sprintf "tablelock_contention=%.2f%%;%s;%s",
+          $self->{table_lock_contention},
+          $self->{warningrange}, $self->{criticalrange});
+      $self->add_perfdata(sprintf "tablelock_contention_now=%.2f%%",
+          $self->{table_lock_contention_now});
+    } elsif ($params{mode} =~ /server::instance::tableindexusage/) {
+      my $refkey = 'index_usage'.($params{lookback} ? '_now' : '');
+      $self->add_nagios(
+          $self->check_thresholds($self->{$refkey}, "90:", "80:"),
+              sprintf "index usage  %.2f%%", $self->{$refkey});
+      $self->add_perfdata(sprintf "index_usage=%.2f%%;%s;%s",
+          $self->{index_usage},
+          $self->{warningrange}, $self->{criticalrange});
+      $self->add_perfdata(sprintf "index_usage_now=%.2f%%",
+          $self->{index_usage_now});
+    } elsif ($params{mode} =~ /server::instance::tabletmpondisk/) {
+      my $refkey = 'pct_tmp_on_disk'.($params{lookback} ? '_now' : '');
+      $self->add_nagios(
+          $self->check_thresholds($self->{$refkey}, "25", "50"),
+              sprintf "%.2f%% of %d tables were created on disk",
+              $self->{$refkey}, $self->{delta_created_tmp_tables});
+      $self->add_perfdata(sprintf "pct_tmp_table_on_disk=%.2f%%;%s;%s",
+          $self->{pct_tmp_on_disk},
+          $self->{warningrange}, $self->{criticalrange});
+      $self->add_perfdata(sprintf "pct_tmp_table_on_disk_now=%.2f%%",
+          $self->{pct_tmp_on_disk_now});
+    } elsif ($params{mode} =~ /server::instance::openfiles/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{pct_open_files}, 80, 95),
+          sprintf "%.2f%% of the open files limit reached (%d of max. %d)",
+              $self->{pct_open_files},
+              $self->{open_files}, $self->{open_files_limit});
+      $self->add_perfdata(sprintf "pct_open_files=%.3f%%;%.3f;%.3f",
+          $self->{pct_open_files},
+          $self->{warningrange},
+          $self->{criticalrange});
+      $self->add_perfdata(sprintf "open_files=%d;%d;%d",
+          $self->{open_files},
+          $self->{open_files_limit} * $self->{warningrange} / 100,
+          $self->{open_files_limit} * $self->{criticalrange} / 100);
+    } elsif ($params{mode} =~ /server::instance::needoptimize/) {
+      foreach (@{$self->{fragmented}}) {
+        $self->add_nagios(
+            $self->check_thresholds($_->[1], 10, 25),
+            sprintf "table %s is %.2f%% fragmented", $_->[0], $_->[1]);
+        if ($params{name}) {
+          $self->add_perfdata(sprintf "'%s_frag'=%.2f%%;%d;%d",
+              $_->[0], $_->[1], $self->{warningrange}, $self->{criticalrange});
+        }
+      }
+    } elsif ($params{mode} =~ /server::instance::myisam/) {
+      $self->{engine_myisam}->nagios(%params);
+      $self->merge_nagios($self->{engine_myisam});
+    } elsif ($params{mode} =~ /server::instance::innodb/) {
+      $self->{engine_innodb}->nagios(%params);
+      $self->merge_nagios($self->{engine_innodb});
+    } elsif ($params{mode} =~ /server::instance::replication/) {
+      $self->{replication}->nagios(%params);
+      $self->merge_nagios($self->{replication});
+    }
+  }
+}
+
+
+
+package DBD::MySQL::Server;
+
+use strict;
+use Time::HiRes;
+use IO::File;
+use File::Copy 'cp';
+use Data::Dumper;
+
+
+{
+  our $verbose = 0;
+  our $scream = 0; # scream if something is not implemented
+  our $access = "dbi"; # how do we access the database. 
+  our $my_modules_dyn_dir = ""; # where we look for self-written extensions
+
+  my @servers = ();
+  my $initerrors = undef;
+
+  sub add_server {
+    push(@servers, shift);
+  }
+
+  sub return_servers {
+    return @servers;
+  }
+  
+  sub return_first_server() {
+    return $servers[0];
+  }
+
+}
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    access => $params{method} || 'dbi',
+    hostname => $params{hostname},
+    database => $params{database} || 'information_schema',
+    port => $params{port},
+    socket => $params{socket},
+    username => $params{username},
+    password => $params{password},
+    timeout => $params{timeout},
+    warningrange => $params{warningrange},
+    criticalrange => $params{criticalrange},
+    verbose => $params{verbose},
+    report => $params{report},
+    labelformat => $params{labelformat},
+    version => 'unknown',
+    instance => undef,
+    handle => undef,
+  };
+  bless $self, $class;
+  $self->init_nagios();
+  if ($self->dbconnect(%params)) {
+    ($self->{dummy}, $self->{version}) = $self->{handle}->fetchrow_array(
+        #q{ SHOW VARIABLES WHERE Variable_name = 'version' }
+        q{ SHOW VARIABLES LIKE 'version' }
+    );
+    $self->{version} = (split "-", $self->{version})[0];
+    ($self->{dummy}, $self->{uptime}) = $self->{handle}->fetchrow_array(
+        q{ SHOW STATUS LIKE 'Uptime' }
+    );
+    DBD::MySQL::Server::add_server($self);
+    $self->init(%params);
+  }
+  return $self;
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  $params{handle} = $self->{handle};
+  $params{uptime} = $self->{uptime};
+  $self->set_global_db_thresholds(\%params);
+  if ($params{mode} =~ /^server::instance/) {
+    $self->{instance} = DBD::MySQL::Server::Instance->new(%params);
+  } elsif ($params{mode} =~ /^server::sql/) {
+    $self->set_local_db_thresholds(%params);
+    if ($params{regexp}) {
+      # sql output is treated as text
+      if ($params{name2} eq $params{name}) {
+        $self->add_nagios_unknown(sprintf "where's the regexp????");
+      } else {
+        $self->{genericsql} =
+            $self->{handle}->fetchrow_array($params{selectname});
+        if (! defined $self->{genericsql}) {
+          $self->add_nagios_unknown(sprintf "got no valid response for %s",
+              $params{selectname});
+        }
+      }
+    } else {
+      # sql output must be a number (or array of numbers)
+      @{$self->{genericsql}} =
+          $self->{handle}->fetchrow_array($params{selectname});
+      if (! (defined $self->{genericsql} &&
+          (scalar(grep { /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)$/ } @{$self->{genericsql}})) == 
+          scalar(@{$self->{genericsql}}))) {
+        $self->add_nagios_unknown(sprintf "got no valid response for %s",
+            $params{selectname});
+      } else {
+        # name2 in array
+        # units in array
+      }
+    }
+  } elsif ($params{mode} =~ /^server::uptime/) {
+    # already set with the connection. but use minutes here
+  } elsif ($params{mode} =~ /^server::connectiontime/) {
+    $self->{connection_time} = $self->{tac} - $self->{tic};
+  } elsif ($params{mode} =~ /^my::([^:.]+)/) {
+    my $class = $1;
+    my $loaderror = undef;
+    substr($class, 0, 1) = uc substr($class, 0, 1);
+    foreach my $libpath (split(":", $DBD::MySQL::Server::my_modules_dyn_dir)) {
+      foreach my $extmod (glob $libpath."/CheckMySQLHealth*.pm") {
+        eval {
+          $self->trace(sprintf "loading module %s", $extmod);
+          require $extmod;
+        };
+        if ($@) {
+          $loaderror = $extmod;
+          $self->trace(sprintf "failed loading module %s: %s", $extmod, $@);
+        }
+      }
+    }
+    my $obj = {
+        handle => $params{handle},
+        warningrange => $params{warningrange},
+        criticalrange => $params{criticalrange},
+    };
+    bless $obj, "My$class";
+    $self->{my} = $obj;
+    if ($self->{my}->isa("DBD::MySQL::Server")) {
+      my $dos_init = $self->can("init");
+      my $dos_nagios = $self->can("nagios");
+      my $my_init = $self->{my}->can("init");
+      my $my_nagios = $self->{my}->can("nagios");
+      if ($my_init == $dos_init) {
+          $self->add_nagios_unknown(
+              sprintf "Class %s needs an init() method", ref($self->{my}));
+      } elsif ($my_nagios == $dos_nagios) {
+          $self->add_nagios_unknown(
+              sprintf "Class %s needs a nagios() method", ref($self->{my}));
+      } else {
+        $self->{my}->init_nagios(%params);
+        $self->{my}->init(%params);
+      }
+    } else {
+      $self->add_nagios_unknown(
+          sprintf "Class %s is not a subclass of DBD::MySQL::Server%s", 
+              ref($self->{my}),
+              $loaderror ? sprintf " (syntax error in %s?)", $loaderror : "" );
+    }
+  } else {
+    printf "broken mode %s\n", $params{mode};
+  }
+}
+
+sub dump {
+  my $self = shift;
+  my $message = shift || "";
+  printf "%s %s\n", $message, Data::Dumper::Dumper($self);
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  if (! $self->{nagios_level}) {
+    if ($params{mode} =~ /^server::instance/) {
+      $self->{instance}->nagios(%params);
+      $self->merge_nagios($self->{instance});
+    } elsif ($params{mode} =~ /^server::database/) {
+      $self->{database}->nagios(%params);
+      $self->merge_nagios($self->{database});
+    } elsif ($params{mode} =~ /^server::uptime/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{uptime} / 60, "10:", "5:"),
+          sprintf "database is up since %d minutes", $self->{uptime} / 60);
+      $self->add_perfdata(sprintf "uptime=%ds",
+          $self->{uptime});
+    } elsif ($params{mode} =~ /^server::connectiontime/) {
+      $self->add_nagios(
+          $self->check_thresholds($self->{connection_time}, 1, 5),
+          sprintf "%.2f seconds to connect as %s",
+              $self->{connection_time}, ($self->{username} || getpwuid($<)));
+      $self->add_perfdata(sprintf "connection_time=%.4fs;%d;%d",
+          $self->{connection_time},
+          $self->{warningrange}, $self->{criticalrange});
+    } elsif ($params{mode} =~ /^server::sql/) {
+      if ($params{regexp}) {
+        if (substr($params{name2}, 0, 1) eq '!') {
+          $params{name2} =~ s/^!//;
+          if ($self->{genericsql} !~ /$params{name2}/) {
+            $self->add_nagios_ok(
+                sprintf "output %s does not match pattern %s",
+                    $self->{genericsql}, $params{name2});
+          } else {
+            $self->add_nagios_critical(
+                sprintf "output %s matches pattern %s",
+                    $self->{genericsql}, $params{name2});
+          }
+        } else {
+          if ($self->{genericsql} =~ /$params{name2}/) {
+            $self->add_nagios_ok(
+                sprintf "output %s matches pattern %s",
+                    $self->{genericsql}, $params{name2});
+          } else {
+            $self->add_nagios_critical(
+                sprintf "output %s does not match pattern %s",
+                    $self->{genericsql}, $params{name2});
+          }
+        }
+      } else {
+        $self->add_nagios(
+            # the first item in the list will trigger the threshold values
+            $self->check_thresholds($self->{genericsql}[0], 1, 5),
+                sprintf "%s: %s%s",
+                $params{name2} ? lc $params{name2} : lc $params{selectname},
+                # float as float, integers as integers
+                join(" ", map {
+                    (sprintf("%d", $_) eq $_) ? $_ : sprintf("%f", $_)
+                } @{$self->{genericsql}}),
+                $params{units} ? $params{units} : "");
+        my $i = 0;
+        # workaround... getting the column names from the database would be nicer
+        my @names2_arr = split(/\s+/, $params{name2});
+        foreach my $t (@{$self->{genericsql}}) {
+          $self->add_perfdata(sprintf "\'%s\'=%s%s;%s;%s",
+              $names2_arr[$i] ? lc $names2_arr[$i] : lc $params{selectname},
+              # float as float, integers as integers
+              (sprintf("%d", $t) eq $t) ? $t : sprintf("%f", $t),
+              $params{units} ? $params{units} : "",
+            ($i == 0) ? $self->{warningrange} : "",
+              ($i == 0) ? $self->{criticalrange} : ""
+          );
+          $i++;
+        }
+      }
+    } elsif ($params{mode} =~ /^my::([^:.]+)/) {
+      $self->{my}->nagios(%params);
+      $self->merge_nagios($self->{my});
+    }
+  }
+}
+
+
+sub init_nagios {
+  my $self = shift;
+  no strict 'refs';
+  if (! ref($self)) {
+    my $nagiosvar = $self."::nagios";
+    my $nagioslevelvar = $self."::nagios_level";
+    $$nagiosvar = {
+      messages => {
+        0 => [],
+        1 => [],
+        2 => [],
+        3 => [],
+      },
+      perfdata => [],
+    };
+    $$nagioslevelvar = $ERRORS{OK},
+  } else {
+    $self->{nagios} = {
+      messages => {
+        0 => [],
+        1 => [],
+        2 => [],
+        3 => [],
+      },
+      perfdata => [],
+    };
+    $self->{nagios_level} = $ERRORS{OK},
+  }
+}
+
+sub check_thresholds {
+  my $self = shift;
+  my $value = shift;
+  my $defaultwarningrange = shift;
+  my $defaultcriticalrange = shift;
+  my $level = $ERRORS{OK};
+  $self->{warningrange} = defined $self->{warningrange} ?
+      $self->{warningrange} : $defaultwarningrange;
+  $self->{criticalrange} = defined $self->{criticalrange} ?
+      $self->{criticalrange} : $defaultcriticalrange;
+  if ($self->{warningrange} !~ /:/ && $self->{criticalrange} !~ /:/) {
+    # warning = 10, critical = 20, warn if > 10, crit if > 20
+    $level = $ERRORS{WARNING} if $value > $self->{warningrange};
+    $level = $ERRORS{CRITICAL} if $value > $self->{criticalrange};
+  } elsif ($self->{warningrange} =~ /([\d\.]+):/ && 
+      $self->{criticalrange} =~ /([\d\.]+):/) {
+    # warning = 98:, critical = 95:, warn if < 98, crit if < 95
+    $self->{warningrange} =~ /([\d\.]+):/;
+    $level = $ERRORS{WARNING} if $value < $1;
+    $self->{criticalrange} =~ /([\d\.]+):/;
+    $level = $ERRORS{CRITICAL} if $value < $1;
+  }
+  return $level;
+  #
+  # syntax error must be reported with returncode -1
+  #
+}
+
+sub add_nagios {
+  my $self = shift;
+  my $level = shift;
+  my $message = shift;
+  push(@{$self->{nagios}->{messages}->{$level}}, $message);
+  # recalc current level
+  foreach my $llevel qw(CRITICAL WARNING UNKNOWN OK) {
+    if (scalar(@{$self->{nagios}->{messages}->{$ERRORS{$llevel}}})) {
+      $self->{nagios_level} = $ERRORS{$llevel};
+    }
+  }
+}
+
+sub add_nagios_ok {
+  my $self = shift;
+  my $message = shift;
+  $self->add_nagios($ERRORS{OK}, $message);
+}
+
+sub add_nagios_warning {
+  my $self = shift;
+  my $message = shift;
+  $self->add_nagios($ERRORS{WARNING}, $message);
+}
+
+sub add_nagios_critical {
+  my $self = shift;
+  my $message = shift;
+  $self->add_nagios($ERRORS{CRITICAL}, $message);
+}
+
+sub add_nagios_unknown {
+  my $self = shift;
+  my $message = shift;
+  $self->add_nagios($ERRORS{UNKNOWN}, $message);
+}
+
+sub add_perfdata {
+  my $self = shift;
+  my $data = shift;
+  push(@{$self->{nagios}->{perfdata}}, $data);
+}
+
+sub merge_nagios {
+  my $self = shift;
+  my $child = shift;
+  foreach my $level (0..3) {
+    foreach (@{$child->{nagios}->{messages}->{$level}}) {
+      $self->add_nagios($level, $_);
+    }
+    #push(@{$self->{nagios}->{messages}->{$level}},
+    #    @{$child->{nagios}->{messages}->{$level}});
+  }
+  push(@{$self->{nagios}->{perfdata}}, @{$child->{nagios}->{perfdata}});
+}
+
+sub calculate_result {
+  my $self = shift;
+  my $labels = shift || {};
+  my $multiline = 0;
+  map {
+    $self->{nagios_level} = $ERRORS{$_} if
+        (scalar(@{$self->{nagios}->{messages}->{$ERRORS{$_}}}));
+  } ("OK", "UNKNOWN", "WARNING", "CRITICAL");
+  if ($ENV{NRPE_MULTILINESUPPORT} &&
+      length join(" ", @{$self->{nagios}->{perfdata}}) > 200) {
+    $multiline = 1;
+  }
+  my $all_messages = join(($multiline ? "\n" : ", "), map {
+      join(($multiline ? "\n" : ", "), @{$self->{nagios}->{messages}->{$ERRORS{$_}}})
+  } grep {
+      scalar(@{$self->{nagios}->{messages}->{$ERRORS{$_}}})
+  } ("CRITICAL", "WARNING", "UNKNOWN", "OK"));
+  my $bad_messages = join(($multiline ? "\n" : ", "), map {
+      join(($multiline ? "\n" : ", "), @{$self->{nagios}->{messages}->{$ERRORS{$_}}})
+  } grep {
+      scalar(@{$self->{nagios}->{messages}->{$ERRORS{$_}}})
+  } ("CRITICAL", "WARNING", "UNKNOWN"));
+  my $all_messages_short = $bad_messages ? $bad_messages : 'no problems';
+  my $all_messages_html = "<table style=\"border-collapse: collapse;\">".
+      join("", map {
+          my $level = $_;
+          join("", map {
+              sprintf "<tr valign=\"top\"><td class=\"service%s\">%s</td></tr>",
+              $level, $_;
+          } @{$self->{nagios}->{messages}->{$ERRORS{$_}}});
+      } grep {
+          scalar(@{$self->{nagios}->{messages}->{$ERRORS{$_}}})
+      } ("CRITICAL", "WARNING", "UNKNOWN", "OK")).
+  "</table>";
+  if (exists $self->{identstring}) {
+    $self->{nagios_message} .= $self->{identstring};
+  }
+  if ($self->{report} eq "long") {
+    $self->{nagios_message} .= $all_messages;
+  } elsif ($self->{report} eq "short") {
+    $self->{nagios_message} .= $all_messages_short;
+  } elsif ($self->{report} eq "html") {
+    $self->{nagios_message} .= $all_messages_short."\n".$all_messages_html;
+  }
+  if ($self->{labelformat} eq "pnp4nagios") {
+    $self->{perfdata} = join(" ", @{$self->{nagios}->{perfdata}});
+  } else {
+    $self->{perfdata} = join(" ", map {
+        my $perfdata = $_;
+        if ($perfdata =~ /^(.*?)=(.*)/) {
+          my $label = $1;
+          my $data = $2;
+          if (exists $labels->{$label} &&
+              exists $labels->{$label}->{$self->{labelformat}}) {
+            $labels->{$label}->{$self->{labelformat}}."=".$data;
+          } else {
+            $perfdata;
+          }
+        } else {
+          $perfdata;
+        }
+    } @{$self->{nagios}->{perfdata}});
+  }
+}
+
+sub set_global_db_thresholds {
+  my $self = shift;
+  my $params = shift;
+  my $warning = undef;
+  my $critical = undef;
+  return unless defined $params->{dbthresholds};
+  $params->{name0} = $params->{dbthresholds};
+  # :pluginmode   :name     :warning    :critical
+  # mode          empty     
+  # 
+  eval {
+    if ($self->{handle}->fetchrow_array(q{
+        SELECT table_name
+        FROM information_schema.tables
+        WHERE table_schema = ?
+        AND table_name = 'CHECK_MYSQL_HEALTH_THRESHOLDS';
+      }, $self->{database})) { # either --database... or information_schema
+      my @dbthresholds = $self->{handle}->fetchall_array(q{
+          SELECT * FROM check_mysql_health_thresholds
+      });
+      $params->{dbthresholds} = \@dbthresholds;
+      foreach (@dbthresholds) { 
+        if (($_->[0] eq $params->{cmdlinemode}) &&
+            (! defined $_->[1] || ! $_->[1])) {
+          ($warning, $critical) = ($_->[2], $_->[3]);
+        }
+      }
+    }
+  };
+  if (! $@) {
+    if ($warning) {
+      $params->{warningrange} = $warning;
+      $self->trace("read warningthreshold %s from database", $warning);
+    }
+    if ($critical) {
+      $params->{criticalrange} = $critical;
+      $self->trace("read criticalthreshold %s from database", $critical);
+    }
+  }
+}
+
+sub set_local_db_thresholds {
+  my $self = shift;
+  my %params = @_;
+  my $warning = undef;
+  my $critical = undef;
+  # :pluginmode   :name     :warning    :critical
+  # mode          name0
+  # mode          name2
+  # mode          name
+  #
+  # first: argument of --dbthresholds, it it exists
+  # second: --name2
+  # third: --name
+  if (ref($params{dbthresholds}) eq 'ARRAY') {
+    my $marker;
+    foreach (@{$params{dbthresholds}}) {
+      if ($_->[0] eq $params{cmdlinemode}) {
+        if (defined $_->[1] && $params{name0} && $_->[1] eq $params{name0}) {
+          ($warning, $critical) = ($_->[2], $_->[3]);
+          $marker = $params{name0};
+          last;
+        } elsif (defined $_->[1] && $params{name2} && $_->[1] eq $params{name2}) {
+          ($warning, $critical) = ($_->[2], $_->[3]);
+          $marker = $params{name2};
+          last;
+        } elsif (defined $_->[1] && $params{name} && $_->[1] eq $params{name}) {
+          ($warning, $critical) = ($_->[2], $_->[3]);
+          $marker = $params{name};
+          last;
+        }
+      }
+    }
+    if ($warning) {
+      $self->{warningrange} = $warning;
+      $self->trace("read warningthreshold %s for %s from database",
+         $marker, $warning);
+    }
+    if ($critical) {
+      $self->{criticalrange} = $critical;
+      $self->trace("read criticalthreshold %s for %s from database",
+          $marker, $critical);
+    }
+  }
+}
+
+sub debug {
+  my $self = shift;
+  my $msg = shift;
+  if ($DBD::MySQL::Server::verbose) {
+    printf "%s %s\n", $msg, ref($self);
+  }
+}
+
+sub dbconnect {
+  my $self = shift;
+  my %params = @_;
+  my $retval = undef;
+  $self->{tic} = Time::HiRes::time();
+  $self->{handle} = DBD::MySQL::Server::Connection->new(%params);
+  if ($self->{handle}->{errstr}) {
+    if ($params{mode} =~ /^server::tnsping/ &&
+        $self->{handle}->{errstr} =~ /ORA-01017/) {
+      $self->add_nagios($ERRORS{OK},
+          sprintf "connection established to %s.", $self->{connect});
+      $retval = undef;
+    } elsif ($self->{handle}->{errstr} eq "alarm\n") {
+      $self->add_nagios($ERRORS{CRITICAL},
+          sprintf "connection could not be established within %d seconds",
+              $self->{timeout});
+    } else {
+      $self->add_nagios($ERRORS{CRITICAL},
+          sprintf "cannot connect to %s. %s",
+          $self->{database}, $self->{handle}->{errstr});
+      $retval = undef;
+    }
+  } else {
+    $retval = $self->{handle};
+  }
+  $self->{tac} = Time::HiRes::time();
+  return $retval;
+}
+
+sub trace {
+  my $self = shift;
+  my $format = shift;
+  $self->{trace} = -f "/tmp/check_mysql_health.trace" ? 1 : 0;
+  if ($self->{verbose}) {
+    printf("%s: ", scalar localtime);
+    printf($format, @_);
+  }
+  if ($self->{trace}) {
+    my $logfh = new IO::File;
+    $logfh->autoflush(1);
+    if ($logfh->open("/tmp/check_mysql_health.trace", "a")) {
+      $logfh->printf("%s: ", scalar localtime);
+      $logfh->printf($format, @_);
+      $logfh->printf("\n");
+      $logfh->close();
+    }
+  }
+}
+
+sub DESTROY {
+  my $self = shift;
+  my $handle1 = "null";
+  my $handle2 = "null";
+  if (defined $self->{handle}) {
+    $handle1 = ref($self->{handle});
+    if (defined $self->{handle}->{handle}) {
+      $handle2 = ref($self->{handle}->{handle});
+    }
+  }
+  $self->trace(sprintf "DESTROY %s with handle %s %s", ref($self), $handle1, $handle2);
+  if (ref($self) eq "DBD::MySQL::Server") {
+  }
+  $self->trace(sprintf "DESTROY %s exit with handle %s %s", ref($self), $handle1, $handle2);
+  if (ref($self) eq "DBD::MySQL::Server") {
+    #printf "humpftata\n";
+  }
+}
+
+sub save_state {
+  my $self = shift;
+  my %params = @_;
+  my $extension = "";
+  my $mode = $params{mode};
+  if ($params{connect} && $params{connect} =~ /(\w+)\/(\w+)@(\w+)/) {
+    $params{connect} = $3;
+  } elsif ($params{connect}) {
+    # just to be sure
+    $params{connect} =~ s/\//_/g;
+  }
+  if ($^O =~ /MSWin/) {
+    $mode =~ s/::/_/g;
+    $params{statefilesdir} = $self->system_vartmpdir();
+  }
+  if (! -d $params{statefilesdir}) {
+    eval {
+      use File::Path;
+      mkpath $params{statefilesdir};
+    };
+  }
+  if ($@ || ! -w $params{statefilesdir}) {
+    $self->add_nagios($ERRORS{CRITICAL},
+        sprintf "statefilesdir %s does not exist or is not writable\n",
+        $params{statefilesdir});
+    return;
+  }
+  my $statefile = sprintf "%s_%s", $params{hostname}, $mode;
+  $extension .= $params{differenciator} ? "_".$params{differenciator} : "";
+  $extension .= $params{socket} ? "_".$params{socket} : "";
+  $extension .= $params{port} ? "_".$params{port} : "";
+  $extension .= $params{database} ? "_".$params{database} : "";
+  $extension .= $params{tablespace} ? "_".$params{tablespace} : "";
+  $extension .= $params{datafile} ? "_".$params{datafile} : "";
+  $extension .= $params{name} ? "_".$params{name} : "";
+  $extension =~ s/\//_/g;
+  $extension =~ s/\(/_/g;
+  $extension =~ s/\)/_/g;
+  $extension =~ s/\*/_/g;
+  $extension =~ s/\s/_/g;
+  $statefile .= $extension;
+  $statefile = lc $statefile;
+  $statefile = sprintf "%s/%s", $params{statefilesdir}, $statefile;
+  if (open(STATE, ">$statefile")) {
+    if ((ref($params{save}) eq "HASH") && exists $params{save}->{timestamp}) {
+      $params{save}->{localtime} = scalar localtime $params{save}->{timestamp};
+    }
+    printf STATE Data::Dumper::Dumper($params{save});
+    close STATE;
+  } else { 
+    $self->add_nagios($ERRORS{CRITICAL},
+        sprintf "statefile %s is not writable", $statefile);
+  }
+  $self->debug(sprintf "saved %s to %s",
+      Data::Dumper::Dumper($params{save}), $statefile);
+}
+
+sub load_state {
+  my $self = shift;
+  my %params = @_;
+  my $extension = "";
+  my $mode = $params{mode};
+  if ($params{connect} && $params{connect} =~ /(\w+)\/(\w+)@(\w+)/) {
+    $params{connect} = $3;
+  } elsif ($params{connect}) {
+    # just to be sure
+    $params{connect} =~ s/\//_/g;
+  }
+  if ($^O =~ /MSWin/) {
+    $mode =~ s/::/_/g;
+    $params{statefilesdir} = $self->system_vartmpdir();
+  }
+  my $statefile = sprintf "%s_%s", $params{hostname}, $mode;
+  $extension .= $params{differenciator} ? "_".$params{differenciator} : "";
+  $extension .= $params{socket} ? "_".$params{socket} : "";
+  $extension .= $params{port} ? "_".$params{port} : "";
+  $extension .= $params{database} ? "_".$params{database} : "";
+  $extension .= $params{tablespace} ? "_".$params{tablespace} : "";
+  $extension .= $params{datafile} ? "_".$params{datafile} : "";
+  $extension .= $params{name} ? "_".$params{name} : "";
+  $extension =~ s/\//_/g;
+  $extension =~ s/\(/_/g;
+  $extension =~ s/\)/_/g;
+  $extension =~ s/\*/_/g;
+  $extension =~ s/\s/_/g;
+  $statefile .= $extension;
+  $statefile = lc $statefile;
+  $statefile = sprintf "%s/%s", $params{statefilesdir}, $statefile;
+  if ( -f $statefile) {
+    our $VAR1;
+    eval {
+      require $statefile;
+    };
+    if($@) {
+      $self->add_nagios($ERRORS{CRITICAL},
+          sprintf "statefile %s is corrupt", $statefile);
+    }
+    $self->debug(sprintf "load %s", Data::Dumper::Dumper($VAR1));
+    return $VAR1;
+  } else {
+    return undef;
+  }
+}
+
+sub valdiff {
+  my $self = shift;
+  my $pparams = shift;
+  my %params = %{$pparams};
+  my @keys = @_;
+  my $now = time;
+  my $last_values = $self->load_state(%params) || eval {
+    my $empty_events = {};
+    foreach (@keys) {
+      $empty_events->{$_} = 0;
+    }
+    $empty_events->{timestamp} = 0;
+    if ($params{lookback}) {
+      $empty_events->{lookback_history} = {};
+    }
+    $empty_events;
+  };
+  foreach (@keys) {
+    if ($params{lookback}) {
+      # find a last_value in the history which fits lookback best
+      # and overwrite $last_values->{$_} with historic data
+      if (exists $last_values->{lookback_history}->{$_}) {
+        foreach my $date (sort {$a <=> $b} keys %{$last_values->{lookback_history}->{$_}}) {
+          if ($date >= ($now - $params{lookback})) {
+            $last_values->{$_} = $last_values->{lookback_history}->{$_}->{$date};
+            $last_values->{timestamp} = $date;
+            last;
+          } else {
+            delete $last_values->{lookback_history}->{$_}->{$date};
+          }
+        }
+      }
+    }
+    $last_values->{$_} = 0 if ! exists $last_values->{$_};
+    if ($self->{$_} >= $last_values->{$_}) {
+      $self->{'delta_'.$_} = $self->{$_} - $last_values->{$_};
+    } else {
+      # vermutlich db restart und zaehler alle auf null
+      $self->{'delta_'.$_} = $self->{$_};
+    }
+    $self->debug(sprintf "delta_%s %f", $_, $self->{'delta_'.$_});
+  }
+  $self->{'delta_timestamp'} = $now - $last_values->{timestamp};
+  $params{save} = eval {
+    my $empty_events = {};
+    foreach (@keys) {
+      $empty_events->{$_} = $self->{$_};
+    }
+    $empty_events->{timestamp} = $now;
+    if ($params{lookback}) {
+      $empty_events->{lookback_history} = $last_values->{lookback_history};
+      foreach (@keys) {
+        $empty_events->{lookback_history}->{$_}->{$now} = $self->{$_};
+      }
+    }
+    $empty_events;
+  };
+  $self->save_state(%params);
+}
+
+sub requires_version {
+  my $self = shift;
+  my $version = shift;
+  my @instances = DBD::MySQL::Server::return_servers();
+  my $instversion = $instances[0]->{version};
+  if (! $self->version_is_minimum($version)) {
+    $self->add_nagios($ERRORS{UNKNOWN}, 
+        sprintf "not implemented/possible for MySQL release %s", $instversion);
+  }
+}
+
+sub version_is_minimum {
+  # the current version is newer or equal
+  my $self = shift;
+  my $version = shift;
+  my $newer = 1;
+  my @instances = DBD::MySQL::Server::return_servers();
+  my @v1 = map { $_ eq "x" ? 0 : $_ } split(/\./, $version);
+  my @v2 = split(/\./, $instances[0]->{version});
+  if (scalar(@v1) > scalar(@v2)) {
+    push(@v2, (0) x (scalar(@v1) - scalar(@v2)));
+  } elsif (scalar(@v2) > scalar(@v1)) {
+    push(@v1, (0) x (scalar(@v2) - scalar(@v1)));
+  }
+  foreach my $pos (0..$#v1) {
+    if ($v2[$pos] > $v1[$pos]) {
+      $newer = 1;
+      last;
+    } elsif ($v2[$pos] < $v1[$pos]) {
+      $newer = 0;
+      last;
+    }
+  }
+  #printf STDERR "check if %s os minimum %s\n", join(".", @v2), join(".", @v1);
+  return $newer;
+}
+
+sub instance_thread {
+  my $self = shift;
+  my @instances = DBD::MySQL::Server::return_servers();
+  return $instances[0]->{thread};
+}
+
+sub windows_server {
+  my $self = shift;
+  my @instances = DBD::MySQL::Server::return_servers();
+  if ($instances[0]->{os} =~ /Win/i) {
+    return 1;
+  } else {
+    return 0;
+  }
+}
+
+sub system_vartmpdir {
+  my $self = shift;
+  if ($^O =~ /MSWin/) {
+    return $self->system_tmpdir();
+  } else {
+    return "/var/tmp/check_mysql_health";
+  }
+}
+
+sub system_oldvartmpdir {
+  my $self = shift;
+  return "/tmp";
+}
+
+sub system_tmpdir {
+  my $self = shift;
+  if ($^O =~ /MSWin/) {
+    return $ENV{TEMP} if defined $ENV{TEMP};
+    return $ENV{TMP} if defined $ENV{TMP};
+    return File::Spec->catfile($ENV{windir}, 'Temp')
+        if defined $ENV{windir};
+    return 'C:\Temp';
+  } else {
+    return "/tmp";
+  }
+}
+
+
+package DBD::MySQL::Server::Connection;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Server);
+
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    mode => $params{mode},
+    timeout => $params{timeout},
+    access => $params{method} || "dbi",
+    hostname => $params{hostname},
+    database => $params{database} || "information_schema",
+    port => $params{port},
+    socket => $params{socket},
+    username => $params{username},
+    password => $params{password},
+    handle => undef,
+  };
+  bless $self, $class;
+  if ($params{method} eq "dbi") {
+    bless $self, "DBD::MySQL::Server::Connection::Dbi";
+  } elsif ($params{method} eq "mysql") {
+    bless $self, "DBD::MySQL::Server::Connection::Mysql";
+  } elsif ($params{method} eq "sqlrelay") {
+    bless $self, "DBD::MySQL::Server::Connection::Sqlrelay";
+  }
+  $self->init(%params);
+  return $self;
+}
+
+
+package DBD::MySQL::Server::Connection::Dbi;
+
+use strict;
+use Net::Ping;
+
+our @ISA = qw(DBD::MySQL::Server::Connection);
+
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  my $retval = undef;
+  if ($self->{mode} =~ /^server::tnsping/) {
+    if (! $self->{connect}) {
+      $self->{errstr} = "Please specify a database";
+    } else {
+      $self->{sid} = $self->{connect};
+      $self->{username} ||= time;  # prefer an existing user
+      $self->{password} = time;
+    }
+  } else {
+    if (($self->{hostname} ne 'localhost') && (! $self->{username} || ! $self->{password})) {
+      $self->{errstr} = "Please specify hostname, username and password";
+      return undef;
+    }
+    $self->{dsn} = "DBI:mysql:";
+    $self->{dsn} .= sprintf "database=%s", $self->{database};
+    $self->{dsn} .= sprintf ";host=%s", $self->{hostname};
+    $self->{dsn} .= sprintf ";port=%s", $self->{port}
+        unless $self->{socket} || $self->{hostname} eq 'localhost';
+    $self->{dsn} .= sprintf ";mysql_socket=%s", $self->{socket} 
+        if $self->{socket};
+  }
+  if (! exists $self->{errstr}) {
+    eval {
+      require DBI;
+      use POSIX ':signal_h';
+      local $SIG{'ALRM'} = sub {
+        die "alarm\n";
+      };
+      my $mask = POSIX::SigSet->new( SIGALRM );
+      my $action = POSIX::SigAction->new(
+          sub { die "alarm\n" ; }, $mask);
+      my $oldaction = POSIX::SigAction->new();
+      sigaction(SIGALRM ,$action ,$oldaction );
+      alarm($self->{timeout} - 1); # 1 second before the global unknown timeout
+      if ($self->{handle} = DBI->connect(
+          $self->{dsn},
+          $self->{username},
+          $self->{password},
+          { RaiseError => 0, AutoCommit => 0, PrintError => 0 })) {
+#        $self->{handle}->do(q{
+#            ALTER SESSION SET NLS_NUMERIC_CHARACTERS=".," });
+        $retval = $self;
+      } else {
+        $self->{errstr} = DBI::errstr();
+      }
+    };
+    if ($@) {
+      $self->{errstr} = $@;
+      $retval = undef;
+    }
+  }
+  $self->{tac} = Time::HiRes::time();
+  return $retval;
+}
+
+sub selectrow_hashref {
+  my $self = shift;
+  my $sql = shift;
+  my @arguments = @_;
+  my $sth = undef;
+  my $hashref = undef;
+  eval {
+    $self->trace(sprintf "SQL:\n%s\nARGS:\n%s\n",
+        $sql, Data::Dumper::Dumper(\@arguments));
+    # helm auf! jetzt wirds dreckig.
+    if ($sql =~ /^\s*SHOW/) {
+      $hashref = $self->{handle}->selectrow_hashref($sql);
+    } else {
+      $sth = $self->{handle}->prepare($sql);
+      if (scalar(@arguments)) {
+        $sth->execute(@arguments);
+      } else {
+        $sth->execute();
+      }
+      $hashref = $sth->selectrow_hashref();
+    }
+    $self->trace(sprintf "RESULT:\n%s\n",
+        Data::Dumper::Dumper($hashref));
+  };
+  if ($@) {
+    $self->debug(sprintf "bumm %s", $@);
+  }
+  if (-f "/tmp/check_mysql_health_simulation/".$self->{mode}) {
+    my $simulation = do { local (@ARGV, $/) =
+        "/tmp/check_mysql_health_simulation/".$self->{mode}; <> };
+    # keine lust auf den scheiss
+  }
+  return $hashref;
+}
+
+sub fetchrow_array {
+  my $self = shift;
+  my $sql = shift;
+  my @arguments = @_;
+  my $sth = undef;
+  my @row = ();
+  eval {
+    $self->trace(sprintf "SQL:\n%s\nARGS:\n%s\n",
+        $sql, Data::Dumper::Dumper(\@arguments));
+    $sth = $self->{handle}->prepare($sql);
+    if (scalar(@arguments)) {
+      $sth->execute(@arguments);
+    } else {
+      $sth->execute();
+    }
+    @row = $sth->fetchrow_array();
+    $self->trace(sprintf "RESULT:\n%s\n",
+        Data::Dumper::Dumper(\@row));
+  }; 
+  if ($@) {
+    $self->debug(sprintf "bumm %s", $@);
+  }
+  if (-f "/tmp/check_mysql_health_simulation/".$self->{mode}) {
+    my $simulation = do { local (@ARGV, $/) = 
+        "/tmp/check_mysql_health_simulation/".$self->{mode}; <> };
+    @row = split(/\s+/, (split(/\n/, $simulation))[0]);
+  }
+  return $row[0] unless wantarray;
+  return @row;
+}
+
+sub fetchall_array {
+  my $self = shift;
+  my $sql = shift;
+  my @arguments = @_;
+  my $sth = undef;
+  my $rows = undef;
+  eval {
+    $self->trace(sprintf "SQL:\n%s\nARGS:\n%s\n",
+        $sql, Data::Dumper::Dumper(\@arguments));
+    $sth = $self->{handle}->prepare($sql);
+    if (scalar(@arguments)) {
+      $sth->execute(@arguments);
+    } else {
+      $sth->execute();
+    }
+    $rows = $sth->fetchall_arrayref();
+    $self->trace(sprintf "RESULT:\n%s\n",
+        Data::Dumper::Dumper($rows));
+  }; 
+  if ($@) {
+    printf STDERR "bumm %s\n", $@;
+  }
+  if (-f "/tmp/check_mysql_health_simulation/".$self->{mode}) {
+    my $simulation = do { local (@ARGV, $/) = 
+        "/tmp/check_mysql_health_simulation/".$self->{mode}; <> };
+    @{$rows} = map { [ split(/\s+/, $_) ] } split(/\n/, $simulation);
+  }
+  return @{$rows};
+}
+
+sub func {
+  my $self = shift;
+  $self->{handle}->func(@_);
+}
+
+
+sub execute {
+  my $self = shift;
+  my $sql = shift;
+  eval {
+    my $sth = $self->{handle}->prepare($sql);
+    $sth->execute();
+  };
+  if ($@) {
+    printf STDERR "bumm %s\n", $@;
+  }
+}
+
+sub errstr {
+  my $self = shift;
+  return $self->{errstr};
+}
+
+sub DESTROY {
+  my $self = shift;
+  $self->trace(sprintf "disconnecting DBD %s",
+      $self->{handle} ? "with handle" : "without handle");
+  $self->{handle}->disconnect() if $self->{handle};
+}
+
+package DBD::MySQL::Server::Connection::Mysql;
+
+use strict;
+use File::Temp qw/tempfile/;
+
+our @ISA = qw(DBD::MySQL::Server::Connection);
+
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  my $retval = undef;
+  $self->{loginstring} = "traditional";
+  ($self->{sql_commandfile_handle}, $self->{sql_commandfile}) =
+      tempfile($self->{mode}."XXXXX", SUFFIX => ".sql", 
+      DIR => $self->system_tmpdir() );
+  close $self->{sql_commandfile_handle};
+  ($self->{sql_resultfile_handle}, $self->{sql_resultfile}) =
+      tempfile($self->{mode}."XXXXX", SUFFIX => ".out", 
+      DIR => $self->system_tmpdir() );
+  close $self->{sql_resultfile_handle};
+  if ($self->{mode} =~ /^server::tnsping/) {
+    if (! $self->{connect}) {
+      $self->{errstr} = "Please specify a database";
+    } else {
+      $self->{sid} = $self->{connect};
+      $self->{username} ||= time;  # prefer an existing user
+      $self->{password} = time;
+    }
+  } else {
+    if (! $self->{username} || ! $self->{password}) {
+      $self->{errstr} = "Please specify database, username and password";
+      return undef;
+    } elsif (! (($self->{hostname} && $self->{port}) || $self->{socket})) {
+      $self->{errstr} = "Please specify hostname and port or socket";
+      return undef;
+    }
+  }
+  if (! exists $self->{errstr}) {
+    eval {
+      my $mysql = '/'.'usr'.'/'.'bin'.'/'.'mysql';
+      if (! -x $mysql) {
+        die "nomysql\n";
+      }
+      if ($self->{loginstring} eq "traditional") {
+        $self->{sqlplus} = sprintf "%s ", $mysql;
+        $self->{sqlplus} .= sprintf "--batch --raw --skip-column-names ";
+        $self->{sqlplus} .= sprintf "--database=%s ", $self->{database};
+        $self->{sqlplus} .= sprintf "--host=%s ", $self->{hostname};
+        $self->{sqlplus} .= sprintf "--port=%s ", $self->{port}
+            unless $self->{socket} || $self->{hostname} eq "localhost";
+        $self->{sqlplus} .= sprintf "--socket=%s ", $self->{socket}
+            if $self->{socket};
+        $self->{sqlplus} .= sprintf "--user=%s --password=%s < %s > %s",
+            $self->{username}, $self->{password},
+            $self->{sql_commandfile}, $self->{sql_resultfile};
+      }
+  
+      use POSIX ':signal_h';
+      local $SIG{'ALRM'} = sub {
+        die "alarm\n";
+      };
+      my $mask = POSIX::SigSet->new( SIGALRM );
+      my $action = POSIX::SigAction->new(
+          sub { die "alarm\n" ; }, $mask);
+      my $oldaction = POSIX::SigAction->new();
+      sigaction(SIGALRM ,$action ,$oldaction );
+      alarm($self->{timeout} - 1); # 1 second before the global unknown timeout
+  
+      my $answer = $self->fetchrow_array(
+          q{ SELECT 42 FROM dual});
+      die unless defined $answer and $answer == 42;
+      $retval = $self;
+    };
+    if ($@) {
+      $self->{errstr} = $@;
+      $self->{errstr} =~ s/at $0 .*//g;
+      chomp $self->{errstr};
+      $retval = undef;
+    }
+  }
+  $self->{tac} = Time::HiRes::time();
+  return $retval;
+}
+
+sub selectrow_hashref {
+  my $self = shift;
+  my $sql = shift;
+  my @arguments = @_;
+  my $sth = undef;
+  my $hashref = undef;
+  foreach (@arguments) {
+    # replace the ? by the parameters
+    if (/^\d+$/) {
+      $sql =~ s/\?/$_/;
+    } else {
+      $sql =~ s/\?/'$_'/;
+    }
+  }
+  if ($sql =~ /^\s*SHOW/) {
+    $sql .= '\G'; # http://dev.mysql.com/doc/refman/5.1/de/show-slave-status.html
+  }
+  $self->trace(sprintf "SQL (? resolved):\n%s\nARGS:\n%s\n",
+      $sql, Data::Dumper::Dumper(\@arguments));
+  $self->create_commandfile($sql);
+  my $exit_output = `$self->{sqlplus}`;
+  if ($?) {
+    printf STDERR "fetchrow_array exit bumm \n";
+    my $output = do { local (@ARGV, $/) = $self->{sql_resultfile}; <> };
+    my @oerrs = map {
+      /((ERROR \d+).*)/ ? $1 : ();
+    } split(/\n/, $output);
+    $self->{errstr} = join(" ", @oerrs);
+  } else {
+    my $output = do { local (@ARGV, $/) = $self->{sql_resultfile}; <> };
+    if ($sql =~ /^\s*SHOW/) {
+      map {
+        if (/^\s*([\w_]+):\s*(.*)/) {
+          $hashref->{$1} = $2;
+        }
+      } split(/\n/, $output);
+    } else {
+      # i dont mess around here and you shouldn't either
+    }
+    $self->trace(sprintf "RESULT:\n%s\n",
+        Data::Dumper::Dumper($hashref));
+  }
+  unlink $self->{sql_commandfile};
+  unlink $self->{sql_resultfile};
+  return $hashref;
+}
+
+sub fetchrow_array {
+  my $self = shift;
+  my $sql = shift;
+  my @arguments = @_;
+  my $sth = undef;
+  my @row = ();
+  foreach (@arguments) {
+    # replace the ? by the parameters
+    if (/^\d+$/) {
+      $sql =~ s/\?/$_/;
+    } else {
+      $sql =~ s/\?/'$_'/;
+    }
+  }
+  $self->trace(sprintf "SQL (? resolved):\n%s\nARGS:\n%s\n",
+      $sql, Data::Dumper::Dumper(\@arguments));
+  $self->create_commandfile($sql);
+  my $exit_output = `$self->{sqlplus}`;
+  if ($?) {
+    printf STDERR "fetchrow_array exit bumm \n";
+    my $output = do { local (@ARGV, $/) = $self->{sql_resultfile}; <> };
+    my @oerrs = map {
+      /((ERROR \d+).*)/ ? $1 : ();
+    } split(/\n/, $output);
+    $self->{errstr} = join(" ", @oerrs);
+  } else {
+    my $output = do { local (@ARGV, $/) = $self->{sql_resultfile}; <> };
+    @row = map { convert($_) } 
+        map { s/^\s+([\.\d]+)$/$1/g; $_ }         # strip leading space from numbers
+        map { s/\s+$//g; $_ }                     # strip trailing space
+        split(/\t/, (split(/\n/, $output))[0]);
+    $self->trace(sprintf "RESULT:\n%s\n",
+        Data::Dumper::Dumper(\@row));
+  }
+  if ($@) {
+    $self->debug(sprintf "bumm %s", $@);
+  }
+  unlink $self->{sql_commandfile};
+  unlink $self->{sql_resultfile};
+  return $row[0] unless wantarray;
+  return @row;
+}
+
+sub fetchall_array {
+  my $self = shift;
+  my $sql = shift;
+  my @arguments = @_;
+  my $sth = undef;
+  my $rows = undef;
+  foreach (@arguments) {
+    # replace the ? by the parameters
+    if (/^\d+$/) {
+      $sql =~ s/\?/$_/;
+    } else {
+      $sql =~ s/\?/'$_'/;
+    }
+  }
+  $self->trace(sprintf "SQL (? resolved):\n%s\nARGS:\n%s\n",
+      $sql, Data::Dumper::Dumper(\@arguments));
+  $self->create_commandfile($sql);
+  my $exit_output = `$self->{sqlplus}`;
+  if ($?) {
+    printf STDERR "fetchrow_array exit bumm %s\n", $exit_output;
+    my $output = do { local (@ARGV, $/) = $self->{sql_resultfile}; <> };
+    my @oerrs = map {
+      /((ERROR \d+).*)/ ? $1 : ();
+    } split(/\n/, $output);
+    $self->{errstr} = join(" ", @oerrs);
+  } else {
+    my $output = do { local (@ARGV, $/) = $self->{sql_resultfile}; <> };
+    my @rows = map { [ 
+        map { convert($_) } 
+        map { s/^\s+([\.\d]+)$/$1/g; $_ }
+        map { s/\s+$//g; $_ }
+        split /\t/
+    ] } grep { ! /^\d+ rows selected/ } 
+        grep { ! /^Elapsed: / }
+        grep { ! /^\s*$/ } split(/\n/, $output);
+    $rows = \@rows;
+    $self->trace(sprintf "RESULT:\n%s\n",
+        Data::Dumper::Dumper($rows));
+  }
+  if ($@) {
+    $self->debug(sprintf "bumm %s", $@);
+  }
+  unlink $self->{sql_commandfile};
+  unlink $self->{sql_resultfile};
+  return @{$rows};
+}
+
+sub func {
+  my $self = shift;
+  my $function = shift;
+  $self->{handle}->func(@_);
+}
+
+sub convert {
+  my $n = shift;
+  # mostly used to convert numbers in scientific notation
+  if ($n =~ /^\s*\d+\s*$/) {
+    return $n;
+  } elsif ($n =~ /^\s*([-+]?)(\d*[\.,]*\d*)[eE]{1}([-+]?)(\d+)\s*$/) {
+    my ($vor, $num, $sign, $exp) = ($1, $2, $3, $4);
+    $n =~ s/E/e/g;
+    $n =~ s/,/\./g;
+    $num =~ s/,/\./g;
+    my $sig = $sign eq '-' ? "." . ($exp - 1 + length $num) : '';
+    my $dec = sprintf "%${sig}f", $n;
+    $dec =~ s/\.[0]+$//g;
+    return $dec;
+  } elsif ($n =~ /^\s*([-+]?)(\d+)[\.,]*(\d*)\s*$/) {
+    return $1.$2.".".$3;
+  } elsif ($n =~ /^\s*(.*?)\s*$/) {
+    return $1;
+  } else {
+    return $n;
+  }
+}
+
+
+sub execute {
+  my $self = shift;
+  my $sql = shift;
+  eval {
+    my $sth = $self->{handle}->prepare($sql);
+    $sth->execute();
+  };
+  if ($@) {
+    printf STDERR "bumm %s\n", $@;
+  }
+}
+
+sub errstr {
+  my $self = shift;
+  return $self->{errstr};
+}
+
+sub DESTROY {
+  my $self = shift;
+  $self->trace("try to clean up command and result files");
+  unlink $self->{sql_commandfile} if -f $self->{sql_commandfile};
+  unlink $self->{sql_resultfile} if -f $self->{sql_resultfile};
+}
+
+sub create_commandfile {
+  my $self = shift;
+  my $sql = shift;
+  open CMDCMD, "> $self->{sql_commandfile}"; 
+  printf CMDCMD "%s\n", $sql;
+  close CMDCMD;
+}
+
+
+package DBD::MySQL::Server::Connection::Sqlrelay;
+
+use strict;
+use Net::Ping;
+
+our @ISA = qw(DBD::MySQL::Server::Connection);
+
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  my $retval = undef;
+  if ($self->{mode} =~ /^server::tnsping/) {
+    if (! $self->{connect}) {
+      $self->{errstr} = "Please specify a database";
+    } else {
+      if ($self->{connect} =~ /([\.\w]+):(\d+)/) {
+        $self->{host} = $1;
+        $self->{port} = $2;
+        $self->{socket} = "";
+      } elsif ($self->{connect} =~ /([\.\w]+):([\w\/]+)/) {
+        $self->{host} = $1;
+        $self->{socket} = $2;
+        $self->{port} = "";
+      }
+    }
+  } else {
+    if (! $self->{hostname} || ! $self->{username} || ! $self->{password}) {
+      if ($self->{hostname} && $self->{hostname} =~ /(\w+)\/(\w+)@([\.\w]+):(\d+)/) {
+        $self->{username} = $1;
+        $self->{password} = $2;
+        $self->{hostname} = $3;
+        $self->{port} = $4;
+        $self->{socket} = "";
+      } elsif ($self->{hostname} && $self->{hostname} =~ /(\w+)\/(\w+)@([\.\w]+):([\w\/]+)/) {
+        $self->{username} = $1;
+        $self->{password} = $2;
+        $self->{hostname} = $3;
+        $self->{socket} = $4;
+        $self->{port} = "";
+      } else {
+        $self->{errstr} = "Please specify database, username and password";
+        return undef;
+      }
+    } else {
+      if ($self->{hostname} =~ /([\.\w]+):(\d+)/) {
+        $self->{hostname} = $1;
+        $self->{port} = $2;
+        $self->{socket} = "";
+      } elsif ($self->{hostname} =~ /([\.\w]+):([\w\/]+)/) {
+        $self->{hostname} = $1;
+        $self->{socket} = $2;
+        $self->{port} = "";
+      } else {
+        $self->{errstr} = "Please specify hostname, username, password and port/socket";
+        return undef;
+      }
+    }
+  }
+  if (! exists $self->{errstr}) {
+    eval {
+      require DBI;
+      use POSIX ':signal_h';
+      local $SIG{'ALRM'} = sub {
+        die "alarm\n";
+      };
+      my $mask = POSIX::SigSet->new( SIGALRM );
+      my $action = POSIX::SigAction->new(
+      sub { die "alarm\n" ; }, $mask);
+      my $oldaction = POSIX::SigAction->new();
+      sigaction(SIGALRM ,$action ,$oldaction );
+      alarm($self->{timeout} - 1); # 1 second before the global unknown timeout
+      if ($self->{handle} = DBI->connect(
+          sprintf("DBI:SQLRelay:host=%s;port=%d;socket=%s", 
+          $self->{hostname}, $self->{port}, $self->{socket}),
+          $self->{username},
+          $self->{password},
+          { RaiseError => 1, AutoCommit => 0, PrintError => 1 })) {
+        $retval = $self;
+        if ($self->{mode} =~ /^server::tnsping/ && $self->{handle}->ping()) {
+          # database connected. fake a "unknown user"
+          $self->{errstr} = "ORA-01017";
+        }
+      } else {
+        $self->{errstr} = DBI::errstr();
+      }
+    };
+    if ($@) {
+      $self->{errstr} = $@;
+      $self->{errstr} =~ s/at [\w\/\.]+ line \d+.*//g;
+      $retval = undef;
+    }
+  }
+  $self->{tac} = Time::HiRes::time();
+  return $retval;
+}
+
+sub fetchrow_array {
+  my $self = shift;
+  my $sql = shift;
+  my @arguments = @_;
+  my $sth = undef;
+  my @row = ();
+  $self->trace(sprintf "fetchrow_array: %s", $sql);
+  eval {
+    $sth = $self->{handle}->prepare($sql);
+    if (scalar(@arguments)) {
+      $sth->execute(@arguments);
+    } else {
+      $sth->execute();
+    }
+    @row = $sth->fetchrow_array();
+  };
+  if ($@) {
+    $self->debug(sprintf "bumm %s", $@);
+  }
+  if (-f "/tmp/check_mysql_health_simulation/".$self->{mode}) {
+    my $simulation = do { local (@ARGV, $/) =
+        "/tmp/check_mysql_health_simulation/".$self->{mode}; <> };
+    @row = split(/\s+/, (split(/\n/, $simulation))[0]);
+  }
+  return $row[0] unless wantarray;
+  return @row;
+}
+
+sub fetchall_array {
+  my $self = shift;
+  my $sql = shift;
+  my @arguments = @_;
+  my $sth = undef;
+  my $rows = undef;
+  $self->trace(sprintf "fetchall_array: %s", $sql);
+  eval {
+    $sth = $self->{handle}->prepare($sql);
+    if (scalar(@arguments)) {
+      $sth->execute(@arguments);
+    } else {
+      $sth->execute();
+    }
+    $rows = $sth->fetchall_arrayref();
+  };
+  if ($@) {
+    printf STDERR "bumm %s\n", $@;
+  }
+  if (-f "/tmp/check_mysql_health_simulation/".$self->{mode}) {
+    my $simulation = do { local (@ARGV, $/) =
+        "/tmp/check_mysql_health_simulation/".$self->{mode}; <> };
+    @{$rows} = map { [ split(/\s+/, $_) ] } split(/\n/, $simulation);
+  }
+  return @{$rows};
+}
+
+sub func {
+  my $self = shift;
+  $self->{handle}->func(@_);
+}
+
+sub execute {
+  my $self = shift;
+  my $sql = shift;
+  eval {
+    my $sth = $self->{handle}->prepare($sql);
+    $sth->execute();
+  };
+  if ($@) {
+    printf STDERR "bumm %s\n", $@;
+  }
+}
+
+sub DESTROY {
+  my $self = shift;
+  #$self->trace(sprintf "disconnecting DBD %s",
+  #    $self->{handle} ? "with handle" : "without handle");
+  #$self->{handle}->disconnect() if $self->{handle};
+}
+
+
+
+
+package DBD::MySQL::Cluster;
+
+use strict;
+use Time::HiRes;
+use IO::File;
+use Data::Dumper;
+
+
+{
+  our $verbose = 0;
+  our $scream = 0; # scream if something is not implemented
+  our $access = "dbi"; # how do we access the database. 
+  our $my_modules_dyn_dir = ""; # where we look for self-written extensions
+
+  my @clusters = ();
+  my $initerrors = undef;
+
+  sub add_cluster {
+    push(@clusters, shift);
+  }
+
+  sub return_clusters {
+    return @clusters;
+  }
+  
+  sub return_first_cluster() {
+    return $clusters[0];
+  }
+
+}
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    hostname => $params{hostname},
+    port => $params{port},
+    username => $params{username},
+    password => $params{password},
+    timeout => $params{timeout},
+    warningrange => $params{warningrange},
+    criticalrange => $params{criticalrange},
+    version => 'unknown',
+    nodes => [],
+    ndbd_nodes => 0,
+    ndb_mgmd_nodes => 0,
+    mysqld_nodes => 0,
+  };
+  bless $self, $class;
+  $self->init_nagios();
+  if ($self->connect(%params)) {
+    DBD::MySQL::Cluster::add_cluster($self);
+    $self->init(%params);
+  }
+  return $self;
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  if ($self->{show}) {
+    my $type = undef;
+    foreach (split /\n/, $self->{show}) {
+      if (/\[(\w+)\((\w+)\)\]\s+(\d+) node/) {
+        $type = uc $2;
+      } elsif (/id=(\d+)(.*)/) {
+        push(@{$self->{nodes}}, DBD::MySQL::Cluster::Node->new(
+            type => $type,
+            id => $1,
+            status => $2,
+        ));
+      }
+    }
+  } else {
+  }
+  if ($params{mode} =~ /^cluster::ndbdrunning/) {
+    foreach my $node (@{$self->{nodes}}) {
+      $node->{type} eq "NDB" && $node->{status} eq "running" && $self->{ndbd_nodes}++;
+      $node->{type} eq "MGM" && $node->{status} eq "running" && $self->{ndb_mgmd_nodes}++;
+      $node->{type} eq "API" && $node->{status} eq "running" && $self->{mysqld_nodes}++;
+    }
+  } else {
+    printf "broken mode %s\n", $params{mode};
+  }
+}
+
+sub dump {
+  my $self = shift;
+  my $message = shift || "";
+  printf "%s %s\n", $message, Data::Dumper::Dumper($self);
+}
+
+sub nagios {
+  my $self = shift;
+  my %params = @_;
+  my $dead_ndb = 0;
+  my $dead_api = 0;
+  if (! $self->{nagios_level}) {
+    if ($params{mode} =~ /^cluster::ndbdrunning/) {
+      foreach my $node (grep { $_->{type} eq "NDB"} @{$self->{nodes}}) {
+        next if $params{selectname} && $params{selectname} ne $_->{id};
+        if (! $node->{connected}) {
+          $self->add_nagios_critical(
+              sprintf "ndb node %d is not connected", $node->{id});
+          $dead_ndb++;
+        }
+      }
+      foreach my $node (grep { $_->{type} eq "API"} @{$self->{nodes}}) {
+        next if $params{selectname} && $params{selectname} ne $_->{id};
+        if (! $node->{connected}) {
+          $self->add_nagios_critical(
+              sprintf "api node %d is not connected", $node->{id});
+          $dead_api++;
+        }
+      }
+      if (! $dead_ndb) {
+        $self->add_nagios_ok("all ndb nodes are connected");
+      }
+      if (! $dead_api) {
+        $self->add_nagios_ok("all api nodes are connected");
+      }
+    }
+  }
+  $self->add_perfdata(sprintf "ndbd_nodes=%d ndb_mgmd_nodes=%d mysqld_nodes=%d",
+      $self->{ndbd_nodes}, $self->{ndb_mgmd_nodes}, $self->{mysqld_nodes});
+}
+
+
+sub init_nagios {
+  my $self = shift;
+  no strict 'refs';
+  if (! ref($self)) {
+    my $nagiosvar = $self."::nagios";
+    my $nagioslevelvar = $self."::nagios_level";
+    $$nagiosvar = {
+      messages => {
+        0 => [],
+        1 => [],
+        2 => [],
+        3 => [],
+      },
+      perfdata => [],
+    };
+    $$nagioslevelvar = $ERRORS{OK},
+  } else {
+    $self->{nagios} = {
+      messages => {
+        0 => [],
+        1 => [],
+        2 => [],
+        3 => [],
+      },
+      perfdata => [],
+    };
+    $self->{nagios_level} = $ERRORS{OK},
+  }
+}
+
+sub check_thresholds {
+  my $self = shift;
+  my $value = shift;
+  my $defaultwarningrange = shift;
+  my $defaultcriticalrange = shift;
+  my $level = $ERRORS{OK};
+  $self->{warningrange} = $self->{warningrange} ?
+      $self->{warningrange} : $defaultwarningrange;
+  $self->{criticalrange} = $self->{criticalrange} ?
+      $self->{criticalrange} : $defaultcriticalrange;
+  if ($self->{warningrange} !~ /:/ && $self->{criticalrange} !~ /:/) {
+    # warning = 10, critical = 20, warn if > 10, crit if > 20
+    $level = $ERRORS{WARNING} if $value > $self->{warningrange};
+    $level = $ERRORS{CRITICAL} if $value > $self->{criticalrange};
+  } elsif ($self->{warningrange} =~ /([\d\.]+):/ && 
+      $self->{criticalrange} =~ /([\d\.]+):/) {
+    # warning = 98:, critical = 95:, warn if < 98, crit if < 95
+    $self->{warningrange} =~ /([\d\.]+):/;
+    $level = $ERRORS{WARNING} if $value < $1;
+    $self->{criticalrange} =~ /([\d\.]+):/;
+    $level = $ERRORS{CRITICAL} if $value < $1;
+  }
+  return $level;
+  #
+  # syntax error must be reported with returncode -1
+  #
+}
+
+sub add_nagios {
+  my $self = shift;
+  my $level = shift;
+  my $message = shift;
+  push(@{$self->{nagios}->{messages}->{$level}}, $message);
+  # recalc current level
+  foreach my $llevel qw(CRITICAL WARNING UNKNOWN OK) {
+    if (scalar(@{$self->{nagios}->{messages}->{$ERRORS{$llevel}}})) {
+      $self->{nagios_level} = $ERRORS{$llevel};
+    }
+  }
+}
+
+sub add_nagios_ok {
+  my $self = shift;
+  my $message = shift;
+  $self->add_nagios($ERRORS{OK}, $message);
+}
+
+sub add_nagios_warning {
+  my $self = shift;
+  my $message = shift;
+  $self->add_nagios($ERRORS{WARNING}, $message);
+}
+
+sub add_nagios_critical {
+  my $self = shift;
+  my $message = shift;
+  $self->add_nagios($ERRORS{CRITICAL}, $message);
+}
+
+sub add_nagios_unknown {
+  my $self = shift;
+  my $message = shift;
+  $self->add_nagios($ERRORS{UNKNOWN}, $message);
+}
+
+sub add_perfdata {
+  my $self = shift;
+  my $data = shift;
+  push(@{$self->{nagios}->{perfdata}}, $data);
+}
+
+sub merge_nagios {
+  my $self = shift;
+  my $child = shift;
+  foreach my $level (0..3) {
+    foreach (@{$child->{nagios}->{messages}->{$level}}) {
+      $self->add_nagios($level, $_);
+    }
+    #push(@{$self->{nagios}->{messages}->{$level}},
+    #    @{$child->{nagios}->{messages}->{$level}});
+  }
+  push(@{$self->{nagios}->{perfdata}}, @{$child->{nagios}->{perfdata}});
+}
+
+
+sub calculate_result {
+  my $self = shift;
+  if ($ENV{NRPE_MULTILINESUPPORT} && 
+      length join(" ", @{$self->{nagios}->{perfdata}}) > 200) {
+    foreach my $level ("CRITICAL", "WARNING", "UNKNOWN", "OK") {
+      # first the bad news
+      if (scalar(@{$self->{nagios}->{messages}->{$ERRORS{$level}}})) {
+        $self->{nagios_message} .=
+            "\n".join("\n", @{$self->{nagios}->{messages}->{$ERRORS{$level}}});
+      }
+    }
+    $self->{nagios_message} =~ s/^\n//g;
+    $self->{perfdata} = join("\n", @{$self->{nagios}->{perfdata}});
+  } else {
+    foreach my $level ("CRITICAL", "WARNING", "UNKNOWN", "OK") {
+      # first the bad news
+      if (scalar(@{$self->{nagios}->{messages}->{$ERRORS{$level}}})) {
+        $self->{nagios_message} .= 
+            join(", ", @{$self->{nagios}->{messages}->{$ERRORS{$level}}}).", ";
+      }
+    }
+    $self->{nagios_message} =~ s/, $//g;
+    $self->{perfdata} = join(" ", @{$self->{nagios}->{perfdata}});
+  }
+  foreach my $level ("OK", "UNKNOWN", "WARNING", "CRITICAL") {
+    if (scalar(@{$self->{nagios}->{messages}->{$ERRORS{$level}}})) {
+      $self->{nagios_level} = $ERRORS{$level};
+    }
+  }
+}
+
+sub debug {
+  my $self = shift;
+  my $msg = shift;
+  if ($DBD::MySQL::Cluster::verbose) {
+    printf "%s %s\n", $msg, ref($self);
+  }
+}
+
+sub connect {
+  my $self = shift;
+  my %params = @_;
+  my $retval = undef;
+  $self->{tic} = Time::HiRes::time();
+  eval {
+    use POSIX ':signal_h';
+    local $SIG{'ALRM'} = sub {
+      die "alarm\n";
+    };
+    my $mask = POSIX::SigSet->new( SIGALRM );
+    my $action = POSIX::SigAction->new(
+        sub { die "connection timeout\n" ; }, $mask);
+    my $oldaction = POSIX::SigAction->new();
+    sigaction(SIGALRM ,$action ,$oldaction );
+    alarm($self->{timeout} - 1); # 1 second before the global unknown timeout
+    my $ndb_mgm = "ndb_mgm";
+    $params{hostname} = "127.0.0.1" if ! $params{hostname};
+    $ndb_mgm .= sprintf " --ndb-connectstring=%s", $params{hostname}
+        if $params{hostname};
+    $ndb_mgm .= sprintf ":%d", $params{port}
+        if $params{port};
+    $self->{show} = `$ndb_mgm -e show 2>&1`;
+    if ($? == -1) {
+      $self->add_nagios_critical("ndb_mgm failed to execute $!");
+    } elsif ($? & 127) {
+      $self->add_nagios_critical("ndb_mgm failed to execute $!");
+    } elsif ($? >> 8 != 0) {
+      $self->add_nagios_critical("ndb_mgm unable to connect");
+    } else {
+      if ($self->{show} !~ /Cluster Configuration/) {
+        $self->add_nagios_critical("got no cluster configuration");
+      } else {
+        $retval = 1;
+      }
+    }
+  };
+  if ($@) {
+    $self->{errstr} = $@;
+    $self->{errstr} =~ s/at $0 .*//g;
+    chomp $self->{errstr};
+    $self->add_nagios_critical($self->{errstr});
+    $retval = undef;
+  }
+  $self->{tac} = Time::HiRes::time();
+  return $retval;
+}
+
+sub trace {
+  my $self = shift;
+  my $format = shift;
+  $self->{trace} = -f "/tmp/check_mysql_health.trace" ? 1 : 0;
+  if ($self->{verbose}) {
+    printf("%s: ", scalar localtime);
+    printf($format, @_);
+  }
+  if ($self->{trace}) {
+    my $logfh = new IO::File;
+    $logfh->autoflush(1);
+    if ($logfh->open("/tmp/check_mysql_health.trace", "a")) {
+      $logfh->printf("%s: ", scalar localtime);
+      $logfh->printf($format, @_);
+      $logfh->printf("\n");
+      $logfh->close();
+    }
+  }
+}
+
+sub DESTROY {
+  my $self = shift;
+  my $handle1 = "null";
+  my $handle2 = "null";
+  if (defined $self->{handle}) {
+    $handle1 = ref($self->{handle});
+    if (defined $self->{handle}->{handle}) {
+      $handle2 = ref($self->{handle}->{handle});
+    }
+  }
+  $self->trace(sprintf "DESTROY %s with handle %s %s", ref($self), $handle1, $handle2);
+  if (ref($self) eq "DBD::MySQL::Cluster") {
+  }
+  $self->trace(sprintf "DESTROY %s exit with handle %s %s", ref($self), $handle1, $handle2);
+  if (ref($self) eq "DBD::MySQL::Cluster") {
+    #printf "humpftata\n";
+  }
+}
+
+sub save_state {
+  my $self = shift;
+  my %params = @_;
+  my $extension = "";
+  mkdir $params{statefilesdir} unless -d $params{statefilesdir};
+  my $statefile = sprintf "%s/%s_%s", 
+      $params{statefilesdir}, $params{hostname}, $params{mode};
+  $extension .= $params{differenciator} ? "_".$params{differenciator} : "";
+  $extension .= $params{socket} ? "_".$params{socket} : "";
+  $extension .= $params{port} ? "_".$params{port} : "";
+  $extension .= $params{database} ? "_".$params{database} : "";
+  $extension .= $params{tablespace} ? "_".$params{tablespace} : "";
+  $extension .= $params{datafile} ? "_".$params{datafile} : "";
+  $extension .= $params{name} ? "_".$params{name} : "";
+  $extension =~ s/\//_/g;
+  $extension =~ s/\(/_/g;
+  $extension =~ s/\)/_/g;
+  $extension =~ s/\*/_/g;
+  $extension =~ s/\s/_/g;
+  $statefile .= $extension;
+  $statefile = lc $statefile;
+  open(STATE, ">$statefile");
+  if ((ref($params{save}) eq "HASH") && exists $params{save}->{timestamp}) {
+    $params{save}->{localtime} = scalar localtime $params{save}->{timestamp};
+  }
+  printf STATE Data::Dumper::Dumper($params{save});
+  close STATE;
+  $self->debug(sprintf "saved %s to %s",
+      Data::Dumper::Dumper($params{save}), $statefile);
+}
+
+sub load_state {
+  my $self = shift;
+  my %params = @_;
+  my $extension = "";
+  my $statefile = sprintf "%s/%s_%s", 
+      $params{statefilesdir}, $params{hostname}, $params{mode};
+  $extension .= $params{differenciator} ? "_".$params{differenciator} : "";
+  $extension .= $params{socket} ? "_".$params{socket} : "";
+  $extension .= $params{port} ? "_".$params{port} : "";
+  $extension .= $params{database} ? "_".$params{database} : "";
+  $extension .= $params{tablespace} ? "_".$params{tablespace} : "";
+  $extension .= $params{datafile} ? "_".$params{datafile} : "";
+  $extension .= $params{name} ? "_".$params{name} : "";
+  $extension =~ s/\//_/g;
+  $extension =~ s/\(/_/g;
+  $extension =~ s/\)/_/g;
+  $extension =~ s/\*/_/g;
+  $extension =~ s/\s/_/g;
+  $statefile .= $extension;
+  $statefile = lc $statefile;
+  if ( -f $statefile) {
+    our $VAR1;
+    eval {
+      require $statefile;
+    };
+    if($@) {
+printf "rumms\n";
+    }
+    $self->debug(sprintf "load %s", Data::Dumper::Dumper($VAR1));
+    return $VAR1;
+  } else {
+    return undef;
+  }
+}
+
+sub valdiff {
+  my $self = shift;
+  my $pparams = shift;
+  my %params = %{$pparams};
+  my @keys = @_;
+  my $last_values = $self->load_state(%params) || eval {
+    my $empty_events = {};
+    foreach (@keys) {
+      $empty_events->{$_} = 0;
+    }
+    $empty_events->{timestamp} = 0;
+    $empty_events;
+  };
+  foreach (@keys) {
+    $self->{'delta_'.$_} = $self->{$_} - $last_values->{$_};
+    $self->debug(sprintf "delta_%s %f", $_, $self->{'delta_'.$_});
+  }
+  $self->{'delta_timestamp'} = time - $last_values->{timestamp};
+  $params{save} = eval {
+    my $empty_events = {};
+    foreach (@keys) {
+      $empty_events->{$_} = $self->{$_};
+    }
+    $empty_events->{timestamp} = time;
+    $empty_events;
+  };
+  $self->save_state(%params);
+}
+
+sub requires_version {
+  my $self = shift;
+  my $version = shift;
+  my @instances = DBD::MySQL::Cluster::return_clusters();
+  my $instversion = $instances[0]->{version};
+  if (! $self->version_is_minimum($version)) {
+    $self->add_nagios($ERRORS{UNKNOWN}, 
+        sprintf "not implemented/possible for MySQL release %s", $instversion);
+  }
+}
+
+sub version_is_minimum {
+  # the current version is newer or equal
+  my $self = shift;
+  my $version = shift;
+  my $newer = 1;
+  my @instances = DBD::MySQL::Cluster::return_clusters();
+  my @v1 = map { $_ eq "x" ? 0 : $_ } split(/\./, $version);
+  my @v2 = split(/\./, $instances[0]->{version});
+  if (scalar(@v1) > scalar(@v2)) {
+    push(@v2, (0) x (scalar(@v1) - scalar(@v2)));
+  } elsif (scalar(@v2) > scalar(@v1)) {
+    push(@v1, (0) x (scalar(@v2) - scalar(@v1)));
+  }
+  foreach my $pos (0..$#v1) {
+    if ($v2[$pos] > $v1[$pos]) {
+      $newer = 1;
+      last;
+    } elsif ($v2[$pos] < $v1[$pos]) {
+      $newer = 0;
+      last;
+    }
+  }
+  #printf STDERR "check if %s os minimum %s\n", join(".", @v2), join(".", @v1);
+  return $newer;
+}
+
+sub instance_rac {
+  my $self = shift;
+  my @instances = DBD::MySQL::Cluster::return_clusters();
+  return (lc $instances[0]->{parallel} eq "yes") ? 1 : 0;
+}
+
+sub instance_thread {
+  my $self = shift;
+  my @instances = DBD::MySQL::Cluster::return_clusters();
+  return $instances[0]->{thread};
+}
+
+sub windows_cluster {
+  my $self = shift;
+  my @instances = DBD::MySQL::Cluster::return_clusters();
+  if ($instances[0]->{os} =~ /Win/i) {
+    return 1;
+  } else {
+    return 0;
+  }
+}
+
+sub system_vartmpdir {
+  my $self = shift;
+  if ($^O =~ /MSWin/) {
+    return $self->system_tmpdir();
+  } else {
+    return "/var/tmp/check_mysql_health";
+  }
+}
+
+sub system_oldvartmpdir {
+  my $self = shift;
+  return "/tmp";
+}
+
+sub system_tmpdir {
+  my $self = shift;
+  if ($^O =~ /MSWin/) {
+    return $ENV{TEMP} if defined $ENV{TEMP};
+    return $ENV{TMP} if defined $ENV{TMP};
+    return File::Spec->catfile($ENV{windir}, 'Temp')
+        if defined $ENV{windir};
+    return 'C:\Temp';
+  } else {
+    return "/tmp";
+  }
+}
+
+
+package DBD::MySQL::Cluster::Node;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Cluster);
+
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    mode => $params{mode},
+    timeout => $params{timeout},
+    type => $params{type},
+    id => $params{id},
+    status => $params{status},
+  };
+  bless $self, $class;
+  $self->init(%params);
+  if ($params{type} eq "NDB") {
+    bless $self, "DBD::MySQL::Cluster::Node::NDB";
+    $self->init(%params);
+  }
+  return $self;
+}
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  if ($self->{status} =~ /@(\d+\.\d+\.\d+\.\d+)\s/) {
+    $self->{addr} = $1;
+    $self->{connected} = 1;
+  } elsif ($self->{status} =~ /accepting connect from (\d+\.\d+\.\d+\.\d+)/) {
+    $self->{addr} = $1;
+    $self->{connected} = 0;
+  }
+  if ($self->{status} =~ /starting,/) {
+    $self->{status} = "starting";
+  } elsif ($self->{status} =~ /shutting,/) {
+    $self->{status} = "shutting";
+  } else {
+    $self->{status} = $self->{connected} ? "running" : "dead";
+  }
+}
+
+
+package DBD::MySQL::Cluster::Node::NDB;
+
+use strict;
+
+our @ISA = qw(DBD::MySQL::Cluster::Node);
+
+
+sub init {
+  my $self = shift;
+  my %params = @_;
+  if ($self->{status} =~ /Nodegroup:\s*(\d+)/) {
+    $self->{nodegroup} = $1;
+  }
+  $self->{master} = ($self->{status} =~ /Master\)/) ? 1 : 0;
+}
+
+
+package Extraopts;
+
+use strict;
+use File::Basename;
+use Data::Dumper;
+
+sub new {
+  my $class = shift;
+  my %params = @_;
+  my $self = {
+    file => $params{file},
+    commandline => $params{commandline},
+    config => {},
+    section => 'default_no_section',
+  };
+  bless $self, $class;
+  $self->prepare_file_and_section();
+  $self->init();
+  return $self;
+}
+
+sub prepare_file_and_section {
+  my $self = shift;
+  if (! defined $self->{file}) {
+    # ./check_stuff --extra-opts
+    $self->{section} = basename($0);
+    $self->{file} = $self->get_default_file();
+  } elsif ($self->{file} =~ /^[^@]+$/) {
+    # ./check_stuff --extra-opts=special_opts
+    $self->{section} = $self->{file};
+    $self->{file} = $self->get_default_file();
+  } elsif ($self->{file} =~ /^@(.*)/) {
+    # ./check_stuff --extra-opts=@/etc/myconfig.ini
+    $self->{section} = basename($0);
+    $self->{file} = $1;
+  } elsif ($self->{file} =~ /^(.*?)@(.*)/) {
+    # ./check_stuff --extra-opts=special_opts@/etc/myconfig.ini
+    $self->{section} = $1;
+    $self->{file} = $2;
+  }
+}
+
+sub get_default_file {
+  my $self = shift;
+  foreach my $default (qw(/etc/nagios/plugins.ini
+      /usr/local/nagios/etc/plugins.ini
+      /usr/local/etc/nagios/plugins.ini
+      /etc/opt/nagios/plugins.ini
+      /etc/nagios-plugins.ini
+      /usr/local/etc/nagios-plugins.ini
+      /etc/opt/nagios-plugins.ini)) {
+    if (-f $default) {
+      return $default;
+    }
+  }
+  return undef;
+}
+
+sub init {
+  my $self = shift;
+  if (! defined $self->{file}) {
+    $self->{errors} = sprintf 'no extra-opts file specified and no default file found';
+  } elsif (! -f $self->{file}) {
+    $self->{errors} = sprintf 'could not open %s', $self->{file};
+  } else {
+    my $data = do { local (@ARGV, $/) = $self->{file}; <> };
+    my $in_section = 'default_no_section';
+    foreach my $line (split(/\n/, $data)) {
+      if ($line =~ /\[(.*)\]/) {
+        $in_section = $1;
+      } elsif ($line =~ /(.*?)\s*=\s*(.*)/) {
+        $self->{config}->{$in_section}->{$1} = $2;
+      }
+    }
+  }
+}
+
+sub is_valid {
+  my $self = shift;
+  return ! exists $self->{errors};
+}
+
+sub overwrite {
+  my $self = shift;
+  my %commandline = ();
+  if (scalar(keys %{$self->{config}->{default_no_section}}) > 0) {
+    foreach (keys %{$self->{config}->{default_no_section}}) {
+      $commandline{$_} = $self->{config}->{default_no_section}->{$_};
+    }
+  }
+  if (exists $self->{config}->{$self->{section}}) {
+    foreach (keys %{$self->{config}->{$self->{section}}}) {
+      $commandline{$_} = $self->{config}->{$self->{section}}->{$_};
+    }
+  }
+  foreach (keys %commandline) {
+    if (! exists $self->{commandline}->{$_}) {
+      $self->{commandline}->{$_} = $commandline{$_};
+    }
+  }
+}
+
+
+
+package main;
+
+use strict;
+use Getopt::Long qw(:config no_ignore_case);
+use File::Basename;
+use lib dirname($0);
+
+
+
+use vars qw ($PROGNAME $REVISION $CONTACT $TIMEOUT $STATEFILESDIR $needs_restart %commandline);
+
+$PROGNAME = "check_mysql_health";
+$REVISION = '$Revision: 2.1.7 $';
+$CONTACT = 'gerhard.lausser@consol.de';
+$TIMEOUT = 60;
+$STATEFILESDIR = '/var/tmp/check_mysql_health';
+$needs_restart = 0;
+
+my @modes = (
+  ['server::connectiontime',
+      'connection-time', undef,
+      'Time to connect to the server' ],
+  ['server::uptime',
+      'uptime', undef,
+      'Time the server is running' ],
+  ['server::instance::connectedthreads',
+      'threads-connected', undef,
+      'Number of currently open connections' ],
+  ['server::instance::threadcachehitrate',
+      'threadcache-hitrate', undef,
+      'Hit rate of the thread-cache' ],
+  ['server::instance::createdthreads',
+      'threads-created', undef,
+      'Number of threads created per sec' ],
+  ['server::instance::runningthreads',
+      'threads-running', undef,
+      'Number of currently running threads' ],
+  ['server::instance::cachedthreads',
+      'threads-cached', undef,
+      'Number of currently cached threads' ],
+  ['server::instance::abortedconnects',
+      'connects-aborted', undef,
+      'Number of aborted connections per sec' ],
+  ['server::instance::abortedclients',
+      'clients-aborted', undef,
+      'Number of aborted connections (because the client died) per sec' ],
+  ['server::instance::replication::slavelag',
+      'slave-lag', ['replication-slave-lag'],
+      'Seconds behind master' ],
+  ['server::instance::replication::slaveiorunning',
+      'slave-io-running', ['replication-slave-io-running'],
+      'Slave io running: Yes' ],
+  ['server::instance::replication::slavesqlrunning',
+      'slave-sql-running', ['replication-slave-sql-running'],
+      'Slave sql running: Yes' ],
+  ['server::instance::querycachehitrate',
+      'qcache-hitrate', ['querycache-hitrate'],
+      'Query cache hitrate' ],
+  ['server::instance::querycachelowmemprunes',
+      'qcache-lowmem-prunes', ['querycache-lowmem-prunes'],
+      'Query cache entries pruned because of low memory' ],
+  ['server::instance::myisam::keycache::hitrate',
+      'keycache-hitrate', ['myisam-keycache-hitrate'],
+      'MyISAM key cache hitrate' ],
+  ['server::instance::innodb::bufferpool::hitrate',
+      'bufferpool-hitrate', ['innodb-bufferpool-hitrate'],
+      'InnoDB buffer pool hitrate' ],
+  ['server::instance::innodb::bufferpool::waitfree',
+      'bufferpool-wait-free', ['innodb-bufferpool-wait-free'],
+      'InnoDB buffer pool waits for clean page available' ],
+  ['server::instance::innodb::logwaits',
+      'log-waits', ['innodb-log-waits'],
+      'InnoDB log waits because of a too small log buffer' ],
+  ['server::instance::tablecachehitrate',
+      'tablecache-hitrate', undef,
+      'Table cache hitrate' ],
+  ['server::instance::tablelockcontention',
+      'table-lock-contention', undef,
+      'Table lock contention' ],
+  ['server::instance::tableindexusage',
+      'index-usage', undef,
+      'Usage of indices' ],
+  ['server::instance::tabletmpondisk',
+      'tmp-disk-tables', undef,
+      'Percent of temp tables created on disk' ],
+  ['server::instance::needoptimize',
+      'table-fragmentation', undef,
+      'Show tables which should be optimized' ],
+  ['server::instance::openfiles',
+      'open-files', undef,
+      'Percent of opened files' ],
+  ['server::instance::slowqueries',
+      'slow-queries', undef,
+      'Slow queries' ],
+  ['server::instance::longprocs',
+      'long-running-procs', undef,
+      'long running processes' ],
+  ['cluster::ndbdrunning',
+      'cluster-ndbd-running', undef,
+      'ndnd nodes are up and running' ],
+  ['server::sql',
+      'sql', undef,
+      'any sql command returning a single number' ],
+);
+
+# rrd data store names are limited to 19 characters
+my %labels = (
+  bufferpool_hitrate => {
+    groundwork => 'bp_hitrate',
+  },
+  bufferpool_hitrate_now => {
+    groundwork => 'bp_hitrate_now',
+  },
+  bufferpool_free_waits_rate => {
+    groundwork => 'bp_freewaits',
+  },
+  innodb_log_waits_rate => {
+    groundwork => 'inno_log_waits',
+  },
+  keycache_hitrate => {
+    groundwork => 'kc_hitrate',
+  },
+  keycache_hitrate_now => {
+    groundwork => 'kc_hitrate_now',
+  },
+  threads_created_per_sec => {
+    groundwork => 'thrds_creat_per_s',
+  },
+  connects_aborted_per_sec => {
+    groundwork => 'conn_abrt_per_s',
+  },
+  clients_aborted_per_sec => {
+    groundwork => 'clnt_abrt_per_s',
+  },
+  thread_cache_hitrate => {
+    groundwork => 'tc_hitrate',
+  },
+  thread_cache_hitrate_now => {
+    groundwork => 'tc_hitrate_now',
+  },
+  qcache_lowmem_prunes_rate => {
+    groundwork => 'qc_lowm_prnsrate',
+  },
+  slow_queries_rate => {
+    groundwork => 'slow_q_rate',
+  },
+  tablecache_hitrate => {
+    groundwork => 'tac_hitrate',
+  },
+  tablecache_fillrate => {
+    groundwork => 'tac_fillrate',
+  },
+  tablelock_contention => {
+    groundwork => 'tl_contention',
+  },
+  tablelock_contention_now => {
+    groundwork => 'tl_contention_now',
+  },
+  pct_tmp_table_on_disk => {
+    groundwork => 'tmptab_on_disk',
+  },
+  pct_tmp_table_on_disk_now => {
+    groundwork => 'tmptab_on_disk_now',
+  },
+);
+
+sub print_usage () {
+  print <<EOUS;
+  Usage:
+    $PROGNAME [-v] [-t <timeout>] [[--hostname <hostname>] 
+        [--port <port> | --socket <socket>]
+        --username <username> --password <password>] --mode <mode>
+        [--method mysql]
+    $PROGNAME [-h | --help]
+    $PROGNAME [-V | --version]
+
+  Options:
+    --hostname
+       the database server's hostname
+    --port
+       the database's port. (default: 3306)
+    --socket
+       the database's unix socket.
+    --username
+       the mysql db user
+    --password
+       the mysql db user's password
+    --database
+       the database's name. (default: information_schema)
+    --warning
+       the warning range
+    --critical
+       the critical range
+    --mode
+       the mode of the plugin. select one of the following keywords:
+EOUS
+  my $longest = length ((reverse sort {length $a <=> length $b} map { $_->[1] } @modes)[0]);
+  my $format = "       %-".
+  (length ((reverse sort {length $a <=> length $b} map { $_->[1] } @modes)[0])).
+  "s\t(%s)\n";
+  foreach (@modes) {
+    printf $format, $_->[1], $_->[3];
+  }
+  printf "\n";
+  print <<EOUS;
+    --name
+       the name of something that needs to be further specified,
+       currently only used for sql statements
+    --name2
+       if name is a sql statement, this statement would appear in
+       the output and the performance data. This can be ugly, so 
+       name2 can be used to appear instead.
+    --regexp
+       if this parameter is used, name will be interpreted as a 
+       regular expression.
+    --units
+       one of %, KB, MB, GB. This is used for a better output of mode=sql
+       and for specifying thresholds for mode=tablespace-free
+    --labelformat
+       one of pnp4nagios (which is the default) or groundwork.
+       It is used to shorten performance data labels to 19 characters.
+
+  In mode sql you can url-encode the statement so you will not have to mess
+  around with special characters in your Nagios service definitions.
+  Instead of 
+  --name="select count(*) from v\$session where status = 'ACTIVE'"
+  you can say 
+  --name=select%20count%28%2A%29%20from%20v%24session%20where%20status%20%3D%20%27ACTIVE%27
+  For your convenience you can call check_mysql_health with the --mode encode
+  option and it will encode the standard input.
+
+  You can find the full documentation at 
+  http://www.consol.de/opensource/nagios/check-mysql-health
+
+EOUS
+  
+}
+
+sub print_help () {
+  print "Copyright (c) 2009 Gerhard Lausser\n\n";
+  print "\n";
+  print "  Check various parameters of MySQL databases \n";
+  print "\n";
+  print_usage();
+  support();
+}
+
+
+sub print_revision ($$) {
+  my $commandName = shift;
+  my $pluginRevision = shift;
+  $pluginRevision =~ s/^\$Revision: //;
+  $pluginRevision =~ s/ \$\s*$//;
+  print "$commandName ($pluginRevision)\n";
+  print "This nagios plugin comes with ABSOLUTELY NO WARRANTY. You may redistribute\ncopies of this plugin under the terms of the GNU General Public License.\n";
+}
+
+sub support () {
+  my $support='Send email to gerhard.lausser@consol.de if you have questions\nregarding use of this software. \nPlease include version information with all correspondence (when possible,\nuse output from the --version option of the plugin itself).\n';
+  $support =~ s/@/\@/g;
+  $support =~ s/\\n/\n/g;
+  print $support;
+}
+
+sub contact_author ($$) {
+  my $item = shift;
+  my $strangepattern = shift;
+  if ($commandline{verbose}) {
+    printf STDERR
+        "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n".
+        "You found a line which is not recognized by %s\n".
+        "This means, certain components of your system cannot be checked.\n".
+        "Please contact the author %s and\nsend him the following output:\n\n".
+        "%s /%s/\n\nThank you!\n".
+        "++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\n",
+            $PROGNAME, $CONTACT, $item, $strangepattern;
+  }
+}
+
+%commandline = ();
+my @params = (
+    "timeout|t=i",
+    "version|V",
+    "help|h",
+    "verbose|v",
+    "debug|d",
+    "hostname|H=s",
+    "database=s",
+    "port|P=s",
+    "socket|S=s",
+    "username|u=s",
+    "password|p=s",
+    "mode|m=s",
+    "name=s",
+    "name2=s",
+    "regexp",
+    "perfdata",
+    "warning=s",
+    "critical=s",
+    "dbthresholds:s",
+    "absolute|a",
+    "environment|e=s%",
+    "method=s",
+    "runas|r=s",
+    "scream",
+    "shell",
+    "eyecandy",
+    "encode",
+    "units=s",
+    "lookback=i",
+    "3",
+    "statefilesdir=s",
+    "with-mymodules-dyn-dir=s",
+    "report=s",
+    "labelformat=s",
+    "extra-opts:s");
+
+if (! GetOptions(\%commandline, @params)) {
+  print_help();
+  exit $ERRORS{UNKNOWN};
+}
+
+if (exists $commandline{'extra-opts'}) {
+  # read the extra file and overwrite other parameters
+  my $extras = Extraopts->new(file => $commandline{'extra-opts'}, commandline =>
+ \%commandline);
+  if (! $extras->is_valid()) {
+    printf "extra-opts are not valid: %s\n", $extras->{errors};
+    exit $ERRORS{UNKNOWN};
+  } else {
+    $extras->overwrite();
+  }
+}
+
+if (exists $commandline{version}) {
+  print_revision($PROGNAME, $REVISION);
+  exit $ERRORS{OK};
+}
+
+if (exists $commandline{help}) {
+  print_help();
+  exit $ERRORS{OK};
+} elsif (! exists $commandline{mode}) {
+  printf "Please select a mode\n";
+  print_help();
+  exit $ERRORS{OK};
+}
+
+if ($commandline{mode} eq "encode") {
+  my $input = <>;
+  chomp $input;
+  $input =~ s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
+  printf "%s\n", $input;
+  exit $ERRORS{OK};
+}
+
+if (exists $commandline{3}) {
+  $ENV{NRPE_MULTILINESUPPORT} = 1;
+}
+
+if (exists $commandline{timeout}) {
+  $TIMEOUT = $commandline{timeout};
+}
+
+if (exists $commandline{verbose}) {
+  $DBD::MySQL::Server::verbose = exists $commandline{verbose};
+}
+
+if (exists $commandline{scream}) {
+#  $DBD::MySQL::Server::hysterical = exists $commandline{scream};
+}
+
+if (exists $commandline{method}) {
+  # snmp or mysql cmdline
+} else {
+  $commandline{method} = "dbi";
+}
+
+if (exists $commandline{report}) {
+  # short, long, html
+} else {
+  $commandline{report} = "long";
+}
+
+if (exists $commandline{labelformat}) {
+  # groundwork
+} else {
+  $commandline{labelformat} = "pnp4nagios";
+}
+
+if (exists $commandline{'with-mymodules-dyn-dir'}) {
+  $DBD::MySQL::Server::my_modules_dyn_dir = $commandline{'with-mymodules-dyn-dir'};
+} else {
+  $DBD::MySQL::Server::my_modules_dyn_dir = '/usr/local/nagios/libexec';
+}
+
+if (exists $commandline{environment}) {
+  # if the desired environment variable values are different from
+  # the environment of this running script, then a restart is necessary.
+  # because setting $ENV does _not_ change the environment of the running script.
+  foreach (keys %{$commandline{environment}}) {
+    if ((! $ENV{$_}) || ($ENV{$_} ne $commandline{environment}->{$_})) {
+      $needs_restart = 1;
+      $ENV{$_} = $commandline{environment}->{$_};
+      printf STDERR "new %s=%s forces restart\n", $_, $ENV{$_} 
+          if $DBD::MySQL::Server::verbose;
+    }
+  }
+  # e.g. called with --runas dbnagio. shlib_path environment variable is stripped
+  # during the sudo.
+  # so the perl interpreter starts without a shlib_path. but --runas cares for
+  # a --environment shlib_path=...
+  # so setting the environment variable in the code above and restarting the 
+  # perl interpreter will help it find shared libs
+}
+
+if (exists $commandline{runas}) {
+  # remove the runas parameter
+  # exec sudo $0 ... the remaining parameters
+  $needs_restart = 1;
+  # if the calling script has a path for shared libs and there is no --environment
+  # parameter then the called script surely needs the variable too.
+  foreach my $important_env qw(LD_LIBRARY_PATH SHLIB_PATH 
+      ORACLE_HOME TNS_ADMIN ORA_NLS ORA_NLS33 ORA_NLS10) {
+    if ($ENV{$important_env} && ! scalar(grep { /^$important_env=/ } 
+        keys %{$commandline{environment}})) {
+      $commandline{environment}->{$important_env} = $ENV{$important_env};
+      printf STDERR "add important --environment %s=%s\n", 
+          $important_env, $ENV{$important_env} if $DBD::MySQL::Server::verbose;
+    }
+  }
+}
+
+if ($needs_restart) {
+  my @newargv = ();
+  my $runas = undef;
+  if (exists $commandline{runas}) {
+    $runas = $commandline{runas};
+    delete $commandline{runas};
+  }
+  foreach my $option (keys %commandline) {
+    if (grep { /^$option/ && /=/ } @params) {
+      if (ref ($commandline{$option}) eq "HASH") {
+        foreach (keys %{$commandline{$option}}) {
+          push(@newargv, sprintf "--%s", $option);
+          push(@newargv, sprintf "%s=%s", $_, $commandline{$option}->{$_});
+        }
+      } else {
+        push(@newargv, sprintf "--%s", $option);
+        push(@newargv, sprintf "%s", $commandline{$option});
+      }
+    } else {
+      push(@newargv, sprintf "--%s", $option);
+    }
+  }
+  if ($runas) {
+    exec "sudo", "-S", "-u", $runas, $0, @newargv;
+  } else {
+    exec $0, @newargv;  
+    # this makes sure that even a SHLIB or LD_LIBRARY_PATH are set correctly
+    # when the perl interpreter starts. Setting them during runtime does not
+    # help loading e.g. libclntsh.so
+  }
+  exit;
+}
+
+if (exists $commandline{shell}) {
+  # forget what you see here.
+  system("/bin/sh");
+}
+
+if (! exists $commandline{statefilesdir}) {
+  if (exists $ENV{OMD_ROOT}) {
+    $commandline{statefilesdir} = $ENV{OMD_ROOT}."/var/tmp/check_mysql_health";
+  } else {
+    $commandline{statefilesdir} = $STATEFILESDIR;
+  }
+}
+
+if (exists $commandline{name}) {
+  # objects can be encoded like an url
+  # with s/([^A-Za-z0-9])/sprintf("%%%02X", ord($1))/seg;
+  if (($commandline{mode} ne "sql") || 
+      (($commandline{mode} eq "sql") &&
+       ($commandline{name} =~ /select%20/i))) { # protect ... like '%cac%' ... from decoding
+    $commandline{name} =~ s/\%([A-Fa-f0-9]{2})/pack('C', hex($1))/seg;
+  }
+  if ($commandline{name} =~ /^0$/) {
+    # without this, $params{selectname} would be treated like undef
+    $commandline{name} = "00";
+  } 
+}
+
+$SIG{'ALRM'} = sub {
+  printf "UNKNOWN - %s timed out after %d seconds\n", $PROGNAME, $TIMEOUT;
+  exit $ERRORS{UNKNOWN};
+};
+alarm($TIMEOUT);
+
+my $nagios_level = $ERRORS{UNKNOWN};
+my $nagios_message = "";
+my $perfdata = "";
+if ($commandline{mode} =~ /^my-([^\-.]+)/) {
+  my $param = $commandline{mode};
+  $param =~ s/\-/::/g;
+  push(@modes, [$param, $commandline{mode}, undef, 'my extension']);
+} elsif ((! grep { $commandline{mode} eq $_ } map { $_->[1] } @modes) &&
+    (! grep { $commandline{mode} eq $_ } map { defined $_->[2] ? @{$_->[2]} : () } @modes)) {
+  printf "UNKNOWN - mode %s\n", $commandline{mode};
+  print_usage();
+  exit 3;
+}
+
+my %params = (
+    timeout => $TIMEOUT,
+    mode => (
+        map { $_->[0] }
+        grep {
+           ($commandline{mode} eq $_->[1]) ||
+           ( defined $_->[2] && grep { $commandline{mode} eq $_ } @{$_->[2]})
+        } @modes
+    )[0],
+    cmdlinemode => $commandline{mode},
+    method => $commandline{method} ||
+        $ENV{NAGIOS__SERVICEMYSQL_METH} ||
+        $ENV{NAGIOS__HOSTMYSQL_METH} || 'dbi',
+    hostname => $commandline{hostname} || 
+        $ENV{NAGIOS__SERVICEMYSQL_HOST} ||
+        $ENV{NAGIOS__HOSTMYSQL_HOST} || 'localhost',
+    database => $commandline{database} || 
+        $ENV{NAGIOS__SERVICEMYSQL_DATABASE} ||
+        $ENV{NAGIOS__HOSTMYSQL_DATABASE} || 'information_schema',
+    port => $commandline{port}  || (($commandline{mode} =~ /^cluster/) ?
+        ($ENV{NAGIOS__SERVICENDBMGM_PORT} || $ENV{NAGIOS__HOSTNDBMGM_PORT} || 1186) :
+        ($ENV{NAGIOS__SERVICEMYSQL_PORT} || $ENV{NAGIOS__HOSTMYSQL_PORT} || 3306)),
+    socket => $commandline{socket}  || 
+        $ENV{NAGIOS__SERVICEMYSQL_SOCKET} ||
+        $ENV{NAGIOS__HOSTMYSQL_SOCKET},
+    username => $commandline{username} || 
+        $ENV{NAGIOS__SERVICEMYSQL_USER} ||
+        $ENV{NAGIOS__HOSTMYSQL_USER},
+    password => $commandline{password} || 
+        $ENV{NAGIOS__SERVICEMYSQL_PASS} ||
+        $ENV{NAGIOS__HOSTMYSQL_PASS},
+    warningrange => $commandline{warning},
+    criticalrange => $commandline{critical},
+    dbthresholds => $commandline{dbthresholds},
+    absolute => $commandline{absolute},
+    lookback => $commandline{lookback},
+    selectname => $commandline{name} || $commandline{tablespace} || $commandline{datafile},
+    regexp => $commandline{regexp},
+    name => $commandline{name},
+    name2 => $commandline{name2} || $commandline{name},
+    units => $commandline{units},
+    lookback => $commandline{lookback} || 0,
+    eyecandy => $commandline{eyecandy},
+    statefilesdir => $commandline{statefilesdir},
+    verbose => $commandline{verbose},
+    report => $commandline{report},
+    labelformat => $commandline{labelformat},
+);
+
+my $server = undef;
+my $cluster = undef;
+
+if ($params{mode} =~ /^(server|my)/) {
+  $server = DBD::MySQL::Server->new(%params);
+  $server->nagios(%params);
+  $server->calculate_result(\%labels);
+  $nagios_message = $server->{nagios_message};
+  $nagios_level = $server->{nagios_level};
+  $perfdata = $server->{perfdata};
+} elsif ($params{mode} =~ /^cluster/) {
+  $cluster = DBD::MySQL::Cluster->new(%params);
+  $cluster->nagios(%params);
+  $cluster->calculate_result(\%labels);
+  $nagios_message = $cluster->{nagios_message};
+  $nagios_level = $cluster->{nagios_level};
+  $perfdata = $cluster->{perfdata};
+}
+
+printf "%s - %s", $ERRORCODES{$nagios_level}, $nagios_message;
+printf " | %s", $perfdata if $perfdata;
+printf "\n";
+exit $nagios_level;
+
+
+__END__
+
+
diff --git a/puppet/modules/nagios/files/plugins/check_openvpn_server.pl b/puppet/modules/nagios/files/plugins/check_openvpn_server.pl
new file mode 100755
index 00000000..b74ace89
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_openvpn_server.pl
@@ -0,0 +1,109 @@
+#!/usr/bin/perl
+#
+# Filaname: check_openvpn
+# Created:  2012-06-15
+# Website:  http://blog.kernelpicnic.net
+#
+# Description:
+# This script is for verifying the status of an OpenVPN daemon. It has been
+# written to integrate directly with Nagios / Opsview.
+#
+# Usage:
+#    check_openvpn [OPTIONS]...
+#
+#      -H, --hostname      Host to check
+#      -p, --port          Port number to check
+#      -h, --help          Display help.
+#
+#############################################################################
+
+# Custom library path for Nagis modules.
+use lib qw ( /usr/local/nagios/perl/lib );
+
+# Enforce sanity.
+use strict;
+use warnings;
+
+# Required modules.
+use Getopt::Long qw(:config no_ignore_case);
+use Nagios::Plugin;
+use IO::Socket;
+
+# Define defaults.
+my $help    = 0;
+my $timeout = 5;
+
+# Ensure required variables are set.
+my($hostname, $port);
+
+my $options = GetOptions(
+                         "hostname|H=s" => \$hostname,
+                         "timeout|t=s"  => \$timeout,
+                         "port|p=s"     => \$port,
+                         "help|h"       => \$help,
+);
+
+# Check if help has been requested.
+if($help || !$hostname || !$port) {
+
+    printf("\n");
+    printf("Usage: check_openvpn [OPTIONS]...\n\n");
+    printf("  -H, --hostname      Host to check\n");
+    printf("  -p, --port          Port number to check\n");
+    printf("  -h, --help          This help page\n");
+    printf("  -t, --timeout       Socket timeout\n");
+    printf("\n");
+
+    exit(-1);
+
+}
+
+# Setup a new Nagios::Plugin object.
+my $nagios = Nagios::Plugin->new();
+
+# Define the check string to send to the OpenVPN server - as binary due
+# to non-printable characters.
+my $check_string = "001110000011001010010010011011101000000100010001110"
+                  ."100110110101010110011000000000000000000000000000000"
+                  ."0000000000";
+
+# Attempt to setup a socket to the specified host.
+my $host_sock = IO::Socket::INET->new(
+                                      Proto    => 'udp',
+                                      PeerAddr => $hostname,
+                                      PeerPort => $port,
+);
+
+# Ensure we have a socket.
+if(!$host_sock) {
+    $nagios->nagios_exit(UNKNOWN, "Unable to bind socket");
+}
+
+# Fire off the check request.
+$host_sock->send(pack("B*", $check_string));
+
+# Wait for $timeout for response for a response, otherwise, fail.
+my $response;
+
+eval {
+
+    # Define how to handle ALARM.
+    local $SIG{ALRM} = sub {
+        $nagios->nagios_exit(CRITICAL, "No response received");
+    };
+
+    # Set the alarm for the given timeout value.
+    alarm($timeout);
+
+    # Check for response.
+    $host_sock->recv($response, 1)
+      or $nagios->nagios_exit(CRITICAL, "No response received");
+
+    # Alright, response received, cancel alarm.
+    alarm(0);
+    1;
+
+};
+
+# Reply received, return okay.
+$nagios->nagios_exit(OK, "Response received from host");
diff --git a/puppet/modules/nagios/files/plugins/check_pop3_login b/puppet/modules/nagios/files/plugins/check_pop3_login
new file mode 100644
index 00000000..4eb29b88
--- /dev/null
+++ b/puppet/modules/nagios/files/plugins/check_pop3_login
@@ -0,0 +1,83 @@
+#!/usr/bin/python
+# -*- coding: UTF-8 -*-
+# -*- Mode: Python -*-
+#
+# Copyright (C) 2006 Bertera Pietro <pietro@bertera.it>
+# Copyright (C) 2015 mh <mh@immerda.ch>
+# Response time monitoring with perfdata modification by Ivan Savcic <isavcic@gmail.com> and Milos Buncic, 2012.
+# Derived from: https://github.com/isavcic/check_imap_login
+
+# This file may be distributed and/or modified under the terms of
+# the GNU General Public License version 2 as published by
+# the Free Software Foundation.
+# This file is distributed without any warranty; without even the implied
+# warranty of merchantability or fitness for a particular purpose.
+
+import sys, os, poplib, getopt
+from time import time
+
+def usage():
+  print sys.argv[0] + " -u <user> -p <password> -H <host> [-s] -w <warning threshold (sec)> -c <critical threshold (sec)>\n -s is for using POP3s"
+
+def main():
+  try:
+    opts, args = getopt.getopt(sys.argv[1:], "u:p:sH:w:c:")
+  except getopt.GetoptError:
+    usage()
+    return 3
+
+  user = host = password = use_ssl = warning = critical = None
+
+  for o, a in opts:
+    if o == "-u":
+      user = a
+    elif o == "-p":
+      password = a
+    elif o == "-s":
+      use_ssl = True
+    elif o == "-H":
+      host = a
+    elif o == "-w":
+      warning = float(a)
+    elif o == "-c":
+      critical = float(a)
+
+  if user == None or password == None or host == None or warning == None or critical == None:
+    usage()
+    return 1
+
+  if use_ssl:
+    M = poplib.POP3_SSL(host=host)
+  else:
+    M = poplib.POP3(host)
+
+  timestamp = time()
+
+  try:
+    M.getwelcome()
+    M.user(user)
+    M.pass_(password)
+  except Exception, e:
+    print "CRITICAL POP3 Login Failed: %s" % e
+    return 2
+
+  M.quit()
+
+  timestamp = time() - timestamp
+
+  if timestamp < warning:
+    status = "OK"
+    exitcode = 0
+  if timestamp >= warning:
+    status = "WARNING"
+    exitcode = 1
+  if timestamp >= critical:
+    status = "CRITICAL"
+    exitcode = 2
+
+  print '%s POP3 Login | response_time=%.3fs;%.3f;%.3f' % (status, timestamp, warning, critical)
+
+  return exitcode
+
+if __name__ == "__main__":
+  sys.exit(main())
diff --git a/puppet/modules/nagios/files/pnp4nagios/action.gif b/puppet/modules/nagios/files/pnp4nagios/action.gif
new file mode 100644
index 00000000..96571a40
Binary files /dev/null and b/puppet/modules/nagios/files/pnp4nagios/action.gif differ
diff --git a/puppet/modules/nagios/files/pnp4nagios/apache.conf b/puppet/modules/nagios/files/pnp4nagios/apache.conf
new file mode 100644
index 00000000..816bf05c
--- /dev/null
+++ b/puppet/modules/nagios/files/pnp4nagios/apache.conf
@@ -0,0 +1,31 @@
+# SAMPLE CONFIG SNIPPETS FOR APACHE WEB SERVER
+
+Alias /pnp4nagios "/usr/share/pnp4nagios/html"
+
+<Directory "/usr/share/pnp4nagios/html">
+        AllowOverride None
+        Order allow,deny
+        Allow from all
+        #
+        # Use the same value as defined in nagios.conf
+        #
+        AuthName "Nagios Access"
+        AuthType Basic
+        AuthUserFile /etc/nagios3/htpasswd.users
+        Require valid-user
+        <IfModule mod_rewrite.c>
+                # Turn on URL rewriting
+                RewriteEngine On
+                Options FollowSymLinks
+                # Installation directory
+                RewriteBase /pnp4nagios/
+                # Protect application and system files from being viewed
+                RewriteRule ^(application|modules|system) - [F,L]
+                # Allow any files or directories that exist to be displayed directly
+                RewriteCond %{REQUEST_FILENAME} !-f
+                RewriteCond %{REQUEST_FILENAME} !-d
+                # Rewrite all other URLs to index.php/URL
+                RewriteRule .* index.php/$0 [PT,L]
+        </IfModule>
+        DirectoryIndex index.php
+</Directory>
diff --git a/puppet/modules/nagios/files/pnp4nagios/npcd b/puppet/modules/nagios/files/pnp4nagios/npcd
new file mode 100644
index 00000000..64b3d4d9
--- /dev/null
+++ b/puppet/modules/nagios/files/pnp4nagios/npcd
@@ -0,0 +1,8 @@
+# Default settings for the NPCD init script.
+
+# Should NPCD be started? ("yes" to enable)
+RUN="yes"
+
+# Additional options that are passed to the daemon.
+DAEMON_OPTS="-d -f /etc/pnp4nagios/npcd.cfg"
+
diff --git a/puppet/modules/nagios/files/pnp4nagios/pnp4nagios-popup-templates.cfg b/puppet/modules/nagios/files/pnp4nagios/pnp4nagios-popup-templates.cfg
new file mode 100644
index 00000000..de17d841
--- /dev/null
+++ b/puppet/modules/nagios/files/pnp4nagios/pnp4nagios-popup-templates.cfg
@@ -0,0 +1,31 @@
+# http://docs.pnp4nagios.org/de/pnp-0.6/webfe
+
+define host {
+   name       host-pnp
+   action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=_HOST_' class='tips' rel='/pnp4nagios/index.php/popup?host=$HOSTNAME$&srv=_HOST_
+   register   0
+}
+
+define service {
+   name       srv-pnp
+   action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=$SERVICEDESC$' class='tips' rel='/pnp4nagios/index.php/popup?host=$HOSTNAME$&srv=$SERVICEDESC$
+   register   0
+}
+
+# templates for explicit use, i.e.
+# use => 'generic-host-pnp'
+
+define host {
+    name        generic-host-pnp
+    use         generic-host,host-pnp
+#   action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=_HOST_
+   register   0
+}
+
+define service {
+    name        generic-service-pnp
+    use         generic-service,srv-pnp
+#   action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=_HOST_
+   register   0
+}
+
diff --git a/puppet/modules/nagios/files/pnp4nagios/pnp4nagios-templates.cfg b/puppet/modules/nagios/files/pnp4nagios/pnp4nagios-templates.cfg
new file mode 100644
index 00000000..64c51865
--- /dev/null
+++ b/puppet/modules/nagios/files/pnp4nagios/pnp4nagios-templates.cfg
@@ -0,0 +1,33 @@
+# http://docs.pnp4nagios.org/de/pnp-0.6/webfe
+
+# templates for additional use, i.e.
+# use => 'generic-host,host-pnp'
+define host {
+   name       host-pnp
+   action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=_HOST_
+   register   0
+}
+
+define service {
+   name       srv-pnp
+   action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=$SERVICEDESC$
+   register   0
+}
+
+# templates for explicit use, i.e.
+# use => 'generic-host-pnp'
+
+define host {
+    name	generic-host-pnp
+    use		generic-host,host-pnp
+#   action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=_HOST_
+   register   0
+}
+
+define service {
+    name        generic-service-pnp
+    use         generic-service,srv-pnp
+#   action_url /pnp4nagios/index.php/graph?host=$HOSTNAME$&srv=_HOST_
+   register   0
+}
+
diff --git a/puppet/modules/nagios/files/pnp4nagios/status-header.ssi b/puppet/modules/nagios/files/pnp4nagios/status-header.ssi
new file mode 100644
index 00000000..472be3a2
--- /dev/null
+++ b/puppet/modules/nagios/files/pnp4nagios/status-header.ssi
@@ -0,0 +1,8 @@
+<script src="/pnp4nagios/media/js/jquery-min.js" type="text/javascript"></script>
+<script src="/pnp4nagios/media/js/jquery.cluetip.js" type="text/javascript"></script>
+<script type="text/javascript">
+$(document).ready(function() {
+  $('a.tips').cluetip({ajaxCache: false, dropShadow: false,showTitle: false });
+});
+</script>
+
diff --git a/puppet/modules/nagios/images/nagiosgraph.gif b/puppet/modules/nagios/images/nagiosgraph.gif
new file mode 100644
index 00000000..068082af
Binary files /dev/null and b/puppet/modules/nagios/images/nagiosgraph.gif differ
diff --git a/puppet/modules/nagios/manifests/apache.pp b/puppet/modules/nagios/manifests/apache.pp
new file mode 100644
index 00000000..87fe3d2f
--- /dev/null
+++ b/puppet/modules/nagios/manifests/apache.pp
@@ -0,0 +1,15 @@
+# setup naguis together with apache
+class nagios::apache(
+  $allow_external_cmd = false,
+  $manage_shorewall = false,
+  $manage_munin = false,
+  $storeconfigs = true
+) {
+  class{'::nagios':
+    httpd              => 'apache',
+    allow_external_cmd => $allow_external_cmd,
+    manage_munin       => $manage_munin,
+    manage_shorewall   => $manage_shorewall,
+    storeconfigs       => $storeconfigs
+  }
+}
diff --git a/puppet/modules/nagios/manifests/base.pp b/puppet/modules/nagios/manifests/base.pp
new file mode 100644
index 00000000..18d5c12f
--- /dev/null
+++ b/puppet/modules/nagios/manifests/base.pp
@@ -0,0 +1,144 @@
+# basic stuff for nagios
+class nagios::base {
+  # include the variables
+  include ::nagios::defaults::vars
+
+  package { 'nagios':
+    ensure  => present,
+  }
+
+  service { 'nagios':
+    ensure  => running,
+    enable  => $nagios::service_at_boot,
+    require => Package['nagios'],
+  }
+
+  $cfg_dir = $nagios::defaults::vars::int_cfgdir
+  # this file should contain all the nagios_puppet-paths:
+  file{
+    'nagios_cfgdir':
+      ensure  => directory,
+      path    => $cfg_dir,
+      alias   => nagios_confd,
+      recurse => true,
+      purge   => true,
+      force   => true,
+      require => Package['nagios'],
+      notify  => Service['nagios'],
+      owner   => root,
+      group   => root,
+      mode    => '0755';
+    'nagios_main_cfg':
+      path    => "${cfg_dir}/nagios.cfg",
+      source  => [ "puppet:///modules/site_nagios/configs/${::fqdn}/nagios.cfg",
+                    "puppet:///modules/site_nagios/configs/${::operatingsystem}/nagios.cfg",
+                    'puppet:///modules/site_nagios/configs/nagios.cfg',
+                    "puppet:///modules/nagios/configs/${::operatingsystem}/nagios.cfg",
+                    'puppet:///modules/nagios/configs/nagios.cfg' ],
+      notify  => Service['nagios'],
+      owner   => root,
+      group   => root,
+      mode    => '0644';
+    'nagios_cgi_cfg':
+      path    => "${cfg_dir}/cgi.cfg",
+      source  => [ "puppet:///modules/site_nagios/configs/${::fqdn}/cgi.cfg",
+                    "puppet:///modules/site_nagios/configs/${::operatingsystem}/cgi.cfg",
+                    'puppet:///modules/site_nagios/configs/cgi.cfg',
+                    "puppet:///modules/nagios/configs/${::operatingsystem}/cgi.cfg",
+                    'puppet:///modules/nagios/configs/cgi.cfg' ],
+      notify  => Service['apache'],
+      owner   => 'root',
+      group   => 0,
+      mode    => '0644';
+    'nagios_htpasswd':
+      path    => "${cfg_dir}/htpasswd.users",
+      source  => [ 'puppet:///modules/site_nagios/htpasswd.users',
+                    'puppet:///modules/nagios/htpasswd.users' ],
+      owner   => root,
+      group   => apache,
+      mode    => '0640';
+    'nagios_resource_cfg':
+      path    => "${cfg_dir}/resource.cfg",
+      source  => [ "puppet:///modules/site_nagios/configs/${::operatingsystem}/private/resource.cfg.${::architecture}",
+                    "puppet:///modules/nagios/configs/${::operatingsystem}/private/resource.cfg.${::architecture}" ],
+      notify  => Service['nagios'],
+      owner   => root,
+      group   => nagios,
+      mode    => '0640';
+  }
+
+  if $cfg_dir == '/etc/nagios3' {
+    file{'/etc/nagios':
+      ensure => link,
+      target => $cfg_dir,
+      before => File['nagios_cfgdir'],
+    }
+  }
+
+  file{
+    [ "${cfg_dir}/nagios_command.cfg",
+      "${cfg_dir}/nagios_contact.cfg",
+      "${cfg_dir}/nagios_contactgroup.cfg",
+      "${cfg_dir}/nagios_host.cfg",
+      "${cfg_dir}/nagios_hostdependency.cfg",
+      "${cfg_dir}/nagios_hostescalation.cfg",
+      "${cfg_dir}/nagios_hostextinfo.cfg",
+      "${cfg_dir}/nagios_hostgroup.cfg",
+      "${cfg_dir}/nagios_hostgroupescalation.cfg",
+      "${cfg_dir}/nagios_service.cfg",
+      "${cfg_dir}/nagios_servicedependency.cfg",
+      "${cfg_dir}/nagios_serviceescalation.cfg",
+      "${cfg_dir}/nagios_serviceextinfo.cfg",
+      "${cfg_dir}/nagios_servicegroup.cfg",
+      "${cfg_dir}/nagios_timeperiod.cfg" ]:
+      ensure  => file,
+      replace => false,
+      notify  => Service['nagios'],
+      require => File['nagios_cfgdir'],
+      owner   => root,
+      group   => 0,
+      mode    => '0644';
+  }
+
+  resources {
+    [
+      'nagios_command',
+      'nagios_contactgroup',
+      'nagios_contact',
+      'nagios_hostdependency',
+      'nagios_hostescalation',
+      'nagios_hostextinfo',
+      'nagios_hostgroup',
+      'nagios_host',
+      'nagios_servicedependency',
+      'nagios_serviceescalation',
+      'nagios_servicegroup',
+      'nagios_serviceextinfo',
+      'nagios_service',
+      'nagios_timeperiod',
+    ]:
+      notify => Service['nagios'],
+      purge  => $::nagios::purge_resources
+  }
+
+  # make sure nagios resources are defined after nagios is
+  # installed and the nagios_cfgdir resource is present
+  File['nagios_cfgdir'] -> Nagios_command <||>
+  File['nagios_cfgdir'] -> Nagios_contactgroup <||>
+  File['nagios_cfgdir'] -> Nagios_contact <||>
+  File['nagios_cfgdir'] -> Nagios_hostdependency <||>
+  File['nagios_cfgdir'] -> Nagios_hostescalation <||>
+  File['nagios_cfgdir'] -> Nagios_hostextinfo <||>
+  File['nagios_cfgdir'] -> Nagios_hostgroup <||>
+  File['nagios_cfgdir'] -> Nagios_host <||>
+  File['nagios_cfgdir'] -> Nagios_servicedependency <||>
+  File['nagios_cfgdir'] -> Nagios_serviceescalation <||>
+  File['nagios_cfgdir'] -> Nagios_servicegroup <||>
+  File['nagios_cfgdir'] -> Nagios_serviceextinfo <||>
+  File['nagios_cfgdir'] -> Nagios_service <||>
+  File['nagios_cfgdir'] -> Nagios_timeperiod <||>
+
+  if ( $nagios::storeconfigs == true ) {
+    include ::nagios::storeconfigs
+  }
+}
diff --git a/puppet/modules/nagios/manifests/centos.pp b/puppet/modules/nagios/manifests/centos.pp
new file mode 100644
index 00000000..f41d46dc
--- /dev/null
+++ b/puppet/modules/nagios/manifests/centos.pp
@@ -0,0 +1,42 @@
+# centos specific changes
+class nagios::centos inherits nagios::base {
+
+  package { [ 'nagios-plugins', 'nagios-plugins-smtp','nagios-plugins-http',
+      'nagios-plugins-ssh', 'nagios-plugins-tcp', 'nagios-plugins-dig',
+      'nagios-plugins-nrpe', 'nagios-plugins-load', 'nagios-plugins-dns',
+      'nagios-plugins-ping', 'nagios-plugins-procs', 'nagios-plugins-users',
+      'nagios-plugins-ldap', 'nagios-plugins-disk', 'nagios-plugins-swap',
+      'nagios-plugins-nagios', 'nagios-plugins-perl', 'nagios-plugins-ntp',
+      'nagios-plugins-snmp' ]:
+      ensure => 'present',
+      notify => Service['nagios'],
+  }
+
+  Service['nagios']{
+    hasstatus => true,
+  }
+
+  file{
+    'nagios_private':
+      ensure  => directory,
+      path    => "${nagios::base::cfg_dir}/private",
+      purge   => true,
+      recurse => true,
+      notify  => Service['nagios'],
+      owner   => root,
+      group   => nagios,
+      mode    => '0750';
+  }
+  File['nagios_resource_cfg']{
+    path => "${nagios::base::cfg_dir}/private/resource.cfg",
+  }
+  if $nagios::allow_external_cmd {
+    file{'/var/spool/nagios/cmd':
+      ensure  => 'directory',
+      require => Package['nagios'],
+      owner   => apache,
+      group   => nagios,
+      mode    => '2660',
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/command/imap_pop3.pp b/puppet/modules/nagios/manifests/command/imap_pop3.pp
new file mode 100644
index 00000000..42e4092b
--- /dev/null
+++ b/puppet/modules/nagios/manifests/command/imap_pop3.pp
@@ -0,0 +1,30 @@
+# manage mail checks
+class nagios::command::imap_pop3 {
+  require ::nagios::plugins::mail_login
+  case $::operatingsystem {
+    'Debian','Ubuntu': { }  # Debian/Ubuntu already define those checks
+    default: {
+      nagios_command {
+        'check_imap':
+          command_line => '$USER1$/check_imap -H $ARG1$ -p $ARG2$';
+      }
+    }
+  }
+
+  nagios_command {
+    'check_imap_ssl':
+      command_line => '$USER1$/check_imap -H $ARG1$ -p $ARG2$ -S';
+    'check_pop3':
+      command_line => '$USER1$/check_pop -H $ARG1$ -p $ARG2$';
+    'check_pop3_ssl':
+      command_line => '$USER1$/check_pop -H $ARG1$ -p $ARG2$ -S';
+    'check_managesieve':
+      command_line => '$USER1$/check_tcp -H $ARG1$ -p 4190';
+    'check_managesieve_legacy':
+      command_line => '$USER1$/check_tcp -H $ARG1$ -p 2000';
+    'check_imap_login':
+      command_line => '$USER1$/check_imap_login -s -H $ARG1$ -u $ARG2$ -p $ARG3$ -w $ARG4$ -c $ARG5$';
+    'check_pop3_login':
+      command_line => '$USER1$/check_pop3_login -s -H $ARG1$ -u $ARG2$ -p $ARG3$ -w $ARG4$ -c $ARG5$';
+  }
+}
diff --git a/puppet/modules/nagios/manifests/command/nrpe.pp b/puppet/modules/nagios/manifests/command/nrpe.pp
new file mode 100644
index 00000000..7539a266
--- /dev/null
+++ b/puppet/modules/nagios/manifests/command/nrpe.pp
@@ -0,0 +1,14 @@
+class nagios::command::nrpe {
+
+  # this command runs a program $ARG1$ with arguments $ARG2$
+  nagios_command {
+    'check_nrpe':
+       command_line => '/usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$ -a $ARG2$'
+  }
+
+  # this command runs a program $ARG1$ with no arguments
+  nagios_command {
+    'check_nrpe_1arg':
+       command_line => '/usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$'
+  }
+}
diff --git a/puppet/modules/nagios/manifests/command/nrpe_timeout.pp b/puppet/modules/nagios/manifests/command/nrpe_timeout.pp
new file mode 100644
index 00000000..799f2fc3
--- /dev/null
+++ b/puppet/modules/nagios/manifests/command/nrpe_timeout.pp
@@ -0,0 +1,11 @@
+class nagios::command::nrpe_timeout {
+  nagios_command {
+    'check_nrpe_timeout':
+      command_line => '/usr/lib/nagios/plugins/check_nrpe -t $ARG1$ -H $HOSTADDRESS$ -c $ARG2$ -a $ARG3$',
+      require      => Package['nagios-nrpe-server'];
+
+    'check_nrpe_1arg_timeout':
+      command_line => '/usr/lib/nagios/plugins/check_nrpe -t $ARG1$ -H $HOSTADDRESS$ -c $ARG2$',
+      require      => Package['nagios-nrpe-server']
+  }
+}
diff --git a/puppet/modules/nagios/manifests/command/smtp.pp b/puppet/modules/nagios/manifests/command/smtp.pp
new file mode 100644
index 00000000..29d97f8b
--- /dev/null
+++ b/puppet/modules/nagios/manifests/command/smtp.pp
@@ -0,0 +1,22 @@
+class nagios::command::smtp {
+  case $operatingsystem {
+    debian,ubuntu: { }  # Debian/Ubuntu already define those checks
+    default: {
+      nagios_command {
+        'check_smtp':
+           command_line => '$USER1$/check_smtp -H $ARG1$ -p $ARG2$';
+        'check_ssmtp':
+           command_line => '$USER1$/check_ssmtp -H $ARG1$ -p $ARG2$ -S';
+      }
+    }
+  }
+
+  nagios_command {
+    'check_smtp_tls':
+       command_line => '$USER1$/check_smtp -H $ARG1$ -p $ARG2$ -S';
+    'check_smtp_cert':
+       command_line => '$USER1$/check_smtp -H $ARG1$ -p $ARG2$ -S -D $ARG3$';
+    'check_ssmtp_cert':
+       command_line => '$USER1$/check_ssmtp -H $ARG1$ -p $ARG2$ -S -D $ARG3$';
+  }
+}
diff --git a/puppet/modules/nagios/manifests/debian.pp b/puppet/modules/nagios/manifests/debian.pp
new file mode 100644
index 00000000..39af973e
--- /dev/null
+++ b/puppet/modules/nagios/manifests/debian.pp
@@ -0,0 +1,54 @@
+# debian specific things
+class nagios::debian inherits nagios::base {
+
+  Package['nagios'] { name => 'nagios3' }
+
+  package { [ 'nagios-plugins', 'nagios-snmp-plugins','nagios-nrpe-plugin' ]:
+      ensure => 'present',
+      notify => Service['nagios'],
+  }
+
+  Service['nagios'] {
+      name      => 'nagios3',
+      hasstatus => true,
+  }
+
+  File['nagios_htpasswd', 'nagios_cgi_cfg'] { group => 'www-data' }
+
+  file{
+    'nagios_commands_cfg':
+      path    => "${nagios::defaults::vars::int_cfgdir}/commands.cfg",
+      notify  => Service['nagios'],
+      owner   => root,
+      group   => root,
+      mode    => '0644',
+      require => Package['nagios'];
+    "${nagios::defaults::vars::int_cfgdir}/stylesheets":
+      ensure  => directory,
+      purge   => false,
+      recurse => true,
+      require => Package['nagios'];
+  }
+
+  if $nagios::allow_external_cmd {
+    exec { 'nagios_external_cmd_perms_overrides':
+      command   => 'dpkg-statoverride --update --add nagios www-data 2710 /var/lib/nagios3/rw && dpkg-statoverride --update --add nagios nagios 751 /var/lib/nagios3',
+      unless    => 'dpkg-statoverride --list nagios www-data 2710 /var/lib/nagios3/rw && dpkg-statoverride --list nagios nagios 751 /var/lib/nagios3',
+      logoutput => false,
+      notify    => Service['nagios'],
+      require   => Package['nagios'],
+    }
+    exec { 'nagios_external_cmd_perms_1':
+      command => 'chmod 0751 /var/lib/nagios3 && chown nagios:nagios /var/lib/nagios3',
+      unless  => 'test "`stat -c "%a %U %G" /var/lib/nagios3`" = "751 nagios nagios"',
+      notify  => Service['nagios'],
+      require => Package['nagios'],
+    }
+    exec { 'nagios_external_cmd_perms_2':
+      command => 'chmod 2751 /var/lib/nagios3/rw && chown nagios:www-data /var/lib/nagios3/rw',
+      unless  => 'test "`stat -c "%a %U %G" /var/lib/nagios3/rw`" = "2751 nagios www-data"',
+      notify  => Service['nagios'],
+      require => Package['nagios'],
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/debian/apache.pp b/puppet/modules/nagios/manifests/debian/apache.pp
new file mode 100644
index 00000000..17b60c60
--- /dev/null
+++ b/puppet/modules/nagios/manifests/debian/apache.pp
@@ -0,0 +1,22 @@
+# Handle files that are specifically needed for nagios with apache on debian
+#
+# Do not include this class directly. It is included by the nagios class and
+# needs variables from it.
+#
+class nagios::debian::apache {
+
+  include ::nagios::defaults::vars
+
+  file { "${nagios::defaults::vars::int_cfgdir}/apache2.conf":
+    source => [ "puppet:///modules/site_nagios/configs/${::fqdn}/apache2.conf",
+                'puppet:///modules/site_nagios/configs/apache2.conf',
+                'puppet:///modules/nagios/configs/apache2.conf'],
+  }
+
+  apache::config::global { 'nagios3.conf':
+    ensure  => link,
+    target  => "${nagios::defaults::vars::int_cfgdir}/apache2.conf",
+    require => File["${nagios::defaults::vars::int_cfgdir}/apache2.conf"],
+  }
+
+}
diff --git a/puppet/modules/nagios/manifests/defaults.pp b/puppet/modules/nagios/manifests/defaults.pp
new file mode 100644
index 00000000..7c25ac94
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults.pp
@@ -0,0 +1,12 @@
+class nagios::defaults {
+
+    # include some default nagios objects
+
+    include nagios::defaults::commands
+    include nagios::defaults::contactgroups
+    include nagios::defaults::contacts
+    include nagios::defaults::hostgroups
+    include nagios::defaults::templates
+    include nagios::defaults::timeperiods
+    include nagios::defaults::plugins
+}
diff --git a/puppet/modules/nagios/manifests/defaults/commands.pp b/puppet/modules/nagios/manifests/defaults/commands.pp
new file mode 100644
index 00000000..0f24411f
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/commands.pp
@@ -0,0 +1,145 @@
+# defaults commands we wanna have available
+class nagios::defaults::commands {
+
+  include ::nagios::command::smtp
+  include ::nagios::command::imap_pop3
+  include ::nagios::plugins::horde_login
+
+  # common service commands
+  case $::operatingsystem {
+    'Debian','Ubuntu': {
+      nagios_command {
+        'check_dummy':
+          command_line => '$USER1$/check_dummy $ARG1$';
+        'check_https_cert':
+          command_line => '$USER1$/check_http --ssl -C 20 -H $HOSTADDRESS$ -I $HOSTADDRESS$';
+        'check_http_url':
+          command_line => '$USER1$/check_http -H $ARG1$ -u $ARG2$';
+        'check_http_url_regex':
+          command_line => '$USER1$/check_http -H $ARG1$ -p $ARG2$ -u $ARG3$ -e $ARG4$';
+        'check_https_url':
+          command_line => '$USER1$/check_http --ssl -H $ARG1$ -u $ARG2$';
+        'check_https_url_regex':
+          command_line => '$USER1$/check_http --ssl -H $ARG1$ -u $ARG2$ -e $ARG3$';
+        'check_mysql_db':
+          command_line => '$USER1$/check_mysql -H $ARG1$ -P $ARG2$ -u $ARG3$ -p $ARG4$ -d $ARG5$';
+        'check_ntp_time':
+          command_line => '$USER1$/check_ntp_time -H $HOSTADDRESS$ -w 0.5 -c 1';
+        'check_silc':
+          command_line => '$USER1$/check_tcp -p 706 -H $ARG1$';
+        'check_sobby':
+          command_line => '$USER1$/check_tcp -H $ARG1$ -p $ARG2$';
+        'check_jabber':
+          command_line => '$USER1$/check_jabber -H $ARG1$';
+        'check_git':
+          command_line => '$USER1$/check_tcp -H $ARG1$ -p 9418';
+      }
+    }
+    default: {
+      nagios_command {
+        'check_dummy':
+          command_line => '$USER1$/check_dummy $ARG1$';
+        'check_ping':
+          command_line => '$USER1$/check_ping -H $HOSTADDRESS$ -w $ARG1$ -c $ARG2$';
+        'check-host-alive':
+          command_line => '$USER1$/check_ping -H $HOSTADDRESS$ -w 5000,100% -c 5000,100% -p 1';
+        'check_tcp':
+          command_line => '$USER1$/check_tcp -H $HOSTADDRESS$ -p $ARG1$';
+        'check_udp':
+          command_line => '$USER1$/check_udp -H $HOSTADDRESS$ -p $ARG1$';
+        'check_load':
+          command_line => '$USER1$/check_load --warning=$ARG1$,$ARG2$,$ARG3$ --critical=$ARG4$,$ARG5$,$ARG6$';
+        'check_disk':
+          command_line => '$USER1$/check_disk -w $ARG1$ -c $ARG2$ -e -p $ARG3$';
+        'check_all_disks':
+          command_line => '$USER1$/check_disk -w $ARG1$ -c $ARG2$ -e';
+        'check_ssh':
+          command_line => '$USER1$/check_ssh $HOSTADDRESS$';
+        'check_ssh_port':
+          command_line => '$USER1$/check_ssh -p $ARG1$ $HOSTADDRESS$';
+        'check_ssh_port_host':
+          command_line => '$USER1$/check_ssh -p $ARG1$ $ARG2$';
+        'check_http':
+          command_line => '$USER1$/check_http -H $HOSTADDRESS$ -I $HOSTADDRESS$';
+        'check_https':
+          command_line => '$USER1$/check_http --ssl -H $HOSTADDRESS$ -I $HOSTADDRESS$';
+        'check_https_cert':
+          command_line => '$USER1$/check_http --ssl -C 20 -H $HOSTADDRESS$ -I $HOSTADDRESS$';
+        'check_http_url':
+          command_line => '$USER1$/check_http -H $ARG1$ -u $ARG2$';
+        'check_http_url_regex':
+          command_line => '$USER1$/check_http -H $ARG1$ -p $ARG2$ -u $ARG3$ -e $ARG4$';
+        'check_https_url':
+          command_line => '$USER1$/check_http --ssl -H $ARG1$ -u $ARG2$';
+        'check_https_url_regex':
+          command_line => '$USER1$/check_http --ssl -H $ARG1$ -u $ARG2$ -e $ARG3$';
+        'check_mysql':
+          command_line => '$USER1$/check_mysql -H $ARG1$ -P $ARG2$ -u $ARG3$ -p $ARG4$';
+        'check_mysql_db':
+          command_line => '$USER1$/check_mysql -H $ARG1$ -P $ARG2$ -u $ARG3$ -p $ARG4$ -d $ARG5$';
+        'check_ntp_time':
+          command_line => '$USER1$/check_ntp_time -H $HOSTADDRESS$ -w 0.5 -c 1';
+        'check_silc':
+          command_line => '$USER1$/check_tcp -p 706 -H $ARG1$';
+        'check_sobby':
+          command_line => '$USER1$/check_tcp -H $ARG1$ -p $ARG2$';
+        'check_jabber':
+          command_line => '$USER1$/check_jabber -H $ARG1$';
+        'check_git':
+          command_line => '$USER1$/check_tcp -H $ARG1$ -p 9418';
+      }
+    }
+  }
+
+  # commands for services defined by other modules
+
+  nagios_command {
+    # from apache module
+    'http_port':
+      command_line => '$USER1$/check_http -p $ARG1$ -H $HOSTADDRESS$ -I $HOSTADDRESS$';
+
+    'check_http_port_url_content':
+      command_line => '$USER1$/check_http -H $ARG1$ -p $ARG2$ -u $ARG3$ -s $ARG4$';
+    'check_https_port_url_content':
+      command_line => '$USER1$/check_http --ssl -H $ARG1$ -p $ARG2$ -u $ARG3$ -s $ARG4$';
+    'check_http_url_content':
+      command_line => '$USER1$/check_http -H $ARG1$ -u $ARG2$ -s $ARG3$';
+    'check_https_url_content':
+      command_line => '$USER1$/check_http --ssl -H $ARG1$ -u $ARG2$ -s $ARG3$';
+
+    # from bind module
+    'check_dig2':
+      command_line => '$USER1$/check_dig -H $HOSTADDRESS$ -l $ARG1$ --record_type=$ARG2$';
+
+    # from mysql module
+    'check_mysql_health':
+      command_line => '$USER1$/check_mysql_health --hostname $ARG1$ --port $ARG2$ --username $ARG3$ --password $ARG4$ --mode $ARG5$ --database $ARG6$ $ARG7$ $ARG8$';
+
+    # better check_dns
+    'check_dns2':
+      command_line => '$USER1$/check_dns2 -c $ARG1$ A $ARG2$';
+
+    # dnsbl checking
+    'check_dnsbl':
+      command_line => '$USER1$/check_dnsbl -H $ARG1$';
+  }
+
+  # notification commands
+
+  $mail_cmd_location = $::operatingsystem ? {
+    'CentOS' => '/bin/mail',
+    default  => '/usr/bin/mail'
+  }
+
+  case $::lsbdistcodename {
+    'wheezy': { }
+    default: {
+      nagios_command {
+        'notify-host-by-email':
+          command_line => "/usr/bin/printf \"%b\" \"***** Nagios *****\\n\\nNotification Type: \$NOTIFICATIONTYPE\$\\n\\nHost:      \$HOSTNAME\$ (\$HOSTALIAS\$)\\nAddress:   \$HOSTADDRESS\$\\nState:     \$HOSTSTATE\$\\nDuration:  \$HOSTDURATION\$\\n\\nDate/Time: \$LONGDATETIME\$\\n\\nOutput:    \$HOSTOUTPUT\$\" | ${mail_cmd_location} -s \"\$NOTIFICATIONTYPE\$: \$HOSTSTATE\$ - \$HOSTNAME\$\" \$CONTACTEMAIL\$";
+        'notify-service-by-email':
+          command_line => "/usr/bin/printf \"%b\" \"***** Nagios *****\\n\\nNotification Type: \$NOTIFICATIONTYPE\$\\n\\nHost:      \$HOSTNAME\$ (\$HOSTALIAS\$)\\nAddress:   \$HOSTADDRESS\$\\n\\nService:   \$SERVICEDESC\$\\nState:     \$SERVICESTATE\$\\nDuration:  \$SERVICEDURATION\$\\n\\nDate/Time: \$LONGDATETIME\$\\n\\nOutput:    \$SERVICEOUTPUT\$\" | ${mail_cmd_location} -s \"\$NOTIFICATIONTYPE\$: \$SERVICESTATE\$ - \$HOSTALIAS\$/\$SERVICEDESC\$\" \$CONTACTEMAIL\$";
+      }
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/defaults/contactgroups.pp b/puppet/modules/nagios/manifests/defaults/contactgroups.pp
new file mode 100644
index 00000000..f5affc60
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/contactgroups.pp
@@ -0,0 +1,9 @@
+class nagios::defaults::contactgroups {
+
+    nagios_contactgroup {
+        'admins':
+            alias   => 'Nagios Administrators',
+            members => 'root',
+    }
+
+}
diff --git a/puppet/modules/nagios/manifests/defaults/contacts.pp b/puppet/modules/nagios/manifests/defaults/contacts.pp
new file mode 100644
index 00000000..0252b5a8
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/contacts.pp
@@ -0,0 +1,15 @@
+class nagios::defaults::contacts {
+
+    nagios_contact {
+        'root':
+            alias                           => 'Root',
+            service_notification_period     => '24x7',
+            host_notification_period        => '24x7',
+            service_notification_options    => 'w,u,c,r',
+            host_notification_options       => 'd,r',
+            service_notification_commands   => 'notify-service-by-email',
+            host_notification_commands      => 'notify-host-by-email',
+            email                           => 'root@localhost',
+    }
+
+}
diff --git a/puppet/modules/nagios/manifests/defaults/host_templates.pp b/puppet/modules/nagios/manifests/defaults/host_templates.pp
new file mode 100644
index 00000000..0f47324a
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/host_templates.pp
@@ -0,0 +1,24 @@
+class nagios::defaults::host_templates {
+
+    # this inoperative for the moment, see :
+    # http://projects.reductivelabs.com/issues/1180
+
+    nagios_host {
+        'generic-host':
+            notifications_enabled           => '1',
+            event_handler_enabled           => '1',
+            flap_detection_enabled          => '1',
+            failure_prediction_enabled      => '1',
+            process_perf_data               => '1',
+            retain_status_information       => '1',
+            retain_nonstatus_information    => '1',
+            check_command                   => 'check-host-alive',
+            max_check_attempts              => '10',
+            notification_interval           => '0',
+            notification_period             => '24x7',
+            notification_options            => 'd,u,r',
+            contact_groups                  => 'admins',
+            register                        => '0',
+        }
+
+}
diff --git a/puppet/modules/nagios/manifests/defaults/hostgroups.pp b/puppet/modules/nagios/manifests/defaults/hostgroups.pp
new file mode 100644
index 00000000..8715adee
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/hostgroups.pp
@@ -0,0 +1,11 @@
+class nagios::defaults::hostgroups {
+  nagios_hostgroup {
+    'all':
+      alias   => 'All Servers',
+    	members => '*';
+    'debian-servers':
+      alias   => 'Debian GNU/Linux Servers';
+    'centos-servers':
+      alias   => 'CentOS GNU/Linux Servers';
+  }
+}
diff --git a/puppet/modules/nagios/manifests/defaults/plugins.pp b/puppet/modules/nagios/manifests/defaults/plugins.pp
new file mode 100644
index 00000000..abd8b528
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/plugins.pp
@@ -0,0 +1,10 @@
+class nagios::defaults::plugins {
+  nagios::plugin {
+    'check_mysql_health':
+      source => 'nagios/plugins/check_mysql_health';
+    'check_dns2':
+      source => 'nagios/plugins/check_dns2';
+    'check_dnsbl':
+      source => 'nagios/plugins/check_dnsbl';
+  }
+}
diff --git a/puppet/modules/nagios/manifests/defaults/pnp4nagios.pp b/puppet/modules/nagios/manifests/defaults/pnp4nagios.pp
new file mode 100644
index 00000000..58676c5a
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/pnp4nagios.pp
@@ -0,0 +1,14 @@
+# configure default cmds for pnp4nagios
+class nagios::defaults::pnp4nagios {
+
+  # performance data cmds
+    # http://docs.pnp4nagios.org/de/pnp-0.6/config#bulk_mode_mit_npcd
+    nagios_command {
+        'process-service-perfdata-file-pnp4nagios-bulk-npcd':
+            command_line => '/bin/mv /var/lib/nagios3/service-perfdata /var/spool/pnp4nagios/npcd/service-perfdata.$TIMET$',
+            require      => Package['nagios'];
+        'process-host-perfdata-file-pnp4nagios-bulk-npcd':
+            command_line => '/bin/mv /var/lib/nagios3/host-perfdata /var/spool/pnp4nagios/npcd/host-perfdata.$TIMET$',
+            require      => Package['nagios'];
+    }
+}
diff --git a/puppet/modules/nagios/manifests/defaults/service_templates.pp b/puppet/modules/nagios/manifests/defaults/service_templates.pp
new file mode 100644
index 00000000..e39441a1
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/service_templates.pp
@@ -0,0 +1,32 @@
+# define the generic service template
+class nagios::defaults::service_templates {
+
+  # this inoperative for the moment, see :
+  # http://projects.reductivelabs.com/issues/1180
+
+  nagios_service {
+    'generic-service':
+      active_checks_enabled        => '1',
+      passive_checks_enabled       => '1',
+      parallelize_check            => '1',
+      obsess_over_service          => '1',
+      check_freshness              => '0',
+      notifications_enabled        => '1',
+      event_handler_enabled        => '1',
+      flap_detection_enabled       => '1',
+      failure_prediction_enabled   => '1',
+      process_perf_data            => '1',
+      retain_status_information    => '1',
+      retain_nonstatus_information => '1',
+      notification_interval        => '0',
+      is_volatile                  => '0',
+      check_period                 => '24x7',
+      check_interval               => '5',
+      retry_check_interval         => '1',
+      max_check_attempts           => '4',
+      notification_period          => '24x7',
+      notification_options         => 'w,u,c,r',
+      contact_groups               => 'admins',
+      register                     => '0',
+  }
+}
diff --git a/puppet/modules/nagios/manifests/defaults/templates.pp b/puppet/modules/nagios/manifests/defaults/templates.pp
new file mode 100644
index 00000000..5158189c
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/templates.pp
@@ -0,0 +1,17 @@
+# manage nagios_templates
+class nagios::defaults::templates {
+  include nagios::defaults::vars
+
+  file { 'nagios_templates':
+    path    => "${nagios::defaults::vars::int_cfgdir}/nagios_templates.cfg",
+    source  => [ "puppet:///modules/site_nagios/configs/${::fqdn}/nagios_templates.cfg",
+      "puppet:///modules/site_nagios/configs/${::operatingsystem}/nagios_templates.cfg",
+      'puppet:///modules/site_nagios/configs/nagios_templates.cfg',
+      "puppet:///modules/nagios/configs/${::operatingsystem}/nagios_templates.cfg",
+      'puppet:///modules/nagios/configs/nagios_templates.cfg' ],
+    notify  => Service['nagios'],
+    owner   => root,
+    group   => root,
+    mode    => '0644';
+  }
+}
diff --git a/puppet/modules/nagios/manifests/defaults/timeperiods.pp b/puppet/modules/nagios/manifests/defaults/timeperiods.pp
new file mode 100644
index 00000000..0d05118a
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/timeperiods.pp
@@ -0,0 +1,33 @@
+class nagios::defaults::timeperiods {
+
+    nagios_timeperiod {
+        '24x7':
+            alias       => '24 Hours A Day, 7 Days A Week',
+            sunday      => '00:00-24:00',
+            monday      => '00:00-24:00',
+            tuesday     => '00:00-24:00',
+            wednesday   => '00:00-24:00',
+            thursday    => '00:00-24:00',
+            friday      => '00:00-24:00',
+            saturday    => '00:00-24:00';
+        'workhours':
+            alias       => 'Standard Work Hours',
+            monday      => '09:00-17:00',
+            tuesday     => '09:00-17:00',
+            wednesday   => '09:00-17:00',
+            thursday    => '09:00-17:00',
+            friday      => '09:00-17:00';
+        'nonworkhours':
+            alias       => 'Non-Work Hours',
+            sunday      => '00:00-24:00',
+            monday      => '00:00-09:00,17:00-24:00',
+            tuesday     => '00:00-09:00,17:00-24:00',
+            wednesday   => '00:00-09:00,17:00-24:00',
+            thursday    => '00:00-09:00,17:00-24:00',
+            friday      => '00:00-09:00,17:00-24:00',
+            saturday    => '00:00-24:00';
+        'never':
+            alias       => 'Never';
+        }
+
+}
diff --git a/puppet/modules/nagios/manifests/defaults/vars.pp b/puppet/modules/nagios/manifests/defaults/vars.pp
new file mode 100644
index 00000000..e1a62245
--- /dev/null
+++ b/puppet/modules/nagios/manifests/defaults/vars.pp
@@ -0,0 +1,11 @@
+# some default vars
+class nagios::defaults::vars {
+  case $nagios::cfgdir {
+    '': { $int_cfgdir = $::operatingsystem ? {
+            centos => '/etc/nagios',
+            default => '/etc/nagios3'
+          }
+    }
+    default: { $int_cfgdir = $nagios::cfgdir }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/headless.pp b/puppet/modules/nagios/manifests/headless.pp
new file mode 100644
index 00000000..ba8af8f4
--- /dev/null
+++ b/puppet/modules/nagios/manifests/headless.pp
@@ -0,0 +1,5 @@
+class nagios::headless {
+    class { 'nagios':
+      httpd => 'absent',
+    }
+}
diff --git a/puppet/modules/nagios/manifests/init.pp b/puppet/modules/nagios/manifests/init.pp
new file mode 100644
index 00000000..e3421a0a
--- /dev/null
+++ b/puppet/modules/nagios/manifests/init.pp
@@ -0,0 +1,56 @@
+#
+# nagios module
+# nagios.pp - everything nagios related
+#
+# Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at>
+# Copyright 2008, admin(at)immerda.ch
+# Copyright 2008, Puzzle ITC GmbH
+# Marcel Haerry haerry+puppet(at)puzzle.ch
+# Simon Josi josi+puppet(at)puzzle.ch
+#
+# This program is free software; you can redistribute
+# it and/or modify it under the terms of the GNU
+# General Public License version 3 as published by
+# the Free Software Foundation.
+#
+
+# manage nagios
+class nagios(
+  $httpd              = 'apache',
+  $allow_external_cmd = false,
+  $manage_shorewall   = false,
+  $manage_munin       = false,
+  $service_atboot     = true,
+  $purge_resources    = true,
+  $gpgkey_checks      = {},
+  $storeconfigs       = true
+) {
+  case $nagios::httpd {
+    'absent': { }
+    'lighttpd': { include ::lighttpd }
+    'apache': {
+      include ::apache
+      if $::operatingsystem == 'Debian' {
+        include ::nagios::debian::apache
+      }
+    }
+    default: { include ::apache }
+  }
+  case $::operatingsystem {
+    'centos': {
+      $cfgdir = '/etc/nagios'
+      include ::nagios::centos
+    }
+    'debian': {
+      $cfgdir = '/etc/nagios3'
+      include ::nagios::debian
+    }
+    default: {
+      fail("No such operatingsystem: ${::operatingsystem} yet defined")
+    }
+  }
+  if $manage_munin {
+    include ::nagios::munin
+  }
+  create_resources('nagios::service::gpgkey',$gpgkey_checks)
+}
diff --git a/puppet/modules/nagios/manifests/irc_bot.pp b/puppet/modules/nagios/manifests/irc_bot.pp
new file mode 100644
index 00000000..7e934ef1
--- /dev/null
+++ b/puppet/modules/nagios/manifests/irc_bot.pp
@@ -0,0 +1,50 @@
+class nagios::irc_bot(
+  $nsa_socket = 'absent',
+  $nsa_server,
+  $nsa_port = 6667,
+  $nsa_nickname,
+  $nsa_password = '',
+  $nsa_channel,
+  $nsa_pidfile = 'absent',
+  $nsa_realname = 'Nagios',
+  $nsa_usenotices = false,
+  $nsa_commandfile = 'absent'
+) {
+  $real_nsa_socket = $nsa_socket ? {
+    'absent' => $::operatingsystem ? {
+      centos => '/var/run/nagios-nsa/nsa.socket',
+      default => '/var/run/nagios3/nsa.socket'
+    },
+    default => $nsa_socket,
+  }
+  $real_nsa_pidfile = $nsa_pidfile ? {
+    'absent' => $::operatingsystem ? {
+      centos => '/var/run/nagios-nsa/nsa.pid',
+      default => '/var/run/nagios3/nsa.pid'
+    },
+    default => $nsa_pidfile,
+  }
+  $real_nsa_commandfile = $nsa_commandfile ? {
+    'absent' => $::operatingsystem ? {
+      centos => '/var/spool/nagios/cmd/nagios.cmd',
+      default => '/var/lib/nagios3/rw/nagios.cmd'
+    },
+    default => $nsa_commandfile,
+  }
+
+  case $::operatingsystem {
+    centos: {
+      include nagios::irc_bot::centos
+    }
+    debian,ubuntu: {
+      include nagios::irc_bot::debian
+    }
+    default: {
+      include nagios::irc_bot::base
+    }
+  }
+
+  if $nagios::manage_shorewall {
+    include shorewall::rules::out::irc
+  }
+}
diff --git a/puppet/modules/nagios/manifests/irc_bot/base.pp b/puppet/modules/nagios/manifests/irc_bot/base.pp
new file mode 100644
index 00000000..fff9da4f
--- /dev/null
+++ b/puppet/modules/nagios/manifests/irc_bot/base.pp
@@ -0,0 +1,41 @@
+class nagios::irc_bot::base {
+  file {
+    '/usr/local/bin/riseup-nagios-client.pl':
+      source => 'puppet:///modules/nagios/irc_bot/riseup-nagios-client.pl',
+      owner  => root, group => 0, mode => '0755';
+
+    '/usr/local/bin/riseup-nagios-server.pl':
+      source => 'puppet:///modules/nagios/irc_bot/riseup-nagios-server.pl',
+      owner  => root, group => 0, mode => '0755';
+
+    '/etc/init.d/nagios-nsa':
+      content => template("nagios/irc_bot/${::operatingsystem}/nagios-nsa.sh.erb"),
+      require => File['/usr/local/bin/riseup-nagios-server.pl'],
+      owner   => root, group => 0, mode => '0755';
+
+    '/etc/nagios_nsa.cfg':
+      ensure  => present,
+      content => template('nagios/irc_bot/nsa.cfg.erb'),
+      owner   => nagios, group => 0, mode => '0400',
+      notify  => Service['nagios-nsa'];
+  }
+
+  package { 'libnet-irc-perl':
+    ensure => present,
+  }
+
+  service { 'nagios-nsa':
+    ensure    => 'running',
+    hasstatus => true,
+    require   => [ File['/etc/nagios_nsa.cfg'],
+                   Package['libnet-irc-perl'],
+                   Service['nagios'] ],
+  }
+
+  nagios_command {
+    'notify-by-irc':
+      command_line => '/usr/local/bin/riseup-nagios-client.pl "$HOSTNAME$ ($SERVICEDESC$) $NOTIFICATIONTYPE$ n.$SERVICEATTEMPT$ $SERVICESTATETYPE$ $SERVICEEXECUTIONTIME$s $SERVICELATENCY$s $SERVICEOUTPUT$ $SERVICEPERFDATA$"';
+    'host-notify-by-irc':
+      command_line => '/usr/local/bin/riseup-nagios-client.pl "$HOSTNAME$ ($HOSTALIAS$) $NOTIFICATIONTYPE$ n.$HOSTATTEMPT$ $HOSTSTATETYPE$ took $HOSTEXECUTIONTIME$s $HOSTOUTPUT$ $HOSTPERFDATA$ $HOSTLATENCY$s"';
+  }
+}
diff --git a/puppet/modules/nagios/manifests/irc_bot/centos.pp b/puppet/modules/nagios/manifests/irc_bot/centos.pp
new file mode 100644
index 00000000..d7b19063
--- /dev/null
+++ b/puppet/modules/nagios/manifests/irc_bot/centos.pp
@@ -0,0 +1,9 @@
+class nagios::irc_bot::centos inherits nagios::irc_bot::base {
+  Package['libnet-irc-perl']{
+    name => 'perl-Net-IRC',
+  }
+
+  Service['nagios-nsa']{
+    enable => true,
+  }
+}
diff --git a/puppet/modules/nagios/manifests/irc_bot/debian.pp b/puppet/modules/nagios/manifests/irc_bot/debian.pp
new file mode 100644
index 00000000..93ea64b8
--- /dev/null
+++ b/puppet/modules/nagios/manifests/irc_bot/debian.pp
@@ -0,0 +1,8 @@
+class nagios::irc_bot::debian inherits nagios::irc_bot::base {
+  exec { "nagios_nsa_init_script":
+    command => "/usr/sbin/update-rc.d nagios-nsa defaults",
+    unless => "/bin/ls /etc/rc3.d/ | /bin/grep nagios-nsa",
+    require => File["/etc/init.d/nagios-nsa"],
+    before => Service['nagios-nsa'],
+  }
+}
diff --git a/puppet/modules/nagios/manifests/irc_bot/disable.pp b/puppet/modules/nagios/manifests/irc_bot/disable.pp
new file mode 100644
index 00000000..d6b7c551
--- /dev/null
+++ b/puppet/modules/nagios/manifests/irc_bot/disable.pp
@@ -0,0 +1,8 @@
+class nagios::irc_bot::disable inherits nagios::irc_bot::base {
+
+    Service['nagios-nsa'] {
+        ensure => stopped,
+        enable => false,
+    }
+
+}
diff --git a/puppet/modules/nagios/manifests/lighttpd.pp b/puppet/modules/nagios/manifests/lighttpd.pp
new file mode 100644
index 00000000..0f298964
--- /dev/null
+++ b/puppet/modules/nagios/manifests/lighttpd.pp
@@ -0,0 +1,12 @@
+class nagios::lighttpd(
+  $allow_external_cmd = false,
+  $manage_shorewall = false,
+  $manage_munin = false
+) {
+  class{'nagios':
+    httpd => 'lighttpd',
+    allow_external_cmd => $allow_external_cmd,
+    manage_munin => $manage_munin,
+    manage_shorewall => $manage_shorewall,
+  }
+}
diff --git a/puppet/modules/nagios/manifests/munin.pp b/puppet/modules/nagios/manifests/munin.pp
new file mode 100644
index 00000000..dc5cc4c3
--- /dev/null
+++ b/puppet/modules/nagios/manifests/munin.pp
@@ -0,0 +1,19 @@
+class nagios::munin {
+  include munin::plugins::base
+
+  munin::plugin::deploy {
+    'nagios_hosts':
+      source => 'nagios/munin/nagios_hosts',
+      config => 'user nagios';
+    'nagios_svc':
+      source => 'nagios/munin/nagios_svc',
+      config => 'user nagios';
+    'nagios_perf_hosts':
+      source => 'nagios/munin/nagios_perf',
+      config => 'user nagios';
+    'nagios_perf_svc':
+      source => 'nagios/munin/nagios_perf',
+      config => 'user nagios';
+  }
+
+}
diff --git a/puppet/modules/nagios/manifests/nrpe.pp b/puppet/modules/nagios/manifests/nrpe.pp
new file mode 100644
index 00000000..b7984b6e
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nrpe.pp
@@ -0,0 +1,41 @@
+# setup nrpe stuff
+class nagios::nrpe (
+  $cfg_dir = '',
+  $pid_file = '',
+  $plugin_dir = '',
+  $server_address = '',
+  $allowed_hosts = '',
+  $dont_blame = '0',
+) {
+
+  if !($dont_blame in ['0', '1']) {
+    fail('Unrecognized value for $dont_blame, must be one of "0", or "1".')
+  }
+
+  case $::operatingsystem {
+    'FreeBSD': {
+      if $cfg_dir == '' { $real_cfg_dir = '/usr/local/etc' }
+      if $pid_file == '' { $real_pid_file = '/var/spool/nagios/nrpe2.pid' }
+      if $plugin_dir == '' { $real_plugin_dir = '/usr/local/libexec/nagios' }
+
+      include ::nagios::nrpe::freebsd
+    }
+    'Debian': {
+      if $cfg_dir == '' { $real_cfg_dir = '/etc/nagios' }
+      if $pid_file == '' { $real_pid_file = '/var/run/nagios/nrpe.pid' }
+      if $plugin_dir == '' { $real_plugin_dir = '/usr/lib/nagios/plugins' }
+      include ::nagios::nrpe::linux
+    }
+    default: {
+      if $cfg_dir == '' { $real_cfg_dir = '/etc/nagios' }
+      if $pid_file == '' { $real_pid_file = '/var/run/nrpe.pid' }
+      if $plugin_dir == '' { $real_plugin_dir = '/usr/lib/nagios/plugins' }
+
+      case $::kernel {
+        'Linux': { include ::nagios::nrpe::linux }
+        default: { include ::nagios::nrpe::base }
+      }
+    }
+  }
+
+}
diff --git a/puppet/modules/nagios/manifests/nrpe/base.pp b/puppet/modules/nagios/manifests/nrpe/base.pp
new file mode 100644
index 00000000..e48e87b4
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nrpe/base.pp
@@ -0,0 +1,58 @@
+# basic nrpe stuff
+class nagios::nrpe::base {
+
+  # Import all variables from entry point
+  $cfg_dir = $::nagios::nrpe::real_cfg_dir
+  $pid_file = $::nagios::nrpe::real_pid_file
+  $plugin_dir = $::nagios::nrpe::real_plugin_dir
+  $server_address = $::nagios::nrpe::server_address
+  $allowed_hosts = $::nagios::nrpe::allowed_hosts
+  $dont_blame = $::nagios::nrpe::dont_blame
+
+  package{['nagios-nrpe-server', 'nagios-plugins-basic', 'libwww-perl']:
+    ensure => installed;
+  }
+
+  # Special-case lenny. the package doesn't exist
+  if $::lsbdistcodename != 'lenny' {
+    package{'libnagios-plugin-perl': ensure => installed; }
+  }
+
+  file{
+    [ $cfg_dir, "${cfg_dir}/nrpe.d" ]:
+      ensure => directory;
+  }
+
+  file { "${cfg_dir}/nrpe.cfg":
+    content => template('nagios/nrpe/nrpe.cfg'),
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+
+  # default commands
+  nagios::nrpe::command{'basic_nrpe':
+    source => [ "puppet:///modules/site_nagios/configs/nrpe/nrpe_commands.${::fqdn}.cfg",
+                'puppet:///modules/site_nagios/configs/nrpe/nrpe_commands.cfg',
+                'puppet:///modules/nagios/nrpe/nrpe_commands.cfg' ],
+  }
+  # the check for load should be customized for each server based on number
+  # of CPUs and the type of activity.
+  $warning_1_threshold = 7 * $::processorcount
+  $warning_5_threshold = 6 * $::processorcount
+  $warning_15_threshold = 5 * $::processorcount
+  $critical_1_threshold = 10 * $::processorcount
+  $critical_5_threshold = 9 * $::processorcount
+  $critical_15_threshold = 8 * $::processorcount
+  nagios::nrpe::command {'check_load':
+    command_line => "${plugin_dir}/check_load -w ${warning_1_threshold},${warning_5_threshold},${warning_15_threshold} -c ${critical_1_threshold},${critical_5_threshold},${critical_15_threshold}",
+  }
+
+  service{'nagios-nrpe-server':
+    ensure    => running,
+    enable    => true,
+    pattern   => 'nrpe',
+    subscribe => File["${cfg_dir}/nrpe.cfg"],
+    require   => Package['nagios-nrpe-server'],
+  }
+}
diff --git a/puppet/modules/nagios/manifests/nrpe/command.pp b/puppet/modules/nagios/manifests/nrpe/command.pp
new file mode 100644
index 00000000..c66ab986
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nrpe/command.pp
@@ -0,0 +1,34 @@
+# manage an nrpe command
+define nagios::nrpe::command (
+  $ensure       = present,
+  $command_line = '',
+  $source       = '',
+){
+  if ($command_line == '' and $source == '') {
+    fail('Either one of $command_line or $source must be given to nagios::nrpe::command.' )
+  }
+
+  $cfg_dir = $nagios::nrpe::real_cfg_dir
+
+  file{"${cfg_dir}/nrpe.d/${name}_command.cfg":
+    ensure  => $ensure,
+    notify  => Service['nagios-nrpe-server'],
+    require => File["${cfg_dir}/nrpe.d" ],
+    owner   => 'root',
+    group   => 0,
+    mode    => '0644';
+  }
+
+  case $source {
+    '': {
+      File["${cfg_dir}/nrpe.d/${name}_command.cfg"] {
+        content => template('nagios/nrpe/nrpe_command.erb'),
+      }
+    }
+    default: {
+      File["${cfg_dir}/nrpe.d/${name}_command.cfg"] {
+        source => $source,
+      }
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/nrpe/debian.pp b/puppet/modules/nagios/manifests/nrpe/debian.pp
new file mode 100644
index 00000000..fcaf8514
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nrpe/debian.pp
@@ -0,0 +1,6 @@
+class nagios::nrpe::debian inherits nagios::nrpe::base {
+  include nagios::nrpe::linux
+  Service['nagios-nrpe-server'] {
+    hasstatus => false,
+  }
+}
diff --git a/puppet/modules/nagios/manifests/nrpe/freebsd.pp b/puppet/modules/nagios/manifests/nrpe/freebsd.pp
new file mode 100644
index 00000000..063b79bc
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nrpe/freebsd.pp
@@ -0,0 +1,16 @@
+class nagios::nrpe::freebsd inherits nagios::nrpe::base {
+
+    Package["nagios-nrpe-server"] { name => "nrpe" }
+    Package["nagios-plugins-basic"] { name => "nagios-plugins" }
+    Package["libnagios-plugin-perl"] { name => "p5-Nagios-Plugin" }
+    Package["libwww-perl"] { name => "p5-libwww" }
+
+    # TODO check_cpustats.sh is probably not working as of now. the package 'sysstat' is not available under FreeBSD
+
+    Service["nagios-nrpe-server"] {
+        pattern => "^/usr/local/sbin/nrpe2",
+        path => "/usr/local/etc/rc.d",
+        name => "nrpe2",
+	hasstatus => "false",
+    }
+}
diff --git a/puppet/modules/nagios/manifests/nrpe/linux.pp b/puppet/modules/nagios/manifests/nrpe/linux.pp
new file mode 100644
index 00000000..14e007f3
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nrpe/linux.pp
@@ -0,0 +1,9 @@
+class nagios::nrpe::linux inherits nagios::nrpe::base {
+
+    package {
+        "nagios-plugins-standard": ensure => present;
+        "ksh": ensure => present; # for check_cpustats.sh
+        "sysstat": ensure => present; # for check_cpustats.sh
+    }
+
+}
diff --git a/puppet/modules/nagios/manifests/nrpe/xinetd.pp b/puppet/modules/nagios/manifests/nrpe/xinetd.pp
new file mode 100644
index 00000000..4de0bac6
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nrpe/xinetd.pp
@@ -0,0 +1,11 @@
+# This is created only to cope with cases where we're not the only ones
+# administering a machine and NRPE is running in xinetd.
+class nagios::nrpe::xinetd inherits base {
+
+    Service["nagios-nrpe-server"] {
+	    ensure    => stopped,
+    }
+
+    # TODO manage the xinetd config file that glues with NRPE
+
+}
diff --git a/puppet/modules/nagios/manifests/nsca.pp b/puppet/modules/nagios/manifests/nsca.pp
new file mode 100644
index 00000000..d5be298c
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nsca.pp
@@ -0,0 +1,3 @@
+class nagios::nsca {
+    include nagios::nsca::server
+}
diff --git a/puppet/modules/nagios/manifests/nsca/client.pp b/puppet/modules/nagios/manifests/nsca/client.pp
new file mode 100644
index 00000000..6aa8c0b1
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nsca/client.pp
@@ -0,0 +1,18 @@
+# manage nsca client
+class nagios::nsca::client {
+
+  package{'nsca':
+    ensure => installed
+  }
+
+  file{'/etc/send_nsca.cfg':
+    source  => [ "puppet:///modules/site_nagios/nsca/${::fqdn}/send_nsca.cfg",
+                'puppet:///modules/site_nagios/nsca/send_nsca.cfg',
+                'puppet:///modules/nagios/nsca/send_nsca.cfg' ],
+    owner   => 'nagios',
+    group   => 'nogroup',
+    mode    => '0400',
+    require => Package['nsca'];
+  }
+
+}
diff --git a/puppet/modules/nagios/manifests/nsca/server.pp b/puppet/modules/nagios/manifests/nsca/server.pp
new file mode 100644
index 00000000..8163eec1
--- /dev/null
+++ b/puppet/modules/nagios/manifests/nsca/server.pp
@@ -0,0 +1,24 @@
+# an nsca server
+class nagios::nsca::server {
+  package{'nsca':
+    ensure => installed
+  }
+
+  service { 'nsca':
+    ensure     => running,
+    hasstatus  => false,
+    hasrestart => true,
+    require    => Package['nsca'],
+  }
+
+  file { '/etc/nsca.cfg':
+    source => [ "puppet:///modules/site_nagios/nsca/${::fqdn}/nsca.cfg",
+                'puppet:///modules/site_nagios/nsca/nsca.cfg',
+                'puppet:///modules/nagios/nsca/nsca.cfg' ],
+    owner  => 'nagios',
+    group  => 'nogroup',
+    mode   => '0400',
+    notify => Service['nsca'],
+  }
+
+}
diff --git a/puppet/modules/nagios/manifests/plugin.pp b/puppet/modules/nagios/manifests/plugin.pp
new file mode 100644
index 00000000..07938cd2
--- /dev/null
+++ b/puppet/modules/nagios/manifests/plugin.pp
@@ -0,0 +1,28 @@
+# a wrapper for syncing a plugin
+define nagios::plugin(
+  $source = 'absent',
+  $ensure = present,
+){
+  if $::hardwaremodel == 'x86_64' and $::operatingsystem != 'Debian' {
+    $real_path = "/usr/lib64/nagios/plugins/${name}"
+  }
+  else {
+    $real_path = "/usr/lib/nagios/plugins/${name}"
+  }
+
+  $real_source = $source ? {
+    'absent' => "puppet:///modules/nagios/plugins/${name}",
+    default => "puppet:///modules/${source}"
+  }
+
+  file{$name:
+    ensure  => $ensure,
+    path    => $real_path,
+    source  => $real_source,
+    tag     => 'nagios_plugin',
+    require => Package['nagios-plugins'],
+    owner   => 'root',
+    group   => 0,
+    mode    => '0755';
+  }
+}
diff --git a/puppet/modules/nagios/manifests/plugin/deploy.pp b/puppet/modules/nagios/manifests/plugin/deploy.pp
new file mode 100644
index 00000000..76815909
--- /dev/null
+++ b/puppet/modules/nagios/manifests/plugin/deploy.pp
@@ -0,0 +1,41 @@
+# deploy a specific plugin
+define nagios::plugin::deploy(
+  $source = '',
+  $ensure = 'present',
+  $config = '',
+  $require_package = 'nagios-plugins'
+) {
+  $plugin_src = $ensure ? {
+    'present' => $name,
+    'absent' => $name,
+    default => $ensure
+  }
+  $real_source = $source ? {
+    ''  =>  "nagios/plugins/${plugin_src}",
+    default => $source
+  }
+
+  if !defined(Package[$require_package]) {
+    package { $require_package:
+      ensure => installed,
+      tag    => 'nagios::plugin::deploy::package';
+    }
+  }
+
+  include ::nagios::plugin::scriptpaths
+  file{"nagios_plugin_${name}":
+    path    => "${nagios::plugin::scriptpaths::script_path}/${name}",
+    source  => "puppet:///modules/${real_source}",
+    require => Package[$require_package],
+    tag     => 'nagios::plugin::deploy::file',
+    owner   => root,
+    group   => 0,
+    mode    => '0755';
+  }
+
+  # register the plugin
+  nagios::plugin{$name:
+    ensure  => $ensure,
+    require => Package['nagios-plugins']
+  }
+}
diff --git a/puppet/modules/nagios/manifests/plugin/scriptpaths.pp b/puppet/modules/nagios/manifests/plugin/scriptpaths.pp
new file mode 100644
index 00000000..9cd4b5d6
--- /dev/null
+++ b/puppet/modules/nagios/manifests/plugin/scriptpaths.pp
@@ -0,0 +1,6 @@
+class nagios::plugin::scriptpaths {
+    case $::hardwaremodel {
+    	x86_64: { $script_path =  "/usr/lib64/nagios/plugins/" }
+    	default: { $script_path =  "/usr/lib/nagios/plugins" }
+    }
+}
diff --git a/puppet/modules/nagios/manifests/plugins/gpg.pp b/puppet/modules/nagios/manifests/plugins/gpg.pp
new file mode 100644
index 00000000..a09736a8
--- /dev/null
+++ b/puppet/modules/nagios/manifests/plugins/gpg.pp
@@ -0,0 +1,30 @@
+# check_gpg from
+# https://github.com/lelutin/nagios-plugins/blob/master/check_gpg
+class nagios::plugins::gpg {
+  require ::gpg
+  nagios::plugin{'check_gpg':
+    source => 'nagios/plugins/check_gpg',
+  }
+
+  $gpg_home = '/var/local/nagios_gpg_homedir'
+  file{
+    $gpg_home:
+      ensure  => 'directory',
+      owner   => nagios,
+      group   => nagios,
+      mode    => '0600',
+      require => Nagios::Plugin['check_gpg'];
+    "${gpg_home}/sks-keyservers.netCA.pem":
+      source  => 'puppet:///modules/nagios/plugin_data/sks-keyservers.netCA.pem',
+      owner   => nagios,
+      group   => 0,
+      mode    => '0400',
+      before  => Nagios_command['check_gpg'];
+  }
+  nagios_command {
+    'check_gpg':
+      command_line => "\$USER1\$/check_gpg --gnupg-homedir ${gpg_home} -w \$ARG1\$ \$ARG2\$",
+      require      => Nagios::Plugin['check_gpg'],
+  }
+}
+
diff --git a/puppet/modules/nagios/manifests/plugins/horde_login.pp b/puppet/modules/nagios/manifests/plugins/horde_login.pp
new file mode 100644
index 00000000..4274b4cf
--- /dev/null
+++ b/puppet/modules/nagios/manifests/plugins/horde_login.pp
@@ -0,0 +1,11 @@
+# check_horde_login
+class nagios::plugins::horde_login {
+  ensure_packages(['python-requests'])
+  nagios::plugin { 'check_horde_login':
+    source  => 'nagios/plugins/check_horde_login',
+    require => Package['python-requests'],
+  } -> nagios_command {
+    'check_horde_login':
+      command_line => "\$USER1\$/check_horde_login -s \$ARG1\$ -u \$ARG2\$ -p \$ARG3\$",
+  }
+}
diff --git a/puppet/modules/nagios/manifests/plugins/jabber.pp b/puppet/modules/nagios/manifests/plugins/jabber.pp
new file mode 100644
index 00000000..380a5c0a
--- /dev/null
+++ b/puppet/modules/nagios/manifests/plugins/jabber.pp
@@ -0,0 +1,10 @@
+class nagios::plugins::jabber {
+
+    # for check_jabber_login
+    require rubygems::xmpp4r
+
+    nagios::plugin { 'check_jabber_login':
+         source => 'nagios/plugins/check_jabber_login'
+    }
+}
+
diff --git a/puppet/modules/nagios/manifests/plugins/mail_login.pp b/puppet/modules/nagios/manifests/plugins/mail_login.pp
new file mode 100644
index 00000000..a86cdc24
--- /dev/null
+++ b/puppet/modules/nagios/manifests/plugins/mail_login.pp
@@ -0,0 +1,10 @@
+# simple mail login check
+class nagios::plugins::mail_login {
+  nagios::plugin {
+    'check_imap_login':
+      source => 'nagios/plugins/check_imap_login';
+    'check_pop3_login':
+      source => 'nagios/plugins/check_pop3_login';
+  }
+}
+
diff --git a/puppet/modules/nagios/manifests/pnp4nagios.pp b/puppet/modules/nagios/manifests/pnp4nagios.pp
new file mode 100644
index 00000000..bd7ab0ca
--- /dev/null
+++ b/puppet/modules/nagios/manifests/pnp4nagios.pp
@@ -0,0 +1,68 @@
+# manage pnp4nagios
+class nagios::pnp4nagios {
+  include nagios::defaults::pnp4nagios
+
+  package { [ 'pnp4nagios', 'pnp4nagios-web-config-nagios3']:
+    ensure  => installed,
+    require => Package['nagios']
+  }
+
+  # unfortunatly we can't use the nagios_host and nagios_service
+  # definition to define templates, so we need to copy a file here.
+  # see http://projects.reductivelabs.com/issues/1180 for this limitation
+
+  file { 'pnp4nagios-templates.cfg':
+    path   => "${nagios::defaults::vars::int_cfgdir}/pnp4nagios-templates.cfg",
+    source => [ 'puppet:///modules/site_nagios/pnp4nagios/pnp4nagios-templates.cfg',
+                'puppet:///modules/nagios/pnp4nagios/pnp4nagios-templates.cfg' ],
+    mode   => '0644',
+    owner  => root,
+    group  => root,
+    notify => Service['nagios'],
+    require => Package['nagios'];
+  }
+
+  file { 'apache.conf':
+    path    => '/etc/pnp4nagios/apache.conf',
+    source  => ['puppet:///modules/site_nagios/pnp4nagios/apache.conf',
+                'puppet:///modules/nagios/pnp4nagios/apache.conf' ],
+    mode    => '0644',
+    owner   => root,
+    group   => root,
+    notify  => Service['apache'],
+    require => [ Package['apache2'], Package['pnp4nagios'] ],
+  }
+
+  # run npcd as daemon
+
+  file { '/etc/default/npcd':
+    path    => '/etc/default/npcd',
+    source  => [ 'puppet:///modules/site_nagios/pnp4nagios/npcd',
+                'puppet:///modules/nagios/pnp4nagios/npcd' ],
+    mode    => '0644',
+    owner   => root,
+    group   => root,
+    notify  => Service['npcd'],
+    require => [ Package['nagios'], Package['pnp4nagios'] ];
+  }
+
+  service { 'npcd':
+      ensure    => running,
+      enable    => true,
+      hasstatus => true,
+      require   => Package['pnp4nagios'],
+  }
+
+  # modify action.gif
+
+  file { '/usr/share/nagios3/htdocs/images/action.gif':
+    path   => '/usr/share/nagios3/htdocs/images/action.gif',
+    source => [ 'puppet:///modules/site_nagios/pnp4nagios/action.gif',
+                'puppet:///modules/nagios/pnp4nagios/action.gif' ],
+    mode    => '0644',
+    owner   => root,
+    group   => root,
+    notify  => Service['nagios'],
+    require => Package['nagios'];
+  }
+}
diff --git a/puppet/modules/nagios/manifests/pnp4nagios/popup.pp b/puppet/modules/nagios/manifests/pnp4nagios/popup.pp
new file mode 100644
index 00000000..91136ccb
--- /dev/null
+++ b/puppet/modules/nagios/manifests/pnp4nagios/popup.pp
@@ -0,0 +1,24 @@
+class nagios::pnp4nagios::popup inherits nagios::pnp4nagios {
+  File['pnp4nagios-templates.cfg']{
+    source => [
+      'puppet:///modules/site-nagios/pnp4nagios/pnp4nagios-popup-templates.cfg',
+      'puppet:///modules/nagios/pnp4nagios/pnp4nagios-popup-templates.cfg' ],
+  }
+
+  file { '/usr/share/nagios3/htdocs/ssi':
+    ensure  => directory,
+    require => Package['nagios'],
+  }
+
+  file { 'status-header.ssi':
+    path    => '/usr/share/nagios3/htdocs/ssi/status-header.ssi',
+    source  => [
+      'puppet:///modules/site-nagios/pnp4nagios/status-header.ssi',
+      'puppet:///modules/nagios/pnp4nagios/status-header.ssi'],
+    mode    => '0644',
+    owner   => root,
+    group   => root,
+    notify  => Service['nagios'],
+    require => Package['nagios'],
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service.pp b/puppet/modules/nagios/manifests/service.pp
new file mode 100644
index 00000000..e2c08e99
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service.pp
@@ -0,0 +1,91 @@
+# a wrapper around nagios_service to make it more convenient and
+# also automatically an exported resource.
+define nagios::service (
+  $ensure                = present,
+  $host_name             = $::fqdn,
+  $check_command         = 'absent',
+  $check_period          = undef,
+  $check_interval        = undef,
+  $retry_check_interval  = undef,
+  $max_check_attempts    = undef,
+  $notification_interval = undef,
+  $notification_period   = undef,
+  $notification_options  = undef,
+  $contact_groups        = undef,
+  $use                   = 'generic-service',
+  $service_description   = 'absent',
+  $use_nrpe              = undef,
+  $nrpe_args             = undef,
+  $nrpe_timeout          = 10,
+) {
+
+  # TODO: this resource should normally accept all nagios_host parameters
+
+  $real_name = "${::hostname}_${name}"
+
+  @@nagios_service {$real_name:
+    ensure => $ensure,
+    notify => Service['nagios'];
+  }
+
+  if $ensure != 'absent' {
+    if $check_command == 'absent' {
+      fail("Must pass a check_command to ${name} if it should be present")
+    }
+    if str2bool($use_nrpe) {
+      include ::nagios::command::nrpe_timeout
+
+      if $nrpe_args {
+        $real_check_command = "check_nrpe_timeout!${nrpe_timeout}!${check_command}!\"${nrpe_args}\""
+      } else {
+        $real_check_command = "check_nrpe_1arg_timeout!${nrpe_timeout}!${check_command}"
+      }
+    } else {
+      $real_check_command = $check_command
+    }
+
+    $real_service_description = $service_description ? {
+      'absent' => $name,
+      default => $service_description
+    }
+    Nagios_service[$real_name] {
+      check_command       => $check_command,
+      host_name           => $host_name,
+      use                 => $use,
+      service_description => $real_service_description,
+    }
+
+    if $check_period {
+      Nagios_service[$real_name] { check_period => $check_period }
+    }
+
+    if $check_interval {
+      Nagios_service[$real_name] { check_interval => $check_interval }
+    }
+
+    if $retry_check_interval {
+      Nagios_service[$real_name] { retry_check_interval => $retry_check_interval }
+    }
+
+    if $max_check_attempts {
+      Nagios_service[$real_name] { max_check_attempts => $max_check_attempts }
+    }
+
+    if $notification_interval {
+      Nagios_service[$real_name] { notification_interval => $notification_interval }
+    }
+
+    if $notification_period {
+      Nagios_service[$real_name] { notification_period => $notification_period }
+    }
+
+    if $notification_options {
+      Nagios_service[$real_name] { notification_options => $notification_options }
+    }
+
+    if $contact_groups {
+      Nagios_service[$real_name] { contact_groups => $contact_groups }
+    }
+  }
+}
+
diff --git a/puppet/modules/nagios/manifests/service/dns.pp b/puppet/modules/nagios/manifests/service/dns.pp
new file mode 100644
index 00000000..5ef6e3e8
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/dns.pp
@@ -0,0 +1,19 @@
+define nagios::service::dns(
+  $host_name      = $::fqdn,
+  $comment        = $name,
+  $check_domain   = $name,
+  $ip
+){
+  if $name != $comment {
+    $check_name = "${comment}_${name}_${::hostname}"
+  } else {
+    $check_name = "${name}_${::hostname}"
+  }
+
+  nagios::service{
+    $check_name:
+      check_command       => "check_dns2!${check_domain}!${ip}",
+      host_name           => $host_name,
+      service_description => "check if ${::host_name} is resolving ${check_domain}";
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/dns_host.pp b/puppet/modules/nagios/manifests/service/dns_host.pp
new file mode 100644
index 00000000..d88f3735
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/dns_host.pp
@@ -0,0 +1,22 @@
+# add a special host and monitor
+# it's dns service
+define nagios::service::dns_host(
+  $check_domain,
+  $host_alias,
+  $parent,
+  $ip
+){
+  @@nagios_host{$name:
+    address => $ip,
+    alias   => $host_alias,
+    use     => 'generic-host',
+    parents => $parent,
+  }
+
+  nagios::service::dns{$name:
+    host_name    => $name,
+    comment      => 'public_ns',
+    check_domain => $check_domain,
+    ip           => $ip,
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/gpgkey.pp b/puppet/modules/nagios/manifests/service/gpgkey.pp
new file mode 100644
index 00000000..df13ca88
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/gpgkey.pp
@@ -0,0 +1,49 @@
+# define a gpgkey to be watched
+define nagios::service::gpgkey(
+  $ensure         = 'present',
+  $warning        = '14',
+  $key_info       = undef,
+  $check_interval = 60,
+){
+  validate_slength($name,40,40)
+  require ::nagios::plugins::gpg
+  $gpg_home = $nagios::plugins::gpg::gpg_home
+  $gpg_cmd  = "gpg --homedir ${gpg_home}"
+
+  exec{"manage_key_${name}":
+    user  => nagios,
+    group => nagios,
+  }
+  nagios::service{
+    "check_gpg_${name}":
+      ensure => $ensure;
+  }
+
+  if $ensure == 'present' {
+    Exec["manage_key_${name}"]{
+      command => "${gpg_cmd} --keyserver hkps://hkps.pool.sks-keyservers.net --keyserver-options ca-cert-file=${gpg_home}/sks-keyservers.netCA.pem --recv-keys ${name}",
+      unless  => "${gpg_cmd} --list-keys ${name}",
+      before  => Nagios::Service["check_gpg_${name}"],
+    }
+
+    Nagios::Service["check_gpg_${name}"]{
+      check_command  => "check_gpg!${warning}!${name}",
+      check_interval => $check_interval,
+    }
+    if $key_info {
+      Nagios::Service["check_gpg_${name}"]{
+        service_description => "Keyfingerprint: ${name} - Info: ${key_info}",
+      }
+    } else {
+      Nagios::Service["check_gpg_${name}"]{
+        service_description => "Keyfingerprint: ${name}",
+      }
+    }
+  } else {
+    Exec["manage_key_${name}"]{
+      command => "${gpg_cmd} --batch --delete-key ${name}",
+      onlyif  => "${gpg_cmd} --list-keys ${name}",
+      require => Nagios::Service["check_gpg_${name}"],
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/horde_login.pp b/puppet/modules/nagios/manifests/service/horde_login.pp
new file mode 100644
index 00000000..6cab59e9
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/horde_login.pp
@@ -0,0 +1,18 @@
+# a horde login check
+define nagios::service::horde_login(
+  $password,
+  $url,
+  $username = $name,
+  $ensure   = 'present',
+){
+  nagios::service{
+    "horde_${name}":
+      ensure => $ensure;
+  }
+
+  if $ensure != 'absent' {
+    Nagios::Service["horde_${name}"]{
+      check_command => "check_horde_login!${url}!${username}!${password}",
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/http.pp b/puppet/modules/nagios/manifests/service/http.pp
new file mode 100644
index 00000000..b80c140e
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/http.pp
@@ -0,0 +1,54 @@
+# ssl_mode:
+#   - false: only check http
+#   - true: check http and https
+#   - force: http is permanent redirect to https
+#   - only: check only https
+define nagios::service::http(
+  $ensure       = present,
+  $check_domain = 'absent',
+  $port     = '80',
+  $check_url    = '/',
+  $check_code   = '200,301,302',
+  $use      = 'generic-service',
+  $ssl_mode     = false
+){
+  $real_check_domain = $check_domain ? {
+      'absent'  => $name,
+      default   => $check_domain
+  }
+  if is_hash($check_code) {
+    $check_code_hash = $check_code
+  } else {
+    $check_code_hash = {
+      http  => $check_code,
+      https => $check_code,
+    }
+  }
+  case $ssl_mode {
+    'force',true,'only': {
+      nagios::service{"https_${name}":
+        ensure        => $ensure,
+        use           => $use,
+        check_command => "check_https_url_regex!${real_check_domain}!${check_url}!'${check_code_hash[https]}'",
+      }
+      case $ssl_mode {
+        'force': {
+          nagios::service{"http_${name}":
+            ensure        => $ensure,
+            use           => $use,
+            check_command => "check_http_url_regex!${real_check_domain}!${port}!${check_url}!'301'",
+          }
+        }
+      }
+    }
+  }
+  case $ssl_mode {
+    false,true: {
+      nagios::service{"http_${name}":
+        ensure        => $ensure,
+        use           => $use,
+        check_command => "check_http_url_regex!${real_check_domain}!${port}!${check_url}!'${check_code_hash[http]}'",
+      }
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/imap.pp b/puppet/modules/nagios/manifests/service/imap.pp
new file mode 100644
index 00000000..45b667ab
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/imap.pp
@@ -0,0 +1,34 @@
+# check an imap service
+define nagios::service::imap(
+  $ensure     = 'present',
+  $host       = 'absent',
+  $port       = '143',
+  $tls        = true,
+  $tls_port   = '993'
+){
+
+  $real_host = $host ? {
+    'absent' => $name,
+    default  => $host
+  }
+
+  $tls_ensure = $tls ? {
+    true    => $ensure,
+    default => 'absent'
+  }
+  nagios::service{
+    "imap_${name}_${port}":
+      ensure => $ensure;
+    "imaps_${name}_${tls_port}":
+      ensure => $tls_ensure;
+  }
+
+  if $ensure != 'absent' {
+    Nagios::Service["imap_${name}_${port}"]{
+      check_command => "check_imap!${real_host}!${port}",
+    }
+    Nagios::Service["imaps_${name}_${tls_port}"]{
+      check_command => "check_imap_ssl!${real_host}!${tls_port}",
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/imap_login.pp b/puppet/modules/nagios/manifests/service/imap_login.pp
new file mode 100644
index 00000000..25303a3f
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/imap_login.pp
@@ -0,0 +1,22 @@
+# a imap login check
+define nagios::service::imap_login(
+  $username,
+  $password,
+  $warning   = 5,
+  $critical  = 10,
+  $host      = $::fqdn,
+  $host_name = $::fqdn,
+  $ensure    = 'present',
+){
+  nagios::service{
+    "imap_login_${name}":
+      ensure => $ensure;
+  }
+
+  if $ensure != 'absent' {
+    Nagios::Service["imap_login_${name}"]{
+      check_command => "check_imap_login!${host}!${username}!${password}!${warning}!${critical}",
+      host_name     => $host_name,
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/mysql.pp b/puppet/modules/nagios/manifests/service/mysql.pp
new file mode 100644
index 00000000..9559b17c
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/mysql.pp
@@ -0,0 +1,58 @@
+# Checks a mysql instance via tcp or socket
+define nagios::service::mysql(
+  $ensure = present,
+  $check_host = 'absent',
+  $check_port = '3306',
+  $check_username = 'nagios',
+  $check_password,
+  $check_database = 'information_schema',
+  $check_warning = undef,
+  $check_critical = undef,
+  $check_health_mode = $name,
+  $check_name = undef,
+  $check_name2 = undef,
+  $check_regexp = undef,
+  $check_units = undef,
+  $check_mode = 'tcp' )
+{
+
+  if ($check_host == 'absent') {
+    fail("Please specify a hostname, ip address or socket to check a mysql instance.")
+  }
+
+  if $check_name != undef {
+    $real_check_name = "!--name $check_name"
+  }
+  
+  if $check_warning != undef {
+    $real_check_warning = "!--warning $check_warning"
+  }
+   
+  if $check_critical != undef {
+    $real_check_critical = "!--critical $check_critical"
+  }
+    
+  case $check_mode {
+    'tcp': {
+      if ($check_host == 'localhost') {
+        $real_check_host = '127.0.0.1'
+      }
+      else {
+        $real_check_host = $check_host
+      }
+    }
+    default: {
+      if ($check_host == '127.0.0.1') {
+        $real_check_host = 'localhost'
+      }
+      else {
+        $real_check_host = $check_host
+      }
+    }
+  }
+
+  nagios::service { "mysql_health_${name}":
+    ensure        => $ensure,
+    check_command => "check_mysql_health!${real_check_host}!${check_port}!${check_username}!'${check_password}'!${check_health_mode}!${check_database}${real_check_name}${real_check_warning}${real_check_critical}",
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/ntp.pp b/puppet/modules/nagios/manifests/service/ntp.pp
new file mode 100644
index 00000000..b3cde2ab
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/ntp.pp
@@ -0,0 +1,9 @@
+# manifests/service/ntp.pp
+
+class nagios::service::ntp {
+  nagios::service{ "check_ntp":
+    check_command => "check_ntp_time",
+    host_name => $::fqdn,
+  }
+}
+
diff --git a/puppet/modules/nagios/manifests/service/passive.pp b/puppet/modules/nagios/manifests/service/passive.pp
new file mode 100644
index 00000000..f3df1e8b
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/passive.pp
@@ -0,0 +1,18 @@
+define nagios::service::passive(
+    $ensure = present,
+    $notification_interval = '',
+    $notification_period = '',
+    $notification_options = '',
+    $contact_groups = ''
+) {
+
+    nagios::service { $name:
+        use                   => 'passive-service',
+        check_command         => 'check_dummy!0',
+        notification_interval => $notification_interval,
+        notification_period   => $notification_period,
+        notification_options  => $notification_options,
+        contact_groups        => $contact_groups,
+    }
+
+}
diff --git a/puppet/modules/nagios/manifests/service/ping.pp b/puppet/modules/nagios/manifests/service/ping.pp
new file mode 100644
index 00000000..f1c8d878
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/ping.pp
@@ -0,0 +1,9 @@
+define nagios::service::ping(
+    $ensure = present,
+    $ping_rate = '!100.0,20%!500.0,60%'
+){
+  nagios::service{ "check_ping":
+    ensure => $ensure,
+    check_command => "check_ping${ping_rate}",
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/pop.pp b/puppet/modules/nagios/manifests/service/pop.pp
new file mode 100644
index 00000000..9ec4aec1
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/pop.pp
@@ -0,0 +1,32 @@
+define nagios::service::pop(
+  $ensure = 'present',
+  $host = 'absent',
+  $port = '110',
+  $tls = true,
+  $tls_port = '995'
+){
+
+  $real_host = $host ? {
+    'absent' => $name,
+    default => $host
+  }
+
+  nagios::service{
+    "pop_${name}_${port}":
+      ensure => $ensure;
+    "pops_${name}_${tls_port}":
+      ensure => $tls ? {
+        true => $ensure,
+        default => 'absent'
+        };
+  }
+
+  if $ensure != 'absent' {
+    Nagios::Service["pop_${name}_${port}"]{
+      check_command => "check_pop3!${real_host}!${port}",
+    }
+    Nagios::Service["pops_${name}_${tls_port}"]{
+      check_command => "check_pop3_ssl!${real_host}!${tls_port}",
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/pop3_login.pp b/puppet/modules/nagios/manifests/service/pop3_login.pp
new file mode 100644
index 00000000..74535289
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/pop3_login.pp
@@ -0,0 +1,22 @@
+# a pop3 login check
+define nagios::service::pop3_login(
+  $username,
+  $password,
+  $warning   = 5,
+  $critical  = 10,
+  $host      = $::fqdn,
+  $host_name = $::fqdn,
+  $ensure    = 'present',
+){
+  nagios::service{
+    "pop3_login_${name}":
+      ensure => $ensure;
+  }
+
+  if $ensure != 'absent' {
+    Nagios::Service["pop3_login_${name}"]{
+      check_command => "check_pop3_login!${host}!${username}!${password}!${warning}!${critical}",
+      host_name     => $host_name,
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/smtp.pp b/puppet/modules/nagios/manifests/service/smtp.pp
new file mode 100644
index 00000000..14237a9e
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/smtp.pp
@@ -0,0 +1,50 @@
+# true:
+#   - true   : check tls and plain connect *defualt*
+#   - false : check plain connection only
+# cert_days:
+#   If tls is used add an additionl check
+#   to check for validity for cert.
+#   - 'absent' : do not execute that check
+#   - INTEGER  : Minimum number of days a certificate
+#                has to be valid. Default: 10
+define nagios::service::smtp(
+  $ensure = 'present',
+  $host = 'absent',
+  $port = '25',
+  $tls = true,
+  $cert_days = 10
+){
+  $real_host = $host ? {
+    'absent' => $name,
+     default => $host
+  }
+
+  nagios::service{
+    "smtp_${name}_${port}":
+      ensure => $ensure;
+    "smtp_tls_${name}_${port}":
+      ensure => $tls ? {
+        true => $ensure,
+        default => 'absent'
+      };
+    "smtp_tls_cert_${name}_${port}":
+      ensure => $cert_days ? {
+        'absent' => 'absent',
+        default => $ensure
+      };
+  }
+
+  if $ensure != 'absent' {
+    Nagios::Service["smtp_${name}_${port}"]{
+      check_command => "check_smtp!${real_host}!${port}",
+    }
+    Nagios::Service["smtp_tls_${name}_${port}"]{
+      check_command => "check_smtp_tls!${real_host}!${port}",
+    }
+    if $cert_days != 'absent' {
+      Nagios::Service["smtp_tls_cert_${name}_${port}"]{
+        check_command => "check_smtp_cert!${real_host}!${port}!${cert_days}",
+      }
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/service/ssmtp.pp b/puppet/modules/nagios/manifests/service/ssmtp.pp
new file mode 100644
index 00000000..b05678a6
--- /dev/null
+++ b/puppet/modules/nagios/manifests/service/ssmtp.pp
@@ -0,0 +1,32 @@
+define nagios::service::ssmtp(
+  $ensure = 'present',
+  $host = 'absent',
+  $port = '465',
+  $cert_days = 10
+){
+  $real_host = $host ? {
+    'absent' => $name,
+     default => $host
+  }
+
+  nagios::service{
+    "ssmtp_${name}_${port}":
+      ensure => $ensure;
+    "ssmtp_cert_${name}_${port}":
+      ensure => $cert_days ? {
+        'absent' => 'absent',
+        default => $ensure
+      };
+  }
+
+  if $ensure != 'absent' {
+    Nagios::Service["ssmtp_${name}_${port}"]{
+      check_command => "check_ssmtp!${real_host}!${port}",
+    }
+    if $cert_days != 'absent' {
+      Nagios::Service["ssmtp_cert_${name}_${port}"]{
+        check_command => "check_ssmtp_cert!${real_host}!${port}!${cert_days}",
+      }
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/storeconfigs.pp b/puppet/modules/nagios/manifests/storeconfigs.pp
new file mode 100644
index 00000000..96c30dd5
--- /dev/null
+++ b/puppet/modules/nagios/manifests/storeconfigs.pp
@@ -0,0 +1,61 @@
+# collect exported resources when using 'storeconfigs => true'
+class nagios::storeconfigs {
+
+  Nagios_command <<||>>
+  Nagios_contactgroup <<||>>
+  Nagios_contact <<||>>
+  Nagios_hostdependency <<||>>
+  Nagios_hostescalation <<||>>
+  Nagios_hostextinfo <<||>>
+  Nagios_hostgroup <<||>>
+  Nagios_host <<||>>
+  Nagios_servicedependency <<||>>
+  Nagios_serviceescalation <<||>>
+  Nagios_servicegroup <<||>>
+  Nagios_serviceextinfo <<||>>
+  Nagios_service <<||>>
+  Nagios_timeperiod <<||>>
+
+  Nagios_command <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_contact <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_contactgroup <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_host <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_hostdependency <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_hostescalation <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_hostextinfo <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_hostgroup <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_service <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_servicegroup <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_servicedependency <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_serviceescalation <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_serviceextinfo <||> {
+    notify  => Service['nagios'],
+  }
+  Nagios_timeperiod <||> {
+    notify  => Service['nagios'],
+  }
+}
diff --git a/puppet/modules/nagios/manifests/stored_config.pp b/puppet/modules/nagios/manifests/stored_config.pp
new file mode 100644
index 00000000..5afda04f
--- /dev/null
+++ b/puppet/modules/nagios/manifests/stored_config.pp
@@ -0,0 +1,19 @@
+class nagios::stored_config {
+  # collect exported resources
+
+  Nagios_command <<||>>
+  Nagios_contactgroup <<||>>
+  Nagios_contact <<||>>
+  Nagios_hostdependency <<||>>
+  Nagios_hostescalation <<||>>
+  Nagios_hostextinfo <<||>>
+  Nagios_hostgroup <<||>>
+  Nagios_host <<||>>
+  Nagios_servicedependency <<||>>
+  Nagios_serviceescalation <<||>>
+  Nagios_servicegroup <<||>>
+  Nagios_serviceextinfo <<||>>
+  Nagios_service <<||>>
+  Nagios_timeperiod <<||>>
+
+}
diff --git a/puppet/modules/nagios/manifests/target.pp b/puppet/modules/nagios/manifests/target.pp
new file mode 100644
index 00000000..760d7d47
--- /dev/null
+++ b/puppet/modules/nagios/manifests/target.pp
@@ -0,0 +1,32 @@
+# a simple nagios target to monitor
+class nagios::target(
+  $parents      = 'absent',
+  $address      = $::ipaddress,
+  $nagios_alias = false,
+  $hostgroups   = 'absent',
+  $use          = 'generic-host',
+){
+  @@nagios_host { $::fqdn:
+    address => $address,
+    use     => $use,
+  }
+  # Watch out with using aliases: they need to be unique throughout *all*
+  # resources in a given host's catalogue.
+  if $nagios_alias {
+    Nagios_host[$::fqdn]{
+      alias => $nagios_alias
+    }
+  }
+
+  if ($parents != 'absent') {
+    Nagios_host[$::fqdn]{
+      parents => $parents
+    }
+  }
+
+  if ($hostgroups != 'absent') {
+    Nagios_host[$::fqdn]{
+      hostgroups => $hostgroups
+    }
+  }
+}
diff --git a/puppet/modules/nagios/manifests/target/fqdn.pp b/puppet/modules/nagios/manifests/target/fqdn.pp
new file mode 100644
index 00000000..31fc4b71
--- /dev/null
+++ b/puppet/modules/nagios/manifests/target/fqdn.pp
@@ -0,0 +1,12 @@
+# monitor a host by fqdn
+class nagios::target::fqdn(
+  $address    = $::fqdn,
+  $hostgroups = 'absent',
+  $parents    = 'absent'
+) {
+  class{'nagios::target':
+    address    => $address,
+    hostgroups => $hostgroups,
+    parents    => $parents
+  }
+}
diff --git a/puppet/modules/nagios/templates/irc_bot/CentOS/nagios-nsa.sh.erb b/puppet/modules/nagios/templates/irc_bot/CentOS/nagios-nsa.sh.erb
new file mode 100644
index 00000000..0f9f87b4
--- /dev/null
+++ b/puppet/modules/nagios/templates/irc_bot/CentOS/nagios-nsa.sh.erb
@@ -0,0 +1,104 @@
+#!/bin/sh
+#
+# nagios-nsa - manage nagios irc bot
+#
+# chkconfig:   - 99 01
+# description: Nagios Simple IRC Agent
+
+### BEGIN INIT INFO
+# Provides: nagios-nsa
+# Required-Start: $nagios
+# Required-Stop: $nagios
+# Default-Start: 2 3 4 5
+# Default-Stop: 1 6 0
+# Short-Description: Nagios Simple IRC Agent
+### END INIT INFO
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+exec="/usr/local/bin/riseup-nagios-server.pl"
+prog="nsa"
+PIDFILE=<%= scope.lookupvar('nagios::irc_bot::real_nsa_pidfile') %>
+SOCKFILE=<%= scope.lookupvar('nagios::irc_bot::real_nsa_socket') %>
+
+[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
+
+lockfile=/var/lock/subsys/$prog
+mkdir -p /var/run/nagios-nsa 2>/dev/null
+chown nagios /var/run/nagios-nsa
+
+start() {
+    [ -x $exec ] || exit 5
+    [ -f $config ] || exit 6
+    echo -n $"Starting $prog: "
+    daemon --pidfile $PIDFILE --user nagios /usr/local/bin/riseup-nagios-server.pl
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && touch $lockfile
+    return $retval
+}
+
+stop() {
+    echo -n $"Stopping $prog: "
+    killproc -p $PIDFILE $prog
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && rm -f $lockfile
+    return $retval
+}
+
+restart() {
+    stop
+    start
+}
+
+reload() {
+    restart
+}
+
+force_reload() {
+    restart
+}
+
+rh_status() {
+    # run checks to determine if the service is running or use generic status
+    status -p $PIDFILE $prog
+}
+
+rh_status_q() {
+    rh_status >/dev/null 2>&1
+}
+
+
+case "$1" in
+    start)
+        rh_status_q && exit 0
+        $1
+        ;;
+    stop)
+        rh_status_q || exit 0
+        $1
+        ;;
+    restart)
+        $1
+        ;;
+    reload)
+        rh_status_q || exit 7
+        $1
+        ;;
+    force-reload)
+        force_reload
+        ;;
+    status)
+        rh_status
+        ;;
+    condrestart|try-restart)
+        rh_status_q || exit 0
+        restart
+        ;;
+    *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
+        exit 2
+esac
+exit $?
diff --git a/puppet/modules/nagios/templates/irc_bot/Debian/nagios-nsa.sh.erb b/puppet/modules/nagios/templates/irc_bot/Debian/nagios-nsa.sh.erb
new file mode 100644
index 00000000..43c0e794
--- /dev/null
+++ b/puppet/modules/nagios/templates/irc_bot/Debian/nagios-nsa.sh.erb
@@ -0,0 +1,72 @@
+#! /bin/sh
+
+### BEGIN INIT INFO
+# Provides:		nagios-nsa
+# Required-Start:	$remote_fs $syslog nagios3
+# Required-Stop:	$remote_fs $syslog nagios3
+# Default-Start:	2 3 4 5
+# Default-Stop:		1 6 0
+# Short-Description:	Nagios Simple IRC Agent
+### END INIT INFO
+
+PIDFILE=<%= scope.lookupvar('nagios::irc_bot::real_nsa_pidfile') %>
+SOCKFILE=<%= scope.lookupvar('nagios::irc_bot::real_nsa_socket') %>
+
+. /lib/lsb/init-functions
+
+start() {
+	log_daemon_msg "Starting nagios IRC bot" "nagios-nsa"
+        if start-stop-daemon --start --quiet --oknodo --pidfile $PIDFILE --user nagios --chuid nagios --exec /usr/local/bin/riseup-nagios-server.pl; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+}
+
+stop () {
+	log_daemon_msg "Stopping nagios IRC bot" "nagios-nsa"
+        if start-stop-daemon --stop --quiet --pidfile $PIDFILE; then
+            log_end_msg 0
+        else
+            log_end_msg 1
+        fi
+}
+
+remove_socket() {
+	[ -e $SOCKFILE ] && rm $SOCKFILE
+}
+
+cleanup() {
+        if [ -r $PIDFILE ]; then
+                ps -p `cat $PIDFILE` | grep -v 'PID' || {
+			echo "not running"
+			remove_socket
+		}
+        else
+                echo "no pid file"
+		remove_socket
+        fi
+}
+
+case $1
+in
+        start)
+		cleanup
+                start
+                ;;
+        stop)
+                stop
+                ;;
+        restart)
+                stop
+		cleanup
+                start
+                ;;
+        status)
+                status_of_proc -p $PIDFILE /usr/local/bin/riseup-nagios-server.pl && exit 0 || exit $?
+                ;;
+        *)
+                log_action_msg "Usage: /etc/init.d/nagios-nsa {start|stop|restart|status}"
+                exit 1
+esac
+
diff --git a/puppet/modules/nagios/templates/irc_bot/nsa.cfg.erb b/puppet/modules/nagios/templates/irc_bot/nsa.cfg.erb
new file mode 100644
index 00000000..c4091e8a
--- /dev/null
+++ b/puppet/modules/nagios/templates/irc_bot/nsa.cfg.erb
@@ -0,0 +1,15 @@
+%Nsa = (
+        'socket'      => '<%= scope.lookupvar('nagios::irc_bot::real_nsa_socket') %>',
+        'server'      => '<%= scope.lookupvar('nagios::irc_bot::nsa_server') %>',
+        'port'        => '<%= scope.lookupvar('nagios::irc_bot::nsa_port') %>',
+        'nickname'    => '<%= scope.lookupvar('nagios::irc_bot::nsa_nickname') %>',
+        'password'    => '<%= scope.lookupvar('nagios::irc_bot::nsa_password') %>',
+	# this needs libio-socket-ssl-perl
+	# doesn't actually works because Net::IRC is braindead and tries to use IO::Socket::SSL->read/write instead of the builtin print, see http://search.cpan.org/dist/IO-Socket-SSL/SSL.pm
+	#'SSL'        => 0,
+        'channel'     => '<%= scope.lookupvar('nagios::irc_bot::nsa_channel') %>',
+        'pidfile'     => '<%= scope.lookupvar('nagios::irc_bot::real_nsa_pidfile') %>', # set to undef to disable
+        'realname'    => '<%= scope.lookupvar('nagios::irc_bot::nsa_realname') %>',
+        'usenotices'  => '<%= scope.lookupvar('nagios::irc_bot::nsa_usenotices') %>',
+        'commandfile' => '<%= scope.lookupvar('nagios::irc_bot::real_nsa_commandfile') %>',
+);
diff --git a/puppet/modules/nagios/templates/nrpe/nrpe.cfg b/puppet/modules/nagios/templates/nrpe/nrpe.cfg
new file mode 100644
index 00000000..d4ad9a4d
--- /dev/null
+++ b/puppet/modules/nagios/templates/nrpe/nrpe.cfg
@@ -0,0 +1,203 @@
+#############################################################################
+# Sample NRPE Config File 
+# Written by: Ethan Galstad (nagios@nagios.org)
+# 
+# Last Modified: 02-23-2006
+#
+# NOTES:
+# This is a sample configuration file for the NRPE daemon.  It needs to be
+# located on the remote host that is running the NRPE daemon, not the host
+# from which the check_nrpe client is being executed.
+#############################################################################
+
+
+# PID FILE
+# The name of the file in which the NRPE daemon should write it's process ID
+# number.  The file is only written if the NRPE daemon is started by the root
+# user and is running in standalone mode.
+
+pid_file=<%= @pid_file %>
+
+
+
+# PORT NUMBER
+# Port number we should wait for connections on.
+# NOTE: This must be a non-priviledged port (i.e. > 1024).
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+server_port=5666
+
+
+
+# SERVER ADDRESS
+# Address that nrpe should bind to in case there are more than one interface
+# and you do not want nrpe to bind on all interfaces.
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+<%- if not @server_address.to_s.empty? then %>
+server_address=<%= @server_address %>
+<%- end %>
+
+
+# NRPE USER
+# This determines the effective user that the NRPE daemon should run as.  
+# You can either supply a username or a UID.
+# 
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+nrpe_user=nagios
+
+
+
+# NRPE GROUP
+# This determines the effective group that the NRPE daemon should run as.  
+# You can either supply a group name or a GID.
+# 
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+nrpe_group=nagios
+
+
+
+# ALLOWED HOST ADDRESSES
+# This is an optional comma-delimited list of IP address or hostnames 
+# that are allowed to talk to the NRPE daemon.
+#
+# Note: The daemon only does rudimentary checking of the client's IP
+# address.  I would highly recommend adding entries in your /etc/hosts.allow
+# file to allow only the specified host to connect to the port
+# you are running this daemon on.
+#
+# NOTE: This option is ignored if NRPE is running under either inetd or xinetd
+
+<%- if @allowed_hosts.to_s.empty? then %>
+allowed_hosts=127.0.0.1
+<%- else %>
+allowed_hosts=127.0.0.1,<%= @allowed_hosts %>
+<%- end %>
+
+# COMMAND ARGUMENT PROCESSING
+# This option determines whether or not the NRPE daemon will allow clients
+# to specify arguments to commands that are executed.  This option only works
+# if the daemon was configured with the --enable-command-args configure script
+# option.  
+#
+# *** ENABLING THIS OPTION IS A SECURITY RISK! *** 
+# Read the SECURITY file for information on some of the security implications
+# of enabling this variable.
+#
+# Values: 0=do not allow arguments, 1=allow command arguments
+
+dont_blame_nrpe=<%= @dont_blame %>
+
+
+# COMMAND PREFIX
+# This option allows you to prefix all commands with a user-defined string.
+# A space is automatically added between the specified prefix string and the
+# command line from the command definition.
+#
+# *** THIS EXAMPLE MAY POSE A POTENTIAL SECURITY RISK, SO USE WITH CAUTION! ***
+# Usage scenario: 
+# Execute restricted commmands using sudo.  For this to work, you need to add
+# the nagios user to your /etc/sudoers.  An example entry for alllowing 
+# execution of the plugins from might be:
+#
+# nagios          ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins/
+#
+# This lets the nagios user run all commands in that directory (and only them)
+# without asking for a password.  If you do this, make sure you don't give
+# random users write access to that directory or its contents!
+
+# command_prefix=/usr/bin/sudo 
+
+
+
+# DEBUGGING OPTION
+# This option determines whether or not debugging messages are logged to the
+# syslog facility.
+# Values: 0=debugging off, 1=debugging on
+
+debug=0
+
+
+
+# COMMAND TIMEOUT
+# This specifies the maximum number of seconds that the NRPE daemon will
+# allow plugins to finish executing before killing them off.
+
+command_timeout=60
+
+
+
+# WEEK RANDOM SEED OPTION
+# This directive allows you to use SSL even if your system does not have
+# a /dev/random or /dev/urandom (on purpose or because the necessary patches
+# were not applied). The random number generator will be seeded from a file
+# which is either a file pointed to by the environment valiable $RANDFILE
+# or $HOME/.rnd. If neither exists, the pseudo random number generator will
+# be initialized and a warning will be issued.
+# Values: 0=only seed from /dev/[u]random, 1=also seed from weak randomness
+
+#allow_weak_random_seed=1
+
+
+
+# INCLUDE CONFIG FILE
+# This directive allows you to include definitions from an external config file.
+
+#include=<somefile.cfg>
+
+
+
+# INCLUDE CONFIG DIRECTORY
+# This directive allows you to include definitions from config files (with a
+# .cfg extension) in one or more directories (with recursion).
+
+#include_dir=<somedirectory>
+#include_dir=<someotherdirectory>
+include_dir=<%= @cfg_dir %>/nrpe.d
+
+
+
+# COMMAND DEFINITIONS
+# Command definitions that this daemon will run.  Definitions
+# are in the following format:
+#
+# command[<command_name>]=<command_line>
+#
+# When the daemon receives a request to return the results of <command_name>
+# it will execute the command specified by the <command_line> argument.
+#
+# Unlike Nagios, the command line cannot contain macros - it must be
+# typed exactly as it should be executed.
+#
+# Note: Any plugins that are used in the command lines must reside
+# on the machine that this daemon is running on!  The examples below
+# assume that you have plugins installed in a /usr/local/nagios/libexec
+# directory.  Also note that you will have to modify the definitions below
+# to match the argument format the plugins expect.  Remember, these are
+# examples only!
+
+# The following examples use hardcoded command arguments...
+
+#command[check_users]=/usr/lib/nagios/plugins/check_users -w 5 -c 10
+#command[check_load]=/usr/lib/nagios/plugins/check_load -w 15,10,5 -c 30,25,20
+#command[check_disk1]=/usr/lib/nagios/plugins/check_disk -w 20 -c 10 -p /dev/hda1
+#command[check_disk2]=/usr/lib/nagios/plugins/check_disk -w 20 -c 10 -p /dev/hdb1
+#command[check_zombie_procs]=/usr/lib/nagios/plugins/check_procs -w 5 -c 10 -s Z
+#command[check_total_procs]=/usr/lib/nagios/plugins/check_procs -w 150 -c 200 
+
+# The following examples allow user-supplied arguments and can
+# only be used if the NRPE daemon was compiled with support for 
+# command arguments *AND* the dont_blame_nrpe directive in this
+# config file is set to '1'...
+
+#command[check_users]=/usr/lib/nagios/plugins/check_users -w $ARG1$ -c $ARG2$
+#command[check_load]=/usr/lib/nagios/plugins/check_load -w $ARG1$ -c $ARG2$
+#command[check_disk]=/usr/lib/nagios/plugins/check_disk -w $ARG1$ -c $ARG2$ -p $ARG3$
+#command[check_procs]=/usr/lib/nagios/plugins/check_procs -w $ARG1$ -c $ARG2$ -s $ARG3$
+
+#
+# local configuration:
+#	if you'd prefer, you can instead place directives here
+
diff --git a/puppet/modules/nagios/templates/nrpe/nrpe_command.erb b/puppet/modules/nagios/templates/nrpe/nrpe_command.erb
new file mode 100644
index 00000000..99f4601b
--- /dev/null
+++ b/puppet/modules/nagios/templates/nrpe/nrpe_command.erb
@@ -0,0 +1,2 @@
+# generated by puppet, do not edit
+command[<%= name -%>]=<%= command_line %>
-- 
cgit v1.2.3


From 297fadc8e6ad4729589d4ec21683f05a1e50bdf9 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:13 -0400
Subject: git subrepo clone https://leap.se/git/puppet_tor puppet/modules/tor

subrepo:
  subdir:   "puppet/modules/tor"
  merged:   "9981a70"
upstream:
  origin:   "https://leap.se/git/puppet_tor"
  branch:   "master"
  commit:   "9981a70"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I0a876a52bd83914cfd1e06abe9af208dd62e5683
---
 puppet/modules/tor/.gitignore                      |    1 +
 puppet/modules/tor/.gitrepo                        |   11 +
 puppet/modules/tor/LICENSE                         |  661 ++++
 puppet/modules/tor/README                          |  214 ++
 puppet/modules/tor/files/munin/tor_connections     |  162 +
 puppet/modules/tor/files/munin/tor_routers         |  151 +
 puppet/modules/tor/files/munin/tor_traffic         |  154 +
 puppet/modules/tor/files/polipo/polipo.conf        |  164 +
 puppet/modules/tor/files/tor-exit-notice.html      |  144 +
 puppet/modules/tor/files/tor.html                  | 3157 ++++++++++++++++++++
 puppet/modules/tor/manifests/arm.pp                |    9 +
 puppet/modules/tor/manifests/base.pp               |   14 +
 puppet/modules/tor/manifests/compact.pp            |    7 +
 puppet/modules/tor/manifests/daemon.pp             |   22 +
 puppet/modules/tor/manifests/daemon/base.pp        |   77 +
 puppet/modules/tor/manifests/daemon/bridge.pp      |   18 +
 puppet/modules/tor/manifests/daemon/control.pp     |   27 +
 puppet/modules/tor/manifests/daemon/directory.pp   |   27 +
 puppet/modules/tor/manifests/daemon/dns.pp         |   17 +
 puppet/modules/tor/manifests/daemon/exit_policy.pp |   18 +
 .../modules/tor/manifests/daemon/hidden_service.pp |   17 +
 puppet/modules/tor/manifests/daemon/map_address.pp |   17 +
 puppet/modules/tor/manifests/daemon/relay.pp       |   42 +
 puppet/modules/tor/manifests/daemon/snippet.pp     |   16 +
 puppet/modules/tor/manifests/daemon/socks.pp       |   15 +
 puppet/modules/tor/manifests/daemon/transparent.pp |   17 +
 puppet/modules/tor/manifests/init.pp               |    6 +
 puppet/modules/tor/manifests/munin.pp              |   21 +
 puppet/modules/tor/manifests/polipo.pp             |    9 +
 puppet/modules/tor/manifests/polipo/base.pp        |   22 +
 puppet/modules/tor/manifests/polipo/debian.pp      |    7 +
 puppet/modules/tor/manifests/repo.pp               |   16 +
 puppet/modules/tor/manifests/repo/debian.pp        |    9 +
 puppet/modules/tor/manifests/torsocks.pp           |    9 +
 puppet/modules/tor/templates/torrc.bridge.erb      |    3 +
 puppet/modules/tor/templates/torrc.control.erb     |   16 +
 puppet/modules/tor/templates/torrc.directory.erb   |   11 +
 puppet/modules/tor/templates/torrc.dns.erb         |    5 +
 puppet/modules/tor/templates/torrc.exit_policy.erb |   11 +
 puppet/modules/tor/templates/torrc.global.erb      |   24 +
 puppet/modules/tor/templates/torrc.header.erb      |    2 +
 .../modules/tor/templates/torrc.hidden_service.erb |    6 +
 puppet/modules/tor/templates/torrc.map_address.erb |    3 +
 puppet/modules/tor/templates/torrc.relay.erb       |   46 +
 puppet/modules/tor/templates/torrc.socks.erb       |    9 +
 puppet/modules/tor/templates/torrc.transparent.erb |    5 +
 46 files changed, 5419 insertions(+)
 create mode 100644 puppet/modules/tor/.gitignore
 create mode 100644 puppet/modules/tor/.gitrepo
 create mode 100644 puppet/modules/tor/LICENSE
 create mode 100644 puppet/modules/tor/README
 create mode 100755 puppet/modules/tor/files/munin/tor_connections
 create mode 100755 puppet/modules/tor/files/munin/tor_routers
 create mode 100755 puppet/modules/tor/files/munin/tor_traffic
 create mode 100644 puppet/modules/tor/files/polipo/polipo.conf
 create mode 100644 puppet/modules/tor/files/tor-exit-notice.html
 create mode 100644 puppet/modules/tor/files/tor.html
 create mode 100644 puppet/modules/tor/manifests/arm.pp
 create mode 100644 puppet/modules/tor/manifests/base.pp
 create mode 100644 puppet/modules/tor/manifests/compact.pp
 create mode 100644 puppet/modules/tor/manifests/daemon.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/base.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/bridge.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/control.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/directory.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/dns.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/exit_policy.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/hidden_service.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/map_address.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/relay.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/snippet.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/socks.pp
 create mode 100644 puppet/modules/tor/manifests/daemon/transparent.pp
 create mode 100644 puppet/modules/tor/manifests/init.pp
 create mode 100644 puppet/modules/tor/manifests/munin.pp
 create mode 100644 puppet/modules/tor/manifests/polipo.pp
 create mode 100644 puppet/modules/tor/manifests/polipo/base.pp
 create mode 100644 puppet/modules/tor/manifests/polipo/debian.pp
 create mode 100644 puppet/modules/tor/manifests/repo.pp
 create mode 100644 puppet/modules/tor/manifests/repo/debian.pp
 create mode 100644 puppet/modules/tor/manifests/torsocks.pp
 create mode 100644 puppet/modules/tor/templates/torrc.bridge.erb
 create mode 100644 puppet/modules/tor/templates/torrc.control.erb
 create mode 100644 puppet/modules/tor/templates/torrc.directory.erb
 create mode 100644 puppet/modules/tor/templates/torrc.dns.erb
 create mode 100644 puppet/modules/tor/templates/torrc.exit_policy.erb
 create mode 100644 puppet/modules/tor/templates/torrc.global.erb
 create mode 100644 puppet/modules/tor/templates/torrc.header.erb
 create mode 100644 puppet/modules/tor/templates/torrc.hidden_service.erb
 create mode 100644 puppet/modules/tor/templates/torrc.map_address.erb
 create mode 100644 puppet/modules/tor/templates/torrc.relay.erb
 create mode 100644 puppet/modules/tor/templates/torrc.socks.erb
 create mode 100644 puppet/modules/tor/templates/torrc.transparent.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/tor/.gitignore b/puppet/modules/tor/.gitignore
new file mode 100644
index 00000000..1377554e
--- /dev/null
+++ b/puppet/modules/tor/.gitignore
@@ -0,0 +1 @@
+*.swp
diff --git a/puppet/modules/tor/.gitrepo b/puppet/modules/tor/.gitrepo
new file mode 100644
index 00000000..dfc1b3d9
--- /dev/null
+++ b/puppet/modules/tor/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_tor
+	branch = master
+	commit = 9981a70f7ba1f9e4fe33e4eb46654295287c1fc1
+	parent = 26aac7ccf240b06d65616bdd00ae472d980aaea9
+	cmdver = 0.3.0
diff --git a/puppet/modules/tor/LICENSE b/puppet/modules/tor/LICENSE
new file mode 100644
index 00000000..dba13ed2
--- /dev/null
+++ b/puppet/modules/tor/LICENSE
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<http://www.gnu.org/licenses/>.
diff --git a/puppet/modules/tor/README b/puppet/modules/tor/README
new file mode 100644
index 00000000..7777438a
--- /dev/null
+++ b/puppet/modules/tor/README
@@ -0,0 +1,214 @@
+puppet module for managing tor
+==============================
+
+This module tries to manage tor, making sure it is installed, running, has munin
+graphs if desired and allows for configuration of relays, hidden services, exit
+policies, etc.
+
+! Upgrade Notice !
+
+ previously, if you did not set the $outbound_bindaddress variable, it was being 
+ automatically set to the $listen_address variable. Now this is not being done
+ and instead you will need to set the $outbound_bindaddress explicitly for it to 
+ be set. 
+
+ the tor::relay{} variables $bandwidth_rate and $bandwidth_burst were previously
+ used for the tor configuration variables RelayBandwidthRate and
+ RelayBandwidthBurst, these have been renamed to $relay_bandwidth_rate and
+ $relay_bandwidth_burst. If you were using these, please rename your variables in
+ your configuration.
+
+ The variables $bandwidth_rate and $bandwidth_burst are now used for the tor
+ configuration variables BandwidthRate and BandwidthBurst. If you used
+ $bandwidth_rate or $bandwidth_burst please be aware that these values have
+ changed and adjust your configuration as necessary.
+
+ The $tor_ensure_version was converted to a parameter for the tor and
+ tor::daemon classes.
+
+ The $torsocks_ensure_version was converted to a parameter for the
+ tor::torsocks class.
+
+ The options that used to be settable with the
+ tor::daemon::global_opts define now are parameters for the
+ tor::daemon class, and tor::daemon::global_opts was
+ removed accordingly.
+
+
+Dependencies
+============
+
+This module needs:
+
+- the concat module: git://labs.riseup.net/shared-concat
+
+Usage
+=====
+
+Installing tor
+--------------
+
+To install tor, simply include the 'tor' class in your manifests:
+
+    class { 'tor': }
+
+You can specify the $ensure_version class parameter to get a specific
+version installed.
+
+However, if you want to make configuration changes to your tor daemon, you will
+want to instead include the 'tor::daemon' class in your manifests, which will
+inherit the 'tor' class from above:
+
+    class { '::tor::daemon': }
+
+You have the following class parameters that you can specify:
+
+data_dir    (default: '/var/lib/tor')
+config_file (default: '/etc/tor/torrc')
+use_bridges (default: 0)
+automap_hosts_on_resolve (default: 0)
+log_rules   (default: ['notice file /var/log/tor/notices.log'])
+
+The data_dir will be used for the tor user's $HOME, and the tor DataDirectory
+value.
+
+The config_file will be managed and the daemon restarted when
+it changed.
+
+use_bridges and automap_hosts_on_resolve are used to set the
+UseBridges and AutomapHostsOnResolve torrc settings.
+
+The log_rules can be an array of different Log lines, each will be added to the
+config, for example the following will use syslog:
+
+    class { '::tor::daemon':
+        log_rules => [ 'notice syslog' ],
+    }
+
+If you want to set specific options for the tor class,
+you may pass them directly to the tor::daemon in your manifests,
+e.g.:
+
+    class { '::tor::daemon':
+      use_munin                 => true,
+      automap_hosts_on_resolve  => 1,
+    }
+
+Configuring socks
+-----------------
+
+To configure tor socks support, you can do the following:
+
+  tor::daemon::socks { "listen_locally": listen_addresses => [ '127.0.0.1' ]; }
+
+this will setup the SocksListenAddress to be 127.0.0.1. You also can pass the
+following options to tor::daemon::socks:
+
+$port = 0       - SocksPort
+$listen_address - can pass multiple values to configure SocksListenAddress lines
+$policies       - can pass multiple values to configure SocksPolicy lines
+
+Installing torsocks
+-------------------
+
+To install torsocks, simply include the 'torsocks' class in your manifests:
+
+    class { 'torsocks': }
+
+You can specify the $ensure_version class parameter to get a specific
+version installed.
+
+Configuring relays
+==================
+
+An example relay configuration:
+
+ tor::daemon::relay { "foobar":
+   port => 9001, listen_addresses => '192.168.0.1', address => '192.168.0.1',
+   bandwidth_rate => '256', bandwidth_burst => '256', contact_info => "Foo <collective at example dot com>",
+   my_family => '<long family string here>'
+ }
+
+You have the following options that can be passed to a relay, with the defaults shown:
+ 
+$port                    = 0,
+$listen_addresses        = [],
+$portforwarding          = 0,     # PortForwarding 0|1, set for opening ports at the router via UPnP.
+                                  # Requires 'tor-fw-helper' binary present.
+$bandwidth_rate          = '',    # KB/s, defaulting to using tor's default: 5120KB/s
+$bandwidth_burst         = '',    # KB/s, defaulting to using tor's default: 10240KB/s
+$relay_bandwidth_rate    = 0,     # KB/s, 0 for no limit.
+$relay_bandwidth_burst   = 0,     # KB/s, 0 for no limit.
+$accounting_max          = 0,     # GB, 0 for no limit.
+$accounting_start        = [],
+$contact_info            = '',
+$my_family               = '', # TODO: autofill with other relays
+$address                 = "tor.${domain}",
+$bridge_relay            = 0,
+$ensure                  = present
+$nickname                = $name
+
+Configuring the control 
+-----------------------
+
+To pass parameters to configure the ControlPort and the HashedControlPassword,
+you would do something like this:
+
+ tor::daemon::control { "foo-control": 
+  port => '80', hashed_control_password => '<somehash>',
+  ensure => present 
+}
+
+Note: you must pass a hashed password to the control port, if you are going to
+use it.
+
+
+Configuring hidden services
+---------------------------
+
+To configure a tor hidden service you can do something like the following:
+
+ tor::daemon::hidden_service { "hidden_ssh": ports => 22 }
+
+The HiddenServiceDir is set to the ${data_dir}/${name}.
+
+Configuring directories
+-----------------------
+
+An example directory configuration:
+
+ tor::daemon::directory { 'ssh_directory':
+   port => 80, listen_address => '192.168.0.1', 
+   port_front_page => '/etc/tor/tor.html'
+ }
+  
+Configuring exit policies
+--------------------------
+
+To configure exit policies, you can do the following:
+ 
+tor::daemon::exit_policy { "ssh_exit_policy":
+        accept => "192.168.0.1:22",
+        reject => "*:*";
+      }
+    }
+
+
+Polipo
+======
+
+Polipo support can be enabled by doing:
+
+    include tor::polipo
+
+this will inherit the tor class by default, remove privoxy if its installed, and
+install polipo, making sure it is running.
+  
+
+Munin
+=====
+
+If you are using munin, and have the puppet munin module installed, you can set
+the use_munin parameter to true when defining the tor::daemon class to have
+graphs setup for you.
+
diff --git a/puppet/modules/tor/files/munin/tor_connections b/puppet/modules/tor/files/munin/tor_connections
new file mode 100755
index 00000000..c1d0a928
--- /dev/null
+++ b/puppet/modules/tor/files/munin/tor_connections
@@ -0,0 +1,162 @@
+#!/usr/bin/perl -w
+#
+# Munin plugin to monitor Tor
+#
+# Author: Ge van Geldorp <ge@gse.nl>
+#
+# Parameters understood:
+#
+# 	host       - Change which host to graph (default localhost)
+# 	port       - Change which port to connect to (default 9051)
+#	password   - Plain-text control channel password (see torrc
+#	             HashedControlPassword parameter)
+#	cookiefile - Name of the file containing the control channel cookie
+#	             (see torrc CookieAuthentication parameter)
+#
+# Using HashedControlPassword authentication has the problem that you must
+# include the plain-text password in the munin config file. To have any
+# effect, that file shouldn't be world-readable.
+# If you're using CookieAuthentication, you should run this plugin as a user
+# which has read access to the tor datafiles. Also note that bugs in versions
+# upto and including 0.1.1.20 prevent CookieAuthentication from working.
+#
+# Usage: place in /etc/munin/node.d/ (or link it there using ln -s)
+#
+# Parameters understood:
+# 	config   (required)
+# 	autoconf (optional - used by munin-config)
+#
+#
+# Magic markers - optional - used by installation scripts and
+# munin-config:
+#
+#%# family=contrib
+#%# capabilities=autoconf
+
+use strict;
+use IO::Socket::INET;
+
+# Config
+our $address = $ENV{host}  || "localhost";	# Default: localhost
+our $port    = $ENV{port}  || 9051;		# Default: 9051
+
+# Don't edit below this line
+
+sub Authenticate
+{
+	my ($socket) = @_;
+	my $authline = "AUTHENTICATE";
+	if (defined($ENV{cookiefile})) {
+		if (open(COOKIE, "<$ENV{cookiefile}")) {
+			binmode COOKIE;
+			my $cookie;
+			$authline .= " ";
+			while (read(COOKIE, $cookie, 32)) {
+				foreach my $byte (unpack "C*", $cookie) {
+					$authline .= sprintf "%02x", $byte;
+				}
+			}
+			close COOKIE;
+		}
+	} elsif (defined($ENV{password})) {
+		$authline .= ' "' . $ENV{password} . '"';
+	}
+	print $socket "$authline\r\n";
+	my $replyline = <$socket>;
+	if (substr($replyline, 0, 1) != '2') {
+		$replyline =~ s/\s*$//;
+		return "Failed to authenticate: $replyline";
+	}
+
+	return;
+}
+
+if ($ARGV[0] and $ARGV[0] eq "autoconf") {
+	# Try to connect to the daemon
+	my $socket = IO::Socket::INET->new("$address:$port")
+		or my $failed = 1;
+
+	if ($failed) {
+		print "no (failed to connect to $address port $port)\n";
+		exit 1;
+	}
+
+	my $msg = Authenticate($socket);
+	if (defined($msg)) {
+		print $socket "QUIT\r\n";
+		close($socket);
+		print "no ($msg)\n";
+		exit 1;
+	}
+
+	print $socket "QUIT\r\n";
+	close($socket);
+	print "yes\n";
+	exit 0;
+}
+
+my %connections = ("new",       0,
+                   "launched",  0,
+                   "connected", 0,
+                   "failed",    0,
+                   "closed",    0);
+
+if ($ARGV[0] and $ARGV[0] eq "config") {
+	print "graph_title Connections\n";
+	print "graph_args -l 0 --base 1000\n";
+	print "graph_vlabel connections\n";
+	print "graph_category Tor\n";
+	print "graph_period second\n";
+	print "graph_info This graph shows the number of Tor OR connections.\n";
+
+	foreach my $status (keys %connections) {
+		print "$status.label $status\n";
+		print "$status.type GAUGE\n";
+		print "$status.max 50000\n";
+		print "$status.min 0\n";
+	}
+	
+        exit 0;
+}
+
+my $socket = IO::Socket::INET->new("$address:$port")
+	or die("Couldn't connect to $address port $port: $!");
+
+my $msg = Authenticate($socket);
+if (defined($msg)) {
+	print $socket "QUIT\r\n";
+	close($socket);
+	die "$msg\n";
+}
+
+print $socket "GETINFO orconn-status\r\n";
+my $replyline = <$socket>;
+if (substr($replyline, 0, 1) != '2') {
+	print $socket "QUIT\r\n";
+	close($socket);
+	$replyline =~ s/\s*$//;
+	die "Failed to get orconn-status info: $replyline\n";
+}
+
+while (! (($replyline = <$socket>) =~ /^\.\s*$/)) {
+	my @reply = split(/\s+/, $replyline);
+	$connections{lc($reply[1])}++;
+}
+$replyline = <$socket>;
+if (substr($replyline, 0, 1) != '2') {
+	print $socket "QUIT\r\n";
+	close($socket);
+	$replyline =~ s/\s*$//;
+	die "Failed to authenticate: $replyline\n";
+}
+
+print $socket "QUIT\r\n";
+close($socket);
+
+while (my ($status, $count) = each(%connections)) {
+	print "$status.value $count\n";
+}
+
+exit 0;
+
+# vim:syntax=perl
diff --git a/puppet/modules/tor/files/munin/tor_routers b/puppet/modules/tor/files/munin/tor_routers
new file mode 100755
index 00000000..b977f9aa
--- /dev/null
+++ b/puppet/modules/tor/files/munin/tor_routers
@@ -0,0 +1,151 @@
+#!/usr/bin/perl -w
+#
+# Munin plugin to monitor Tor routers
+#
+# Author: Ævar Arnfjörð Bjarmason <avarab@gmail.com>, based on a plugin by Ge van Geldorp <ge@gse.nl>
+#
+# Parameters understood:
+#
+# 	host       - Change which host to graph (default localhost)
+# 	port       - Change which port to connect to (default 9051)
+#	password   - Plain-text control channel password (see torrc
+#	             HashedControlPassword parameter)
+#	cookiefile - Name of the file containing the control channel cookie
+#	             (see torrc CookieAuthentication parameter)
+#
+# Using HashedControlPassword authentication has the problem that you must
+# include the plain-text password in the munin config file. To have any
+# effect, that file shouldn't be world-readable.
+# If you're using CookieAuthentication, you should run this plugin as a user
+# which has read access to the tor datafiles. Also note that bugs in versions
+# upto and including 0.1.1.20 prevent CookieAuthentication from working.
+#
+# Usage: place in /etc/munin/node.d/ (or link it there using ln -s)
+#
+# Parameters understood:
+# 	config   (required)
+# 	autoconf (optional - used by munin-config)
+#
+#
+# Magic markers - optional - used by installation scripts and
+# munin-config:
+#
+#%# family=contrib
+#%# capabilities=autoconf
+
+use strict;
+use IO::Socket::INET;
+
+# Config
+our $address = $ENV{host}  || "localhost";	# Default: localhost
+our $port    = $ENV{port}  || 9051;		# Default: 9051
+
+# Don't edit below this line
+
+sub Authenticate
+{
+	my ($socket) = @_;
+	my $authline = "AUTHENTICATE";
+	if (defined($ENV{cookiefile})) {
+		if (open(COOKIE, "<$ENV{cookiefile}")) {
+			binmode COOKIE;
+			my $cookie;
+			$authline .= " ";
+			while (read(COOKIE, $cookie, 32)) {
+				foreach my $byte (unpack "C*", $cookie) {
+					$authline .= sprintf "%02x", $byte;
+				}
+			}
+			close COOKIE;
+		}
+	} elsif (defined($ENV{password})) {
+		$authline .= ' "' . $ENV{password} . '"';
+	}
+	print $socket "$authline\r\n";
+	my $replyline = <$socket>;
+	if (substr($replyline, 0, 1) != '2') {
+		$replyline =~ s/\s*$//;
+		return "Failed to authenticate: $replyline";
+	}
+
+	return;
+}
+
+if ($ARGV[0] and $ARGV[0] eq "autoconf") {
+	# Try to connect to the daemon
+	my $socket = IO::Socket::INET->new("$address:$port")
+		or my $failed = 1;
+
+	if ($failed) {
+		print "no (failed to connect to $address port $port)\n";
+		exit 1;
+	}
+
+	my $msg = Authenticate($socket);
+	if (defined($msg)) {
+		print $socket "QUIT\r\n";
+		close($socket);
+		print "no ($msg)\n";
+		exit 1;
+	}
+
+	print $socket "QUIT\r\n";
+	close($socket);
+	print "yes\n";
+	exit 0;
+}
+
+if ($ARGV[0] and $ARGV[0] eq "config") {
+	print "graph_title Routers\n";
+	print "graph_args -l 0\n";
+	print "graph_vlabel routers\n";
+	print "graph_category Tor\n";
+	print "graph_info This graph shows the number of known Tor ORs.\n";
+
+    print "ors.label routers\n";
+    print "ors.type GAUGE\n";
+    print "ors.info The number of known Tor ORs (onion routers)\n";
+
+    exit 0;
+}
+
+my $socket = IO::Socket::INET->new("$address:$port")
+	or die("Couldn't connect to $address port $port: $!");
+
+my $msg = Authenticate($socket);
+if (defined($msg)) {
+	print $socket "QUIT\r\n";
+	close($socket);
+	die "$msg\n";
+}
+
+print $socket "GETINFO ns/all\r\n";
+my $replyline = <$socket>;
+if (substr($replyline, 0, 1) != '2') {
+	print $socket "QUIT\r\n";
+	close($socket);
+	$replyline =~ s/\s*$//;
+	die "Failed to get orconn-status info: $replyline\n";
+}
+
+my $count;
+while (! (($replyline = <$socket>) =~ /^\.\s*$/)) {
+	my @reply = split(/\s+/, $replyline);
+    $count++ if $reply[0] eq 'r';
+}
+$replyline = <$socket>;
+if (substr($replyline, 0, 1) != '2') {
+	print $socket "QUIT\r\n";
+	close($socket);
+	$replyline =~ s/\s*$//;
+	die "Failed to authenticate: $replyline\n";
+}
+
+print $socket "QUIT\r\n";
+close($socket);
+
+print "ors.value $count\n";
+
+exit 0;
+
+# vim:syntax=perl
diff --git a/puppet/modules/tor/files/munin/tor_traffic b/puppet/modules/tor/files/munin/tor_traffic
new file mode 100755
index 00000000..a72e7d7f
--- /dev/null
+++ b/puppet/modules/tor/files/munin/tor_traffic
@@ -0,0 +1,154 @@
+#!/usr/bin/perl -w
+#
+# Munin plugin to monitor Tor traffic
+#
+# Author: Ge van Geldorp <ge@gse.nl>
+#
+# Parameters understood:
+#
+# 	host       - Change which host to graph (default localhost)
+# 	port       - Change which port to connect to (default 9051)
+#	password   - Plain-text control channel password (see torrc
+#	             HashedControlPassword parameter)
+#	cookiefile - Name of the file containing the control channel cookie
+#	             (see torrc CookieAuthentication parameter)
+#
+# Using HashedControlPassword authentication has the problem that you must
+# include the plain-text password in the munin config file. To have any
+# effect, that file shouldn't be world-readable.
+# If you're using CookieAuthentication, you should run this plugin as a user
+# which has read access to the tor datafiles. Also note that bugs in versions
+# upto and including 0.1.1.20 prevent CookieAuthentication from working.
+#
+# Usage: place in /etc/munin/node.d/ (or link it there using ln -s)
+#
+# Parameters understood:
+# 	config   (required)
+# 	autoconf (optional - used by munin-config)
+#
+#
+# Magic markers - optional - used by installation scripts and
+# munin-config:
+#
+#%# family=contrib
+#%# capabilities=autoconf
+
+use strict;
+use IO::Socket::INET;
+
+# Config
+our $address = $ENV{host}  || "localhost";	# Default: localhost
+our $port    = $ENV{port}  || 9051;		# Default: 9051
+
+# Don't edit below this line
+
+sub Authenticate
+{
+	my ($socket) = @_;
+	my $authline = "AUTHENTICATE";
+	if (defined($ENV{cookiefile})) {
+		if (open(COOKIE, "<$ENV{cookiefile}")) {
+			binmode COOKIE;
+			my $cookie;
+			$authline .= " ";
+			while (read(COOKIE, $cookie, 32)) {
+				foreach my $byte (unpack "C*", $cookie) {
+					$authline .= sprintf "%02x", $byte;
+				}
+			}
+			close COOKIE;
+		}
+	} elsif (defined($ENV{password})) {
+		$authline .= ' "' . $ENV{password} . '"';
+	}
+	print $socket "$authline\r\n";
+	my $replyline = <$socket>;
+	if (substr($replyline, 0, 1) != '2') {
+		$replyline =~ s/\s*$//;
+		return "Failed to authenticate: $replyline";
+	}
+
+	return;
+}
+
+if ($ARGV[0] and $ARGV[0] eq "autoconf") {
+	# Try to connect to the daemon
+	my $socket = IO::Socket::INET->new("$address:$port")
+		or my $failed = 1;
+
+	if ($failed) {
+		print "no (failed to connect to $address port $port)\n";
+		exit 1;
+	}
+
+	my $msg = Authenticate($socket);
+	if (defined($msg)) {
+		print $socket "QUIT\r\n";
+		close($socket);
+		print "no ($msg)\n";
+		exit 1;
+	}
+
+	print $socket "QUIT\r\n";
+	close($socket);
+	print "yes\n";
+	exit 0;
+}
+
+if ($ARGV[0] and $ARGV[0] eq "config") {
+	print "graph_title Traffic\n";
+	print "graph_vlabel bytes per \${graph_period} read (-) / written (+)\n";
+	print "graph_category Tor\n";
+	print "graph_info This graph shows the bandwidth used by Tor.\n";
+
+	print "read.label byte/s\n";
+	print "read.type GAUGE\n";
+	print "read.graph no\n";
+	print "read.max 10000000\n";
+	print "write.label byte/s\n";
+	print "write.type GAUGE\n";
+	print "write.negative read\n";
+	print "write.max 10000000\n";
+	
+        exit 0;
+}
+
+my $socket = IO::Socket::INET->new("$address:$port")
+	or die("Couldn't connect to $address port $port: $!");
+
+my $msg = Authenticate($socket);
+if (defined($msg)) {
+	print $socket "QUIT\r\n";
+	close($socket);
+	die "$msg\n";
+}
+
+print $socket "SETEVENTS bw\r\n";
+my $replyline = <$socket>;
+if (substr($replyline, 0, 1) != '2') {
+	print $socket "QUIT\r\n";
+	close($socket);
+	$replyline =~ s/\s*$//;
+	die "Failed to get orconn-status info: $replyline\n";
+}
+
+$replyline = <$socket>;
+if (substr($replyline, 0, 1) != '6') {
+	print $socket "QUIT\r\n";
+	close($socket);
+	$replyline =~ s/\s*$//;
+	die "Failed to get bw: $replyline\n";
+}
+my @reply = split(/\s+/, $replyline);
+
+print $socket "SETEVENTS\r\n";
+$replyline = <$socket>;
+print $socket "QUIT\r\n";
+close($socket);
+
+print "read.value $reply[2]\n";
+print "write.value $reply[3]\n";
+
+exit 0;
+
+# vim:syntax=perl
diff --git a/puppet/modules/tor/files/polipo/polipo.conf b/puppet/modules/tor/files/polipo/polipo.conf
new file mode 100644
index 00000000..12b10c41
--- /dev/null
+++ b/puppet/modules/tor/files/polipo/polipo.conf
@@ -0,0 +1,164 @@
+# Polipo Configuration from https://svn.torproject.org/svn/torbrowser/trunk/build-scripts/config/polipo.conf
+# Managed by puppet.
+
+### Basic configuration
+### *******************
+
+# Uncomment one of these if you want to allow remote clients to
+# connect:
+
+# proxyAddress = "::0"        # both IPv4 and IPv6
+# proxyAddress = "0.0.0.0"    # IPv4 only
+
+proxyAddress = "127.0.0.1"
+proxyPort = 8118
+
+# If you do that, you'll want to restrict the set of hosts allowed to
+# connect:
+
+# allowedClients = "127.0.0.1, 134.157.168.57"
+# allowedClients = "127.0.0.1, 134.157.168.0/24"
+
+allowedClients = 127.0.0.1
+allowedPorts = 1-65535
+
+# Uncomment this if you want your Polipo to identify itself by
+# something else than the host name:
+
+proxyName = "localhost"
+
+# Uncomment this if there's only one user using this instance of Polipo:
+
+cacheIsShared = false
+
+# Uncomment this if you want to use a parent proxy:
+
+# parentProxy = "squid.example.org:3128"
+
+# Uncomment this if you want to use a parent SOCKS proxy:
+
+socksParentProxy = "localhost:9050"
+socksProxyType = socks5
+
+
+### Memory
+### ******
+
+# Uncomment this if you want Polipo to use a ridiculously small amount
+# of memory (a hundred C-64 worth or so):
+
+# chunkHighMark = 819200
+# objectHighMark = 128
+
+# Uncomment this if you've got plenty of memory:
+
+# chunkHighMark = 50331648
+# objectHighMark = 16384
+
+chunkHighMark = 67108864
+
+### On-disk data
+### ************
+
+# Uncomment this if you want to disable the on-disk cache:
+
+diskCacheRoot = ""
+
+# Uncomment this if you want to put the on-disk cache in a
+# non-standard location:
+
+# diskCacheRoot = "~/.polipo-cache/"
+
+# Uncomment this if you want to disable the local web server:
+
+localDocumentRoot = ""
+
+# Uncomment this if you want to enable the pages under /polipo/index?
+# and /polipo/servers?.  This is a serious privacy leak if your proxy
+# is shared.
+
+# disableIndexing = false
+# disableServersList = false
+
+disableLocalInterface = true
+disableConfiguration = true
+
+### Domain Name System
+### ******************
+
+# Uncomment this if you want to contact IPv4 hosts only (and make DNS
+# queries somewhat faster):
+#
+# dnsQueryIPv6 = no
+
+# Uncomment this if you want Polipo to prefer IPv4 to IPv6 for
+# double-stack hosts:
+#
+# dnsQueryIPv6 = reluctantly
+
+# Uncomment this to disable Polipo's DNS resolver and use the system's
+# default resolver instead.  If you do that, Polipo will freeze during
+# every DNS query:
+
+dnsUseGethostbyname = yes
+
+
+### HTTP
+### ****
+
+# Uncomment this if you want to enable detection of proxy loops.
+# This will cause your hostname (or whatever you put into proxyName
+# above) to be included in every request:
+
+disableVia = true
+
+# Uncomment this if you want to slightly reduce the amount of
+# information that you leak about yourself:
+
+# censoredHeaders = from, accept-language
+# censorReferer = maybe
+
+censoredHeaders = from,accept-language,x-pad,link
+censorReferer = maybe
+
+# Uncomment this if you're paranoid.  This will break a lot of sites,
+# though:
+
+# censoredHeaders = set-cookie, cookie, cookie2, from, accept-language
+# censorReferer = true
+
+# Uncomment this if you want to use Poor Man's Multiplexing; increase
+# the sizes if you're on a fast line.  They should each amount to a few
+# seconds' worth of transfer; if pmmSize is small, you'll want
+# pmmFirstSize to be larger.
+
+# Note that PMM is somewhat unreliable.
+
+# pmmFirstSize = 16384
+# pmmSize = 8192
+
+# Uncomment this if your user-agent does something reasonable with
+# Warning headers (most don't):
+
+# relaxTransparency = maybe
+
+# Uncomment this if you never want to revalidate instances for which
+# data is available (this is not a good idea):
+
+# relaxTransparency = yes
+
+# Uncomment this if you have no network:
+
+# proxyOffline = yes
+
+# Uncomment this if you want to avoid revalidating instances with a
+# Vary header (this is not a good idea):
+
+# mindlesslyCacheVary = true
+
+# Suggestions from Incognito configuration
+maxConnectionAge = 5m
+maxConnectionRequests = 120
+serverMaxSlots = 8
+serverSlots = 2
+tunnelAllowedPorts = 1-65535
diff --git a/puppet/modules/tor/files/tor-exit-notice.html b/puppet/modules/tor/files/tor-exit-notice.html
new file mode 100644
index 00000000..de3be174
--- /dev/null
+++ b/puppet/modules/tor/files/tor-exit-notice.html
@@ -0,0 +1,144 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
+<title>This is a Tor Exit Router</title>
+
+<!--
+
+This notice is intended to be placed on a virtual host for a domain that
+your Tor exit node IP reverse resolves to so that people who may be about
+to file an abuse complaint would check it first before bothering you or
+your ISP. Ex:
+http://tor-exit.yourdomain.org or http://tor-readme.yourdomain.org.
+
+This type of setup has proven very effective at reducing abuse complaints
+for exit node operators.
+
+There are a few places in this document that you may want to customize.
+They are marked with FIXME.
+
+-->
+
+</head>
+<body>
+
+<p style="text-align:center; font-size:xx-large; font-weight:bold">This is a
+Tor Exit Router</p>
+
+<p>
+Most likely you are accessing this website because you had some issue with
+the traffic coming from this IP. This router is part of the <a
+href="https://www.torproject.org/">Tor Anonymity Network</a>, which is
+dedicated to <a href="https://www.torproject.org/about/overview">providing
+privacy</a> to people who need it most: average computer users. This
+router IP should be generating no other traffic, unless it has been
+compromised.</p>
+
+
+<!-- FIXME: you should probably grab your own copy of how_tor_works_thumb.png
+     and serve it locally -->
+
+<p style="text-align:center">
+<a href="https://www.torproject.org/about/overview">
+<img src="https://www.torproject.org/images/how_tor_works_thumb.png" alt="How Tor works" style="border-style:none"/>
+</a></p>
+
+<p>
+Tor sees use by <a href="https://www.torproject.org/about/torusers">many
+important segments of the population</a>, including whistle blowers,
+journalists, Chinese dissidents skirting the Great Firewall and oppressive
+censorship, abuse victims, stalker targets, the US military, and law
+enforcement, just to name a few.  While Tor is not designed for malicious
+computer users, it is true that they can use the network for malicious ends.
+In reality however, the actual amount of <a
+href="https://www.torproject.org/docs/faq-abuse">abuse</a> is quite low. This
+is largely because criminals and hackers have significantly better access to
+privacy and anonymity than do the regular users whom they prey upon. Criminals
+can and do <a
+href="http://voices.washingtonpost.com/securityfix/2008/08/web_fraud_20_tools.html">build,
+sell, and trade</a> far larger and <a
+href="http://voices.washingtonpost.com/securityfix/2008/08/web_fraud_20_distributing_your.html">more
+powerful networks</a> than Tor on a daily basis. Thus, in the mind of this
+operator, the social need for easily accessible censorship-resistant private,
+anonymous communication trumps the risk of unskilled bad actors, who are
+almost always more easily uncovered by traditional police work than by
+extensive monitoring and surveillance anyway.</p>
+
+<p>
+In terms of applicable law, the best way to understand Tor is to consider it a
+network of routers operating as common carriers, much like the Internet
+backbone. However, unlike the Internet backbone routers, Tor routers
+explicitly do not contain identifiable routing information about the source of
+a packet, and no single Tor node can determine both the origin and destination
+of a given transmission.</p>
+
+<p>
+As such, there is little the operator of this router can do to help you track
+the connection further. This router maintains no logs of any of the Tor
+traffic, so there is little that can be done to trace either legitimate or
+illegitimate traffic (or to filter one from the other).  Attempts to
+seize this router will accomplish nothing.</p>
+
+<!-- FIXME: US-Only section. Remove if you are a non-US operator -->
+
+<p>
+Furthermore, this machine also serves as a carrier of email, which means that
+its contents are further protected under the ECPA. <a
+href="http://www4.law.cornell.edu/uscode/html/uscode18/usc_sec_18_00002707----000-.html">18
+USC 2707</a> explicitly allows for civil remedies ($1000/account
+<i><b>plus</b></i>  legal fees)
+in the event of a seizure executed without good faith or probable cause (it
+should be clear at this point that traffic with an originating IP address of
+FIXME_DNS_NAME should not constitute probable cause to seize the
+machine). Similar considerations exist for 1st amendment content on this
+machine.</p>
+
+<!-- FIXME: May or may not be US-only. Some non-US tor nodes have in
+     fact reported DMCA harassment... -->
+
+<p>
+If you are a representative of a company who feels that this router is being
+used to violate the DMCA, please be aware that this machine does not host or
+contain any illegal content. Also be aware that network infrastructure
+maintainers are not liable for the type of content that passes over their
+equipment, in accordance with <a
+href="http://www4.law.cornell.edu/uscode/html/uscode17/usc_sec_17_00000512----000-.html">DMCA
+"safe harbor" provisions</a>. In other words, you will have just as much luck
+sending a takedown notice to the Internet backbone providers. Please consult
+<a href="https://www.torproject.org/eff/tor-dmca-response">EFF's prepared
+response</a> for more information on this matter.</p>
+
+<p>For more information, please consult the following documentation:</p>
+
+<ol>
+<li><a href="https://www.torproject.org/about/overview">Tor Overview</a></li>
+<li><a href="https://www.torproject.org/docs/faq-abuse">Tor Abuse FAQ</a></li>
+<li><a href="https://www.torproject.org/eff/tor-legal-faq">Tor Legal FAQ</a></li>
+</ol>
+
+<p>
+That being said, if you still have a complaint about the router,  you may
+email the <a href="mailto:FIXME_YOUR_EMAIL_ADDRESS">maintainer</a>. If
+complaints are related to a particular service that is being abused, I will
+consider removing that service from my exit policy, which would prevent my
+router from allowing that traffic to exit through it. I can only do this on an
+IP+destination port basis, however. Common P2P ports are
+already blocked.</p>
+
+<p>
+You also have the option of blocking this IP address and others on
+the Tor network if you so desire. The Tor project provides a <a
+href="https://check.torproject.org/cgi-bin/TorBulkExitList.py">web service</a>
+to fetch a list of all IP addresses of Tor exit nodes that allow exiting to a
+specified IP:port combination, and an official <a
+href="https://www.torproject.org/tordnsel/dist/">DNSRBL</a> is also available to
+determine if a given IP address is actually a Tor exit server. Please
+be considerate
+when using these options. It would be unfortunate to deny all Tor users access
+to your site indefinitely simply because of a few bad apples.</p>
+
+</body>
+</html>
diff --git a/puppet/modules/tor/files/tor.html b/puppet/modules/tor/files/tor.html
new file mode 100644
index 00000000..484545b8
--- /dev/null
+++ b/puppet/modules/tor/files/tor.html
@@ -0,0 +1,3157 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
+    "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<meta name="generator" content="AsciiDoc 8.4.5" />
+<title>TOR(1)</title>
+<style type="text/css">
+/* Debug borders */
+p, li, dt, dd, div, pre, h1, h2, h3, h4, h5, h6 {
+/*
+  border: 1px solid red;
+*/
+}
+
+body {
+  margin: 1em 5% 1em 5%;
+}
+
+a {
+  color: blue;
+  text-decoration: underline;
+}
+a:visited {
+  color: fuchsia;
+}
+
+em {
+  font-style: italic;
+  color: navy;
+}
+
+strong {
+  font-weight: bold;
+  color: #083194;
+}
+
+tt {
+  color: navy;
+}
+
+h1, h2, h3, h4, h5, h6 {
+  color: #527bbd;
+  font-family: sans-serif;
+  margin-top: 1.2em;
+  margin-bottom: 0.5em;
+  line-height: 1.3;
+}
+
+h1, h2, h3 {
+  border-bottom: 2px solid silver;
+}
+h2 {
+  padding-top: 0.5em;
+}
+h3 {
+  float: left;
+}
+h3 + * {
+  clear: left;
+}
+
+div.sectionbody {
+  font-family: serif;
+  margin-left: 0;
+}
+
+hr {
+  border: 1px solid silver;
+}
+
+p {
+  margin-top: 0.5em;
+  margin-bottom: 0.5em;
+}
+
+ul, ol, li > p {
+  margin-top: 0;
+}
+
+pre {
+  padding: 0;
+  margin: 0;
+}
+
+span#author {
+  color: #527bbd;
+  font-family: sans-serif;
+  font-weight: bold;
+  font-size: 1.1em;
+}
+span#email {
+}
+span#revnumber, span#revdate, span#revremark {
+  font-family: sans-serif;
+}
+
+div#footer {
+  font-family: sans-serif;
+  font-size: small;
+  border-top: 2px solid silver;
+  padding-top: 0.5em;
+  margin-top: 4.0em;
+}
+div#footer-text {
+  float: left;
+  padding-bottom: 0.5em;
+}
+div#footer-badges {
+  float: right;
+  padding-bottom: 0.5em;
+}
+
+div#preamble {
+  margin-top: 1.5em;
+  margin-bottom: 1.5em;
+}
+div.tableblock, div.imageblock, div.exampleblock, div.verseblock,
+div.quoteblock, div.literalblock, div.listingblock, div.sidebarblock,
+div.admonitionblock {
+  margin-top: 1.5em;
+  margin-bottom: 1.5em;
+}
+div.admonitionblock {
+  margin-top: 2.5em;
+  margin-bottom: 2.5em;
+}
+
+div.content { /* Block element content. */
+  padding: 0;
+}
+
+/* Block element titles. */
+div.title, caption.title {
+  color: #527bbd;
+  font-family: sans-serif;
+  font-weight: bold;
+  text-align: left;
+  margin-top: 1.0em;
+  margin-bottom: 0.5em;
+}
+div.title + * {
+  margin-top: 0;
+}
+
+td div.title:first-child {
+  margin-top: 0.0em;
+}
+div.content div.title:first-child {
+  margin-top: 0.0em;
+}
+div.content + div.title {
+  margin-top: 0.0em;
+}
+
+div.sidebarblock > div.content {
+  background: #ffffee;
+  border: 1px solid silver;
+  padding: 0.5em;
+}
+
+div.listingblock > div.content {
+  border: 1px solid silver;
+  background: #f4f4f4;
+  padding: 0.5em;
+}
+
+div.quoteblock {
+  padding-left: 2.0em;
+  margin-right: 10%;
+}
+div.quoteblock > div.attribution {
+  padding-top: 0.5em;
+  text-align: right;
+}
+
+div.verseblock {
+  padding-left: 2.0em;
+  margin-right: 10%;
+}
+div.verseblock > div.content {
+  white-space: pre;
+}
+div.verseblock > div.attribution {
+  padding-top: 0.75em;
+  text-align: left;
+}
+/* DEPRECATED: Pre version 8.2.7 verse style literal block. */
+div.verseblock + div.attribution {
+  text-align: left;
+}
+
+div.admonitionblock .icon {
+  vertical-align: top;
+  font-size: 1.1em;
+  font-weight: bold;
+  text-decoration: underline;
+  color: #527bbd;
+  padding-right: 0.5em;
+}
+div.admonitionblock td.content {
+  padding-left: 0.5em;
+  border-left: 2px solid silver;
+}
+
+div.exampleblock > div.content {
+  border-left: 2px solid silver;
+  padding: 0.5em;
+}
+
+div.imageblock div.content { padding-left: 0; }
+span.image img { border-style: none; }
+a.image:visited { color: white; }
+
+dl {
+  margin-top: 0.8em;
+  margin-bottom: 0.8em;
+}
+dt {
+  margin-top: 0.5em;
+  margin-bottom: 0;
+  font-style: normal;
+  color: navy;
+}
+dd > *:first-child {
+  margin-top: 0.1em;
+}
+
+ul, ol {
+    list-style-position: outside;
+}
+ol.arabic {
+  list-style-type: decimal;
+}
+ol.loweralpha {
+  list-style-type: lower-alpha;
+}
+ol.upperalpha {
+  list-style-type: upper-alpha;
+}
+ol.lowerroman {
+  list-style-type: lower-roman;
+}
+ol.upperroman {
+  list-style-type: upper-roman;
+}
+
+div.compact ul, div.compact ol,
+div.compact p, div.compact p,
+div.compact div, div.compact div {
+  margin-top: 0.1em;
+  margin-bottom: 0.1em;
+}
+
+div.tableblock > table {
+  border: 3px solid #527bbd;
+}
+thead {
+  font-family: sans-serif;
+  font-weight: bold;
+}
+tfoot {
+  font-weight: bold;
+}
+td > div.verse {
+  white-space: pre;
+}
+p.table {
+  margin-top: 0;
+}
+/* Because the table frame attribute is overriden by CSS in most browsers. */
+div.tableblock > table[frame="void"] {
+  border-style: none;
+}
+div.tableblock > table[frame="hsides"] {
+  border-left-style: none;
+  border-right-style: none;
+}
+div.tableblock > table[frame="vsides"] {
+  border-top-style: none;
+  border-bottom-style: none;
+}
+
+
+div.hdlist {
+  margin-top: 0.8em;
+  margin-bottom: 0.8em;
+}
+div.hdlist tr {
+  padding-bottom: 15px;
+}
+dt.hdlist1.strong, td.hdlist1.strong {
+  font-weight: bold;
+}
+td.hdlist1 {
+  vertical-align: top;
+  font-style: normal;
+  padding-right: 0.8em;
+  color: navy;
+}
+td.hdlist2 {
+  vertical-align: top;
+}
+div.hdlist.compact tr {
+  margin: 0;
+  padding-bottom: 0;
+}
+
+.comment {
+  background: yellow;
+}
+
+@media print {
+  div#footer-badges { display: none; }
+}
+
+div#toctitle {
+  color: #527bbd;
+  font-family: sans-serif;
+  font-size: 1.1em;
+  font-weight: bold;
+  margin-top: 1.0em;
+  margin-bottom: 0.1em;
+}
+
+div.toclevel1, div.toclevel2, div.toclevel3, div.toclevel4 {
+  margin-top: 0;
+  margin-bottom: 0;
+}
+div.toclevel2 {
+  margin-left: 2em;
+  font-size: 0.9em;
+}
+div.toclevel3 {
+  margin-left: 4em;
+  font-size: 0.9em;
+}
+div.toclevel4 {
+  margin-left: 6em;
+  font-size: 0.9em;
+}
+/* Overrides for manpage documents */
+h1 {
+  padding-top: 0.5em;
+  padding-bottom: 0.5em;
+  border-top: 2px solid silver;
+  border-bottom: 2px solid silver;
+}
+h2 {
+  border-style: none;
+}
+div.sectionbody {
+  margin-left: 5%;
+}
+
+@media print {
+  div#toc { display: none; }
+}
+
+/* Workarounds for IE6's broken and incomplete CSS2. */
+
+div.sidebar-content {
+  background: #ffffee;
+  border: 1px solid silver;
+  padding: 0.5em;
+}
+div.sidebar-title, div.image-title {
+  color: #527bbd;
+  font-family: sans-serif;
+  font-weight: bold;
+  margin-top: 0.0em;
+  margin-bottom: 0.5em;
+}
+
+div.listingblock div.content {
+  border: 1px solid silver;
+  background: #f4f4f4;
+  padding: 0.5em;
+}
+
+div.quoteblock-attribution {
+  padding-top: 0.5em;
+  text-align: right;
+}
+
+div.verseblock-content {
+  white-space: pre;
+}
+div.verseblock-attribution {
+  padding-top: 0.75em;
+  text-align: left;
+}
+
+div.exampleblock-content {
+  border-left: 2px solid silver;
+  padding-left: 0.5em;
+}
+
+/* IE6 sets dynamically generated links as visited. */
+div#toc a:visited { color: blue; }
+</style>
+</head>
+<body>
+<div id="header">
+<h1>
+TOR(1) Manual Page
+</h1>
+<h2>NAME</h2>
+<div class="sectionbody">
+<p>tor -
+   The second-generation onion router
+</p>
+</div>
+</div>
+<h2 id="_synopsis">SYNOPSIS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p><strong>tor</strong> [<em>OPTION</em> <em>value</em>]&#8230;</p></div>
+</div>
+<h2 id="_description">DESCRIPTION</h2>
+<div class="sectionbody">
+<div class="paragraph"><p><em>tor</em> is a connection-oriented anonymizing communication
+service. Users choose a source-routed path through a set of nodes, and
+negotiate a "virtual circuit" through the network, in which each node
+knows its predecessor and successor, but no others. Traffic flowing down
+the circuit is unwrapped by a symmetric key at each node, which reveals
+the downstream node.<br /></p></div>
+<div class="paragraph"><p>Basically <em>tor</em> provides a distributed network of servers ("onion routers").
+Users bounce their TCP streams&#8201;&#8212;&#8201;web traffic, ftp, ssh, etc&#8201;&#8212;&#8201;around the
+routers, and recipients, observers, and even the routers themselves have
+difficulty tracking the source of the stream.</p></div>
+</div>
+<h2 id="_options">OPTIONS</h2>
+<div class="sectionbody">
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>-h</strong>, <strong>-help</strong>
+</dt>
+<dd>
+<p>
+    Display a short help message and exit.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>-f</strong> <em>FILE</em>
+</dt>
+<dd>
+<p>
+    FILE contains further "option value" pairs. (Default: /etc/tor/torrc)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>--hash-password</strong>
+</dt>
+<dd>
+<p>
+    Generates a hashed password for control port access.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>--list-fingerprint</strong>
+</dt>
+<dd>
+<p>
+    Generate your keys and output your nickname and fingerprint.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>--verify-config</strong>
+</dt>
+<dd>
+<p>
+    Verify the configuration file is valid.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>--nt-service</strong>
+</dt>
+<dd>
+<p>
+    <strong>--service [install|remove|start|stop]</strong> Manage the Tor Windows
+    NT/2000/XP service. Current instructions can be found at
+    <a href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#WinNTService">https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#WinNTService</a>
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>--list-torrc-options</strong>
+</dt>
+<dd>
+<p>
+    List all valid options.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>--version</strong>
+</dt>
+<dd>
+<p>
+    Display Tor version and exit.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>--quiet</strong>
+</dt>
+<dd>
+<p>
+    Do not start Tor with a console log unless explicitly requested to do so.
+    (By default, Tor starts out logging messages at level "notice" or higher to
+    the console, until it has parsed its configuration.)
+</p>
+</dd>
+</dl></div>
+<div class="paragraph"><p>Other options can be specified either on the command-line (--option
+    value), or in the configuration file (option value or option "value").
+    Options are case-insensitive. C-style escaped characters are allowed inside
+    quoted values.   Options on the command line take precedence over
+    options found in the configuration file, except indicated otherwise.  To
+    split one configuration entry into multiple lines, use a single \ before
+    the end of the line.  Comments can be used in such multiline entries, but
+    they must start at the beginning of a line.</p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>BandwidthRate</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    A token bucket limits the average incoming bandwidth usage on this node to
+    the specified number of bytes per second, and the average outgoing
+    bandwidth usage to that same value.  If you want to run a relay in the
+    public network, this needs to be <em>at the very least</em> 20 KB (that is,
+    20480 bytes). (Default: 5 MB)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>BandwidthBurst</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    Limit the maximum token bucket size (also known as the burst) to the given
+    number of bytes in each direction. (Default: 10 MB)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>MaxAdvertisedBandwidth</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    If set, we will not advertise more than this amount of bandwidth for our
+    BandwidthRate. Server operators who want to reduce the number of clients
+    who ask to build circuits through them (since this is proportional to
+    advertised bandwidth rate) can thus reduce the CPU demands on their server
+    without impacting network performance.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RelayBandwidthRate</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    If not 0, a separate token bucket limits the average incoming bandwidth
+    usage for _relayed traffic_ on this node to the specified number of bytes
+    per second, and the average outgoing bandwidth usage to that same value.
+    Relayed traffic currently is calculated to include answers to directory
+    requests, but that may change in future versions. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RelayBandwidthBurst</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    If not 0, limit the maximum token bucket size (also known as the burst) for
+    _relayed traffic_ to the given number of bytes in each direction.
+    (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>PerConnBWRate</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    If set, do separate rate limiting for each connection from a non-relay.
+    You should never need to change this value, since a network-wide value is
+    published in the consensus and your relay will use that value. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>PerConnBWBurst</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    If set, do separate rate limiting for each connection from a non-relay.
+    You should never need to change this value, since a network-wide value is
+    published in the consensus and your relay will use that value. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ConnLimit</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    The minimum number of file descriptors that must be available to the Tor
+    process before it will start. Tor will ask the OS for as many file
+    descriptors as the OS will allow (you can find this by "ulimit -H -n").
+    If this number is less than ConnLimit, then Tor will refuse to start.<br />
+<br />
+    You probably don&#8217;t need to adjust this. It has no effect on Windows
+    since that platform lacks getrlimit(). (Default: 1000)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ConstrainedSockets</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set, Tor will tell the kernel to attempt to shrink the buffers for all
+    sockets to the size specified in <strong>ConstrainedSockSize</strong>. This is useful for
+    virtual servers and other environments where system level TCP buffers may
+    be limited. If you&#8217;re on a virtual server, and you encounter the "Error
+    creating network socket: No buffer space available" message, you are
+    likely experiencing this problem.<br />
+<br />
+    The preferred solution is to have the admin increase the buffer pool for
+    the host itself via /proc/sys/net/ipv4/tcp_mem or equivalent facility;
+    this configuration option is a second-resort.<br />
+<br />
+    The DirPort option should also not be used if TCP buffers are scarce. The
+    cached directory requests consume additional sockets which exacerbates
+    the problem.<br />
+<br />
+    You should <strong>not</strong> enable this feature unless you encounter the "no buffer
+    space available" issue. Reducing the TCP buffers affects window size for
+    the TCP stream and will reduce throughput in proportion to round trip
+    time on long paths. (Default: 0.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ConstrainedSockSize</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>
+</dt>
+<dd>
+<p>
+    When <strong>ConstrainedSockets</strong> is enabled the receive and transmit buffers for
+    all sockets will be set to this limit. Must be a value between 2048 and
+    262144, in 1024 byte increments. Default of 8192 is recommended.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ControlPort</strong> <em>PORT</em>|<strong>auto</strong>
+</dt>
+<dd>
+<p>
+    If set, Tor will accept connections on this port and allow those
+    connections to control the Tor process using the Tor Control Protocol
+    (described in control-spec.txt). Note: unless you also specify one or
+    more of <strong>HashedControlPassword</strong> or <strong>CookieAuthentication</strong>,
+    setting this option will cause Tor to allow any process on the local
+    host to control it. (Setting both authentication methods means either
+    method is sufficient to authenticate to Tor.) This
+    option is required for many Tor controllers; most use the value of 9051.
+    Set it to "auto" to have Tor pick a port for you. (Default: 0).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ControlListenAddress</strong> <em>IP</em>[:<em>PORT</em>]
+</dt>
+<dd>
+<p>
+    Bind the controller listener to this address. If you specify a port, bind
+    to this port rather than the one specified in ControlPort. We strongly
+    recommend that you leave this alone unless you know what you&#8217;re doing,
+    since giving attackers access to your control listener is really
+    dangerous. (Default: 127.0.0.1) This directive can be specified multiple
+    times to bind to multiple addresses/ports.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ControlSocket</strong> <em>Path</em>
+</dt>
+<dd>
+<p>
+    Like ControlPort, but listens on a Unix domain socket, rather than a TCP
+    socket. (Unix and Unix-like systems only.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ControlSocketsGroupWritable</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If this option is set to 0, don&#8217;t allow the filesystem group to read and
+    write unix sockets (e.g. ControlSocket). If the option is set to 1, make
+    the control socket readable and writable by the default GID. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HashedControlPassword</strong> <em>hashed_password</em>
+</dt>
+<dd>
+<p>
+    Allow connections on the control port if they present
+    the password whose one-way hash is <em>hashed_password</em>. You
+    can compute the hash of a password by running "tor --hash-password
+    <em>password</em>". You can provide several acceptable passwords by using more
+    than one HashedControlPassword line.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>CookieAuthentication</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If this option is set to 1, allow connections on the control port
+    when the connecting process knows the contents of a file named
+    "control_auth_cookie", which Tor will create in its data directory. This
+    authentication method should only be used on systems with good filesystem
+    security. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>CookieAuthFile</strong> <em>Path</em>
+</dt>
+<dd>
+<p>
+    If set, this option overrides the default location and file name
+    for Tor&#8217;s cookie file. (See CookieAuthentication above.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>CookieAuthFileGroupReadable</strong> <strong>0</strong>|<strong>1</strong>|<em>Groupname</em>
+</dt>
+<dd>
+<p>
+    If this option is set to 0, don&#8217;t allow the filesystem group to read the
+    cookie file. If the option is set to 1, make the cookie file readable by
+    the default GID. [Making the file readable by other groups is not yet
+    implemented; let us know if you need this for some reason.] (Default: 0).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ControlPortWriteToFile</strong> <em>Path</em>
+</dt>
+<dd>
+<p>
+    If set, Tor writes the address and port of any control port it opens to
+    this address.  Usable by controllers to learn the actual control port
+    when ControlPort is set to "auto".
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ControlPortFileGroupReadable</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If this option is set to 0, don&#8217;t allow the filesystem group to read the
+    control port file. If the option is set to 1, make the control port
+    file readable by the default GID. (Default: 0).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DataDirectory</strong> <em>DIR</em>
+</dt>
+<dd>
+<p>
+    Store working data in DIR (Default: /var/lib/tor)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DirServer</strong> [<em>nickname</em>] [<strong>flags</strong>] <em>address</em>:<em>port</em> <em>fingerprint</em>
+</dt>
+<dd>
+<p>
+    Use a nonstandard authoritative directory server at the provided address
+    and port, with the specified key fingerprint. This option can be repeated
+    many times, for multiple authoritative directory servers. Flags are
+    separated by spaces, and determine what kind of an authority this directory
+    is. By default, every authority is authoritative for current ("v2")-style
+    directories, unless the "no-v2" flag is given. If the "v1" flags is
+    provided, Tor will use this server as an authority for old-style (v1)
+    directories as well. (Only directory mirrors care about this.) Tor will
+    use this server as an authority for hidden service information if the "hs"
+    flag is set, or if the "v1" flag is set and the "no-hs" flag is <strong>not</strong> set.
+    Tor will use this authority as a bridge authoritative directory if the
+    "bridge" flag is set. If a flag "orport=<strong>port</strong>" is given, Tor will use the
+    given port when opening encrypted tunnels to the dirserver. Lastly, if a
+    flag "v3ident=<strong>fp</strong>" is given, the dirserver is a v3 directory authority
+    whose v3 long-term signing key has the fingerprint <strong>fp</strong>.<br />
+<br />
+    If no <strong>dirserver</strong> line is given, Tor will use the default directory
+    servers. NOTE: this option is intended for setting up a private Tor
+    network with its own directory authorities. If you use it, you will be
+    distinguishable from other users, because you won&#8217;t believe the same
+    authorities they do.
+</p>
+</dd>
+</dl></div>
+<div class="paragraph"><p><strong>AlternateDirAuthority</strong> [<em>nickname</em>] [<strong>flags</strong>] <em>address</em>:<em>port</em> <em>fingerprint</em><br /></p></div>
+<div class="paragraph"><p><strong>AlternateHSAuthority</strong> [<em>nickname</em>] [<strong>flags</strong>] <em>address</em>:<em>port</em> <em>fingerprint</em><br /></p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>AlternateBridgeAuthority</strong> [<em>nickname</em>] [<strong>flags</strong>] <em>address</em>:<em>port</em> <em> fingerprint</em>
+</dt>
+<dd>
+<p>
+    As DirServer, but replaces less of the default directory authorities. Using
+    AlternateDirAuthority replaces the default Tor directory authorities, but
+    leaves the hidden service authorities and bridge authorities in place.
+    Similarly, Using AlternateHSAuthority replaces the default hidden service
+    authorities, but not the directory or bridge authorities.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DisableAllSwap</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 1, Tor will attempt to lock all current and future memory pages,
+    so that memory cannot be paged out. Windows, OS X and Solaris are currently
+    not supported. We believe that this feature works on modern Gnu/Linux
+    distributions, and that it should work on *BSD systems (untested). This
+    option requires that you start your Tor as root, and you should use the
+    <strong>User</strong> option to properly reduce Tor&#8217;s privileges. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FetchDirInfoEarly</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 1, Tor will always fetch directory information like other
+    directory caches, even if you don&#8217;t meet the normal criteria for fetching
+    early. Normal users should leave it off. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FetchDirInfoExtraEarly</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 1, Tor will fetch directory information before other directory
+    caches. It will attempt to download directory information closer to the
+    start of the consensus period. Normal users should leave it off.
+    (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FetchHidServDescriptors</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 0, Tor will never fetch any hidden service descriptors from the
+    rendezvous directories. This option is only useful if you&#8217;re using a Tor
+    controller that handles hidden service fetches for you. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FetchServerDescriptors</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 0, Tor will never fetch any network status summaries or server
+    descriptors from the directory servers. This option is only useful if
+    you&#8217;re using a Tor controller that handles directory fetches for you.
+    (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FetchUselessDescriptors</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 1, Tor will fetch every non-obsolete descriptor from the
+    authorities that it hears about. Otherwise, it will avoid fetching useless
+    descriptors, for example for routers that are not running. This option is
+    useful if you&#8217;re using the contributed "exitlist" script to enumerate Tor
+    nodes that exit to certain addresses. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HTTPProxy</strong> <em>host</em>[:<em>port</em>]
+</dt>
+<dd>
+<p>
+    Tor will make all its directory requests through this host:port (or host:80
+    if port is not specified), rather than connecting directly to any directory
+    servers.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HTTPProxyAuthenticator</strong> <em>username:password</em>
+</dt>
+<dd>
+<p>
+    If defined, Tor will use this username:password for Basic HTTP proxy
+    authentication, as in RFC 2617. This is currently the only form of HTTP
+    proxy authentication that Tor supports; feel free to submit a patch if you
+    want it to support others.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HTTPSProxy</strong> <em>host</em>[:<em>port</em>]
+</dt>
+<dd>
+<p>
+    Tor will make all its OR (SSL) connections through this host:port (or
+    host:443 if port is not specified), via HTTP CONNECT rather than connecting
+    directly to servers. You may want to set <strong>FascistFirewall</strong> to restrict
+    the set of ports you might try to connect to, if your HTTPS proxy only
+    allows connecting to certain ports.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HTTPSProxyAuthenticator</strong> <em>username:password</em>
+</dt>
+<dd>
+<p>
+    If defined, Tor will use this username:password for Basic HTTPS proxy
+    authentication, as in RFC 2617. This is currently the only form of HTTPS
+    proxy authentication that Tor supports; feel free to submit a patch if you
+    want it to support others.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>Socks4Proxy</strong> <em>host</em>[:<em>port</em>]
+</dt>
+<dd>
+<p>
+    Tor will make all OR connections through the SOCKS 4 proxy at host:port
+    (or host:1080 if port is not specified).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>Socks5Proxy</strong> <em>host</em>[:<em>port</em>]
+</dt>
+<dd>
+<p>
+    Tor will make all OR connections through the SOCKS 5 proxy at host:port
+    (or host:1080 if port is not specified).
+</p>
+</dd>
+</dl></div>
+<div class="paragraph"><p><strong>Socks5ProxyUsername</strong> <em>username</em><br /></p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>Socks5ProxyPassword</strong> <em>password</em>
+</dt>
+<dd>
+<p>
+    If defined, authenticate to the SOCKS 5 server using username and password
+    in accordance to RFC 1929. Both username and password must be between 1 and
+    255 characters.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>KeepalivePeriod</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    To keep firewalls from expiring connections, send a padding keepalive cell
+    every NUM seconds on open connections that are in use. If the connection
+    has no open circuits, it will instead be closed after NUM seconds of
+    idleness. (Default: 5 minutes)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>Log</strong> <em>minSeverity</em>[-<em>maxSeverity</em>] <strong>stderr</strong>|<strong>stdout</strong>|<strong>syslog</strong>
+</dt>
+<dd>
+<p>
+    Send all messages between <em>minSeverity</em> and <em>maxSeverity</em> to the standard
+    output stream, the standard error stream, or to the system log. (The
+    "syslog" value is only supported on Unix.) Recognized severity levels are
+    debug, info, notice, warn, and err. We advise using "notice" in most cases,
+    since anything more verbose may provide sensitive information to an
+    attacker who obtains the logs. If only one severity level is given, all
+    messages of that level or higher will be sent to the listed destination.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>Log</strong> <em>minSeverity</em>[-<em>maxSeverity</em>] <strong>file</strong> <em>FILENAME</em>
+</dt>
+<dd>
+<p>
+    As above, but send log messages to the listed filename. The
+    "Log" option may appear more than once in a configuration file.
+    Messages are sent to all the logs that match their severity
+    level.
+</p>
+</dd>
+</dl></div>
+<div class="paragraph"><p><strong>Log</strong> <strong>[</strong><em>domain</em>,&#8230;<strong>]</strong><em>minSeverity</em>[-<em>maxSeverity</em>] &#8230; <strong>file</strong> <em>FILENAME</em><br /></p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>Log</strong> <strong>[</strong><em>domain</em>,&#8230;<strong>]</strong><em>minSeverity</em>[-<em>maxSeverity</em>] &#8230; <strong>stderr</strong>|<strong>stdout</strong>|<strong>syslog</strong>
+</dt>
+<dd>
+<p>
+    As above, but select messages by range of log severity <em>and</em> by a
+    set of "logging domains".  Each logging domain corresponds to an area of
+    functionality inside Tor.  You can specify any number of severity ranges
+    for a single log statement, each of them prefixed by a comma-separated
+    list of logging domains.  You can prefix a domain with ~ to indicate
+    negation, and use * to indicate "all domains".  If you specify a severity
+    range without a list of domains, it matches all domains.<br />
+<br />
+    This is an advanced feature which is most useful for debugging one or two
+    of Tor&#8217;s subsystems at a time.<br />
+<br />
+    The currently recognized domains are: general, crypto, net, config, fs,
+    protocol, mm, http, app, control, circ, rend, bug, dir, dirserv, or, edge,
+    acct, hist, and handshake.  Domain names are case-insensitive.<br />
+<br />
+    For example, "<tt>Log [handshake]debug [~net,~mm]info notice stdout</tt>" sends
+    to stdout: all handshake messages of any severity, all info-and-higher
+    messages from domains other than networking and memory management, and all
+    messages of severity notice or higher.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>LogMessageDomains</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If 1, Tor includes message domains with each log message.  Every log
+    message currently has at least one domain; most currently have exactly
+    one.  This doesn&#8217;t affect controller log messages. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>OutboundBindAddress</strong> <em>IP</em>
+</dt>
+<dd>
+<p>
+    Make all outbound connections originate from the IP address specified. This
+    is only useful when you have multiple network interfaces, and you want all
+    of Tor&#8217;s outgoing connections to use a single one.  This setting will be
+    ignored for connections to the loopback addresses (127.0.0.0/8 and ::1).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>PidFile</strong> <em>FILE</em>
+</dt>
+<dd>
+<p>
+    On startup, write our PID to FILE. On clean shutdown, remove
+    FILE.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ProtocolWarnings</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If 1, Tor will log with severity 'warn' various cases of other parties not
+    following the Tor specification. Otherwise, they are logged with severity
+    'info'. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RunAsDaemon</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If 1, Tor forks and daemonizes to the background. This option has no effect
+    on Windows; instead you should use the --service command-line option.
+    (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SafeLogging</strong> <strong>0</strong>|<strong>1</strong>|<strong>relay</strong>
+</dt>
+<dd>
+<p>
+    Tor can scrub potentially sensitive strings from log messages (e.g.
+    addresses) by replacing them with the string [scrubbed]. This way logs can
+    still be useful, but they don&#8217;t leave behind personally identifying
+    information about what sites a user might have visited.<br />
+<br />
+    If this option is set to 0, Tor will not perform any scrubbing, if it is
+    set to 1, all potentially sensitive strings are replaced. If it is set to
+    relay, all log messages generated when acting as a relay are sanitized, but
+    all messages generated when acting as a client are not. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>User</strong> <em>UID</em>
+</dt>
+<dd>
+<p>
+    On startup, setuid to this user and setgid to their primary group.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HardwareAccel</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If non-zero, try to use built-in (static) crypto hardware acceleration when
+    available. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AccelName</strong> <em>NAME</em>
+</dt>
+<dd>
+<p>
+    When using OpenSSL hardware crypto acceleration attempt to load the dynamic
+    engine of this name. This must be used for any dynamic hardware engine.
+    Names can be verified with the openssl engine command.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AccelDir</strong> <em>DIR</em>
+</dt>
+<dd>
+<p>
+    Specify this option if using dynamic hardware acceleration and the engine
+    implementation library resides somewhere other than the OpenSSL default.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AvoidDiskWrites</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If non-zero, try to write to disk less frequently than we would otherwise.
+    This is useful when running on flash memory or other media that support
+    only a limited number of writes. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TunnelDirConns</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If non-zero, when a directory server we contact supports it, we will build
+    a one-hop circuit and make an encrypted connection via its ORPort.
+    (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>PreferTunneledDirConns</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If non-zero, we will avoid directory servers that don&#8217;t support tunneled
+    directory connections, when possible. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>CircuitPriorityHalflife</strong> <em>NUM1</em>
+</dt>
+<dd>
+<p>
+    If this value is set, we override the default algorithm for choosing which
+    circuit&#8217;s cell to deliver or relay next. When the value is 0, we
+    round-robin between the active circuits on a connection, delivering one
+    cell from each in turn. When the value is positive, we prefer delivering
+    cells from whichever connection has the lowest weighted cell count, where
+    cells are weighted exponentially according to the supplied
+    CircuitPriorityHalflife value (in seconds). If this option is not set at
+    all, we use the behavior recommended in the current consensus
+    networkstatus. This is an advanced option; you generally shouldn&#8217;t have
+    to mess with it. (Default: not set.)
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_client_options">CLIENT OPTIONS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p>The following options are useful only for clients (that is, if
+<strong>SocksPort</strong> is non-zero):</p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>AllowInvalidNodes</strong> <strong>entry</strong>|<strong>exit</strong>|<strong>middle</strong>|<strong>introduction</strong>|<strong>rendezvous</strong>|<strong>&#8230;</strong>
+</dt>
+<dd>
+<p>
+    If some Tor servers are obviously not working right, the directory
+    authorities can manually mark them as invalid, meaning that it&#8217;s not
+    recommended you use them for entry or exit positions in your circuits. You
+    can opt to use them in some circuit positions, though. The default is
+    "middle,rendezvous", and other choices are not advised.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ExcludeSingleHopRelays</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    This option controls whether circuits built by Tor will include relays with
+    the AllowSingleHopExits flag set to true. If ExcludeSingleHopRelays is set
+    to 0, these relays will be included. Note that these relays might be at
+    higher risk of being seized or observed, so they are not normally
+    included.  Also note that relatively few clients turn off this option,
+    so using these relays might make your client stand out.
+    (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>Bridge</strong> <em>IP</em>:<em>ORPort</em> [fingerprint]
+</dt>
+<dd>
+<p>
+    When set along with UseBridges, instructs Tor to use the relay at
+    "IP:ORPort" as a "bridge" relaying into the Tor network. If "fingerprint"
+    is provided (using the same format as for DirServer), we will verify that
+    the relay running at that location has the right fingerprint. We also use
+    fingerprint to look up the bridge descriptor at the bridge authority, if
+    it&#8217;s provided and if UpdateBridgesFromAuthority is set too.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>LearnCircuitBuildTimeout</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If 0, CircuitBuildTimeout adaptive learning is disabled. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>CircuitBuildTimeout</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    Try for at most NUM seconds when building circuits. If the circuit isn&#8217;t
+    open in that time, give up on it. If LearnCircuitBuildTimeout is 1, this
+    value serves as the initial value to use before a timeout is learned. If
+    LearnCircuitBuildTimeout is 0, this value is the only value used.
+    (Default: 60 seconds.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>CircuitIdleTimeout</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    If we have kept a clean (never used) circuit around for NUM seconds, then
+    close it. This way when the Tor client is entirely idle, it can expire all
+    of its circuits, and then expire its TLS connections. Also, if we end up
+    making a circuit that is not useful for exiting any of the requests we&#8217;re
+    receiving, it won&#8217;t forever take up a slot in the circuit list. (Default: 1
+    hour.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>CircuitStreamTimeout</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    If non-zero, this option overrides our internal timeout schedule for how
+    many seconds until we detach a stream from a circuit and try a new circuit.
+    If your network is particularly slow, you might want to set this to a
+    number like 60. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ClientOnly</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 1, Tor will under no circumstances run as a server or serve
+    directory requests. The default is to run as a client unless ORPort is
+    configured. (Usually, you don&#8217;t need to set this; Tor is pretty smart at
+    figuring out whether you are reliable and high-bandwidth enough to be a
+    useful server.) (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ExcludeNodes</strong> <em>node</em>,<em>node</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    A list of identity fingerprints, nicknames, country codes and address
+    patterns of nodes to avoid when building a circuit.
+    (Example:
+    ExcludeNodes SlowServer, ABCD1234CDEF5678ABCD1234CDEF5678ABCD1234, {cc}, 255.254.0.0/8)<br />
+<br />
+    By default, this option is treated as a preference that Tor is allowed
+    to override in order to keep working.
+    For example, if you try to connect to a hidden service,
+    but you have excluded all of the hidden service&#8217;s introduction points,
+    Tor will connect to one of them anyway.  If you do not want this
+    behavior, set the StrictNodes option (documented below). <br />
+<br />
+    Note also that if you are a relay, this (and the other node selection
+    options below) only affects your own circuits that Tor builds for you.
+    Clients can still build circuits through you to any node.  Controllers
+    can tell Tor to build circuits through any node.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ExcludeExitNodes</strong> <em>node</em>,<em>node</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    A list of identity fingerprints, nicknames, country codes and address
+    patterns of nodes to never use when picking an exit node---that is, a
+    node that delivers traffic for you outside the Tor network.   Note that any
+    node listed in ExcludeNodes is automatically considered to be part of this
+    list too.  See also the caveats on the "ExitNodes" option below.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ExitNodes</strong> <em>node</em>,<em>node</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    A list of identity fingerprints, nicknames, country codes and address
+    patterns of nodes to use as exit node---that is, a
+    node that delivers traffic for you outside the Tor network.<br />
+<br />
+    Note that if you list too few nodes here, or if you exclude too many exit
+    nodes with ExcludeExitNodes, you can degrade functionality.  For example,
+    if none of the exits you list allows traffic on port 80 or 443, you won&#8217;t
+    be able to browse the web.<br />
+<br />
+    Note also that not every circuit is used to deliver traffic outside of
+    the Tor network.  It is normal to see non-exit circuits (such as those
+    used to connect to hidden services, those that do directory fetches,
+    those used for relay reachability self-tests, and so on) that end
+    at a non-exit node.  To
+    keep a node from being used entirely, see ExcludeNodes and StrictNodes.<br />
+<br />
+    The ExcludeNodes option overrides this option: any node listed in both
+    ExitNodes and ExcludeNodes is treated as excluded.<br />
+<br />
+    The .exit address notation, if enabled via AllowDotExit, overrides
+    this option.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>EntryNodes</strong> <em>node</em>,<em>node</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    A list of identity fingerprints and nicknames of nodes
+    to use for the first hop in your normal circuits.  (Country codes and
+    address patterns are not yet supported.)  Normal circuits include all
+    circuits except for direct connections to directory servers.  The Bridge
+    option overrides this option; if you have configured bridges and
+    UseBridges is 1, the Bridges are used as your entry nodes.<br />
+<br />
+    The ExcludeNodes option overrides this option: any node listed in both
+    EntryNodes and ExcludeNodes is treated as excluded.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>StrictNodes</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If StrictNodes is set to 1, Tor will treat the ExcludeNodes option as a
+    requirement to follow for all the circuits you generate, even if doing so
+    will break functionality for you.  If StrictNodes is set to 0, Tor will
+    still try to avoid nodes in the ExcludeNodes list, but it will err on the
+    side of avoiding unexpected errors.  Specifically, StrictNodes 0 tells
+    Tor that it is okay to use an excluded node when it is <strong>necessary</strong> to
+    perform relay reachability self-tests, connect to
+    a hidden service, provide a hidden service to a client, fulfill a .exit
+    request, upload directory information, or download directory information.
+    (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FascistFirewall</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If 1, Tor will only create outgoing connections to ORs running on ports
+    that your firewall allows (defaults to 80 and 443; see <strong>FirewallPorts</strong>).
+    This will allow you to run Tor as a client behind a firewall with
+    restrictive policies, but will not allow you to run as a server behind such
+    a firewall. If you prefer more fine-grained control, use
+    ReachableAddresses instead.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FirewallPorts</strong> <em>PORTS</em>
+</dt>
+<dd>
+<p>
+    A list of ports that your firewall allows you to connect to. Only used when
+    <strong>FascistFirewall</strong> is set. This option is deprecated; use ReachableAddresses
+    instead. (Default: 80, 443)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HidServAuth</strong> <em>onion-address</em> <em>auth-cookie</em> [<em>service-name</em>]
+</dt>
+<dd>
+<p>
+    Client authorization for a hidden service. Valid onion addresses contain 16
+    characters in a-z2-7 plus ".onion", and valid auth cookies contain 22
+    characters in A-Za-z0-9+/. The service name is only used for internal
+    purposes, e.g., for Tor controllers. This option may be used multiple times
+    for different hidden services. If a hidden service uses authorization and
+    this option is not set, the hidden service is not accessible. Hidden
+    services can be configured to require authorization using the
+    <strong>HiddenServiceAuthorizeClient</strong> option.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ReachableAddresses</strong> <em>ADDR</em>[/<em>MASK</em>][:<em>PORT</em>]&#8230;
+</dt>
+<dd>
+<p>
+    A comma-separated list of IP addresses and ports that your firewall allows
+    you to connect to. The format is as for the addresses in ExitPolicy, except
+    that "accept" is understood unless "reject" is explicitly provided. For
+    example, 'ReachableAddresses 99.0.0.0/8, reject 18.0.0.0/8:80, accept
+    *:80' means that your firewall allows connections to everything inside net
+    99, rejects port 80 connections to net 18, and accepts connections to port
+    80 otherwise. (Default: 'accept *:*'.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ReachableDirAddresses</strong> <em>ADDR</em>[/<em>MASK</em>][:<em>PORT</em>]&#8230;
+</dt>
+<dd>
+<p>
+    Like <strong>ReachableAddresses</strong>, a list of addresses and ports. Tor will obey
+    these restrictions when fetching directory information, using standard HTTP
+    GET requests. If not set explicitly then the value of
+    <strong>ReachableAddresses</strong> is used. If <strong>HTTPProxy</strong> is set then these
+    connections will go through that proxy.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ReachableORAddresses</strong> <em>ADDR</em>[/<em>MASK</em>][:<em>PORT</em>]&#8230;
+</dt>
+<dd>
+<p>
+    Like <strong>ReachableAddresses</strong>, a list of addresses and ports. Tor will obey
+    these restrictions when connecting to Onion Routers, using TLS/SSL. If not
+    set explicitly then the value of <strong>ReachableAddresses</strong> is used. If
+    <strong>HTTPSProxy</strong> is set then these connections will go through that proxy.<br />
+<br />
+    The separation between <strong>ReachableORAddresses</strong> and
+    <strong>ReachableDirAddresses</strong> is only interesting when you are connecting
+    through proxies (see <strong>HTTPProxy</strong> and <strong>HTTPSProxy</strong>). Most proxies limit
+    TLS connections (which Tor uses to connect to Onion Routers) to port 443,
+    and some limit HTTP GET requests (which Tor uses for fetching directory
+    information) to port 80.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>LongLivedPorts</strong> <em>PORTS</em>
+</dt>
+<dd>
+<p>
+    A list of ports for services that tend to have long-running connections
+    (e.g. chat and interactive shells). Circuits for streams that use these
+    ports will contain only high-uptime nodes, to reduce the chance that a node
+    will go down before the stream is finished. (Default: 21, 22, 706, 1863,
+    5050, 5190, 5222, 5223, 6667, 6697, 8300)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>MapAddress</strong> <em>address</em> <em>newaddress</em>
+</dt>
+<dd>
+<p>
+    When a request for address arrives to Tor, it will rewrite it to newaddress
+    before processing it. For example, if you always want connections to
+    www.indymedia.org to exit via <em>torserver</em> (where <em>torserver</em> is the
+    nickname of the server), use "MapAddress www.indymedia.org
+    www.indymedia.org.torserver.exit".
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>NewCircuitPeriod</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    Every NUM seconds consider whether to build a new circuit. (Default: 30
+    seconds)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>MaxCircuitDirtiness</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    Feel free to reuse a circuit that was first used at most NUM seconds ago,
+    but never attach a new stream to a circuit that is too old. (Default: 10
+    minutes)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>NodeFamily</strong> <em>node</em>,<em>node</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    The Tor servers, defined by their identity fingerprints or nicknames,
+    constitute a "family" of similar or co-administered servers, so never use
+    any two of them in the same circuit. Defining a NodeFamily is only needed
+    when a server doesn&#8217;t list the family itself (with MyFamily). This option
+    can be used multiple times.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>EnforceDistinctSubnets</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If 1, Tor will not put two servers whose IP addresses are "too close" on
+    the same circuit. Currently, two addresses are "too close" if they lie in
+    the same /16 range. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SocksPort</strong> <em>PORT</em>|<strong>auto</strong>
+</dt>
+<dd>
+<p>
+    Advertise this port to listen for connections from Socks-speaking
+    applications. Set this to 0 if you don&#8217;t want to allow application
+    connections via SOCKS. Set it to "auto" to have Tor pick a port for
+    you. (Default: 9050)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SocksListenAddress</strong> <em>IP</em>[:<em>PORT</em>]
+</dt>
+<dd>
+<p>
+    Bind to this address to listen for connections from Socks-speaking
+    applications. (Default: 127.0.0.1) You can also specify a port (e.g.
+    192.168.0.1:9100). This directive can be specified multiple times to bind
+    to multiple addresses/ports.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SocksPolicy</strong> <em>policy</em>,<em>policy</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    Set an entrance policy for this server, to limit who can connect to the
+    SocksPort and DNSPort ports. The policies have the same form as exit
+    policies below.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SocksTimeout</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    Let a socks connection wait NUM seconds handshaking, and NUM seconds
+    unattached waiting for an appropriate circuit, before we fail it. (Default:
+    2 minutes.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TrackHostExits</strong> <em>host</em>,<em>.domain</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    For each value in the comma separated list, Tor will track recent
+    connections to hosts that match this value and attempt to reuse the same
+    exit node for each. If the value is prepended with a '.', it is treated as
+    matching an entire domain. If one of the values is just a '.', it means
+    match everything. This option is useful if you frequently connect to sites
+    that will expire all your authentication cookies (i.e. log you out) if
+    your IP address changes. Note that this option does have the disadvantage
+    of making it more clear that a given history is associated with a single
+    user. However, most people who would wish to observe this will observe it
+    through cookies or other protocol-specific means anyhow.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TrackHostExitsExpire</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    Since exit servers go up and down, it is desirable to expire the
+    association between host and exit server after NUM seconds. The default is
+    1800 seconds (30 minutes).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>UpdateBridgesFromAuthority</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When set (along with UseBridges), Tor will try to fetch bridge descriptors
+    from the configured bridge authorities when feasible. It will fall back to
+    a direct request if the authority responds with a 404. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>UseBridges</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When set, Tor will fetch descriptors for each bridge listed in the "Bridge"
+    config lines, and use these relays as both entry guards and directory
+    guards. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>UseEntryGuards</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If this option is set to 1, we pick a few long-term entry servers, and try
+    to stick with them. This is desirable because constantly changing servers
+    increases the odds that an adversary who owns some servers will observe a
+    fraction of your paths. (Defaults to 1.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>NumEntryGuards</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    If UseEntryGuards is set to 1, we will try to pick a total of NUM routers
+    as long-term entries for our circuits. (Defaults to 3.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SafeSocks</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, Tor will reject application connections that
+    use unsafe variants of the socks protocol&#8201;&#8212;&#8201;ones that only provide an IP
+    address, meaning the application is doing a DNS resolve first.
+    Specifically, these are socks4 and socks5 when not doing remote DNS.
+    (Defaults to 0.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TestSocks</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, Tor will make a notice-level log entry for
+    each connection to the Socks port indicating whether the request used a
+    safe socks protocol or an unsafe one (see above entry on SafeSocks). This
+    helps to determine whether an application using Tor is possibly leaking
+    DNS requests. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>WarnUnsafeSocks</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, Tor will warn whenever a request is
+    received that only contains an IP address instead of a hostname. Allowing
+    applications to do DNS resolves themselves is usually a bad idea and
+    can leak your location to attackers. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>VirtualAddrNetwork</strong> <em>Address</em>/<em>bits</em>
+</dt>
+<dd>
+<p>
+    When Tor needs to assign a virtual (unused) address because of a MAPADDRESS
+    command from the controller or the AutomapHostsOnResolve feature, Tor
+    picks an unassigned address from this range. (Default:
+    127.192.0.0/10)<br />
+<br />
+    When providing proxy server service to a network of computers using a tool
+    like dns-proxy-tor, change this address to "10.192.0.0/10" or
+    "172.16.0.0/12". The default <strong>VirtualAddrNetwork</strong> address range on a
+    properly configured machine will route to the loopback interface. For
+    local use, no change to the default VirtualAddrNetwork setting is needed.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AllowNonRFC953Hostnames</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is disabled, Tor blocks hostnames containing illegal
+    characters (like @ and :) rather than sending them to an exit node to be
+    resolved. This helps trap accidental attempts to resolve URLs and so on.
+    (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AllowDotExit</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If enabled, we convert "www.google.com.foo.exit" addresses on the
+    SocksPort/TransPort/NATDPort into "www.google.com" addresses that exit from
+    the node "foo". Disabled by default since attacking websites and exit
+    relays can use it to manipulate your path selection. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FastFirstHopPK</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is disabled, Tor uses the public key step for the first
+    hop of creating circuits. Skipping it is generally safe since we have
+    already used TLS to authenticate the relay and to establish forward-secure
+    keys. Turning this option off makes circuit building slower.<br />
+<br />
+    Note that Tor will always use the public key step for the first hop if it&#8217;s
+    operating as a relay, and it will never use the public key step if it
+    doesn&#8217;t yet know the onion key of the first hop. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TransPort</strong> <em>PORT</em>|<strong>auto</strong>
+</dt>
+<dd>
+<p>
+    If non-zero, enables transparent proxy support on <em>PORT</em> (by convention,
+    9040). Requires OS support for transparent proxies, such as BSDs' pf or
+    Linux&#8217;s IPTables. If you&#8217;re planning to use Tor as a transparent proxy for
+    a network, you&#8217;ll want to examine and change VirtualAddrNetwork from the
+    default setting. You&#8217;ll also want to set the TransListenAddress option for
+    the network you&#8217;d like to proxy.  Set it to "auto" to have Tor pick a
+    port for you.  (Default: 0).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TransListenAddress</strong> <em>IP</em>[:<em>PORT</em>]
+</dt>
+<dd>
+<p>
+    Bind to this address to listen for transparent proxy connections. (Default:
+    127.0.0.1). This is useful for exporting a transparent proxy server to an
+    entire network.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>NATDPort</strong> <em>PORT</em>|<strong>auto</strong>
+</dt>
+<dd>
+<p>
+    Allow old versions of ipfw (as included in old versions of FreeBSD, etc.)
+    to send connections through Tor using the NATD protocol. This option is
+    only for people who cannot use TransPort.  Set it to "auto" to have Tor
+    pick a port for you. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>NATDListenAddress</strong> <em>IP</em>[:<em>PORT</em>]
+</dt>
+<dd>
+<p>
+    Bind to this address to listen for NATD connections. (Default: 127.0.0.1).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AutomapHostsOnResolve</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, and we get a request to resolve an address
+    that ends with one of the suffixes in <strong>AutomapHostsSuffixes</strong>, we map an
+    unused virtual address to that address, and return the new virtual address.
+    This is handy for making ".onion" addresses work with applications that
+    resolve an address and then connect to it. (Default: 0).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AutomapHostsSuffixes</strong> <em>SUFFIX</em>,<em>SUFFIX</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    A comma-separated list of suffixes to use with <strong>AutomapHostsOnResolve</strong>.
+    The "." suffix is equivalent to "all addresses." (Default: .exit,.onion).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DNSPort</strong> <em>PORT</em>|<strong>auto</strong>
+</dt>
+<dd>
+<p>
+    If non-zero, Tor listens for UDP DNS requests on this port and resolves
+    them anonymously.  Set it to "auto" to have Tor pick a port for
+    you. (Default: 0).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DNSListenAddress</strong> <em>IP</em>[:<em>PORT</em>]
+</dt>
+<dd>
+<p>
+    Bind to this address to listen for DNS connections. (Default: 127.0.0.1).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ClientDNSRejectInternalAddresses</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If true, Tor does not believe any anonymously retrieved DNS answer that
+    tells it that an address resolves to an internal address (like 127.0.0.1 or
+    192.168.0.1). This option prevents certain browser-based attacks; don&#8217;t
+    turn it off unless you know what you&#8217;re doing. (Default: 1).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ClientRejectInternalAddresses</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If true, Tor does not try to fulfill requests to connect to an internal
+    address (like 127.0.0.1 or 192.168.0.1) <em>unless a exit node is
+    specifically requested</em> (for example, via a .exit hostname, or a
+    controller request).  (Default: 1).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DownloadExtraInfo</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If true, Tor downloads and caches "extra-info" documents. These documents
+    contain information about servers other than the information in their
+    regular router descriptors. Tor does not use this information for anything
+    itself; to save bandwidth, leave this option turned off. (Default: 0).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FallbackNetworkstatusFile</strong> <em>FILENAME</em>
+</dt>
+<dd>
+<p>
+    If Tor doesn&#8217;t have a cached networkstatus file, it starts out using this
+    one instead. Even if this file is out of date, Tor can still use it to
+    learn about directory mirrors, so it doesn&#8217;t need to put load on the
+    authorities. (Default: None).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>WarnPlaintextPorts</strong> <em>port</em>,<em>port</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    Tells Tor to issue a warnings whenever the user tries to make an anonymous
+    connection to one of these ports. This option is designed to alert users
+    to services that risk sending passwords in the clear. (Default:
+    23,109,110,143).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RejectPlaintextPorts</strong> <em>port</em>,<em>port</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    Like WarnPlaintextPorts, but instead of warning about risky port uses, Tor
+    will instead refuse to make the connection. (Default: None).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AllowSingleHopCircuits</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set, the attached Tor controller can use relays
+    that have the <strong>AllowSingleHopExits</strong> option turned on to build
+    one-hop Tor connections.  (Default: 0)
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_server_options">SERVER OPTIONS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p>The following options are useful only for servers (that is, if ORPort
+is non-zero):</p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>Address</strong> <em>address</em>
+</dt>
+<dd>
+<p>
+    The IP address or fully qualified domain name of this server (e.g.
+    moria.mit.edu). You can leave this unset, and Tor will guess your IP
+    address.  This IP address is the one used to tell clients and other
+    servers where to find your Tor server; it doesn&#8217;t affect the IP that your
+    Tor client binds to.  To bind to a different address, use the
+    *ListenAddress and OutboundBindAddress options.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AllowSingleHopExits</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    This option controls whether clients can use this server as a single hop
+    proxy. If set to 1, clients can use this server as an exit even if it is
+    the only hop in the circuit.  Note that most clients will refuse to use
+    servers that set this option, since most clients have
+    ExcludeSingleHopRelays set.  (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AssumeReachable</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    This option is used when bootstrapping a new Tor network. If set to 1,
+    don&#8217;t do self-reachability testing; just upload your server descriptor
+    immediately. If <strong>AuthoritativeDirectory</strong> is also set, this option
+    instructs the dirserver to bypass remote reachability testing too and list
+    all connected servers as running.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>BridgeRelay</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    Sets the relay to act as a "bridge" with respect to relaying connections
+    from bridge users to the Tor network. It mainly causes Tor to publish a
+    server descriptor to the bridge database, rather than publishing a relay
+    descriptor to the public directory authorities.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ContactInfo</strong> <em>email_address</em>
+</dt>
+<dd>
+<p>
+    Administrative contact information for server. This line might get picked
+    up by spam harvesters, so you may want to obscure the fact that it&#8217;s an
+    email address.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ExitPolicy</strong> <em>policy</em>,<em>policy</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    Set an exit policy for this server. Each policy is of the form
+    "<strong>accept</strong>|<strong>reject</strong> <em>ADDR</em>[/<em>MASK</em>][:<em>PORT</em>]". If /<em>MASK</em> is
+    omitted then this policy just applies to the host given. Instead of giving
+    a host or network you can also use "*" to denote the universe (0.0.0.0/0).
+    <em>PORT</em> can be a single port number, an interval of ports
+    "<em>FROM_PORT</em>-<em>TO_PORT</em>", or "*". If <em>PORT</em> is omitted, that means
+    "*".<br />
+<br />
+    For example, "accept 18.7.22.69:*,reject 18.0.0.0/8:*,accept *:*" would
+    reject any traffic destined for MIT except for web.mit.edu, and accept
+    anything else.<br />
+<br />
+    To specify all internal and link-local networks (including 0.0.0.0/8,
+    169.254.0.0/16,    127.0.0.0/8,    192.168.0.0/16, 10.0.0.0/8, and
+    172.16.0.0/12), you can use the "private" alias instead of an address.
+    These addresses are rejected by default (at the beginning of your exit
+    policy), along with your public IP address, unless you set the
+    ExitPolicyRejectPrivate config option to 0. For example, once you&#8217;ve done
+    that, you could allow HTTP to 127.0.0.1 and block all other connections to
+    internal networks with "accept 127.0.0.1:80,reject private:*", though that
+    may also allow connections to your own computer that are addressed to its
+    public (external) IP address. See RFC 1918 and RFC 3330 for more details
+    about internal and reserved IP address space.<br />
+<br />
+    This directive can be specified multiple times so you don&#8217;t have to put it
+    all on one line.<br />
+<br />
+    Policies are considered first to last, and the first match wins. If you
+    want to _replace_ the default exit policy, end your exit policy with
+    either a reject *:* or an accept *:*. Otherwise, you&#8217;re _augmenting_
+    (prepending to) the default exit policy. The default exit policy is:<br />
+</p>
+<div class="literalblock">
+<div class="content">
+<pre><tt>reject *:25
+reject *:119
+reject *:135-139
+reject *:445
+reject *:563
+reject *:1214
+reject *:4661-4666
+reject *:6346-6429
+reject *:6699
+reject *:6881-6999
+accept *:*</tt></pre>
+</div></div>
+</dd>
+<dt class="hdlist1">
+<strong>ExitPolicyRejectPrivate</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    Reject all private (local) networks, along with your own public IP address,
+    at the beginning of your exit policy. See above entry on ExitPolicy.
+    (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>MaxOnionsPending</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    If you have more than this number of onionskins queued for decrypt, reject
+    new ones. (Default: 100)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>MyFamily</strong> <em>node</em>,<em>node</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    Declare that this Tor server is controlled or administered by a group or
+    organization identical or similar to that of the other servers, defined by
+    their identity fingerprints or nicknames. When two servers both declare
+    that they are in the same 'family', Tor clients will not use them in the
+    same circuit. (Each server only needs to list the other servers in its
+    family; it doesn&#8217;t need to list itself, but it won&#8217;t hurt.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>Nickname</strong> <em>name</em>
+</dt>
+<dd>
+<p>
+    Set the server&#8217;s nickname to 'name'. Nicknames must be between 1 and 19
+    characters inclusive, and must contain only the characters [a-zA-Z0-9].
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>NumCPUs</strong> <em>num</em>
+</dt>
+<dd>
+<p>
+    How many processes to use at once for decrypting onionskins. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ORPort</strong> <em>PORT</em>|<strong>auto</strong>
+</dt>
+<dd>
+<p>
+    Advertise this port to listen for connections from Tor clients and
+    servers.  This option is required to be a Tor server.
+    Set it to "auto" to have Tor pick a port for you. (Default: 0).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ORListenAddress</strong> <em>IP</em>[:<em>PORT</em>]
+</dt>
+<dd>
+<p>
+    Bind to this IP address to listen for connections from Tor clients and
+    servers. If you specify a port, bind to this port rather than the one
+    specified in ORPort. (Default: 0.0.0.0) This directive can be specified
+    multiple times to bind to multiple addresses/ports.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>PublishServerDescriptor</strong> <strong>0</strong>|<strong>1</strong>|<strong>v1</strong>|<strong>v2</strong>|<strong>v3</strong>|<strong>bridge</strong>,<strong>&#8230;</strong>
+</dt>
+<dd>
+<p>
+    This option specifies which descriptors Tor will publish when acting as
+    a relay. You can
+    choose multiple arguments, separated by commas.
+<br />
+    If this option is set to 0, Tor will not publish its
+    descriptors to any directories. (This is useful if you&#8217;re testing
+    out your server, or if you&#8217;re using a Tor controller that handles directory
+    publishing for you.) Otherwise, Tor will publish its descriptors of all
+    type(s) specified. The default is "1",
+    which means "if running as a server, publish the
+    appropriate descriptors to the authorities".
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ShutdownWaitLength</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    When we get a SIGINT and we&#8217;re a server, we begin shutting down:
+    we close listeners and start refusing new circuits. After <strong>NUM</strong>
+    seconds, we exit. If we get a second SIGINT, we exit immedi-
+    ately. (Default: 30 seconds)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AccountingMax</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>|<strong>TB</strong>
+</dt>
+<dd>
+<p>
+    Never send more than the specified number of bytes in a given accounting
+    period, or receive more than that number in the period. For example, with
+    AccountingMax set to 1 GB, a server could send 900 MB and receive 800 MB
+    and continue running. It will only hibernate once one of the two reaches 1
+    GB. When the number of bytes gets low, Tor will stop accepting new
+    connections and circuits.  When the number of bytes
+    is exhausted, Tor will hibernate until some
+    time in the next accounting period. To prevent all servers from waking at
+    the same time, Tor will also wait until a random point in each period
+    before waking up. If you have bandwidth cost issues, enabling hibernation
+    is preferable to setting a low bandwidth, since it provides users with a
+    collection of fast servers that are up some of the time, which is more
+    useful than a set of slow servers that are always "available".
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AccountingStart</strong> <strong>day</strong>|<strong>week</strong>|<strong>month</strong> [<em>day</em>] <em>HH:MM</em>
+</dt>
+<dd>
+<p>
+    Specify how long accounting periods last. If <strong>month</strong> is given, each
+    accounting period runs from the time <em>HH:MM</em> on the <em>dayth</em> day of one
+    month to the same day and time of the next. (The day must be between 1 and
+    28.) If <strong>week</strong> is given, each accounting period runs from the time <em>HH:MM</em>
+    of the <em>dayth</em> day of one week to the same day and time of the next week,
+    with Monday as day 1 and Sunday as day 7. If <strong>day</strong> is given, each
+    accounting period runs from the time <em>HH:MM</em> each day to the same time on
+    the next day. All times are local, and given in 24-hour time. (Defaults to
+    "month 1 0:00".)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RefuseUnknownExits</strong> <strong>0</strong>|<strong>1</strong>|<strong>auto</strong>
+</dt>
+<dd>
+<p>
+    Prevent nodes that don&#8217;t appear in the consensus from exiting using this
+    relay.  If the option is 1, we always block exit attempts from such
+    nodes; if it&#8217;s 0, we never do, and if the option is "auto", then we do
+    whatever the authorities suggest in the consensus. (Defaults to auto.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ServerDNSResolvConfFile</strong> <em>filename</em>
+</dt>
+<dd>
+<p>
+    Overrides the default DNS configuration with the configuration in
+    <em>filename</em>. The file format is the same as the standard Unix
+    "<strong>resolv.conf</strong>" file (7). This option, like all other ServerDNS options,
+    only affects name lookups that your server does on behalf of clients.
+    (Defaults to use the system DNS configuration.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ServerDNSAllowBrokenConfig</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If this option is false, Tor exits immediately if there are problems
+    parsing the system DNS configuration or connecting to nameservers.
+    Otherwise, Tor continues to periodically retry the system nameservers until
+    it eventually succeeds. (Defaults to "1".)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ServerDNSSearchDomains</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 1, then we will search for addresses in the local search domain.
+    For example, if this system is configured to believe it is in
+    "example.com", and a client tries to connect to "www", the client will be
+    connected to "www.example.com". This option only affects name lookups that
+    your server does on behalf of clients. (Defaults to "0".)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ServerDNSDetectHijacking</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set to 1, we will test periodically to determine
+    whether our local nameservers have been configured to hijack failing DNS
+    requests (usually to an advertising site). If they are, we will attempt to
+    correct this. This option only affects name lookups that your server does
+    on behalf of clients. (Defaults to "1".)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ServerDNSTestAddresses</strong> <em>address</em>,<em>address</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    When we&#8217;re detecting DNS hijacking, make sure that these <em>valid</em> addresses
+    aren&#8217;t getting redirected. If they are, then our DNS is completely useless,
+    and we&#8217;ll reset our exit policy to "reject <strong>:</strong>". This option only affects
+    name lookups that your server does on behalf of clients. (Defaults to
+    "www.google.com, www.mit.edu, www.yahoo.com, www.slashdot.org".)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ServerDNSAllowNonRFC953Hostnames</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is disabled, Tor does not try to resolve hostnames
+    containing illegal characters (like @ and :) rather than sending them to an
+    exit node to be resolved. This helps trap accidental attempts to resolve
+    URLs and so on. This option only affects name lookups that your server does
+    on behalf of clients. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>BridgeRecordUsageByCountry</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled and BridgeRelay is also enabled, and we have
+    GeoIP data, Tor keeps a keep a per-country count of how many client
+    addresses have contacted it so that it can help the bridge authority guess
+    which countries have blocked access to it. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ServerDNSRandomizeCase</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set, Tor sets the case of each character randomly in
+    outgoing DNS requests, and makes sure that the case matches in DNS replies.
+    This so-called "0x20 hack" helps resist some types of DNS poisoning attack.
+    For more information, see "Increased DNS Forgery Resistance through
+    0x20-Bit Encoding". This option only affects name lookups that your server
+    does on behalf of clients. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>GeoIPFile</strong> <em>filename</em>
+</dt>
+<dd>
+<p>
+    A filename containing GeoIP data, for use with BridgeRecordUsageByCountry.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>CellStatistics</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, Tor writes statistics on the mean time that
+    cells spend in circuit queues to disk every 24 hours. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DirReqStatistics</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, Tor writes statistics on the number and
+    response time of network status requests to disk every 24 hours.
+    (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>EntryStatistics</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, Tor writes statistics on the number of
+    directly connecting clients to disk every 24 hours. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ExitPortStatistics</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, Tor writes statistics on the number of relayed
+    bytes and opened stream per exit port to disk every 24 hours. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ExtraInfoStatistics</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is enabled, Tor includes previously gathered statistics in
+    its extra-info documents that it uploads to the directory authorities.
+    (Default: 0)
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_directory_server_options">DIRECTORY SERVER OPTIONS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p>The following options are useful only for directory servers (that is,
+if DirPort is non-zero):</p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>AuthoritativeDirectory</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set to 1, Tor operates as an authoritative directory
+    server. Instead of caching the directory, it generates its own list of
+    good servers, signs it, and sends that to the clients. Unless the clients
+    already have you listed as a trusted directory, you probably do not want
+    to set this option. Please coordinate with the other admins at
+    <a href="mailto:tor-ops@torproject.org">tor-ops@torproject.org</a> if you think you should be a directory.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DirPortFrontPage</strong> <em>FILENAME</em>
+</dt>
+<dd>
+<p>
+    When this option is set, it takes an HTML file and publishes it as "/" on
+    the DirPort. Now relay operators can provide a disclaimer without needing
+    to set up a separate webserver. There&#8217;s a sample disclaimer in
+    contrib/tor-exit-notice.html.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V1AuthoritativeDirectory</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set in addition to <strong>AuthoritativeDirectory</strong>, Tor
+    generates version 1 directory and running-routers documents (for legacy
+    Tor clients up to 0.1.0.x).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V2AuthoritativeDirectory</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set in addition to <strong>AuthoritativeDirectory</strong>, Tor
+    generates version 2 network statuses and serves descriptors, etc as
+    described in doc/spec/dir-spec-v2.txt (for Tor clients and servers running
+    0.1.1.x and 0.1.2.x).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V3AuthoritativeDirectory</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set in addition to <strong>AuthoritativeDirectory</strong>, Tor
+    generates version 3 network statuses and serves descriptors, etc as
+    described in doc/spec/dir-spec.txt (for Tor clients and servers running at
+    least 0.2.0.x).
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>VersioningAuthoritativeDirectory</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set to 1, Tor adds information on which versions of
+    Tor are still believed safe for use to the published directory. Each
+    version 1 authority is automatically a versioning authority; version 2
+    authorities provide this service optionally. See <strong>RecommendedVersions</strong>,
+    <strong>RecommendedClientVersions</strong>, and <strong>RecommendedServerVersions</strong>.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>NamingAuthoritativeDirectory</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set to 1, then the server advertises that it has
+    opinions about nickname-to-fingerprint bindings. It will include these
+    opinions in its published network-status pages, by listing servers with
+    the flag "Named" if a correct binding between that nickname and fingerprint
+    has been registered with the dirserver. Naming dirservers will refuse to
+    accept or publish descriptors that contradict a registered binding. See
+    <strong>approved-routers</strong> in the <strong>FILES</strong> section below.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HSAuthoritativeDir</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set in addition to <strong>AuthoritativeDirectory</strong>, Tor also
+    accepts and serves v0 hidden service descriptors,
+    which are produced and used by Tor 0.2.1.x and older. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HidServDirectoryV2</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set, Tor accepts and serves v2 hidden service
+    descriptors. Setting DirPort is not required for this, because clients
+    connect via the ORPort by default. (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>BridgeAuthoritativeDir</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set in addition to <strong>AuthoritativeDirectory</strong>, Tor
+    accepts and serves router descriptors, but it caches and serves the main
+    networkstatus documents rather than generating its own. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>MinUptimeHidServDirectoryV2</strong> <em>N</em> <strong>seconds</strong>|<strong>minutes</strong>|<strong>hours</strong>|<strong>days</strong>|<strong>weeks</strong>
+</dt>
+<dd>
+<p>
+    Minimum uptime of a v2 hidden service directory to be accepted as such by
+    authoritative directories. (Default: 25 hours)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DirPort</strong> <em>PORT</em>|<strong>auto</strong>
+</dt>
+<dd>
+<p>
+    If this option is nonzero, advertise the directory service on this port.
+    Set it to "auto" to have Tor pick a port for you.  (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DirListenAddress</strong> <em>IP</em>[:<em>PORT</em>]
+</dt>
+<dd>
+<p>
+    Bind the directory service to this address. If you specify a port, bind to
+    this port rather than the one specified in DirPort.  (Default: 0.0.0.0)
+    This directive can be specified multiple times  to bind to multiple
+    addresses/ports.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DirPolicy</strong> <em>policy</em>,<em>policy</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    Set an entrance policy for this server, to limit who can connect to the
+    directory ports. The policies have the same form as exit policies above.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>FetchV2Networkstatus</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set, we try to fetch the (obsolete, unused) version 2 network status
+    consensus documents from the directory authorities. No currently
+    supported Tor version uses them.  (Default: 0.)
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_directory_authority_server_options">DIRECTORY AUTHORITY SERVER OPTIONS</h2>
+<div class="sectionbody">
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>RecommendedVersions</strong> <em>STRING</em>
+</dt>
+<dd>
+<p>
+    STRING is a comma-separated list of Tor versions currently believed to be
+    safe. The list is included in each directory, and nodes which pull down the
+    directory learn whether they need to upgrade. This option can appear
+    multiple times: the values from multiple lines are spliced together. When
+    this is set then <strong>VersioningAuthoritativeDirectory</strong> should be set too.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RecommendedClientVersions</strong> <em>STRING</em>
+</dt>
+<dd>
+<p>
+    STRING is a comma-separated list of Tor versions currently believed to be
+    safe for clients to use. This information is included in version 2
+    directories. If this is not set then the value of <strong>RecommendedVersions</strong>
+    is used. When this is set then <strong>VersioningAuthoritativeDirectory</strong> should
+    be set too.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RecommendedServerVersions</strong> <em>STRING</em>
+</dt>
+<dd>
+<p>
+    STRING is a comma-separated list of Tor versions currently believed to be
+    safe for servers to use. This information is included in version 2
+    directories. If this is not set then the value of <strong>RecommendedVersions</strong>
+    is used. When this is set then <strong>VersioningAuthoritativeDirectory</strong> should
+    be set too.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>ConsensusParams</strong> <em>STRING</em>
+</dt>
+<dd>
+<p>
+    STRING is a space-separated list of key=value pairs that Tor will include
+    in the "params" line of its networkstatus vote.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>DirAllowPrivateAddresses</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 1, Tor will accept router descriptors with arbitrary "Address"
+    elements. Otherwise, if the address is not an IP address or is a private IP
+    address, it will reject the router descriptor. Defaults to 0.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirBadDir</strong> <em>AddressPattern&#8230;</em>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. A set of address patterns for servers that
+    will be listed as bad directories in any network status document this
+    authority publishes, if <strong>AuthDirListBadDirs</strong> is set.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirBadExit</strong> <em>AddressPattern&#8230;</em>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. A set of address patterns for servers that
+    will be listed as bad exits in any network status document this authority
+    publishes, if <strong>AuthDirListBadExits</strong> is set.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirInvalid</strong> <em>AddressPattern&#8230;</em>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. A set of address patterns for servers that
+    will never be listed as "valid" in any network status document that this
+    authority publishes.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirReject</strong> <em>AddressPattern</em>&#8230;
+</dt>
+<dd>
+<p>
+    Authoritative directories only. A set of address patterns for servers that
+    will never be listed at all in any network status document that this
+    authority publishes, or accepted as an OR address in any descriptor
+    submitted for publication by this authority.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirListBadDirs</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. If set to 1, this directory has some
+    opinion about which nodes are unsuitable as directory caches. (Do not set
+    this to 1 unless you plan to list non-functioning directories as bad;
+    otherwise, you are effectively voting in favor  of every declared
+    directory.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirListBadExits</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. If set to 1, this directory has some
+    opinion about which nodes are unsuitable as exit nodes. (Do not set this to
+    1 unless you plan to list non-functioning exits as bad; otherwise, you are
+    effectively voting in favor of every declared exit as an exit.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirRejectUnlisted</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. If set to 1, the directory server rejects
+    all uploaded server descriptors that aren&#8217;t explicitly listed in the
+    fingerprints file. This acts as a "panic button" if we get hit with a Sybil
+    attack. (Default: 0)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirMaxServersPerAddr</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. The maximum number of servers that we will
+    list as acceptable on a single IP address. Set this to "0" for "no limit".
+    (Default: 2)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirMaxServersPerAuthAddr</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. Like AuthDirMaxServersPerAddr, but applies
+    to addresses shared with directory authorities. (Default: 5)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirFastGuarantee</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. If non-zero, always vote the
+    Fast flag for any relay advertising this amount of capacity or
+    more. (Default: 20 KB)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>AuthDirGuardBWGuarantee</strong> <em>N</em> <strong>bytes</strong>|<strong>KB</strong>|<strong>MB</strong>|<strong>GB</strong>
+</dt>
+<dd>
+<p>
+    Authoritative directories only. If non-zero, this advertised capacity
+    or more is always sufficient to satisfy the bandwidth requirement
+    for the Guard flag. (Default: 250 KB)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>BridgePassword</strong> <em>Password</em>
+</dt>
+<dd>
+<p>
+    If set, contains an HTTP authenticator that tells a bridge authority to
+    serve all requested bridge information.  Used for debugging.  (Default:
+    not set.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V3AuthVotingInterval</strong> <em>N</em> <strong>minutes</strong>|<strong>hours</strong>
+</dt>
+<dd>
+<p>
+    V3 authoritative directories only. Configures the server&#8217;s preferred voting
+    interval. Note that voting will <em>actually</em> happen at an interval chosen
+    by consensus from all the authorities' preferred intervals. This time
+    SHOULD divide evenly into a day. (Default: 1 hour)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V3AuthVoteDelay</strong> <em>N</em> <strong>minutes</strong>|<strong>hours</strong>
+</dt>
+<dd>
+<p>
+    V3 authoritative directories only. Configures the server&#8217;s preferred delay
+    between publishing its vote and assuming it has all the votes from all the
+    other authorities. Note that the actual time used is not the server&#8217;s
+    preferred time, but the consensus of all preferences. (Default: 5 minutes.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V3AuthDistDelay</strong> <em>N</em> <strong>minutes</strong>|<strong>hours</strong>
+</dt>
+<dd>
+<p>
+    V3 authoritative directories only. Configures the server&#8217;s preferred  delay
+    between publishing its consensus and signature and assuming  it has all the
+    signatures from all the other authorities. Note that the actual time used
+    is not the server&#8217;s preferred time,  but the consensus of all preferences.
+    (Default: 5 minutes.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V3AuthNIntervalsValid</strong> <em>NUM</em>
+</dt>
+<dd>
+<p>
+    V3 authoritative directories only. Configures the number of VotingIntervals
+    for which each consensus should be valid for. Choosing high numbers
+    increases network partitioning risks; choosing low numbers increases
+    directory traffic. Note that the actual number of intervals used is not the
+    server&#8217;s preferred number, but the consensus of all preferences. Must be at
+    least 2. (Default: 3.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V3BandwidthsFile</strong> <em>FILENAME</em>
+</dt>
+<dd>
+<p>
+    V3 authoritative directories only. Configures the location of the
+    bandiwdth-authority generated file storing information on relays' measured
+    bandwidth capacities. (Default: unset.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>V3AuthUseLegacyKey</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set, the directory authority will sign consensuses not only with its
+    own signing key, but also with a "legacy" key and certificate with a
+    different identity.  This feature is used to migrate directory authority
+    keys in the event of a compromise.  (Default: 0.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RephistTrackTime</strong> <em>N</em> <strong>seconds</strong>|<strong>minutes</strong>|<strong>hours</strong>|<strong>days</strong>|<strong>weeks</strong>
+</dt>
+<dd>
+<p>
+    Tells an authority, or other node tracking node reliability and history,
+    that fine-grained information about nodes can be discarded when it hasn&#8217;t
+    changed for a given amount of time.  (Default: 24 hours)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>VoteOnHidServDirectoriesV2</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    When this option is set in addition to <strong>AuthoritativeDirectory</strong>, Tor
+    votes on whether to accept relays as hidden service directories.
+    (Default: 1)
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_hidden_service_options">HIDDEN SERVICE OPTIONS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p>The following options are used to configure a hidden service.</p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>HiddenServiceDir</strong> <em>DIRECTORY</em>
+</dt>
+<dd>
+<p>
+    Store data files for a hidden service in DIRECTORY. Every hidden service
+    must have a separate directory. You may use this option  multiple times to
+    specify multiple services. DIRECTORY must be an existing directory.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HiddenServicePort</strong> <em>VIRTPORT</em> [<em>TARGET</em>]
+</dt>
+<dd>
+<p>
+    Configure a virtual port VIRTPORT for a hidden service. You may use this
+    option multiple times; each time applies to the service using the most
+    recent hiddenservicedir. By default, this option maps the virtual port to
+    the same port on 127.0.0.1. You may override the target port, address, or
+    both by specifying a target of addr, port, or addr:port. You may also have
+    multiple lines with  the same VIRTPORT: when a user connects to that
+    VIRTPORT, one of the TARGETs from those lines will be chosen at random.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>PublishHidServDescriptors</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 0, Tor will run any hidden services you configure, but it won&#8217;t
+    advertise them to the rendezvous directory. This option is only useful if
+    you&#8217;re using a Tor controller that handles hidserv publishing for you.
+    (Default: 1)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HiddenServiceVersion</strong> <em>version</em>,<em>version</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    A list of rendezvous service descriptor versions to publish for the hidden
+    service. Currently, only version 2 is supported. (Default: 2)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>HiddenServiceAuthorizeClient</strong> <em>auth-type</em> <em>client-name</em>,<em>client-name</em>,<em>&#8230;</em>
+</dt>
+<dd>
+<p>
+    If configured, the hidden service is accessible for authorized clients
+    only. The auth-type can either be 'basic' for a general-purpose
+    authorization protocol or 'stealth' for a less scalable protocol that also
+    hides service activity from unauthorized clients. Only clients that are
+    listed here are authorized to access the hidden service. Valid client names
+    are 1 to 19 characters  long and only use characters in A-Za-z0-9+-_ (no
+    spaces). If this option is set, the hidden service is not accessible for
+    clients without authorization any more. Generated authorization data can be
+    found in the hostname file. Clients need to put this authorization data in
+    their configuration file using <strong>HidServAuth</strong>.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>RendPostPeriod</strong> <em>N</em> <strong>seconds</strong>|<strong>minutes</strong>|<strong>hours</strong>|<strong>days</strong>|<strong>weeks</strong>
+</dt>
+<dd>
+<p>
+    Every time the specified period elapses, Tor uploads any rendezvous
+    service descriptors to the directory servers. This information  is also
+    uploaded whenever it changes. (Default: 1 hour)
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_testing_network_options">TESTING NETWORK OPTIONS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p>The following options are used for running a testing Tor network.</p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>TestingTorNetwork</strong> <strong>0</strong>|<strong>1</strong>
+</dt>
+<dd>
+<p>
+    If set to 1, Tor adjusts default values of the configuration options below,
+    so that it is easier to set up a testing Tor network. May only be set if
+    non-default set of DirServers is set. Cannot be unset while Tor is running.
+    (Default: 0)<br />
+</p>
+<div class="literalblock">
+<div class="content">
+<pre><tt>ServerDNSAllowBrokenConfig 1
+DirAllowPrivateAddresses 1
+EnforceDistinctSubnets 0
+AssumeReachable 1
+AuthDirMaxServersPerAddr 0
+AuthDirMaxServersPerAuthAddr 0
+ClientDNSRejectInternalAddresses 0
+ClientRejectInternalAddresses 0
+ExitPolicyRejectPrivate 0
+V3AuthVotingInterval 5 minutes
+V3AuthVoteDelay 20 seconds
+V3AuthDistDelay 20 seconds
+MinUptimeHidServDirectoryV2 0 seconds
+TestingV3AuthInitialVotingInterval 5 minutes
+TestingV3AuthInitialVoteDelay 20 seconds
+TestingV3AuthInitialDistDelay 20 seconds
+TestingAuthDirTimeToLearnReachability 0 minutes
+TestingEstimatedDescriptorPropagationTime 0 minutes</tt></pre>
+</div></div>
+</dd>
+<dt class="hdlist1">
+<strong>TestingV3AuthInitialVotingInterval</strong> <em>N</em> <strong>minutes</strong>|<strong>hours</strong>
+</dt>
+<dd>
+<p>
+    Like V3AuthVotingInterval, but for initial voting interval before the first
+    consensus has been created. Changing this requires that
+    <strong>TestingTorNetwork</strong> is set. (Default: 30 minutes)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TestingV3AuthInitialVoteDelay</strong> <em>N</em> <strong>minutes</strong>|<strong>hours</strong>
+</dt>
+<dd>
+<p>
+    Like TestingV3AuthInitialVoteDelay, but for initial voting interval before
+    the first consensus has been created. Changing this requires that
+    <strong>TestingTorNetwork</strong> is set. (Default: 5 minutes)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TestingV3AuthInitialDistDelay</strong> <em>N</em> <strong>minutes</strong>|<strong>hours</strong>
+</dt>
+<dd>
+<p>
+    Like TestingV3AuthInitialDistDelay, but for initial voting interval before
+    the first consensus has been created. Changing this requires that
+    <strong>TestingTorNetwork</strong> is set. (Default: 5 minutes)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TestingAuthDirTimeToLearnReachability</strong> <em>N</em> <strong>minutes</strong>|<strong>hours</strong>
+</dt>
+<dd>
+<p>
+    After starting as an authority, do not make claims about whether routers
+    are Running until this much time has passed. Changing this requires
+    that <strong>TestingTorNetwork</strong> is set.  (Default: 30 minutes)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>TestingEstimatedDescriptorPropagationTime</strong> <em>N</em> <strong>minutes</strong>|<strong>hours</strong>
+</dt>
+<dd>
+<p>
+    Clients try downloading router descriptors from directory caches after this
+    time. Changing this requires that <strong>TestingTorNetwork</strong> is set. (Default:
+    10 minutes)
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_signals">SIGNALS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p>Tor catches the following signals:</p></div>
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>SIGTERM</strong>
+</dt>
+<dd>
+<p>
+    Tor will catch this, clean up and sync to disk if necessary, and exit.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SIGINT</strong>
+</dt>
+<dd>
+<p>
+    Tor clients behave as with SIGTERM; but Tor servers will do a controlled
+    slow shutdown, closing listeners and waiting 30 seconds before exiting.
+    (The delay can be configured with the ShutdownWaitLength config option.)
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SIGHUP</strong>
+</dt>
+<dd>
+<p>
+    The signal instructs Tor to reload its configuration (including closing and
+    reopening logs), and kill and restart its helper processes if applicable.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SIGUSR1</strong>
+</dt>
+<dd>
+<p>
+    Log statistics about current connections, past connections, and throughput.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SIGUSR2</strong>
+</dt>
+<dd>
+<p>
+    Switch all logs to loglevel debug. You can go back to the old loglevels by
+    sending a SIGHUP.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SIGCHLD</strong>
+</dt>
+<dd>
+<p>
+    Tor receives this signal when one of its helper processes has exited, so it
+    can clean up.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SIGPIPE</strong>
+</dt>
+<dd>
+<p>
+    Tor catches this signal and ignores it.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>SIGXFSZ</strong>
+</dt>
+<dd>
+<p>
+    If this signal exists on your platform, Tor catches and ignores it.
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_files">FILES</h2>
+<div class="sectionbody">
+<div class="dlist"><dl>
+<dt class="hdlist1">
+<strong>/etc/tor/torrc</strong>
+</dt>
+<dd>
+<p>
+    The configuration file, which contains "option value" pairs.
+</p>
+</dd>
+<dt class="hdlist1">
+<strong>/var/lib/tor/</strong>
+</dt>
+<dd>
+<p>
+    The tor process stores keys and other data here.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/cached-status/</strong>
+</dt>
+<dd>
+<p>
+    The most recently downloaded network status document for each authority.
+    Each file holds one such document; the filenames are the hexadecimal
+    identity key fingerprints of the directory authorities.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/cached-descriptors</strong> and <strong>cached-descriptors.new</strong>
+</dt>
+<dd>
+<p>
+    These files hold downloaded router statuses. Some routers may appear more
+    than once; if so, the most recently published descriptor is used. Lines
+    beginning with @-signs are annotations that contain more information about
+    a given router. The ".new" file is an append-only journal; when it gets
+    too large, all entries are merged into a new cached-descriptors file.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/cached-routers</strong> and <strong>cached-routers.new</strong>
+</dt>
+<dd>
+<p>
+    Obsolete versions of cached-descriptors and cached-descriptors.new. When
+    Tor can&#8217;t find the newer files, it looks here instead.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/state</strong>
+</dt>
+<dd>
+<p>
+    A set of persistent key-value mappings. These are documented in
+    the file. These include:
+</p>
+<div class="ulist"><ul>
+<li>
+<p>
+The current entry guards and their status.
+</p>
+</li>
+<li>
+<p>
+The current bandwidth accounting values (unused so far; see
+            below).
+</p>
+</li>
+<li>
+<p>
+When the file was last written
+</p>
+</li>
+<li>
+<p>
+What version of Tor generated the state file
+</p>
+</li>
+<li>
+<p>
+A short history of bandwidth usage, as produced in the router
+            descriptors.
+</p>
+</li>
+</ul></div>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/bw_accounting</strong>
+</dt>
+<dd>
+<p>
+    Used to track bandwidth accounting values (when the current period starts
+    and ends; how much has been read and written so far this period). This file
+    is obsolete, and the data is now stored in the 'state' file as well. Only
+    used when bandwidth accounting is enabled.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/control_auth_cookie</strong>
+</dt>
+<dd>
+<p>
+    Used for cookie authentication with the controller. Location can be
+    overridden by the CookieAuthFile config option. Regenerated on startup. See
+    control-spec.txt for details. Only used when cookie authentication is
+    enabled.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/keys/</strong>*
+</dt>
+<dd>
+<p>
+    Only used by servers. Holds identity keys and onion keys.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/fingerprint</strong>
+</dt>
+<dd>
+<p>
+    Only used by servers. Holds the fingerprint of the server&#8217;s identity key.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/approved-routers</strong>
+</dt>
+<dd>
+<p>
+    Only for naming authoritative directory servers (see
+    <strong>NamingAuthoritativeDirectory</strong>). This file lists nickname to identity
+    bindings. Each line lists a nickname and a fingerprint separated by
+    whitespace. See your <strong>fingerprint</strong> file in the <em>DataDirectory</em> for an
+    example line. If the nickname is <strong>!reject</strong> then descriptors from the
+    given identity (fingerprint) are rejected by this server. If it is
+    <strong>!invalid</strong> then descriptors are accepted but marked in the directory as
+    not valid, that is, not recommended.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>DataDirectory</em><strong>/router-stability</strong>
+</dt>
+<dd>
+<p>
+    Only used by authoritative directory servers. Tracks measurements for
+    router mean-time-between-failures so that authorities have a good idea of
+    how to set their Stable flags.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>HiddenServiceDirectory</em><strong>/hostname</strong>
+</dt>
+<dd>
+<p>
+    The &lt;base32-encoded-fingerprint&gt;.onion domain name for this hidden service.
+    If the hidden service is restricted to authorized clients only, this file
+    also contains authorization data for all clients.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>HiddenServiceDirectory</em><strong>/private_key</strong>
+</dt>
+<dd>
+<p>
+    The private key for this hidden service.
+</p>
+</dd>
+<dt class="hdlist1">
+<em>HiddenServiceDirectory</em><strong>/client_keys</strong>
+</dt>
+<dd>
+<p>
+    Authorization data for a hidden service that is only accessible by
+    authorized clients.
+</p>
+</dd>
+</dl></div>
+</div>
+<h2 id="_see_also">SEE ALSO</h2>
+<div class="sectionbody">
+<div class="paragraph"><p><strong>privoxy</strong>(1), <strong>tsocks</strong>(1), <strong>torify</strong>(1)<br /></p></div>
+<div class="paragraph"><p><strong>https://www.torproject.org/</strong></p></div>
+</div>
+<h2 id="_bugs">BUGS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p>Plenty, probably. Tor is still in development. Please report them.</p></div>
+</div>
+<h2 id="_authors">AUTHORS</h2>
+<div class="sectionbody">
+<div class="paragraph"><p>Roger Dingledine [arma at mit.edu], Nick Mathewson [nickm at alum.mit.edu].</p></div>
+</div>
+<div id="footer">
+<div id="footer-text">
+Last updated 2011-12-15 11:28:37 EDT
+</div>
+</div>
+</body>
+</html>
diff --git a/puppet/modules/tor/manifests/arm.pp b/puppet/modules/tor/manifests/arm.pp
new file mode 100644
index 00000000..44ddcbbf
--- /dev/null
+++ b/puppet/modules/tor/manifests/arm.pp
@@ -0,0 +1,9 @@
+# manage tor-arm
+class tor::arm (
+  $ensure_version = 'installed'
+){
+  include ::tor
+  package{'tor-arm':
+    ensure => $ensure_version,
+  }
+}
diff --git a/puppet/modules/tor/manifests/base.pp b/puppet/modules/tor/manifests/base.pp
new file mode 100644
index 00000000..b98451be
--- /dev/null
+++ b/puppet/modules/tor/manifests/base.pp
@@ -0,0 +1,14 @@
+# basic management of resources for tor
+class tor::base {
+  package { [ 'tor', 'tor-geoipdb' ]:
+    ensure => $tor::ensure_version,
+  }
+
+  service { 'tor':
+    ensure     => running,
+    enable     => true,
+    hasrestart => true,
+    hasstatus  => true,
+    require    => Package['tor'],
+  }
+}
diff --git a/puppet/modules/tor/manifests/compact.pp b/puppet/modules/tor/manifests/compact.pp
new file mode 100644
index 00000000..c0f59199
--- /dev/null
+++ b/puppet/modules/tor/manifests/compact.pp
@@ -0,0 +1,7 @@
+# manage a complete tor
+# installation with all the basics
+class tor::compact {
+  include ::tor
+  include tor::polipo
+  include tor::torsocks
+}
diff --git a/puppet/modules/tor/manifests/daemon.pp b/puppet/modules/tor/manifests/daemon.pp
new file mode 100644
index 00000000..2522b2cc
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon.pp
@@ -0,0 +1,22 @@
+# manage a snippet based tor installation
+class tor::daemon (
+  $ensure_version           = 'installed',
+  $use_munin                = false,
+  $data_dir                 = '/var/lib/tor',
+  $config_file              = '/etc/tor/torrc',
+  $use_bridges              = 0,
+  $automap_hosts_on_resolve = 0,
+  $log_rules                = [ 'notice file /var/log/tor/notices.log' ],
+  $safe_logging             = 1,
+) {
+
+  class{'tor':
+    ensure_version => $ensure_version,
+  }
+
+  include tor::daemon::base
+
+  if $use_munin {
+    include tor::munin
+  }
+}
diff --git a/puppet/modules/tor/manifests/daemon/base.pp b/puppet/modules/tor/manifests/daemon/base.pp
new file mode 100644
index 00000000..63d7bc4d
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/base.pp
@@ -0,0 +1,77 @@
+# extend basic tor things with a snippet based daemon configuration
+class tor::daemon::base inherits tor::base {
+  # packages, user, group
+  Service['tor'] {
+    subscribe => File[$tor::daemon::config_file],
+  }
+
+  Package[ 'tor' ] {
+    require => File[$tor::daemon::data_dir],
+  }
+
+  group { 'debian-tor':
+    ensure    => present,
+    allowdupe => false,
+  }
+
+  user { 'debian-tor':
+    ensure    => present,
+    allowdupe => false,
+    comment   => 'tor user,,,',
+    home      => $tor::daemon::data_dir,
+    shell     => '/bin/false',
+    gid       => 'debian-tor',
+    require   => Group['debian-tor'],
+  }
+
+  # directories
+  file { $tor::daemon::data_dir:
+    ensure  => directory,
+    mode    => '0700',
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    require => User['debian-tor'],
+  }
+
+  file { '/etc/tor':
+    ensure  => directory,
+    mode    => '0755',
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    require => User['debian-tor'],
+  }
+
+  file { '/var/lib/puppet/modules/tor':
+    ensure  => absent,
+    recurse => true,
+    force   => true,
+  }
+
+  # tor configuration file
+  concat { $tor::daemon::config_file:
+    mode   => '0600',
+    owner  => 'debian-tor',
+    group  => 'debian-tor',
+  }
+
+  # config file headers
+  concat::fragment { '00.header':
+    ensure  => present,
+    content => template('tor/torrc.header.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 00,
+    target  => $tor::daemon::config_file,
+  }
+
+  # global configurations
+  concat::fragment { '01.global':
+    content => template('tor/torrc.global.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 01,
+    target  => $tor::daemon::config_file,
+  }
+}
diff --git a/puppet/modules/tor/manifests/daemon/bridge.pp b/puppet/modules/tor/manifests/daemon/bridge.pp
new file mode 100644
index 00000000..063f5656
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/bridge.pp
@@ -0,0 +1,18 @@
+# Bridge definition
+define tor::daemon::bridge(
+  $ip,
+  $port,
+  $fingerprint = false,
+  $ensure      = present ) {
+
+  concat::fragment { "10.bridge.${name}":
+    ensure  => $ensure,
+    content => template('tor/torrc.bridge.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 10,
+    target  => $tor::daemon::config_file,
+  }
+}
+
diff --git a/puppet/modules/tor/manifests/daemon/control.pp b/puppet/modules/tor/manifests/daemon/control.pp
new file mode 100644
index 00000000..01726562
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/control.pp
@@ -0,0 +1,27 @@
+# control definition
+define tor::daemon::control(
+  $port                            = 0,
+  $hashed_control_password         = '',
+  $cookie_authentication           = 0,
+  $cookie_auth_file                = '',
+  $cookie_auth_file_group_readable = '',
+  $ensure                          = present ) {
+
+  if $cookie_authentication == '0' and $hashed_control_password == '' and $ensure != 'absent' {
+    fail('You need to define the tor control password')
+  }
+
+  if $cookie_authentication == 0 and ($cookie_auth_file != '' or $cookie_auth_file_group_readable != '') {
+    notice('You set a tor cookie authentication option, but do not have cookie_authentication on')
+  }
+
+  concat::fragment { '04.control':
+    ensure  => $ensure,
+    content => template('tor/torrc.control.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0600',
+    order   => 04,
+    target  => $tor::daemon::config_file,
+  }
+}
diff --git a/puppet/modules/tor/manifests/daemon/directory.pp b/puppet/modules/tor/manifests/daemon/directory.pp
new file mode 100644
index 00000000..d877a861
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/directory.pp
@@ -0,0 +1,27 @@
+# directory advertising
+define tor::daemon::directory (
+  $port             = 0,
+  $listen_addresses = [],
+  $port_front_page  = '/etc/tor/tor-exit-notice.html',
+  $ensure           = present ) {
+
+  concat::fragment { '06.directory':
+    ensure  => $ensure,
+    content => template('tor/torrc.directory.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 06,
+    target  => $tor::daemon::config_file,
+  }
+
+  file { '/etc/tor/tor-exit-notice.html':
+    ensure  => $ensure,
+    source  => 'puppet:///modules/tor/tor-exit-notice.html',
+    require => File['/etc/tor'],
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+  }
+}
+
diff --git a/puppet/modules/tor/manifests/daemon/dns.pp b/puppet/modules/tor/manifests/daemon/dns.pp
new file mode 100644
index 00000000..4677f24d
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/dns.pp
@@ -0,0 +1,17 @@
+# DNS definition
+define tor::daemon::dns(
+  $port             = 0,
+  $listen_addresses = [],
+  $ensure           = present ) {
+
+  concat::fragment { "08.dns.${name}":
+    ensure  => $ensure,
+    content => template('tor/torrc.dns.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => '08',
+    target  => $tor::daemon::config_file,
+  }
+}
+
diff --git a/puppet/modules/tor/manifests/daemon/exit_policy.pp b/puppet/modules/tor/manifests/daemon/exit_policy.pp
new file mode 100644
index 00000000..f459ece7
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/exit_policy.pp
@@ -0,0 +1,18 @@
+# exit policies
+define tor::daemon::exit_policy(
+  $accept         = [],
+  $reject         = [],
+  $reject_private = 1,
+  $ensure         = present ) {
+
+  concat::fragment { "07.exit_policy.${name}":
+    ensure  => $ensure,
+    content => template('tor/torrc.exit_policy.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 07,
+    target  => $tor::daemon::config_file,
+  }
+}
+
diff --git a/puppet/modules/tor/manifests/daemon/hidden_service.pp b/puppet/modules/tor/manifests/daemon/hidden_service.pp
new file mode 100644
index 00000000..c8272116
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/hidden_service.pp
@@ -0,0 +1,17 @@
+# hidden services definition
+define tor::daemon::hidden_service(
+  $ports    = [],
+  $data_dir = $tor::daemon::data_dir,
+  $ensure   = present ) {
+
+  concat::fragment { "05.hidden_service.${name}":
+    ensure  => $ensure,
+    content => template('tor/torrc.hidden_service.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 05,
+    target  => $tor::daemon::config_file,
+  }
+}
+
diff --git a/puppet/modules/tor/manifests/daemon/map_address.pp b/puppet/modules/tor/manifests/daemon/map_address.pp
new file mode 100644
index 00000000..270eac21
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/map_address.pp
@@ -0,0 +1,17 @@
+# map address definition
+define tor::daemon::map_address(
+  $address    = '',
+  $newaddress = '',
+  $ensure     = 'present') {
+
+  concat::fragment { "08.map_address.${name}":
+    ensure  => $ensure,
+    content => template('tor/torrc.map_address.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => '08',
+    target  => $tor::daemon::config_file,
+  }
+}
+
diff --git a/puppet/modules/tor/manifests/daemon/relay.pp b/puppet/modules/tor/manifests/daemon/relay.pp
new file mode 100644
index 00000000..ff528937
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/relay.pp
@@ -0,0 +1,42 @@
+# relay definition
+define tor::daemon::relay(
+  $port                    = 0,
+  $listen_addresses        = [],
+  $outbound_bindaddresses  = [],
+  $portforwarding          = 0,
+  # KB/s, defaulting to using tor's default: 5120KB/s
+  $bandwidth_rate          = '',
+  # KB/s, defaulting to using tor's default: 10240KB/s
+  $bandwidth_burst         = '',
+  # KB/s, 0 for no limit
+  $relay_bandwidth_rate    = 0,
+  # KB/s, 0 for no limit
+  $relay_bandwidth_burst   = 0,
+  # GB, 0 for no limit
+  $accounting_max          = 0,
+  $accounting_start        = [],
+  $contact_info            = '',
+  # TODO: autofill with other relays
+  $my_family               = '',
+  $address                 = "tor.${::domain}",
+  $bridge_relay            = 0,
+  $ensure                  = present ) {
+
+  $nickname = $name
+
+  if $outbound_bindaddresses == [] {
+    $real_outbound_bindaddresses = []
+  } else {
+    $real_outbound_bindaddresses = $outbound_bindaddresses
+  }
+
+  concat::fragment { '03.relay':
+    ensure  => $ensure,
+    content => template('tor/torrc.relay.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 03,
+    target  => $tor::daemon::config_file,
+  }
+}
diff --git a/puppet/modules/tor/manifests/daemon/snippet.pp b/puppet/modules/tor/manifests/daemon/snippet.pp
new file mode 100644
index 00000000..b9089b40
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/snippet.pp
@@ -0,0 +1,16 @@
+# Arbitrary torrc snippet definition
+define tor::daemon::snippet(
+  $content = '',
+  $ensure  = present ) {
+
+  concat::fragment { "99.snippet.${name}":
+    ensure  => $ensure,
+    content => $content,
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 99,
+    target  => $tor::daemon::config_file,
+  }
+}
+
diff --git a/puppet/modules/tor/manifests/daemon/socks.pp b/puppet/modules/tor/manifests/daemon/socks.pp
new file mode 100644
index 00000000..910461c9
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/socks.pp
@@ -0,0 +1,15 @@
+# socks definition
+define tor::daemon::socks(
+  $port = 0,
+  $listen_addresses = [],
+  $policies = [] ) {
+
+  concat::fragment { '02.socks':
+    content => template('tor/torrc.socks.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => 02,
+    target  => $tor::daemon::config_file,
+  }
+}
diff --git a/puppet/modules/tor/manifests/daemon/transparent.pp b/puppet/modules/tor/manifests/daemon/transparent.pp
new file mode 100644
index 00000000..65d744f4
--- /dev/null
+++ b/puppet/modules/tor/manifests/daemon/transparent.pp
@@ -0,0 +1,17 @@
+# Transparent proxy definition
+define tor::daemon::transparent(
+  $port             = 0,
+  $listen_addresses = [],
+  $ensure           = present ) {
+
+  concat::fragment { "09.transparent.${name}":
+    ensure  => $ensure,
+    content => template('tor/torrc.transparent.erb'),
+    owner   => 'debian-tor',
+    group   => 'debian-tor',
+    mode    => '0644',
+    order   => '09',
+    target  => $tor::daemon::config_file,
+  }
+}
+
diff --git a/puppet/modules/tor/manifests/init.pp b/puppet/modules/tor/manifests/init.pp
new file mode 100644
index 00000000..9c19c648
--- /dev/null
+++ b/puppet/modules/tor/manifests/init.pp
@@ -0,0 +1,6 @@
+# manage a basic tor installation
+class tor (
+  $ensure_version = 'installed'
+){
+  include tor::base
+}
diff --git a/puppet/modules/tor/manifests/munin.pp b/puppet/modules/tor/manifests/munin.pp
new file mode 100644
index 00000000..4412337a
--- /dev/null
+++ b/puppet/modules/tor/manifests/munin.pp
@@ -0,0 +1,21 @@
+# munin plugins for puppet
+class tor::munin {
+  tor::daemon::control{
+    'control_port_for_munin':
+      port                  => 19051,
+      cookie_authentication => 1,
+      cookie_auth_file      => '/var/run/tor/control.authcookie',
+  }
+
+  Munin::Plugin::Deploy {
+    config  => "user debian-tor\n env.cookiefile /var/run/tor/control.authcookie\n env.port 19051"
+  }
+  munin::plugin::deploy {
+    'tor_connections':
+      source => 'tor/munin/tor_connections';
+    'tor_routers':
+      source => 'tor/munin/tor_routers';
+    'tor_traffic':
+      source => 'tor/munin/tor_traffic';
+  }
+}
diff --git a/puppet/modules/tor/manifests/polipo.pp b/puppet/modules/tor/manifests/polipo.pp
new file mode 100644
index 00000000..73dc2262
--- /dev/null
+++ b/puppet/modules/tor/manifests/polipo.pp
@@ -0,0 +1,9 @@
+# manage the polipo proxy service
+class tor::polipo {
+  include ::tor
+
+  case $::operatingsystem {
+    'debian': { include tor::polipo::debian }
+    default:  { include tor::polipo::base   }
+  }
+}
diff --git a/puppet/modules/tor/manifests/polipo/base.pp b/puppet/modules/tor/manifests/polipo/base.pp
new file mode 100644
index 00000000..df2d6ea6
--- /dev/null
+++ b/puppet/modules/tor/manifests/polipo/base.pp
@@ -0,0 +1,22 @@
+# manage polipo resources
+class tor::polipo::base {
+  package{'polipo':
+    ensure => present,
+  }
+
+  file { '/etc/polipo/config':
+    ensure  => present,
+    owner   => root,
+    group   => root,
+    mode    => '0644',
+    source  => 'puppet:///modules/tor/polipo/polipo.conf',
+    require => Package['polipo'],
+    notify  => Service['polipo'],
+  }
+
+  service { 'polipo':
+    ensure  => running,
+    enable  => true,
+    require => [ Package['polipo'], Service['tor'] ],
+  }
+}
diff --git a/puppet/modules/tor/manifests/polipo/debian.pp b/puppet/modules/tor/manifests/polipo/debian.pp
new file mode 100644
index 00000000..607b3617
--- /dev/null
+++ b/puppet/modules/tor/manifests/polipo/debian.pp
@@ -0,0 +1,7 @@
+# manage polipo on debian
+class tor::polipo::debian inherits tor::polipo::base {
+  Service['polipo'] {
+    hasstatus => false,
+    pattern   => '/usr/bin/polipo',
+  }
+}
diff --git a/puppet/modules/tor/manifests/repo.pp b/puppet/modules/tor/manifests/repo.pp
new file mode 100644
index 00000000..f6255995
--- /dev/null
+++ b/puppet/modules/tor/manifests/repo.pp
@@ -0,0 +1,16 @@
+class tor::repo (
+  $ensure      = present,
+  $source_name = 'torproject.org',
+  $include_src = false,
+) {
+  case $::osfamily {
+    'Debian': {
+      $key      = '886DDD89'
+      $location = 'https://deb.torproject.org/torproject.org/'
+      class { 'tor::repo::debian': }
+    }
+    default: {
+      fail("Unsupported managed repository for osfamily: ${::osfamily}, operatingsystem: ${::operatingsystem}, module ${module_name} currently only supports managing repos for osfamily Debian and Ubuntu")
+    }
+  }
+}
diff --git a/puppet/modules/tor/manifests/repo/debian.pp b/puppet/modules/tor/manifests/repo/debian.pp
new file mode 100644
index 00000000..174c3310
--- /dev/null
+++ b/puppet/modules/tor/manifests/repo/debian.pp
@@ -0,0 +1,9 @@
+# PRIVATE CLASS: do not use directly
+class tor::repo::debian inherits tor::repo {
+  apt::source { $source_name:
+    ensure      => $::tor::repo::ensure,
+    location    => $::tor::repo::location,
+    key         => $::tor::repo::key,
+    include_src => $::tor::repo::include_src,
+  }
+}
diff --git a/puppet/modules/tor/manifests/torsocks.pp b/puppet/modules/tor/manifests/torsocks.pp
new file mode 100644
index 00000000..e9fc75b2
--- /dev/null
+++ b/puppet/modules/tor/manifests/torsocks.pp
@@ -0,0 +1,9 @@
+# manage torsocks
+class tor::torsocks (
+  $ensure_version = 'installed'
+){
+  include ::tor
+  package{'torsocks':
+    ensure => $ensure_version,
+  }
+}
diff --git a/puppet/modules/tor/templates/torrc.bridge.erb b/puppet/modules/tor/templates/torrc.bridge.erb
new file mode 100644
index 00000000..559ce5df
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.bridge.erb
@@ -0,0 +1,3 @@
+# Bridge <%= @name %>
+Bridge <%= @ip %>:<%= @port %><% if @fingerprint -%> <%= @fingerprint%><% end -%>
+
diff --git a/puppet/modules/tor/templates/torrc.control.erb b/puppet/modules/tor/templates/torrc.control.erb
new file mode 100644
index 00000000..0b68faff
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.control.erb
@@ -0,0 +1,16 @@
+# tor controller
+<%  if @port != '0' -%>
+ControlPort <%= @port %>
+<%    if @cookie_authentication != '0' -%>
+CookieAuthentication 1
+<%      if @cookie_auth_file != '' -%>
+CookieAuthFile <%= @cookie_auth_file %>
+<%      end -%>
+<%      if @cookie_auth_file_group_readable != '' -%>
+CookieAuthFileGroupReadable <%= @cookie_auth_file_group_readable %>
+<%      end -%>
+<%    else -%>
+HashedControlPassword <%= @hashed_control_password %>
+<%    end -%>
+<%  end -%>
+
diff --git a/puppet/modules/tor/templates/torrc.directory.erb b/puppet/modules/tor/templates/torrc.directory.erb
new file mode 100644
index 00000000..1af9f40f
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.directory.erb
@@ -0,0 +1,11 @@
+# directory listing
+<%  if port != '0' -%>
+DirPort <%= @port %>
+<%  end -%>
+<%  listen_addresses.each do |listen_address| -%>
+DirListenAddress <%= listen_address %>
+<%  end -%>
+<%  if @port_front_page != '' -%>
+DirPortFrontPage <%= port_front_page %>
+<%- end -%>
+
diff --git a/puppet/modules/tor/templates/torrc.dns.erb b/puppet/modules/tor/templates/torrc.dns.erb
new file mode 100644
index 00000000..57cf46d9
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.dns.erb
@@ -0,0 +1,5 @@
+# DNS
+DNSPort <%= @port %>
+<% @listen_addresses.each do |listen_address|  -%>
+DNSListenAddress <%= listen_address %>
+<% end -%>
diff --git a/puppet/modules/tor/templates/torrc.exit_policy.erb b/puppet/modules/tor/templates/torrc.exit_policy.erb
new file mode 100644
index 00000000..a30d43b8
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.exit_policy.erb
@@ -0,0 +1,11 @@
+# exit policies: <%= @name %>
+<% if @reject_private != '1' -%>
+ExitPolicyRejectPrivate <%= @reject_private %>
+<% end -%>
+<% @accept.each do |policy| -%>
+ExitPolicy accept <%= policy %>
+<% end -%>
+<% @reject.each do |policy| -%>
+ExitPolicy reject <%= policy %>
+<% end -%>
+
diff --git a/puppet/modules/tor/templates/torrc.global.erb b/puppet/modules/tor/templates/torrc.global.erb
new file mode 100644
index 00000000..f577673d
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.global.erb
@@ -0,0 +1,24 @@
+# runtime
+RunAsDaemon 1
+<%  if (v=scope.lookupvar('tor::daemon::data_dir')) != '/var/lib/tor' -%>
+DataDirectory <%= v %>
+<% end -%>
+
+# log
+<% if (rules=scope.lookupvar('tor::daemon::log_rules')).empty? -%>
+Log notice syslog
+<%  else -%>
+<%   rules.each do |log_rule| -%>
+Log <%= log_rule %>
+<%    end -%>
+<%  end -%>
+<%- if @safe_logging != 1 then -%>
+SafeLogging <%= @safe_logging %>
+<%-   end -%>
+
+<%  if (v=scope.lookupvar('tor::daemon::automap_hosts_on_resolve')) != '0' -%>
+AutomapHostsOnResolve <%= v %>
+<%  end -%>
+<%  if (v=scope.lookupvar('tor::daemon::use_bridges')) != '0' -%>
+UseBridges <%= v %>
+<%- end -%>
diff --git a/puppet/modules/tor/templates/torrc.header.erb b/puppet/modules/tor/templates/torrc.header.erb
new file mode 100644
index 00000000..79d6da9d
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.header.erb
@@ -0,0 +1,2 @@
+# This file is managed by puppet.
+
diff --git a/puppet/modules/tor/templates/torrc.hidden_service.erb b/puppet/modules/tor/templates/torrc.hidden_service.erb
new file mode 100644
index 00000000..4dec0b25
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.hidden_service.erb
@@ -0,0 +1,6 @@
+# hidden service <%= @name %>
+HiddenServiceDir <%= @data_dir %>/<%= @name %>
+<% @ports.each do |port| -%>
+HiddenServicePort <%= port %>
+<% end -%>
+
diff --git a/puppet/modules/tor/templates/torrc.map_address.erb b/puppet/modules/tor/templates/torrc.map_address.erb
new file mode 100644
index 00000000..ef4f2683
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.map_address.erb
@@ -0,0 +1,3 @@
+# map address <%= @name %>
+MapAddress <%= @address %> <%= @newaddress %>
+
diff --git a/puppet/modules/tor/templates/torrc.relay.erb b/puppet/modules/tor/templates/torrc.relay.erb
new file mode 100644
index 00000000..a286459f
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.relay.erb
@@ -0,0 +1,46 @@
+# relay
+<% if @port != 0 -%>
+ORPort <%= @port %>
+<%   @listen_addresses.each do |listen_address| -%>
+ORListenAddress <%= @listen_address %>
+<%   end -%>
+<%   @real_outbound_bindaddresses.each do |outbound_bindaddress| -%>
+OutboundBindAddress <%= @outbound_bindaddress %>
+<%   end -%>
+<%   if @nickname != '' -%>
+Nickname <%= @nickname %>
+<%   end -%>
+<%   if @address != '' -%>
+Address <%= @address %>
+<%   end -%>
+<%   if @portforwarding != '0' -%>
+PortForwarding <%= @portforwarding %>
+<%   end -%>
+<%   if @bandwidth_rate != '' -%>
+BandwidthRate <%= @bandwidth_rate %> KB
+<%   end -%>
+<%   if @bandwidth_burst != '' -%>
+BandwidthBurst <%= @bandwidth_burst %> KB
+<%   end -%>
+<%   if @relay_bandwidth_rate != '0' -%>
+RelayBandwidthRate <%= @relay_bandwidth_rate %> KB
+<%   end -%>
+<%   if @relay_bandwidth_burst != '0' -%>
+RelayBandwidthBurst <%= @relay_bandwidth_burst %> KB
+<%   end -%>
+<%   if @accounting_max != '0' -%>
+AccountingMax <%= @accounting_max %> GB
+<%     if @accounting_start -%>
+AccountingStart <%= @accounting_start %>
+<%     end -%>
+<%   end -%>
+<%   if @contact_info != '' -%>
+ContactInfo <%= @contact_info %>
+<%   end -%>
+<% end -%>
+<% if @my_family != '' -%>
+MyFamily <%= @my_family %>
+<% end -%>
+<% if @bridge_relay != '0' -%>
+BridgeRelay <%= @bridge_relay %>
+<% end -%>
diff --git a/puppet/modules/tor/templates/torrc.socks.erb b/puppet/modules/tor/templates/torrc.socks.erb
new file mode 100644
index 00000000..4bc3ddc1
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.socks.erb
@@ -0,0 +1,9 @@
+# socks
+SocksPort <%= @port %>
+<% @listen_addresses.each do |listen_address| -%>
+SocksListenAddress <%= listen_address %>
+<% end -%>
+<% @policies.each do |policy| -%>
+SocksPolicy <%= policy %>
+<% end -%>
+
diff --git a/puppet/modules/tor/templates/torrc.transparent.erb b/puppet/modules/tor/templates/torrc.transparent.erb
new file mode 100644
index 00000000..c683150f
--- /dev/null
+++ b/puppet/modules/tor/templates/torrc.transparent.erb
@@ -0,0 +1,5 @@
+# Transparent proxy
+TransPort <%= @port %>
+<% @listen_addresses.each do |listen_address| -%>
+TransListenAddress <%= listen_address %>
+<% end -%>
-- 
cgit v1.2.3


From 04279dd8d1390d61d696d2c14817199304ccd4d8 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:21 -0400
Subject: git subrepo clone https://leap.se/git/puppet_stunnel
 puppet/modules/stunnel

subrepo:
  subdir:   "puppet/modules/stunnel"
  merged:   "523612f"
upstream:
  origin:   "https://leap.se/git/puppet_stunnel"
  branch:   "master"
  commit:   "523612f"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: If384c84c99d9cabc67d2b4b9d7d2fbfa4a47550a
---
 puppet/modules/stunnel/.gitrepo                    |  11 +
 puppet/modules/stunnel/LICENSE                     | 674 +++++++++++++++++++++
 puppet/modules/stunnel/README                      |  77 +++
 puppet/modules/stunnel/files/CentOS/stunnel.init   | 143 +++++
 puppet/modules/stunnel/manifests/base.pp           |  13 +
 puppet/modules/stunnel/manifests/centos.pp         |  35 ++
 puppet/modules/stunnel/manifests/debian.pp         |  23 +
 puppet/modules/stunnel/manifests/init.pp           |  65 ++
 puppet/modules/stunnel/manifests/linux.pp          |   6 +
 puppet/modules/stunnel/manifests/service.pp        |  79 +++
 puppet/modules/stunnel/manifests/service/nagios.pp |  12 +
 puppet/modules/stunnel/templates/Debian/default    |  13 +
 .../stunnel/templates/refresh_stunnel.sh.erb       |  22 +
 puppet/modules/stunnel/templates/service.conf.erb  |  47 ++
 14 files changed, 1220 insertions(+)
 create mode 100644 puppet/modules/stunnel/.gitrepo
 create mode 100644 puppet/modules/stunnel/LICENSE
 create mode 100644 puppet/modules/stunnel/README
 create mode 100644 puppet/modules/stunnel/files/CentOS/stunnel.init
 create mode 100644 puppet/modules/stunnel/manifests/base.pp
 create mode 100644 puppet/modules/stunnel/manifests/centos.pp
 create mode 100644 puppet/modules/stunnel/manifests/debian.pp
 create mode 100644 puppet/modules/stunnel/manifests/init.pp
 create mode 100644 puppet/modules/stunnel/manifests/linux.pp
 create mode 100644 puppet/modules/stunnel/manifests/service.pp
 create mode 100644 puppet/modules/stunnel/manifests/service/nagios.pp
 create mode 100644 puppet/modules/stunnel/templates/Debian/default
 create mode 100644 puppet/modules/stunnel/templates/refresh_stunnel.sh.erb
 create mode 100644 puppet/modules/stunnel/templates/service.conf.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/stunnel/.gitrepo b/puppet/modules/stunnel/.gitrepo
new file mode 100644
index 00000000..d7540f10
--- /dev/null
+++ b/puppet/modules/stunnel/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_stunnel
+	branch = master
+	commit = 523612fb6daff51837423619f5014e62dc835559
+	parent = 297fadc8e6ad4729589d4ec21683f05a1e50bdf9
+	cmdver = 0.3.0
diff --git a/puppet/modules/stunnel/LICENSE b/puppet/modules/stunnel/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/stunnel/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/stunnel/README b/puppet/modules/stunnel/README
new file mode 100644
index 00000000..b6a3124c
--- /dev/null
+++ b/puppet/modules/stunnel/README
@@ -0,0 +1,77 @@
+Overview
+========
+
+This module manages stunnel4. It installs and configures the software, makes
+sure it is running, and enables you to create different stunnels.
+
+
+! Upgrade Notice !
+==================
+
+Previous versions of this module were not using parameterized classes. If you
+were using a previous version, you may need to change how you are using the
+module to accomodate for that. If you were previously setting some stunnel
+variables before including the class, you will now need to pass those variables
+to the class as parameters. If you were just simply doing 'include stunnel',
+then you will not need to change anything.
+
+Classes
+=======
+
+stunnel
+-------
+
+This is the main class which brings you stunnel support. You will need to
+instantiate it by doing the following:
+
+class { 'stunnel': }
+
+Class parameters:
+
+* ensure_version - If this parameter is passed, you can force a particular
+  version of stunnel to be installed, if it is available with your packaging
+  system, for example:
+
+  class { 'stunnel': ensure_version = '3:4.53-1' }
+  
+  If you do not pass this parameter, it will default to just be 'present'.
+
+* startboot (Debian) - This parameter controls if stunnel should be started at
+  boot or not, if you do not pass this paramter, by default it will be started
+
+* default_extra (Debian) - This parameter lets you add arbitrary extra text to
+  the bottom of /etc/default/stunnel4, this can be useful to set ulimit for
+  example
+
+
+Defines
+=======
+
+stunnel::service
+----------------
+
+This define lets you setup any number of stunnels, it allows you to pass every
+stunnel configuration variable (see manifests/server.pp) which will be used to
+create the /etc/stunnel/${name}.conf file, and then notify the stunnel service
+so it will restart.
+
+If you pass $manage_nagios to this define, it will create a nagios::service
+entry for stunnel_${name} which will watch for the appropriate number processes
+with that configuration name
+
+Note that if you need to use some specific logic to decide whether or not to
+create a nagios service check, you should set $manage_nagios to false, and
+use stunnel::service::nagios from within your own manifests.
+
+stunnel::service::nagios
+------------------------
+
+This define creates a nagios service check for a specific tunnel. The resource
+name should be the name of the tunnel's configuration file without the '.conf'
+suffix. For example:
+
+    stunnel::service::nagios { 'carpal': }
+
+The above example would verify that the tunnel defined in
+`/etc/stunnel/carpal.conf'.
+
diff --git a/puppet/modules/stunnel/files/CentOS/stunnel.init b/puppet/modules/stunnel/files/CentOS/stunnel.init
new file mode 100644
index 00000000..d5c60fd8
--- /dev/null
+++ b/puppet/modules/stunnel/files/CentOS/stunnel.init
@@ -0,0 +1,143 @@
+#!/bin/bash
+#
+# Script to run stunnel in daemon mode at boot time.
+#
+# Check http://www.gaztronics.net/ for the
+# most up-to-date version of this script.
+#
+# This script is realeased under the terms of the GPL.
+# You can source a copy at:
+# http://www.fsf.org/copyleft/copyleft.html
+#
+# Please feel free to modify the script to suite your own needs.
+# I always welcome email feedback with suggestions for improvements.
+# Please do not email for general support. I do not have time to answer
+# personal help requests.
+
+# Author: Gary Myers MIIE MBCS
+# email: http://www.gaztronics.net/webform/
+# Revision 1.0  -  4th March 2005
+
+#====================================================================
+# Run level information:
+#
+# chkconfig: 2345 99 99
+# description: Secure Tunnel
+# processname: stunnel
+#
+# Run "/sbin/chkconfig --add stunnel" to add the Run levels.
+# This will setup the symlinks and set the process to run at boot.
+#====================================================================
+
+#====================================================================
+# Paths and variables and system checks.
+
+# Source function library (It's a Red Hat thing!)
+. /etc/rc.d/init.d/functions
+
+# Check that networking is up.
+#
+[ ${NETWORKING} ="yes" ] || exit 0
+
+# Path to the executable.
+#
+SEXE=/usr/sbin/stunnel
+
+# Path to the configuration file.
+#
+CONF=/etc/stunnel/stunnel.conf
+
+# Check the configuration file exists.
+#
+if [ ! -f $CONF ] ; then
+  echo "The configuration file cannot be found!"
+exit 0
+fi
+
+CHROOT=`grep '^chroot' /etc/stunnel/stunnel.conf | head -n 1 | sed 's/ //g' | awk -F= '{ print $2 }'`
+PIDFILE=`grep '^pid' /etc/stunnel/stunnel.conf | head -n 1 | sed 's/ //g' | awk -F= '{ print $2 }'` 
+if [ -n "$CHROOT" ]; then
+    PIDFILE=$CHROOT/$PIDFILE
+fi
+
+# Path to the lock file.
+#
+LOCK_FILE=/var/lock/subsys/stunnel
+
+#====================================================================
+
+#====================================================================
+# Run controls:
+
+prog=$"stunnel"
+
+RETVAL=0
+
+# Start stunnel as daemon.
+#
+start() {
+  if [ -f $LOCK_FILE ]; then
+    echo "stunnel is already running!"
+    exit 0
+  else
+    echo -n $"Starting $prog: "
+    $SEXE $CONF
+  fi
+
+  RETVAL=$?
+  [ $RETVAL -eq 0 ] && success 
+  echo
+  [ $RETVAL -eq 0 ] && touch $LOCK_FILE
+  return $RETVAL
+}
+
+
+# Stop stunnel.
+#
+stop() {
+  if [ ! -f $LOCK_FILE ]; then
+    echo "stunnel is not running!"
+    exit 0
+
+  else
+
+    echo -n $"Shutting down $prog: "
+    killproc -p $PIDFILE stunnel
+    RETVAL=$?
+    [ $RETVAL -eq 0 ]
+     rm -f $LOCK_FILE
+    echo
+    return $RETVAL
+
+  fi
+}
+
+# See how we were called.
+case "$1" in
+   start)
+  start
+  ;;
+   stop)
+  stop
+  ;;
+   restart)
+  stop
+  start
+  ;;
+   condrestart)
+  if [ -f $LOCK_FILE ]; then
+     stop
+     start
+     RETVAL=$?
+  fi
+  ;;
+   status)
+  status -p $PIDFILE stunnel
+  RETVAL=$?
+  ;;
+   *)
+    echo $"Usage: $0 {start|stop|restart|condrestart|status}"
+    RETVAL=1
+esac
+
+exit $RETVAL
diff --git a/puppet/modules/stunnel/manifests/base.pp b/puppet/modules/stunnel/manifests/base.pp
new file mode 100644
index 00000000..9fed2de7
--- /dev/null
+++ b/puppet/modules/stunnel/manifests/base.pp
@@ -0,0 +1,13 @@
+class stunnel::base {
+
+  file { '/etc/stunnel':
+    ensure => directory;
+  }
+
+  service { 'stunnel':
+    ensure    => running,
+    name      => 'stunnel',
+    enable    => true,
+    hasstatus => false;
+  }
+}
diff --git a/puppet/modules/stunnel/manifests/centos.pp b/puppet/modules/stunnel/manifests/centos.pp
new file mode 100644
index 00000000..3b0a6e2a
--- /dev/null
+++ b/puppet/modules/stunnel/manifests/centos.pp
@@ -0,0 +1,35 @@
+class stunnel::centos inherits stunnel::linux {
+
+  file { '/etc/init.d/stunnel':
+    source  => "puppet:///modules/stunnel/${::operatingsystem}/stunnel.init",
+    require => Package['stunnel'],
+    before  => Service['stunnel'],
+    owner   => root,
+    group   => 0,
+    mode    => '0755';
+  }
+
+  user::managed { 'stunnel':
+    homedir => '/var/run/stunnel',
+    shell   => '/sbin/nologin',
+    uid     => 105,
+    gid     => 105;
+  }
+
+  Service['stunnel']{
+    hasstatus => true,
+    require   => [ User['stunnel'], File['/etc/init.d/stunnel'] ]
+  }
+
+  file { '/etc/stunnel/stunnel.conf':
+    source  => [ "puppet:///modules/site-stunnel/${::fqdn}/stunnel.conf",
+                 "puppet:///modules/site-stunnel/${stunnel::cluster}/stunnel.conf",
+                 'puppet:///modules/site-stunnel/stunnel.conf',
+                 "puppet:///modules/stunnel/${::operatingsystem}/stunnel.conf" ],
+    require => Package['stunnel'],
+    notify  => Service['stunnel'],
+    owner   => root,
+    group   => 0,
+    mode    => '0600';
+  }
+}
diff --git a/puppet/modules/stunnel/manifests/debian.pp b/puppet/modules/stunnel/manifests/debian.pp
new file mode 100644
index 00000000..1135b98d
--- /dev/null
+++ b/puppet/modules/stunnel/manifests/debian.pp
@@ -0,0 +1,23 @@
+class stunnel::debian inherits stunnel::linux {
+
+  Package['stunnel'] {
+    name => 'stunnel4',
+  }
+
+  Service['stunnel'] {
+    name      => 'stunnel4',
+    pattern   => '/usr/bin/stunnel4',
+    subscribe => File['/etc/default/stunnel4'],
+    require   => Package['stunnel4']
+  }
+
+  file { '/etc/default/stunnel4':
+    content => template('stunnel/Debian/default'),
+    before  => Package['stunnel4'],
+    notify  => Service['stunnel4'],
+    owner   => root,
+    group   => 0,
+    mode    => '0644';
+  }
+}
+
diff --git a/puppet/modules/stunnel/manifests/init.pp b/puppet/modules/stunnel/manifests/init.pp
new file mode 100644
index 00000000..544ac04e
--- /dev/null
+++ b/puppet/modules/stunnel/manifests/init.pp
@@ -0,0 +1,65 @@
+#
+# stunnel puppet module
+#
+# Copyright 2009, Riseup Networks <micah@riseup.net>
+#
+#
+# This program is free software; you can redistribute
+# it and/or modify it under the terms of the GNU
+# General Public License version 3 as published by
+# the Free Software Foundation.
+#
+# 1. include stunnel: this will automatically include stunnel::debian,
+#    which automatically includes stunnel::linux, which automatically
+#    includes stunnel::base
+# 2. stunnel::client allows you to configure different /etc/stunnel/*.conf files
+#    to provide various stunnel configurations
+
+# TODO: warn on cert/key issues, fail on false accept?
+
+class stunnel (
+  $ensure_version = 'present',
+  $startboot      = '1',
+  $default_extra  = '',
+  $cluster        = '' )
+{
+
+  case $::operatingsystem {
+    debian: { class { 'stunnel::debian': } }
+    centos: { class {  'stunnel::centos': } }
+    default: { class { 'stunnel::default': } }
+  }
+
+  $stunnel_staging = "${::puppet_vardir}/stunnel4"
+  $stunnel_compdir = "${stunnel_staging}/configs"
+
+  file {
+    [ $stunnel_staging, "${stunnel_staging}/bin" ]:
+      ensure => directory,
+      owner  => 0,
+      group  => 0,
+      mode   => '0750';
+
+    "${stunnel_staging}/configs":
+      ensure  => directory,
+      owner   => 0,
+      group   => 0,
+      mode    => '0750',
+      recurse => true,
+      purge   => true,
+      force   => true,
+      source  => undef,
+      notify  => Exec['refresh_stunnel'];
+
+    "${stunnel_staging}/bin/refresh_stunnel.sh":
+      owner   => 0,
+      group   => 0,
+      mode    => '0755',
+      content => template('stunnel/refresh_stunnel.sh.erb');
+  }
+
+  exec { 'refresh_stunnel':
+    command => "${stunnel_staging}/bin/refresh_stunnel.sh",
+    require => [ Package['stunnel4'], File['/etc/default/stunnel4'] ]
+  }
+}
diff --git a/puppet/modules/stunnel/manifests/linux.pp b/puppet/modules/stunnel/manifests/linux.pp
new file mode 100644
index 00000000..a4a926e4
--- /dev/null
+++ b/puppet/modules/stunnel/manifests/linux.pp
@@ -0,0 +1,6 @@
+class stunnel::linux inherits stunnel::base {
+
+  package { 'stunnel':
+    ensure => $stunnel::ensure_version
+  }
+}
diff --git a/puppet/modules/stunnel/manifests/service.pp b/puppet/modules/stunnel/manifests/service.pp
new file mode 100644
index 00000000..8a98d8ff
--- /dev/null
+++ b/puppet/modules/stunnel/manifests/service.pp
@@ -0,0 +1,79 @@
+define stunnel::service (
+  $ensure = present,
+  $accept = false,
+  $capath = false,
+  $cafile = false,
+  $cert = false,
+  $chroot = false,
+  $ciphers = false,
+  $client = false,
+  $compress = false,
+  $connect = false,
+  $crlpath = false,
+  $crlfile = false,
+  $debuglevel = false,
+  $delay = false,
+  $egd = false,
+  $engine = false,
+  $engineCtrl = false,
+  $enginenum = false,
+  $exec = false,
+  $execargs = false,
+  $failover = false,
+  $ident = false,
+  $key = false,
+  $local = false,
+  $oscp = false,
+  $ocspflag = false,
+  $options = false,
+  $output = false,
+  $pid = false,
+  $protocol = false,
+  $protocolauthentication = false,
+  $protocolhost = false,
+  $protocolpassword = false,
+  $protocolusername = false,
+  $pty = false,
+  $retry = false,
+  $rndbytes = false,
+  $rndfile = false,
+  $rndoverwrite = false,
+  $service = false,
+  $session = false,
+  $setuid = 'stunnel4',
+  $setgid = 'stunnel4',
+  $socket = [ 'l:TCP_NODELAY=1', 'r:TCP_NODELAY=1'],
+  $sslversion = 'SSLv3',
+  $stack = false,
+  $syslog = false,
+  $timeoutbusy = false,
+  $timeoutclose = false,
+  $timeoutconnect = false,
+  $timeoutidle = false,
+  $transparent = false,
+  $manage_nagios = false,
+  $verify = false
+) {
+
+  include stunnel
+
+  $real_client = $client ? { default => 'yes' }
+  $real_pid = $pid ? { false => "/${name}.pid", default => $pid }
+
+  $stunnel_compdir = "${::puppet_vardir}/stunnel4/configs"
+
+  file {
+    "${stunnel_compdir}/${name}.conf":
+      ensure  => $ensure,
+      content => template('stunnel/service.conf.erb'),
+      require => Package['stunnel'],
+      notify  => Exec['refresh_stunnel'],
+      owner   => 'root',
+      group   => 0,
+      mode    => '0600';
+  }
+
+  if $manage_nagios {
+    stunnel::service::nagios { $name: }
+  }
+}
diff --git a/puppet/modules/stunnel/manifests/service/nagios.pp b/puppet/modules/stunnel/manifests/service/nagios.pp
new file mode 100644
index 00000000..578b417e
--- /dev/null
+++ b/puppet/modules/stunnel/manifests/service/nagios.pp
@@ -0,0 +1,12 @@
+# Put a Nagios service check in place for a specific tunnel.
+#
+# The resource name will be used to point to the corresponding stunnel
+# configuration file.
+#
+define stunnel::service::nagios () {
+
+    nagios::service { "stunnel_${name}":
+      check_command => "nagios-stat-proc!/usr/bin/stunnel4 /etc/stunnel/${name}.conf!6!5!proc";
+    }
+
+}
diff --git a/puppet/modules/stunnel/templates/Debian/default b/puppet/modules/stunnel/templates/Debian/default
new file mode 100644
index 00000000..9e2f4d37
--- /dev/null
+++ b/puppet/modules/stunnel/templates/Debian/default
@@ -0,0 +1,13 @@
+# /etc/default/stunnel
+# Julien LEMOINE <speedblue@debian.org>
+# September 2003
+
+# Change to one to enable stunnel automatic startup
+ENABLED=<%= scope.lookupvar('stunnel::startboot') %>
+FILES="/etc/stunnel/*.conf"
+OPTIONS=""
+
+# Change to one to enable ppp restart scripts
+PPP_RESTART=0
+
+<%= scope.lookupvar('stunnel::default_extra') %>
diff --git a/puppet/modules/stunnel/templates/refresh_stunnel.sh.erb b/puppet/modules/stunnel/templates/refresh_stunnel.sh.erb
new file mode 100644
index 00000000..1af0cff7
--- /dev/null
+++ b/puppet/modules/stunnel/templates/refresh_stunnel.sh.erb
@@ -0,0 +1,22 @@
+#!/bin/sh -x
+
+for difference in `diff -q /etc/stunnel <%= @stunnel_staging %>/configs | grep differ | awk '{print $2}'`
+do 
+    old_config=`basename $difference`
+    /etc/init.d/stunnel4 stop $(basename $old_config .conf)
+    rm $difference
+done
+
+for only in `diff -q /etc/stunnel <%= @stunnel_staging %>/configs | grep 'Only in /etc/stunnel:' | awk '{print $4}'`
+do
+    old_config=`basename $only`
+    /etc/init.d/stunnel4 stop $(basename $only .conf)
+    rm /etc/stunnel/${only}
+done
+
+cp <%= @stunnel_staging %>/configs/*.conf /etc/stunnel
+
+/etc/init.d/stunnel4 start
+
+
+
diff --git a/puppet/modules/stunnel/templates/service.conf.erb b/puppet/modules/stunnel/templates/service.conf.erb
new file mode 100644
index 00000000..47f1c9d2
--- /dev/null
+++ b/puppet/modules/stunnel/templates/service.conf.erb
@@ -0,0 +1,47 @@
+; templated stunnel configuration file to be used by puppet stunnel module
+; NOTE: any changes you make to this file will be overwritten the next time 
+; puppet runs, please make configuration changes to this service in puppet
+
+; Global configuration options
+<%= 'debug = ' + @debuglevel %>
+<%= 'pid = ' + @real_pid %>
+<%- %w{chroot setuid setgid service compression}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + " = " + instance_variable_get("@#{v}").to_s %>
+<%-
+	end
+end -%>
+
+; Some performance tunings
+<% if @socket.is_a? String -%>
+<%= 'socket = ' + @socket %>
+<% elsif @socket.is_a? Array -%>
+<%= @socket.map { |i| "socket = #{i}" }. join("\n") %>
+<% end -%>
+
+<%- %w{output syslog}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + " = " + instance_variable_get("@#{v}").to_s %>
+<%-
+	end
+end -%>
+
+<%- %w{egd engine enginectrl rndbytes rndfile rndoverwrite}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + " = " + instance_variable_get("@#{v}").to_s %>
+<%-
+	end
+end -%>
+
+; Service-level configuration
+<%= '[' + @name + ']' %>
+<%- %w{accept connect capath cafile cert ciphers crlpath crlfile delay enginenum exec 
+       execargs failover ident key local oscp ocspflag options protocol protocolauthentication
+       protocolhost protocolpassword protocolusername pty retry session sslversion stack 
+       timeoutbusy timeoutclose timeoutconnect timeoutidle transparent verify}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + ' = ' + instance_variable_get("@#{v}").to_s %>
+<%-
+    end
+end -%>
+client = <%= @client ? 'yes' : 'no' %>
-- 
cgit v1.2.3


From a658f5c30ada5e03468257f90d08f6cd2ba25488 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:22 -0400
Subject: git subrepo clone https://leap.se/git/puppet_haproxy
 puppet/modules/haproxy

subrepo:
  subdir:   "puppet/modules/haproxy"
  merged:   "af322a7"
upstream:
  origin:   "https://leap.se/git/puppet_haproxy"
  branch:   "master"
  commit:   "af322a7"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Iabf2dd01dc00acd7d886420968bda9aab7190770
---
 puppet/modules/haproxy/.fixtures.yml               |   5 +
 puppet/modules/haproxy/.gemfile                    |   5 +
 puppet/modules/haproxy/.gitrepo                    |  11 ++
 puppet/modules/haproxy/.travis.yml                 |  23 ++++
 puppet/modules/haproxy/CHANGELOG                   |   5 +
 puppet/modules/haproxy/Modulefile                  |  12 ++
 puppet/modules/haproxy/README.md                   |  87 ++++++++++++
 puppet/modules/haproxy/Rakefile                    |   1 +
 puppet/modules/haproxy/manifests/balancermember.pp |  95 +++++++++++++
 puppet/modules/haproxy/manifests/init.pp           | 149 +++++++++++++++++++++
 puppet/modules/haproxy/manifests/listen.pp         |  95 +++++++++++++
 puppet/modules/haproxy/manifests/params.pp         |  65 +++++++++
 .../modules/haproxy/spec/classes/haproxy_spec.rb   | 138 +++++++++++++++++++
 .../haproxy/spec/defines/balancermember_spec.rb    |  82 ++++++++++++
 puppet/modules/haproxy/spec/defines/listen_spec.rb |  53 ++++++++
 puppet/modules/haproxy/spec/spec.opts              |   6 +
 puppet/modules/haproxy/spec/spec_helper.rb         |   1 +
 .../modules/haproxy/templates/haproxy-base.cfg.erb |  21 +++
 .../haproxy/templates/haproxy_balancermember.erb   |   3 +
 .../haproxy/templates/haproxy_listen_block.erb     |  10 ++
 puppet/modules/haproxy/tests/init.pp               |  69 ++++++++++
 21 files changed, 936 insertions(+)
 create mode 100644 puppet/modules/haproxy/.fixtures.yml
 create mode 100644 puppet/modules/haproxy/.gemfile
 create mode 100644 puppet/modules/haproxy/.gitrepo
 create mode 100644 puppet/modules/haproxy/.travis.yml
 create mode 100644 puppet/modules/haproxy/CHANGELOG
 create mode 100644 puppet/modules/haproxy/Modulefile
 create mode 100644 puppet/modules/haproxy/README.md
 create mode 100644 puppet/modules/haproxy/Rakefile
 create mode 100644 puppet/modules/haproxy/manifests/balancermember.pp
 create mode 100644 puppet/modules/haproxy/manifests/init.pp
 create mode 100644 puppet/modules/haproxy/manifests/listen.pp
 create mode 100644 puppet/modules/haproxy/manifests/params.pp
 create mode 100644 puppet/modules/haproxy/spec/classes/haproxy_spec.rb
 create mode 100644 puppet/modules/haproxy/spec/defines/balancermember_spec.rb
 create mode 100644 puppet/modules/haproxy/spec/defines/listen_spec.rb
 create mode 100644 puppet/modules/haproxy/spec/spec.opts
 create mode 100644 puppet/modules/haproxy/spec/spec_helper.rb
 create mode 100644 puppet/modules/haproxy/templates/haproxy-base.cfg.erb
 create mode 100644 puppet/modules/haproxy/templates/haproxy_balancermember.erb
 create mode 100644 puppet/modules/haproxy/templates/haproxy_listen_block.erb
 create mode 100644 puppet/modules/haproxy/tests/init.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/haproxy/.fixtures.yml b/puppet/modules/haproxy/.fixtures.yml
new file mode 100644
index 00000000..8d6f22d6
--- /dev/null
+++ b/puppet/modules/haproxy/.fixtures.yml
@@ -0,0 +1,5 @@
+fixtures:
+  repositories:
+    concat: "git://github.com/ripienaar/puppet-concat.git"
+  symlinks:
+    haproxy: "#{source_dir}"
diff --git a/puppet/modules/haproxy/.gemfile b/puppet/modules/haproxy/.gemfile
new file mode 100644
index 00000000..9aad840c
--- /dev/null
+++ b/puppet/modules/haproxy/.gemfile
@@ -0,0 +1,5 @@
+source :rubygems
+
+puppetversion = ENV.key?('PUPPET_VERSION') ? "= #{ENV['PUPPET_VERSION']}" : ['>= 2.7']
+gem 'puppet', puppetversion
+gem 'puppetlabs_spec_helper', '>= 0.1.0'
diff --git a/puppet/modules/haproxy/.gitrepo b/puppet/modules/haproxy/.gitrepo
new file mode 100644
index 00000000..ed92831a
--- /dev/null
+++ b/puppet/modules/haproxy/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_haproxy
+	branch = master
+	commit = af322a73c013f80a958ab7d5d31d0c75cf6d0523
+	parent = 04279dd8d1390d61d696d2c14817199304ccd4d8
+	cmdver = 0.3.0
diff --git a/puppet/modules/haproxy/.travis.yml b/puppet/modules/haproxy/.travis.yml
new file mode 100644
index 00000000..fdbc95dc
--- /dev/null
+++ b/puppet/modules/haproxy/.travis.yml
@@ -0,0 +1,23 @@
+language: ruby
+rvm:
+  - 1.8.7
+  - 1.9.3
+script: "rake spec"
+branches:
+  only:
+    - master
+env:
+  - PUPPET_VERSION=2.6.17
+  - PUPPET_VERSION=2.7.19
+  #- PUPPET_VERSION=3.0.1 # Breaks due to rodjek/rspec-puppet#58
+notifications:
+  email: false
+gemfile: .gemfile
+matrix:
+  exclude:
+  - rvm: 1.9.3
+    gemfile: .gemfile
+    env: PUPPET_VERSION=2.6.17
+  - rvm: 1.8.7
+    gemfile: .gemfile
+    env: PUPPET_VERSION=3.0.1
diff --git a/puppet/modules/haproxy/CHANGELOG b/puppet/modules/haproxy/CHANGELOG
new file mode 100644
index 00000000..0b6d670f
--- /dev/null
+++ b/puppet/modules/haproxy/CHANGELOG
@@ -0,0 +1,5 @@
+2012-10-12 - Version 0.2.0
+- Initial public release
+- Backwards incompatible changes all around
+- No longer needs ordering passed for more than one listener
+- Accepts multiple listen ips/ports/server_names
diff --git a/puppet/modules/haproxy/Modulefile b/puppet/modules/haproxy/Modulefile
new file mode 100644
index 00000000..e729739b
--- /dev/null
+++ b/puppet/modules/haproxy/Modulefile
@@ -0,0 +1,12 @@
+name    'puppetlabs-haproxy'
+version '0.2.0'
+source 'git://github.com/puppetlabs/puppetlabs-haproxy'
+author 'Puppet Labs'
+license 'Apache License, Version 2.0'
+summary 'Haproxy Module'
+description 'An Haproxy module for Redhat family OSes using Storeconfigs'
+project_page 'http://github.com/puppetlabs/puppetlabs-haproxy'
+
+## Add dependencies, if any:
+# dependency 'username/name', '>= 1.2.0'
+dependency 'ripienaar/concat', '>= 0.1.0'
diff --git a/puppet/modules/haproxy/README.md b/puppet/modules/haproxy/README.md
new file mode 100644
index 00000000..d209e9ab
--- /dev/null
+++ b/puppet/modules/haproxy/README.md
@@ -0,0 +1,87 @@
+PuppetLabs Module for haproxy
+=============================
+
+HAProxy is an HA proxying daemon for load-balancing to clustered services. It
+can proxy TCP directly, or other kinds of traffic such as HTTP.
+
+Dependencies
+------------
+
+Tested and built on Debian, Ubuntu and CentOS
+
+Currently requires the ripienaar/concat module on the Puppet Forge and uses storeconfigs on the Puppet Master to export/collect resources
+from all balancer members.
+
+Basic Usage
+-----------
+
+This haproxy uses storeconfigs to collect and realize balancer member servers
+on a load balancer server. 
+
+*To install and configure HAProxy server listening on port 8140*
+
+```puppet
+node 'haproxy-server' {
+  class { 'haproxy': }
+  haproxy::listen { 'puppet00':
+    ipaddress => $::ipaddress,
+    ports     => '8140',
+  }
+}
+```
+
+*To add backend loadbalance members*
+
+```puppet
+node 'webserver01' {
+  @@haproxy::balancermember { $fqdn:
+    listening_service => 'puppet00',
+    server_names      => $::hostname,
+    ipaddresses       => $::ipaddress,
+    ports             => '8140',
+    options           => 'check'
+  }
+}
+```
+
+Configuring haproxy options
+---------------------------
+
+The base `haproxy` class can accept two parameters which will configure basic
+behaviour of the haproxy server daemon:
+
+- `global_options` to configure the `global` section in `haproxy.cfg`
+- `defaults_options` to configure the `defaults` section in `haproxy.cfg`
+
+Configuring haproxy daemon listener
+-----------------------------------
+
+One `haproxy::listen` defined resource should be defined for each HAProxy loadbalanced set of backend servers. The title of the `haproxy::listen` resource is the key to which balancer members will be proxied to. The `ipaddress` field should be the public ip address which the loadbalancer will be contacted on. The `ports` attribute can accept an array or comma-separated list of ports which should be proxied to the `haproxy::balancermemeber` nodes.
+
+Configuring haproxy loadbalanced member nodes
+---------------------------------------------
+
+The `haproxy::balacemember` defined resource should be exported from each node
+which is serving loadbalanced traffic. the `listening_service` attribute will
+associate it with `haproxy::listen` directives on the haproxy node.
+`ipaddresses` and `ports` will be assigned to the member to be contacted on. If an array of `ipaddresses` and `server_names` are provided then they will be added to the config in lock-step.
+
+
+Copyright and License
+---------------------
+
+Copyright (C) 2012 [Puppet Labs](https://www.puppetlabs.com/) Inc
+
+Puppet Labs can be contacted at: info@puppetlabs.com
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/puppet/modules/haproxy/Rakefile b/puppet/modules/haproxy/Rakefile
new file mode 100644
index 00000000..cd3d3799
--- /dev/null
+++ b/puppet/modules/haproxy/Rakefile
@@ -0,0 +1 @@
+require 'puppetlabs_spec_helper/rake_tasks'
diff --git a/puppet/modules/haproxy/manifests/balancermember.pp b/puppet/modules/haproxy/manifests/balancermember.pp
new file mode 100644
index 00000000..a0e27539
--- /dev/null
+++ b/puppet/modules/haproxy/manifests/balancermember.pp
@@ -0,0 +1,95 @@
+# == Define Resource Type: haproxy::balancermember
+#
+# This type will setup a balancer member inside a listening service
+#  configuration block in /etc/haproxy/haproxy.cfg on the load balancer.
+#  currently it only has the ability to specify the instance name,
+#  ip address, port, and whether or not it is a backup. More features
+#  can be added as needed. The best way to implement this is to export
+#  this resource for all haproxy balancer member servers, and then collect
+#  them on the main haproxy load balancer.
+#
+# === Requirement/Dependencies:
+#
+# Currently requires the ripienaar/concat module on the Puppet Forge and
+#  uses storeconfigs on the Puppet Master to export/collect resources
+#  from all balancer members.
+#
+# === Parameters
+#
+# [*name*]
+#   The title of the resource is arbitrary and only utilized in the concat
+#    fragment name.
+#
+# [*listening_service*]
+#    The haproxy service's instance name (or, the title of the
+#     haproxy::listen resource). This must match up with a declared
+#     haproxy::listen resource.
+#
+# [*ports*]
+#     An array or commas-separated list of ports for which the balancer member
+#     will accept connections from the load balancer. Note that cookie values
+#     aren't yet supported, but shouldn't be difficult to add to the
+#     configuration. If you use an array in server_names and ipaddresses, the
+#     same port is used for all balancermembers.
+#
+# [*server_names*]
+#     The name of the balancer member server as known to haproxy in the
+#      listening service's configuration block. This defaults to the
+#      hostname. Can be an array of the same length as ipaddresses,
+#      in which case a balancermember is created for each pair of
+#      server_names and ipaddresses (in lockstep).
+#
+# [*ipaddresses*]
+#      The ip address used to contact the balancer member server.
+#      Can be an array, see documentation to server_names.
+#
+# [*options*]
+#      An array of options to be specified after the server declaration
+#       in the listening service's configuration block.
+#
+#
+# === Examples
+#
+#  Exporting the resource for a balancer member:
+#
+#  @@haproxy::balancermember { 'haproxy':
+#    listening_service => 'puppet00',
+#    ports             => '8140',
+#    server_names      => $::hostname,
+#    ipaddresses       => $::ipaddress,
+#    options           => 'check',
+#  }
+#
+#
+#  Collecting the resource on a load balancer
+#
+#  Haproxy::Balancermember <<| listening_service == 'puppet00' |>>
+#
+#  Creating the resource for multiple balancer members at once
+#  (for single-pass installation of haproxy without requiring a first
+#  pass to export the resources if you know the members in advance):
+# 
+#  haproxy::balancermember { 'haproxy':
+#    listening_service => 'puppet00',
+#    ports             => '8140',
+#    server_names      => ['server01', 'server02'],
+#    ipaddresses       => ['192.168.56.200', '192.168.56.201'],
+#    options           => 'check',
+#  }
+#  
+#  (this resource can be declared anywhere)
+#
+define haproxy::balancermember (
+  $listening_service,
+  $ports,
+  $server_names = $::hostname,
+  $ipaddresses  = $::ipaddress,
+  $options      = ''
+) {
+  # Template uses $ipaddresses, $server_name, $ports, $option
+  concat::fragment { "${listening_service}_balancermember_${name}":
+    order   => "20-${listening_service}-${name}",
+    target  => '/etc/haproxy/haproxy.cfg',
+    content => template('haproxy/haproxy_balancermember.erb'),
+  }
+}
diff --git a/puppet/modules/haproxy/manifests/init.pp b/puppet/modules/haproxy/manifests/init.pp
new file mode 100644
index 00000000..b91591a3
--- /dev/null
+++ b/puppet/modules/haproxy/manifests/init.pp
@@ -0,0 +1,149 @@
+# == Class: haproxy
+#
+# A Puppet module, using storeconfigs, to model an haproxy configuration.
+# Currently VERY limited - Pull requests accepted!
+#
+# === Requirement/Dependencies:
+#
+# Currently requires the ripienaar/concat module on the Puppet Forge and
+#  uses storeconfigs on the Puppet Master to export/collect resources
+#  from all balancer members.
+#
+# === Parameters
+#
+# [*enable*]
+#   Chooses whether haproxy should be installed or ensured absent.
+#   Currently ONLY accepts valid boolean true/false values.
+#
+# [*version*]
+#   Allows you to specify what version of the package to install.
+#   Default is simply 'present'
+#
+# [*global_options*]
+#   A hash of all the haproxy global options. If you want to specify more
+#    than one option (i.e. multiple timeout or stats options), pass those
+#    options as an array and you will get a line for each of them in the
+#    resultant haproxy.cfg file.
+#
+# [*defaults_options*]
+#   A hash of all the haproxy defaults options. If you want to specify more
+#    than one option (i.e. multiple timeout or stats options), pass those
+#    options as an array and you will get a line for each of them in the
+#    resultant haproxy.cfg file.
+#
+#
+# === Examples
+#
+#  class { 'haproxy':
+#    enable           => true,
+#    global_options   => {
+#      'log'     => "${::ipaddress} local0",
+#      'chroot'  => '/var/lib/haproxy',
+#      'pidfile' => '/var/run/haproxy.pid',
+#      'maxconn' => '4000',
+#      'user'    => 'haproxy',
+#      'group'   => 'haproxy',
+#      'daemon'  => '',
+#      'stats'   => 'socket /var/lib/haproxy/stats'
+#    },
+#    defaults_options => {
+#      'log'     => 'global',
+#      'stats'   => 'enable',
+#      'option'  => 'redispatch',
+#      'retries' => '3',
+#      'timeout' => [
+#        'http-request 10s',
+#        'queue 1m',
+#        'connect 10s',
+#        'client 1m',
+#        'server 1m',
+#        'check 10s'
+#      ],
+#      'maxconn' => '8000'
+#    },
+#  }
+#
+class haproxy (
+  $manage_service   = true,
+  $enable           = true,
+  $version          = 'present',
+  $global_options   = $haproxy::params::global_options,
+  $defaults_options = $haproxy::params::defaults_options
+) inherits haproxy::params {
+  include concat::setup
+
+  package { 'haproxy':
+    ensure  => $enable ? {
+      true  => $version,
+      false => absent,
+    },
+    name    => 'haproxy',
+  }
+
+  if $enable {
+    concat { '/etc/haproxy/haproxy.cfg':
+      owner   => '0',
+      group   => '0',
+      mode    => '0644',
+      require => Package['haproxy'],
+      notify  => $manage_service ? {
+        true  => Service['haproxy'],
+        false => undef,
+      },
+    }
+
+    # Simple Header
+    concat::fragment { '00-header':
+      target  => '/etc/haproxy/haproxy.cfg',
+      order   => '01',
+      content => "# This file managed by Puppet\n",
+    }
+
+    # Template uses $global_options, $defaults_options
+    concat::fragment { 'haproxy-base':
+      target  => '/etc/haproxy/haproxy.cfg',
+      order   => '10',
+      content => template('haproxy/haproxy-base.cfg.erb'),
+    }
+
+    if ($::osfamily == 'Debian') {
+      file { '/etc/default/haproxy':
+        content => 'ENABLED=1',
+        require => Package['haproxy'],
+        before  => $manage_service ? {
+          true  => Service['haproxy'],
+          false => undef,
+        },
+      }
+    }
+
+    file { $global_options['chroot']:
+      ensure  => directory,
+      owner   => $global_options['user'],
+      group   => $global_options['group'],
+      mode    => '0550',
+      require => Package['haproxy']
+    }
+
+  }
+
+  if $manage_service {
+    service { 'haproxy':
+      ensure     => $enable ? {
+        true  => running,
+        false => stopped,
+      },
+      enable     => $enable ? {
+        true  => true,
+        false => false,
+      },
+      name       => 'haproxy',
+      hasrestart => true,
+      hasstatus  => true,
+      require    => [
+        Concat['/etc/haproxy/haproxy.cfg'],
+        File[$global_options['chroot']],
+      ],
+    }
+  }
+}
diff --git a/puppet/modules/haproxy/manifests/listen.pp b/puppet/modules/haproxy/manifests/listen.pp
new file mode 100644
index 00000000..00636e3d
--- /dev/null
+++ b/puppet/modules/haproxy/manifests/listen.pp
@@ -0,0 +1,95 @@
+# == Define Resource Type: haproxy::listen
+#
+# This type will setup a listening service configuration block inside
+#  the haproxy.cfg file on an haproxy load balancer. Each listening service
+#  configuration needs one or more load balancer member server (that can be
+#  declared with the haproxy::balancermember defined resource type). Using
+#  storeconfigs, you can export the haproxy::balancermember resources on all
+#  load balancer member servers, and then collect them on a single haproxy
+#  load balancer server.
+#
+# === Requirement/Dependencies:
+#
+# Currently requires the ripienaar/concat module on the Puppet Forge and
+#  uses storeconfigs on the Puppet Master to export/collect resources
+#  from all balancer members.
+#
+# === Parameters
+#
+# [*name*]
+#    The namevar of the defined resource type is the listening service's name.
+#     This name goes right after the 'listen' statement in haproxy.cfg
+#
+# [*ports*]
+#    Ports on which the proxy will listen for connections on the ip address
+#    specified in the virtual_ip parameter. Accepts either a single
+#    comma-separated string or an array of strings which may be ports or
+#    hyphenated port ranges.
+#
+# [*ipaddress*]
+#    The ip address the proxy binds to. Empty addresses, '*', and '0.0.0.0'
+#     mean that the proxy listens to all valid addresses on the system.
+#
+# [*mode*]
+#    The mode of operation for the listening service. Valid values are 'tcp',
+#     HTTP', and 'health'.
+#
+# [*options*]
+#    A hash of options that are inserted into the listening service
+#     configuration block.
+#
+# [*collect_exported*]
+#    Boolean, default 'true'. True means 'collect exported @@balancermember resources'
+#    (for the case when every balancermember node exports itself), false means
+#    'rely on the existing declared balancermember resources' (for the case when you 
+#    know the full set of balancermembers in advance and use haproxy::balancermember 
+#    with array arguments, which allows you to deploy everything in 1 run)
+#
+#
+# === Examples
+#
+#  Exporting the resource for a balancer member:
+#
+#  haproxy::listen { 'puppet00':
+#    ipaddress => $::ipaddress,
+#    ports     => '18140',
+#    mode      => 'tcp',
+#    options   => {
+#      'option'  => [
+#        'tcplog',
+#        'ssl-hello-chk'
+#      ],
+#      'balance' => 'roundrobin'
+#    },
+#  }
+#
+# === Authors
+#
+# Gary Larizza <gary@puppetlabs.com>
+#
+define haproxy::listen (
+  $ports,
+  $ipaddress        = [$::ipaddress],
+  $mode             = 'tcp',
+  $collect_exported = true,
+  $options          = {
+    'option'  => [
+      'tcplog',
+      'ssl-hello-chk'
+    ],
+    'balance' => 'roundrobin'
+  }
+) {
+  # Template uses: $name, $ipaddress, $ports, $options
+  concat::fragment { "${name}_listen_block":
+    order   => "20-${name}-00",
+    target  => '/etc/haproxy/haproxy.cfg',
+    content => template('haproxy/haproxy_listen_block.erb'),
+  }
+
+  if $collect_exported {
+    Haproxy::Balancermember <<| listening_service == $name |>>
+  }
+  # else: the resources have been created and they introduced their
+  # concat fragments. We don't have to do anything about them.
+}
diff --git a/puppet/modules/haproxy/manifests/params.pp b/puppet/modules/haproxy/manifests/params.pp
new file mode 100644
index 00000000..53442ddc
--- /dev/null
+++ b/puppet/modules/haproxy/manifests/params.pp
@@ -0,0 +1,65 @@
+# == Class: haproxy::params
+#
+# This is a container class holding default parameters for for haproxy class.
+#  currently, only the Redhat family is supported, but this can be easily
+#  extended by changing package names and configuration file paths.
+#
+class haproxy::params {
+  case $osfamily {
+    Redhat: {
+      $global_options   = {
+        'log'     => "${::ipaddress} local0",
+        'chroot'  => '/var/lib/haproxy',
+        'pidfile' => '/var/run/haproxy.pid',
+        'maxconn' => '4000',
+        'user'    => 'haproxy',
+        'group'   => 'haproxy',
+        'daemon'  => '',
+        'stats'   => 'socket /var/lib/haproxy/stats'
+      }
+      $defaults_options = {
+        'log'     => 'global',
+        'stats'   => 'enable',
+        'option'  => 'redispatch',
+        'retries' => '3',
+        'timeout' => [
+          'http-request 10s',
+          'queue 1m',
+          'connect 10s',
+          'client 1m',
+          'server 1m',
+          'check 10s',
+        ],
+        'maxconn' => '8000'
+      }
+    }
+    Debian: {
+      $global_options   = {
+        'log'     => "${::ipaddress} local0",
+        'chroot'  => '/var/lib/haproxy',
+        'pidfile' => '/var/run/haproxy.pid',
+        'maxconn' => '4000',
+        'user'    => 'haproxy',
+        'group'   => 'haproxy',
+        'daemon'  => '',
+        'stats'   => 'socket /var/lib/haproxy/stats'
+      }
+      $defaults_options = {
+        'log'     => 'global',
+        'stats'   => 'enable',
+        'option'  => 'redispatch',
+        'retries' => '3',
+        'timeout' => [
+          'http-request 10s',
+          'queue 1m',
+          'connect 10s',
+          'client 1m',
+          'server 1m',
+          'check 10s',
+        ],
+        'maxconn' => '8000'
+      }
+    }
+    default: { fail("The $::osfamily operating system is not supported with the haproxy module") }
+  }
+}
diff --git a/puppet/modules/haproxy/spec/classes/haproxy_spec.rb b/puppet/modules/haproxy/spec/classes/haproxy_spec.rb
new file mode 100644
index 00000000..4b5902ce
--- /dev/null
+++ b/puppet/modules/haproxy/spec/classes/haproxy_spec.rb
@@ -0,0 +1,138 @@
+require 'spec_helper'
+
+describe 'haproxy', :type => :class do
+  let(:default_facts) do
+    {
+      :concat_basedir => '/dne',
+      :ipaddress      => '10.10.10.10'
+    }
+  end
+  context 'on supported platforms' do
+    describe 'for OS-agnostic configuration' do
+      ['Debian', 'RedHat'].each do |osfamily|
+        context "on #{osfamily} family operatingsystems" do
+          let(:facts) do
+            { :osfamily => osfamily }.merge default_facts
+          end
+          let(:params) do
+            {'enable' => true}
+          end
+          it { should include_class('concat::setup') }
+          it 'should install the haproxy package' do
+            subject.should contain_package('haproxy').with(
+              'ensure' => 'present'
+            )
+          end
+          it 'should install the haproxy service' do
+            subject.should contain_service('haproxy').with(
+              'ensure'     => 'running',
+              'enable'     => 'true',
+              'hasrestart' => 'true',
+              'hasstatus'  => 'true',
+              'require'    => [
+                'Concat[/etc/haproxy/haproxy.cfg]',
+                'File[/var/lib/haproxy]'
+              ]
+            )
+          end
+          it 'should set up /etc/haproxy/haproxy.cfg as a concat resource' do
+            subject.should contain_concat('/etc/haproxy/haproxy.cfg').with(
+              'owner' => '0',
+              'group' => '0',
+              'mode'  => '0644'
+            )
+          end
+          it 'should manage the chroot directory' do
+            subject.should contain_file('/var/lib/haproxy').with(
+              'ensure' => 'directory'
+            )
+          end
+          it 'should contain a header concat fragment' do
+            subject.should contain_concat__fragment('00-header').with(
+              'target'  => '/etc/haproxy/haproxy.cfg',
+              'order'   => '01',
+              'content' => "# This file managed by Puppet\n"
+            )
+          end
+          it 'should contain a haproxy-base concat fragment' do
+            subject.should contain_concat__fragment('haproxy-base').with(
+              'target'  => '/etc/haproxy/haproxy.cfg',
+              'order'   => '10'
+            )
+          end
+          describe 'Base concat fragment contents' do
+            let(:contents) { param_value(subject, 'concat::fragment', 'haproxy-base', 'content').split("\n") }
+            it 'should contain global and defaults sections' do
+              contents.should include('global')
+              contents.should include('defaults')
+            end
+            it 'should log to an ip address for local0' do
+              contents.should be_any { |match| match =~ /  log  \d+(\.\d+){3} local0/ }
+            end
+            it 'should specify the default chroot' do
+              contents.should include('  chroot  /var/lib/haproxy')
+            end
+            it 'should specify the correct user' do
+              contents.should include('  user  haproxy')
+            end
+            it 'should specify the correct group' do
+              contents.should include('  group  haproxy')
+            end
+            it 'should specify the correct pidfile' do
+              contents.should include('  pidfile  /var/run/haproxy.pid')
+            end
+          end
+        end
+        context "on #{osfamily} family operatingsystems without managing the service" do
+          let(:facts) do
+            { :osfamily => osfamily }.merge default_facts
+          end
+          let(:params) do
+            {
+              'enable'         => true,
+              'manage_service' => false,
+            }
+          end
+          it { should include_class('concat::setup') }
+          it 'should install the haproxy package' do
+            subject.should contain_package('haproxy').with(
+              'ensure' => 'present'
+            )
+          end
+          it 'should install the haproxy service' do
+            subject.should_not contain_service('haproxy')
+          end
+        end
+      end
+    end
+    describe 'for OS-specific configuration' do
+      context 'only on Debian family operatingsystems' do
+        let(:facts) do
+          { :osfamily => 'Debian' }.merge default_facts
+        end
+        it 'should manage haproxy service defaults' do
+          subject.should contain_file('/etc/default/haproxy').with(
+            'before'  => 'Service[haproxy]',
+            'require' => 'Package[haproxy]'
+          )
+          verify_contents(subject, '/etc/default/haproxy', ['ENABLED=1'])
+        end
+      end
+      context 'only on RedHat family operatingsystems' do
+        let(:facts) do
+          { :osfamily => 'RedHat' }.merge default_facts
+        end
+      end
+    end
+  end
+  context 'on unsupported operatingsystems' do
+    let(:facts) do
+      { :osfamily => 'RainbowUnicorn' }.merge default_facts
+    end
+    it do
+      expect {
+        should contain_service('haproxy')
+      }.to raise_error(Puppet::Error, /operating system is not supported with the haproxy module/)
+    end
+  end
+end
diff --git a/puppet/modules/haproxy/spec/defines/balancermember_spec.rb b/puppet/modules/haproxy/spec/defines/balancermember_spec.rb
new file mode 100644
index 00000000..74bc7a8b
--- /dev/null
+++ b/puppet/modules/haproxy/spec/defines/balancermember_spec.rb
@@ -0,0 +1,82 @@
+require 'spec_helper'
+
+describe 'haproxy::balancermember' do
+  let(:title) { 'tyler' }
+  let(:facts) do
+    {
+      :ipaddress => '1.1.1.1',
+      :hostname  => 'dero'
+    }
+  end
+
+  context 'with a single balancermember option' do
+    let(:params) do
+      {
+        :name              => 'tyler',
+        :listening_service => 'croy',
+        :ports             => '18140',
+        :options           => 'check'
+      }
+    end
+
+    it { should contain_concat__fragment('croy_balancermember_tyler').with(
+      'order'   => '20-croy-tyler',
+      'target'  => '/etc/haproxy/haproxy.cfg',
+      'content' => "  server dero 1.1.1.1:18140 check\n\n"
+    ) }
+  end
+
+  context 'with multiple balancermember options' do
+    let(:params) do
+      {
+        :name              => 'tyler',
+        :listening_service => 'croy',
+        :ports             => '18140',
+        :options           => ['check', 'close']
+      }
+    end
+
+    it { should contain_concat__fragment('croy_balancermember_tyler').with(
+      'order'   => '20-croy-tyler',
+      'target'  => '/etc/haproxy/haproxy.cfg',
+      'content' => "  server dero 1.1.1.1:18140 check close\n\n"
+    ) }
+  end
+
+  context 'with multiple servers' do
+    let(:params) do
+      {
+        :name              => 'tyler',
+        :listening_service => 'croy',
+        :ports             => '18140',
+        :server_names      => ['server01', 'server02'],
+        :ipaddresses       => ['192.168.56.200', '192.168.56.201'],
+        :options           => ['check']
+      }
+    end
+
+    it { should contain_concat__fragment('croy_balancermember_tyler').with(
+      'order'   => '20-croy-tyler',
+      'target'  => '/etc/haproxy/haproxy.cfg',
+      'content' => "  server server01 192.168.56.200:18140 check\n  server server02 192.168.56.201:18140 check\n\n"
+    ) }
+  end
+  context 'with multiple servers and multiple ports' do
+    let(:params) do
+      {
+        :name              => 'tyler',
+        :listening_service => 'croy',
+        :ports             => ['18140','18150'],
+        :server_names      => ['server01', 'server02'],
+        :ipaddresses       => ['192.168.56.200', '192.168.56.201'],
+        :options           => ['check']
+      }
+    end
+
+    it { should contain_concat__fragment('croy_balancermember_tyler').with(
+      'order'   => '20-croy-tyler',
+      'target'  => '/etc/haproxy/haproxy.cfg',
+      'content' => "  server server01 192.168.56.200:18140,192.168.56.200:18150 check\n  server server02 192.168.56.201:18140,192.168.56.201:18150 check\n\n"
+    ) }
+  end
+end
diff --git a/puppet/modules/haproxy/spec/defines/listen_spec.rb b/puppet/modules/haproxy/spec/defines/listen_spec.rb
new file mode 100644
index 00000000..31dd4c85
--- /dev/null
+++ b/puppet/modules/haproxy/spec/defines/listen_spec.rb
@@ -0,0 +1,53 @@
+require 'spec_helper'
+
+describe 'haproxy::listen' do
+  let(:title) { 'tyler' }
+  let(:facts) {{ :ipaddress => '1.1.1.1' }}
+  context "when only one port is provided" do
+    let(:params) do
+      {
+        :name  => 'croy',
+        :ports => '18140'
+      }
+    end
+
+    it { should contain_concat__fragment('croy_listen_block').with(
+      'order'   => '20-croy-00',
+      'target'  => '/etc/haproxy/haproxy.cfg',
+      'content' => "listen croy\n\n  bind 1.1.1.1:18140\n\n  balance  roundrobin\n  option  tcplog\n  option  ssl-hello-chk\n"
+    ) }
+  end
+  context "when an array of ports is provided" do
+    let(:params) do
+      {
+        :name      => 'apache',
+        :ipaddress => '23.23.23.23',
+        :ports     => [
+          '80',
+          '443',
+        ]
+      }
+    end
+
+    it { should contain_concat__fragment('apache_listen_block').with(
+      'order'   => '20-apache-00',
+      'target'  => '/etc/haproxy/haproxy.cfg',
+      'content' => "listen apache\n\n  bind 23.23.23.23:80\n\n  bind 23.23.23.23:443\n\n  balance  roundrobin\n  option  tcplog\n  option  ssl-hello-chk\n"
+    ) }
+  end
+  context "when a comma-separated list of ports is provided" do
+    let(:params) do
+      {
+        :name      => 'apache',
+        :ipaddress => '23.23.23.23',
+        :ports     => '80,443'
+      }
+    end
+
+    it { should contain_concat__fragment('apache_listen_block').with(
+      'order'   => '20-apache-00',
+      'target'  => '/etc/haproxy/haproxy.cfg',
+      'content' => "listen apache\n\n  bind 23.23.23.23:80\n\n  bind 23.23.23.23:443\n\n  balance  roundrobin\n  option  tcplog\n  option  ssl-hello-chk\n"
+    ) }
+  end
+end
diff --git a/puppet/modules/haproxy/spec/spec.opts b/puppet/modules/haproxy/spec/spec.opts
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/haproxy/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/haproxy/spec/spec_helper.rb b/puppet/modules/haproxy/spec/spec_helper.rb
new file mode 100644
index 00000000..2c6f5664
--- /dev/null
+++ b/puppet/modules/haproxy/spec/spec_helper.rb
@@ -0,0 +1 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
diff --git a/puppet/modules/haproxy/templates/haproxy-base.cfg.erb b/puppet/modules/haproxy/templates/haproxy-base.cfg.erb
new file mode 100644
index 00000000..f25d5c34
--- /dev/null
+++ b/puppet/modules/haproxy/templates/haproxy-base.cfg.erb
@@ -0,0 +1,21 @@
+global
+<% @global_options.sort.each do |key,val| -%>
+<% if val.is_a?(Array) -%>
+<% val.each do |item| -%>
+  <%= key %>  <%= item %>
+<% end -%>
+<% else -%>
+  <%= key %>  <%= val %>
+<% end -%>
+<% end -%>
+
+defaults
+<% @defaults_options.sort.each do |key,val| -%>
+<% if val.is_a?(Array) -%>
+<% val.each do |item| -%>
+  <%= key %>  <%= item %>
+<% end -%>
+<% else -%>
+  <%= key %>  <%= val %>
+<% end -%>
+<% end -%>
diff --git a/puppet/modules/haproxy/templates/haproxy_balancermember.erb b/puppet/modules/haproxy/templates/haproxy_balancermember.erb
new file mode 100644
index 00000000..1d03f565
--- /dev/null
+++ b/puppet/modules/haproxy/templates/haproxy_balancermember.erb
@@ -0,0 +1,3 @@
+<% Array(ipaddresses).zip(Array(server_names)).each do |ipaddress,host| -%>
+  server <%= host %> <%= ipaddress %>:<%= Array(ports).collect {|x|x.split(',')}.flatten.join(",#{ipaddress}:") %> <%= Array(options).join(" ") %>
+<% end %>
diff --git a/puppet/modules/haproxy/templates/haproxy_listen_block.erb b/puppet/modules/haproxy/templates/haproxy_listen_block.erb
new file mode 100644
index 00000000..129313f1
--- /dev/null
+++ b/puppet/modules/haproxy/templates/haproxy_listen_block.erb
@@ -0,0 +1,10 @@
+listen <%= name %>
+  mode <%= mode %>
+<% Array(ipaddress).uniq.each do |virtual_ip| (ports.is_a?(Array) ? ports : Array(ports.split(","))).each do |port| %>
+  bind <%= virtual_ip %>:<%= port %>
+<% end end %>
+<% options.sort.each do |key, val| -%>
+<% Array(val).each do |item| -%>
+  <%= key %>  <%= item %>
+<% end -%>
+<% end -%>
diff --git a/puppet/modules/haproxy/tests/init.pp b/puppet/modules/haproxy/tests/init.pp
new file mode 100644
index 00000000..77590ac8
--- /dev/null
+++ b/puppet/modules/haproxy/tests/init.pp
@@ -0,0 +1,69 @@
+# Declare haproxy base class with configuration options
+class { 'haproxy':
+  enable           => true,
+  global_options   => {
+    'log'     => "${::ipaddress} local0",
+    'chroot'  => '/var/lib/haproxy',
+    'pidfile' => '/var/run/haproxy.pid',
+    'maxconn' => '4000',
+    'user'    => 'haproxy',
+    'group'   => 'haproxy',
+    'daemon'  => '',
+    'stats'   => 'socket /var/lib/haproxy/stats',
+  },
+  defaults_options => {
+    'log'     => 'global',
+    'stats'   => 'enable',
+    'option'  => 'redispatch',
+    'retries' => '3',
+    'timeout' => [
+      'http-request 10s',
+      'queue 1m',
+      'connect 10s',
+      'client 1m',
+      'server 1m',
+      'check 10s',
+    ],
+    'maxconn' => '8000',
+  },
+}
+
+# Export a balancermember server, note that the listening_service parameter
+#  will/must correlate with an haproxy::listen defined resource type.
+@@haproxy::balancermember { $fqdn:
+  order                  => '21',
+  listening_service      => 'puppet00',
+  server_name            => $::hostname,
+  balancer_ip            => $::ipaddress,
+  balancer_port          => '8140',
+  balancermember_options => 'check'
+}
+
+# Declare a couple of Listening Services for haproxy.cfg
+#  Note that the balancermember server resources are being collected in
+#  the haproxy::config defined resource type with the following line:
+#  Haproxy::Balancermember <<| listening_service == $name |>>
+haproxy::listen { 'puppet00':
+  order     => '20',
+  ipaddress => $::ipaddress,
+  ports     => '18140',
+  options   => {
+    'option'  => [
+      'tcplog',
+      'ssl-hello-chk',
+    ],
+    'balance' => 'roundrobin',
+  },
+}
+haproxy::listen { 'stats':
+  order     => '30',
+  ipaddress => '',
+  ports     => '9090',
+  options   => {
+    'mode'  => 'http',
+    'stats' => [
+      'uri /',
+      'auth puppet:puppet'
+    ],
+  },
+}
-- 
cgit v1.2.3


From d8a8d30b04d34387f309d9f5b7afdbcad01f7cbc Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:23 -0400
Subject: git subrepo clone https://leap.se/git/puppet_squid_deb_proxy
 puppet/modules/squid_deb_proxy

subrepo:
  subdir:   "puppet/modules/squid_deb_proxy"
  merged:   "08bfacc"
upstream:
  origin:   "https://leap.se/git/puppet_squid_deb_proxy"
  branch:   "master"
  commit:   "08bfacc"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I4afe250a7d95c927ee2c1e06f7efd6f733fefe29
---
 puppet/modules/squid_deb_proxy/.gitrepo            |  11 ++
 puppet/modules/squid_deb_proxy/README.md           |   8 ++
 .../files/Debian/squid-deb-proxy.conf              |  91 ++++++++++++++
 .../files/Ubuntu/squid-deb-proxy.conf              |  89 +++++++++++++
 .../files/allowed-networks-src.acl.d/20-custom     |   1 +
 .../files/client/apt-avahi-discover                | 138 +++++++++++++++++++++
 .../files/mirror-dstdomain.acl.d/20-custom         |   1 +
 puppet/modules/squid_deb_proxy/manifests/client.pp |  16 +++
 puppet/modules/squid_deb_proxy/manifests/server.pp |  41 ++++++
 9 files changed, 396 insertions(+)
 create mode 100644 puppet/modules/squid_deb_proxy/.gitrepo
 create mode 100644 puppet/modules/squid_deb_proxy/README.md
 create mode 100644 puppet/modules/squid_deb_proxy/files/Debian/squid-deb-proxy.conf
 create mode 100644 puppet/modules/squid_deb_proxy/files/Ubuntu/squid-deb-proxy.conf
 create mode 100644 puppet/modules/squid_deb_proxy/files/allowed-networks-src.acl.d/20-custom
 create mode 100755 puppet/modules/squid_deb_proxy/files/client/apt-avahi-discover
 create mode 100644 puppet/modules/squid_deb_proxy/files/mirror-dstdomain.acl.d/20-custom
 create mode 100644 puppet/modules/squid_deb_proxy/manifests/client.pp
 create mode 100644 puppet/modules/squid_deb_proxy/manifests/server.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/squid_deb_proxy/.gitrepo b/puppet/modules/squid_deb_proxy/.gitrepo
new file mode 100644
index 00000000..78765952
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_squid_deb_proxy
+	branch = master
+	commit = 08bfaccaea01fd2d334946428504e71a51748e3d
+	parent = a658f5c30ada5e03468257f90d08f6cd2ba25488
+	cmdver = 0.3.0
diff --git a/puppet/modules/squid_deb_proxy/README.md b/puppet/modules/squid_deb_proxy/README.md
new file mode 100644
index 00000000..c183c826
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/README.md
@@ -0,0 +1,8 @@
+This module installes squid-deb-proxy (server or client)
+see https://launchpad.net/squid-deb-proxy for more details
+
+Debian Support
+==============
+
+* As of 2013-07, squid-deb-proxy just arrived in jessie, so you need to
+  configure apt to use jessie. 
diff --git a/puppet/modules/squid_deb_proxy/files/Debian/squid-deb-proxy.conf b/puppet/modules/squid_deb_proxy/files/Debian/squid-deb-proxy.conf
new file mode 100644
index 00000000..2a528f84
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/Debian/squid-deb-proxy.conf
@@ -0,0 +1,91 @@
+
+#       WELCOME TO SQUID DEB PROXY
+#       ------------------
+#
+#       This config file is a version of a squid proxy file optimized
+#	as a configuration for a caching proxy for Debian/Ubuntu systems.
+#
+#       More information about squid and its configuration can be found here
+#       http://www.squid-cache.org/ and in the FAQ
+
+# settings that you may want to customize
+# ---------------------------------------
+
+# this file contains private networks (10.0.0.0/8, 172.16.0.0/12,
+# 192.168.0.0/16) by default, you can add/remove additional allowed
+# source networks in it to customize it for your setup
+acl allowed_networks src "/etc/squid-deb-proxy/autogenerated/allowed-networks-src.acl"
+
+# this file contains the archive mirrors by default,
+# if you use a different mirror, add it there
+acl to_archive_mirrors dstdomain "/etc/squid-deb-proxy/autogenerated/mirror-dstdomain.acl"
+
+# this contains the package blacklist
+acl blockedpkgs urlpath_regex "/etc/squid-deb-proxy/autogenerated/pkg-blacklist-regexp.acl"
+
+# default to a different port than stock squid
+http_port 8000
+
+# -------------------------------------------------
+# settings below probably do not need customization
+
+# user visible name
+visible_hostname squid-deb-proxy
+
+# we need a big cache, some debs are huge
+maximum_object_size 512 MB
+
+# use a different dir than stock squid and default to 40G
+cache_dir aufs /var/cache/squid-deb-proxy 40000 16 256
+
+# use different logs
+cache_access_log /var/log/squid-deb-proxy/access.log
+cache_log /var/log/squid-deb-proxy/cache.log
+cache_store_log /var/log/squid-deb-proxy/store.log
+
+# tweaks to speed things up
+cache_mem 200 MB
+maximum_object_size_in_memory 10240 KB
+
+# pid
+pid_filename /var/run/squid-deb-proxy.pid
+
+# refresh pattern for debs and udebs
+refresh_pattern deb$   129600 100% 129600
+refresh_pattern udeb$   129600 100% 129600
+refresh_pattern tar.gz$  129600 100% 129600
+
+# always refresh Packages and Release files
+refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz)$ 0 0% 0
+refresh_pattern \/Release(|\.gpg)$ 0 0% 0
+refresh_pattern \/InRelease$ 0 0% 0
+
+# handle meta-release and changelogs.ubuntu.com special
+# (fine to have this on debian too)
+refresh_pattern changelogs.ubuntu.com/*  0  1% 1
+
+# only allow connects to ports for http, https
+acl Safe_ports port 80
+acl Safe_ports port 443 563   
+
+# only allow ports we trust
+http_access deny !Safe_ports
+
+# do not allow to download from the pkg blacklist
+http_access deny blockedpkgs
+
+# allow access only to official archive mirrors
+# uncomment the third and fouth line to permit any unlisted domain
+http_access deny !to_archive_mirrors
+#http_access allow !to_archive_mirrors
+
+# don't cache domains not listed in the mirrors file
+# uncomment the third and fourth line to cache any unlisted domains
+cache deny !to_archive_mirrors
+#cache allow !to_archive_mirrors
+
+# allow access from our network and localhost
+http_access allow allowed_networks
+
+# And finally deny all other access to this proxy
+http_access deny all
diff --git a/puppet/modules/squid_deb_proxy/files/Ubuntu/squid-deb-proxy.conf b/puppet/modules/squid_deb_proxy/files/Ubuntu/squid-deb-proxy.conf
new file mode 100644
index 00000000..ab5bac8a
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/Ubuntu/squid-deb-proxy.conf
@@ -0,0 +1,89 @@
+
+#       WELCOME TO SQUID DEB PROXY
+#       ------------------
+#
+#       This config file is a version of a squid proxy file optimized
+#	as a configuration for a caching proxy for Ubuntu systems.
+#
+#       More information about squid and its configuration can be found here
+#       http://www.squid-cache.org/ and in the FAQ
+
+# settings that you may want to customize
+# ---------------------------------------
+
+# this file contains private networks (10.0.0.0/8, 172.16.0.0/12,
+# 192.168.0.0/16) by default, you can add/remove additional allowed
+# source networks in it to customize it for your setup
+acl allowed_networks src "/etc/squid-deb-proxy/autogenerated/allowed-networks-src.acl"
+
+# this file contains the *archive.ubuntu.com mirrors by default,
+# if you use a different mirror, add it there
+acl to_ubuntu_mirrors dstdomain "/etc/squid-deb-proxy/autogenerated/mirror-dstdomain.acl"
+
+# this contains the package blacklist
+acl blockedpkgs urlpath_regex "/etc/squid-deb-proxy/autogenerated/pkg-blacklist-regexp.acl"
+
+# default to a different port than stock squid
+http_port 8000
+
+# -------------------------------------------------
+# settings below probably do not need customization
+
+# user visible name
+visible_hostname squid-deb-proxy
+
+# we need a big cache, some debs are huge
+maximum_object_size 512 MB
+
+# use a different dir than stock squid and default to 40G
+cache_dir aufs /var/cache/squid-deb-proxy 40000 16 256
+
+# use different logs
+cache_access_log /var/log/squid-deb-proxy/access.log
+cache_log /var/log/squid-deb-proxy/cache.log
+cache_store_log /var/log/squid-deb-proxy/store.log
+
+# tweaks to speed things up
+cache_mem 200 MB
+maximum_object_size_in_memory 10240 KB
+
+# pid
+pid_filename /var/run/squid-deb-proxy.pid
+
+# refresh pattern for debs and udebs
+refresh_pattern deb$   129600 100% 129600
+refresh_pattern udeb$   129600 100% 129600
+refresh_pattern tar.gz$  129600 100% 129600
+
+# always refresh Packages and Release files
+refresh_pattern \/(Packages|Sources)(|\.bz2|\.gz)$ 0 0% 0
+refresh_pattern \/Release(|\.gpg)$ 0 0% 0
+
+# handle meta-release and changelogs.ubuntu.com special
+refresh_pattern changelogs.ubuntu.com/*  0  1% 1
+
+# only allow connects to ports for http, https
+acl Safe_ports port 80
+acl Safe_ports port 443 563   
+
+# only allow ports we trust
+http_access deny !Safe_ports
+
+# do not allow to download from the pkg blacklist
+http_access deny blockedpkgs
+
+# allow access only to official ubuntu mirrors
+# uncomment the third and fouth line to permit any unlisted domain
+http_access deny !to_ubuntu_mirrors
+#http_access allow !to_ubuntu_mirrors
+
+# don't cache domains not listed in the mirrors file
+# uncomment the third and fourth line to cache any unlisted domains
+cache deny !to_ubuntu_mirrors
+#cache allow !to_ubuntu_mirrors
+
+# allow access from our network and localhost
+http_access allow allowed_networks
+
+# And finally deny all other access to this proxy
+http_access deny all
diff --git a/puppet/modules/squid_deb_proxy/files/allowed-networks-src.acl.d/20-custom b/puppet/modules/squid_deb_proxy/files/allowed-networks-src.acl.d/20-custom
new file mode 100644
index 00000000..d4058b80
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/allowed-networks-src.acl.d/20-custom
@@ -0,0 +1 @@
+# managed by puppet
diff --git a/puppet/modules/squid_deb_proxy/files/client/apt-avahi-discover b/puppet/modules/squid_deb_proxy/files/client/apt-avahi-discover
new file mode 100755
index 00000000..8dbc1be2
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/client/apt-avahi-discover
@@ -0,0 +1,138 @@
+#!/usr/bin/python
+#
+# use avahi to find a _apt_proxy._tcp provider and return
+# a http proxy string suitable for apt
+
+import asyncore
+import functools
+import os
+import socket
+import sys
+import time
+from subprocess	import Popen, PIPE, call
+from syslog import syslog, LOG_INFO, LOG_USER
+
+DEFAULT_CONNECT_TIMEOUT_SEC = 2
+
+def DEBUG(msg):
+    if "--debug" in sys.argv:
+        sys.stderr.write(msg + "\n")
+
+
+def get_avahi_discover_timeout():
+    APT_AVAHI_TIMEOUT_VAR = "APT::Avahi-Discover::Timeout"
+    p = Popen(
+        ["/usr/bin/apt-config", "shell", "TIMEOUT", APT_AVAHI_TIMEOUT_VAR], 
+        stdout=PIPE)
+    stdout, stderr = p.communicate()
+    if not stdout:
+        DEBUG(
+            "no timeout set, using default '%s'" % DEFAULT_CONNECT_TIMEOUT_SEC)
+        return DEFAULT_CONNECT_TIMEOUT_SEC
+    if not stdout.startswith("TIMEOUT="):
+        raise ValueError("got unexpected apt-config output: '%s'" % stdout)
+    varname, sep, value = stdout.strip().partition("=")
+    timeout = int(value.strip("'"))
+    DEBUG("using timeout: '%s'" % timeout)
+    return timeout
+
+@functools.total_ordering
+class AptAvahiClient(asyncore.dispatcher):
+    def __init__(self, addr):
+        asyncore.dispatcher.__init__(self)
+        if is_ipv6(addr[0]):
+            self.create_socket(socket.AF_INET6, socket.SOCK_STREAM)
+            self.connect( (addr[0], addr[1], 0, 0) )
+        else:
+            self.create_socket(socket.AF_INET, socket.SOCK_STREAM)
+            self.connect(addr)
+        self._time_init = time.time()
+        self.time_to_connect = sys.maxint
+        self.address = addr
+    def handle_connect(self):
+        self.time_to_connect = time.time() - self._time_init
+        self.close()
+    def __eq__(self, other):
+        return self.time_to_connect == other.time_to_connect
+    def __lt__(self, other):
+        return self.time_to_connect < other.time_to_connect
+    def __repr__(self):
+        return "<%s> %s: %s" % (
+            self.__class__.__name__, self.addr, self.time_to_connect)
+    def log(self, message):
+        syslog((LOG_INFO|LOG_USER), '%s\n' % str(message))
+    def log_info(self, message, type='info'):
+        if type not in self.ignore_log_types:
+            self.log('%s: %s' % (type, message))
+
+
+def is_ipv6(a):
+    return ':' in a
+
+def is_linklocal(addr):
+    # Link-local should start with fe80 and six null bytes
+    return addr.startswith("fe80::")
+
+def get_proxy_host_port_from_avahi():
+    service = '_apt_proxy._tcp'
+
+    # Obtain all of the services addresses from avahi, pulling the IPv6
+    # addresses to the top.
+    addr4 = []
+    addr6 = []
+    p = Popen(['avahi-browse', '-kprtf', service], stdout=PIPE)
+    DEBUG("avahi-browse output:")
+    for line in p.stdout:
+        DEBUG(" '%s'" % line)
+        if line.startswith('='):
+            tokens = line.split(';')
+            addr = tokens[7]
+            port = int(tokens[8])
+            if is_ipv6(addr):
+                # We need to skip ipv6 link-local addresses since 
+                # APT can't use them
+                if not is_linklocal(addr):
+                    addr6.append((addr, port))
+            else:
+                addr4.append((addr, port))
+
+    # Run through the offered addresses and see if we we have a bound local
+    # address for it.
+    addrs = []
+    for (ip, port) in addr6 + addr4:
+        try:
+            res = socket.getaddrinfo(ip, port, 0, 0, 0, socket.AI_ADDRCONFIG)
+            if res:
+                addrs.append((ip, port))
+        except socket.gaierror:
+            pass
+    if not addrs:
+        return None
+    
+    # sort by answering speed
+    hosts = []
+    for addr in addrs:
+        hosts.append(AptAvahiClient(addr))
+    # 2s timeout, arbitray
+    timeout = get_avahi_discover_timeout()
+    asyncore.loop(timeout=timeout)
+    DEBUG("sorted hosts: '%s'" % sorted(hosts))
+
+    # No host wanted to connect
+    if (all(h.time_to_connect == sys.maxint for h in hosts)):
+        return None
+
+    fastest_host = sorted(hosts)[0]
+    fastest_address = fastest_host.address
+    return fastest_address
+
+
+if __name__ == "__main__":
+    # Dump the approved address out in an appropriate format.
+    address = get_proxy_host_port_from_avahi()
+    if address:
+        (ip, port) = address
+        if is_ipv6(ip):
+            print "http://[%s]:%s/" % (ip, port)
+        else:
+            print "http://%s:%s/" % (ip, port)
diff --git a/puppet/modules/squid_deb_proxy/files/mirror-dstdomain.acl.d/20-custom b/puppet/modules/squid_deb_proxy/files/mirror-dstdomain.acl.d/20-custom
new file mode 100644
index 00000000..d4058b80
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/files/mirror-dstdomain.acl.d/20-custom
@@ -0,0 +1 @@
+# managed by puppet
diff --git a/puppet/modules/squid_deb_proxy/manifests/client.pp b/puppet/modules/squid_deb_proxy/manifests/client.pp
new file mode 100644
index 00000000..049f740a
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/manifests/client.pp
@@ -0,0 +1,16 @@
+# install squid-deb-proxy-client package
+class squid_deb_proxy::client {
+  package { 'squid-deb-proxy-client':
+    ensure => installed,
+  } ->
+
+  # ship newer client discover script than includes in squid-deb-proxy-client
+  # v. 0.8.13 to fix error messages being sent to stdout instead of stderr,
+  # see https://bugs.launchpad.net/ubuntu/+source/squid-deb-proxy/+bug/1505670
+  file { '/usr/share/squid-deb-proxy-client/apt-avahi-discover':
+    source => 'puppet:///modules/squid_deb_proxy/client/apt-avahi-discover',
+    mode   => '0755',
+    owner  => 'root',
+    group  => 'root',
+  }
+}
diff --git a/puppet/modules/squid_deb_proxy/manifests/server.pp b/puppet/modules/squid_deb_proxy/manifests/server.pp
new file mode 100644
index 00000000..b6c3b2ed
--- /dev/null
+++ b/puppet/modules/squid_deb_proxy/manifests/server.pp
@@ -0,0 +1,41 @@
+class squid_deb_proxy::server {
+  package { 'squid-deb-proxy':
+    ensure => installed,
+  }
+
+  service { 'squid-deb-proxy':
+    ensure    => running,
+    hasstatus => false,
+    require   => Package[ 'squid-deb-proxy' ],
+  }
+
+  file {'/etc/squid-deb-proxy/mirror-dstdomain.acl.d/20-custom':
+    source  => [ 'puppet:///modules/site_squid_deb_proxy/mirror-dstdomain.acl.d/20-custom',
+      'puppet:///modules/squid_deb_proxy/mirror-dstdomain.acl.d/20-custom' ],
+    notify  => Service[ 'squid-deb-proxy' ],
+    require => Package[ 'squid-deb-proxy' ],
+    mode    => '0644',
+    owner   => 'root',
+    group   => 'root',
+  }
+
+  file {'/etc/squid-deb-proxy/allowed-networks-src.acl.d/20-custom':
+    source  => [ 'puppet:///modules/site_squid_deb_proxy/allowed-networks-src.acl.d/20-custom',
+      'puppet:///modules/squid_deb_proxy/allowed-networks-src.acl.d/20-custom' ],
+    notify  => Service[ 'squid-deb-proxy' ],
+    require => Package[ 'squid-deb-proxy' ],
+    mode    => '0644',
+    owner   => 'root',
+    group   => 'root',
+  }
+
+  file { '/etc/squid-deb-proxy/squid-deb-proxy.conf':
+    source  => [ "puppet:///modules/site_squid_deb_proxy/${::operatingsystem}/squid-deb-proxy.conf",
+      "puppet:///modules/squid_deb_proxy/${::operatingsystem}/squid-deb-proxy.conf" ],
+    notify  => Service[ 'squid-deb-proxy' ],
+    require => Package[ 'squid-deb-proxy' ],
+    mode    => '0644',
+    owner   => 'root',
+    group   => 'root',
+  }
+}
-- 
cgit v1.2.3


From 5247b7ccf5b5889ee16262dd976b03047e34e32c Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:25 -0400
Subject: git subrepo clone https://leap.se/git/puppet_postfix
 puppet/modules/postfix

subrepo:
  subdir:   "puppet/modules/postfix"
  merged:   "cce918f"
upstream:
  origin:   "https://leap.se/git/puppet_postfix"
  branch:   "master"
  commit:   "cce918f"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I325a79fe1780ee6a5d61959310cf8e52c9a6896f
---
 puppet/modules/postfix/.gitrepo                    |  11 +
 puppet/modules/postfix/LICENSE                     | 674 +++++++++++++++++++++
 puppet/modules/postfix/README.md                   | 224 +++++++
 .../modules/postfix/files/header_checks.d/.ignore  |   0
 puppet/modules/postfix/files/main.cf               |   1 +
 puppet/modules/postfix/files/tls_policy.d/.ignore  |   0
 puppet/modules/postfix/manifests/amavis.pp         |   5 +
 puppet/modules/postfix/manifests/anonsasl.pp       |  18 +
 puppet/modules/postfix/manifests/config.pp         |  49 ++
 puppet/modules/postfix/manifests/disable.pp        |   7 +
 puppet/modules/postfix/manifests/disable/base.pp   |  12 +
 puppet/modules/postfix/manifests/disable/debian.pp |  11 +
 puppet/modules/postfix/manifests/hash.pp           |  71 +++
 puppet/modules/postfix/manifests/header_checks.pp  |  32 +
 .../postfix/manifests/header_checks_snippet.pp     |  60 ++
 puppet/modules/postfix/manifests/init.pp           | 221 +++++++
 puppet/modules/postfix/manifests/mailalias.pp      |  32 +
 puppet/modules/postfix/manifests/mailman.pp        |  34 ++
 puppet/modules/postfix/manifests/mta.pp            |  70 +++
 puppet/modules/postfix/manifests/satellite.pp      |  49 ++
 puppet/modules/postfix/manifests/smtp_auth.pp      |  37 ++
 puppet/modules/postfix/manifests/tlspolicy.pp      |  55 ++
 .../modules/postfix/manifests/tlspolicy_snippet.pp |  45 ++
 puppet/modules/postfix/manifests/transport.pp      |  44 ++
 .../modules/postfix/manifests/transport_regexp.pp  |  56 ++
 .../postfix/manifests/transport_regexp_snippet.pp  |  67 ++
 puppet/modules/postfix/manifests/virtual.pp        |  44 ++
 puppet/modules/postfix/manifests/virtual_regexp.pp |  56 ++
 .../postfix/manifests/virtual_regexp_snippet.pp    |  67 ++
 .../postfix/templates/anonsasl_header_checks.erb   |   2 +
 .../postfix/templates/master.cf.debian-5.erb       | 126 ++++
 .../postfix/templates/master.cf.debian-6.erb       | 158 +++++
 .../postfix/templates/master.cf.debian-7.erb       | 161 +++++
 .../postfix/templates/master.cf.debian-8.erb       | 160 +++++
 .../postfix/templates/master.cf.debian-sid.erb     | 157 +++++
 .../postfix/templates/master.cf.redhat5.erb        |  87 +++
 36 files changed, 2903 insertions(+)
 create mode 100644 puppet/modules/postfix/.gitrepo
 create mode 100644 puppet/modules/postfix/LICENSE
 create mode 100644 puppet/modules/postfix/README.md
 create mode 100644 puppet/modules/postfix/files/header_checks.d/.ignore
 create mode 100644 puppet/modules/postfix/files/main.cf
 create mode 100644 puppet/modules/postfix/files/tls_policy.d/.ignore
 create mode 100644 puppet/modules/postfix/manifests/amavis.pp
 create mode 100644 puppet/modules/postfix/manifests/anonsasl.pp
 create mode 100644 puppet/modules/postfix/manifests/config.pp
 create mode 100644 puppet/modules/postfix/manifests/disable.pp
 create mode 100644 puppet/modules/postfix/manifests/disable/base.pp
 create mode 100644 puppet/modules/postfix/manifests/disable/debian.pp
 create mode 100644 puppet/modules/postfix/manifests/hash.pp
 create mode 100644 puppet/modules/postfix/manifests/header_checks.pp
 create mode 100644 puppet/modules/postfix/manifests/header_checks_snippet.pp
 create mode 100644 puppet/modules/postfix/manifests/init.pp
 create mode 100644 puppet/modules/postfix/manifests/mailalias.pp
 create mode 100644 puppet/modules/postfix/manifests/mailman.pp
 create mode 100644 puppet/modules/postfix/manifests/mta.pp
 create mode 100644 puppet/modules/postfix/manifests/satellite.pp
 create mode 100644 puppet/modules/postfix/manifests/smtp_auth.pp
 create mode 100644 puppet/modules/postfix/manifests/tlspolicy.pp
 create mode 100644 puppet/modules/postfix/manifests/tlspolicy_snippet.pp
 create mode 100644 puppet/modules/postfix/manifests/transport.pp
 create mode 100644 puppet/modules/postfix/manifests/transport_regexp.pp
 create mode 100644 puppet/modules/postfix/manifests/transport_regexp_snippet.pp
 create mode 100644 puppet/modules/postfix/manifests/virtual.pp
 create mode 100644 puppet/modules/postfix/manifests/virtual_regexp.pp
 create mode 100644 puppet/modules/postfix/manifests/virtual_regexp_snippet.pp
 create mode 100644 puppet/modules/postfix/templates/anonsasl_header_checks.erb
 create mode 100644 puppet/modules/postfix/templates/master.cf.debian-5.erb
 create mode 100644 puppet/modules/postfix/templates/master.cf.debian-6.erb
 create mode 100644 puppet/modules/postfix/templates/master.cf.debian-7.erb
 create mode 100644 puppet/modules/postfix/templates/master.cf.debian-8.erb
 create mode 100644 puppet/modules/postfix/templates/master.cf.debian-sid.erb
 create mode 100644 puppet/modules/postfix/templates/master.cf.redhat5.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/postfix/.gitrepo b/puppet/modules/postfix/.gitrepo
new file mode 100644
index 00000000..dfa4389c
--- /dev/null
+++ b/puppet/modules/postfix/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_postfix
+	branch = master
+	commit = cce918f784ebf8a8875f43c79bc3a1f39ab9456b
+	parent = d8a8d30b04d34387f309d9f5b7afdbcad01f7cbc
+	cmdver = 0.3.0
diff --git a/puppet/modules/postfix/LICENSE b/puppet/modules/postfix/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/postfix/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/postfix/README.md b/puppet/modules/postfix/README.md
new file mode 100644
index 00000000..7a6b01fc
--- /dev/null
+++ b/puppet/modules/postfix/README.md
@@ -0,0 +1,224 @@
+Postfix Puppet module
+=====================
+
+This module will help install and configure postfix.
+
+A couple of classes will preconfigure postfix for common needs.
+
+This module needs:
+
+- the concat module: git://labs.riseup.net/shared-concat
+
+!! Upgrade Notice (01/2013) !!
+
+This module now uses parameterized classes, where it used global variables
+before. So please whatch out before pulling, you need to change the
+class declarations in your manifest !
+
+Issues
+------
+
+- Debian wheezy hosts (or below): If you get this error msg:
+
+    "Could not find template 'postfix/master.cf.debian-.erb' at /ssrv/leap/puppet/modules/postfix/manifests/init.pp:158 on node rew07plain1.rewire.org"
+
+  you need to use the facter package from wheezy-backports instead of the wheezy one. See https://gitlab.com/shared-puppet-modules-group/postfix/merge_requests/6#note_1892207 for more details.
+
+
+Deprecation notice
+------------------
+
+It used to be that one could drop header checks snippets into the
+following source directories:
+
+   "puppet:///modules/site-postfix/${fqdn}/header_checks.d"
+   "puppet:///modules/site-postfix/header_checks.d"
+   "puppet:///files/etc/postfix/header_checks.d"
+   "puppet:///modules/postfix/header_checks.d"
+
+... and TLS policy snippets into those:
+
+   "puppet:///modules/site-postfix/${fqdn}/tls_policy.d"
+   "puppet:///modules/site-postfix/tls_policy.d"
+   "puppet:///modules/postfix/tls_policy.d"
+
+This is not supported anymore.
+
+Every such snippet much now be configured using the (respectively)
+postfix::header_checks_snippet and postfix::tlspolicy_snippet defines.
+
+Note: You will need to set a global Exec { path => '...' } to a proper pathing
+in your manifests, or you will experience some issues such as:
+
+err: Failed to apply catalog: Parameter unless failed: 'test "x$(postconf -h relay_domains)" == 'xlocalhost host.foo.com'' is not qualified and no path was specified. Please qualify the command or specify a path.
+
+See: http://www.puppetcookbook.com/posts/set-global-exec-path.html for more
+information about how to do this
+
+Postfix class configuration parameters
+--------------------------------------
+
+ * use_amavisd => 'yes' - to include postfix::amavis
+
+ * anon_sasl => 'yes' -  to hide the originating IP in email
+   relayed for an authenticated SASL client; this needs Postfix
+   2.3 or later to work; beware! Postfix logs the header replacement
+   has been done, which means that you are storing this information,
+   unless you are anonymizing your logs.
+
+ * manage_header_checks => 'yes' - to manage header checks (see
+   postfix::header_checks for details)
+
+ * manage_transport_regexp => 'yes' - to manage header checks (see
+   postfix::transport_regexp for details)
+
+ * manage_virtual_regexp => 'yes' - to manage header checks (see
+   postfix::virtual_regexp for details)
+
+ * manage_tls_policy => 'yes - to manage TLS policy (see
+   postfix::tlspolicy for details)
+
+ * inet_interfaces: by default, postfix will bind to all interfaces, but
+   sometimes you don't want that. To bind to specific interfaces, use the
+   'inet_interfaces' parameter and set it to exactly what would be in the
+   main.cf file.
+
+ * myorigin: some hosts have weird-looking host names (dedicated servers and VPSes). To
+   set the server's domain of origin, set the 'myorigin' parameter
+
+ * smtp_listen: address on which the smtp service will listen (Default: 127.0.0.1)
+
+ * root_mail_recipient: who will receive root's emails (Default: 'nobody')
+
+ * tls_fingerprint_digest: fingerprint digest for tls policy class (Default: 'sha1')
+
+ * use_dovecot_lda: include dovecot declaration at master.cf
+
+ * use_schleuder: whether to include schleuder portion at master.cf
+
+ * use_sympa: whether to include sympa portion at master.cf
+
+ * use_firma: whether to include firma portion at master.cf
+
+ * use_mlmmj: whether to include mlmmj portion at master.cf
+
+ * use_submission: set to "yes" to enable submission section at master.cf
+
+ * use_smtps: set to "yes" to enable smtps section at master.cf
+
+ * mastercf_tail: set this for additional content to be added at the end of master.cf
+
+== Examples:
+
+  class { 'postfix': }
+
+  class { 'postfix': anon_sasl => 'yes', myorigin => 'foo.bar.tz' }
+
+  postfix::config { "relay_domains": value  => "localhost host.foo.com" }
+
+
+Convience classes
+=================
+
+postfix::config
+---------------
+this can be used to pass arbitrary postfix configurations by passing the $name
+to postconf to add/alter/remove options in main.cf
+
+Parameters:
+- *name*: name of the parameter.
+- *ensure*: present/absent. defaults to present.
+- *value*: value of the parameter.
+- *nonstandard*: inform postfix::config that this parameter is not recognized
+  by the "postconf" command. defaults to false.
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+    postfix::config {
+      "smtp_use_tls"            => "yes";
+      "smtp_sasl_auth_enable"   => "yes";
+      "smtp_sasl_password_maps" => "hash:/etc/postfix/my_sasl_passwords";
+      "relayhost"               => "[mail.example.com]:587";
+    }
+
+
+postfix::disable
+----------------
+If you include this class, the postfix package will be removed and the service
+stopped.
+
+
+postfix::hash
+-------------
+This can be used to create postfix hashed "map" files. It will create "${name}",
+and then build "${name}.db" using the "postmap" command. The map file can then
+be referred to using postfix::config.
+
+Parameters:
+- *name*: the name of the map file.
+- *ensure*: present/absent, defaults to present.
+- *source*: file source.
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+    postfix::hash { "/etc/postfix/virtual":
+      ensure => present,
+    }
+    postfix::config { "virtual_alias_maps":
+      value => "hash:/etc/postfix/virtual"
+    }
+
+
+postfix::virtual
+----------------
+Manages content of the /etc/postfix/virtual map
+
+Parameters:
+- *name*: name of address postfix will lookup. See virtual(8).
+- *destination*: where the emails will be delivered to. See virtual(8).
+- *ensure*: present/absent, defaults to present.
+
+Requires:
+- Class["postfix"]
+- Postfix::Hash["/etc/postfix/virtual"]
+- Postfix::Config["virtual_alias_maps"]
+- common::line (from module common)
+
+Example usage:
+
+    postfix::hash { "/etc/postfix/virtual":
+      ensure => present,
+    }
+    postfix::config { "virtual_alias_maps":
+      value => "hash:/etc/postfix/virtual"
+    }
+    postfix::virtual { "user@example.com":
+      ensure      => present,
+      destination => "root",
+    }
+
+postfix::mailalias
+------------------
+Wrapper around Puppet mailalias resource, provides newaliases executable.
+
+Parameters:
+- *name*: the name of the alias.
+- *ensure*: present/absent, defaults to present.
+- *recipient*: recipient of the alias.
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+    postfix::mailalias { "postmaster":
+      ensure => present,
+      recipient => 'foo'
+    }
+
diff --git a/puppet/modules/postfix/files/header_checks.d/.ignore b/puppet/modules/postfix/files/header_checks.d/.ignore
new file mode 100644
index 00000000..e69de29b
diff --git a/puppet/modules/postfix/files/main.cf b/puppet/modules/postfix/files/main.cf
new file mode 100644
index 00000000..ec649c71
--- /dev/null
+++ b/puppet/modules/postfix/files/main.cf
@@ -0,0 +1 @@
+# file managed by puppet
diff --git a/puppet/modules/postfix/files/tls_policy.d/.ignore b/puppet/modules/postfix/files/tls_policy.d/.ignore
new file mode 100644
index 00000000..e69de29b
diff --git a/puppet/modules/postfix/manifests/amavis.pp b/puppet/modules/postfix/manifests/amavis.pp
new file mode 100644
index 00000000..b6639234
--- /dev/null
+++ b/puppet/modules/postfix/manifests/amavis.pp
@@ -0,0 +1,5 @@
+class postfix::amavis {
+  postfix::config {
+    "content_filter": value => "amavis:[127.0.0.1]:10024";
+  }
+}
diff --git a/puppet/modules/postfix/manifests/anonsasl.pp b/puppet/modules/postfix/manifests/anonsasl.pp
new file mode 100644
index 00000000..ca97f199
--- /dev/null
+++ b/puppet/modules/postfix/manifests/anonsasl.pp
@@ -0,0 +1,18 @@
+class postfix::anonsasl {
+
+  include postfix::header_checks
+
+  postfix::config {
+    'smtpd_sasl_authenticated_header':
+      value => 'yes';
+  }
+
+  postfix::header_checks_snippet {
+    'anonsasl':
+      content => template("postfix/anonsasl_header_checks.erb"),
+      require => [
+                  Postfix::Config['smtpd_sasl_authenticated_header'],
+                  ];
+  }
+  
+}
diff --git a/puppet/modules/postfix/manifests/config.pp b/puppet/modules/postfix/manifests/config.pp
new file mode 100644
index 00000000..ce7af9e4
--- /dev/null
+++ b/puppet/modules/postfix/manifests/config.pp
@@ -0,0 +1,49 @@
+/*
+== Definition: postfix::config
+
+Uses the "postconf" command to add/alter/remove options in postfix main
+configuation file (/etc/postfix/main.cf).
+
+Parameters:
+- *name*: name of the parameter.
+- *ensure*: present/absent. defaults to present.
+- *value*: value of the parameter.
+- *nonstandard*: inform postfix::config that this parameter is not recognized
+  by the "postconf" command. defaults to false.
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+  node "toto.example.com" {
+
+    class { 'postfix': }
+
+    postfix::config {
+      "smtp_use_tls"            => "yes";
+      "smtp_sasl_auth_enable"   => "yes";
+      "smtp_sasl_password_maps" => "hash:/etc/postfix/my_sasl_passwords";
+      "relayhost"               => "[mail.example.com]:587";
+    }
+  }
+
+*/
+define postfix::config ($ensure = present, $value, $nonstandard = false) {
+  case $ensure {
+    present: {
+      exec {"postconf -e ${name}='${value}'":
+        unless  => $nonstandard ? {
+          false => "test \"x$(postconf -h ${name})\" = 'x${value}'",
+          true  => "test \"x$(egrep '^${name} ' /etc/postfix/main.cf | cut -d= -f2 | cut -d' ' -f2)\" = 'x${value}'",
+        },
+        notify  => Service["postfix"],
+        require => File["/etc/postfix/main.cf"],
+      }
+    }
+
+    absent: {
+      fail "postfix::config ensure => absent: Not implemented"
+    }
+  }
+}
diff --git a/puppet/modules/postfix/manifests/disable.pp b/puppet/modules/postfix/manifests/disable.pp
new file mode 100644
index 00000000..c233ec6d
--- /dev/null
+++ b/puppet/modules/postfix/manifests/disable.pp
@@ -0,0 +1,7 @@
+# remove postfix
+class postfix::disable {
+  case $::operatingsystem {
+    debian: { include postfix::disable::debian }
+    default: { include postfix::disable::base }
+  }
+}
diff --git a/puppet/modules/postfix/manifests/disable/base.pp b/puppet/modules/postfix/manifests/disable/base.pp
new file mode 100644
index 00000000..5c56c709
--- /dev/null
+++ b/puppet/modules/postfix/manifests/disable/base.pp
@@ -0,0 +1,12 @@
+class postfix::disable::base {
+
+  service{'postfix':
+    ensure => stopped,
+    enable => false,
+  }
+  package{'postfix':
+    ensure => absent,
+    require => Service['postfix'],
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/disable/debian.pp b/puppet/modules/postfix/manifests/disable/debian.pp
new file mode 100644
index 00000000..213efc50
--- /dev/null
+++ b/puppet/modules/postfix/manifests/disable/debian.pp
@@ -0,0 +1,11 @@
+# debian has some issues with absent
+# init scripts.
+# It's a bug in debian's provider that should be fixed in puppet, but in the
+# meantime we need this hack.
+#
+# see: https://projects.puppetlabs.com/issues/9381
+class postfix::disable::debian inherits postfix::disable::base {
+  Service['postfix']{
+    hasstatus => false,
+  }
+}
diff --git a/puppet/modules/postfix/manifests/hash.pp b/puppet/modules/postfix/manifests/hash.pp
new file mode 100644
index 00000000..006f8815
--- /dev/null
+++ b/puppet/modules/postfix/manifests/hash.pp
@@ -0,0 +1,71 @@
+/*
+== Definition: postfix::hash
+
+Creates postfix hashed "map" files. It will create "${name}", and then build
+"${name}.db" using the "postmap" command. The map file can then be referred to
+using postfix::config.
+
+Parameters:
+- *name*: the name of the map file.
+- *ensure*: present/absent, defaults to present.
+- *source*: file source.
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+  node "toto.example.com" {
+
+    class { 'postfix': }
+
+    postfix::hash { "/etc/postfix/virtual":
+      ensure => present,
+    }
+    postfix::config { "virtual_alias_maps":
+      value => "hash:/etc/postfix/virtual"
+    }
+  }
+
+*/
+define postfix::hash ($ensure="present", $source = false) {
+  include ::postfix
+  case $source {
+    false: {
+      file {"${name}":
+        ensure  => $ensure,
+        mode    => 600,
+        owner   => root,
+        group   => root,
+        seltype => $postfix::postfix_seltype,
+        require => Package["postfix"],
+      }
+    }
+    default: {
+      file {"${name}":
+        ensure  => $ensure,
+        mode    => 600,
+        owner   => root,
+        group   => root,
+        source  => $source,
+        seltype => $postfix::postfix_seltype,
+        require => Package["postfix"],
+      }
+    }
+  }
+
+  file {"${name}.db":
+    ensure  => $ensure,
+    mode    => 600,
+    require => [File["${name}"], Exec["generate ${name}.db"]],
+    seltype => $postfix::postfix_seltype,
+  }
+
+  exec {"generate ${name}.db":
+    command => "postmap ${name}",
+    #creates => "${name}.db", # this prevents postmap from being run !
+    subscribe => File["${name}"],
+    refreshonly => true,
+    require => Package["postfix"],
+  }
+}
diff --git a/puppet/modules/postfix/manifests/header_checks.pp b/puppet/modules/postfix/manifests/header_checks.pp
new file mode 100644
index 00000000..5b0c3c86
--- /dev/null
+++ b/puppet/modules/postfix/manifests/header_checks.pp
@@ -0,0 +1,32 @@
+#
+# == Class: postfix::header_checks
+#
+# Manages Postfix header_checks by merging snippets configured
+# via postfix::header_checks_snippet defines
+#
+# Note that this class is useless when used directly.
+# The postfix::header_checks_snippet defines takes care of importing
+# it anyway.
+#
+class postfix::header_checks {
+
+  concat { '/etc/postfix/header_checks':
+    owner => root,
+    group => root,
+    mode  => '0600',
+  }
+
+  postfix::config { "header_checks":
+    value   => 'regexp:/etc/postfix/header_checks',
+    require => Concat['/etc/postfix/header_checks'],
+  }
+
+  # Cleanup previous implementation's internal files
+  include common::moduledir
+  file { "${common::moduledir::module_dir_path}/postfix/header_checks":
+    ensure  => absent,
+    recurse => true,
+    force   => true,
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/header_checks_snippet.pp b/puppet/modules/postfix/manifests/header_checks_snippet.pp
new file mode 100644
index 00000000..05929a33
--- /dev/null
+++ b/puppet/modules/postfix/manifests/header_checks_snippet.pp
@@ -0,0 +1,60 @@
+/*
+== Definition: postfix::header_checks_snippet
+
+Adds a header_checks snippets to /etc/postfix/header_checks.
+See the postfix::header_checks class for details.
+
+Parameters:
+- *source* or *content*: source or content of the header_checks snippet
+- *ensure*: present (default) or absent
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+  node "toto.example.com" {
+    class { 'postfix': }
+    postfix::header_checks_snippet {
+      'wrong_date': content => 'FIXME';
+      'bla':        source => 'puppet:///files/etc/postfix/header_checks.d/bla';
+    }
+  }
+
+*/
+
+define postfix::header_checks_snippet (
+  $ensure  = "present",
+  $source = '',
+  $content = undef
+) {
+
+  if $source == '' and $content == undef {
+    fail("One of \$source or \$content must be specified for postfix::header_checks_snippet ${name}")
+  }
+
+  if $source != '' and $content != undef {
+    fail("Only one of \$source or \$content must specified for postfix::header_checks_snippet ${name}")
+  }
+
+  include postfix::header_checks
+
+  $fragment = "postfix_header_checks_${name}"
+
+  concat::fragment { "$fragment":
+    ensure  => "$ensure",
+    target  => '/etc/postfix/header_checks',
+  }
+
+  if $source {
+    Concat::Fragment["$fragment"] {
+      source => $source,
+    }
+  }
+  else {
+    Concat::Fragment["$fragment"] {
+      content => $content,
+    }
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/init.pp b/puppet/modules/postfix/manifests/init.pp
new file mode 100644
index 00000000..45c8e0c9
--- /dev/null
+++ b/puppet/modules/postfix/manifests/init.pp
@@ -0,0 +1,221 @@
+#
+# == Class: postfix
+#
+# This class provides a basic setup of postfix with local and remote
+# delivery and an SMTP server listening on the loopback interface.
+#
+# Parameters:
+# - *$smtp_listen*: address on which the smtp service will listen to. defaults to 127.0.0.1
+# - *$root_mail_recipient*: who will recieve root's emails. defaults to "nobody"
+# - *$anon_sasl*: set $anon_sasl="yes" to hide the originating IP in email
+# - *$manage_header_checks*: manage header checks
+# - *$manage_tls_policy*: manage tls policy
+# - *$manage_transport_regexp*: manage transport regexps
+# - *$manage_virtual_regexp*: manage virtual regexps
+# - *$tls_fingerprint_digest*: fingerprint digest for tls policy class
+# - *$use_amavisd*: set to "yes" to configure amavis
+# - *$use_dovecot_lda*: include dovecot declaration at master.cf
+# - *$use_schleuder*: whether to include schleuder portion at master.cf
+# - *$use_sympa*: whether to include sympa portion at master.cf
+# - *$use_firma*: whether to include firma portion at master.cf
+# - *$use_mlmmj*: whether to include mlmmj portion at master.cf
+# - *$use_submission*: set to "yes" to enable submission section at master.cf
+# - *$use_smtps*: set to "yes" to enable smtps section at master.cf
+# - *$mastercf_tail*: set this for additional content to be added at the end of master.cf
+# - *$inet_interfaces*: which inet interface postfix should listen on
+# - *$myorigin*: sets postfix $myorigin configuration
+#
+# Example usage:
+#
+#   node "toto.example.com" {
+#     class { 'postfix':
+#       smtp_listen => "192.168.1.10"
+#     }
+#   }
+#
+class postfix(
+  $smtp_listen             = '127.0.0.1',
+  $root_mail_recipient     = 'nobody',
+  $anon_sasl               = 'no',
+  $manage_header_checks    = 'no',
+  $manage_tls_policy       = 'no',
+  $manage_transport_regexp = 'no',
+  $manage_virtual_regexp   = 'no',
+  $tls_fingerprint_digest  = 'sha1',
+  $use_amavisd             = 'no',
+  $use_dovecot_lda         = 'no',
+  $use_schleuder           = 'no',
+  $use_sympa               = 'no',
+  $use_firma               = 'no',
+  $use_mlmmj               = 'no',
+  $use_postscreen          = 'no',
+  $use_submission          = 'no',
+  $use_smtps               = 'no',
+  $mastercf_tail           = '',
+  $inet_interfaces         = 'all',
+  $myorigin                = $::fqdn,
+  $mailname                = $::fqdn,
+  $preseed                 = false,
+  $default_alias_maps      = true
+) {
+
+  case $::operatingsystem {
+
+    'RedHat', 'CentOS': {
+      $master_cf_template = 'postfix/master.cf.redhat5.erb'
+
+      # selinux labels differ from one distribution to another
+      case $::operatingsystemmajrelease {
+        '4':     { $postfix_seltype = 'etc_t' }
+        '5':     { $postfix_seltype = 'postfix_etc_t' }
+        default: { $postfix_seltype = undef }
+      }
+
+      postfix::config {
+        'sendmail_path': value => '/usr/sbin/sendmail.postfix';
+        'newaliases_path': value => '/usr/bin/newaliases.postfix';
+        'mailq_path': value => '/usr/bin/mailq.postfix';
+      }
+    }
+
+    'Debian': {
+      case $::operatingsystemrelease {
+        /^5.*/: {
+          $master_cf_template = 'postfix/master.cf.debian-5.erb'
+        }
+        /^6.*/: {
+          $master_cf_template = 'postfix/master.cf.debian-6.erb'
+        }
+        /^7.*/: {
+          $master_cf_template = 'postfix/master.cf.debian-7.erb'
+        }
+        default:  {
+          $master_cf_template = "postfix/master.cf.debian-${::operatingsystemmajrelease}.erb"
+        }
+      }
+    }
+
+    'Ubuntu': {
+      $master_cf_template = 'postfix/master.cf.debian-sid.erb'
+    }
+
+    default: {
+      $postfix_seltype    = undef
+      $master_cf_template = undef
+    }
+  }
+
+
+  # Bootstrap moduledir
+  include common::moduledir
+  common::module_dir{'postfix': }
+
+  # Include optional classes
+  if $anon_sasl == 'yes' {
+    include postfix::anonsasl
+  }
+  # this global variable needs to get parameterized as well
+  if $::header_checks == 'yes' {
+    include postfix::header_checks
+  }
+  if $manage_tls_policy == 'yes' {
+    class { 'postfix::tlspolicy':
+      fingerprint_digest => $tls_fingerprint_digest,
+    }
+  }
+  if $use_amavisd == 'yes' {
+    include postfix::amavis
+  }
+  if $manage_transport_regexp == 'yes' {
+    include postfix::transport_regexp
+  }
+  if $manage_virtual_regexp == 'yes' {
+    include postfix::virtual_regexp
+  }
+
+  package { 'mailx':
+    ensure => installed
+  }
+
+  if ( $preseed ) {
+    apt::preseeded_package { 'postfix':
+      ensure  => installed,
+    }
+  } else {
+    package { 'postfix':
+      ensure => installed
+    }
+  }
+
+  if $::operatingsystem == 'debian' {
+    Package[mailx] { name => 'bsd-mailx' }
+  }
+
+  service { 'postfix':
+    ensure  => running,
+    require => Package['postfix'],
+  }
+
+  file { '/etc/mailname':
+    ensure  => present,
+    content => "${::fqdn}\n",
+    seltype => $postfix_seltype,
+  }
+
+  # Aliases
+  file { '/etc/aliases':
+    ensure  => present,
+    content => "# file managed by puppet\n",
+    replace => false,
+    seltype => $postfix_seltype,
+    notify  => Exec['newaliases'],
+  }
+
+  # Aliases
+  exec { 'newaliases':
+    command     => '/usr/bin/newaliases',
+    refreshonly => true,
+    require     => Package['postfix'],
+    subscribe   => File['/etc/aliases'],
+  }
+
+  # Config files
+  file { '/etc/postfix/master.cf':
+    ensure  => present,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template($master_cf_template),
+    seltype => $postfix_seltype,
+    notify  => Service['postfix'],
+    require => Package['postfix'],
+  }
+
+  # Config files
+  file { '/etc/postfix/main.cf':
+    ensure  => present,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    source  => 'puppet:///modules/postfix/main.cf',
+    replace => false,
+    seltype => $postfix_seltype,
+    notify  => Service['postfix'],
+    require => Package['postfix'],
+  }
+
+  # Default configuration parameters
+  if $default_alias_maps {
+    postfix::config {
+      'alias_maps': value => 'hash:/etc/aliases';
+    }
+  }
+  postfix::config {
+    'myorigin':        value => $myorigin;
+    'inet_interfaces': value => $inet_interfaces;
+  }
+
+  postfix::mailalias {'root':
+    recipient => $root_mail_recipient,
+  }
+}
diff --git a/puppet/modules/postfix/manifests/mailalias.pp b/puppet/modules/postfix/manifests/mailalias.pp
new file mode 100644
index 00000000..2f239ac3
--- /dev/null
+++ b/puppet/modules/postfix/manifests/mailalias.pp
@@ -0,0 +1,32 @@
+/*
+== Definition: postfix::mailalias
+
+Wrapper around Puppet mailalias resource, provides newaliases executable.
+
+Parameters:
+- *name*: the name of the alias.
+- *ensure*: present/absent, defaults to present.
+- *recipient*: recipient of the alias.
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+  node "toto.example.com" {
+
+    class { 'postfix': }
+
+    postfix::mailalias { "postmaster":
+      ensure => present,
+      recipient => 'foo'
+  }
+
+*/
+define postfix::mailalias ($ensure = 'present', $recipient) {
+    mailalias { "${name}":
+        ensure => $ensure,
+        recipient => $recipient,
+        notify => Exec['newaliases']
+    }
+}
diff --git a/puppet/modules/postfix/manifests/mailman.pp b/puppet/modules/postfix/manifests/mailman.pp
new file mode 100644
index 00000000..8c6ee32c
--- /dev/null
+++ b/puppet/modules/postfix/manifests/mailman.pp
@@ -0,0 +1,34 @@
+#
+# == Class: postfix::mailman
+#
+# Configures a basic smtp server, able to work for the mailman mailing-list
+# manager.
+#
+# Example usage:
+#
+#   node "toto.example.com" {
+#     include mailman
+#     class { 'postfix::mailman': }
+#   }
+#
+class postfix::mailman {
+  class { 'postfix':
+    smtp_listen => "0.0.0.0",
+  }
+
+  postfix::config {
+    "mydestination":                        value => "";
+    "virtual_alias_maps":                   value => "hash:/etc/postfix/virtual";
+    "transport_maps":                       value => "hash:/etc/postfix/transport";
+    "mailman_destination_recipient_limit":  value => "1", nonstandard => true;
+  }
+
+  postfix::hash { "/etc/postfix/virtual":
+    ensure => present,
+  }
+
+  postfix::hash { "/etc/postfix/transport":
+    ensure => present,
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/mta.pp b/puppet/modules/postfix/manifests/mta.pp
new file mode 100644
index 00000000..f7a865db
--- /dev/null
+++ b/puppet/modules/postfix/manifests/mta.pp
@@ -0,0 +1,70 @@
+#
+# == Class: postfix::mta
+#
+# This class configures a minimal MTA, listening on
+# $postfix_smtp_listen (default to localhost) and delivering mail to
+# $postfix_mydestination (default to $fqdn).
+#
+# A valid relay host is required ($postfix_relayhost) for outbound email.
+#
+# transport & virtual maps get configured and can be populated with
+# postfix::transport and postfix::virtual
+#
+# Parameters:
+# - *$postfix_relayhost*
+# - *$postfix_mydestination*
+# - every global variable which works for class "postfix" will work here.
+#
+# Requires:
+# - Class["postfix"]
+#
+# Example usage:
+#
+#   node "toto.example.com" {
+#
+#     class { 'postfix':
+#       smtp_listen => "0.0.0.0",
+#     }
+#
+#     class { 'postfix::mta':
+#       relayhost     => "mail.example.com",
+#       mydestination => "\$myorigin, myapp.example.com",
+#     }
+#
+#     postfix::transport { "myapp.example.com":
+#       ensure => present,
+#       destination => "local:",
+#     }
+#   }
+#
+class postfix::mta(
+  $mydestination = '',
+  $relayhost     = ''
+) {
+
+  #case $relayhost {
+  #  "":   { fail("Required relayhost parameter is not defined.") }
+  #}
+
+  case $mydestination {
+    "": { $postfix_mydestination = "\$myorigin" }
+    default: { $postfix_mydestination = "$mydestination" }
+  }
+
+  postfix::config {
+    "mydestination":                        value => $postfix_mydestination;
+    "mynetworks":                           value => "127.0.0.0/8";
+    "relayhost":                            value => $relayhost;
+    "virtual_alias_maps":                   value => "hash:/etc/postfix/virtual";
+    "transport_maps":                       value => "hash:/etc/postfix/transport";
+  }
+
+  postfix::hash { "/etc/postfix/virtual":
+    ensure => present,
+  }
+
+  postfix::hash { "/etc/postfix/transport":
+    ensure => present,
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/satellite.pp b/puppet/modules/postfix/manifests/satellite.pp
new file mode 100644
index 00000000..c6c1a0e4
--- /dev/null
+++ b/puppet/modules/postfix/manifests/satellite.pp
@@ -0,0 +1,49 @@
+#
+# == Class: postfix::satellite
+#
+# This class configures all local email (cron, mdadm, etc) to be forwarded
+# to $root_mail_recipient, using $postfix_relayhost as a relay.
+#
+# $valid_fqdn can be set to override $fqdn in the case where the FQDN is
+# not recognized as valid by the destination server.
+#
+# Parameters:
+# - *valid_fqdn*
+# - every global variable which works for class "postfix" will work here.
+#
+# Example usage:
+#
+#   node "toto.local.lan" {
+#     class { 'postfix::satellite':
+#       relayhost           => "mail.example.com"
+#       valid_fqdn          => "toto.example.com"
+#       root_mail_recipient => "the.sysadmin@example.com"
+#     }
+#   }
+#
+class postfix::satellite(
+  $relayhost           = '',
+  $valid_fqdn          = $::fqdn,
+  $root_mail_recipient = ''
+) {
+
+  # If $valid_fqdn is provided, use it to override $fqdn
+  if $valid_fqdn != $::fdqn {
+    $fqdn = $valid_fqdn
+  }
+
+  class { 'postfix':
+    root_mail_recipient => $root_mail_recipient,
+    myorigin            => $valid_fqdn,
+    mailname            => $valid_fqdn
+  }
+
+  class { 'postfix::mta':
+    relayhost => $relayhost,
+  }
+
+  postfix::virtual {"@${valid_fqdn}":
+    ensure      => present,
+    destination => "root",
+  }
+}
diff --git a/puppet/modules/postfix/manifests/smtp_auth.pp b/puppet/modules/postfix/manifests/smtp_auth.pp
new file mode 100644
index 00000000..b553fb5b
--- /dev/null
+++ b/puppet/modules/postfix/manifests/smtp_auth.pp
@@ -0,0 +1,37 @@
+# == Definition: postfix::smtp_auth
+#
+# Manages content of the /etc/postfix/smtp_auth map.
+#
+# Requires:
+#   - Class["postfix"]
+#   - Postfix::Hash["/etc/postfix/smtp_auth"]
+#   - file_line (from puppetlab's stdlib module)
+#
+# Example usage:
+#
+#  node 'toto.example.com' {
+#
+#    include postfix
+#
+#    postfix::hash { '/etc/postfix/smtp_auth':
+#      ensure => present,
+#    }
+#    postfix::config { 'smtp_auth_maps':
+#      value => 'hash:/etc/postfix/smtp_auth'
+#    }
+#    postfix::smtp_auth { 'gmail.com':
+#      ensure   => present,
+#      user     => 'USER',
+#      password => 'PW',
+#    }
+#  }
+
+define postfix::smtp_auth ($user, $password, $ensure=present) {
+  file_line { $name:
+    ensure  => $ensure,
+    path    => '/etc/postfix/smtp_auth',
+    line    => "${name} ${user}:${password}",
+    notify  => Exec['generate /etc/postfix/smtp_auth.db'],
+    require => Package['postfix'],
+  }
+}
diff --git a/puppet/modules/postfix/manifests/tlspolicy.pp b/puppet/modules/postfix/manifests/tlspolicy.pp
new file mode 100644
index 00000000..d9017108
--- /dev/null
+++ b/puppet/modules/postfix/manifests/tlspolicy.pp
@@ -0,0 +1,55 @@
+#
+# == Class: postfix::tlspolicy
+#
+# Manages Postfix TLS policy by merging policy snippets configured
+# via postfix::tlspolicy_snippet defines
+#
+# Parameters:
+# - $fingerprint_digest (defaults to sha1)
+#
+# Note that this class is useless when used directly.
+# The postfix::tlspolicy_snippet defines takes care of importing
+# it anyway.
+#
+class postfix::tlspolicy(
+  $fingerprint_digest = 'sha1'
+) {
+
+  include common::moduledir
+  common::module_dir{'postfix/tls_policy': }
+
+  $postfix_tlspolicy_dir          = "${common::moduledir::module_dir_path}/postfix/tls_policy"
+  $postfix_merged_tlspolicy       = "${postfix_tlspolicy_dir}/merged_tls_policy"
+
+  concat { "$postfix_merged_tlspolicy":
+    require => File[$postfix_tlspolicy_dir],
+    owner   => root,
+    group   => root,
+    mode    => '0600',
+  }
+
+  postfix::hash { '/etc/postfix/tls_policy':
+    source    => "$postfix_merged_tlspolicy",
+    subscribe => File["$postfix_merged_tlspolicy"],
+  }
+
+  postfix::config {
+    'smtp_tls_fingerprint_digest': value => "$fingerprint_digest";
+  }
+
+  postfix::config { 'smtp_tls_policy_maps':
+    value   => 'hash:/etc/postfix/tls_policy',
+    require => [
+                Postfix::Hash['/etc/postfix/tls_policy'],
+                Postfix::Config['smtp_tls_fingerprint_digest'],
+               ],
+  }
+
+  # Cleanup previous implementation's internal files
+  file { "${postfix_tlspolicy_dir}/tls_policy.d":
+    ensure  => absent,
+    recurse => true,
+    force   => true,
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/tlspolicy_snippet.pp b/puppet/modules/postfix/manifests/tlspolicy_snippet.pp
new file mode 100644
index 00000000..b63f812c
--- /dev/null
+++ b/puppet/modules/postfix/manifests/tlspolicy_snippet.pp
@@ -0,0 +1,45 @@
+/*
+== Definition: postfix::tlspolicy_snippet
+
+Adds a TLS policy snippets to /etc/postfix/tls_policy.
+See the postfix::tlspolicy class for details.
+
+Parameters:
+- *name*: name of destination domain Postfix will lookup. See TLS_README.
+- *value*: right-hand part of the tls_policy map
+- *ensure*: present/absent, defaults to present.
+
+Requires:
+- Class["postfix"]
+- Class["postfix::tlspolicy"]
+
+Example usage:
+
+  node "toto.example.com" {
+    class { 'postfix':
+      manage_tls_policy => 'yes',
+    }
+    postfix::tlspolicy_snippet {
+      'example.com':  value => 'encrypt';
+      '.example.com': value => 'encrypt';
+      'nothing.com':  value => 'fingerprint match=2A:FF:F0:EC:52:04:99:45:73:1B:C2:22:7F:FD:31:6B:8F:07:43:29';
+    }
+  }
+
+*/
+
+define postfix::tlspolicy_snippet ($ensure="present", $value = false) {
+
+  if ($value == false) and ($ensure == "present") {
+    fail("The value parameter must be set when using the postfix::tlspolicy_snippet define with ensure=present.")
+  }
+
+  include postfix::tlspolicy
+
+  concat::fragment { "postfix_tlspolicy_${name}":
+    ensure  => "$ensure",
+    content => "${name}		${value}\n",
+    target  => "$postfix::tlspolicy::postfix_merged_tlspolicy",
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/transport.pp b/puppet/modules/postfix/manifests/transport.pp
new file mode 100644
index 00000000..08b93e5e
--- /dev/null
+++ b/puppet/modules/postfix/manifests/transport.pp
@@ -0,0 +1,44 @@
+/*
+== Definition: postfix::transport
+
+Manages content of the /etc/postfix/transport map.
+
+Parameters:
+- *name*: name of address postfix will lookup. See transport(5).
+- *destination*: where the emails will be delivered to. See transport(5).
+- *ensure*: present/absent, defaults to present.
+
+Requires:
+- Class["postfix"]
+- Postfix::Hash["/etc/postfix/transport"]
+- Postfix::Config["transport_maps"]
+- file_line (from module stdlib)
+
+Example usage:
+
+  node "toto.example.com" {
+
+    class { 'postfix': }
+
+    postfix::hash { "/etc/postfix/transport":
+      ensure => present,
+    }
+    postfix::config { "transport_maps":
+      value => "hash:/etc/postfix/transport"
+    }
+    postfix::transport { "mailman.example.com":
+      ensure      => present,
+      destination => "mailman",
+    }
+  }
+
+*/
+define postfix::transport ($ensure="present", $destination) {
+  file_line {"${name} ${destination}":
+    ensure => $ensure,
+    path   => "/etc/postfix/transport",
+    line   => "${name} ${destination}",
+    notify => Exec["generate /etc/postfix/transport.db"],
+    require => Package["postfix"],
+  }
+}
diff --git a/puppet/modules/postfix/manifests/transport_regexp.pp b/puppet/modules/postfix/manifests/transport_regexp.pp
new file mode 100644
index 00000000..4961141e
--- /dev/null
+++ b/puppet/modules/postfix/manifests/transport_regexp.pp
@@ -0,0 +1,56 @@
+#
+# == Class: postfix::transport_regexp
+#
+# Manages Postfix transport_regexp by merging snippets shipped:
+# - in the module's files/transport_regexp.d/ or puppet:///files/etc/postfix/transport_regexp.d
+#   (the latter takes precedence if present); site_postfix module is supported
+#   as well, see the source argument of file {"$postfix_transport_regexp_snippets_dir"
+#   bellow for details.
+# - via postfix::transport_regexp_snippet defines
+#
+# Example usage:
+# 
+#   node "toto.example.com" {
+#     class { 'postfix':
+#       manage_transport_regexp => 'yes',
+#     }
+#     postfix::config { "transport_maps":
+#       value => "hash:/etc/postfix/transport, regexp:/etc/postfix/transport_regexp",
+#     }
+#   }
+#
+class postfix::transport_regexp {
+
+  include common::moduledir
+  common::module_dir{'postfix/transport_regexp': }
+
+  $postfix_transport_regexp_dir          = "${common::moduledir::module_dir_path}/postfix/transport_regexp"
+  $postfix_transport_regexp_snippets_dir = "${postfix_transport_regexp_dir}/transport_regexp.d"
+  $postfix_merged_transport_regexp       = "${postfix_transport_regexp_dir}/merged_transport_regexp"
+
+  file {"$postfix_transport_regexp_snippets_dir":
+    ensure  => 'directory',
+    owner   => 'root',
+    group   => '0',
+    mode    => '700',
+    source  => [
+                "puppet:///modules/site_postfix/${fqdn}/transport_regexp.d",
+                "puppet:///modules/site_postfix/transport_regexp.d",
+                "puppet:///files/etc/postfix/transport_regexp.d",
+                "puppet:///modules/postfix/transport_regexp.d",
+               ],
+    recurse => true,
+    purge   => false,
+  }
+
+  concatenated_file { "$postfix_merged_transport_regexp":
+    dir     => "${postfix_transport_regexp_snippets_dir}",
+    require => File["$postfix_transport_regexp_snippets_dir"],
+  }
+  
+  config_file { '/etc/postfix/transport_regexp':
+    source    => "$postfix_merged_transport_regexp",
+    subscribe => File["$postfix_merged_transport_regexp"],
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/transport_regexp_snippet.pp b/puppet/modules/postfix/manifests/transport_regexp_snippet.pp
new file mode 100644
index 00000000..2b13ed14
--- /dev/null
+++ b/puppet/modules/postfix/manifests/transport_regexp_snippet.pp
@@ -0,0 +1,67 @@
+/*
+== Definition: postfix::transport_regexp_snippet
+
+Adds a transport_regexp snippets to /etc/postfix/transport_regexp.
+See the postfix::transport_regexp class for details.
+
+Parameters:
+- *source* or *content*: source or content of the transport_regexp snippet
+- *ensure*: present (default) or absent
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+  node "toto.example.com" {
+    class { 'postfix': }
+    postfix::transport_regexp {
+      'wrong_date': content => 'FIXME';
+      'bla':        source => 'puppet:///files/etc/postfix/transport_regexp.d/bla';
+    }
+  }
+
+*/
+
+define postfix::transport_regexp_snippet (
+  $ensure  = "present",
+  $source = '',
+  $content = undef
+) {
+
+  if $source == '' and $content == undef {
+    fail("One of \$source or \$content must be specified for postfix::transport_regexp_snippet ${name}")
+  }
+
+  if $source != '' and $content != undef {
+    fail("Only one of \$source or \$content must specified for postfix::transport_regexp_snippet ${name}")
+  }
+
+  if ($value == false) and ($ensure == "present") {
+    fail("The value parameter must be set when using the postfix::transport_regexp_snippet define with ensure=present.")
+  }
+
+  include postfix::transport_regexp
+
+  $snippetfile = "${postfix::transport_regexp::postfix_transport_regexp_snippets_dir}/${name}"
+  
+  file { "$snippetfile":
+    ensure  => "$ensure",
+    mode    => 600,
+    owner   => root,
+    group   => 0,
+    notify => Exec["concat_${postfix::transport_regexp::postfix_merged_transport_regexp}"],
+  }
+
+  if $source {
+    File["$snippetfile"] {
+      source => $source,
+    }
+  }
+  else {
+    File["$snippetfile"] {
+      content => $content,
+    }
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/virtual.pp b/puppet/modules/postfix/manifests/virtual.pp
new file mode 100644
index 00000000..06df32ad
--- /dev/null
+++ b/puppet/modules/postfix/manifests/virtual.pp
@@ -0,0 +1,44 @@
+/*
+== Definition: postfix::virtual
+
+Manages content of the /etc/postfix/virtual map.
+
+Parameters:
+- *name*: name of address postfix will lookup. See virtual(8).
+- *destination*: where the emails will be delivered to. See virtual(8).
+- *ensure*: present/absent, defaults to present.
+
+Requires:
+- Class["postfix"]
+- Postfix::Hash["/etc/postfix/virtual"]
+- Postfix::Config["virtual_alias_maps"]
+- file_line (from module stdlib)
+
+Example usage:
+
+  node "toto.example.com" {
+
+    class { 'postfix': }
+
+    postfix::hash { "/etc/postfix/virtual":
+      ensure => present,
+    }
+    postfix::config { "virtual_alias_maps":
+      value => "hash:/etc/postfix/virtual"
+    }
+    postfix::virtual { "user@example.com":
+      ensure      => present,
+      destination => "root",
+    }
+  }
+
+*/
+define postfix::virtual ($ensure="present", $destination) {
+  file_line {"${name} ${destination}":
+    ensure => $ensure,
+    path   => "/etc/postfix/virtual",
+    line   => "${name} ${destination}",
+    notify => Exec["generate /etc/postfix/virtual.db"],
+    require => Package["postfix"],
+  }
+}
diff --git a/puppet/modules/postfix/manifests/virtual_regexp.pp b/puppet/modules/postfix/manifests/virtual_regexp.pp
new file mode 100644
index 00000000..18bbd8ce
--- /dev/null
+++ b/puppet/modules/postfix/manifests/virtual_regexp.pp
@@ -0,0 +1,56 @@
+#
+# == Class: postfix::virtual_regexp
+#
+# Manages Postfix virtual_regexp by merging snippets shipped:
+# - in the module's files/virtual_regexp.d/ or puppet:///files/etc/postfix/virtual_regexp.d
+#   (the latter takes precedence if present); site_postfix module is supported
+#   as well, see the source argument of file {"$postfix_virtual_regexp_snippets_dir"
+#   bellow for details.
+# - via postfix::virtual_regexp_snippet defines
+#
+# Example usage:
+# 
+#   node "toto.example.com" {
+#     class { 'postfix':
+#       manage_virtual_regexp => 'yes',
+#     }
+#     postfix::config { "virtual_alias_maps":
+#       value => 'hash://postfix/virtual, regexp:/etc/postfix/virtual_regexp',
+#     }
+#   }
+#
+class postfix::virtual_regexp {
+
+  include common::moduledir
+  common::module_dir{'postfix/virtual_regexp': }
+
+  $postfix_virtual_regexp_dir          = "${common::moduledir::module_dir_path}/postfix/virtual_regexp"
+  $postfix_virtual_regexp_snippets_dir = "${postfix_virtual_regexp_dir}/virtual_regexp.d"
+  $postfix_merged_virtual_regexp       = "${postfix_virtual_regexp_dir}/merged_virtual_regexp"
+
+  file {"$postfix_virtual_regexp_snippets_dir":
+    ensure  => 'directory',
+    owner   => 'root',
+    group   => '0',
+    mode    => '700',
+    source  => [
+                "puppet:///modules/site_postfix/${fqdn}/virtual_regexp.d",
+                "puppet:///modules/site_postfix/virtual_regexp.d",
+                "puppet:///files/etc/postfix/virtual_regexp.d",
+                "puppet:///modules/postfix/virtual_regexp.d",
+               ],
+    recurse => true,
+    purge   => false,
+  }
+
+  concatenated_file { "$postfix_merged_virtual_regexp":
+    dir     => "${postfix_virtual_regexp_snippets_dir}",
+    require => File["$postfix_virtual_regexp_snippets_dir"],
+  }
+  
+  config_file { '/etc/postfix/virtual_regexp':
+    source    => "$postfix_merged_virtual_regexp",
+    subscribe => File["$postfix_merged_virtual_regexp"],
+  }
+
+}
diff --git a/puppet/modules/postfix/manifests/virtual_regexp_snippet.pp b/puppet/modules/postfix/manifests/virtual_regexp_snippet.pp
new file mode 100644
index 00000000..bd9a982d
--- /dev/null
+++ b/puppet/modules/postfix/manifests/virtual_regexp_snippet.pp
@@ -0,0 +1,67 @@
+/*
+== Definition: postfix::virtual_regexp_snippet
+
+Adds a virtual_regexp snippets to /etc/postfix/virtual_regexp.
+See the postfix::virtual_regexp class for details.
+
+Parameters:
+- *source* or *content*: source or content of the virtual_regexp snippet
+- *ensure*: present (default) or absent
+
+Requires:
+- Class["postfix"]
+
+Example usage:
+
+  node "toto.example.com" {
+    class { 'postfix': }
+    postfix::virtual_regexp {
+      'wrong_date': content => 'FIXME';
+      'bla':        source => 'puppet:///files/etc/postfix/virtual_regexp.d/bla';
+    }
+  }
+
+*/
+
+define postfix::virtual_regexp_snippet (
+  $ensure  = "present",
+  $source = '',
+  $content = undef
+) {
+
+  if $source == '' and $content == undef {
+    fail("One of \$source or \$content must be specified for postfix::virtual_regexp_snippet ${name}")
+  }
+
+  if $source != '' and $content != undef {
+    fail("Only one of \$source or \$content must specified for postfix::virtual_regexp_snippet ${name}")
+  }
+
+  if ($value == false) and ($ensure == "present") {
+    fail("The value parameter must be set when using the postfix::virtual_regexp_snippet define with ensure=present.")
+  }
+
+  include postfix::virtual_regexp
+
+  $snippetfile = "${postfix::virtual_regexp::postfix_virtual_regexp_snippets_dir}/${name}"
+  
+  file { "$snippetfile":
+    ensure  => "$ensure",
+    mode    => 600,
+    owner   => root,
+    group   => 0,
+    notify => Exec["concat_${postfix::virtual_regexp::postfix_merged_virtual_regexp}"],
+  }
+
+  if $source {
+    File["$snippetfile"] {
+      source => $source,
+    }
+  }
+  else {
+    File["$snippetfile"] {
+      content => $content,
+    }
+  }
+
+}
diff --git a/puppet/modules/postfix/templates/anonsasl_header_checks.erb b/puppet/modules/postfix/templates/anonsasl_header_checks.erb
new file mode 100644
index 00000000..bca59146
--- /dev/null
+++ b/puppet/modules/postfix/templates/anonsasl_header_checks.erb
@@ -0,0 +1,2 @@
+/^Received: from (.* \([-._[:alnum:]]+ \[[.[:digit:]]{7,15}\]\)).*?([[:space:]]+).*\(Authenticated sender: ([^)]+)\).*by (<%= fqdn.gsub(/\./, '\.') %>) \(([^)]+)\) with (E?SMTPS?A?) id ([A-F[:digit:]]+).*/
+  REPLACE Received: from [127.0.0.1] (localhost [127.0.0.1])$2(Authenticated sender: $3)${2}with $6 id $7   
diff --git a/puppet/modules/postfix/templates/master.cf.debian-5.erb b/puppet/modules/postfix/templates/master.cf.debian-5.erb
new file mode 100644
index 00000000..50241b8b
--- /dev/null
+++ b/puppet/modules/postfix/templates/master.cf.debian-5.erb
@@ -0,0 +1,126 @@
+# file managed by puppet
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master").
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+<% if smtp_listen == 'all' %>smtp      inet  n       -       -       -       -       smtpd
+<% else %><%= smtp_listen %>:smtp      inet  n       -       -       -       -       smtpd<% end %>
+<% if use_submission == 'yes' %>submission inet n       -       -       -       -       smtpd
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+<% if use_smtps == 'yes' %>smtps     inet  n       -       -       -       -       smtpd
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+#628      inet  n       -       -       -       -       qmqpd
+pickup    fifo  n       -       -       60      1       pickup
+cleanup   unix  n       -       -       -       0       cleanup
+qmgr      fifo  n       -       n       300     1       qmgr
+#qmgr     fifo  n       -       -       300     1       oqmgr
+tlsmgr    unix  -       -       -       1000?   1       tlsmgr
+rewrite   unix  -       -       -       -       -       trivial-rewrite
+bounce    unix  -       -       -       -       0       bounce
+defer     unix  -       -       -       -       0       bounce
+trace     unix  -       -       -       -       0       bounce
+verify    unix  -       -       -       -       1       verify
+flush     unix  n       -       -       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       -       -       -       smtp
+# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
+relay     unix  -       -       -       -       -       smtp
+        -o smtp_fallback_relay=
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       -       -       -       showq
+error     unix  -       -       -       -       -       error
+retry     unix  -       -       -       -       -       error
+discard   unix  -       -       -       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       -       -       -       lmtp
+anvil     unix  -       -       -       -       1       anvil
+scache    unix  -       -       -       -       1       scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop  unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp      unix  -       n       n       -       -       pipe
+  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail    unix  -       n       n       -       -       pipe
+  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp     unix  -       n       n       -       -       pipe
+  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix  -       n       n       -       2       pipe
+  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman   unix  -       n       n       -       -       pipe
+  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+  ${nexthop} ${user}
+<% if use_amavisd == 'yes' %>
+amavis unix - - - - 2 smtp
+        -o smtp_data_done_timeout=1200
+        -o smtp_send_xforward_command=yes
+
+127.0.0.1:10025 inet n - - - - smtpd
+        -o content_filter=
+        -o local_recipient_maps=
+        -o relay_recipient_maps=
+        -o smtpd_restriction_classes=
+        -o smtpd_client_restrictions=
+        -o smtpd_helo_restrictions=
+        -o smtpd_sender_restrictions=
+        -o smtpd_recipient_restrictions=permit_mynetworks,reject
+        -o mynetworks=127.0.0.0/8
+        -o strict_rfc821_envelopes=yes
+        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
+        -o smtpd_bind_address=127.0.0.1
+<% end %>
+<% if use_dovecot_lda == 'yes' %>
+dovecot   unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -n -m ${extension}  
+<% end %>
+<% if use_schleuder == 'yes' %>
+schleuder  unix  -       n       n       -       -       pipe
+  flags=DRhu user=schleuder argv=/usr/bin/schleuder ${user}
+<% end %>
+<% if use_sympa == 'yes' %>
+sympa        unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/queue ${recipient}
+sympabounce  unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ${user}
+<% end %>
+<% if use_mlmmj == 'yes' %>
+mlmmj   unix  -       n       n       -       -       pipe
+  flags=DORhu user=mlmmj argv=/usr/bin/mlmmj-recieve -F -L /var/spool/mlmmj/$nexthop/
+<%- end -%>
+
+<%- unless mastercf_tail.to_s.empty? then -%>
+<%= mastercf_tail %>
+<%- end -%>
diff --git a/puppet/modules/postfix/templates/master.cf.debian-6.erb b/puppet/modules/postfix/templates/master.cf.debian-6.erb
new file mode 100644
index 00000000..9ce32647
--- /dev/null
+++ b/puppet/modules/postfix/templates/master.cf.debian-6.erb
@@ -0,0 +1,158 @@
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master").
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+<% if smtp_listen == 'all' %>smtp      inet  n       -       -       -       -       smtpd
+<% else %><%= smtp_listen %>:smtp      inet  n       -       -       -       -       smtpd<% end %>
+<% if use_submission == 'yes' %>submission inet n       -       -       -       -       smtpd
+  -o smtpd_enforce_tls=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+<% end %>
+#smtp      inet  n       -       -       -       1       postscreen
+#smtpd     pass  -       -       -       -       -       smtpd
+#dnsblog   unix  -       -       -       -       0       dnsblog
+#  -o smtpd_tls_security_level=encrypt
+#  -o smtpd_sasl_auth_enable=yes
+#  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+#  -o milter_macro_daemon_name=ORIGINATING
+<% if use_smtps == 'yes' %>smtps     inet  n       -       -       -       -       smtpd
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+#628       inet  n       -       -       -       -       qmqpd
+pickup    fifo  n       -       -       60      1       pickup
+cleanup   unix  n       -       -       -       0       cleanup
+qmgr      fifo  n       -       n       300     1       qmgr
+#qmgr     fifo  n       -       -       300     1       oqmgr
+tlsmgr    unix  -       -       -       1000?   1       tlsmgr
+rewrite   unix  -       -       -       -       -       trivial-rewrite
+bounce    unix  -       -       -       -       0       bounce
+defer     unix  -       -       -       -       0       bounce
+trace     unix  -       -       -       -       0       bounce
+verify    unix  -       -       -       -       1       verify
+flush     unix  n       -       -       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       -       -       -       smtp
+# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
+relay     unix  -       -       -       -       -       smtp
+	-o smtp_fallback_relay=
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       -       -       -       showq
+error     unix  -       -       -       -       -       error
+retry     unix  -       -       -       -       -       error
+discard   unix  -       -       -       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       -       -       -       lmtp
+anvil     unix  -       -       -       -       1       anvil
+scache    unix  -       -       -       -       1       scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop  unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp      unix  -       n       n       -       -       pipe
+  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail    unix  -       n       n       -       -       pipe
+  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp     unix  -       n       n       -       -       pipe
+  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix	-	n	n	-	2	pipe
+  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman   unix  -       n       n       -       -       pipe
+  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+  ${nexthop} ${user}
+<% if use_amavisd == 'yes' %>
+amavis unix - - - - 2 smtp
+        -o smtp_data_done_timeout=1200
+        -o smtp_send_xforward_command=yes
+
+127.0.0.1:10025 inet n - - - - smtpd
+        -o content_filter=
+        -o local_recipient_maps=
+        -o relay_recipient_maps=
+        -o smtpd_restriction_classes=
+        -o smtpd_client_restrictions=
+        -o smtpd_helo_restrictions=
+        -o smtpd_sender_restrictions=
+        -o smtpd_recipient_restrictions=permit_mynetworks,reject
+        -o mynetworks=127.0.0.0/8
+        -o strict_rfc821_envelopes=yes
+        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
+        -o smtpd_bind_address=127.0.0.1
+<% end %>
+<% if use_dovecot_lda == 'yes' %>
+dovecot   unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -n -m ${extension}  
+<% end %>
+<% if use_schleuder == 'yes' %>
+schleuder  unix  -       n       n       -       -       pipe
+  flags=DRhu user=schleuder argv=/usr/bin/schleuder ${user}
+<% end %>
+<% if use_sympa == 'yes' %>
+sympa        unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/queue ${recipient}
+sympabounce  unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ${user}
+<% end %>
+<% if use_mlmmj == 'yes' %>
+mlmmj   unix  -       n       n       -       -       pipe
+  flags=DORhu user=mlmmj argv=/usr/bin/mlmmj-recieve -F -L /var/spool/mlmmj/$nexthop/
+<%- end -%>
+<% if use_firma == 'yes' %>
+firma  unix  -       n       n       -       -       pipe
+  flags=DRhu user=firma argv=/var/lib/firma/firma -p ${user}
+firmarequest  unix  -       n       n       -       -       pipe
+  flags=DRhu user=firma argv=/var/lib/firma/firma -e ${user}
+<% end %>
+
+<%- unless mastercf_tail.to_s.empty? then -%>
+<%= mastercf_tail %>
+<%- end -%>
diff --git a/puppet/modules/postfix/templates/master.cf.debian-7.erb b/puppet/modules/postfix/templates/master.cf.debian-7.erb
new file mode 100644
index 00000000..d243a93e
--- /dev/null
+++ b/puppet/modules/postfix/templates/master.cf.debian-7.erb
@@ -0,0 +1,161 @@
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master").
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+#
+<% if @use_postscreen == 'yes' and @smtp_listen == 'all' %>smtpd     pass  -       -       n       -       -       smtpd
+smtp      inet  n       -       n       -       1       postscreen
+tlsproxy  unix  -       -       n       -       0       tlsproxy
+<% elsif @use_postscreen == 'no' and @smtp_listen == 'all' %>smtp      inet  n       -       -       -       -       smtpd
+<% else  %><%= @smtp_listen %>:smtp      inet  n       -       -       -       -       smtpd<% end %>
+#smtp      inet  n       -       -       -       1       postscreen
+#smtpd     pass  -       -       -       -       -       smtpd
+#dnsblog   unix  -       -       -       -       0       dnsblog
+#tlsproxy  unix  -       -       -       -       0       tlsproxy
+<% if @use_submission == 'yes' %>submission inet n       -       -       -       -       smtpd
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+<% if @use_smtps == 'yes' %>smtps     inet  n       -       -       -       -       smtpd
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+#628      inet  n       -       -       -       -       qmqpd
+pickup    fifo  n       -       -       60      1       pickup
+cleanup   unix  n       -       -       -       0       cleanup
+qmgr      fifo  n       -       n       300     1       qmgr
+#qmgr     fifo  n       -       -       300     1       oqmgr
+tlsmgr    unix  -       -       -       1000?   1       tlsmgr
+rewrite   unix  -       -       -       -       -       trivial-rewrite
+bounce    unix  -       -       -       -       0       bounce
+defer     unix  -       -       -       -       0       bounce
+trace     unix  -       -       -       -       0       bounce
+verify    unix  -       -       -       -       1       verify
+flush     unix  n       -       -       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       -       -       -       smtp
+# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
+relay     unix  -       -       -       -       -       smtp
+	-o smtp_fallback_relay=
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       -       -       -       showq
+error     unix  -       -       -       -       -       error
+retry     unix  -       -       -       -       -       error
+discard   unix  -       -       -       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       -       -       -       lmtp
+anvil     unix  -       -       -       -       1       anvil
+scache    unix  -       -       -       -       1       scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop  unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix  -       n       n       -       -       pipe
+#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp      unix  -       n       n       -       -       pipe
+  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail    unix  -       n       n       -       -       pipe
+  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp     unix  -       n       n       -       -       pipe
+  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix	-	n	n	-	2	pipe
+  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman   unix  -       n       n       -       -       pipe
+  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+  ${nexthop} ${user}
+
+<% if @use_amavisd == 'yes' %>
+amavis unix - - - - 2 smtp
+        -o smtp_data_done_timeout=1200
+        -o smtp_send_xforward_command=yes
+
+127.0.0.1:10025 inet n - - - - smtpd
+        -o content_filter=
+        -o local_recipient_maps=
+        -o relay_recipient_maps=
+        -o smtpd_restriction_classes=
+        -o smtpd_client_restrictions=
+        -o smtpd_helo_restrictions=
+        -o smtpd_sender_restrictions=
+        -o smtpd_recipient_restrictions=permit_mynetworks,reject
+        -o mynetworks=127.0.0.0/8
+        -o strict_rfc821_envelopes=yes
+        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
+        -o smtpd_bind_address=127.0.0.1
+<% end %>
+<% if @use_dovecot_lda == 'yes' %>
+dovecot   unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -n -m ${extension}
+<% end %>
+<% if @use_schleuder == 'yes' %>
+schleuder  unix  -       n       n       -       -       pipe
+  flags=DRhu user=schleuder argv=/usr/bin/schleuder ${user}
+<% end %>
+<% if @use_sympa == 'yes' %>
+sympa        unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/queue ${recipient}
+sympabounce  unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ${user}
+<% end %>
+<% if @use_mlmmj == 'yes' %>
+mlmmj   unix  -       n       n       -       -       pipe
+  flags=DORhu user=mlmmj argv=/usr/bin/mlmmj-recieve -F -L /var/spool/mlmmj/$nexthop/
+<%- end -%>
+
+<%- unless @mastercf_tail.to_s.empty? then -%>
+<%= @mastercf_tail %>
+<%- end -%>
diff --git a/puppet/modules/postfix/templates/master.cf.debian-8.erb b/puppet/modules/postfix/templates/master.cf.debian-8.erb
new file mode 100644
index 00000000..e613ac1f
--- /dev/null
+++ b/puppet/modules/postfix/templates/master.cf.debian-8.erb
@@ -0,0 +1,160 @@
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master").
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+  # ==========================================================================
+<% if @use_postscreen == 'yes' and @smtp_listen == 'all' %>smtpd     pass  -       -       n       -       -       smtpd
+smtp      inet  n       -       n       -       1       postscreen
+tlsproxy  unix  -       -       n       -       0       tlsproxy
+<% elsif @use_postscreen == 'no' and @smtp_listen == 'all' %>smtp      inet  n       -       -       -       -       smtpd
+<% else  %><%= @smtp_listen %>:smtp      inet  n       -       -       -       -       smtpd<% end %>
+#smtp      inet  n       -       -       -       1       postscreen
+#smtpd     pass  -       -       -       -       -       smtpd
+#dnsblog   unix  -       -       -       -       0       dnsblog
+#tlsproxy  unix  -       -       -       -       0       tlsproxy
+<% if @use_submission == 'yes' %>submission inet n       -       -       -       -       smtpd
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+<% if @use_smtps == 'yes' %>smtps     inet  n       -       -       -       -       smtpd
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+#628      inet  n       -       -       -       -       qmqpd
+pickup    fifo  n       -       -       60      1       pickup
+cleanup   unix  n       -       -       -       0       cleanup
+qmgr      fifo  n       -       n       300     1       qmgr
+#qmgr     fifo  n       -       -       300     1       oqmgr
+tlsmgr    unix  -       -       -       1000?   1       tlsmgr
+rewrite   unix  -       -       -       -       -       trivial-rewrite
+bounce    unix  -       -       -       -       0       bounce
+defer     unix  -       -       -       -       0       bounce
+trace     unix  -       -       -       -       0       bounce
+verify    unix  -       -       -       -       1       verify
+flush     unix  n       -       -       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       -       -       -       smtp
+# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
+relay     unix  -       -       -       -       -       smtp
+	-o smtp_fallback_relay=
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       -       -       -       showq
+error     unix  -       -       -       -       -       error
+retry     unix  -       -       -       -       -       error
+discard   unix  -       -       -       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       -       -       -       lmtp
+anvil     unix  -       -       -       -       1       anvil
+scache    unix  -       -       -       -       1       scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop  unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix  -       n       n       -       -       pipe
+#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp      unix  -       n       n       -       -       pipe
+  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail    unix  -       n       n       -       -       pipe
+  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp     unix  -       n       n       -       -       pipe
+  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix	-	n	n	-	2	pipe
+  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman   unix  -       n       n       -       -       pipe
+  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+  ${nexthop} ${user}
+
+<% if @use_amavisd == 'yes' %>
+amavis unix - - - - 2 smtp
+        -o smtp_data_done_timeout=1200
+        -o smtp_send_xforward_command=yes
+
+127.0.0.1:10025 inet n - - - - smtpd
+        -o content_filter=
+        -o local_recipient_maps=
+        -o relay_recipient_maps=
+        -o smtpd_restriction_classes=
+        -o smtpd_client_restrictions=
+        -o smtpd_helo_restrictions=
+        -o smtpd_sender_restrictions=
+        -o smtpd_recipient_restrictions=permit_mynetworks,reject
+        -o mynetworks=127.0.0.0/8
+        -o strict_rfc821_envelopes=yes
+        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
+        -o smtpd_bind_address=127.0.0.1
+<% end %>
+<% if @use_dovecot_lda == 'yes' %>
+dovecot   unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -n -m ${extension}
+<% end %>
+<% if @use_schleuder == 'yes' %>
+schleuder  unix  -       n       n       -       -       pipe
+  flags=DRhu user=schleuder argv=/usr/bin/schleuder ${user}
+<% end %>
+<% if @use_sympa == 'yes' %>
+sympa        unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/queue ${recipient}
+sympabounce  unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ${user}
+<% end %>
+<% if @use_mlmmj == 'yes' %>
+mlmmj   unix  -       n       n       -       -       pipe
+  flags=DORhu user=mlmmj argv=/usr/bin/mlmmj-recieve -F -L /var/spool/mlmmj/$nexthop/
+<%- end -%>
+
+<%- unless @mastercf_tail.to_s.empty? then -%>
+<%= @mastercf_tail %>
+<%- end -%>
diff --git a/puppet/modules/postfix/templates/master.cf.debian-sid.erb b/puppet/modules/postfix/templates/master.cf.debian-sid.erb
new file mode 100644
index 00000000..7b653fb3
--- /dev/null
+++ b/puppet/modules/postfix/templates/master.cf.debian-sid.erb
@@ -0,0 +1,157 @@
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master").
+#
+# Do not forget to execute "postfix reload" after editing this file.
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+<% if @smtp_listen == 'all' %>smtp      inet  n       -       -       -       -       smtpd
+<% else %><%= @smtp_listen %>:smtp      inet  n       -       -       -       -       smtpd<% end %>
+#smtp      inet  n       -       -       -       1       postscreen
+#smtpd     pass  -       -       -       -       -       smtpd
+#dnsblog   unix  -       -       -       -       0       dnsblog
+#tlsproxy  unix  -       -       -       -       0       tlsproxy
+<% if @use_submission == 'yes' %>submission inet n       -       -       -       -       smtpd
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+<% if @use_smtps == 'yes' %>smtps     inet  n       -       -       -       -       smtpd
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+  -o milter_macro_daemon_name=ORIGINATING
+<% end %>
+#628      inet  n       -       -       -       -       qmqpd
+pickup    fifo  n       -       -       60      1       pickup
+cleanup   unix  n       -       -       -       0       cleanup
+qmgr      fifo  n       -       n       300     1       qmgr
+#qmgr     fifo  n       -       -       300     1       oqmgr
+tlsmgr    unix  -       -       -       1000?   1       tlsmgr
+rewrite   unix  -       -       -       -       -       trivial-rewrite
+bounce    unix  -       -       -       -       0       bounce
+defer     unix  -       -       -       -       0       bounce
+trace     unix  -       -       -       -       0       bounce
+verify    unix  -       -       -       -       1       verify
+flush     unix  n       -       -       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       -       -       -       smtp
+# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
+relay     unix  -       -       -       -       -       smtp
+	-o smtp_fallback_relay=
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       -       -       -       showq
+error     unix  -       -       -       -       -       error
+retry     unix  -       -       -       -       -       error
+discard   unix  -       -       -       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       -       -       -       lmtp
+anvil     unix  -       -       -       -       1       anvil
+scache    unix  -       -       -       -       1       scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop  unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
+#
+# ====================================================================
+#
+# Recent Cyrus versions can use the existing "lmtp" master.cf entry.
+#
+# Specify in cyrus.conf:
+#   lmtp    cmd="lmtpd -a" listen="localhost:lmtp" proto=tcp4
+#
+# Specify in main.cf one or more of the following:
+#  mailbox_transport = lmtp:inet:localhost
+#  virtual_transport = lmtp:inet:localhost
+#
+# ====================================================================
+#
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+#
+#cyrus     unix  -       n       n       -       -       pipe
+#  user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# ====================================================================
+# Old example of delivery via Cyrus.
+#
+#old-cyrus unix  -       n       n       -       -       pipe
+#  flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user}
+#
+# ====================================================================
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp      unix  -       n       n       -       -       pipe
+  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail    unix  -       n       n       -       -       pipe
+  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp     unix  -       n       n       -       -       pipe
+  flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient
+scalemail-backend unix	-	n	n	-	2	pipe
+  flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension}
+mailman   unix  -       n       n       -       -       pipe
+  flags=FR user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py
+  ${nexthop} ${user}
+
+<% if @use_amavisd == 'yes' %>
+amavis unix - - - - 2 smtp
+        -o smtp_data_done_timeout=1200
+        -o smtp_send_xforward_command=yes
+
+127.0.0.1:10025 inet n - - - - smtpd
+        -o content_filter=
+        -o local_recipient_maps=
+        -o relay_recipient_maps=
+        -o smtpd_restriction_classes=
+        -o smtpd_client_restrictions=
+        -o smtpd_helo_restrictions=
+        -o smtpd_sender_restrictions=
+        -o smtpd_recipient_restrictions=permit_mynetworks,reject
+        -o mynetworks=127.0.0.0/8
+        -o strict_rfc821_envelopes=yes
+        -o receive_override_options=no_unknown_recipient_checks,no_header_body_checks
+        -o smtpd_bind_address=127.0.0.1
+<% end %>
+<% if @use_dovecot_lda == 'yes' %>
+dovecot   unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/deliver -f ${sender} -d ${user}@${nexthop} -n -m ${extension}
+<% end %>
+<% if @use_schleuder == 'yes' %>
+schleuder  unix  -       n       n       -       -       pipe
+  flags=DRhu user=schleuder argv=/usr/bin/schleuder ${user}
+<% end %>
+<% if @use_sympa == 'yes' %>
+sympa        unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/queue ${recipient}
+sympabounce  unix  -       n       n       -       -       pipe
+  flags=R user=sympa argv=/usr/lib/sympa/bin/bouncequeue ${user}
+<% end %>
+<% if @use_mlmmj == 'yes' %>
+mlmmj   unix  -       n       n       -       -       pipe
+  flags=DORhu user=mlmmj argv=/usr/bin/mlmmj-recieve -F -L /var/spool/mlmmj/$nexthop/
+<%- end -%>
+
+<%- unless @mastercf_tail.to_s.empty? then -%>
+<%= @mastercf_tail %>
+<%- end -%>
diff --git a/puppet/modules/postfix/templates/master.cf.redhat5.erb b/puppet/modules/postfix/templates/master.cf.redhat5.erb
new file mode 100644
index 00000000..01741e4e
--- /dev/null
+++ b/puppet/modules/postfix/templates/master.cf.redhat5.erb
@@ -0,0 +1,87 @@
+# file managed by puppet
+#
+# Postfix master process configuration file.  For details on the format
+# of the file, see the master(5) manual page (command: "man 5 master").
+#
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+<%= smtp_listen %>:smtp      inet  n       -       n       -       -       smtpd
+#smtp      inet  n       -       n       -       -       smtpd
+<% if use_submission == 'yes' %>submission inet n       -       n       -       -       smtpd
+  -o smtpd_enforce_tls=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+<% end %>
+<% if use_smtps == 'yes' %>smtps     inet  n       -       n       -       -       smtpd
+  -o smtpd_tls_wrappermode=yes
+  -o smtpd_sasl_auth_enable=yes
+  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
+<% end %>
+#628      inet  n       -       n       -       -       qmqpd
+pickup    fifo  n       -       n       60      1       pickup
+cleanup   unix  n       -       n       -       0       cleanup
+qmgr      fifo  n       -       n       300     1       qmgr
+#qmgr     fifo  n       -       n       300     1       oqmgr
+tlsmgr    unix  -       -       n       1000?   1       tlsmgr
+rewrite   unix  -       -       n       -       -       trivial-rewrite
+bounce    unix  -       -       n       -       0       bounce
+defer     unix  -       -       n       -       0       bounce
+trace     unix  -       -       n       -       0       bounce
+verify    unix  -       -       n       -       1       verify
+flush     unix  n       -       n       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+smtp      unix  -       -       n       -       -       smtp
+# When relaying mail as backup MX, disable fallback_relay to avoid MX loops
+relay     unix  -       -       n       -       -       smtp
+	-o fallback_relay=
+#       -o smtp_helo_timeout=5 -o smtp_connect_timeout=5
+showq     unix  n       -       n       -       -       showq
+error     unix  -       -       n       -       -       error
+discard   unix  -       -       n       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       n       -       -       lmtp
+anvil     unix  -       -       n       -       1       anvil
+scache	  unix	-	-	n	-	1	scache
+#
+# ====================================================================
+# Interfaces to non-Postfix software. Be sure to examine the manual
+# pages of the non-Postfix software to find out what options it wants.
+#
+# Many of the following services use the Postfix pipe(8) delivery
+# agent.  See the pipe(8) man page for information about ${recipient}
+# and other message envelope options.
+# ====================================================================
+#
+# maildrop. See the Postfix MAILDROP_README file for details.
+# Also specify in main.cf: maildrop_destination_recipient_limit=1
+#
+maildrop  unix  -       n       n       -       -       pipe
+  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
+#
+# The Cyrus deliver program has changed incompatibly, multiple times.
+#
+old-cyrus unix  -       n       n       -       -       pipe
+  flags=R user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -m ${extension} ${user}
+# Cyrus 2.1.5 (Amos Gouaux)
+# Also specify in main.cf: cyrus_destination_recipient_limit=1
+cyrus     unix  -       n       n       -       -       pipe
+  user=cyrus argv=/usr/lib/cyrus-imapd/deliver -e -r ${sender} -m ${extension} ${user}
+#
+# See the Postfix UUCP_README file for configuration details.
+#
+uucp      unix  -       n       n       -       -       pipe
+  flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient)
+#
+# Other external delivery methods.
+#
+ifmail    unix  -       n       n       -       -       pipe
+  flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient)
+bsmtp     unix  -       n       n       -       -       pipe
+  flags=Fq. user=foo argv=/usr/local/sbin/bsmtp -f $sender $nexthop $recipient
+
+<%- unless mastercf_tail.to_s.empty? then -%>
+<%= mastercf_tail %>
+<%- end -%>
-- 
cgit v1.2.3


From 850a14b59444737f703686d0d1996bf09ab08e2b Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:26 -0400
Subject: git subrepo clone https://leap.se/git/puppet_vcsrepo
 puppet/modules/vcsrepo

subrepo:
  subdir:   "puppet/modules/vcsrepo"
  merged:   "4e23209"
upstream:
  origin:   "https://leap.se/git/puppet_vcsrepo"
  branch:   "master"
  commit:   "4e23209"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I72f8ecdef4855ef9da6e1486453b1cdf01bb54a3
---
 puppet/modules/vcsrepo/.gitattributes              |   5 +
 puppet/modules/vcsrepo/.gitignore                  |  11 +
 puppet/modules/vcsrepo/.gitrepo                    |  11 +
 puppet/modules/vcsrepo/.rspec                      |   2 +
 puppet/modules/vcsrepo/.sync.yml                   |   3 +
 puppet/modules/vcsrepo/.travis.yml                 |  20 +
 puppet/modules/vcsrepo/CHANGELOG.md                | 150 ++++
 puppet/modules/vcsrepo/CONTRIBUTING.md             | 220 ++++++
 puppet/modules/vcsrepo/Gemfile                     |  39 ++
 puppet/modules/vcsrepo/LICENSE                     | 339 +++++++++
 puppet/modules/vcsrepo/NOTICE                      |  20 +
 puppet/modules/vcsrepo/README.markdown             | 758 +++++++++++++++++++++
 puppet/modules/vcsrepo/Rakefile                    |  42 ++
 puppet/modules/vcsrepo/examples/bzr/branch.pp      |   6 +
 puppet/modules/vcsrepo/examples/bzr/init_repo.pp   |   4 +
 puppet/modules/vcsrepo/examples/cvs/local.pp       |  11 +
 puppet/modules/vcsrepo/examples/cvs/remote.pp      |   5 +
 puppet/modules/vcsrepo/examples/git/bare_init.pp   |   4 +
 puppet/modules/vcsrepo/examples/git/clone.pp       |   5 +
 .../git/shallow-clone-with-just-one-commit.pp      |   7 +
 .../vcsrepo/examples/git/working_copy_init.pp      |   4 +
 puppet/modules/vcsrepo/examples/hg/clone.pp        |   6 +
 .../vcsrepo/examples/hg/clone_basic_auth.pp        |   7 +
 puppet/modules/vcsrepo/examples/hg/init_repo.pp    |   4 +
 .../modules/vcsrepo/examples/p4/create_client.pp   |   4 +
 .../modules/vcsrepo/examples/p4/delete_client.pp   |   4 +
 .../modules/vcsrepo/examples/p4/latest_client.pp   |   5 +
 puppet/modules/vcsrepo/examples/p4/sync_client.pp  |   6 +
 puppet/modules/vcsrepo/examples/svn/checkout.pp    |   5 +
 puppet/modules/vcsrepo/examples/svn/server.pp      |   4 +
 .../modules/vcsrepo/lib/puppet/provider/vcsrepo.rb |  42 ++
 .../vcsrepo/lib/puppet/provider/vcsrepo/bzr.rb     |  93 +++
 .../vcsrepo/lib/puppet/provider/vcsrepo/cvs.rb     | 135 ++++
 .../vcsrepo/lib/puppet/provider/vcsrepo/dummy.rb   |  12 +
 .../vcsrepo/lib/puppet/provider/vcsrepo/git.rb     | 483 +++++++++++++
 .../vcsrepo/lib/puppet/provider/vcsrepo/hg.rb      | 130 ++++
 .../vcsrepo/lib/puppet/provider/vcsrepo/p4.rb      | 278 ++++++++
 .../vcsrepo/lib/puppet/provider/vcsrepo/svn.rb     | 139 ++++
 puppet/modules/vcsrepo/lib/puppet/type/vcsrepo.rb  | 248 +++++++
 puppet/modules/vcsrepo/metadata.json               |  81 +++
 .../git/basic_auth/basic_auth_checkout_http.rb     |  69 ++
 .../git/basic_auth/basic_auth_checkout_https.rb    |  77 +++
 .../basic_auth/negative/basic_auth_checkout_git.rb |  53 ++
 .../git/branch_checkout/branch_checkout_file.rb    |  48 ++
 .../branch_checkout/branch_checkout_file_path.rb   |  48 ++
 .../git/branch_checkout/branch_checkout_git.rb     |  53 ++
 .../git/branch_checkout/branch_checkout_http.rb    |  61 ++
 .../git/branch_checkout/branch_checkout_https.rb   |  68 ++
 .../git/branch_checkout/branch_checkout_scp.rb     |  59 ++
 .../git/branch_checkout/branch_checkout_ssh.rb     |  59 ++
 .../negative/branch_checkout_not_exists.rb         |  46 ++
 .../spec/acceptance/beaker/git/clone/clone_file.rb |  46 ++
 .../acceptance/beaker/git/clone/clone_file_path.rb |  46 ++
 .../spec/acceptance/beaker/git/clone/clone_git.rb  |  51 ++
 .../spec/acceptance/beaker/git/clone/clone_http.rb |  59 ++
 .../acceptance/beaker/git/clone/clone_https.rb     |  66 ++
 ...clone_over_different_exiting_repo_with_force.rb |  49 ++
 .../git/clone/clone_repo_with_excludes_in_repo.rb  |  46 ++
 .../clone/clone_repo_with_excludes_not_in_repo.rb  |  46 ++
 .../spec/acceptance/beaker/git/clone/clone_scp.rb  |  57 ++
 .../spec/acceptance/beaker/git/clone/clone_ssh.rb  |  57 ++
 .../negative/clone_over_different_exiting_repo.rb  |  47 ++
 .../negative/clone_repo_with_exec_excludes.rb      |  45 ++
 .../git/compression/compression_0_checkout.rb      |  43 ++
 .../git/compression/compression_1_checkout.rb      |  43 ++
 .../git/compression/compression_2_checkout.rb      |  43 ++
 .../git/compression/compression_3_checkout.rb      |  43 ++
 .../git/compression/compression_4_checkout.rb      |  43 ++
 .../git/compression/compression_5_checkout.rb      |  43 ++
 .../git/compression/compression_6_checkout.rb      |  43 ++
 .../compression/negative/compression_7_checkout.rb |  43 ++
 .../negative/compression_alpha_checkout.rb         |  43 ++
 .../negative/compression_eval_checkout.rb          |  43 ++
 .../negative/compression_exec_checkout.rb          |  43 ++
 .../negative/compression_negative_checkout.rb      |  43 ++
 .../create/create_bare_repo_that_already_exists.rb |  40 ++
 .../git/create/create_repo_that_already_exists.rb  |  42 ++
 .../create_bare_repo_specifying_revision.rb        |  38 ++
 .../git/group_checkout/group_checkout_file.rb      |  53 ++
 .../git/group_checkout/group_checkout_file_path.rb |  53 ++
 .../git/group_checkout/group_checkout_git.rb       |  58 ++
 .../git/group_checkout/group_checkout_http.rb      |  66 ++
 .../git/group_checkout/group_checkout_https.rb     |  73 ++
 .../git/group_checkout/group_checkout_scp.rb       |  64 ++
 .../git/group_checkout/group_checkout_ssh.rb       |  64 ++
 .../group_checkout_file_non_existent_group.rb      |  51 ++
 .../negative/revision_checkout_not_exists.rb       |  46 ++
 .../revision_checkout/revision_checkout_file.rb    |  53 ++
 .../revision_checkout_file_path.rb                 |  53 ++
 .../git/revision_checkout/revision_checkout_git.rb |  58 ++
 .../revision_checkout/revision_checkout_http.rb    |  66 ++
 .../revision_checkout/revision_checkout_https.rb   |  74 ++
 .../git/revision_checkout/revision_checkout_scp.rb |  64 ++
 .../git/revision_checkout/revision_checkout_ssh.rb |  64 ++
 .../negative/shallow_clone_exec_depth.rb           |  43 ++
 .../negative/shallow_clone_file_path.rb            |  44 ++
 .../shallow_clone/negative/shallow_clone_http.rb   |  55 ++
 .../negative/shallow_clone_negative_depth.rb       |  43 ++
 .../negative/shallow_clone_overflow_depth.rb       |  45 ++
 .../beaker/git/shallow_clone/shallow_clone_file.rb |  47 ++
 .../beaker/git/shallow_clone/shallow_clone_git.rb  |  52 ++
 .../git/shallow_clone/shallow_clone_https.rb       |  68 ++
 .../beaker/git/shallow_clone/shallow_clone_scp.rb  |  58 ++
 .../beaker/git/shallow_clone/shallow_clone_ssh.rb  |  58 ++
 .../git/shallow_clone/shallow_clone_zero_depth.rb  |  43 ++
 .../negative/tag_checkout_not_exists.rb            |  47 ++
 .../beaker/git/tag_checkout/tag_checkout_file.rb   |  48 ++
 .../git/tag_checkout/tag_checkout_file_path.rb     |  48 ++
 .../beaker/git/tag_checkout/tag_checkout_git.rb    |  59 ++
 .../beaker/git/tag_checkout/tag_checkout_http.rb   |  67 ++
 .../beaker/git/tag_checkout/tag_checkout_https.rb  |  74 ++
 .../beaker/git/tag_checkout/tag_checkout_scp.rb    |  65 ++
 .../beaker/git/tag_checkout/tag_checkout_ssh.rb    |  65 ++
 .../user_checkout_file_non_existent_user.rb        |  51 ++
 .../beaker/git/user_checkout/user_checkout_file.rb |  53 ++
 .../git/user_checkout/user_checkout_file_path.rb   |  53 ++
 .../beaker/git/user_checkout/user_checkout_git.rb  |  58 ++
 .../beaker/git/user_checkout/user_checkout_http.rb |  66 ++
 .../git/user_checkout/user_checkout_https.rb       |  73 ++
 .../beaker/git/user_checkout/user_checkout_scp.rb  |  64 ++
 .../beaker/git/user_checkout/user_checkout_ssh.rb  |  64 ++
 .../vcsrepo/spec/acceptance/beaker_helper.rb       |  51 ++
 .../vcsrepo/spec/acceptance/clone_repo_spec.rb     | 534 +++++++++++++++
 .../vcsrepo/spec/acceptance/create_repo_spec.rb    |  89 +++
 .../spec/acceptance/files/create_git_repo.sh       |  39 ++
 .../vcsrepo/spec/acceptance/files/server.crt       |  13 +
 .../vcsrepo/spec/acceptance/files/server.key       |  15 +
 .../vcsrepo/spec/acceptance/modules_1596_spec.rb   |  72 ++
 .../vcsrepo/spec/acceptance/modules_1800_spec.rb   |  41 ++
 .../vcsrepo/spec/acceptance/modules_2326_spec.rb   |  69 ++
 .../vcsrepo/spec/acceptance/modules_660_spec.rb    |  89 +++
 .../vcsrepo/spec/acceptance/modules_753_spec.rb    |  68 ++
 .../spec/acceptance/nodesets/centos-59-x64.yml     |  10 +
 .../spec/acceptance/nodesets/centos-64-x64-pe.yml  |  12 +
 .../spec/acceptance/nodesets/centos-64-x64.yml     |  10 +
 .../spec/acceptance/nodesets/centos-65-x64.yml     |  10 +
 .../spec/acceptance/nodesets/debian-607-x64.yml    |  10 +
 .../spec/acceptance/nodesets/debian-73-x64.yml     |  10 +
 .../vcsrepo/spec/acceptance/nodesets/default.yml   |  10 +
 .../nodesets/ubuntu-server-10044-x64.yml           |  10 +
 .../nodesets/ubuntu-server-12042-x64.yml           |  10 +
 .../acceptance/nodesets/ubuntu-server-1404-x64.yml |  11 +
 .../vcsrepo/spec/acceptance/remove_repo_spec.rb    |  30 +
 .../spec/acceptance/remove_repo_spec_noop.rb       |  31 +
 .../vcsrepo/spec/fixtures/bzr_version_info.txt     |   5 +
 .../modules/vcsrepo/spec/fixtures/git_branch_a.txt |  14 +
 .../spec/fixtures/git_branch_feature_bar.txt       |  14 +
 .../vcsrepo/spec/fixtures/git_branch_none.txt      |  15 +
 .../modules/vcsrepo/spec/fixtures/hg_parents.txt   |   6 +
 puppet/modules/vcsrepo/spec/fixtures/hg_tags.txt   |  18 +
 puppet/modules/vcsrepo/spec/fixtures/svn_info.txt  |  10 +
 puppet/modules/vcsrepo/spec/spec.opts              |   6 +
 puppet/modules/vcsrepo/spec/spec_helper.rb         |   8 +
 .../modules/vcsrepo/spec/spec_helper_acceptance.rb |  46 ++
 puppet/modules/vcsrepo/spec/spec_helper_local.rb   |   7 +
 .../vcsrepo/spec/support/filesystem_helpers.rb     |  18 +
 .../vcsrepo/spec/support/fixture_helpers.rb        |   7 +
 .../spec/unit/puppet/provider/vcsrepo/bzr_spec.rb  | 109 +++
 .../spec/unit/puppet/provider/vcsrepo/cvs_spec.rb  | 124 ++++
 .../spec/unit/puppet/provider/vcsrepo/git_spec.rb  | 401 +++++++++++
 .../spec/unit/puppet/provider/vcsrepo/hg_spec.rb   | 138 ++++
 .../spec/unit/puppet/provider/vcsrepo/p4_spec.rb   |  82 +++
 .../spec/unit/puppet/provider/vcsrepo/svn_spec.rb  | 160 +++++
 .../vcsrepo/spec/unit/puppet/type/README.markdown  |   4 +
 164 files changed, 10151 insertions(+)
 create mode 100644 puppet/modules/vcsrepo/.gitattributes
 create mode 100644 puppet/modules/vcsrepo/.gitignore
 create mode 100644 puppet/modules/vcsrepo/.gitrepo
 create mode 100644 puppet/modules/vcsrepo/.rspec
 create mode 100644 puppet/modules/vcsrepo/.sync.yml
 create mode 100644 puppet/modules/vcsrepo/.travis.yml
 create mode 100644 puppet/modules/vcsrepo/CHANGELOG.md
 create mode 100644 puppet/modules/vcsrepo/CONTRIBUTING.md
 create mode 100644 puppet/modules/vcsrepo/Gemfile
 create mode 100644 puppet/modules/vcsrepo/LICENSE
 create mode 100644 puppet/modules/vcsrepo/NOTICE
 create mode 100644 puppet/modules/vcsrepo/README.markdown
 create mode 100755 puppet/modules/vcsrepo/Rakefile
 create mode 100644 puppet/modules/vcsrepo/examples/bzr/branch.pp
 create mode 100644 puppet/modules/vcsrepo/examples/bzr/init_repo.pp
 create mode 100644 puppet/modules/vcsrepo/examples/cvs/local.pp
 create mode 100644 puppet/modules/vcsrepo/examples/cvs/remote.pp
 create mode 100644 puppet/modules/vcsrepo/examples/git/bare_init.pp
 create mode 100644 puppet/modules/vcsrepo/examples/git/clone.pp
 create mode 100644 puppet/modules/vcsrepo/examples/git/shallow-clone-with-just-one-commit.pp
 create mode 100644 puppet/modules/vcsrepo/examples/git/working_copy_init.pp
 create mode 100644 puppet/modules/vcsrepo/examples/hg/clone.pp
 create mode 100644 puppet/modules/vcsrepo/examples/hg/clone_basic_auth.pp
 create mode 100644 puppet/modules/vcsrepo/examples/hg/init_repo.pp
 create mode 100644 puppet/modules/vcsrepo/examples/p4/create_client.pp
 create mode 100644 puppet/modules/vcsrepo/examples/p4/delete_client.pp
 create mode 100644 puppet/modules/vcsrepo/examples/p4/latest_client.pp
 create mode 100644 puppet/modules/vcsrepo/examples/p4/sync_client.pp
 create mode 100644 puppet/modules/vcsrepo/examples/svn/checkout.pp
 create mode 100644 puppet/modules/vcsrepo/examples/svn/server.pp
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo.rb
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/bzr.rb
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/cvs.rb
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/dummy.rb
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/git.rb
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/hg.rb
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/p4.rb
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/svn.rb
 create mode 100644 puppet/modules/vcsrepo/lib/puppet/type/vcsrepo.rb
 create mode 100644 puppet/modules/vcsrepo/metadata.json
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_http.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_https.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/negative/basic_auth_checkout_git.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file_path.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_git.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_http.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_https.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_scp.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_ssh.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/negative/branch_checkout_not_exists.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_file.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_file_path.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_git.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_http.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_https.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_over_different_exiting_repo_with_force.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_in_repo.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_not_in_repo.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_scp.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_ssh.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/negative/clone_over_different_exiting_repo.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/negative/clone_repo_with_exec_excludes.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_0_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_1_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_2_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_3_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_4_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_5_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_6_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_7_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_alpha_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_eval_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_exec_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_negative_checkout.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/create_bare_repo_that_already_exists.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/create_repo_that_already_exists.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/negative/create_bare_repo_specifying_revision.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_file.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_file_path.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_git.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_http.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_https.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_scp.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_ssh.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/negative/group_checkout_file_non_existent_group.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/negative/revision_checkout_not_exists.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file_path.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_git.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_http.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_https.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_scp.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_ssh.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_exec_depth.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_file_path.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_http.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_negative_depth.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_overflow_depth.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_file.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_git.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_https.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_scp.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_ssh.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_zero_depth.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/negative/tag_checkout_not_exists.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file_path.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_git.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_http.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_https.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_scp.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_ssh.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/negative/user_checkout_file_non_existent_user.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_file.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_file_path.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_git.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_http.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_https.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_scp.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_ssh.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/beaker_helper.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/clone_repo_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/create_repo_spec.rb
 create mode 100755 puppet/modules/vcsrepo/spec/acceptance/files/create_git_repo.sh
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/files/server.crt
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/files/server.key
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/modules_1596_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/modules_1800_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/modules_2326_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/modules_660_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/modules_753_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-59-x64.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-64-x64-pe.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-64-x64.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-65-x64.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/debian-607-x64.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/debian-73-x64.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/default.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/remove_repo_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/acceptance/remove_repo_spec_noop.rb
 create mode 100644 puppet/modules/vcsrepo/spec/fixtures/bzr_version_info.txt
 create mode 100644 puppet/modules/vcsrepo/spec/fixtures/git_branch_a.txt
 create mode 100644 puppet/modules/vcsrepo/spec/fixtures/git_branch_feature_bar.txt
 create mode 100644 puppet/modules/vcsrepo/spec/fixtures/git_branch_none.txt
 create mode 100644 puppet/modules/vcsrepo/spec/fixtures/hg_parents.txt
 create mode 100644 puppet/modules/vcsrepo/spec/fixtures/hg_tags.txt
 create mode 100644 puppet/modules/vcsrepo/spec/fixtures/svn_info.txt
 create mode 100644 puppet/modules/vcsrepo/spec/spec.opts
 create mode 100644 puppet/modules/vcsrepo/spec/spec_helper.rb
 create mode 100644 puppet/modules/vcsrepo/spec/spec_helper_acceptance.rb
 create mode 100644 puppet/modules/vcsrepo/spec/spec_helper_local.rb
 create mode 100644 puppet/modules/vcsrepo/spec/support/filesystem_helpers.rb
 create mode 100644 puppet/modules/vcsrepo/spec/support/fixture_helpers.rb
 create mode 100644 puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/bzr_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/cvs_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/git_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/hg_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/p4_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/svn_spec.rb
 create mode 100644 puppet/modules/vcsrepo/spec/unit/puppet/type/README.markdown

(limited to 'puppet/modules')

diff --git a/puppet/modules/vcsrepo/.gitattributes b/puppet/modules/vcsrepo/.gitattributes
new file mode 100644
index 00000000..900ea0cb
--- /dev/null
+++ b/puppet/modules/vcsrepo/.gitattributes
@@ -0,0 +1,5 @@
+#This file is generated by ModuleSync, do not edit.
+*.rb  eol=lf
+*.erb eol=lf
+*.pp  eol=lf
+*.sh  eol=lf
diff --git a/puppet/modules/vcsrepo/.gitignore b/puppet/modules/vcsrepo/.gitignore
new file mode 100644
index 00000000..dd126f2f
--- /dev/null
+++ b/puppet/modules/vcsrepo/.gitignore
@@ -0,0 +1,11 @@
+#This file is generated by ModuleSync, do not edit.
+pkg/
+Gemfile.lock
+vendor/
+spec/fixtures/
+.vagrant/
+.bundle/
+coverage/
+log/
+.idea/
+*.iml
diff --git a/puppet/modules/vcsrepo/.gitrepo b/puppet/modules/vcsrepo/.gitrepo
new file mode 100644
index 00000000..d4a41d8a
--- /dev/null
+++ b/puppet/modules/vcsrepo/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_vcsrepo
+	branch = master
+	commit = 4e23209eaccf1ab504d35158f4141b3053327c2f
+	parent = 5247b7ccf5b5889ee16262dd976b03047e34e32c
+	cmdver = 0.3.0
diff --git a/puppet/modules/vcsrepo/.rspec b/puppet/modules/vcsrepo/.rspec
new file mode 100644
index 00000000..16f9cdb0
--- /dev/null
+++ b/puppet/modules/vcsrepo/.rspec
@@ -0,0 +1,2 @@
+--color
+--format documentation
diff --git a/puppet/modules/vcsrepo/.sync.yml b/puppet/modules/vcsrepo/.sync.yml
new file mode 100644
index 00000000..02e21731
--- /dev/null
+++ b/puppet/modules/vcsrepo/.sync.yml
@@ -0,0 +1,3 @@
+---
+LICENSE:
+  unmanaged: true
diff --git a/puppet/modules/vcsrepo/.travis.yml b/puppet/modules/vcsrepo/.travis.yml
new file mode 100644
index 00000000..588fb5b0
--- /dev/null
+++ b/puppet/modules/vcsrepo/.travis.yml
@@ -0,0 +1,20 @@
+#This file is generated by ModuleSync, do not edit.
+---
+sudo: false
+language: ruby
+cache: bundler
+bundler_args: --without system_tests
+script: "bundle exec rake validate lint spec"
+matrix:
+  fast_finish: true
+  include:
+  - rvm: 2.1.6
+    env: PUPPET_GEM_VERSION="~> 4.0" STRICT_VARIABLES="yes"
+  - rvm: 2.1.5
+    env: PUPPET_GEM_VERSION="~> 3.0" FUTURE_PARSER="yes"
+  - rvm: 2.1.5
+    env: PUPPET_GEM_VERSION="~> 3.0"
+  - rvm: 1.9.3
+    env: PUPPET_GEM_VERSION="~> 3.0"
+notifications:
+  email: false
diff --git a/puppet/modules/vcsrepo/CHANGELOG.md b/puppet/modules/vcsrepo/CHANGELOG.md
new file mode 100644
index 00000000..9aac1e52
--- /dev/null
+++ b/puppet/modules/vcsrepo/CHANGELOG.md
@@ -0,0 +1,150 @@
+# Change Log
+All notable changes to this project will be documented in this file. This project adheres to [Semantic Versioning](http://semver.org/).
+
+## [1.3.2] - Supported Release
+###Summary
+
+Small release for support of newer PE versions. This increments the version of PE in the metadata.json file.
+
+## [1.3.1] - 2015-07-28 Supported Release
+###Summary
+This release includes a number of bugfixes along with some test updates.
+
+### Fixed
+- Fix for detached HEAD on git 2.4+
+- Git provider doesn't ignore revision property when depth is used (MODULES-2131)
+- Test fixes
+- Check if submodules == true before calling update_submodules
+
+## [1.3.0] - 2015-05-19 Supported Release
+### Summary
+This release adds git provider remote handling, svn conflict resolution, and fixes the git provider when /tmp is mounted noexec.
+
+### Added
+- `source` property now takes a hash of sources for the git provider's remotes
+- Add `submodules` parameter to skip submodule initialization for git provider
+- Add `conflict` to svn provider to resolve conflicts
+- Add `branch` parameter to specify clone branch
+- Readme rewrite
+
+### Fixed
+- The git provider now works even if `/tmp` is noexec
+
+## [1.2.0] - 2014-11-04 Supported Release
+### Summary
+This release includes some improvements for git, mercurial, and cvs providers, and fixes the bug where there were warnings about multiple default providers.
+
+### Added
+- Update git and mercurial providers to set UID with `Puppet::Util::Execution.execute` instead of `su`
+- Allow git excludes to be string or array
+- Add `user` feature to cvs provider
+
+### Fixed
+- No more warnings about multiple default providers! (MODULES-428)
+
+## [1.1.0] - 2014-07-14 Supported Release
+### Summary
+This release adds a Perforce provider\* and corrects the git provider behavior
+when using `ensure => latest`.
+
+\*(Only git provider is currently supported.)
+
+### Added
+- New Perforce provider
+
+### Fixed
+- (MODULES-660) Fix behavior with `ensure => latest` and detached HEAD
+- Spec test fixes
+
+## [1.0.2] - 2014-06-30 Supported Release
+### Summary
+This supported release adds SLES 11 to the list of compatible OSs and
+documentation updates for support.
+
+## [1.0.1] - 2014-06-17 Supported Release
+### Summary
+This release is the first supported release of vcsrepo. The readme has been
+greatly improved.
+
+### Added
+- Updated and expanded readme to follow readme template
+
+### Fixed
+- Remove SLES from compatability metadata
+- Unpin rspec development dependencies
+- Update acceptance level testing
+
+## [1.0.0] - 2014-06-04
+### Summary
+
+This release focuses on a number of bugfixes, and also has some
+new features for Bzr and Git.
+
+### Added
+- Bzr:
+ - Call set_ownership
+- Git:
+ - Add ability for shallow clones
+ - Use -a and desired for HARD resets
+ - Use rev-parse to get tag canonical revision
+
+### Fixed
+- HG:
+ - Only add ssh options when it's talking to the network
+- Git:
+ - Fix for issue with detached HEAD
+ - force => true will now destroy and recreate repo
+ - Actually use the remote parameter
+ - Use origin/master instead of origin/HEAD when on master
+- SVN:
+ - Fix svnlook behavior with plain directories
+
+## 0.2.0 - 2013-11-13
+### Summary
+
+This release mainly focuses on a number of bugfixes, which should
+significantly improve the reliability of Git and SVN.  Thanks to
+our many contributors for all of these fixes!
+
+### Added
+- Git:
+ - Add autorequire for Package['git']
+- HG:
+ - Allow user and identity properties.
+- Bzr:
+ - "ensure => latest" support.
+- SVN:
+ - Added configuration parameter.
+ - Add support for master svn repositories.
+- CVS:
+ - Allow for setting the CVS_RSH environment variable.
+
+### Fixed
+- Handle Puppet::Util[::Execution].withenv for 2.x and 3.x properly.
+- Change path_empty? to not do full directory listing.
+- Overhaul spec tests to work with rspec2.
+- Git:
+ - Improve Git SSH usage documentation.
+ - Add ssh session timeouts to prevent network issues from blocking runs.
+ - Fix git provider checkout of a remote ref on an existing repo.
+ - Allow unlimited submodules (thanks to --recursive).
+ - Use git checkout --force instead of short -f everywhere.
+ - Update git provider to handle checking out into an existing (empty) dir.
+- SVN:
+ - Handle force property. for svn.
+ - Adds support for changing upstream repo url.
+ - Check that the URL of the WC matches the URL from the manifest.
+ - Changed from using "update" to "switch".
+ - Handle revision update without source switch.
+ - Fix svn provider to look for '^Revision:' instead of '^Last Changed Rev:'.
+- CVS:
+ - Documented the "module" attribute.
+
+[1.3.2]: https://github.com/puppetlabs/puppetlabs-vcsrepo/compare/1.3.1...1.3.2
+[1.3.1]: https://github.com/puppetlabs/puppetlabs-vcsrepo/compare/1.3.0...1.3.1
+[1.3.0]: https://github.com/puppetlabs/puppetlabs-vcsrepo/compare/1.2.0...1.3.0
+[1.2.0]: https://github.com/puppetlabs/puppetlabs-vcsrepo/compare/1.1.0...1.2.0
+[1.1.0]: https://github.com/puppetlabs/puppetlabs-vcsrepo/compare/1.0.2...1.1.0
+[1.0.2]: https://github.com/puppetlabs/puppetlabs-vcsrepo/compare/1.0.1...1.0.2
+[1.0.1]: https://github.com/puppetlabs/puppetlabs-vcsrepo/compare/1.0.0...1.0.1
+[1.0.0]: https://github.com/puppetlabs/puppetlabs-vcsrepo/compare/0.2.0...1.0.0
diff --git a/puppet/modules/vcsrepo/CONTRIBUTING.md b/puppet/modules/vcsrepo/CONTRIBUTING.md
new file mode 100644
index 00000000..bfeaa701
--- /dev/null
+++ b/puppet/modules/vcsrepo/CONTRIBUTING.md
@@ -0,0 +1,220 @@
+Checklist (and a short version for the impatient)
+=================================================
+
+  * Commits:
+
+    - Make commits of logical units.
+
+    - Check for unnecessary whitespace with "git diff --check" before
+      committing.
+
+    - Commit using Unix line endings (check the settings around "crlf" in
+      git-config(1)).
+
+    - Do not check in commented out code or unneeded files.
+
+    - The first line of the commit message should be a short
+      description (50 characters is the soft limit, excluding ticket
+      number(s)), and should skip the full stop.
+
+    - Associate the issue in the message. The first line should include
+      the issue number in the form "(#XXXX) Rest of message".
+
+    - The body should provide a meaningful commit message, which:
+
+      - uses the imperative, present tense: "change", not "changed" or
+        "changes".
+
+      - includes motivation for the change, and contrasts its
+        implementation with the previous behavior.
+
+    - Make sure that you have tests for the bug you are fixing, or
+      feature you are adding.
+
+    - Make sure the test suites passes after your commit:
+      `bundle exec rspec spec/acceptance` More information on [testing](#Testing) below
+
+    - When introducing a new feature, make sure it is properly
+      documented in the README.md
+
+  * Submission:
+
+    * Pre-requisites:
+
+      - Make sure you have a [GitHub account](https://github.com/join)
+
+      - [Create a ticket](https://tickets.puppetlabs.com/secure/CreateIssue!default.jspa), or [watch the ticket](https://tickets.puppetlabs.com/browse/) you are patching for.
+
+    * Preferred method:
+
+      - Fork the repository on GitHub.
+
+      - Push your changes to a topic branch in your fork of the
+        repository. (the format ticket/1234-short_description_of_change is
+        usually preferred for this project).
+
+      - Submit a pull request to the repository in the puppetlabs
+        organization.
+
+The long version
+================
+
+  1.  Make separate commits for logically separate changes.
+
+      Please break your commits down into logically consistent units
+      which include new or changed tests relevant to the rest of the
+      change.  The goal of doing this is to make the diff easier to
+      read for whoever is reviewing your code.  In general, the easier
+      your diff is to read, the more likely someone will be happy to
+      review it and get it into the code base.
+
+      If you are going to refactor a piece of code, please do so as a
+      separate commit from your feature or bug fix changes.
+
+      We also really appreciate changes that include tests to make
+      sure the bug is not re-introduced, and that the feature is not
+      accidentally broken.
+
+      Describe the technical detail of the change(s).  If your
+      description starts to get too long, that is a good sign that you
+      probably need to split up your commit into more finely grained
+      pieces.
+
+      Commits which plainly describe the things which help
+      reviewers check the patch and future developers understand the
+      code are much more likely to be merged in with a minimum of
+      bike-shedding or requested changes.  Ideally, the commit message
+      would include information, and be in a form suitable for
+      inclusion in the release notes for the version of Puppet that
+      includes them.
+
+      Please also check that you are not introducing any trailing
+      whitespace or other "whitespace errors".  You can do this by
+      running "git diff --check" on your changes before you commit.
+
+  2.  Sending your patches
+
+      To submit your changes via a GitHub pull request, we _highly_
+      recommend that you have them on a topic branch, instead of
+      directly on "master".
+      It makes things much easier to keep track of, especially if
+      you decide to work on another thing before your first change
+      is merged in.
+
+      GitHub has some pretty good
+      [general documentation](http://help.github.com/) on using
+      their site.  They also have documentation on
+      [creating pull requests](http://help.github.com/send-pull-requests/).
+
+      In general, after pushing your topic branch up to your
+      repository on GitHub, you can switch to the branch in the
+      GitHub UI and click "Pull Request" towards the top of the page
+      in order to open a pull request.
+
+
+  3.  Update the related GitHub issue.
+
+      If there is a GitHub issue associated with the change you
+      submitted, then you should update the ticket to include the
+      location of your branch, along with any other commentary you
+      may wish to make.
+
+Testing
+=======
+
+Getting Started
+---------------
+
+Our puppet modules provide [`Gemfile`](./Gemfile)s which can tell a ruby
+package manager such as [bundler](http://bundler.io/) what Ruby packages,
+or Gems, are required to build, develop, and test this software.
+
+Please make sure you have [bundler installed](http://bundler.io/#getting-started)
+on your system, then use it to install all dependencies needed for this project,
+by running
+
+```shell
+% bundle install
+Fetching gem metadata from https://rubygems.org/........
+Fetching gem metadata from https://rubygems.org/..
+Using rake (10.1.0)
+Using builder (3.2.2)
+-- 8><-- many more --><8 --
+Using rspec-system-puppet (2.2.0)
+Using serverspec (0.6.3)
+Using rspec-system-serverspec (1.0.0)
+Using bundler (1.3.5)
+Your bundle is complete!
+Use `bundle show [gemname]` to see where a bundled gem is installed.
+```
+
+NOTE some systems may require you to run this command with sudo.
+
+If you already have those gems installed, make sure they are up-to-date:
+
+```shell
+% bundle update
+```
+
+With all dependencies in place and up-to-date we can now run the tests:
+
+```shell
+% bundle exec rake spec
+```
+
+This will execute all the [rspec tests](http://rspec-puppet.com/) tests
+under [spec/defines](./spec/defines), [spec/classes](./spec/classes),
+and so on. rspec tests may have the same kind of dependencies as the
+module they are testing. While the module defines in its [Modulefile](./Modulefile),
+rspec tests define them in [.fixtures.yml](./fixtures.yml).
+
+Some puppet modules also come with [beaker](https://github.com/puppetlabs/beaker)
+tests. These tests spin up a virtual machine under
+[VirtualBox](https://www.virtualbox.org/)) with, controlling it with
+[Vagrant](http://www.vagrantup.com/) to actually simulate scripted test
+scenarios. In order to run these, you will need both of those tools
+installed on your system.
+
+You can run them by issuing the following command
+
+```shell
+% bundle exec rake spec_clean
+% bundle exec rspec spec/acceptance
+```
+
+This will now download a pre-fabricated image configured in the [default node-set](./spec/acceptance/nodesets/default.yml),
+install puppet, copy this module and install its dependencies per [spec/spec_helper_acceptance.rb](./spec/spec_helper_acceptance.rb)
+and then run all the tests under [spec/acceptance](./spec/acceptance).
+
+Writing Tests
+-------------
+
+XXX getting started writing tests.
+
+If you have commit access to the repository
+===========================================
+
+Even if you have commit access to the repository, you will still need to
+go through the process above, and have someone else review and merge
+in your changes.  The rule is that all changes must be reviewed by a
+developer on the project (that did not write the code) to ensure that
+all changes go through a code review process.
+
+Having someone other than the author of the topic branch recorded as
+performing the merge is the record that they performed the code
+review.
+
+
+Additional Resources
+====================
+
+* [Getting additional help](http://puppetlabs.com/community/get-help)
+
+* [Writing tests](http://projects.puppetlabs.com/projects/puppet/wiki/Development_Writing_Tests)
+
+* [Patchwork](https://patchwork.puppetlabs.com)
+
+* [General GitHub documentation](http://help.github.com/)
+
+* [GitHub pull request documentation](http://help.github.com/send-pull-requests/)
+
diff --git a/puppet/modules/vcsrepo/Gemfile b/puppet/modules/vcsrepo/Gemfile
new file mode 100644
index 00000000..e490bc9b
--- /dev/null
+++ b/puppet/modules/vcsrepo/Gemfile
@@ -0,0 +1,39 @@
+#This file is generated by ModuleSync, do not edit.
+
+source ENV['GEM_SOURCE'] || "https://rubygems.org"
+
+def location_for(place, version = nil)
+  if place =~ /^(git[:@][^#]*)#(.*)/
+    [version, { :git => $1, :branch => $2, :require => false}].compact
+  elsif place =~ /^file:\/\/(.*)/
+    ['>= 0', { :path => File.expand_path($1), :require => false}]
+  else
+    [place, version, { :require => false}].compact
+  end
+end
+
+group :development, :unit_tests do
+  gem 'json',                      :require => false
+  gem 'metadata-json-lint',        :require => false
+  gem 'puppet_facts',              :require => false
+  gem 'puppet-blacksmith',         :require => false
+  gem 'puppetlabs_spec_helper',    :require => false
+  gem 'rspec-puppet', '>= 2.3.2',  :require => false
+  gem 'simplecov',                 :require => false
+end
+group :system_tests do
+  gem 'beaker-rspec',                  *location_for(ENV['BEAKER_RSPEC_VERSION'] || '>= 3.4')
+  gem 'beaker',                        *location_for(ENV['BEAKER_VERSION'])
+  gem 'serverspec',                    :require => false
+  gem 'beaker-puppet_install_helper',  :require => false
+  gem 'master_manipulator',            :require => false
+  gem 'beaker-hostgenerator',          *location_for(ENV['BEAKER_HOSTGENERATOR_VERSION'])
+end
+
+gem 'facter', *location_for(ENV['FACTER_GEM_VERSION'])
+gem 'puppet', *location_for(ENV['PUPPET_GEM_VERSION'])
+
+
+if File.exists? "#{__FILE__}.local"
+  eval(File.read("#{__FILE__}.local"), binding)
+end
diff --git a/puppet/modules/vcsrepo/LICENSE b/puppet/modules/vcsrepo/LICENSE
new file mode 100644
index 00000000..d159169d
--- /dev/null
+++ b/puppet/modules/vcsrepo/LICENSE
@@ -0,0 +1,339 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.
diff --git a/puppet/modules/vcsrepo/NOTICE b/puppet/modules/vcsrepo/NOTICE
new file mode 100644
index 00000000..7eab165b
--- /dev/null
+++ b/puppet/modules/vcsrepo/NOTICE
@@ -0,0 +1,20 @@
+vcsrepo puppet module
+
+Copyright (C) 2010-2012 Puppet Labs Inc.
+
+Puppet Labs can be contacted at: info@puppetlabs.com
+
+
+This program and entire repository is free software; you can
+redistribute it and/or modify it under the terms of the GNU
+General Public License as published by the Free Software
+Foundation; either version 2 of the License, or any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
diff --git a/puppet/modules/vcsrepo/README.markdown b/puppet/modules/vcsrepo/README.markdown
new file mode 100644
index 00000000..ffc2d7e0
--- /dev/null
+++ b/puppet/modules/vcsrepo/README.markdown
@@ -0,0 +1,758 @@
+#vcsrepo
+
+####Table of Contents
+
+1. [Overview](#overview)
+2. [Module Description - What the module does and why it is useful](#module-description)
+3. [Setup - The basics of getting started with vcsrepo](#setup)
+    * [Setup requirements](#setup-requirements)
+    * [Beginning with vcsrepo](#beginning-with-vcsrepo)
+4. [Usage - Configuration options and additional functionality](#usage)
+    * [Git](#git)
+    * [Bazaar](#bazaar)
+    * [CVS](#cvs)
+    * [Mercurial](#mercurial)
+    * [Perforce](#perforce)
+    * [Subversion](#subversion)  
+5. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
+    * [Type: vcsrepo](#type-vcsrepo)
+        * [Providers](#providers)
+        * [Features](#features)
+        * [Parameters](#parameters)
+5. [Limitations - OS compatibility, etc.](#limitations)
+6. [Development - Guide for contributing to the module](#development)
+
+##Overview
+
+The vcsrepo module lets you use Puppet to easily deploy content from your version control system (VCS).
+
+##Module Description
+
+The vcsrepo module provides a single type with providers to support the following version control systems:
+
+* [Git](#git)
+* [Bazaar](#bazaar)
+* [CVS](#cvs)
+* [Mercurial](#mercurial)
+* [Perforce](#perforce)
+* [Subversion](#subversion)
+
+**Note:** `git` is the only vcs provider officially [supported by Puppet Labs](https://forge.puppetlabs.com/supported).
+
+##Setup
+
+###Setup Requirements
+
+The `vcsrepo` module does not install any VCS software for you. You must install a VCS before you can use this module.
+
+Like Puppet in general, the `vcsrepo` module does not automatically create parent directories for the files it manages. Make sure to set up any needed directory structures before you get started.
+
+###Beginning with vcsrepo
+
+To create and manage a blank repository, define the type `vcsrepo` with a path to your repository and supply the `provider` parameter based on the [VCS you're using](#usage).
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => git,
+}
+~~~
+
+##Usage
+
+**Note:** `git` is the only vcsrepo provider officially [supported by Puppet Labs](https://forge.puppetlabs.com/supported).
+
+###Git
+
+####Create a blank repository
+
+To create a blank repository, suitable for use as a central repository, define `vcsrepo` without `source` or `revision`:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => git,
+}
+~~~
+
+If you're managing a central or official repository, you might want to make it a bare repository. To do this, set `ensure` to 'bare':
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => bare,
+  provider => git,
+}
+~~~
+
+####Clone/pull a repository
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => git,
+  source   => 'git://example.com/repo.git',
+}
+~~~
+
+If you want to clone your repository as bare or mirror, you can set `ensure` to 'bare' or 'mirror':
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => mirror,
+  provider => git,
+  source   => 'git://example.com/repo.git',
+}
+~~~
+
+By default, `vcsrepo` will use the HEAD of the source repository's master branch. To use another branch or a specific commit, set `revision` to either a branch name or a commit SHA or tag.
+
+Branch name:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => git,
+  source   => 'git://example.com/repo.git',
+  revision => 'development',
+}
+~~~
+
+SHA:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => git,
+  source   => 'git://example.com/repo.git',
+  revision => '0c466b8a5a45f6cd7de82c08df2fb4ce1e920a31',
+}
+~~~
+
+Tag:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => git,
+  source   => 'git://example.com/repo.git',
+  revision => '1.1.2rc1',
+}
+~~~
+
+To check out a branch as a specific user, supply the `user` parameter:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => git,
+  source   => 'git://example.com/repo.git',
+  revision => '0c466b8a5a45f6cd7de82c08df2fb4ce1e920a31',
+  user     => 'someUser',
+}
+~~~
+
+To keep the repository at the latest revision, set `ensure` to 'latest'.
+
+**WARNING:** this overwrites any local changes to the repository:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => latest,
+  provider => git,
+  source   => 'git://example.com/repo.git',
+  revision => 'master',
+}
+~~~
+
+To clone the repository but skip initializing submodules, set `submodules` to 'false':
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure     => latest,
+  provider   => git,
+  source     => 'git://example.com/repo.git',
+  submodules => false,
+}
+~~~
+
+####Use multiple remotes with a repository
+In place of a single string, you can set `source` to a hash of one or more name => URL pairs:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => git,
+  remote   => 'origin'
+  source   => {
+    'origin'       => 'https://github.com/puppetlabs/puppetlabs-vcsrepo.git', 
+    'other_remote' => 'https://github.com/other_user/puppetlabs-vcsrepo.git'
+  },
+}
+~~~
+
+**Note:** if you set `source` to a hash, one of the names you specify must match the value of the `remote` parameter. That remote serves as the upstream of your managed repository.
+
+####Connect via SSH
+
+To connect to your source repository via SSH (e.g., 'username@server:…'), we recommend managing your SSH keys with Puppet and using the [`require`](http://docs.puppetlabs.com/references/stable/metaparameter.html#require) metaparameter to make sure they are present before the `vcsrepo` resource is applied.
+
+To use SSH keys associated with a user, specify the username in the `user` parameter:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure     => latest,
+  provider   => git,
+  source     => 'git://username@example.com/repo.git',
+  user       => 'toto', #uses toto's $HOME/.ssh setup
+  require    => File['/home/toto/.ssh/id_rsa'],
+}
+~~~
+
+###Bazaar
+
+####Create a blank repository
+
+To create a blank repository, suitable for use as a central repository, define `vcsrepo` without `source` or `revision`:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => bzr,
+}
+~~~
+
+####Branch from an existing repository
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => bzr,
+  source   => '/some/path',
+}
+~~~
+
+To branch from a specific revision, set `revision` to a valid [Bazaar revision spec](http://wiki.bazaar.canonical.com/BzrRevisionSpec):
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => bzr,
+  source   => '/some/path',
+  revision => 'menesis@pov.lt-20100309191856-4wmfqzc803fj300x',
+}
+~~~
+
+####Connect via SSH
+
+To connect to your source repository via SSH (e.g., `'bzr+ssh://...'` or `'sftp://...,'`), we recommend using the [`require`](http://docs.puppetlabs.com/references/stable/metaparameter.html#require) metaparameter to make sure your SSH keys are present before the `vcsrepo` resource is applied:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure     => latest,
+  provider   => bzr,
+  source     => 'bzr+ssh://bzr.example.com/some/path',
+  user       => 'toto', #uses toto's $HOME/.ssh setup
+  require    => File['/home/toto/.ssh/id_rsa'],
+}
+~~~
+
+###CVS
+
+####Create a blank repository
+
+To create a blank repository, suitable for use as a central repository, define `vcsrepo` without `source` or `revision`:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => cvs,
+}
+~~~
+
+####Checkout/update from a repository
+
+~~~
+vcsrepo { '/path/to/workspace':
+  ensure   => present,
+  provider => cvs,
+  source   => ':pserver:anonymous@example.com:/sources/myproj',
+}
+~~~
+
+To get a specific module on the current mainline, supply the `module` parameter:
+
+~~~
+vcsrepo {'/vagrant/lockss-daemon-source':
+  ensure   => present,
+  provider => cvs,
+  source   => ':pserver:anonymous@lockss.cvs.sourceforge.net:/cvsroot/lockss',
+  module   => 'lockss-daemon',
+}
+~~~
+
+To set the GZIP compression levels for your repository history, use the `compression` parameter:
+
+~~~
+vcsrepo { '/path/to/workspace':
+  ensure      => present,
+  provider    => cvs,
+  compression => 3,
+  source      => ':pserver:anonymous@example.com:/sources/myproj',
+}
+~~~
+
+To get a specific revision, set `revision` to the revision number.
+
+~~~
+vcsrepo { '/path/to/workspace':
+  ensure      => present,
+  provider    => cvs,
+  compression => 3,
+  source      => ':pserver:anonymous@example.com:/sources/myproj',
+  revision    => '1.2',
+}
+~~~
+
+You can also set `revision` to a tag:
+
+~~~
+vcsrepo { '/path/to/workspace':
+  ensure      => present,
+  provider    => cvs,
+  compression => 3,
+  source      => ':pserver:anonymous@example.com:/sources/myproj',
+  revision    => 'SOMETAG',
+}
+~~~
+
+####Connect via SSH
+
+To connect to your source repository via SSH, we recommend using the [`require`](http://docs.puppetlabs.com/references/stable/metaparameter.html#require) metaparameter to make sure your SSH keys are present before the `vcsrepo` resource is applied:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure     => latest,
+  provider   => cvs,
+  source     => ':pserver:anonymous@example.com:/sources/myproj',
+  user       => 'toto', #uses toto's $HOME/.ssh setup
+  require    => File['/home/toto/.ssh/id_rsa'],
+}
+~~~
+
+###Mercurial
+
+####Create a blank repository
+
+To create a blank repository, suitable for use as a central repository, define `vcsrepo` without `source` or `revision`:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => hg,
+}
+~~~
+
+####Clone/pull & update a repository
+
+To get the default branch tip:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => hg,
+  source   => 'http://hg.example.com/myrepo',
+}
+~~~
+
+For a specific changeset, use `revision`:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => hg,
+  source   => 'http://hg.example.com/myrepo',
+  revision => '21ea4598c962',
+}
+~~~
+
+You can also set `revision` to a tag:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => hg,
+  source   => 'http://hg.example.com/myrepo',
+  revision => '1.1.2',
+}
+~~~
+
+To check out as a specific user:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => hg,
+  source   => 'http://hg.example.com/myrepo',
+  user     => 'user',
+}
+~~~
+
+To specify an SSH identity key:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => hg,
+  source   => 'ssh://hg@hg.example.com/myrepo',
+  identity => '/home/user/.ssh/id_dsa1,
+}
+~~~
+
+To specify a username and password for HTTP Basic authentication:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => latest,
+  provider => hg,
+  source   => 'http://hg.example.com/myrepo',
+  basic_auth_username => 'hgusername',
+  basic_auth_password => 'hgpassword',
+}
+~~~
+
+####Connect via SSH 
+
+To connect to your source repository via SSH (e.g., `'ssh://...'`), we recommend using the [`require` metaparameter](http://docs.puppetlabs.com/references/stable/metaparameter.html#require) to make sure your SSH keys are present before the `vcsrepo` resource is applied:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure     => latest,
+  provider   => hg,
+  source     => 'ssh://hg.example.com//path/to/myrepo',
+  user       => 'toto', #uses toto's $HOME/.ssh setup
+  require    => File['/home/toto/.ssh/id_rsa'],
+}
+~~~
+
+###Perforce
+
+####Create an empty workspace
+
+To set up the connection to your Perforce service, set `p4config` to the location of a valid Perforce [config file](http://www.perforce.com/perforce/doc.current/manuals/p4guide/chapter.configuration.html#configuration.settings.configfiles) stored on the node: 
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure     => present,
+  provider   => p4,
+  p4config   => '/root/.p4config'
+}
+~~~
+
+**Note:** If you don't include the `P4CLIENT` setting in your config file, the provider generates a workspace name based on the digest of `path` and the node's hostname (e.g., `puppet-91bc00640c4e5a17787286acbe2c021c`):
+
+####Create/update and sync a Perforce workspace
+
+To sync a depot path to head, set `ensure` to 'latest':
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => latest,
+  provider => p4,
+  source   => '//depot/branch/...'
+}
+~~~
+
+To sync to a specific changelist, specify its revision number with the `revision` parameter:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => p4,
+  source   => '//depot/branch/...',
+  revision => '2341'
+}
+~~~
+
+You can also set `revision` to a label:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => p4,
+  source   => '//depot/branch/...',
+  revision => 'my_label'
+}
+~~~
+
+###Subversion
+
+####Create a blank repository
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => svn,
+}
+~~~
+
+####Check out from an existing repository
+
+Provide a `source` pointing to the branch or tag you want to check out:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => svn,
+  source   => 'svn://svnrepo/hello/branches/foo',
+}
+~~~
+
+You can also designate a specific revision:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure   => present,
+  provider => svn,
+  source   => 'svn://svnrepo/hello/branches/foo',
+  revision => '1234',
+}
+~~~
+
+####Use a specific Subversion configuration directory 
+
+Use the `configuration` parameter to designate the directory that contains your Subversion configuration files (typically, '/path/to/.subversion'):
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure        => present,
+  provider      => svn,
+  source        => 'svn://svnrepo/hello/branches/foo',
+  configuration => '/path/to/.subversion',
+}
+~~~
+
+####Connect via SSH 
+
+To connect to your source repository via SSH (e.g., `'svn+ssh://...'`), we recommend using the [`require` metaparameter](http://docs.puppetlabs.com/references/stable/metaparameter.html#require) to make sure your SSH keys are present before the `vcsrepo` resource is applied:
+
+~~~
+vcsrepo { '/path/to/repo':
+  ensure     => latest,
+  provider   => svn,
+  source     => 'svn+ssh://svnrepo/hello/branches/foo',
+  user       => 'toto', #uses toto's $HOME/.ssh setup
+  require    => File['/home/toto/.ssh/id_rsa'],
+}
+~~~
+
+##Reference
+
+###Type: vcsrepo
+
+The vcsrepo module adds only one type with several providers. Each provider abstracts a different VCS, and each provider includes a set of features according to its needs.
+
+####Providers
+
+**Note:** Not all features are available with all providers.
+
+#####`git` - Supports the Git VCS.
+
+Features: `bare_repositories`, `depth`, `multiple_remotes`, `reference_tracking`, `ssh_identity`, `submodules`, `user`
+
+Parameters: `depth`, `ensure`, `excludes`, `force`, `group`, `identity`, `owner`, `path`, `provider`, `remote`, `revision`, `source`, `user`
+
+#####`bzr` - Supports the Bazaar VCS.
+
+Features: `reference_tracking`
+
+Parameters: `ensure`, `excludes`, `force`, `group`, `owner`, `path`, `provider`, `revision`, `source`
+
+#####`cvs` - Supports the CVS VCS.
+
+Features: `cvs_rsh`, `gzip_compression`, `modules`, `reference_tracking`, `user`
+
+Parameters: `compression`, `cvs_rsh`, `ensure`, `excludes`, `force`, `group`, `module`, `owner`, `path`, `provider`
+
+#####`hg` - Supports the Mercurial VCS.
+
+Features: `reference_tracking`, `ssh_identity`, `user`
+
+Parameters: `ensure`, `excludes`, `force`, `group`, `identity`, `owner`, `path`, `provider`, `revision`, `source`, `user`
+
+#####`p4` - Supports the Perforce VCS.
+
+Features: `p4config`, `reference_tracking`
+
+Parameters: `ensure`, `excludes`, `force`, `group`, `owner`, `p4config`, `path`, `provider`, `revision`, `source`
+
+#####`svn` - Supports the Subversion VCS.
+
+Features: `basic_auth`, `configuration`, `conflict`, `depth`, `filesystem_types`, `reference_tracking`
+
+Parameters: `basic_auth_password`, `basic_auth_username`, `configuration`, `conflict`, `ensure`, `excludes`, `force`, `fstype`, `group`, `owner`, `path`, `provider`, `revision`, `source`, `trust_server_cert`
+
+####Features
+
+**Note:** Not all features are available with all providers.
+
+* `bare_repositories` - Differentiates between bare repositories and those with working copies. (Available with `git`.)
+* `basic_auth` -  Supports HTTP Basic authentication. (Available with `svn`.)
+* `conflict` - Lets you decide how to resolve any conflicts between the source repository and your working copy. (Available with `svn`.)
+* `configuration` - Lets you specify the location of your configuration files. (Available with `svn`.)
+* `cvs_rsh` - Understands the `CVS_RSH` environment variable. (Available with `cvs`.)
+* `depth` - Supports shallow clones in `git` or sets scope limit in `svn`. (Available with `git` and `svn`.)
+* `filesystem_types` - Supports multiple types of filesystem. (Available with `svn`.)
+* `gzip_compression` - Supports explicit GZip compression levels. (Available with `cvs`.)
+* `modules` - Lets you choose a specific repository module. (Available with `cvs`.)
+* `multiple_remotes` - Tracks multiple remote repositories. (Available with `git`.)
+* `reference_tracking` - Lets you track revision references that can change over time (e.g., some VCS tags and branch names). (Available with all providers)
+* `ssh_identity` - Lets you specify an SSH identity file. (Available with `git` and `hg`.)
+* `user` - Can run as a different user. (Available with `git`, `hg` and `cvs`.)
+* `p4config` - Supports setting the `P4CONFIG` environment. (Available with `p4`.)
+* `submodules` - Supports repository submodules which can be optionally initialized. (Available with `git`.)
+
+####Parameters
+
+All parameters are optional, except where specified otherwise.
+
+##### `basic_auth_password`
+
+Specifies the password for HTTP Basic authentication. (Requires the `basic_auth` feature.) Valid options: a string. Default: none. 
+
+##### `basic_auth_username`
+
+Specifies the username for HTTP Basic authentication. (Requires the `basic_auth` feature.) Valid options: a string. Default: none. 
+
+##### `compression`
+
+Sets the GZIP compression level for the repository history. (Requires the `gzip_compression` feature.) Valid options: an integer between 0 and 6. Default: none. 
+
+##### `configuration`
+
+Sets the configuration directory to use. (Requires the `configuration` feature.) Valid options: a string containing an absolute path. Default: none. 
+
+##### `conflict`
+
+Tells Subversion how to resolve any conflicts between the source repository and your working copy. (Requires the `conflict` feature.) Valid options: 'base', 'mine-full', 'theirs-full', and 'working'. Default: none. 
+
+##### `cvs_rsh`
+
+Provides a value for the `CVS_RSH` environment variable. (Requires the `cvs_rsh` feature.) Valid options: a string. Default: none. 
+
+##### `depth`
+
+In `git` sets the number of commits to include when creating a shallow clone. (Requires the `depth` feature.) Valid options: an integer. Default: none. 
+
+In `svn` instructs Subversion to limit the scope of an operation to a particular tree depth. (Requires the `depth` feature.) Valid options: 'empty', 'files', 'immediates', 'infinity'. Default: none. 
+
+##### `ensure`
+
+Specifies whether the repository should exist. Valid options: 'present', 'bare', 'absent', and 'latest'. Default: 'present'. 
+
+##### `excludes`
+
+Lists any files the repository shouldn't track (similar to .gitignore). Valid options: a string (separate multiple values with the newline character). Default: none. 
+
+##### `force`
+
+Specifies whether to delete any existing files in the repository path if creating a new repository. **Use with care.** Valid options: 'true' and 'false'. Default: 'false'. 
+
+##### `fstype`
+
+Sets the filesystem type. (Requires the `filesystem_types` feature.) Valid options: 'fsfs' or 'bdb'. Default: none. 
+
+##### `group`
+
+Specifies a group to own the repository files. Valid options: a string containing a group name or GID. Default: none. 
+
+##### `identity`
+
+Specifies an identity file to use for SSH authentication. (Requires the `ssh_identity` feature.) Valid options: a string containing an absolute path. Default: none. 
+
+##### `module`
+
+Specifies the repository module to manage. (Requires the `modules` feature.) Valid options: a string containing the name of a CVS module. Default: none. 
+
+##### `owner`
+
+Specifies a user to own the repository files. Valid options: a string containing a username or UID. Default: none. 
+
+##### `p4config`
+
+Specifies a config file that contains settings for connecting to the Perforce service. (Requires the `p4config` feature.) Valid options: a string containing the absolute path to a valid [Perforce config file](http://www.perforce.com/perforce/doc.current/manuals/p4guide/chapter.configuration.html#configuration.settings.configfiles). Default: none. 
+
+##### `path`
+
+Specifies a location for the managed repository. Valid options: a string containing an absolute path. Default: the title of your declared resource. 
+
+##### `provider`
+
+*Required.* Specifies the backend to use for this vcsrepo resource. Valid options: 'bzr', 'cvs', 'git', 'hg', 'p4', and 'svn'. 
+
+##### `remote`
+
+Specifies the remote repository to track. (Requires the `multiple_remotes` feature.) Valid options: a string containing one of the remote names specified in `source`. Default: 'origin'. 
+
+##### `revision`
+
+Sets the revision of the repository. Valid options vary by provider:
+
+* `git` - a string containing a Git branch name, or a commit SHA or tag
+* `bzr` - a string containing a Bazaar [revision spec](http://wiki.bazaar.canonical.com/BzrRevisionSpec)
+* `cvs` - a string containing a CVS [tag or revision number](http://www.thathost.com/wincvs-howto/cvsdoc/cvs_4.html)
+* `hg` - a string containing a Mercurial [changeset ID](http://mercurial.selenic.com/wiki/ChangeSetID) or [tag](http://mercurial.selenic.com/wiki/Tag)
+* `p4` - a string containing a Perforce [change number, label name, client name, or date spec](http://www.perforce.com/perforce/r12.1/manuals/cmdref/o.fspecs.html)
+* `svn` - a string containing a Subversion [revision number](http://svnbook.red-bean.com/en/1.7/svn.basic.in-action.html#svn.basic.in-action.revs), [revision keyword, or revision date](http://svnbook.red-bean.com/en/1.7/svn.tour.revs.specifiers.html)
+
+Default: none. 
+
+##### `source`
+
+Specifies a source repository to serve as the upstream for your managed repository. Default: none. Valid options vary by provider:
+
+* `git` - a string containing a [Git repository URL](https://www.kernel.org/pub/software/scm/git/docs/git-clone.html#_git_urls_a_id_urls_a) or a hash of name => URL mappings. See also [`remote`](#remote).
+* `bzr` - a string containing a Bazaar branch location
+* `cvs` - a string containing a CVS root
+* `hg` - a string containing the local path or URL of a Mercurial repository
+* `p4` - a string containing a Perforce depot path
+* `svn` - a string containing a Subversion repository URL
+
+Default: none. 
+
+##### `submodules`
+
+Specifies whether to initialize and update each submodule in the repository. (Requires the `submodules` feature.) Valid options: 'true' and 'false'. Default: 'true'. 
+
+##### `trust_server_cert`
+
+Instructs Subversion to accept SSL server certificates issued by unknown certificate authorities. Valid options: 'true' and 'false'. Default: 'false'. 
+
+##### `user`
+
+Specifies the user to run as for repository operations. (Requires the `user` feature.) Valid options: a string containing a username or UID. Default: none.
+
+##Limitations
+
+Git is the only VCS provider officially [supported](https://forge.puppetlabs.com/supported) by Puppet Labs.
+
+This module has been tested with Puppet 2.7 and higher.
+
+The module has been tested on:
+
+* CentOS 5/6/7
+* Debian 6/7
+* Oracle 5/6/7
+* Red Hat Enterprise Linux 5/6/7
+* Scientific Linux 5/6/7
+* SLES 10/11/12
+* Ubuntu 10.04/12.04/14.04
+
+Testing on other platforms has been light and cannot be guaranteed.
+
+##Development
+
+Puppet Labs modules on the Puppet Forge are open projects, and community contributions are essential for keeping them great. We can't access the huge number of platforms and myriad of hardware, software, and deployment configurations that Puppet is intended to serve.
+
+We want to keep it as easy as possible to contribute changes so that our modules work in your environment. There are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.
+
+You can read the complete module contribution guide [on the Puppet Labs wiki.](http://projects.puppetlabs.com/projects/module-site/wiki/Module_contributing)
diff --git a/puppet/modules/vcsrepo/Rakefile b/puppet/modules/vcsrepo/Rakefile
new file mode 100755
index 00000000..7e9a13d5
--- /dev/null
+++ b/puppet/modules/vcsrepo/Rakefile
@@ -0,0 +1,42 @@
+require 'puppet_blacksmith/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+require 'puppetlabs_spec_helper/rake_tasks'
+
+PuppetLint.configuration.fail_on_warnings = true
+PuppetLint.configuration.send('relative')
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.send('disable_class_inherits_from_params_class')
+PuppetLint.configuration.send('disable_documentation')
+PuppetLint.configuration.send('disable_single_quote_string_with_variables')
+PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
+
+desc 'Generate pooler nodesets'
+task :gen_nodeset do
+  require 'beaker-hostgenerator'
+  require 'securerandom'
+  require 'fileutils'
+
+  agent_target = ENV['TEST_TARGET']
+  if ! agent_target
+    STDERR.puts 'TEST_TARGET environment variable is not set'
+    STDERR.puts 'setting to default value of "redhat-64default."'
+    agent_target = 'redhat-64default.'
+  end
+
+  master_target = ENV['MASTER_TEST_TARGET']
+  if ! master_target
+    STDERR.puts 'MASTER_TEST_TARGET environment variable is not set'
+    STDERR.puts 'setting to default value of "redhat7-64mdcl"'
+    master_target = 'redhat7-64mdcl'
+  end
+
+  targets = "#{master_target}-#{agent_target}"
+  cli = BeakerHostGenerator::CLI.new([targets])
+  nodeset_dir = "tmp/nodesets"
+  nodeset = "#{nodeset_dir}/#{targets}-#{SecureRandom.uuid}.yaml"
+  FileUtils.mkdir_p(nodeset_dir)
+  File.open(nodeset, 'w') do |fh|
+    fh.print(cli.execute)
+  end
+  puts nodeset
+end
diff --git a/puppet/modules/vcsrepo/examples/bzr/branch.pp b/puppet/modules/vcsrepo/examples/bzr/branch.pp
new file mode 100644
index 00000000..0ed0705e
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/bzr/branch.pp
@@ -0,0 +1,6 @@
+vcsrepo { '/tmp/vcstest-bzr-branch':
+  ensure   => present,
+  provider => bzr,
+  source   => 'lp:do',
+  revision => '1312',
+}
diff --git a/puppet/modules/vcsrepo/examples/bzr/init_repo.pp b/puppet/modules/vcsrepo/examples/bzr/init_repo.pp
new file mode 100644
index 00000000..1129dd7d
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/bzr/init_repo.pp
@@ -0,0 +1,4 @@
+vcsrepo { '/tmp/vcstest-bzr-init':
+  ensure   => present,
+  provider => bzr,
+}
diff --git a/puppet/modules/vcsrepo/examples/cvs/local.pp b/puppet/modules/vcsrepo/examples/cvs/local.pp
new file mode 100644
index 00000000..155742e3
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/cvs/local.pp
@@ -0,0 +1,11 @@
+vcsrepo { '/tmp/vcstest-cvs-repo':
+  ensure   => present,
+  provider => cvs,
+}
+
+vcsrepo { '/tmp/vcstest-cvs-workspace-local':
+  ensure   => present,
+  provider => cvs,
+  source   => '/tmp/vcstest-cvs-repo',
+  require  => Vcsrepo['/tmp/vcstest-cvs-repo'],
+}
diff --git a/puppet/modules/vcsrepo/examples/cvs/remote.pp b/puppet/modules/vcsrepo/examples/cvs/remote.pp
new file mode 100644
index 00000000..eb9665a9
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/cvs/remote.pp
@@ -0,0 +1,5 @@
+vcsrepo { '/tmp/vcstest-cvs-workspace-remote':
+  ensure   => present,
+  provider => cvs,
+  source   => ':pserver:anonymous@cvs.sv.gnu.org:/sources/leetcvrt',
+}
diff --git a/puppet/modules/vcsrepo/examples/git/bare_init.pp b/puppet/modules/vcsrepo/examples/git/bare_init.pp
new file mode 100644
index 00000000..4166f6e6
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/git/bare_init.pp
@@ -0,0 +1,4 @@
+vcsrepo { '/tmp/vcstest-git-bare':
+  ensure   => bare,
+  provider => git,
+}
diff --git a/puppet/modules/vcsrepo/examples/git/clone.pp b/puppet/modules/vcsrepo/examples/git/clone.pp
new file mode 100644
index 00000000..b29a4fdb
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/git/clone.pp
@@ -0,0 +1,5 @@
+vcsrepo { '/tmp/vcstest-git-clone':
+  ensure   => present,
+  provider => git,
+  source   => 'git://github.com/bruce/rtex.git',
+}
diff --git a/puppet/modules/vcsrepo/examples/git/shallow-clone-with-just-one-commit.pp b/puppet/modules/vcsrepo/examples/git/shallow-clone-with-just-one-commit.pp
new file mode 100644
index 00000000..cd5a05db
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/git/shallow-clone-with-just-one-commit.pp
@@ -0,0 +1,7 @@
+vcsrepo { '/tmp/git':
+    ensure   => 'present',
+    provider => 'git',
+    source   => 'https://github.com/git/git.git',
+    branch   => 'v2.2.0',
+    depth    => 1,
+}
diff --git a/puppet/modules/vcsrepo/examples/git/working_copy_init.pp b/puppet/modules/vcsrepo/examples/git/working_copy_init.pp
new file mode 100644
index 00000000..e3352eb7
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/git/working_copy_init.pp
@@ -0,0 +1,4 @@
+vcsrepo { '/tmp/vcstest-git-wc':
+  ensure   => present,
+  provider => git,
+}
diff --git a/puppet/modules/vcsrepo/examples/hg/clone.pp b/puppet/modules/vcsrepo/examples/hg/clone.pp
new file mode 100644
index 00000000..be2d955d
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/hg/clone.pp
@@ -0,0 +1,6 @@
+vcsrepo { '/tmp/vcstest-hg-clone':
+  ensure   => present,
+  provider => hg,
+  source   => 'http://hg.basho.com/riak',
+  revision => 'riak-0.5.3',
+}
diff --git a/puppet/modules/vcsrepo/examples/hg/clone_basic_auth.pp b/puppet/modules/vcsrepo/examples/hg/clone_basic_auth.pp
new file mode 100644
index 00000000..984f8eaf
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/hg/clone_basic_auth.pp
@@ -0,0 +1,7 @@
+vcsrepo { '/path/to/repo':
+  ensure              => latest,
+  provider            => 'hg',
+  source              => 'http://hg.example.com/myrepo',
+  basic_auth_username => 'hgusername',
+  basic_auth_password => 'hgpassword',
+}
diff --git a/puppet/modules/vcsrepo/examples/hg/init_repo.pp b/puppet/modules/vcsrepo/examples/hg/init_repo.pp
new file mode 100644
index 00000000..a8908040
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/hg/init_repo.pp
@@ -0,0 +1,4 @@
+vcsrepo { '/tmp/vcstest-hg-init':
+  ensure   => present,
+  provider => hg,
+}
diff --git a/puppet/modules/vcsrepo/examples/p4/create_client.pp b/puppet/modules/vcsrepo/examples/p4/create_client.pp
new file mode 100644
index 00000000..3cf91602
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/p4/create_client.pp
@@ -0,0 +1,4 @@
+vcsrepo { '/tmp/vcstest/p4_client_root':
+  ensure   => present,
+  provider => 'p4',
+}
diff --git a/puppet/modules/vcsrepo/examples/p4/delete_client.pp b/puppet/modules/vcsrepo/examples/p4/delete_client.pp
new file mode 100644
index 00000000..82c9c952
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/p4/delete_client.pp
@@ -0,0 +1,4 @@
+vcsrepo { '/tmp/vcstest/p4_client_root':
+  ensure   => absent,
+  provider => 'p4',
+}
diff --git a/puppet/modules/vcsrepo/examples/p4/latest_client.pp b/puppet/modules/vcsrepo/examples/p4/latest_client.pp
new file mode 100644
index 00000000..106ef9e9
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/p4/latest_client.pp
@@ -0,0 +1,5 @@
+vcsrepo { '/tmp/vcstest/p4_client_root':
+  ensure   => latest,
+  provider => 'p4',
+  source   => '//depot/...',
+}
diff --git a/puppet/modules/vcsrepo/examples/p4/sync_client.pp b/puppet/modules/vcsrepo/examples/p4/sync_client.pp
new file mode 100644
index 00000000..33e47317
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/p4/sync_client.pp
@@ -0,0 +1,6 @@
+vcsrepo { '/tmp/vcstest/p4_client_root':
+  ensure   => present,
+  provider => 'p4',
+  source   => '//depot/...',
+  revision => '30',
+}
diff --git a/puppet/modules/vcsrepo/examples/svn/checkout.pp b/puppet/modules/vcsrepo/examples/svn/checkout.pp
new file mode 100644
index 00000000..f9fc2730
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/svn/checkout.pp
@@ -0,0 +1,5 @@
+vcsrepo { '/tmp/vcstest-svn-checkout':
+  ensure   => present,
+  provider => svn,
+  source   => 'http://svn.edgewall.org/repos/babel/trunk',
+}
diff --git a/puppet/modules/vcsrepo/examples/svn/server.pp b/puppet/modules/vcsrepo/examples/svn/server.pp
new file mode 100644
index 00000000..de7c390f
--- /dev/null
+++ b/puppet/modules/vcsrepo/examples/svn/server.pp
@@ -0,0 +1,4 @@
+vcsrepo { '/tmp/vcstest-svn-server':
+  ensure   => present,
+  provider => svn,
+}
diff --git a/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo.rb b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo.rb
new file mode 100644
index 00000000..8793e632
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo.rb
@@ -0,0 +1,42 @@
+require 'tmpdir'
+require 'digest/md5'
+require 'fileutils'
+
+# Abstract
+class Puppet::Provider::Vcsrepo < Puppet::Provider
+
+  private
+
+  def set_ownership
+    owner = @resource.value(:owner) || nil
+    group = @resource.value(:group) || nil
+    FileUtils.chown_R(owner, group, @resource.value(:path))
+  end
+
+  def path_exists?
+    File.directory?(@resource.value(:path))
+  end
+
+  def path_empty?
+    # Path is empty if the only entries are '.' and '..'
+    d = Dir.new(@resource.value(:path))
+    d.read # should return '.'
+    d.read # should return '..'
+    d.read.nil?
+  end
+
+  # Note: We don't rely on Dir.chdir's behavior of automatically returning the
+  # value of the last statement -- for easier stubbing.
+  def at_path(&block) #:nodoc:
+    value = nil
+    Dir.chdir(@resource.value(:path)) do
+      value = yield
+    end
+    value
+  end
+
+  def tempdir
+    @tempdir ||= File.join(Dir.tmpdir, 'vcsrepo-' + Digest::MD5.hexdigest(@resource.value(:path)))
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/bzr.rb b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/bzr.rb
new file mode 100644
index 00000000..797d84d2
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/bzr.rb
@@ -0,0 +1,93 @@
+require File.join(File.dirname(__FILE__), '..', 'vcsrepo')
+
+Puppet::Type.type(:vcsrepo).provide(:bzr, :parent => Puppet::Provider::Vcsrepo) do
+  desc "Supports Bazaar repositories"
+
+  commands :bzr => 'bzr'
+  has_features :reference_tracking
+
+  def create
+    if !@resource.value(:source)
+      create_repository(@resource.value(:path))
+    else
+      clone_repository(@resource.value(:revision))
+    end
+  end
+
+  def working_copy_exists?
+    File.directory?(File.join(@resource.value(:path), '.bzr'))
+  end
+
+  def exists?
+    working_copy_exists?
+  end
+
+  def destroy
+    FileUtils.rm_rf(@resource.value(:path))
+  end
+
+  def revision
+    at_path do
+      current_revid = bzr('version-info')[/^revision-id:\s+(\S+)/, 1]
+      desired = @resource.value(:revision)
+      begin
+        desired_revid = bzr('revision-info', desired).strip.split(/\s+/).last
+      rescue Puppet::ExecutionFailure
+        # Possible revid available during update (but definitely not current)
+        desired_revid = nil
+      end
+      if current_revid == desired_revid
+        desired
+      else
+        current_revid
+      end
+    end
+  end
+
+  def revision=(desired)
+    at_path do
+      begin
+        bzr('update', '-r', desired)
+      rescue Puppet::ExecutionFailure
+        bzr('update', '-r', desired, ':parent')
+      end
+    end
+    update_owner
+  end
+
+  def latest
+    at_path do
+      bzr('version-info', ':parent')[/^revision-id:\s+(\S+)/, 1]
+    end
+  end
+
+  def latest?
+    at_path do
+      return self.revision == self.latest
+    end
+  end
+
+  private
+
+  def create_repository(path)
+    bzr('init', path)
+    update_owner
+  end
+
+  def clone_repository(revision)
+    args = ['branch']
+    if revision
+      args.push('-r', revision)
+    end
+    args.push(@resource.value(:source),
+              @resource.value(:path))
+    bzr(*args)
+    update_owner
+  end
+
+  def update_owner
+    if @resource.value(:owner) or @resource.value(:group)
+      set_ownership
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/cvs.rb b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/cvs.rb
new file mode 100644
index 00000000..7a8f6ef3
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/cvs.rb
@@ -0,0 +1,135 @@
+require File.join(File.dirname(__FILE__), '..', 'vcsrepo')
+
+Puppet::Type.type(:vcsrepo).provide(:cvs, :parent => Puppet::Provider::Vcsrepo) do
+  desc "Supports CVS repositories/workspaces"
+
+  commands :cvs => 'cvs'
+  has_features :gzip_compression, :reference_tracking, :modules, :cvs_rsh, :user
+
+  def create
+    if !@resource.value(:source)
+      create_repository(@resource.value(:path))
+    else
+      checkout_repository
+    end
+    update_owner
+  end
+
+  def exists?
+    if @resource.value(:source)
+      directory = File.join(@resource.value(:path), 'CVS')
+    else
+      directory = File.join(@resource.value(:path), 'CVSROOT')
+    end
+    File.directory?(directory)
+  end
+
+  def working_copy_exists?
+    File.directory?(File.join(@resource.value(:path), 'CVS'))
+  end
+
+  def destroy
+    FileUtils.rm_rf(@resource.value(:path))
+  end
+
+  def latest?
+    Puppet.debug "Checking for updates because 'ensure => latest'"
+    at_path do
+      # We cannot use -P to prune empty dirs, otherwise
+      # CVS would report those as "missing", regardless
+      # if they have contents or updates.
+      is_current = (runcvs('-nq', 'update', '-d').strip == "")
+      if (!is_current) then Puppet.debug "There are updates available on the checkout's current branch/tag." end
+      return is_current
+    end
+  end
+
+  def latest
+    # CVS does not have a conecpt like commit-IDs or change
+    # sets, so we can only have the current branch name (or the
+    # requested one, if that differs) as the "latest" revision.
+    should = @resource.value(:revision)
+    current = self.revision
+    return should != current ? should : current
+  end
+
+  def revision
+    if !@rev
+      if File.exist?(tag_file)
+        contents = File.read(tag_file).strip
+        # Note: Doesn't differentiate between N and T entries
+        @rev = contents[1..-1]
+      else
+        @rev = 'HEAD'
+      end
+      Puppet.debug "Checkout is on branch/tag '#{@rev}'"
+    end
+    return @rev
+  end
+
+  def revision=(desired)
+    at_path do
+      runcvs('update', '-dr', desired, '.')
+      update_owner
+      @rev = desired
+    end
+  end
+
+  private
+
+  def tag_file
+    File.join(@resource.value(:path), 'CVS', 'Tag')
+  end
+
+  def checkout_repository
+    dirname, basename = File.split(@resource.value(:path))
+    Dir.chdir(dirname) do
+      args = ['-d', @resource.value(:source)]
+      if @resource.value(:compression)
+        args.push('-z', @resource.value(:compression))
+      end
+      args.push('checkout')
+      if @resource.value(:revision)
+        args.push('-r', @resource.value(:revision))
+      end
+      args.push('-d', basename, module_name)
+      runcvs(*args)
+    end
+  end
+
+  # When the source:
+  # * Starts with ':' (eg, :pserver:...)
+  def module_name
+    if (m = @resource.value(:module))
+      m
+    elsif (source = @resource.value(:source))
+      source[0, 1] == ':' ? File.basename(source) : '.'
+    end
+  end
+
+  def create_repository(path)
+    runcvs('-d', path, 'init')
+  end
+
+  def update_owner
+    if @resource.value(:owner) or @resource.value(:group)
+      set_ownership
+    end
+  end
+
+  def runcvs(*args)
+    if @resource.value(:cvs_rsh)
+      Puppet.debug "Using CVS_RSH = " + @resource.value(:cvs_rsh)
+      e = { :CVS_RSH => @resource.value(:cvs_rsh) }
+    else
+      e = {}
+    end
+
+    if @resource.value(:user) and @resource.value(:user) != Facter['id'].value
+      Puppet.debug "Running as user " + @resource.value(:user)
+      Puppet::Util::Execution.execute([:cvs, *args], :uid => @resource.value(:user), :custom_environment => e)
+    else
+      Puppet::Util::Execution.execute([:cvs, *args], :custom_environment => e)
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/dummy.rb b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/dummy.rb
new file mode 100644
index 00000000..27bfbbed
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/dummy.rb
@@ -0,0 +1,12 @@
+require File.join(File.dirname(__FILE__), '..', 'vcsrepo')
+
+Puppet::Type.type(:vcsrepo).provide(:dummy, :parent => Puppet::Provider::Vcsrepo) do
+  desc "Dummy default provider"
+
+  defaultfor :feature => :posix
+
+  def working_copy_exists?
+    providers = @resource.class.providers.map{|x| x.to_s}.sort.reject{|x| x == "dummy"}.join(", ") rescue "none"
+    raise("vcsrepo resource must have a provider, available: #{providers}")
+  end
+end
diff --git a/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/git.rb b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/git.rb
new file mode 100644
index 00000000..9d18b474
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/git.rb
@@ -0,0 +1,483 @@
+require File.join(File.dirname(__FILE__), '..', 'vcsrepo')
+
+Puppet::Type.type(:vcsrepo).provide(:git, :parent => Puppet::Provider::Vcsrepo) do
+  desc "Supports Git repositories"
+
+  has_command(:git, 'git') do
+    environment({ 'HOME' => ENV['HOME'] })
+  end
+
+  has_features :bare_repositories, :reference_tracking, :ssh_identity, :multiple_remotes, :user, :depth, :branch, :submodules
+
+  def create
+    if @resource.value(:revision) and ensure_bare_or_mirror?
+      fail("Cannot set a revision (#{@resource.value(:revision)}) on a bare repository")
+    end
+    if !@resource.value(:source)
+      if @resource.value(:ensure) == :mirror
+        fail("Cannot init repository with mirror option, try bare instead")
+      end
+
+      init_repository(@resource.value(:path))
+    else
+      clone_repository(default_url, @resource.value(:path))
+      update_remotes
+
+      if @resource.value(:revision)
+        checkout
+      end
+      if !ensure_bare_or_mirror? && @resource.value(:submodules) == :true
+        update_submodules
+      end
+
+    end
+    update_owner_and_excludes
+  end
+
+  def destroy
+    FileUtils.rm_rf(@resource.value(:path))
+  end
+
+  # Checks to see if the current revision is equal to the revision on the
+  # remote (whether on a branch, tag, or reference)
+  #
+  # @return [Boolean] Returns true if the repo is on the latest revision
+  def latest?
+    return revision == latest_revision
+  end
+
+  # Just gives the `should` value that we should be setting the repo to if
+  # latest? returns false
+  #
+  # @return [String] Returns the target sha/tag/branch
+  def latest
+    if not @resource.value(:revision) and branch = on_branch?
+      return branch
+    else
+      return @resource.value(:revision)
+    end
+  end
+
+  # Get the current revision of the repo (tag/branch/sha)
+  #
+  # @return [String] Returns the branch/tag if the current sha matches the
+  #                  remote; otherwise returns the current sha.
+  def revision
+    #HEAD is the default, but lets just be explicit here.
+    get_revision('HEAD')
+  end
+
+  # Is passed the desired reference, whether a tag, rev, or branch. Should
+  # handle transitions from a rev/branch/tag to a rev/branch/tag. Detached
+  # heads should be treated like bare revisions.
+  #
+  # @param [String] desired The desired revision to which the repo should be
+  #                         set.
+  def revision=(desired)
+    #just checkout tags and shas; fetch has already happened so they should be updated.
+    checkout(desired)
+    #branches require more work.
+    if local_branch_revision?(desired)
+      #reset instead of pull to avoid merge conflicts. assuming remote is
+      #updated and authoritative.
+      #TODO might be worthwhile to have an allow_local_changes param to decide
+      #whether to reset or pull when we're ensuring latest.
+      if @resource.value(:source)
+        at_path { git_with_identity('reset', '--hard', "#{@resource.value(:remote)}/#{desired}") }
+      else
+        at_path { git_with_identity('reset', '--hard', "#{desired}") }
+      end
+    end
+    #TODO Would this ever reach here if it is bare?
+    if !ensure_bare_or_mirror? && @resource.value(:submodules) == :true
+      update_submodules
+    end
+    update_owner_and_excludes
+  end
+
+  def bare_exists?
+    bare_git_config_exists? && !working_copy_exists?
+  end
+
+  def ensure_bare_or_mirror?
+    [:bare, :mirror].include? @resource.value(:ensure)
+  end
+
+  # If :source is set to a hash (for supporting multiple remotes),
+  # we search for the URL for :remote. If it doesn't exist,
+  # we throw an error. If :source is just a string, we use that
+  # value for the default URL.
+  def default_url
+    if @resource.value(:source).is_a?(Hash)
+      if @resource.value(:source).has_key?(@resource.value(:remote))
+        @resource.value(:source)[@resource.value(:remote)]
+      else
+        fail("You must specify the URL for #{@resource.value(:remote)} in the :source hash")
+      end
+    else
+      @resource.value(:source)
+    end
+  end
+
+  def working_copy_exists?
+    if @resource.value(:source) and File.exists?(File.join(@resource.value(:path), '.git', 'config'))
+      File.readlines(File.join(@resource.value(:path), '.git', 'config')).grep(/#{Regexp.escape(default_url)}/).any?
+    else
+      File.directory?(File.join(@resource.value(:path), '.git'))
+    end
+  end
+
+  def exists?
+    working_copy_exists? || bare_exists?
+  end
+
+  def update_remote_url(remote_name, remote_url)
+    do_update = false
+    current = git_with_identity('config', '-l')
+
+    unless remote_url.nil?
+      # Check if remote exists at all, regardless of URL.
+      # If remote doesn't exist, add it
+      if not current.include? "remote.#{remote_name}.url"
+        git_with_identity('remote','add', remote_name, remote_url)
+        return true
+
+      # If remote exists, but URL doesn't match, update URL
+      elsif not current.include? "remote.#{remote_name}.url=#{remote_url}"
+        git_with_identity('remote','set-url', remote_name, remote_url)
+        return true
+      else
+        return false
+      end
+    end
+
+  end
+
+  def update_remotes
+    do_update = false
+
+    # If supplied source is a hash of remote name and remote url pairs, then
+    # we loop around the hash. Otherwise, we assume single url specified
+    # in source property
+    if @resource.value(:source).is_a?(Hash)
+      @resource.value(:source).keys.sort.each do |remote_name|
+        remote_url = @resource.value(:source)[remote_name]
+        at_path { do_update |= update_remote_url(remote_name, remote_url) }
+      end
+    else
+      at_path { do_update |= update_remote_url(@resource.value(:remote), @resource.value(:source)) }
+    end
+
+    # If at least one remote was added or updated, then we must
+    # call the 'git remote update' command
+    if do_update == true
+      at_path { git_with_identity('remote','update') }
+    end
+
+  end
+
+  def update_references
+    at_path do
+      update_remotes
+      git_with_identity('fetch', @resource.value(:remote))
+      git_with_identity('fetch', '--tags', @resource.value(:remote))
+      update_owner_and_excludes
+    end
+  end
+
+  private
+
+  def valid_repo?
+    Dir.chdir(@resource.value(:path)){ system('git rev-parse > /dev/null 2>&1')}
+  end
+
+  def bare_git_config_exists?
+    File.exist?(File.join(@resource.value(:path), 'config')) && valid_repo?
+  end
+
+  # @!visibility private
+  def clone_repository(source, path)
+    check_force
+    args = ['clone']
+    if @resource.value(:depth) and @resource.value(:depth).to_i > 0
+      args.push('--depth', @resource.value(:depth).to_s)
+      if @resource.value(:revision)
+        args.push('--branch', @resource.value(:revision).to_s)
+      end
+    end
+    if @resource.value(:branch)
+      args.push('--branch', @resource.value(:branch).to_s)
+    end
+
+    case @resource.value(:ensure)
+    when :bare then args << '--bare'
+    when :mirror then args << '--mirror'
+    end
+
+    if @resource.value(:remote) != 'origin'
+      args.push('--origin', @resource.value(:remote))
+    end
+    if !working_copy_exists?
+      args.push(source, path)
+      Dir.chdir("/") do
+        git_with_identity(*args)
+      end
+    else
+      notice "Repo has already been cloned"
+    end
+  end
+
+  # @!visibility private
+  def check_force
+    if path_exists? and not path_empty?
+      if @resource.value(:force) && !valid_repo?
+        notice "Removing %s to replace with vcsrepo." % @resource.value(:path)
+        destroy
+      else
+        raise Puppet::Error, "Could not create repository (non-repository at path)"
+      end
+    end
+  end
+
+  # @!visibility private
+  def init_repository(path)
+    check_force
+    if @resource.value(:ensure) == :bare && working_copy_exists?
+      convert_working_copy_to_bare
+    elsif @resource.value(:ensure) == :present && bare_exists?
+      convert_bare_to_working_copy
+    else
+      # normal init
+      FileUtils.mkdir(@resource.value(:path))
+      FileUtils.chown(@resource.value(:user), nil, @resource.value(:path)) if @resource.value(:user)
+      args = ['init']
+      if @resource.value(:ensure) == :bare
+        args << '--bare'
+      end
+      at_path do
+        git_with_identity(*args)
+      end
+    end
+  end
+
+  # Convert working copy to bare
+  #
+  # Moves:
+  #   <path>/.git
+  # to:
+  #   <path>/
+  # @!visibility private
+  def convert_working_copy_to_bare
+    notice "Converting working copy repository to bare repository"
+    FileUtils.mv(File.join(@resource.value(:path), '.git'), tempdir)
+    FileUtils.rm_rf(@resource.value(:path))
+    FileUtils.mv(tempdir, @resource.value(:path))
+  end
+
+  # Convert bare to working copy
+  #
+  # Moves:
+  #   <path>/
+  # to:
+  #   <path>/.git
+  # @!visibility private
+  def convert_bare_to_working_copy
+    notice "Converting bare repository to working copy repository"
+    FileUtils.mv(@resource.value(:path), tempdir)
+    FileUtils.mkdir(@resource.value(:path))
+    FileUtils.mv(tempdir, File.join(@resource.value(:path), '.git'))
+    if commits_in?(File.join(@resource.value(:path), '.git'))
+      reset('HEAD')
+      git_with_identity('checkout', '--force')
+      update_owner_and_excludes
+    end
+  end
+
+  # @!visibility private
+  def commits_in?(dot_git)
+    Dir.glob(File.join(dot_git, 'objects/info/*'), File::FNM_DOTMATCH) do |e|
+      return true unless %w(. ..).include?(File::basename(e))
+    end
+    false
+  end
+
+  # Will checkout a rev/branch/tag using the locally cached versions. Does not
+  # handle upstream branch changes
+  # @!visibility private
+  def checkout(revision = @resource.value(:revision))
+    if !local_branch_revision?(revision) && remote_branch_revision?(revision)
+      #non-locally existant branches (perhaps switching to a branch that has never been checked out)
+      at_path { git_with_identity('checkout', '--force', '-b', revision, '--track', "#{@resource.value(:remote)}/#{revision}") }
+    else
+      #tags, locally existant branches (perhaps outdated), and shas
+      at_path { git_with_identity('checkout', '--force', revision) }
+    end
+  end
+
+  # @!visibility private
+  def reset(desired)
+    at_path do
+      git_with_identity('reset', '--hard', desired)
+    end
+  end
+
+  # @!visibility private
+  def update_submodules
+    at_path do
+      git_with_identity('submodule', 'update', '--init', '--recursive')
+    end
+  end
+
+  # Determins if the branch exists at the upstream but has not yet been locally committed
+  # @!visibility private
+  def remote_branch_revision?(revision = @resource.value(:revision))
+    # git < 1.6 returns '#{@resource.value(:remote)}/#{revision}'
+    # git 1.6+ returns 'remotes/#{@resource.value(:remote)}/#{revision}'
+    branch = at_path { branches.grep /(remotes\/)?#{@resource.value(:remote)}\/#{revision}$/ }
+    branch unless branch.empty?
+  end
+
+  # Determins if the branch is already cached locally
+  # @!visibility private
+  def local_branch_revision?(revision = @resource.value(:revision))
+    at_path { branches.include?(revision) }
+  end
+
+  # @!visibility private
+  def tag_revision?(revision = @resource.value(:revision))
+    at_path { tags.include?(revision) }
+  end
+
+  # @!visibility private
+  def branches
+    at_path { git_with_identity('branch', '-a') }.gsub('*', ' ').split(/\n/).map { |line| line.strip }
+  end
+
+  # git < 2.4 returns 'detached from'
+  # git 2.4+ returns 'HEAD detached at'
+  # @!visibility private
+  def on_branch?
+    at_path {
+      matches = git_with_identity('branch', '-a').match /\*\s+(.*)/
+      matches[1] unless matches[1].match /(\(detached from|\(HEAD detached at|\(no branch)/
+    }
+  end
+
+  # @!visibility private
+  def tags
+    at_path { git_with_identity('tag', '-l') }.split(/\n/).map { |line| line.strip }
+  end
+
+  # @!visibility private
+  def set_excludes
+    # Excludes may be an Array or a String.
+    at_path do
+      open('.git/info/exclude', 'w') do |f|
+        if @resource.value(:excludes).respond_to?(:each)
+          @resource.value(:excludes).each { |ex| f.puts ex }
+        else
+          f.puts @resource.value(:excludes)
+        end
+      end
+    end
+  end
+
+  # Finds the latest revision or sha of the current branch if on a branch, or
+  # of HEAD otherwise.
+  # @note Calls create which can forcibly destroy and re-clone the repo if
+  #       force => true
+  # @see get_revision
+  #
+  # @!visibility private
+  # @return [String] Returns the output of get_revision
+  def latest_revision
+    #TODO Why is create called here anyway?
+    create if @resource.value(:force) && working_copy_exists?
+    create if !working_copy_exists?
+
+    if branch = on_branch?
+      return get_revision("#{@resource.value(:remote)}/#{branch}")
+    else
+      return get_revision
+    end
+  end
+
+  # Returns the current revision given if the revision is a tag or branch and
+  # matches the current sha. If the current sha does not match the sha of a tag
+  # or branch, then it will just return the sha (ie, is not in sync)
+  #
+  # @!visibility private
+  #
+  # @param [String] rev The revision of which to check if it is current
+  # @return [String] Returns the tag/branch of the current repo if it's up to
+  #                  date; otherwise returns the sha of the requested revision.
+  def get_revision(rev = 'HEAD')
+    if @resource.value(:source)
+      update_references
+    else
+      status = at_path { git_with_identity('status')}
+      is_it_new = status =~ /Initial commit/
+      if is_it_new
+        status =~ /On branch (.*)/
+        branch = $1
+        return branch
+      end
+    end
+    current = at_path { git_with_identity('rev-parse', rev).strip }
+    if @resource.value(:revision)
+      if tag_revision?
+        # git-rev-parse will give you the hash of the tag object itself rather
+        # than the commit it points to by default. Using tag^0 will return the
+        # actual commit.
+        canonical = at_path { git_with_identity('rev-parse', "#{@resource.value(:revision)}^0").strip }
+      elsif local_branch_revision?
+        canonical = at_path { git_with_identity('rev-parse', @resource.value(:revision)).strip }
+      elsif remote_branch_revision?
+        canonical = at_path { git_with_identity('rev-parse', "#{@resource.value(:remote)}/#{@resource.value(:revision)}").strip }
+      else
+        #look for a sha (could match invalid shas)
+        canonical = at_path { git_with_identity('rev-parse', '--revs-only', @resource.value(:revision)).strip }
+      end
+      fail("#{@resource.value(:revision)} is not a local or remote ref") if canonical.nil? or canonical.empty?
+      current = @resource.value(:revision) if current == canonical
+    end
+    return current
+  end
+
+  # @!visibility private
+  def update_owner_and_excludes
+    if @resource.value(:owner) or @resource.value(:group)
+      set_ownership
+    end
+    if @resource.value(:excludes)
+      set_excludes
+    end
+  end
+
+  # @!visibility private
+  def git_with_identity(*args)
+    if @resource.value(:identity)
+      Tempfile.open('git-helper', Puppet[:statedir]) do |f|
+        f.puts '#!/bin/sh'
+        f.puts 'export SSH_AUTH_SOCKET='
+        f.puts "exec ssh -oStrictHostKeyChecking=no -oPasswordAuthentication=no -oKbdInteractiveAuthentication=no -oChallengeResponseAuthentication=no -oConnectTimeout=120 -i #{@resource.value(:identity)} $*"
+        f.close
+
+        FileUtils.chmod(0755, f.path)
+        env_save = ENV['GIT_SSH']
+        ENV['GIT_SSH'] = f.path
+
+        ret = git(*args)
+
+        ENV['GIT_SSH'] = env_save
+
+        return ret
+      end
+    elsif @resource.value(:user) and @resource.value(:user) != Facter['id'].value
+      env = Etc.getpwnam(@resource.value(:user))
+      Puppet::Util::Execution.execute("git #{args.join(' ')}", :uid => @resource.value(:user), :failonfail => true, :custom_environment => {'HOME' => env['dir']})
+    else
+      git(*args)
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/hg.rb b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/hg.rb
new file mode 100644
index 00000000..294c2a97
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/hg.rb
@@ -0,0 +1,130 @@
+require File.join(File.dirname(__FILE__), '..', 'vcsrepo')
+
+Puppet::Type.type(:vcsrepo).provide(:hg, :parent => Puppet::Provider::Vcsrepo) do
+  desc "Supports Mercurial repositories"
+
+  commands :hg => 'hg'
+
+  has_features :reference_tracking, :ssh_identity, :user, :basic_auth
+
+  def create
+    if !@resource.value(:source)
+      create_repository(@resource.value(:path))
+    else
+      clone_repository(@resource.value(:revision))
+    end
+    update_owner
+  end
+
+  def working_copy_exists?
+    File.directory?(File.join(@resource.value(:path), '.hg'))
+  end
+
+  def exists?
+    working_copy_exists?
+  end
+
+  def destroy
+    FileUtils.rm_rf(@resource.value(:path))
+  end
+
+  def latest?
+    at_path do
+      return self.revision == self.latest
+    end
+  end
+
+  def latest
+    at_path do
+      begin
+        hg_wrapper('incoming', '--branch', '.', '--newest-first', '--limit', '1', { :remote => true })[/^changeset:\s+(?:-?\d+):(\S+)/m, 1]
+      rescue Puppet::ExecutionFailure
+        # If there are no new changesets, return the current nodeid
+        self.revision
+      end
+    end
+  end
+
+  def revision
+    at_path do
+      current = hg_wrapper('parents')[/^changeset:\s+(?:-?\d+):(\S+)/m, 1]
+      desired = @resource.value(:revision)
+      if desired
+        # Return the tag name if it maps to the current nodeid
+        mapped = hg_wrapper('tags')[/^#{Regexp.quote(desired)}\s+\d+:(\S+)/m, 1]
+        if current == mapped
+          desired
+        else
+          current
+        end
+      else
+        current
+      end
+    end
+  end
+
+  def revision=(desired)
+    at_path do
+      begin
+        hg_wrapper('pull', { :remote => true })
+      rescue
+      end
+      begin
+        hg_wrapper('merge')
+      rescue Puppet::ExecutionFailure
+        # If there's nothing to merge, just skip
+      end
+      hg_wrapper('update', '--clean', '-r', desired)
+    end
+    update_owner
+  end
+
+  private
+
+  def create_repository(path)
+    hg_wrapper('init', path)
+  end
+
+  def clone_repository(revision)
+    args = ['clone']
+    if revision
+      args.push('-u', revision)
+    end
+    args.push(@resource.value(:source),
+              @resource.value(:path))
+    args.push({ :remote => true })
+    hg_wrapper(*args)
+  end
+
+  def update_owner
+    if @resource.value(:owner) or @resource.value(:group)
+      set_ownership
+    end
+  end
+
+  def hg_wrapper(*args)
+    options = { :remote => false }
+    if args.length > 0 and args[-1].is_a? Hash
+      options.merge!(args.pop)
+    end
+
+    if @resource.value(:basic_auth_username) && @resource.value(:basic_auth_password)
+      args += [
+        "--config", "\"auth.x.prefix=#{@resource.value(:source)}\"",
+        "--config", "\"auth.x.username=#{@resource.value(:basic_auth_username)}\"",
+        "--config", "\"auth.x.password=#{@resource.value(:basic_auth_password)}\"",
+        "--config", "\"auth.x.schemes=http https\""
+      ]
+    end
+
+    if options[:remote] and @resource.value(:identity)
+      args += ["--ssh", "ssh -oStrictHostKeyChecking=no -oPasswordAuthentication=no -oKbdInteractiveAuthentication=no -oChallengeResponseAuthentication=no -i #{@resource.value(:identity)}"]
+    end
+    if @resource.value(:user) and @resource.value(:user) != Facter['id'].value
+      args.map! { |a| if a =~ /\s/ then "'#{a}'" else a end }  # Adds quotes to arguments with whitespaces.
+      Puppet::Util::Execution.execute("hg #{args.join(' ')}", :uid => @resource.value(:user), :failonfail => true)
+    else
+      hg(*args)
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/p4.rb b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/p4.rb
new file mode 100644
index 00000000..b429bcbb
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/p4.rb
@@ -0,0 +1,278 @@
+require File.join(File.dirname(__FILE__), '..', 'vcsrepo')
+
+Puppet::Type.type(:vcsrepo).provide(:p4, :parent => Puppet::Provider::Vcsrepo) do
+  desc "Supports Perforce depots"
+
+  has_features :filesystem_types, :reference_tracking, :p4config
+
+  def create
+    # create or update client
+    create_client(client_name)
+
+    # if source provided, sync client
+    source = @resource.value(:source)
+    if source
+      revision = @resource.value(:revision)
+      sync_client(source, revision)
+    end
+
+    update_owner
+  end
+
+  def working_copy_exists?
+    # Check if the server is there, or raise error
+    p4(['info'], {:marshal => false})
+
+    # Check if workspace is setup
+    args = ['where']
+    args.push(@resource.value(:path) + "...")
+    hash = p4(args, {:raise => false})
+
+    return (hash['code'] != "error")
+  end
+
+  def exists?
+    working_copy_exists?
+  end
+
+  def destroy
+    args = ['client']
+    args.push('-d', '-f')
+    args.push(client_name)
+    p4(args)
+    FileUtils.rm_rf(@resource.value(:path))
+  end
+
+  def latest?
+    rev = self.revision
+    if rev
+      (rev >= self.latest)
+    else
+      true
+    end
+  end
+
+  def latest
+    args = ['changes']
+    args.push('-m1', @resource.value(:source))
+    hash = p4(args)
+
+    return hash['change'].to_i
+  end
+
+  def revision
+    args = ['cstat']
+    args.push(@resource.value(:source))
+    hash = p4(args, {:marshal => false})
+    hash = marshal_cstat(hash)
+
+    revision = 0
+    if hash && hash['code'] != 'error'
+      hash['data'].each do |c|
+        if c['status'] == 'have'
+          change = c['change'].to_i
+          revision = change if change > revision
+        end
+      end
+    end
+    return revision
+  end
+
+  def revision=(desired)
+    sync_client(@resource.value(:source), desired)
+    update_owner
+  end
+
+  private
+
+  def update_owner
+    if @resource.value(:owner) or @resource.value(:group)
+      set_ownership
+    end
+  end
+
+  # Sync the client workspace files to head or specified revision.
+  # Params:
+  # +source+:: Depot path to sync
+  # +revision+:: Perforce change list to sync to (optional)
+  def sync_client(source, revision)
+    Puppet.debug "Syncing: #{source}"
+    args = ['sync']
+    if revision
+      args.push(source + "@#{revision}")
+    else
+      args.push(source)
+    end
+    p4(args)
+  end
+
+  # Returns the name of the Perforce client workspace
+  def client_name
+    p4config = @resource.value(:p4config)
+
+    # default (generated) client name
+    path = @resource.value(:path)
+    host = Facter.value('hostname')
+    default = "puppet-" + Digest::MD5.hexdigest(path + host)
+
+    # check config for client name
+    set_client = nil
+    if p4config && File.file?(p4config)
+      open(p4config) do |f|
+        m = f.grep(/^P4CLIENT=/).pop
+        p = /^P4CLIENT=(.*)$/
+        set_client = p.match(m)[1] if m
+      end
+    end
+
+    return set_client || ENV['P4CLIENT'] || default
+  end
+
+  # Create (or update) a client workspace spec.
+  # If a client name is not provided then a hash based on the path is used.
+  # Params:
+  # +client+:: Name of client workspace
+  # +path+:: The Root location of the Perforce client workspace
+  def create_client(client)
+    Puppet.debug "Creating client: #{client}"
+
+    # fetch client spec
+    hash = parse_client(client)
+    hash['Root'] = @resource.value(:path)
+    hash['Description'] = "Generated by Puppet VCSrepo"
+
+    # check is source is a Stream
+    source = @resource.value(:source)
+    if source
+      parts = source.split(/\//)
+      if parts && parts.length >= 4
+        source = "//" + parts[2] + "/" + parts[3]
+        streams = p4(['streams', source], {:raise => false})
+        if streams['code'] == "stat"
+          hash['Stream'] = streams['Stream']
+          notice "Streams" + streams['Stream'].inspect
+        end
+      end
+    end
+
+    # save client spec
+    save_client(hash)
+  end
+
+
+  # Fetches a client workspace spec from Perforce and returns a hash map representation.
+  # Params:
+  # +client+:: name of the client workspace
+  def parse_client(client)
+    args = ['client']
+    args.push('-o', client)
+    hash = p4(args)
+
+    return hash
+  end
+
+
+  # Saves the client workspace spec from the given hash
+  # Params:
+  # +hash+:: hash map of client spec
+  def save_client(hash)
+    spec = String.new
+    view = "\nView:\n"
+
+    hash.keys.sort.each do |k|
+      v = hash[k]
+      next if( k == "code" )
+      if(k.to_s =~ /View/ )
+        view += "\t#{v}\n"
+      else
+        spec += "#{k.to_s}: #{v.to_s}\n"
+      end
+    end
+    spec += view
+
+    args = ['client']
+    args.push('-i')
+    p4(args, {:input => spec, :marshal => false})
+  end
+
+  # Sets Perforce Configuration environment.
+  # P4CLIENT generated, but overwitten if defined in config.
+  def config
+    p4config = @resource.value(:p4config)
+
+    cfg = Hash.new
+    cfg.store 'P4CONFIG', p4config if p4config
+    cfg.store 'P4CLIENT', client_name
+    return cfg
+  end
+
+  def p4(args, options = {})
+    # Merge custom options with defaults
+    opts = {
+      :raise    => true,    # Raise errors
+      :marshal  => true,    # Marshal output
+    }.merge(options)
+
+    cmd = ['p4']
+    cmd.push '-R' if opts[:marshal]
+    cmd.push args
+    cmd_str = cmd.respond_to?(:join) ? cmd.join(' ') : cmd
+
+    Puppet.debug "environment: #{config}"
+    Puppet.debug "command: #{cmd_str}"
+
+    hash = Hash.new
+    Open3.popen3(config, cmd_str) do |i, o, e, t|
+      # Send input stream if provided
+      if(opts[:input])
+        Puppet.debug "input:\n" + opts[:input]
+        i.write opts[:input]
+        i.close
+      end
+
+      if(opts[:marshal])
+        hash = Marshal.load(o)
+      else
+        hash['data'] = o.read
+      end
+
+      # Raise errors, Perforce or Exec
+      if(opts[:raise] && !e.eof && t.value != 0)
+        raise Puppet::Error, "\nP4: #{e.read}"
+      end
+      if(opts[:raise] && hash['code'] == 'error' && t.value != 0)
+        raise Puppet::Error, "\nP4: #{hash['data']}"
+      end
+    end
+
+    Puppet.debug "hash: #{hash}\n"
+    return hash
+  end
+
+  # helper method as cstat does not Marshal
+  def marshal_cstat(hash)
+    data = hash['data']
+    code = 'error'
+
+    list = Array.new
+    change = Hash.new
+    data.each_line do |l|
+      p = /^\.\.\. (.*) (.*)$/
+      m = p.match(l)
+      if m
+        change[m[1]] = m[2]
+        if m[1] == 'status'
+          code = 'stat'
+          list.push change
+          change = Hash.new
+        end
+      end
+    end
+
+    hash = Hash.new
+    hash.store 'code', code
+    hash.store 'data', list
+    return hash
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/svn.rb b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/svn.rb
new file mode 100644
index 00000000..fccfaa5a
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/provider/vcsrepo/svn.rb
@@ -0,0 +1,139 @@
+require File.join(File.dirname(__FILE__), '..', 'vcsrepo')
+
+Puppet::Type.type(:vcsrepo).provide(:svn, :parent => Puppet::Provider::Vcsrepo) do
+  desc "Supports Subversion repositories"
+
+  commands :svn      => 'svn',
+           :svnadmin => 'svnadmin',
+           :svnlook  => 'svnlook'
+
+  has_features :filesystem_types, :reference_tracking, :basic_auth, :configuration, :conflict, :depth
+
+  def create
+    if !@resource.value(:source)
+      create_repository(@resource.value(:path))
+    else
+      checkout_repository(@resource.value(:source),
+                          @resource.value(:path),
+                          @resource.value(:revision),
+                          @resource.value(:depth))
+    end
+    update_owner
+  end
+
+  def working_copy_exists?
+    if File.directory?(@resource.value(:path))
+      # :path is an svn checkout
+      return true if File.directory?(File.join(@resource.value(:path), '.svn'))
+      if File.file?(File.join(@resource.value(:path), 'format'))
+        # :path is an svn server
+        return true if svnlook('uuid', @resource.value(:path))
+      end
+    end
+    false
+  end
+
+  def exists?
+    working_copy_exists?
+  end
+
+  def destroy
+    FileUtils.rm_rf(@resource.value(:path))
+  end
+
+  def latest?
+    at_path do
+      (self.revision >= self.latest) and (@resource.value(:source) == self.sourceurl)
+    end
+  end
+
+  def buildargs
+    args = ['--non-interactive']
+    if @resource.value(:basic_auth_username) && @resource.value(:basic_auth_password)
+      args.push('--username', @resource.value(:basic_auth_username))
+      args.push('--password', @resource.value(:basic_auth_password))
+      args.push('--no-auth-cache')
+    end
+
+    if @resource.value(:force)
+      args.push('--force')
+    end
+
+    if @resource.value(:configuration)
+      args.push('--config-dir', @resource.value(:configuration))
+    end
+
+    if @resource.value(:trust_server_cert) != :false
+      args.push('--trust-server-cert')
+    end
+
+    args
+  end
+
+  def latest
+    args = buildargs.push('info', '-r', 'HEAD')
+    at_path do
+      svn(*args)[/^Revision:\s+(\d+)/m, 1]
+    end
+  end
+
+  def sourceurl
+    args = buildargs.push('info')
+    at_path do
+      svn(*args)[/^URL:\s+(\S+)/m, 1]
+    end
+  end
+
+  def revision
+    args = buildargs.push('info')
+    at_path do
+      svn(*args)[/^Revision:\s+(\d+)/m, 1]
+    end
+  end
+
+  def revision=(desired)
+    args = if @resource.value(:source)
+             buildargs.push('switch', '-r', desired, @resource.value(:source))
+           else
+             buildargs.push('update', '-r', desired)
+           end
+
+    if @resource.value(:conflict)
+      args.push('--accept', @resource.value(:conflict))
+    end
+
+    at_path do
+      svn(*args)
+    end
+    update_owner
+  end
+
+  private
+
+  def checkout_repository(source, path, revision, depth)
+    args = buildargs.push('checkout')
+    if revision
+      args.push('-r', revision)
+    end
+    if depth
+      args.push('--depth', depth)
+    end
+    args.push(source, path)
+    svn(*args)
+  end
+
+  def create_repository(path)
+    args = ['create']
+    if @resource.value(:fstype)
+      args.push('--fs-type', @resource.value(:fstype))
+    end
+    args << path
+    svnadmin(*args)
+  end
+
+  def update_owner
+    if @resource.value(:owner) or @resource.value(:group)
+      set_ownership
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/lib/puppet/type/vcsrepo.rb b/puppet/modules/vcsrepo/lib/puppet/type/vcsrepo.rb
new file mode 100644
index 00000000..e2ef0b7e
--- /dev/null
+++ b/puppet/modules/vcsrepo/lib/puppet/type/vcsrepo.rb
@@ -0,0 +1,248 @@
+require 'pathname'
+
+Puppet::Type.newtype(:vcsrepo) do
+  desc "A local version control repository"
+
+  feature :gzip_compression,
+          "The provider supports explicit GZip compression levels"
+  feature :basic_auth,
+          "The provider supports HTTP Basic Authentication"
+  feature :bare_repositories,
+          "The provider differentiates between bare repositories
+          and those with working copies",
+          :methods => [:bare_exists?, :working_copy_exists?]
+
+  feature :filesystem_types,
+          "The provider supports different filesystem types"
+
+  feature :reference_tracking,
+          "The provider supports tracking revision references that can change
+           over time (eg, some VCS tags and branch names)"
+
+  feature :ssh_identity,
+          "The provider supports a configurable SSH identity file"
+
+  feature :user,
+          "The provider can run as a different user"
+
+  feature :modules,
+          "The repository contains modules that can be chosen of"
+
+  feature :multiple_remotes,
+          "The repository tracks multiple remote repositories"
+
+  feature :configuration,
+          "The configuration directory to use"
+
+  feature :cvs_rsh,
+          "The provider understands the CVS_RSH environment variable"
+
+  feature :depth,
+          "The provider can do shallow clones or set scope limit"
+
+  feature :branch,
+          "The name of the branch"
+
+  feature :p4config,
+          "The provider understands Perforce Configuration"
+
+  feature :submodules,
+          "The repository contains submodules which can be optionally initialized"
+
+  feature :conflict,
+          "The provider supports automatic conflict resolution"
+
+  ensurable do
+    attr_accessor :latest
+
+    def insync?(is)
+      @should ||= []
+
+      case should
+      when :present
+        return true unless [:absent, :purged, :held].include?(is)
+      when :latest
+        if is == :latest
+          return true
+        else
+          return false
+        end
+      when :bare
+        return is == :bare
+      when :mirror
+        return is == :mirror
+      end
+    end
+
+    newvalue :present do
+      notice "Creating repository from present"
+      provider.create
+    end
+
+    newvalue :bare, :required_features => [:bare_repositories] do
+      if !provider.exists?
+        provider.create
+      end
+    end
+
+    newvalue :mirror, :required_features => [:bare_repositories] do
+      if !provider.exists?
+        provider.create
+      end
+    end
+
+    newvalue :absent do
+      provider.destroy
+    end
+
+    newvalue :latest, :required_features => [:reference_tracking] do
+      if provider.exists? && !@resource.value(:force)
+        if provider.respond_to?(:update_references)
+          provider.update_references
+        end
+        if provider.respond_to?(:latest?)
+            reference = provider.latest || provider.revision
+        else
+          reference = resource.value(:revision) || provider.revision
+        end
+        notice "Updating to latest '#{reference}' revision"
+        provider.revision = reference
+      else
+        notice "Creating repository from latest"
+        provider.create
+      end
+    end
+
+    def retrieve
+      prov = @resource.provider
+      if prov
+        if prov.working_copy_exists?
+          (@should.include?(:latest) && prov.latest?) ? :latest : :present
+        elsif prov.class.feature?(:bare_repositories) and prov.bare_exists?
+          :bare
+        else
+          :absent
+        end
+      else
+        raise Puppet::Error, "Could not find provider"
+      end
+    end
+
+  end
+
+  newparam :path do
+    desc "Absolute path to repository"
+    isnamevar
+    validate do |value|
+      path = Pathname.new(value)
+      unless path.absolute?
+        raise ArgumentError, "Path must be absolute: #{path}"
+      end
+    end
+  end
+
+  newparam :source do
+    desc "The source URI for the repository"
+  end
+
+  newparam :fstype, :required_features => [:filesystem_types] do
+    desc "Filesystem type"
+  end
+
+  newproperty :revision do
+    desc "The revision of the repository"
+    newvalue(/^\S+$/)
+  end
+
+  newparam :owner do
+    desc "The user/uid that owns the repository files"
+  end
+
+  newparam :group do
+    desc "The group/gid that owns the repository files"
+  end
+
+  newparam :user do
+    desc "The user to run for repository operations"
+  end
+
+  newparam :excludes do
+    desc "Files to be excluded from the repository"
+  end
+
+  newparam :force do
+    desc "Force repository creation, destroying any files on the path in the process."
+    newvalues(:true, :false)
+    defaultto false
+  end
+
+  newparam :compression, :required_features => [:gzip_compression] do
+    desc "Compression level"
+    validate do |amount|
+      unless Integer(amount).between?(0, 6)
+        raise ArgumentError, "Unsupported compression level: #{amount} (expected 0-6)"
+      end
+    end
+  end
+
+  newparam :basic_auth_username, :required_features => [:basic_auth] do
+    desc "HTTP Basic Auth username"
+  end
+
+  newparam :basic_auth_password, :required_features => [:basic_auth] do
+    desc "HTTP Basic Auth password"
+  end
+
+  newparam :identity, :required_features => [:ssh_identity] do
+    desc "SSH identity file"
+  end
+
+  newparam :module, :required_features => [:modules] do
+    desc "The repository module to manage"
+  end
+
+  newparam :remote, :required_features => [:multiple_remotes] do
+    desc "The remote repository to track"
+    defaultto "origin"
+  end
+
+  newparam :configuration, :required_features => [:configuration]  do
+    desc "The configuration directory to use"
+  end
+
+  newparam :cvs_rsh, :required_features => [:cvs_rsh] do
+    desc "The value to be used for the CVS_RSH environment variable."
+  end
+
+  newparam :depth, :required_features => [:depth] do
+    desc "The value to be used to do a shallow clone."
+  end
+
+  newparam :branch, :required_features => [:branch] do
+    desc "The name of the branch to clone."
+  end
+
+  newparam :p4config, :required_features => [:p4config] do
+    desc "The Perforce P4CONFIG environment."
+  end
+
+  newparam :submodules, :required_features => [:submodules] do
+    desc "Initialize and update each submodule in the repository."
+    newvalues(:true, :false)
+    defaultto true
+  end
+
+  newparam :conflict do
+    desc "The action to take if conflicts exist between repository and working copy"
+  end
+
+  newparam :trust_server_cert do
+    desc "Trust server certificate"
+    newvalues(:true, :false)
+    defaultto :false
+  end
+
+  autorequire(:package) do
+    ['git', 'git-core', 'mercurial']
+  end
+end
diff --git a/puppet/modules/vcsrepo/metadata.json b/puppet/modules/vcsrepo/metadata.json
new file mode 100644
index 00000000..c505faac
--- /dev/null
+++ b/puppet/modules/vcsrepo/metadata.json
@@ -0,0 +1,81 @@
+{
+  "name": "puppetlabs-vcsrepo",
+  "version": "1.3.2",
+  "author": "Puppet Labs",
+  "summary": "Puppet module providing a type to manage repositories from various version control systems",
+  "license": "GPL-2.0+",
+  "source": "https://github.com/puppetlabs/puppetlabs-vcsrepo",
+  "project_page": "https://github.com/puppetlabs/puppetlabs-vcsrepo",
+  "issues_url": "https://tickets.puppetlabs.com/browse/MODULES",
+  "dependencies": [
+  
+  ],
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "RedHat",
+      "operatingsystemrelease": [
+        "5",
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "CentOS",
+      "operatingsystemrelease": [
+        "5",
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "OracleLinux",
+      "operatingsystemrelease": [
+        "5",
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "Scientific",
+      "operatingsystemrelease": [
+        "5",
+        "6",
+        "7"
+      ]
+    },
+    {
+      "operatingsystem": "SLES",
+      "operatingsystemrelease": [
+        "10 SP4",
+        "11 SP1",
+        "12"
+      ]
+    },
+    {
+      "operatingsystem": "Debian",
+      "operatingsystemrelease": [
+        "6",
+        "7",
+        "8"
+      ]
+    },
+    {
+      "operatingsystem": "Ubuntu",
+      "operatingsystemrelease": [
+        "10.04",
+        "12.04",
+        "14.04"
+      ]
+    }
+  ],
+  "requirements": [
+    {
+      "name": "pe",
+      "version_requirement": ">= 3.0.0 < 2015.4.0"
+    },
+    {
+      "name": "puppet",
+      "version_requirement": ">= 3.0.0 < 5.0.0"
+    }
+  ]
+}
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_http.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_http.rb
new file mode 100644
index 00000000..421c5f06
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_http.rb
@@ -0,0 +1,69 @@
+test_name 'C3492 - checkout with basic auth (http protocol)'
+skip_test 'HTTP not supported yet for basic auth using git. See FM-1331'
+
+# Globals
+repo_name = 'testrepo_checkout'
+user      = 'foo'
+password  = 'bar'
+http_server_script = 'basic_auth_http_daemon.rb'
+
+hosts.each do |host|
+  ruby = '/opt/puppet/bin/ruby' if host.is_pe? || 'ruby'
+  gem = '/opt/puppet/bin/gem' if host.is_pe? || 'gem'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    script =<<-EOF
+    require 'sinatra'
+
+    set :bind, '0.0.0.0'
+    set :static, true
+    set :public_folder, '#{tmpdir}'
+
+
+    use Rack::Auth::Basic do |username, password|
+        username == '#{user}' && password == '#{password}'
+    end
+    EOF
+    create_remote_file(host, "#{tmpdir}/#{http_server_script}", script)
+    on(host, "#{gem} install sinatra")
+    on(host, "#{ruby} #{tmpdir}/#{http_server_script} &")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} #{tmpdir}/#{http_server_script}' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'checkout with puppet using basic auth' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:4567/testrepo.git",
+      provider => git,
+      basic_auth_username => '#{user}',
+      basic_auth_password => '#{password}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_https.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_https.rb
new file mode 100644
index 00000000..753e50ca
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_https.rb
@@ -0,0 +1,77 @@
+test_name 'C3493 - checkout with basic auth (https protocol)'
+skip_test 'waiting for CA trust solution'
+
+# Globals
+repo_name = 'testrepo_checkout'
+user      = 'foo'
+password  = 'bar'
+http_server_script = 'basic_auth_https_daemon.rb'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start https server' do
+    script =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+
+    authenticate = Proc.new do |req, res|
+      WEBrick::HTTPAuth.basic_auth(req, res, '') do |user, password|
+        user == '#{user}' && password == '#{password}'
+      end
+    end
+
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :DocumentRootOptions=> {:HandlerCallback => authenticate},
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, "#{tmpdir}/#{http_server_script}", script)
+    on(host, "#{ruby} #{tmpdir}/#{http_server_script}")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} #{tmpdir}/#{http_server_script}' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'checkout with puppet using basic auth' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8443/testrepo.git",
+      provider => git,
+      basic_auth_username => '#{user}',
+      basic_auth_password => '#{password}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/negative/basic_auth_checkout_git.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/negative/basic_auth_checkout_git.rb
new file mode 100644
index 00000000..3b47c485
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/basic_auth/negative/basic_auth_checkout_git.rb
@@ -0,0 +1,53 @@
+test_name 'C3494 - checkout with basic auth (git protocol)'
+
+# Globals
+repo_name = 'testrepo_checkout'
+user      = 'foo'
+password  = 'bar'
+http_server_script = 'basic_auth_http_daemon.rb'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon') unless host['platform'] =~ /debian|ubuntu/
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon ; sleep 1')
+  end
+
+  step 'checkout with puppet using basic auth' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      basic_auth_username => '#{user}',
+      basic_auth_password => '#{password}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout (silent error for basic auth using git protocol)" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file.rb
new file mode 100644
index 00000000..3d2131c2
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file.rb
@@ -0,0 +1,48 @@
+test_name 'C3438 - checkout a branch (file protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file_path.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file_path.rb
new file mode 100644
index 00000000..49b034e3
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file_path.rb
@@ -0,0 +1,48 @@
+test_name 'C3437 - checkout a branch (file path)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_git.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_git.rb
new file mode 100644
index 00000000..9557de85
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_git.rb
@@ -0,0 +1,53 @@
+test_name 'C3436 - checkout a branch (git protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon') unless host['platform'] =~ /debian|ubuntu/
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon ; sleep 1')
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_http.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_http.rb
new file mode 100644
index 00000000..fec60e2a
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_http.rb
@@ -0,0 +1,61 @@
+test_name 'C3441 - checkout a branch (http protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_https.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_https.rb
new file mode 100644
index 00000000..3474c73d
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_https.rb
@@ -0,0 +1,68 @@
+test_name 'C3442 - checkout a branch (https protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_scp.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_scp.rb
new file mode 100644
index 00000000..493b3f49
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_scp.rb
@@ -0,0 +1,59 @@
+test_name 'C3439 - checkout a branch (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_ssh.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_ssh.rb
new file mode 100644
index 00000000..5195ab8c
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/branch_checkout_ssh.rb
@@ -0,0 +1,59 @@
+test_name 'C3440 - checkout a branch (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/negative/branch_checkout_not_exists.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/negative/branch_checkout_not_exists.rb
new file mode 100644
index 00000000..7b9e64d7
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/branch_checkout/negative/branch_checkout_not_exists.rb
@@ -0,0 +1,46 @@
+test_name 'C3609 - checkout a branch that does not exist'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout branch that does not exist with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => 'non_existent_branch',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :expect_failures => true)
+  end
+
+  step 'verify that master branch is checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_file.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_file.rb
new file mode 100644
index 00000000..45413a96
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_file.rb
@@ -0,0 +1,46 @@
+test_name 'C3427 - clone (file protocol)'
+
+# Globals
+repo_name = 'testrepo_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the master branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('master not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_file_path.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_file_path.rb
new file mode 100644
index 00000000..a57e05a4
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_file_path.rb
@@ -0,0 +1,46 @@
+test_name 'C3426 - clone (file path)'
+
+# Globals
+repo_name = 'testrepo_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the master branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('master not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_git.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_git.rb
new file mode 100644
index 00000000..3bceb5dd
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_git.rb
@@ -0,0 +1,51 @@
+test_name 'C3425 - clone (git protocol)'
+
+# Globals
+repo_name = 'testrepo_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon') unless host['platform'] =~ /debian|ubuntu/
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon ; sleep 1')
+  end
+
+  step 'clone with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the master branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('master not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_http.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_http.rb
new file mode 100644
index 00000000..f545dab3
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_http.rb
@@ -0,0 +1,59 @@
+test_name 'C3430 - clone (http protocol)'
+
+# Globals
+repo_name = 'testrepo_clone'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'clone with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the master branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('master not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_https.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_https.rb
new file mode 100644
index 00000000..8758435a
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_https.rb
@@ -0,0 +1,66 @@
+test_name 'C3431 - clone (https protocol)'
+
+# Globals
+repo_name = 'testrepo_clone'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'clone with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the master branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('master not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_over_different_exiting_repo_with_force.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_over_different_exiting_repo_with_force.rb
new file mode 100644
index 00000000..3bc3e304
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_over_different_exiting_repo_with_force.rb
@@ -0,0 +1,49 @@
+test_name 'C3511 - clone over an existing repo with force'
+
+# Globals
+repo_name = 'testrepo_already_exists'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+    on(host, "mkdir #{tmpdir}/#{repo_name}")
+    on(host, "cd #{tmpdir}/#{repo_name} && git init")
+    on(host, "cd #{tmpdir}/#{repo_name} && touch a && git add a && git commit -m 'a'")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone over existing repo with force using puppet' do
+    on(host, "cd #{tmpdir}/#{repo_name} && git log --pretty=format:\"%h\"") do |res|
+      @existing_sha = res.stdout
+    end
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      force => true,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify new repo has replaced old one' do
+    on(host, "cd #{tmpdir}/#{repo_name} && git log --pretty=format:\"%h\"") do |res|
+      fail_test('original repo not replaced by force') if res.stdout.include? "#{@existing_sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_in_repo.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_in_repo.rb
new file mode 100644
index 00000000..dec275fa
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_in_repo.rb
@@ -0,0 +1,46 @@
+test_name 'C3507 - clone repo with excludes in repo'
+
+# Globals
+repo_name = 'testrepo_with_excludes_in_repo'
+exclude1 = 'file1.txt'
+exclude2 ='file2.txt'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone repo with excludes in repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      excludes => [ '#{exclude1}', '#{exclude2}' ],
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify exludes are known to git' do
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/info/exclude") do |res|
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude1}"
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude2}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_not_in_repo.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_not_in_repo.rb
new file mode 100644
index 00000000..ba379309
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_not_in_repo.rb
@@ -0,0 +1,46 @@
+test_name 'C3508 - clone repo with excludes not in repo'
+
+# Globals
+repo_name = 'testrepo_with_excludes_not_in_repo'
+exclude1 = 'worh02o'
+exclude2 ='ho398b'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone repo with excludes not in repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      excludes => [ '#{exclude1}', '#{exclude2}' ],
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify exludes are known to git' do
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/info/exclude") do |res|
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude1}"
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude2}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_scp.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_scp.rb
new file mode 100644
index 00000000..59370ebd
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_scp.rb
@@ -0,0 +1,57 @@
+test_name 'C3428 - clone (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'clone with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the master branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('master not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_ssh.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_ssh.rb
new file mode 100644
index 00000000..5bc06ec8
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/clone_ssh.rb
@@ -0,0 +1,57 @@
+test_name 'C3429 - clone (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'clone with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is on the master branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('master not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/negative/clone_over_different_exiting_repo.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/negative/clone_over_different_exiting_repo.rb
new file mode 100644
index 00000000..1e3b4bb5
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/negative/clone_over_different_exiting_repo.rb
@@ -0,0 +1,47 @@
+test_name 'C3482 - clone over an existing repo'
+
+# Globals
+repo_name = 'testrepo_already_exists'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+    on(host, "mkdir #{tmpdir}/#{repo_name}")
+    on(host, "cd #{tmpdir}/#{repo_name} && git init")
+    on(host, "cd #{tmpdir}/#{repo_name} && touch a && git add a && git commit -m 'a'")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone over existing repo using puppet' do
+    on(host, "cd #{tmpdir}/#{repo_name} && git log --pretty=format:\"%h\"") do |res|
+      @existing_sha = res.stdout
+    end
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :expect_failures => true)
+  end
+
+  step 'verify original repo was not replaced' do
+    on(host, "cd #{tmpdir}/#{repo_name} && git log --pretty=format:\"%h\"") do |res|
+      fail_test('original repo was replaced without force') unless res.stdout.include? "#{@existing_sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/negative/clone_repo_with_exec_excludes.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/negative/clone_repo_with_exec_excludes.rb
new file mode 100644
index 00000000..98053555
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/clone/negative/clone_repo_with_exec_excludes.rb
@@ -0,0 +1,45 @@
+test_name 'C3509 - clone repo with excludes not in repo'
+skip_test 'expectations not defined'
+
+# Globals
+repo_name = 'testrepo_with_excludes_not_in_repo'
+exclude1 = "`exec \"rm -rf /tmp\"`"
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone repo with excludes not in repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      excludes => [ '#{exclude1}' ],
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify excludes are known to git' do
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/info/exclude") do |res|
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude1}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_0_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_0_checkout.rb
new file mode 100644
index 00000000..7ac4c4a0
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_0_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3495 - checkout with compression 0'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 0 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 0,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_1_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_1_checkout.rb
new file mode 100644
index 00000000..8b7455d8
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_1_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3496 - checkout with compression 1'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 1 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_2_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_2_checkout.rb
new file mode 100644
index 00000000..81d32c3f
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_2_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3497 - checkout with compression 2'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 2 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 2,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_3_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_3_checkout.rb
new file mode 100644
index 00000000..12b60a37
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_3_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3498 - checkout with compression 3'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 3 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 3,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_4_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_4_checkout.rb
new file mode 100644
index 00000000..66d2d5eb
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_4_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3499 - checkout with compression 4'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 4 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 4,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_5_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_5_checkout.rb
new file mode 100644
index 00000000..b60a9f7f
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_5_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3500 - checkout with compression 5'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 5 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 5,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_6_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_6_checkout.rb
new file mode 100644
index 00000000..2f6b075a
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/compression_6_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3501 - checkout with compression 6'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 6 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 6,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_7_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_7_checkout.rb
new file mode 100644
index 00000000..e74cca92
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_7_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3503 - checkout with compression 7'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 7 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 7,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_alpha_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_alpha_checkout.rb
new file mode 100644
index 00000000..59aaf219
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_alpha_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3505 - checkout with compression alpha'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression alpha with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => abcde,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_eval_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_eval_checkout.rb
new file mode 100644
index 00000000..b989e586
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_eval_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3504 - checkout with compression 10-5'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 10-5 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 10-5,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_exec_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_exec_checkout.rb
new file mode 100644
index 00000000..e1373afb
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_exec_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3506 - checkout with compression exec'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression exec with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => "exec 'rm -rf /tmp'",
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_negative_checkout.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_negative_checkout.rb
new file mode 100644
index 00000000..1253db1d
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/compression/negative/compression_negative_checkout.rb
@@ -0,0 +1,43 @@
+test_name 'C3502 - checkout with compression -1'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression -1 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => -1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/create_bare_repo_that_already_exists.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/create_bare_repo_that_already_exists.rb
new file mode 100644
index 00000000..ccb8a707
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/create_bare_repo_that_already_exists.rb
@@ -0,0 +1,40 @@
+test_name 'C3472 - create bare repo that already exists'
+
+# Globals
+repo_name = 'testrepo_bare_repo_already_exists.git'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create bare repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    on(host, "mkdir #{tmpdir}/#{repo_name}")
+    on(host, "cd #{tmpdir}/#{repo_name} && git --bare init")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'create bare repo that already exists using puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => bare,
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify repo does not contain .git directory' do
+    on(host, "ls -al #{tmpdir}/#{repo_name}") do |res|
+      fail_test "found .git for #{repo_name}" if res.stdout.include? ".git"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/create_repo_that_already_exists.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/create_repo_that_already_exists.rb
new file mode 100644
index 00000000..8fb85435
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/create_repo_that_already_exists.rb
@@ -0,0 +1,42 @@
+test_name 'C3470 - create repo that already exists'
+
+# Globals
+repo_name = 'testrepo_already_exists'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+    on(host, "cd #{tmpdir} && git clone file://#{tmpdir}/testrepo.git #{repo_name}")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'create repo that already exists using puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify repo is on master branch' do
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      assert_match(/ref: refs\/heads\/master/, stdout, "Git checkout not on master on #{host}")
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/negative/create_bare_repo_specifying_revision.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/negative/create_bare_repo_specifying_revision.rb
new file mode 100644
index 00000000..5b789df1
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/create/negative/create_bare_repo_specifying_revision.rb
@@ -0,0 +1,38 @@
+test_name 'C3473 - create bare repo specifying revision'
+
+# Globals
+repo_name = 'testrepo_bare.git'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'create bare repo specifying revision using puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => bare,
+      revision => master,
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :expect_failures => true)
+  end
+
+  step 'verify repo does not contain .git directory' do
+    on(host, "ls -al #{tmpdir}") do |res|
+      fail_test "found repo for #{repo_name}" if res.stdout.include? repo_name
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_file.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_file.rb
new file mode 100644
index 00000000..beea7b80
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_file.rb
@@ -0,0 +1,53 @@
+test_name 'C3487 - checkout as a group (file protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout as a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_file_path.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_file_path.rb
new file mode 100644
index 00000000..319a8e74
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_file_path.rb
@@ -0,0 +1,53 @@
+test_name 'C3486 - checkout as a group (file path)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_git.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_git.rb
new file mode 100644
index 00000000..e5b9cf29
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_git.rb
@@ -0,0 +1,58 @@
+test_name 'C3485 - checkout as a group (git protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon') unless host['platform'] =~ /debian|ubuntu/
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon ; sleep 1')
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_http.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_http.rb
new file mode 100644
index 00000000..bf86f2eb
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_http.rb
@@ -0,0 +1,66 @@
+test_name 'C3490 - checkout as a group (http protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_https.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_https.rb
new file mode 100644
index 00000000..c4c645f9
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_https.rb
@@ -0,0 +1,73 @@
+test_name 'C3491 - checkout as a group (https protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout as a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_scp.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_scp.rb
new file mode 100644
index 00000000..c65acc43
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_scp.rb
@@ -0,0 +1,64 @@
+test_name 'C3488 - checkout as a group (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout as a group with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_ssh.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_ssh.rb
new file mode 100644
index 00000000..cccad19c
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/group_checkout_ssh.rb
@@ -0,0 +1,64 @@
+test_name 'C3489 - checkout as a group (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout as a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/negative/group_checkout_file_non_existent_group.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/negative/group_checkout_file_non_existent_group.rb
new file mode 100644
index 00000000..081642d9
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/group_checkout/negative/group_checkout_file_non_existent_group.rb
@@ -0,0 +1,51 @@
+test_name 'C3484 - checkout as a group that is not on system'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - delete group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout as a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :expect_failures => true)
+  end
+
+  step "verify git checkout is NOT owned by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') if res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/negative/revision_checkout_not_exists.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/negative/revision_checkout_not_exists.rb
new file mode 100644
index 00000000..85f1fcc0
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/negative/revision_checkout_not_exists.rb
@@ -0,0 +1,46 @@
+test_name 'C3614 - checkout a revision that does not exist'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout revision that does not exist with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '11111111111111111',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :expect_failures => true)
+  end
+
+  step 'verify that master revision is checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file.rb
new file mode 100644
index 00000000..b17dc73d
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file.rb
@@ -0,0 +1,53 @@
+test_name 'C3452 - checkout a revision (file protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify repo is checked out to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file_path.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file_path.rb
new file mode 100644
index 00000000..c80eb81b
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file_path.rb
@@ -0,0 +1,53 @@
+test_name 'C3451 - checkout a revision (file path)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify repo is checked out to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_git.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_git.rb
new file mode 100644
index 00000000..69a7fe22
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_git.rb
@@ -0,0 +1,58 @@
+test_name 'C3450 - checkout a revision (git protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon') unless host['platform'] =~ /debian|ubuntu/
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon ; sleep 1')
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_http.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_http.rb
new file mode 100644
index 00000000..7cac163d
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_http.rb
@@ -0,0 +1,66 @@
+test_name 'C3455 - checkout a revision (http protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_https.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_https.rb
new file mode 100644
index 00000000..1c705a5e
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_https.rb
@@ -0,0 +1,74 @@
+test_name 'C3456 - checkout a revision (https protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git clone https://github.com/johnduarte/testrepo.git #{tmpdir}/foo")
+    on(host, "git --git-dir=#{tmpdir}/foo/.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_scp.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_scp.rb
new file mode 100644
index 00000000..b5dbd244
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_scp.rb
@@ -0,0 +1,64 @@
+test_name 'C3453 - checkout a revision (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_ssh.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_ssh.rb
new file mode 100644
index 00000000..222653e4
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/revision_checkout/revision_checkout_ssh.rb
@@ -0,0 +1,64 @@
+test_name 'C3454 - checkout a revision (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_exec_depth.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_exec_depth.rb
new file mode 100644
index 00000000..f01a488e
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_exec_depth.rb
@@ -0,0 +1,43 @@
+test_name 'C3608 - shallow clone repo depth hostile input'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet (bad input ignored, full clone checkedout)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => "exec 'rm -rf /tmp'",
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is NOT shallow' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') if res.stdout.include? "shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_file_path.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_file_path.rb
new file mode 100644
index 00000000..47fb338b
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_file_path.rb
@@ -0,0 +1,44 @@
+test_name 'C3475 - shallow clone repo minimal depth = 1 (file path protocol)'
+skip_test 'Not currently supported. See FM-1285'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'git does not support shallow clone via file path: verify checkout is NOT created' do
+    on(host, "ls #{tmpdir}") do |res|
+      fail_test('checkout found') if res.stdout.include? "#{repo_name}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_http.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_http.rb
new file mode 100644
index 00000000..723a0b62
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_http.rb
@@ -0,0 +1,55 @@
+test_name 'C3479 - shallow clone repo minimal depth = 1 (http protocol)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'ps ax | grep "#{ruby} /tmp/http_daemon.rb" | grep -v grep | awk \'{print "kill -9 " $1}\' | sh ; sleep 1')
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :expect_failures => true)
+  end
+
+  step 'git does not support shallow clone via HTTP: verify checkout is NOT created' do
+    on(host, "ls #{tmpdir}") do |res|
+      fail_test('checkout found') if res.stdout.include? "#{repo_name}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_negative_depth.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_negative_depth.rb
new file mode 100644
index 00000000..869620d2
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_negative_depth.rb
@@ -0,0 +1,43 @@
+test_name 'C3607 - shallow clone repo depth = -1'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet (bad input ignored, full clone checkedout)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => -1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is NOT shallow' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') if res.stdout.include? "shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_overflow_depth.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_overflow_depth.rb
new file mode 100644
index 00000000..5da9fd7e
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_overflow_depth.rb
@@ -0,0 +1,45 @@
+test_name 'C3606 - shallow clone repo depth overflow 64bit integer'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+pending_test("The overflow can't be handled on some git versions")
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet (bad input ignored, full clone checkedout)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 18446744073709551616,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is NOT shallow' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') if res.stdout.include? "shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_file.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_file.rb
new file mode 100644
index 00000000..9e2abe28
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_file.rb
@@ -0,0 +1,47 @@
+test_name 'C3476 - shallow clone repo minimal depth = 1 (file protocol)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "1 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_git.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_git.rb
new file mode 100644
index 00000000..49683d24
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_git.rb
@@ -0,0 +1,52 @@
+test_name 'C3474 - shallow clone repo minimal depth = 1 (git protocol)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon') unless host['platform'] =~ /debian|ubuntu/
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon ; sleep 1')
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "1 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_https.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_https.rb
new file mode 100644
index 00000000..23927287
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_https.rb
@@ -0,0 +1,68 @@
+test_name 'C3480 - shallow clone repo minimal depth = 1 (https protocol)'
+skip_test 'Not currently supported. See FM-1286'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'ps ax | grep "#{ruby} /tmp/https_daemon.rb" | grep -v grep | awk \'{print "kill -9 " $1}\' | sh ; sleep 1')
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "1 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_scp.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_scp.rb
new file mode 100644
index 00000000..1d5b35a1
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_scp.rb
@@ -0,0 +1,58 @@
+test_name 'C3478 - shallow clone repo minimal depth = 1 (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'shallow clone repo with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "1 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_ssh.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_ssh.rb
new file mode 100644
index 00000000..0f00b30e
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_ssh.rb
@@ -0,0 +1,58 @@
+test_name 'C3477 - shallow clone repo minimal depth = 1 (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "1 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_zero_depth.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_zero_depth.rb
new file mode 100644
index 00000000..34c624f7
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/shallow_clone/shallow_clone_zero_depth.rb
@@ -0,0 +1,43 @@
+test_name 'C3404 - shallow clone repo depth = 0 non shallow'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet (zero depth means not shallow)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 0,
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify checkout is NOT shallow' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow found') if res.stdout.include? "shallow"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/negative/tag_checkout_not_exists.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/negative/tag_checkout_not_exists.rb
new file mode 100644
index 00000000..1849f029
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/negative/tag_checkout_not_exists.rb
@@ -0,0 +1,47 @@
+test_name 'C3612 - checkout a tag that does not exist'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout tag that does not exist with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      tag => '11111111111111111',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step 'verify that master tag is checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file.rb
new file mode 100644
index 00000000..9c744855
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file.rb
@@ -0,0 +1,48 @@
+test_name 'C3445 - checkout a tag (file protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file_path.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file_path.rb
new file mode 100644
index 00000000..01f319cb
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file_path.rb
@@ -0,0 +1,48 @@
+test_name 'C3444 - checkout a tag (file path)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_git.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_git.rb
new file mode 100644
index 00000000..42e689c8
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_git.rb
@@ -0,0 +1,59 @@
+test_name 'C3443 - checkout a tag (git protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon') unless host['platform'] =~ /debian|ubuntu/
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon ; sleep 1')
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_http.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_http.rb
new file mode 100644
index 00000000..3ea363c4
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_http.rb
@@ -0,0 +1,67 @@
+test_name 'C3448 - checkout a tag (http protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_https.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_https.rb
new file mode 100644
index 00000000..d508c436
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_https.rb
@@ -0,0 +1,74 @@
+test_name 'C3449 - checkout a tag (https protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_scp.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_scp.rb
new file mode 100644
index 00000000..cb96b4e2
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_scp.rb
@@ -0,0 +1,65 @@
+test_name 'C3446 - checkout a tag (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_ssh.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_ssh.rb
new file mode 100644
index 00000000..bc416e8e
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/tag_checkout/tag_checkout_ssh.rb
@@ -0,0 +1,65 @@
+test_name 'C3447 - checkout a tag (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/negative/user_checkout_file_non_existent_user.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/negative/user_checkout_file_non_existent_user.rb
new file mode 100644
index 00000000..245e1751
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/negative/user_checkout_file_non_existent_user.rb
@@ -0,0 +1,51 @@
+test_name 'C3483 - checkout as a user that is not on system'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - delete user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout as a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :expect_failures => true)
+  end
+
+  step "verify git checkout is NOT owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') if res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_file.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_file.rb
new file mode 100644
index 00000000..ccd9ad44
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_file.rb
@@ -0,0 +1,53 @@
+test_name 'C3459 - checkout as a user (file protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout as a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_file_path.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_file_path.rb
new file mode 100644
index 00000000..602769de
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_file_path.rb
@@ -0,0 +1,53 @@
+test_name 'C3458 - checkout as a user (file path)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_git.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_git.rb
new file mode 100644
index 00000000..af2ffb71
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_git.rb
@@ -0,0 +1,58 @@
+test_name 'C3457 - checkout as a user (git protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon') unless host['platform'] =~ /debian|ubuntu/
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon ; sleep 1')
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_http.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_http.rb
new file mode 100644
index 00000000..e8713e5b
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_http.rb
@@ -0,0 +1,66 @@
+test_name 'C3462 - checkout as a user (http protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_https.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_https.rb
new file mode 100644
index 00000000..4e633d78
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_https.rb
@@ -0,0 +1,73 @@
+test_name 'C3463 - checkout as a user (https protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh ; sleep 1")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout as a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_scp.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_scp.rb
new file mode 100644
index 00000000..98efb462
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_scp.rb
@@ -0,0 +1,64 @@
+test_name 'C3460 - checkout as a user (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout as a user with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_ssh.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_ssh.rb
new file mode 100644
index 00000000..cfd521ec
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker/git/user_checkout/user_checkout_ssh.rb
@@ -0,0 +1,64 @@
+test_name 'C3461 - checkout as a user (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    git_pkg = 'git'
+    if host['platform'] =~ /ubuntu-10/
+      git_pkg = 'git-core'
+    end
+    install_package(host, git_pkg)
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'yes | ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys')
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }", :catch_failures => true)
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }", :catch_failures => true)
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }", :catch_failures => true)
+  end
+
+  step 'checkout as a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp, :catch_failures => true)
+    apply_manifest_on(host, pp, :catch_changes  => true)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/beaker_helper.rb b/puppet/modules/vcsrepo/spec/acceptance/beaker_helper.rb
new file mode 100644
index 00000000..4d232047
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/beaker_helper.rb
@@ -0,0 +1,51 @@
+test_name "Installing Puppet and vcsrepo module" do
+  step 'install puppet' do
+    if @options[:provision]
+      # This will fail if puppet is already installed, ie --no-provision
+      if hosts.first.is_pe?
+        install_pe
+      else
+        install_puppet
+        on hosts, "mkdir -p #{hosts.first['distmoduledir']}"
+      end
+    end
+  end
+
+  step 'Ensure we can install our module' do
+    hosts.each do |host|
+      # We ask the host to interpolate it's distmoduledir because we don't
+      # actually know it on Windows until we've let it redirect us (depending
+      # on whether we're running as a 32/64 bit process on 32/64 bit Windows
+      moduledir = on(host, "echo #{host['distmoduledir']}").stdout.chomp
+      on host, "mkdir -p #{moduledir}"
+    end
+  end
+
+  step 'install module' do
+    hosts.each do |host|
+      proj_root = File.expand_path(File.join(File.dirname(__FILE__),'..','..'))
+
+      # This require beaker 1.15
+      copy_module_to(host, :source => proj_root, :module_name => 'vcsrepo')
+
+      case fact_on(host, 'osfamily')
+      when 'RedHat'
+        install_package(host, 'git')
+      when 'Debian'
+        install_package(host, 'git-core')
+      else
+        if !check_for_package(host, 'git')
+          puts "Git package is required for this module"
+          exit
+        end
+      end
+
+      gitconfig = <<-EOS
+[user]
+	email = root@localhost
+	name = root
+EOS
+      create_remote_file(host, "/root/.gitconfig", gitconfig)
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/clone_repo_spec.rb b/puppet/modules/vcsrepo/spec/acceptance/clone_repo_spec.rb
new file mode 100644
index 00000000..c2345502
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/clone_repo_spec.rb
@@ -0,0 +1,534 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'clones a remote repo' do
+  before(:all) do
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+    shell("mkdir -p #{tmpdir}") # win test
+    scp_to(default, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    shell("cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  after(:all) do
+    shell("rm -rf #{tmpdir}/testrepo.git")
+  end
+
+  context 'get the current master HEAD' do
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo/.git") do
+      it { is_expected.to be_directory }
+    end
+
+    describe file("#{tmpdir}/testrepo/.git/HEAD") do
+      it { is_expected.to contain 'ref: refs/heads/master' }
+    end
+  end
+
+  context 'using a https source on github' do
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/httpstestrepo":
+        ensure => present,
+        provider => git,
+        source => "https://github.com/puppetlabs/puppetlabs-vcsrepo.git",
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/httpstestrepo/.git") do
+      it { is_expected.to be_directory }
+    end
+
+    describe file("#{tmpdir}/httpstestrepo/.git/HEAD") do
+      it { is_expected.to contain 'ref: refs/heads/master' }
+    end
+  end
+
+  context 'using a commit SHA' do
+    let (:sha) do
+      shell("git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1").stdout.chomp
+    end
+
+    after(:all) do
+      shell("rm -rf #{tmpdir}/testrepo_sha")
+    end
+
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_sha":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        revision => "#{sha}",
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_sha/.git") do
+      it { is_expected.to be_directory }
+    end
+
+    describe file("#{tmpdir}/testrepo_sha/.git/HEAD") do
+      it { is_expected.to contain sha }
+    end
+  end
+
+  context 'using a tag' do
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_tag":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        revision => '0.0.2',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_tag/.git") do
+      it { is_expected.to be_directory }
+    end
+
+    it 'should have the tag as the HEAD' do
+      shell("git --git-dir=#{tmpdir}/testrepo_tag/.git name-rev HEAD | grep '0.0.2'")
+    end
+  end
+
+  context 'using a branch name' do
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_branch":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        revision => 'a_branch',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_branch/.git") do
+      it { is_expected.to be_directory }
+    end
+
+    describe file("#{tmpdir}/testrepo_branch/.git/HEAD") do
+      it { is_expected.to contain 'ref: refs/heads/a_branch' }
+    end
+  end
+
+  context 'ensure latest with branch specified' do
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_latest":
+        ensure => latest,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        revision => 'a_branch',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    it 'verifies the HEAD commit SHA on remote and local match' do
+      remote_commit = shell("git ls-remote file://#{tmpdir}/testrepo_latest HEAD | head -1").stdout
+      local_commit = shell("git --git-dir=#{tmpdir}/testrepo_latest/.git rev-parse HEAD").stdout.chomp
+      expect(remote_commit).to include(local_commit)
+    end
+  end
+
+  context 'ensure latest with branch unspecified' do
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_latest":
+        ensure => latest,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    it 'verifies the HEAD commit SHA on remote and local match' do
+      remote_commit = shell("git ls-remote file://#{tmpdir}/testrepo_latest HEAD | head -1").stdout
+      local_commit = shell("git --git-dir=#{tmpdir}/testrepo_latest/.git rev-parse HEAD").stdout.chomp
+      expect(remote_commit).to include(local_commit)
+    end
+  end
+
+  context 'with shallow clone' do
+    it 'does a shallow clone' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_shallow":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        depth => '1',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_shallow/.git/shallow") do
+      it { is_expected.to be_file }
+    end
+  end
+
+  context 'path is not empty and not a repository' do
+    before(:all) do
+      shell("mkdir #{tmpdir}/not_a_repo", :acceptable_exit_codes => [0,1])
+      shell("touch #{tmpdir}/not_a_repo/file1.txt", :acceptable_exit_codes => [0,1])
+    end
+
+    it 'should raise an exception' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/not_a_repo":
+        ensure => present,
+        provider => git
+        source => "file://#{tmpdir}/testrepo.git",
+      }
+      EOS
+      apply_manifest(pp, :expect_failures => true)
+    end
+  end
+
+  context 'with an owner' do
+    pp = <<-EOS
+    user { 'vagrant':
+      ensure => present,
+    }
+    EOS
+
+    apply_manifest(pp, :catch_failures => true)
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_owner":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        owner => 'vagrant',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_owner") do
+      it { is_expected.to be_directory }
+      it { is_expected.to be_owned_by 'vagrant' }
+    end
+  end
+
+  context 'with a group' do
+    pp = <<-EOS
+    group { 'vagrant':
+      ensure => present,
+    }
+    EOS
+
+    apply_manifest(pp, :catch_failures => true)
+
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "/#{tmpdir}/testrepo_group":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        group => 'vagrant',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_group") do
+      it { is_expected.to be_directory }
+      it { is_expected.to be_grouped_into 'vagrant' }
+    end
+  end
+
+  context 'with excludes' do
+    it 'clones a repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_excludes":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        excludes => ['exclude1.txt', 'exclude2.txt'],
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_excludes/.git/info/exclude") do
+      describe '#content' do
+        subject { super().content }
+        it { is_expected.to match /exclude1.txt/ }
+      end
+
+      describe '#content' do
+        subject { super().content }
+        it { is_expected.to match /exclude2.txt/ }
+      end
+    end
+  end
+
+  context 'with force' do
+    before(:all) do
+      shell("mkdir -p #{tmpdir}/testrepo_force/folder")
+      shell("touch #{tmpdir}/testrepo_force/temp.txt")
+    end
+
+    it 'applies the manifest' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_force":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        force => true,
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_force/folder") do
+      it { is_expected.not_to be_directory }
+    end
+
+    describe file("#{tmpdir}/testrepo_force/temp.txt") do
+      it { is_expected.not_to be_file }
+    end
+
+    describe file("#{tmpdir}/testrepo_force/.git") do
+      it { is_expected.to be_directory }
+    end
+
+    context 'and noop' do
+      before(:all) do
+        shell("mkdir #{tmpdir}/testrepo_already_exists")
+        shell("cd #{tmpdir}/testrepo_already_exists && git init")
+        shell("cd #{tmpdir}/testrepo_already_exists && touch a && git add a && git commit -m 'a'")
+      end
+      after(:all) do
+        shell("rm -rf #{tmpdir}/testrepo_already_exists")
+      end
+
+      it 'applies the manifest' do
+        pp = <<-EOS
+        vcsrepo { "#{tmpdir}/testrepo_already_exists":
+          ensure   => present,
+          source   => "file://#{tmpdir}/testrepo.git",
+          provider => git,
+          force    => true,
+          noop     => true,
+        }
+        EOS
+
+        apply_manifest(pp, :catch_changes => true)
+      end
+    end
+  end
+
+  context 'as a user' do
+    before(:all) do
+      shell("chmod 707 #{tmpdir}")
+      pp = <<-EOS
+      group { 'testuser':
+        ensure => present,
+      }
+      user { 'testuser':
+        ensure => present,
+        groups => 'testuser',
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+
+    it 'applies the manifest' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_user":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        user => 'testuser',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_user") do
+      it { is_expected.to be_directory }
+      it { is_expected.to be_owned_by 'testuser' }
+    end
+
+    describe file("#{tmpdir}/testrepo_user") do
+      it { is_expected.to be_directory }
+      it { is_expected.to be_grouped_into 'testuser' }
+    end
+  end
+
+  context 'non-origin remote name' do
+    it 'applies the manifest' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_remote":
+        ensure => present,
+        provider => git,
+        source => "file://#{tmpdir}/testrepo.git",
+        remote => 'testorigin',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    it 'remote name is "testorigin"' do
+      shell("git --git-dir=#{tmpdir}/testrepo_remote/.git remote | grep 'testorigin'")
+    end
+
+    after(:all) do
+      pp = 'user { "testuser": ensure => absent }'
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+
+  context 'as a user with ssh' do
+    before(:all) do
+      # create user
+      pp = <<-EOS
+      group { 'testuser-ssh':
+        ensure => present,
+      }
+      user { 'testuser-ssh':
+        ensure => present,
+        groups => 'testuser-ssh',
+        managehome => true,
+      }
+      EOS
+      apply_manifest(pp, :catch_failures => true)
+
+      # create ssh keys
+      shell('mkdir -p /home/testuser-ssh/.ssh')
+      shell('ssh-keygen -q -t rsa -f /home/testuser-ssh/.ssh/id_rsa -N ""')
+
+      # copy public key to authorized_keys
+      shell('cat /home/testuser-ssh/.ssh/id_rsa.pub > /home/testuser-ssh/.ssh/authorized_keys')
+      shell('echo -e "Host localhost\n\tStrictHostKeyChecking no\n" > /home/testuser-ssh/.ssh/config')
+      shell('chown -R testuser-ssh:testuser-ssh /home/testuser-ssh/.ssh')
+    end
+
+    it 'applies the manifest' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_user_ssh":
+        ensure => present,
+        provider => git,
+        source => "testuser-ssh@localhost:#{tmpdir}/testrepo.git",
+        user => 'testuser-ssh',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    after(:all) do
+      pp = <<-EOS
+      user { 'testuser-ssh':
+        ensure => absent,
+        managehome => true,
+      }
+      EOS
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+
+  context 'using an identity file' do
+    before(:all) do
+      # create user
+      pp = <<-EOS
+      user { 'testuser-ssh':
+        ensure => present,
+        managehome => true,
+      }
+      EOS
+      apply_manifest(pp, :catch_failures => true)
+
+      # create ssh keys
+      shell('mkdir -p /home/testuser-ssh/.ssh')
+      shell('ssh-keygen -q -t rsa -f /home/testuser-ssh/.ssh/id_rsa -N ""')
+
+      # copy public key to authorized_keys
+      shell('cat /home/testuser-ssh/.ssh/id_rsa.pub > /home/testuser-ssh/.ssh/authorized_keys')
+      shell('echo -e "Host localhost\n\tStrictHostKeyChecking no\n" > /home/testuser-ssh/.ssh/config')
+      shell('chown -R testuser-ssh:testuser-ssh /home/testuser-ssh/.ssh')
+    end
+
+    it 'applies the manifest' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_user_ssh_id":
+        ensure => present,
+        provider => git,
+        source => "testuser-ssh@localhost:#{tmpdir}/testrepo.git",
+        identity => '/home/testuser-ssh/.ssh/id_rsa',
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/create_repo_spec.rb b/puppet/modules/vcsrepo/spec/acceptance/create_repo_spec.rb
new file mode 100644
index 00000000..53a93c97
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/create_repo_spec.rb
@@ -0,0 +1,89 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'create a repo' do
+  context 'without a source' do
+    it 'creates a blank repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_blank_repo":
+        ensure => present,
+        provider => git,
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_blank_repo/") do
+      it 'should have zero files' do
+        shell("ls -1 #{tmpdir}/testrepo_blank_repo | wc -l") do |r|
+          expect(r.stdout).to match(/^0\n$/)
+        end
+      end
+    end
+
+    describe file("#{tmpdir}/testrepo_blank_repo/.git") do
+      it { is_expected.to be_directory }
+    end
+  end
+
+  context 'no source but revision provided' do
+    it 'should not fail (MODULES-2125)' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_blank_with_revision_repo":
+        ensure   => present,
+        provider => git,
+        revision => 'master'
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+  end
+
+  context 'bare repo' do
+    it 'creates a bare repo' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_bare_repo":
+        ensure => bare,
+        provider => git,
+      }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_bare_repo/config") do
+      it { is_expected.to contain 'bare = true' }
+    end
+
+    describe file("#{tmpdir}/testrepo_bare_repo/.git") do
+      it { is_expected.not_to be_directory }
+    end
+  end
+
+  context 'bare repo with a revision' do
+    it 'does not create a bare repo when a revision is defined' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo_bare_repo_rev":
+        ensure => bare,
+        provider => git,
+        revision => 'master',
+      }
+      EOS
+
+      apply_manifest(pp, :expect_failures => true)
+    end
+
+    describe file("#{tmpdir}/testrepo_bare_repo_rev") do
+      it { is_expected.not_to be_directory }
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/files/create_git_repo.sh b/puppet/modules/vcsrepo/spec/acceptance/files/create_git_repo.sh
new file mode 100755
index 00000000..b5e930ca
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/files/create_git_repo.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+mkdir testrepo
+cd testrepo
+
+touch file1.txt file2.txt file3.txt
+git init
+echo 'change 1' > file1.txt
+git add file1.txt
+git commit -m 'add file1'
+git tag 0.0.1
+echo 'change 2' > file2.txt
+git add file2.txt
+git commit -m 'add file2'
+git tag 0.0.2
+echo 'change 3' > file3.txt
+git add file3.txt
+git commit -m 'add file3'
+git tag 0.0.3
+
+git checkout -b a_branch
+echo 'change 4' > file4.txt
+git add file4.txt
+git commit -m 'add file4'
+echo 'change 5' > file5.txt
+git add file5.txt
+git commit -m 'add file5'
+echo 'change 6' > file6.txt
+git add file6.txt
+git commit -m 'add file6'
+
+git checkout master
+cd ..
+
+git --git-dir=testrepo/.git config core.bare true
+cp -r testrepo/.git testrepo.git
+rm -rf testrepo
+cd testrepo.git
+touch git-daemon-export-ok
+git update-server-info
diff --git a/puppet/modules/vcsrepo/spec/acceptance/files/server.crt b/puppet/modules/vcsrepo/spec/acceptance/files/server.crt
new file mode 100644
index 00000000..270f65c0
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/files/server.crt
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICATCCAWoCCQDRobnOvvkStDANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJB
+VTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMB4XDTE1MDQwODE3MjM1NVoXDTI1MDQwNTE3MjM1NVowRTELMAkG
+A1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0
+IFdpZGdpdHMgUHR5IEx0ZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyRTv
+uX6328aQ5Auc8PI+xNaCiE0UZNYcs+xq3AEkR/Tnz0HGXdx3+PnFG7MIRSS65hXA
+VGenZk3wP4vNIe9gu+G9jtOFTJOgoOBUnJ/Hcs79Zgcmz3cAWQpqww+CZpyngUDS
+msZ5HoEbNS+qaIron3IrYCgPsy1BHFs5ze7JrtcCAwEAATANBgkqhkiG9w0BAQUF
+AAOBgQCaYVv8WbFbrnLMOcyjE7GjSmVh68fEN+AqntZa1Z5GOv6OQIN9mVSoNxWo
+lb/9xmldfMQThgKckHHvB5Q9kf923nMQZOi8yxyaoeYWrkglkFFU/sdF6yuFBdUU
+D+rXmHnS754FLTGDzESmlRVUCYuwVgrRdm+P+wu2+lZT3x85VA==
+-----END CERTIFICATE-----
diff --git a/puppet/modules/vcsrepo/spec/acceptance/files/server.key b/puppet/modules/vcsrepo/spec/acceptance/files/server.key
new file mode 100644
index 00000000..b594f13e
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/files/server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDJFO+5frfbxpDkC5zw8j7E1oKITRRk1hyz7GrcASRH9OfPQcZd
+3Hf4+cUbswhFJLrmFcBUZ6dmTfA/i80h72C74b2O04VMk6Cg4FScn8dyzv1mBybP
+dwBZCmrDD4JmnKeBQNKaxnkegRs1L6poiuifcitgKA+zLUEcWznN7smu1wIDAQAB
+AoGAQPnD8OOyk5DZVuctwmn0wHQ0X8jQczkAs18MtKSlzZ6knUM6zy+jkM9c0vOK
+E5Wn0xtqN5v66sL6g/4vvex1DA5Q6YsXvZ48VpVliZXXK/1pdTv0qwMyHdlBhmgJ
+MhnZbyNy61QHdOTsWDR1YrELpDyFMJ9cZZD0NOnsuhd2DbECQQDq7W/zlJBZPWNR
+ab2dP+HLpm/PiEBT13SuEEskh3GEEfZlwz/cGu0Z8DHA4E3Z60KFjwgnc92GNFMg
+m0t3hHtpAkEA2x5PsDxBk9sWwdIvu57vjQLdotvAfyb+W9puIaZS1JRSVLTsUVEj
+Y0KxgsPHtcjrVoN//zGymn4ePxWOzlrQPwJBAN5thEuZY7o6dyiD9zVFYKGSqdZS
+aKV5H04Wuy6Q1pd28lWTMYlSLR8b3d+B//PN3SPbMps4BoukSvhaUG+OjdECQFzF
+KZIBAPa7pJftCH6UHPIDy5ifF5H+DWUQRt6CT8FnBrCMZR1MkAH/g65Me6pwZYsc
+Y73E6cxVJzMoSmz9r/sCQQCOhPflFCxZ23ocsuRBo9O/mMUDaLoHZXWuJ2DqAUN2
+mS6UUR/lpyc7Cmy0VOyhS8783D7MUfji5ddfVxb5tWgm
+-----END RSA PRIVATE KEY-----
diff --git a/puppet/modules/vcsrepo/spec/acceptance/modules_1596_spec.rb b/puppet/modules/vcsrepo/spec/acceptance/modules_1596_spec.rb
new file mode 100644
index 00000000..fa36285a
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/modules_1596_spec.rb
@@ -0,0 +1,72 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'clones a remote repo' do
+  before(:all) do
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+    shell("mkdir -p #{tmpdir}") # win test
+  end
+
+  after(:all) do
+    shell("rm -rf #{tmpdir}/vcsrepo")
+  end
+
+  context 'force with a remote' do
+    it 'clones from remote' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/vcsrepo":
+        ensure   => present,
+        provider => git,
+        source   => 'https://github.com/puppetlabs/puppetlabs-vcsrepo',
+        force    => true,
+      }
+      EOS
+
+      # Run it twice to test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      # need to create a file to make sure we aren't destroying the repo
+      # because fun fact, if you call destroy/create in 'retrieve' puppet won't
+      # register that any changes happen, because that method isn't supposed to
+      # be making any changes.
+      shell("touch #{tmpdir}/vcsrepo/foo")
+      apply_manifest(pp, :catch_changes  => true)
+    end
+
+    describe file("#{tmpdir}/vcsrepo/foo") do
+      it { is_expected.to be_file }
+    end
+  end
+
+  context 'force over an existing repo' do
+    it 'clones from remote' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/vcsrepo":
+        ensure   => present,
+        provider => git,
+        source   => 'https://github.com/puppetlabs/puppetlabs-vcsrepo',
+        force    => true,
+      }
+      EOS
+
+      pp2 = <<-EOS
+      vcsrepo { "#{tmpdir}/vcsrepo":
+        ensure   => present,
+        provider => git,
+        source   => 'https://github.com/puppetlabs/puppetlabs-stdlib',
+        force    => true,
+      }
+      EOS
+
+
+      apply_manifest(pp, :catch_failures => true)
+      # create a file to make sure we're destroying the repo
+      shell("touch #{tmpdir}/vcsrepo/foo")
+      apply_manifest(pp2, :catch_failures  => true)
+    end
+
+    describe file("#{tmpdir}/vcsrepo/foo") do
+      it { is_expected.to_not be_file }
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/modules_1800_spec.rb b/puppet/modules/vcsrepo/spec/acceptance/modules_1800_spec.rb
new file mode 100644
index 00000000..12415e80
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/modules_1800_spec.rb
@@ -0,0 +1,41 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'clones a remote repo' do
+  before(:all) do
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+    shell("mkdir -p #{tmpdir}") # win test
+  end
+
+  after(:all) do
+    shell("rm -rf #{tmpdir}/vcsrepo")
+  end
+
+  context 'ensure latest with no revision' do
+    it 'clones from default remote' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/vcsrepo":
+          ensure   => present,
+          provider => git,
+          source   => "https://github.com/puppetlabs/puppetlabs-vcsrepo.git",
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+      shell("cd #{tmpdir}/vcsrepo; /usr/bin/git reset --hard HEAD~2")
+    end
+
+    it 'updates' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/vcsrepo":
+          ensure   => latest,
+          provider => git,
+          source   => "https://github.com/puppetlabs/puppetlabs-vcsrepo.git",
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/modules_2326_spec.rb b/puppet/modules/vcsrepo/spec/acceptance/modules_2326_spec.rb
new file mode 100644
index 00000000..601c6ff6
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/modules_2326_spec.rb
@@ -0,0 +1,69 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'clones with special characters' do
+
+  before(:all) do
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+    shell("mkdir -p #{tmpdir}") # win test
+    scp_to(default, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    shell("cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  after(:all) do
+    shell("rm -rf #{tmpdir}/testrepo.git")
+  end
+
+  context 'as a user with ssh' do
+    before(:all) do
+      # create user
+      pp = <<-EOS
+        group { 'testuser-ssh':
+          ensure => present,
+        }
+        user { 'testuser-ssh':
+          ensure     => present,
+          groups     => 'testuser-ssh',
+          managehome => true,
+        }
+      EOS
+      apply_manifest(pp, :catch_failures => true)
+
+      # create ssh keys
+      shell('mkdir -p /home/testuser-ssh/.ssh')
+      shell('echo -e \'y\n\'|ssh-keygen -q -t rsa -f /home/testuser-ssh/.ssh/id_rsa -N ""')
+
+      # copy public key to authorized_keys
+      shell('cat /home/testuser-ssh/.ssh/id_rsa.pub > /home/testuser-ssh/.ssh/authorized_keys')
+      shell('echo -e "Host localhost\n\tStrictHostKeyChecking no\n" > /home/testuser-ssh/.ssh/config')
+      shell('chown -R testuser-ssh:testuser-ssh /home/testuser-ssh/.ssh')
+      shell("chown testuser-ssh:testuser-ssh #{tmpdir}")
+    end
+
+    it 'applies the manifest' do
+      pp = <<-EOS
+        vcsrepo { "#{tmpdir}/testrepo_user_ssh":
+          ensure   => present,
+          provider => git,
+          source   => "git+ssh://testuser-ssh@localhost#{tmpdir}/testrepo.git",
+          user     => 'testuser-ssh',
+        }
+      EOS
+
+      # Run it twice and test for idempotency
+      apply_manifest(pp, :catch_failures => true)
+      apply_manifest(pp, :catch_changes => true)
+    end
+
+    after(:all) do
+      pp = <<-EOS
+        user { 'testuser-ssh':
+          ensure     => absent,
+          managehome => true,
+        }
+      EOS
+      apply_manifest(pp, :catch_failures => true)
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/modules_660_spec.rb b/puppet/modules/vcsrepo/spec/acceptance/modules_660_spec.rb
new file mode 100644
index 00000000..c45aa28b
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/modules_660_spec.rb
@@ -0,0 +1,89 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'MODULES-660' do
+  before(:all) do
+    # Create testrepo.git
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+    shell("mkdir -p #{tmpdir}") # win test
+    scp_to(default, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    shell("cd #{tmpdir} && ./create_git_repo.sh")
+
+    # Configure testrepo.git as upstream of testrepo
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/testrepo":
+      ensure   => present,
+      provider => git,
+      revision => 'a_branch',
+      source   => "file://#{tmpdir}/testrepo.git",
+    }
+    EOS
+    apply_manifest(pp, :catch_failures => true)
+  end
+
+  after(:all) do
+    shell("rm -rf #{tmpdir}/testrepo.git")
+  end
+
+  shared_examples 'switch to branch/tag/sha' do
+    it 'pulls the new branch commits' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo":
+        ensure   => latest,
+        provider => git,
+        revision => 'a_branch',
+        source   => "file://#{tmpdir}/testrepo.git",
+      }
+      EOS
+      apply_manifest(pp, :expect_changes => true)
+      apply_manifest(pp, :catch_changes  => true)
+    end
+    it 'checks out the tag' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo":
+        ensure   => latest,
+        provider => git,
+        revision => '0.0.3',
+        source   => "file://#{tmpdir}/testrepo.git",
+      }
+      EOS
+      apply_manifest(pp, :expect_changes => true)
+      apply_manifest(pp, :catch_changes  => true)
+    end
+    it 'checks out the sha' do
+      sha = shell("cd #{tmpdir}/testrepo && git rev-parse origin/master").stdout.chomp
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/testrepo":
+        ensure   => latest,
+        provider => git,
+        revision => '#{sha}',
+        source   => "file://#{tmpdir}/testrepo.git",
+      }
+      EOS
+      apply_manifest(pp, :expect_changes => true)
+      apply_manifest(pp, :catch_changes  => true)
+    end
+  end
+
+  context 'on branch' do
+    before :each do
+      shell("cd #{tmpdir}/testrepo && git checkout a_branch")
+      shell("cd #{tmpdir}/testrepo && git reset --hard 0.0.2")
+    end
+    it_behaves_like 'switch to branch/tag/sha'
+  end
+  context 'on tag' do
+    before :each do
+      shell("cd #{tmpdir}/testrepo && git checkout 0.0.1")
+    end
+    it_behaves_like 'switch to branch/tag/sha'
+  end
+  context 'on detached head' do
+    before :each do
+      shell("cd #{tmpdir}/testrepo && git checkout 0.0.2")
+      shell("cd #{tmpdir}/testrepo && git checkout HEAD~1")
+    end
+    it_behaves_like 'switch to branch/tag/sha'
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/modules_753_spec.rb b/puppet/modules/vcsrepo/spec/acceptance/modules_753_spec.rb
new file mode 100644
index 00000000..e4e332bf
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/modules_753_spec.rb
@@ -0,0 +1,68 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'clones a remote repo' do
+  before(:all) do
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+    shell("mkdir -p #{tmpdir}") # win test
+  end
+
+  after(:all) do
+    shell("rm -rf #{tmpdir}/vcsrepo")
+  end
+
+  context 'clone with single remote' do
+    it 'clones from default remote' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/vcsrepo":
+          ensure   => present,
+          provider => git,
+          source   => "https://github.com/puppetlabs/puppetlabs-vcsrepo.git",
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+
+    end
+
+    it "git config output should contain the remote" do
+      shell("/usr/bin/git config -l -f #{tmpdir}/vcsrepo/.git/config") do |r|
+        expect(r.stdout).to match(/remote.origin.url=https:\/\/github.com\/puppetlabs\/puppetlabs-vcsrepo.git/)
+      end
+    end
+
+    after(:all) do
+      shell("rm -rf #{tmpdir}/vcsrepo")
+    end
+
+  end
+
+  context 'clone with multiple remotes' do
+    it 'clones from default remote and adds 2 remotes to config file' do
+      pp = <<-EOS
+      vcsrepo { "#{tmpdir}/vcsrepo":
+          ensure   => present,
+          provider => git,
+          source   => {"origin" => "https://github.com/puppetlabs/puppetlabs-vcsrepo.git", "test1" => "https://github.com/puppetlabs/puppetlabs-vcsrepo.git"},
+      }
+      EOS
+
+      apply_manifest(pp, :catch_failures => true)
+
+    end
+
+    it "git config output should contain the remotes" do
+      shell("/usr/bin/git config -l -f #{tmpdir}/vcsrepo/.git/config") do |r|
+        expect(r.stdout).to match(/remote.origin.url=https:\/\/github.com\/puppetlabs\/puppetlabs-vcsrepo.git/)
+        expect(r.stdout).to match(/remote.test1.url=https:\/\/github.com\/puppetlabs\/puppetlabs-vcsrepo.git/)
+      end
+    end
+
+    after(:all) do
+      shell("rm -rf #{tmpdir}/vcsrepo")
+    end
+
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-59-x64.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-59-x64.yml
new file mode 100644
index 00000000..2ad90b86
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-59-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-59-x64:
+    roles:
+      - master
+    platform: el-5-x86_64
+    box : centos-59-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-59-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: git
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-64-x64-pe.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-64-x64-pe.yml
new file mode 100644
index 00000000..7d9242f1
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-64-x64-pe.yml
@@ -0,0 +1,12 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+      - database
+      - dashboard
+    platform: el-6-x86_64
+    box : centos-64-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: pe
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-64-x64.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-64-x64.yml
new file mode 100644
index 00000000..05540ed8
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-64-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-64-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-65-x64.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-65-x64.yml
new file mode 100644
index 00000000..4e2cb809
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/centos-65-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-65-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-65-x64-vbox436-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-65-x64-virtualbox-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/debian-607-x64.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/debian-607-x64.yml
new file mode 100644
index 00000000..43df6a57
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/debian-607-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  debian-607-x64:
+    roles:
+      - master
+    platform: debian-6-amd64
+    box : debian-607-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/debian-607-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/debian-73-x64.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/debian-73-x64.yml
new file mode 100644
index 00000000..5b87870a
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/debian-73-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  debian-73-x64:
+    roles:
+      - master
+    platform: debian-7-amd64
+    box : debian-73-x64-virtualbox-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/debian-73-x64-virtualbox-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/default.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/default.yml
new file mode 100644
index 00000000..05540ed8
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/default.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  centos-64-x64:
+    roles:
+      - master
+    platform: el-6-x86_64
+    box : centos-64-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml
new file mode 100644
index 00000000..5ca1514e
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-10044-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-server-10044-x64:
+    roles:
+      - master
+    platform: ubuntu-10.04-amd64
+    box : ubuntu-server-10044-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/ubuntu-server-10044-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml
new file mode 100644
index 00000000..d065b304
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-12042-x64.yml
@@ -0,0 +1,10 @@
+HOSTS:
+  ubuntu-server-12042-x64:
+    roles:
+      - master
+    platform: ubuntu-12.04-amd64
+    box : ubuntu-server-12042-x64-vbox4210-nocm
+    box_url : http://puppet-vagrant-boxes.puppetlabs.com/ubuntu-server-12042-x64-vbox4210-nocm.box
+    hypervisor : vagrant
+CONFIG:
+  type: foss
diff --git a/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml b/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
new file mode 100644
index 00000000..cba1cd04
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/nodesets/ubuntu-server-1404-x64.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  ubuntu-server-1404-x64:
+    roles:
+      - master
+    platform: ubuntu-14.04-amd64
+    box : puppetlabs/ubuntu-14.04-64-nocm
+    box_url : https://vagrantcloud.com/puppetlabs/ubuntu-14.04-64-nocm
+    hypervisor : vagrant
+CONFIG:
+  log_level   : debug
+  type: git
diff --git a/puppet/modules/vcsrepo/spec/acceptance/remove_repo_spec.rb b/puppet/modules/vcsrepo/spec/acceptance/remove_repo_spec.rb
new file mode 100644
index 00000000..d5646b34
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/remove_repo_spec.rb
@@ -0,0 +1,30 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'remove a repo' do
+  it 'creates a blank repo' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/testrepo_deleted":
+      ensure => present,
+      provider => git,
+    }
+    EOS
+    apply_manifest(pp, :catch_failures => true)
+  end
+
+  it 'removes a repo' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/testrepo_deleted":
+      ensure => absent,
+      provider => git,
+    }
+    EOS
+
+    apply_manifest(pp, :catch_failures => true)
+  end
+
+  describe file("#{tmpdir}/testrepo_deleted") do
+    it { is_expected.not_to be_directory }
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/acceptance/remove_repo_spec_noop.rb b/puppet/modules/vcsrepo/spec/acceptance/remove_repo_spec_noop.rb
new file mode 100644
index 00000000..f6bd86e9
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/acceptance/remove_repo_spec_noop.rb
@@ -0,0 +1,31 @@
+require 'spec_helper_acceptance'
+
+tmpdir = default.tmpdir('vcsrepo')
+
+describe 'does not remove a repo if noop' do
+  it 'creates a blank repo' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/testrepo_noop_deleted":
+      ensure   => present,
+      provider => git,
+    }
+    EOS
+    apply_manifest(pp, :catch_failures => true)
+  end
+
+  it 'does not remove a repo if noop' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/testrepo_noop_deleted":
+      ensure   => absent,
+      provider => git,
+      force    => true,
+    }
+    EOS
+
+    apply_manifest(pp, :catch_failures => true, :noop => true, :verbose => false)
+  end
+
+  describe file("#{tmpdir}/testrepo_noop_deleted") do
+    it { is_expected.to be_directory }
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/fixtures/bzr_version_info.txt b/puppet/modules/vcsrepo/spec/fixtures/bzr_version_info.txt
new file mode 100644
index 00000000..88a56a1c
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/fixtures/bzr_version_info.txt
@@ -0,0 +1,5 @@
+revision-id: menesis@pov.lt-20100309191856-4wmfqzc803fj300x
+date: 2010-03-09 21:18:56 +0200
+build-date: 2010-03-14 00:42:43 -0800
+revno: 2634
+branch-nick: mytest
diff --git a/puppet/modules/vcsrepo/spec/fixtures/git_branch_a.txt b/puppet/modules/vcsrepo/spec/fixtures/git_branch_a.txt
new file mode 100644
index 00000000..2c99829d
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/fixtures/git_branch_a.txt
@@ -0,0 +1,14 @@
+  feature/foo
+  feature/bar
+  feature/baz
+  feature/quux
+  only/local
+* master
+  refactor/foo
+  origin/HEAD
+  origin/feature/foo
+  origin/feature/bar
+  origin/feature/baz
+  origin/feature/quux
+  origin/only/remote
+  origin/master
diff --git a/puppet/modules/vcsrepo/spec/fixtures/git_branch_feature_bar.txt b/puppet/modules/vcsrepo/spec/fixtures/git_branch_feature_bar.txt
new file mode 100644
index 00000000..72d5e200
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/fixtures/git_branch_feature_bar.txt
@@ -0,0 +1,14 @@
+  feature/foo
+* feature/bar
+  feature/baz
+  feature/quux
+  only/local
+  master
+  refactor/foo
+  origin/HEAD
+  origin/feature/foo
+  origin/feature/bar
+  origin/feature/baz
+  origin/feature/quux
+  origin/only/remote
+  origin/master
diff --git a/puppet/modules/vcsrepo/spec/fixtures/git_branch_none.txt b/puppet/modules/vcsrepo/spec/fixtures/git_branch_none.txt
new file mode 100644
index 00000000..7207c379
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/fixtures/git_branch_none.txt
@@ -0,0 +1,15 @@
+  feature/foo
+  feature/bar
+  feature/baz
+  feature/quux
+  only/local
+  master
+* (no branch)  
+  refactor/foo
+  origin/HEAD
+  origin/feature/foo
+  origin/feature/bar
+  origin/feature/baz
+  origin/feature/quux
+  origin/only/remote
+  origin/master
diff --git a/puppet/modules/vcsrepo/spec/fixtures/hg_parents.txt b/puppet/modules/vcsrepo/spec/fixtures/hg_parents.txt
new file mode 100644
index 00000000..46173df4
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/fixtures/hg_parents.txt
@@ -0,0 +1,6 @@
+changeset:   3:34e6012c783a
+parent:      2:21ea4598c962
+parent:      1:9d0ff0028458
+user:        Test User <test.user@example.com>
+date:        Fri Aug 07 13:13:02 2009 -0400
+summary:     merge
diff --git a/puppet/modules/vcsrepo/spec/fixtures/hg_tags.txt b/puppet/modules/vcsrepo/spec/fixtures/hg_tags.txt
new file mode 100644
index 00000000..53792e5a
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/fixtures/hg_tags.txt
@@ -0,0 +1,18 @@
+tip                             1019:bca3f20b249b
+0.9.1                           1017:76ce7cca95d8
+0.9                             1001:dbaa6f4ec585
+0.8                              839:65b66ac0fc83
+0.7.1                            702:e1357f00129f
+0.7                              561:7b2af3b4c968
+0.6.3                            486:e38077f4e4aa
+0.6.2                            405:07bb099b7b10
+0.6.1                            389:93750f3fbbe2
+0.6                              369:34e6012c783a
+0.5.3                            321:5ffa6ae7e699
+0.5.2                            318:fdc2c2e4cebe
+0.5.1                            315:33a5ea0cbe7a
+0.5                              313:47490716f4c9
+0.4                              240:47fa3a14cc63
+0.3.1                            132:bc231db18e1c
+0.3                              130:661615e510dd
+0.2                               81:f98d13b442f6
diff --git a/puppet/modules/vcsrepo/spec/fixtures/svn_info.txt b/puppet/modules/vcsrepo/spec/fixtures/svn_info.txt
new file mode 100644
index 00000000..d2a975b2
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/fixtures/svn_info.txt
@@ -0,0 +1,10 @@
+Path: .
+URL: http://example.com/svn/trunk
+Repository Root: http://example.com/svn
+Repository UUID: 75246ace-e253-0410-96dd-a7613ca8dc81
+Revision: 4
+Node Kind: directory
+Schedule: normal
+Last Changed Author: jon
+Last Changed Rev: 3
+Last Changed Date: 2008-08-07 11:34:25 -0700 (Thu, 07 Aug 2008)
diff --git a/puppet/modules/vcsrepo/spec/spec.opts b/puppet/modules/vcsrepo/spec/spec.opts
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/vcsrepo/spec/spec_helper.rb b/puppet/modules/vcsrepo/spec/spec_helper.rb
new file mode 100644
index 00000000..22d5d689
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/spec_helper.rb
@@ -0,0 +1,8 @@
+#This file is generated by ModuleSync, do not edit.
+require 'puppetlabs_spec_helper/module_spec_helper'
+
+# put local configuration and setup into spec_helper_local
+begin
+  require 'spec_helper_local'
+rescue LoadError
+end
diff --git a/puppet/modules/vcsrepo/spec/spec_helper_acceptance.rb b/puppet/modules/vcsrepo/spec/spec_helper_acceptance.rb
new file mode 100644
index 00000000..97c43e8c
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/spec_helper_acceptance.rb
@@ -0,0 +1,46 @@
+require 'beaker-rspec'
+require 'beaker/puppet_install_helper'
+
+run_puppet_install_helper
+
+RSpec.configure do |c|
+  # Project root
+  proj_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+
+  # Readable test descriptions
+  c.formatter = :documentation
+
+  # Configure all nodes in nodeset
+  c.before :suite do
+
+    # ensure test dependencies are available on all hosts
+    hosts.each do |host|
+      copy_module_to(host, :source => proj_root, :module_name => 'vcsrepo')
+      case fact_on(host, 'osfamily')
+      when 'RedHat'
+        if fact_on(host, 'operatingsystemmajrelease') == '5'
+          will_install_git = on(host, 'which git', :acceptable_exit_codes => [0,1]).exit_code == 1
+
+          if will_install_git
+            on host, puppet('module install stahnma-epel')
+            apply_manifest_on( host, 'include epel' )
+          end
+
+        end
+
+        install_package(host, 'git')
+
+      when 'Debian'
+        install_package(host, 'git-core')
+
+      else
+        if !check_for_package(host, 'git')
+          puts "Git package is required for this module"
+          exit
+        end
+      end
+      on host, 'git config --global user.email "root@localhost"'
+      on host, 'git config --global user.name "root"'
+    end
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/spec_helper_local.rb b/puppet/modules/vcsrepo/spec/spec_helper_local.rb
new file mode 100644
index 00000000..c7d27b52
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/spec_helper_local.rb
@@ -0,0 +1,7 @@
+require 'support/filesystem_helpers'
+require 'support/fixture_helpers'
+
+RSpec.configure do |c|
+  c.include FilesystemHelpers
+  c.include FixtureHelpers
+end
diff --git a/puppet/modules/vcsrepo/spec/support/filesystem_helpers.rb b/puppet/modules/vcsrepo/spec/support/filesystem_helpers.rb
new file mode 100644
index 00000000..15e2ca75
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/support/filesystem_helpers.rb
@@ -0,0 +1,18 @@
+module FilesystemHelpers
+
+  def expects_chdir(path = resource.value(:path))
+    Dir.expects(:chdir).with(path).at_least_once.yields
+  end
+
+  def expects_mkdir(path = resource.value(:path))
+    Dir.expects(:mkdir).with(path).at_least_once
+  end
+
+  def expects_rm_rf(path = resource.value(:path))
+    FileUtils.expects(:rm_rf).with(path)
+  end
+
+  def expects_directory?(returns = true, path = resource.value(:path))
+    File.expects(:directory?).with(path).returns(returns)
+  end
+end
diff --git a/puppet/modules/vcsrepo/spec/support/fixture_helpers.rb b/puppet/modules/vcsrepo/spec/support/fixture_helpers.rb
new file mode 100644
index 00000000..8a0e0a0b
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/support/fixture_helpers.rb
@@ -0,0 +1,7 @@
+module FixtureHelpers
+
+  def fixture(name, ext = '.txt')
+    File.read(File.join(File.dirname(__FILE__), '..', 'fixtures', name.to_s + ext))
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/bzr_spec.rb b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/bzr_spec.rb
new file mode 100644
index 00000000..b5e2f731
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/bzr_spec.rb
@@ -0,0 +1,109 @@
+require 'spec_helper'
+
+describe Puppet::Type.type(:vcsrepo).provider(:bzr_provider) do
+
+  let(:resource) { Puppet::Type.type(:vcsrepo).new({
+    :name     => 'test',
+    :ensure   => :present,
+    :provider => :bzr,
+    :revision => '2634',
+    :source   => 'lp:do',
+    :path     => '/tmp/test',
+  })}
+
+  let(:provider) { resource.provider }
+
+  before :each do
+    Puppet::Util.stubs(:which).with('bzr').returns('/usr/bin/bzr')
+  end
+
+  describe 'creating' do
+    context 'with defaults' do
+      it "should execute 'bzr clone -r' with the revision" do
+        provider.expects(:bzr).with('branch', '-r', resource.value(:revision), resource.value(:source), resource.value(:path))
+        provider.create
+      end
+    end
+
+    context 'without revision' do
+      it "should just execute 'bzr clone' without a revision" do
+        resource.delete(:revision)
+        provider.expects(:bzr).with('branch', resource.value(:source), resource.value(:path))
+        provider.create
+      end
+    end
+
+    context 'without source' do
+      it "should execute 'bzr init'" do
+        resource.delete(:source)
+        provider.expects(:bzr).with('init', resource.value(:path))
+        provider.create
+      end
+    end
+  end
+
+  describe 'destroying' do
+    it "it should remove the directory" do
+      provider.destroy
+    end
+  end
+
+  describe "checking existence" do
+    it "should check for the directory" do
+      File.expects(:directory?).with(File.join(resource.value(:path), '.bzr')).returns(true)
+      provider.exists?
+    end
+  end
+
+  describe "checking the revision property" do
+    before do
+      expects_chdir
+      provider.expects(:bzr).with('version-info').returns(File.read(fixtures('bzr_version_info.txt')))
+      @current_revid = 'menesis@pov.lt-20100309191856-4wmfqzc803fj300x'
+    end
+
+    context "when given a non-revid as the resource revision" do
+      context "when its revid is not different than the current revid" do
+        it "should return the ref" do
+          resource[:revision] = '2634'
+          provider.expects(:bzr).with('revision-info', '2634').returns("2634 menesis@pov.lt-20100309191856-4wmfqzc803fj300x\n")
+          expect(provider.revision).to eq(resource.value(:revision))
+        end
+      end
+      context "when its revid is different than the current revid" do
+        it "should return the current revid" do
+          resource[:revision] = '2636'
+          provider.expects(:bzr).with('revision-info', resource.value(:revision)).returns("2635 foo\n")
+          expect(provider.revision).to eq(@current_revid)
+        end
+      end
+    end
+
+    context "when given a revid as the resource revision" do
+      context "when it is the same as the current revid" do
+        it "should return it" do
+          resource[:revision] = 'menesis@pov.lt-20100309191856-4wmfqzc803fj300x'
+          provider.expects(:bzr).with('revision-info', resource.value(:revision)).returns("1234 #{resource.value(:revision)}\n")
+          expect(provider.revision).to eq(resource.value(:revision))
+        end
+      end
+      context "when it is not the same as the current revid" do
+        it "should return the current revid" do
+          resource[:revision] = 'menesis@pov.lt-20100309191856-4wmfqzc803fj300y'
+          provider.expects(:bzr).with('revision-info', resource.value(:revision)).returns("2636 foo\n")
+          expect(provider.revision).to eq(@current_revid)
+        end
+      end
+
+    end
+  end
+
+  describe "setting the revision property" do
+    it "should use 'bzr update -r' with the revision" do
+      Dir.expects(:chdir).with('/tmp/test').at_least_once.yields
+      provider.expects(:bzr).with('update', '-r', 'somerev')
+      provider.revision = 'somerev'
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/cvs_spec.rb b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/cvs_spec.rb
new file mode 100644
index 00000000..2e18149a
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/cvs_spec.rb
@@ -0,0 +1,124 @@
+require 'spec_helper'
+
+describe Puppet::Type.type(:vcsrepo).provider(:cvs_provider) do
+
+  let(:resource) { Puppet::Type.type(:vcsrepo).new({
+    :name     => 'test',
+    :ensure   => :present,
+    :provider => :cvs,
+    :revision => '2634',
+    :source   => 'lp:do',
+    :path     => '/tmp/test',
+  })}
+
+  let(:provider) { resource.provider }
+
+  before :each do
+    Puppet::Util.stubs(:which).with('cvs').returns('/usr/bin/cvs')
+  end
+
+  describe 'creating' do
+    context "with a source" do
+      it "should execute 'cvs checkout'" do
+        resource[:source] = ':ext:source@example.com:/foo/bar'
+        resource[:revision] = 'an-unimportant-value'
+        expects_chdir('/tmp')
+        Puppet::Util::Execution.expects(:execute).with([:cvs, '-d', resource.value(:source), 'checkout', '-r', 'an-unimportant-value', '-d', 'test', 'bar'], :custom_environment => {})
+        provider.create
+      end
+
+      it "should execute 'cvs checkout' as user 'muppet'" do
+        resource[:source] = ':ext:source@example.com:/foo/bar'
+        resource[:revision] = 'an-unimportant-value'
+        resource[:user] = 'muppet'
+        expects_chdir('/tmp')
+        Puppet::Util::Execution.expects(:execute).with([:cvs, '-d', resource.value(:source), 'checkout', '-r', 'an-unimportant-value', '-d', 'test', 'bar'], :uid => 'muppet', :custom_environment => {})
+        provider.create
+      end
+
+      it "should just execute 'cvs checkout' without a revision" do
+        resource[:source] = ':ext:source@example.com:/foo/bar'
+        resource.delete(:revision)
+        Puppet::Util::Execution.expects(:execute).with([:cvs, '-d', resource.value(:source), 'checkout', '-d', File.basename(resource.value(:path)), File.basename(resource.value(:source))], :custom_environment => {})
+        provider.create
+      end
+
+      context "with a compression" do
+        it "should just execute 'cvs checkout' without a revision" do
+          resource[:source] = ':ext:source@example.com:/foo/bar'
+          resource[:compression] = '3'
+          resource.delete(:revision)
+          Puppet::Util::Execution.expects(:execute).with([:cvs, '-d', resource.value(:source), '-z', '3', 'checkout', '-d', File.basename(resource.value(:path)), File.basename(resource.value(:source))], :custom_environment => {})
+          provider.create
+        end
+      end
+    end
+
+    context "when a source is not given" do
+      it "should execute 'cvs init'" do
+        resource.delete(:source)
+        Puppet::Util::Execution.expects(:execute).with([:cvs, '-d', resource.value(:path), 'init'], :custom_environment => {})
+        provider.create
+      end
+    end
+  end
+
+  describe 'destroying' do
+    it "it should remove the directory" do
+      provider.destroy
+    end
+  end
+
+  describe "checking existence" do
+    it "should check for the CVS directory with source" do
+      resource[:source] = ':ext:source@example.com:/foo/bar'
+      File.expects(:directory?).with(File.join(resource.value(:path), 'CVS'))
+      provider.exists?
+    end
+
+    it "should check for the CVSROOT directory without source" do
+      resource.delete(:source)
+      File.expects(:directory?).with(File.join(resource.value(:path), 'CVSROOT'))
+      provider.exists?
+    end
+  end
+
+  describe "checking the revision property" do
+    before do
+      @tag_file = File.join(resource.value(:path), 'CVS', 'Tag')
+    end
+
+    context "when CVS/Tag exists" do
+      before do
+        @tag = 'TAG'
+        File.expects(:exist?).with(@tag_file).returns(true)
+      end
+      it "should read CVS/Tag" do
+        File.expects(:read).with(@tag_file).returns("T#{@tag}")
+        expect(provider.revision).to eq(@tag)
+      end
+    end
+
+    context "when CVS/Tag does not exist" do
+      before do
+        File.expects(:exist?).with(@tag_file).returns(false)
+      end
+      it "assumes HEAD" do
+        expect(provider.revision).to eq('HEAD')
+      end
+    end
+  end
+
+  describe "when setting the revision property" do
+    before do
+      @tag = 'SOMETAG'
+    end
+
+    it "should use 'cvs update -dr'" do
+      expects_chdir
+      Puppet::Util::Execution.expects(:execute).with([:cvs, 'update', '-dr', @tag, '.'], :custom_environment => {})
+      provider.revision = @tag
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/git_spec.rb b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/git_spec.rb
new file mode 100644
index 00000000..6a8f58f8
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/git_spec.rb
@@ -0,0 +1,401 @@
+require 'spec_helper'
+
+describe Puppet::Type.type(:vcsrepo).provider(:git_provider) do
+  def branch_a_list(include_branch = nil?)
+    <<branches
+end
+#{"*  master" unless  include_branch.nil?}
+#{"*  " + include_branch unless !include_branch}
+   remote/origin/master
+   remote/origin/foo
+
+branches
+  end
+  let(:resource) { Puppet::Type.type(:vcsrepo).new({
+    :name     => 'test',
+    :ensure   => :present,
+    :provider => :git,
+    :revision => '2634',
+    :source   => 'git@repo',
+    :path     => '/tmp/test',
+    :force    => false
+  })}
+
+  let(:provider) { resource.provider }
+
+  before :each do
+    Puppet::Util.stubs(:which).with('git').returns('/usr/bin/git')
+  end
+
+  context 'creating' do
+    context "with a revision that is a remote branch" do
+      it "should execute 'git clone' and 'git checkout -b'" do
+        resource[:revision] = 'only/remote'
+        Dir.expects(:chdir).with('/').at_least_once.yields
+        Dir.expects(:chdir).with('/tmp/test').at_least_once.yields
+        provider.expects(:git).with('clone', resource.value(:source), resource.value(:path))
+        provider.expects(:update_submodules)
+        provider.expects(:update_remote_url).with("origin", resource.value(:source)).returns false
+        provider.expects(:git).with('branch', '-a').returns(branch_a_list(resource.value(:revision)))
+        provider.expects(:git).with('checkout', '--force', resource.value(:revision))
+        provider.create
+      end
+    end
+
+    context "with a remote not named 'origin'" do
+      it "should execute 'git clone --origin not_origin" do
+        resource[:remote] = 'not_origin'
+        Dir.expects(:chdir).with('/').at_least_once.yields
+        Dir.expects(:chdir).with('/tmp/test').at_least_once.yields
+        provider.expects(:git).with('clone', '--origin', 'not_origin', resource.value(:source), resource.value(:path))
+        provider.expects(:update_submodules)
+        provider.expects(:update_remote_url).with("not_origin", resource.value(:source)).returns false
+        provider.expects(:git).with('branch', '-a').returns(branch_a_list(resource.value(:revision)))
+        provider.expects(:git).with('checkout', '--force', resource.value(:revision))
+        provider.create
+      end
+    end
+
+    context "with shallow clone enable" do
+      it "should execute 'git clone --depth 1'" do
+        resource[:revision] = 'only/remote'
+        resource[:depth] = 1
+        Dir.expects(:chdir).with('/').at_least_once.yields
+        Dir.expects(:chdir).with('/tmp/test').at_least_once.yields
+        provider.expects(:git).with('clone', '--depth', '1', '--branch', resource.value(:revision),resource.value(:source), resource.value(:path))
+        provider.expects(:update_submodules)
+        provider.expects(:update_remote_url).with("origin", resource.value(:source)).returns false
+        provider.expects(:git).with('branch', '-a').returns(branch_a_list(resource.value(:revision)))
+        provider.expects(:git).with('checkout', '--force', resource.value(:revision))
+        provider.create
+      end
+    end
+
+    context "with a revision that is not a remote branch" do
+      it "should execute 'git clone' and 'git reset --hard'" do
+        resource[:revision] = 'a-commit-or-tag'
+        Dir.expects(:chdir).with('/').at_least_once.yields
+        Dir.expects(:chdir).with('/tmp/test').at_least_once.yields
+        provider.expects(:git).with('clone', resource.value(:source), resource.value(:path))
+        provider.expects(:update_submodules)
+        provider.expects(:update_remote_url).with("origin", resource.value(:source)).returns false
+        provider.expects(:git).with('branch', '-a').returns(branch_a_list(resource.value(:revision)))
+        provider.expects(:git).with('checkout', '--force', resource.value(:revision))
+        provider.create
+      end
+
+      it "should execute 'git clone' and submodule commands" do
+        resource.delete(:revision)
+        provider.expects(:git).with('clone', resource.value(:source), resource.value(:path))
+        provider.expects(:update_submodules)
+        provider.expects(:update_remotes)
+        provider.create
+      end
+    end
+
+    context "with an ensure of bare" do
+      context "with revision" do
+        it "should raise an error" do
+          resource[:ensure] = :bare
+          expect { provider.create }.to raise_error Puppet::Error, /cannot set a revision.+bare/i
+        end
+      end
+      context "without revision" do
+        it "should just execute 'git clone --bare'" do
+          resource[:ensure] = :bare
+          resource.delete(:revision)
+          provider.expects(:git).with('clone', '--bare', resource.value(:source), resource.value(:path))
+          provider.expects(:update_remotes)
+          provider.create
+        end
+      end
+    end
+
+    context "with an ensure of mirror" do
+      context "with revision" do
+        it "should raise an error" do
+          resource[:ensure] = :mirror
+          expect { provider.create }.to raise_error Puppet::Error, /cannot set a revision.+bare/i
+        end
+      end
+      context "without revision" do
+        it "should just execute 'git clone --mirror'" do
+          resource[:ensure] = :mirror
+          resource.delete(:revision)
+          provider.expects(:git).with('clone', '--mirror', resource.value(:source), resource.value(:path))
+          provider.expects(:update_remotes)
+          provider.create
+        end
+      end
+    end
+
+    context "when a source is not given" do
+      context "when the path does not exist" do
+        it "should execute 'git init'" do
+          resource[:ensure] = :present
+          resource.delete(:source)
+          expects_mkdir
+          expects_chdir
+          expects_directory?(false)
+
+          provider.expects(:bare_exists?).returns(false)
+          provider.expects(:git).with('init')
+          provider.create
+        end
+      end
+
+      context "when the path is a bare repository" do
+        it "should convert it to a working copy" do
+          resource[:ensure] = :present
+          resource.delete(:source)
+          provider.expects(:bare_exists?).returns(true)
+          provider.expects(:convert_bare_to_working_copy)
+          provider.create
+        end
+      end
+
+      context "when the path is not empty and not a repository" do
+        it "should raise an exception" do
+          provider.expects(:path_exists?).returns(true)
+          provider.expects(:path_empty?).returns(false)
+          expect { provider.create }.to raise_error(Puppet::Error)
+        end
+      end
+    end
+
+    context "when the path does not exist" do
+      it "should execute 'git init --bare'" do
+        resource[:ensure] = :bare
+        resource.delete(:source)
+        resource.delete(:revision)
+        expects_chdir
+        expects_mkdir
+        expects_directory?(false)
+        provider.expects(:working_copy_exists?).returns(false)
+        provider.expects(:git).with('init', '--bare')
+        provider.create
+      end
+
+      it "should raise an exeption" do
+        resource[:ensure] = :mirror
+        resource.delete(:source)
+        resource.delete(:revision)
+
+        expect { provider.create }.to raise_error Puppet::Error, /cannot init repository with mirror.+try bare/i
+      end
+    end
+
+    context "when the path is a working copy repository" do
+      it "should convert it to a bare repository" do
+        resource[:ensure] = :bare
+        resource.delete(:source)
+        resource.delete(:revision)
+        provider.expects(:working_copy_exists?).returns(true)
+        provider.expects(:convert_working_copy_to_bare)
+        provider.create
+      end
+      it "should clone overtop it using force" do
+        resource[:force] = true
+        Dir.expects(:chdir).with('/').at_least_once.yields
+        Dir.expects(:chdir).with('/tmp/test').at_least_once.yields
+        provider.expects(:path_exists?).returns(true)
+        provider.expects(:path_empty?).returns(false)
+        provider.destroy
+        provider.expects(:git).with('clone',resource.value(:source), resource.value(:path))
+        provider.expects(:update_submodules)
+        provider.expects(:update_remote_url).with("origin", resource.value(:source)).returns false
+        provider.expects(:git).with('branch', '-a').returns(branch_a_list(resource.value(:revision)))
+        provider.expects(:git).with('checkout', '--force', resource.value(:revision))
+        provider.create
+      end
+    end
+
+    context "when the path is not empty and not a repository" do
+      it "should raise an exception" do
+        provider.expects(:path_exists?).returns(true)
+        provider.expects(:path_empty?).returns(false)
+        provider.expects(:working_copy_exists?).returns(false)
+        expect { provider.create }.to raise_error(Puppet::Error)
+      end
+    end
+  end
+
+
+  context 'destroying' do
+    it "it should remove the directory" do
+      #expects_rm_rf
+      provider.destroy
+    end
+  end
+
+  context "checking the revision property" do
+    before do
+      expects_chdir('/tmp/test')
+      resource[:revision] = 'currentsha'
+      resource[:source] = 'http://example.com'
+      provider.stubs(:git).with('config', 'remote.origin.url').returns('')
+      provider.stubs(:git).with('fetch', 'origin') # FIXME
+      provider.stubs(:git).with('fetch', '--tags', 'origin')
+      provider.stubs(:git).with('rev-parse', 'HEAD').returns('currentsha')
+      provider.stubs(:git).with('branch', '-a').returns(branch_a_list(resource.value(:revision)))
+      provider.stubs(:git).with('tag', '-l').returns("Hello")
+    end
+
+    context "when its SHA is not different than the current SHA" do
+      it "should return the ref" do
+        provider.expects(:git).with('rev-parse', resource.value(:revision)).returns('currentsha')
+        provider.expects(:update_remotes)
+        expect(provider.revision).to eq(resource.value(:revision))
+      end
+    end
+
+    context "when its SHA is different than the current SHA" do
+      it "should return the current SHA" do
+        provider.expects(:git).with('rev-parse', resource.value(:revision)).returns('othersha')
+        provider.expects(:update_remotes)
+        expect(provider.revision).to eq(resource.value(:revision))
+      end
+    end
+
+    context "when its a ref to a remote head" do
+      it "should return the revision" do
+        provider.stubs(:git).with('branch', '-a').returns("  remotes/origin/#{resource.value(:revision)}")
+        provider.expects(:git).with('rev-parse', "origin/#{resource.value(:revision)}").returns("newsha")
+        provider.expects(:update_remotes)
+        expect(provider.revision).to eq(resource.value(:revision))
+      end
+    end
+
+    context "when its a ref to non existant remote head" do
+      it "should fail" do
+        provider.expects(:git).with('branch', '-a').returns(branch_a_list)
+        provider.expects(:git).with('rev-parse', '--revs-only', resource.value(:revision)).returns('')
+        provider.expects(:update_remotes)
+        expect { provider.revision }.to raise_error(Puppet::Error, /not a local or remote ref$/)
+      end
+    end
+
+    context "when the source is modified" do
+      it "should update the origin url" do
+        resource[:source] = 'git://git@foo.com/bar.git'
+        provider.expects(:git).with('config', '-l').returns("remote.origin.url=git://git@foo.com/foo.git\n")
+        provider.expects(:git).with('remote', 'set-url', 'origin', 'git://git@foo.com/bar.git')
+        provider.expects(:git).with('remote','update')
+        provider.expects(:git).with('rev-parse', resource.value(:revision)).returns('currentsha')
+        expect(provider.revision).to eq(resource.value(:revision))
+      end
+    end
+
+    context "when multiple sources are modified" do
+      it "should update the urls" do
+        resource[:source] = {"origin" => "git://git@foo.com/bar.git", "new_remote" => "git://git@foo.com/baz.git"}
+        provider.expects(:git).at_least_once.with('config', '-l').returns("remote.origin.url=git://git@foo.com/bar.git\n", "remote.origin.url=git://git@foo.com/foo.git\n")
+        provider.expects(:git).with('remote', 'set-url', 'origin', 'git://git@foo.com/bar.git')
+        provider.expects(:git).with('remote', 'add', 'new_remote', 'git://git@foo.com/baz.git')
+        provider.expects(:git).with('remote','update')
+        provider.expects(:git).with('rev-parse', resource.value(:revision)).returns('currentsha')
+        expect(provider.revision).to eq(resource.value(:revision))
+      end
+    end
+
+    context "when there's no source" do
+      it 'should return the revision' do
+        resource.delete(:source)
+        provider.expects(:git).with('status')
+        provider.expects(:git).with('rev-parse', resource.value(:revision)).returns('currentsha')
+        expect(provider.revision).to eq(resource.value(:revision))
+      end
+    end
+  end
+
+  context "setting the revision property" do
+    before do
+      expects_chdir
+    end
+    context "when it's an existing local branch" do
+      it "should use 'git fetch' and 'git reset'" do
+        resource[:revision] = 'feature/foo'
+        provider.expects(:update_submodules)
+        provider.expects(:git).with('branch', '-a').at_least_once.returns(branch_a_list(resource.value(:revision)))
+        provider.expects(:git).with('checkout', '--force', resource.value(:revision))
+        provider.expects(:git).with('reset', '--hard',  "origin/#{resource.value(:revision)}")
+        provider.revision = resource.value(:revision)
+      end
+    end
+    context "when it's a remote branch" do
+      it "should use 'git fetch' and 'git reset'" do
+        resource[:revision] = 'only/remote'
+        provider.expects(:update_submodules)
+        provider.expects(:git).with('branch', '-a').at_least_once.returns(resource.value(:revision))
+        provider.expects(:git).with('checkout', '--force', resource.value(:revision))
+        provider.expects(:git).with('reset', '--hard',  "origin/#{resource.value(:revision)}")
+        provider.revision = resource.value(:revision)
+      end
+    end
+    context "when it's a commit or tag" do
+      it "should use 'git fetch' and 'git reset'" do
+        resource[:revision] = 'a-commit-or-tag'
+        provider.expects(:git).with('branch', '-a').at_least_once.returns(fixture(:git_branch_a))
+        provider.expects(:git).with('checkout', '--force', resource.value(:revision))
+        provider.expects(:git).with('branch', '-a').returns(fixture(:git_branch_a))
+        provider.expects(:git).with('branch', '-a').returns(fixture(:git_branch_a))
+        provider.expects(:git).with('submodule', 'update', '--init', '--recursive')
+        provider.revision = resource.value(:revision)
+      end
+    end
+  end
+
+  context "updating references" do
+    it "should use 'git fetch --tags'" do
+      resource.delete(:source)
+      expects_chdir
+      provider.expects(:git).with('config', '-l').returns("remote.origin.url=git://git@foo.com/foo.git\n")
+      provider.expects(:git).with('fetch', 'origin')
+      provider.expects(:git).with('fetch', '--tags', 'origin')
+      provider.update_references
+    end
+  end
+
+  describe 'latest?' do
+    context 'when true' do
+      it do
+        provider.expects(:revision).returns('testrev')
+        provider.expects(:latest_revision).returns('testrev')
+        expect(provider.latest?).to be_truthy
+      end
+    end
+    context 'when false' do
+      it do
+        provider.expects(:revision).returns('master')
+        provider.expects(:latest_revision).returns('testrev')
+        expect(provider.latest?).to be_falsey
+      end
+    end
+  end
+
+  describe 'convert_working_copy_to_bare' do
+    it do
+      FileUtils.expects(:mv).returns(true)
+      FileUtils.expects(:rm_rf).returns(true)
+      FileUtils.expects(:mv).returns(true)
+
+      provider.instance_eval { convert_working_copy_to_bare }
+    end
+  end
+
+    describe 'convert_bare_to_working_copy' do
+    it do
+      FileUtils.expects(:mv).returns(true)
+      FileUtils.expects(:mkdir).returns(true)
+      FileUtils.expects(:mv).returns(true)
+      provider.expects(:commits_in?).returns(true)
+      # If you forget to stub these out you lose 3 hours of rspec work.
+      provider.expects(:reset).with('HEAD').returns(true)
+      provider.expects(:git_with_identity).returns(true)
+      provider.expects(:update_owner_and_excludes).returns(true)
+
+      provider.instance_eval { convert_bare_to_working_copy }
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/hg_spec.rb b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/hg_spec.rb
new file mode 100644
index 00000000..65d820d9
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/hg_spec.rb
@@ -0,0 +1,138 @@
+require 'spec_helper'
+
+describe Puppet::Type.type(:vcsrepo).provider(:hg) do
+
+  let(:resource) { Puppet::Type.type(:vcsrepo).new({
+    :name     => 'test',
+    :ensure   => :present,
+    :provider => :hg,
+    :path     => '/tmp/vcsrepo',
+  })}
+
+  let(:provider) { resource.provider }
+
+  before :each do
+    Puppet::Util.stubs(:which).with('hg').returns('/usr/bin/hg')
+  end
+
+  describe 'creating' do
+    context 'with source and revision' do
+      it "should execute 'hg clone -u' with the revision" do
+        resource[:source] = 'something'
+        resource[:revision] = '1'
+        provider.expects(:hg).with('clone', '-u',
+          resource.value(:revision),
+          resource.value(:source),
+          resource.value(:path))
+        provider.create
+      end
+    end
+
+    context 'without revision' do
+      it "should just execute 'hg clone' without a revision" do
+        resource[:source] = 'something'
+        provider.expects(:hg).with('clone', resource.value(:source), resource.value(:path))
+        provider.create
+      end
+    end
+
+    context "when a source is not given" do
+      it "should execute 'hg init'" do
+        provider.expects(:hg).with('init', resource.value(:path))
+        provider.create
+      end
+    end
+
+    context "when basic auth is used" do
+      it "should execute 'hg clone'" do
+        resource[:source] = 'something'
+        resource[:basic_auth_username] = 'user'
+        resource[:basic_auth_password] = 'pass'
+        provider.expects(:hg).with('clone',
+          resource.value(:source),
+          resource.value(:path),
+            "--config","\"auth.x.prefix=" + resource.value(:source) + "\"",
+            "--config","\"auth.x.username=" + resource.value(:basic_auth_username) + "\"",
+            "--config","\"auth.x.password=" + resource.value(:basic_auth_password) + "\"",
+            "--config","\"auth.x.schemes=http https" + "\"")
+        provider.create
+      end
+    end
+  end
+
+  describe 'destroying' do
+    it "it should remove the directory" do
+      expects_rm_rf
+      provider.destroy
+    end
+  end
+
+  describe "checking existence" do
+    it "should check for the directory" do
+      expects_directory?(true, File.join(resource.value(:path), '.hg'))
+      provider.exists?
+    end
+  end
+
+  describe "checking the revision property" do
+    before do
+      expects_chdir
+    end
+
+    context "when given a non-SHA as the resource revision" do
+      before do
+        provider.expects(:hg).with('parents').returns(fixture(:hg_parents))
+        provider.expects(:hg).with('tags').returns(fixture(:hg_tags))
+      end
+
+      context "when its SHA is not different than the current SHA" do
+        it "should return the ref" do
+          resource[:revision] = '0.6'
+          expect(provider.revision).to eq('0.6')
+        end
+      end
+
+      context "when its SHA is different than the current SHA" do
+        it "should return the current SHA" do
+          resource[:revision] = '0.5.3'
+          expect(provider.revision).to eq('34e6012c783a')
+        end
+      end
+    end
+    context "when given a SHA as the resource revision" do
+      before do
+        provider.expects(:hg).with('parents').returns(fixture(:hg_parents))
+      end
+
+      context "when it is the same as the current SHA", :resource => {:revision => '34e6012c783a'} do
+        it "should return it" do
+          resource[:revision] = '34e6012c783a'
+          provider.expects(:hg).with('tags').returns(fixture(:hg_tags))
+          expect(provider.revision).to eq(resource.value(:revision))
+        end
+      end
+
+      context "when it is not the same as the current SHA", :resource => {:revision => 'not-the-same'} do
+        it "should return the current SHA" do
+          resource[:revision] = 'not-the-same'
+          provider.expects(:hg).with('tags').returns(fixture(:hg_tags))
+          expect(provider.revision).to eq('34e6012c783a')
+        end
+      end
+    end
+  end
+
+  describe "setting the revision property" do
+    before do
+      @revision = '6aa99e9b3ab1'
+    end
+    it "should use 'hg update ---clean -r'" do
+      expects_chdir
+      provider.expects(:hg).with('pull')
+      provider.expects(:hg).with('merge')
+      provider.expects(:hg).with('update', '--clean', '-r', @revision)
+      provider.revision = @revision
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/p4_spec.rb b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/p4_spec.rb
new file mode 100644
index 00000000..e331cae6
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/p4_spec.rb
@@ -0,0 +1,82 @@
+require 'spec_helper'
+
+describe Puppet::Type.type(:vcsrepo).provider(:p4) do
+
+  let(:resource) { Puppet::Type.type(:vcsrepo).new({
+    :name     => 'test',
+    :ensure   => :present,
+    :provider => :p4,
+    :path     => '/tmp/vcsrepo',
+  })}
+
+  let(:provider) { resource.provider }
+
+  before :each do
+    Puppet::Util.stubs(:which).with('p4').returns('/usr/local/bin/p4')
+  end
+
+  spec = {
+    :input => "Description: Generated by Puppet VCSrepo\nRoot: /tmp/vcsrepo\n\nView:\n",
+    :marshal => false
+  }
+
+  describe 'creating' do
+    context 'with source and revision' do
+      it "should execute 'p4 sync' with the revision" do
+        resource[:source] = 'something'
+        resource[:revision] = '1'
+        ENV['P4CLIENT'] = 'client_ws1'
+
+        provider.expects(:p4).with(['client', '-o', 'client_ws1']).returns({})
+        provider.expects(:p4).with(['client', '-i'], spec)
+        provider.expects(:p4).with(['sync', resource.value(:source) + "@" + resource.value(:revision)])
+        provider.create
+      end
+    end
+
+    context 'without revision' do
+      it "should just execute 'p4 sync' without a revision" do
+        resource[:source] = 'something'
+        ENV['P4CLIENT'] = 'client_ws2'
+
+        provider.expects(:p4).with(['client', '-o', 'client_ws2']).returns({})
+        provider.expects(:p4).with(['client', '-i'], spec)
+        provider.expects(:p4).with(['sync', resource.value(:source)])
+        provider.create
+      end
+    end
+
+    context "when a client and source are not given" do
+      it "should execute 'p4 client'" do
+        ENV['P4CLIENT'] = nil
+
+        path = resource.value(:path)
+      host = Facter.value('hostname')
+        default = "puppet-" + Digest::MD5.hexdigest(path + host)
+
+        provider.expects(:p4).with(['client', '-o', default]).returns({})
+        provider.expects(:p4).with(['client', '-i'], spec)
+        provider.create
+      end
+    end
+  end
+
+  describe 'destroying' do
+    it "it should remove the directory" do
+      ENV['P4CLIENT'] = 'test_client'
+
+      provider.expects(:p4).with(['client', '-d', '-f', 'test_client'])
+      expects_rm_rf
+      provider.destroy
+    end
+  end
+
+  describe "checking existence" do
+    it "should check for the directory" do
+      provider.expects(:p4).with(['info'], {:marshal => false}).returns({})
+      provider.expects(:p4).with(['where', resource.value(:path) + "..."], {:raise => false}).returns({})
+      provider.exists?
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/svn_spec.rb b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/svn_spec.rb
new file mode 100644
index 00000000..6a37c205
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/unit/puppet/provider/vcsrepo/svn_spec.rb
@@ -0,0 +1,160 @@
+require 'spec_helper'
+
+describe Puppet::Type.type(:vcsrepo).provider(:svn) do
+
+  let(:resource) { Puppet::Type.type(:vcsrepo).new({
+    :name     => 'test',
+    :ensure   => :present,
+    :provider => :svn,
+    :path     => '/tmp/vcsrepo',
+  })}
+
+  let(:provider) { resource.provider }
+
+  before :each do
+    Puppet::Util.stubs(:which).with('git').returns('/usr/bin/git')
+  end
+
+  describe 'creating' do
+    context 'with source and revision' do
+      it "should execute 'svn checkout' with a revision" do
+        resource[:source] = 'exists'
+        resource[:revision] = '1'
+        provider.expects(:svn).with('--non-interactive', 'checkout', '-r',
+          resource.value(:revision),
+          resource.value(:source),
+          resource.value(:path))
+        provider.create
+      end
+    end
+    context 'with source' do
+      it "should just execute 'svn checkout' without a revision" do
+        resource[:source] = 'exists'
+        provider.expects(:svn).with('--non-interactive', 'checkout',
+          resource.value(:source),
+          resource.value(:path))
+        provider.create
+      end
+    end
+
+    context 'with fstype' do
+      it "should execute 'svnadmin create' with an '--fs-type' option" do
+        resource[:fstype] = 'ext4'
+        provider.expects(:svnadmin).with('create', '--fs-type',
+                                          resource.value(:fstype),
+                                          resource.value(:path))
+        provider.create
+      end
+    end
+    context 'without fstype' do
+      it "should execute 'svnadmin create' without an '--fs-type' option" do
+        provider.expects(:svnadmin).with('create', resource.value(:path))
+        provider.create
+      end
+    end
+    
+    context "with depth" do
+      it "should execute 'svn checkout' with a depth" do
+        resource[:source] = 'exists'
+        resource[:depth] = 'infinity'
+        provider.expects(:svn).with('--non-interactive', 'checkout', '--depth', 'infinity',
+          resource.value(:source),
+          resource.value(:path))
+        provider.create
+      end
+    end
+    
+    context "with trust_server_cert" do
+      it "should execute 'svn checkout' without a trust-server-cert" do
+        resource[:source] = 'exists'
+        resource[:trust_server_cert] = :false
+        provider.expects(:svn).with('--non-interactive', 'checkout',
+          resource.value(:source),
+          resource.value(:path))
+        provider.create
+      end
+      it "should execute 'svn checkout' with a trust-server-cert" do
+        resource[:source] = 'exists'
+        resource[:trust_server_cert] = :true
+        provider.expects(:svn).with('--non-interactive', '--trust-server-cert', 'checkout',
+          resource.value(:source),
+          resource.value(:path))
+        provider.create
+      end
+    end
+  end
+
+  describe 'destroying' do
+    it "it should remove the directory" do
+      expects_rm_rf
+      provider.destroy
+    end
+  end
+
+  describe "checking existence" do
+    it "should check for the directory" do
+      expects_directory?(true, resource.value(:path))
+      expects_directory?(true, File.join(resource.value(:path), '.svn'))
+      provider.exists?
+    end
+  end
+
+  describe "checking the revision property" do
+    before do
+      provider.expects(:svn).with('--non-interactive', 'info').returns(fixture(:svn_info))
+    end
+    it "should use 'svn info'" do
+      expects_chdir
+      expect(provider.revision).to eq('4') # From 'Revision', not 'Last Changed Rev'
+    end
+  end
+
+  describe "setting the revision property" do
+    before do
+      @revision = '30'
+    end
+    context 'with conflict' do
+      it "should use 'svn update'" do
+        resource[:conflict] = 'theirs-full'
+        expects_chdir
+        provider.expects(:svn).with('--non-interactive', 'update',
+                                    '-r', @revision,
+                                    '--accept', resource.value(:conflict))
+        provider.revision = @revision
+      end
+    end
+    context 'without conflict' do
+      it "should use 'svn update'" do
+        expects_chdir
+        provider.expects(:svn).with('--non-interactive', 'update', '-r', @revision)
+        provider.revision = @revision
+      end
+    end
+  end
+
+  describe "setting the revision property and repo source" do
+    before do
+      @revision = '30'
+    end
+    context 'with conflict' do
+      it "should use 'svn switch'" do
+        resource[:source] = 'an-unimportant-value'
+        resource[:conflict] = 'theirs-full'
+        expects_chdir
+        provider.expects(:svn).with('--non-interactive', 'switch',
+                                    '-r', @revision, 'an-unimportant-value',
+                                    '--accept', resource.value(:conflict))
+        provider.revision = @revision
+      end
+    end
+    context 'without conflict' do
+      it "should use 'svn switch'" do
+        resource[:source] = 'an-unimportant-value'
+        expects_chdir
+        provider.expects(:svn).with('--non-interactive', 'switch', '-r', @revision, 'an-unimportant-value')
+        provider.revision = @revision
+      end
+    end
+  end
+
+end
diff --git a/puppet/modules/vcsrepo/spec/unit/puppet/type/README.markdown b/puppet/modules/vcsrepo/spec/unit/puppet/type/README.markdown
new file mode 100644
index 00000000..1ee19ac8
--- /dev/null
+++ b/puppet/modules/vcsrepo/spec/unit/puppet/type/README.markdown
@@ -0,0 +1,4 @@
+Resource Type Specs
+===================
+
+Define specs for your resource types in this directory.
-- 
cgit v1.2.3


From 1e1e25286b64790141c9627f81b50f579b13b719 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:28 -0400
Subject: git subrepo clone https://leap.se/git/puppet_rsyslog
 puppet/modules/rsyslog

subrepo:
  subdir:   "puppet/modules/rsyslog"
  merged:   "b8ef11c"
upstream:
  origin:   "https://leap.se/git/puppet_rsyslog"
  branch:   "master"
  commit:   "b8ef11c"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Iee06502c6df609f1a261410742360cec8694dab5
---
 puppet/modules/rsyslog/.fixtures.yml               |   3 +
 puppet/modules/rsyslog/.gemfile                    |  14 +
 puppet/modules/rsyslog/.gitignore                  |   5 +
 puppet/modules/rsyslog/.gitrepo                    |  11 +
 puppet/modules/rsyslog/.travis.yml                 |  56 +++
 puppet/modules/rsyslog/LICENSE                     | 202 +++++++++
 puppet/modules/rsyslog/README.md                   | 202 +++++++++
 puppet/modules/rsyslog/Rakefile                    |   6 +
 .../modules/rsyslog/lib/facter/rsyslog_version.rb  |  38 ++
 puppet/modules/rsyslog/manifests/client.pp         |  64 +++
 puppet/modules/rsyslog/manifests/config.pp         |  51 +++
 puppet/modules/rsyslog/manifests/database.pp       |  57 +++
 puppet/modules/rsyslog/manifests/imfile.pp         |  48 +++
 puppet/modules/rsyslog/manifests/init.pp           |  54 +++
 puppet/modules/rsyslog/manifests/install.pp        |  32 ++
 puppet/modules/rsyslog/manifests/modload.pp        |  15 +
 puppet/modules/rsyslog/manifests/params.pp         | 222 ++++++++++
 puppet/modules/rsyslog/manifests/server.pp         |  70 +++
 puppet/modules/rsyslog/manifests/service.pp        |  21 +
 puppet/modules/rsyslog/manifests/snippet.pp        |  35 ++
 puppet/modules/rsyslog/metadata.json               |  62 +++
 .../rsyslog/spec/classes/rsyslog_client_spec.rb    | 146 +++++++
 .../rsyslog/spec/classes/rsyslog_database_spec.rb  | 308 ++++++++++++++
 .../rsyslog/spec/classes/rsyslog_server_spec.rb    | 182 ++++++++
 .../modules/rsyslog/spec/classes/rsyslog_spec.rb   | 469 +++++++++++++++++++++
 .../rsyslog/spec/defines/rsyslog_imfile_spec.rb    | 169 ++++++++
 .../rsyslog/spec/defines/rsyslog_snippet_spec.rb   | 157 +++++++
 puppet/modules/rsyslog/spec/spec.opts              |   6 +
 puppet/modules/rsyslog/spec/spec_helper.rb         |  28 ++
 puppet/modules/rsyslog/templates/client.conf.erb   | 180 ++++++++
 puppet/modules/rsyslog/templates/database.conf.erb |   6 +
 puppet/modules/rsyslog/templates/imfile.erb        |  15 +
 puppet/modules/rsyslog/templates/modload.erb       |   3 +
 puppet/modules/rsyslog/templates/rsyslog.conf.erb  |  49 +++
 .../modules/rsyslog/templates/rsyslog_default.erb  |   9 +
 .../rsyslog/templates/rsyslog_default_gentoo.erb   |  16 +
 .../rsyslog/templates/rsyslog_default_rhel7.erb    |   2 +
 .../rsyslog/templates/server-default.conf.erb      |  42 ++
 .../rsyslog/templates/server-hostname.conf.erb     |  41 ++
 .../templates/server/_default-footer.conf.erb      |  13 +
 .../templates/server/_default-header.conf.erb      |  36 ++
 puppet/modules/rsyslog/tests/database.pp           |   9 +
 puppet/modules/rsyslog/tests/init.pp               |   1 +
 puppet/modules/rsyslog/tests/log_templates.pp      |   9 +
 puppet/modules/rsyslog/tests/multiple_hosts.pp     |  17 +
 45 files changed, 3181 insertions(+)
 create mode 100644 puppet/modules/rsyslog/.fixtures.yml
 create mode 100644 puppet/modules/rsyslog/.gemfile
 create mode 100644 puppet/modules/rsyslog/.gitignore
 create mode 100644 puppet/modules/rsyslog/.gitrepo
 create mode 100644 puppet/modules/rsyslog/.travis.yml
 create mode 100644 puppet/modules/rsyslog/LICENSE
 create mode 100644 puppet/modules/rsyslog/README.md
 create mode 100644 puppet/modules/rsyslog/Rakefile
 create mode 100644 puppet/modules/rsyslog/lib/facter/rsyslog_version.rb
 create mode 100644 puppet/modules/rsyslog/manifests/client.pp
 create mode 100644 puppet/modules/rsyslog/manifests/config.pp
 create mode 100644 puppet/modules/rsyslog/manifests/database.pp
 create mode 100644 puppet/modules/rsyslog/manifests/imfile.pp
 create mode 100644 puppet/modules/rsyslog/manifests/init.pp
 create mode 100644 puppet/modules/rsyslog/manifests/install.pp
 create mode 100644 puppet/modules/rsyslog/manifests/modload.pp
 create mode 100644 puppet/modules/rsyslog/manifests/params.pp
 create mode 100644 puppet/modules/rsyslog/manifests/server.pp
 create mode 100644 puppet/modules/rsyslog/manifests/service.pp
 create mode 100644 puppet/modules/rsyslog/manifests/snippet.pp
 create mode 100644 puppet/modules/rsyslog/metadata.json
 create mode 100644 puppet/modules/rsyslog/spec/classes/rsyslog_client_spec.rb
 create mode 100644 puppet/modules/rsyslog/spec/classes/rsyslog_database_spec.rb
 create mode 100644 puppet/modules/rsyslog/spec/classes/rsyslog_server_spec.rb
 create mode 100644 puppet/modules/rsyslog/spec/classes/rsyslog_spec.rb
 create mode 100644 puppet/modules/rsyslog/spec/defines/rsyslog_imfile_spec.rb
 create mode 100644 puppet/modules/rsyslog/spec/defines/rsyslog_snippet_spec.rb
 create mode 100644 puppet/modules/rsyslog/spec/spec.opts
 create mode 100644 puppet/modules/rsyslog/spec/spec_helper.rb
 create mode 100644 puppet/modules/rsyslog/templates/client.conf.erb
 create mode 100644 puppet/modules/rsyslog/templates/database.conf.erb
 create mode 100644 puppet/modules/rsyslog/templates/imfile.erb
 create mode 100644 puppet/modules/rsyslog/templates/modload.erb
 create mode 100644 puppet/modules/rsyslog/templates/rsyslog.conf.erb
 create mode 100644 puppet/modules/rsyslog/templates/rsyslog_default.erb
 create mode 100644 puppet/modules/rsyslog/templates/rsyslog_default_gentoo.erb
 create mode 100644 puppet/modules/rsyslog/templates/rsyslog_default_rhel7.erb
 create mode 100644 puppet/modules/rsyslog/templates/server-default.conf.erb
 create mode 100644 puppet/modules/rsyslog/templates/server-hostname.conf.erb
 create mode 100644 puppet/modules/rsyslog/templates/server/_default-footer.conf.erb
 create mode 100644 puppet/modules/rsyslog/templates/server/_default-header.conf.erb
 create mode 100644 puppet/modules/rsyslog/tests/database.pp
 create mode 100644 puppet/modules/rsyslog/tests/init.pp
 create mode 100644 puppet/modules/rsyslog/tests/log_templates.pp
 create mode 100644 puppet/modules/rsyslog/tests/multiple_hosts.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/rsyslog/.fixtures.yml b/puppet/modules/rsyslog/.fixtures.yml
new file mode 100644
index 00000000..b1fb3e0c
--- /dev/null
+++ b/puppet/modules/rsyslog/.fixtures.yml
@@ -0,0 +1,3 @@
+fixtures:
+  symlinks:
+    "rsyslog": "#{source_dir}"
diff --git a/puppet/modules/rsyslog/.gemfile b/puppet/modules/rsyslog/.gemfile
new file mode 100644
index 00000000..e9e12704
--- /dev/null
+++ b/puppet/modules/rsyslog/.gemfile
@@ -0,0 +1,14 @@
+source 'https://rubygems.org'
+
+group :development, :test do
+  gem 'rake',                   :require => false
+  gem 'puppet-lint',            :require => false
+  gem 'rspec-puppet',           :require => false
+  gem 'puppetlabs_spec_helper', :require => false
+end
+
+if puppetversion = ENV['PUPPET_GEM_VERSION']
+  gem 'puppet', puppetversion, :require => false
+else
+  gem 'puppet', :require => false
+end
diff --git a/puppet/modules/rsyslog/.gitignore b/puppet/modules/rsyslog/.gitignore
new file mode 100644
index 00000000..d51673f2
--- /dev/null
+++ b/puppet/modules/rsyslog/.gitignore
@@ -0,0 +1,5 @@
+pkg/
+*.swp
+.forge-releng
+/spec/fixtures
+.DS_Store
diff --git a/puppet/modules/rsyslog/.gitrepo b/puppet/modules/rsyslog/.gitrepo
new file mode 100644
index 00000000..fa9db13d
--- /dev/null
+++ b/puppet/modules/rsyslog/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_rsyslog
+	branch = master
+	commit = b8ef11c23949d12732ad5cdaebb3023ff39a297a
+	parent = 850a14b59444737f703686d0d1996bf09ab08e2b
+	cmdver = 0.3.0
diff --git a/puppet/modules/rsyslog/.travis.yml b/puppet/modules/rsyslog/.travis.yml
new file mode 100644
index 00000000..bf7edebb
--- /dev/null
+++ b/puppet/modules/rsyslog/.travis.yml
@@ -0,0 +1,56 @@
+---
+branches:
+  only:
+    - master
+language: ruby
+bundler_args: --without development
+script: bundle exec rake spec SPEC_OPTS='--format documentation'
+after_success:
+  - git clone -q git://github.com/puppetlabs/ghpublisher.git .forge-releng
+  - .forge-releng/publish
+rvm:
+  - 1.8.7
+  - 1.9.3
+  - 2.0.0
+  - 2.1.1
+env:
+  matrix:
+    - PUPPET_GEM_VERSION="~> 2.7.0"
+    - PUPPET_GEM_VERSION="~> 3.0.0"
+    - PUPPET_GEM_VERSION="~> 3.1.0"
+    - PUPPET_GEM_VERSION="~> 3.2.0"
+    - PUPPET_GEM_VERSION="~> 3.3.0"
+    - PUPPET_GEM_VERSION="~> 3.4.0"
+    - PUPPET_GEM_VERSION="~> 3.5.0"
+  global:
+  - PUBLISHER_LOGIN=saz
+  - secure: |-
+      EmipIx5A93xnHKwdHfuMPGNLjLz0M0wND0IyeucWhIHE+KtZ48oT+mO2XhnJSpu1DH
+      JaSoYgjQpCILvniWg76o+HY1bTDEP3AmUlxNFgfDAOAQfv0RHv2cEcgNxNrxsddx6S
+      Ks0FCvVkFgY703X+kBiYTpjP4SBzRe0y9OudSvk=
+matrix:
+  fast_finish: true
+  exclude:
+    - rvm: 1.9.3
+      env: PUPPET_GEM_VERSION="~> 2.7.0"
+    - rvm: 2.0.0
+      env: PUPPET_GEM_VERSION="~> 2.7.0"
+    - rvm: 2.0.0
+      env: PUPPET_GEM_VERSION="~> 3.0.0"
+    - rvm: 2.0.0
+      env: PUPPET_GEM_VERSION="~> 3.1.0"
+    - rvm: 2.1.1
+      env: PUPPET_GEM_VERSION="~> 2.7.0"
+    - rvm: 2.1.1
+      env: PUPPET_GEM_VERSION="~> 3.0.0"
+    - rvm: 2.1.1
+      env: PUPPET_GEM_VERSION="~> 3.1.0"
+    - rvm: 2.1.1
+      env: PUPPET_GEM_VERSION="~> 3.2.0"
+    - rvm: 2.1.1
+      env: PUPPET_GEM_VERSION="~> 3.3.0"
+    - rvm: 2.1.1
+      env: PUPPET_GEM_VERSION="~> 3.4.0"
+notifications:
+  email: false
+gemfile: .gemfile
diff --git a/puppet/modules/rsyslog/LICENSE b/puppet/modules/rsyslog/LICENSE
new file mode 100644
index 00000000..d6456956
--- /dev/null
+++ b/puppet/modules/rsyslog/LICENSE
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/puppet/modules/rsyslog/README.md b/puppet/modules/rsyslog/README.md
new file mode 100644
index 00000000..d9292866
--- /dev/null
+++ b/puppet/modules/rsyslog/README.md
@@ -0,0 +1,202 @@
+# puppet-rsyslog [![Build Status](https://secure.travis-ci.org/saz/puppet-rsyslog.png)](https://travis-ci.org/saz/puppet-rsyslog)
+
+Manage rsyslog client and server via Puppet
+
+## REQUIREMENTS
+
+* Puppet >=2.6 if using parameterized classes
+* Currently supports Ubuntu >=11.04 & Debian running rsyslog >=4.5
+
+## USAGE
+
+### Client
+
+#### Using default values
+```
+    class { 'rsyslog::client': }
+```
+
+#### Variables and default values
+```
+    class { 'rsyslog::client':
+        log_remote            => true,
+        spool_size            => '1g',
+        remote_type           => 'tcp',
+        remote_forward_format => 'RSYSLOG_ForwardFormat',
+        log_local             => false,
+        log_auth_local        => false,
+        custom_config         => undef,
+        custom_params         => undef,
+        server                => 'log',
+        port                  => '514',
+        remote_servers        => false,
+        ssl_ca                => undef,
+        log_templates         => false,
+        actionfiletemplate    => false
+    }
+```
+for read from file
+```
+ rsyslog::imfile { 'my-imfile':
+   file_name => '/some/file',
+   file_tag => 'mytag',
+   file_facility => 'myfacility',
+  }
+
+```
+
+#### Defining custom logging templates
+
+The `log_templates` parameter can be used to set up custom logging templates, which can be used for local and/or remote logging. More detail on template formats can be found in the [rsyslog documentation](http://www.rsyslog.com/doc/rsyslog_conf_templates.html).
+
+The following examples sets up a custom logging template as per [RFC3164fmt](https://www.ietf.org/rfc/rfc3164.txt):
+
+```puppet
+class{'rsyslog::client':
+  log_templates => [
+    {
+      name      => 'RFC3164fmt',
+      template  => '<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%',
+    },
+  ]
+}
+```
+
+#### Logging to multiple remote servers
+
+The `remote_servers` parameter can be used to set up logging to multiple remote servers which are supplied as a list of key value pairs for each remote. There is an example configuration provided in `./test/multiple_hosts.pp`
+
+Using the `remote_servers` parameter over-rides the other remote sever parameters, and they will not be used in the client configuration file:
+* `log_remote`
+* `remote_type`
+* `server`
+* `port`
+
+The following example sets up three remote logging hosts for the client:
+
+```puppet
+class{'rsyslog::client':
+  remote_servers => [
+    {
+      host => 'logs.example.org',
+    },
+    {
+      port => '55514',
+    },
+    {
+      host      => 'logs.somewhere.com',
+      port      => '555',
+      pattern   => '*.log',
+      protocol  => 'tcp',
+      format    => 'RFC3164fmt',
+    },
+  ]
+}
+```
+
+Each host has the following parameters:
+* *host*: Sets the address or hostname of the remote logging server. Defaults to `localhost`
+* *port*: Sets the port the host is listening on. Defaults to `514`
+* *pattern*: Sets the pattern to match logs. Defaults to `*.*`
+* *protocol*: Sets the protocol. Only recognises TCP and UDP. Defaults to UDP
+* *format*: Sets the log format. Defaults to not specifying log format, which defaults to the format set by `ActionFileDefaultTemplate` in the client configuration.
+
+#### Logging to a MySQL or PostgreSQL database
+
+Events can also be logged to a MySQL or PostgreSQL database. The database needs to be deployed separately, either locally or remotely. Schema are available from the `rsyslog` source:
+
+  * [MySQL schema](http://git.adiscon.com/?p=rsyslog.git;a=blob_plain;f=plugins/ommysql/createDB.sql)
+  * [PostgreSQL schema](http://git.adiscon.com/?p=rsyslog.git;a=blob_plain;f=plugins/ompgsql/createDB.sql)
+
+Declare the following to configure the connection:
+````
+    class { 'rsyslog::database':
+        backend  => 'mysql',
+        server   => 'localhost',
+        database => 'Syslog',
+        username => 'rsyslog',
+        password => 'secret',
+    }
+````
+### Server
+
+#### Using default values
+```
+    class { 'rsyslog::server': }
+```
+
+#### Variables and default values
+```
+    class { 'rsyslog::server':
+        enable_tcp                => true,
+        enable_udp                => true,
+        enable_onefile            => false,
+        server_dir                => '/srv/log/',
+        custom_config             => undef,
+        high_precision_timestamps => false,
+    }
+```
+
+Both can be installed at the same time.
+
+## PARAMETERS
+
+The following lists all the class parameters this module accepts.
+
+    RSYSLOG::SERVER CLASS PARAMETERS    VALUES              DESCRIPTION
+    -------------------------------------------------------------------
+    enable_tcp                          true,false          Enable TCP listener. Defaults to true.
+    enable_udp                          true,false          Enable UDP listener. Defaults to true.
+    enable_onefile                      true,false          Only one logfile per remote host. Defaults to false.
+    server_dir                          STRING              Folder where logs will be stored on the server. Defaults to '/srv/log/'
+    custom_config                       STRING              Specify your own template to use for server config. Defaults to undef. Example usage: custom_config => 'rsyslog/my_config.erb'
+    high_precision_timestamps           true,false          Whether or not to use high precision timestamps.
+    remote_servers                      HASH                Provides a hash of multiple remote logging servers. Check documentation.
+
+    RSYSLOG::CLIENT CLASS PARAMETERS    VALUES              DESCRIPTION
+    -------------------------------------------------------------------
+    log_remote                          true,false          Log Remotely. Defaults to true.
+    spool_size                          STRING              Max size for disk queue if remote server failed. Defaults to '1g'.
+    remote_type                         'tcp','udp'         Which protocol to use when logging remotely. Defaults to 'tcp'.
+    remote_forward_format               STRING              Which forward format for remote servers should be used. Only used if remote_servers is false.
+    log_local                           true,false          Log locally. Defaults to false.
+    log_auth_local                      true,false          Just log auth facility locally. Defaults to false.
+    custom_config                       STRING              Specify your own template to use for client config. Defaults to undef. Example usage: custom_config => 'rsyslog/my_config.erb'
+    custom_params                       TODO                TODO
+    server                              STRING              Rsyslog server to log to. Will be used in the client configuration file. Only used, if remote_servers is false.
+    port                                '514'               Remote server port. Only used if remote_servers is false.
+    remote_servers                      Array of hashes     Array of hashes with remote servers. See documentation above. Defaults to false.
+    ssl_ca                              STRING              SSL CA file location. Defaults to undef.
+    log_templates                       HASH                Provides a has defining custom logging templates using the `$template` configuration parameter.
+    actionfiletemplate                  STRING              If set this defines the `ActionFileDefaultTemplate` which sets the default logging format for remote and local logging.
+
+    RSYSLOG::DATABASE CLASS PARAMETERS  VALUES              DESCRIPTION
+    -------------------------------------------------------------------
+    backend                             'mysql','pgsql'     Database backend (MySQL or PostgreSQL).
+    server                              STRING              Database server.
+    database                            STRING              Database name.
+    username                            STRING              Database username.
+    password                            STRING              Database password.
+
+### Other notes
+
+Due to a missing feature in current RELP versions (InputRELPServerBindRuleset option),
+remote logging is using TCP. You can switch between TCP and UDP. As soon as there is
+a new RELP version which supports setting Rulesets, I will add support for relp back.
+
+By default, rsyslog::server will strip numbers from hostnames. This means the logs of
+multiple servers with the same non-numerical name will be aggregrated in a single
+directory. i.e. www01 www02 and www02 would all log to the www directory.
+
+To log each host to a seperate directory, set the custom_config parameter to
+'rsyslog/server-hostname.conf.erb'
+
+If any of the following parameters are set to `false`, then the module will not
+manage the respective package:
+
+    gnutls_package_name
+    relp_package_name
+    rsyslog_package_name
+
+This can be used when using the adiscon PPA repository, that has merged rsyslog-gnutls
+with the main rsyslog package.
diff --git a/puppet/modules/rsyslog/Rakefile b/puppet/modules/rsyslog/Rakefile
new file mode 100644
index 00000000..469b83c6
--- /dev/null
+++ b/puppet/modules/rsyslog/Rakefile
@@ -0,0 +1,6 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+
+# Enable puppet-lint for all manifests: rake lint
+require 'puppet-lint/tasks/puppet-lint'
+PuppetLint.configuration.send("disable_80chars")    # no warnings on lines over 80 chars.
+PuppetLint.configuration.ignore_paths = ["spec/fixtures/**/*.pp"]
diff --git a/puppet/modules/rsyslog/lib/facter/rsyslog_version.rb b/puppet/modules/rsyslog/lib/facter/rsyslog_version.rb
new file mode 100644
index 00000000..de8531e8
--- /dev/null
+++ b/puppet/modules/rsyslog/lib/facter/rsyslog_version.rb
@@ -0,0 +1,38 @@
+# Fact: :syslog_package
+#
+# Purpose: retrieve installed rsyslog version
+#
+
+Facter.add(:rsyslog_version) do
+    setcode do
+        osfamily = Facter.value('osfamily')
+        case osfamily
+        when "Debian"
+            command='/usr/bin/dpkg-query -f \'${Status};${Version};\' -W rsyslog 2>/dev/null'
+            version = Facter::Util::Resolution.exec(command)
+            if version =~ /.*install ok installed;([^;]+);.*/
+                $1
+            else
+                nil
+            end
+        when "RedHat", "Suse"
+            command='rpm -qa --qf "%{VERSION}" "rsyslog"'
+            version = Facter::Util::Resolution.exec(command)
+            if version =~ /^(.+)$/
+                $1
+            else
+                nil
+            end
+        when "FreeBSD"
+          command='pkg query %v rsyslog'
+          version = Facter::Util::Resolution.exec(command)
+          if version =~ /^(.+)$/
+            $1
+          else
+            nil
+          end
+        else
+            nil
+        end
+    end
+end
diff --git a/puppet/modules/rsyslog/manifests/client.pp b/puppet/modules/rsyslog/manifests/client.pp
new file mode 100644
index 00000000..193aa336
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/client.pp
@@ -0,0 +1,64 @@
+# == Class: rsyslog::client
+#
+# Full description of class role here.
+#
+# === Parameters
+#
+# [*log_remote*]
+# [*spool_size*]
+# [*remote_type*]
+# [*remote_forward_format*]
+# [*log_local*]
+# [*log_auth_local*]
+# [*custom_config*]
+# [*custom_params*]
+# [*server*]
+# [*port*]
+# [*remote_servers*]
+# [*ssl_ca*]
+# [*log_templates*]
+# [*actionfiletemplate*]
+#
+# === Variables
+#
+# === Examples
+#
+#  class { 'rsyslog::client': }
+#
+class rsyslog::client (
+  $log_remote            = true,
+  $spool_size            = '1g',
+  $remote_type           = 'tcp',
+  $remote_forward_format = 'RSYSLOG_ForwardFormat',
+  $log_local             = false,
+  $log_auth_local        = false,
+  $custom_config         = undef,
+  $custom_params         = undef,
+  $server                = 'log',
+  $port                  = '514',
+  $remote_servers        = false,
+  $ssl_ca                = undef,
+  $log_templates         = false,
+  $actionfiletemplate    = false
+) inherits rsyslog {
+
+  if $custom_config {
+    $content_real = template($custom_config)
+  } else {
+    $content_real = template("${module_name}/client.conf.erb")
+  }
+
+  rsyslog::snippet { $rsyslog::client_conf:
+    ensure  => present,
+    content => $content_real,
+  }
+
+  if $rsyslog::ssl and $ssl_ca == undef {
+    fail('You need to define $ssl_ca in order to use SSL.')
+  }
+
+  if $rsyslog::ssl and $remote_type != 'tcp' {
+    fail('You need to enable tcp in order to use SSL.')
+  }
+
+}
diff --git a/puppet/modules/rsyslog/manifests/config.pp b/puppet/modules/rsyslog/manifests/config.pp
new file mode 100644
index 00000000..1aebe47b
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/config.pp
@@ -0,0 +1,51 @@
+# == Class: rsyslog::config
+#
+# Full description of class role here.
+#
+# === Parameters
+#
+# === Variables
+#
+# === Examples
+#
+#  class { 'rsyslog::config': }
+#
+class rsyslog::config {
+  file { $rsyslog::rsyslog_d:
+    ensure  => directory,
+    owner   => 'root',
+    group   => $rsyslog::run_group,
+    purge   => $rsyslog::purge_rsyslog_d,
+    recurse => true,
+    force   => true,
+    require => Class['rsyslog::install'],
+  }
+
+  file { $rsyslog::rsyslog_conf:
+    ensure  => file,
+    owner   => 'root',
+    group   => $rsyslog::run_group,
+    content => template("${module_name}/rsyslog.conf.erb"),
+    require => Class['rsyslog::install'],
+    notify  => Class['rsyslog::service'],
+  }
+
+  file { $rsyslog::rsyslog_default:
+    ensure  => file,
+    owner   => 'root',
+    group   => $rsyslog::run_group,
+    content => template("${module_name}/${rsyslog::rsyslog_default_file}.erb"),
+    require => Class['rsyslog::install'],
+    notify  => Class['rsyslog::service'],
+  }
+
+  file { $rsyslog::spool_dir:
+    ensure  => directory,
+    owner   => 'root',
+    group   => $rsyslog::run_group,
+    seltype => 'syslogd_var_lib_t',
+    require => Class['rsyslog::install'],
+    notify  => Class['rsyslog::service'],
+  }
+
+}
diff --git a/puppet/modules/rsyslog/manifests/database.pp b/puppet/modules/rsyslog/manifests/database.pp
new file mode 100644
index 00000000..fe6d6ac8
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/database.pp
@@ -0,0 +1,57 @@
+# == Class: rsyslog::database
+#
+# Full description of class role here.
+#
+# === Parameters
+#
+# [*backend*]  - Which backend server to use (mysql|pgsql)
+# [*server*]   - Server hostname
+# [*database*] - Database name
+# [*username*] - Database username
+# [*password*] - Database password
+#
+# === Variables
+#
+# === Examples
+#
+#  class { 'rsyslog::database':
+#    backend  => 'mysql',
+#    server   => 'localhost',
+#    database => 'mydb',
+#    username => 'myuser',
+#    password => 'mypass',
+#  }
+#
+class rsyslog::database (
+  $backend,
+  $server,
+  $database,
+  $username,
+  $password
+) inherits rsyslog {
+
+  $db_module = "om${backend}"
+  $db_conf = "${rsyslog::rsyslog_d}${backend}.conf"
+
+  case $backend {
+    mysql: { $db_package = $rsyslog::mysql_package_name }
+    pgsql: { $db_package = $rsyslog::pgsql_package_name }
+    default: { fail("Unsupported backend: ${backend}. Only MySQL (mysql) and PostgreSQL (pgsql) are supported.") }
+  }
+
+  package { $db_package:
+    ensure => $rsyslog::package_status,
+    before => File[$db_conf],
+  }
+
+  file { $db_conf:
+    ensure  => present,
+    owner   => 'root',
+    group   => $rsyslog::run_group,
+    mode    => '0600',
+    content => template("${module_name}/database.conf.erb"),
+    require => Class['rsyslog::config'],
+    notify  => Class['rsyslog::service'],
+  }
+
+}
diff --git a/puppet/modules/rsyslog/manifests/imfile.pp b/puppet/modules/rsyslog/manifests/imfile.pp
new file mode 100644
index 00000000..bd0afa36
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/imfile.pp
@@ -0,0 +1,48 @@
+# == Define: rsyslog::imfile
+#
+# Full description of class role here.
+#
+# === Parameters
+#
+# [*file_name*]
+# [*file_tag*]
+# [*file_facility*]
+# [*polling_interval*]
+# [*file_severity*]
+# [*run_file_monitor*]
+# [*persist_state_interval]
+#
+# === Variables
+#
+# === Examples
+#
+#  rsyslog::imfile { 'my-imfile':
+#    file_name     => '/some/file',
+#    file_tag      => 'mytag',
+#    file_facility => 'myfacility',
+#  }
+#
+define rsyslog::imfile(
+  $file_name,
+  $file_tag,
+  $file_facility,
+  $polling_interval = 10,
+  $file_severity = 'notice',
+  $run_file_monitor = true,
+  $persist_state_interval = 0,
+) {
+
+
+  include rsyslog
+  $extra_modules = $rsyslog::extra_modules
+
+  file { "${rsyslog::rsyslog_d}${name}.conf":
+    ensure  => file,
+    owner   => 'root',
+    group   => $rsyslog::run_group,
+    content => template('rsyslog/imfile.erb'),
+    require => Class['rsyslog::install'],
+    notify  => Class['rsyslog::service'],
+  }
+
+}
diff --git a/puppet/modules/rsyslog/manifests/init.pp b/puppet/modules/rsyslog/manifests/init.pp
new file mode 100644
index 00000000..76d61023
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/init.pp
@@ -0,0 +1,54 @@
+# == Class: rsyslog
+#
+# Meta class to install rsyslog with a basic configuration.
+# You probably want rsyslog::client or rsyslog::server
+#
+# === Parameters
+#
+# === Variables
+#
+# === Examples
+#
+#  class { 'rsyslog': }
+#
+class rsyslog (
+  $rsyslog_package_name   = $rsyslog::params::rsyslog_package_name,
+  $relp_package_name      = $rsyslog::params::relp_package_name,
+  $mysql_package_name     = $rsyslog::params::mysql_package_name,
+  $pgsql_package_name     = $rsyslog::params::pgsql_package_name,
+  $gnutls_package_name    = $rsyslog::params::gnutls_package_name,
+  $package_status         = $rsyslog::params::package_status,
+  $rsyslog_d              = $rsyslog::params::rsyslog_d,
+  $purge_rsyslog_d        = $rsyslog::params::purge_rsyslog_d,
+  $rsyslog_conf           = $rsyslog::params::rsyslog_conf,
+  $rsyslog_default        = $rsyslog::params::rsyslog_default,
+  $rsyslog_default_file   = $rsyslog::params::default_config_file,
+  $run_user               = $rsyslog::params::run_user,
+  $run_group              = $rsyslog::params::run_group,
+  $log_user               = $rsyslog::params::log_user,
+  $log_group              = $rsyslog::params::log_group,
+  $log_style              = $rsyslog::params::log_style,
+  $umask                  = $rsyslog::params::umask,
+  $perm_file              = $rsyslog::params::perm_file,
+  $perm_dir               = $rsyslog::params::perm_dir,
+  $spool_dir              = $rsyslog::params::spool_dir,
+  $service_name           = $rsyslog::params::service_name,
+  $service_hasrestart     = $rsyslog::params::service_hasrestart,
+  $service_hasstatus      = $rsyslog::params::service_hasstatus,
+  $client_conf            = $rsyslog::params::client_conf,
+  $server_conf            = $rsyslog::params::server_conf,
+  $ssl                    = $rsyslog::params::ssl,
+  $modules                = $rsyslog::params::modules,
+  $preserve_fqdn          = $rsyslog::params::preserve_fqdn,
+  $max_message_size       = $rsyslog::params::max_message_size,
+  $extra_modules          = $rsyslog::params::extra_modules
+) inherits rsyslog::params {
+  class { 'rsyslog::install': }
+  class { 'rsyslog::config': }
+
+  if $extra_modules != [] {
+    class { 'rsyslog::modload': }
+  }
+
+  class { 'rsyslog::service': }
+}
diff --git a/puppet/modules/rsyslog/manifests/install.pp b/puppet/modules/rsyslog/manifests/install.pp
new file mode 100644
index 00000000..9798b3f4
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/install.pp
@@ -0,0 +1,32 @@
+# == Class: rsyslog::install
+#
+# This class makes sure that the required packages are installed
+#
+# === Parameters
+#
+# === Variables
+#
+# === Examples
+#
+#  class { 'rsyslog::install': }
+#
+class rsyslog::install {
+  if $rsyslog::rsyslog_package_name != false {
+    package { $rsyslog::rsyslog_package_name:
+      ensure => $rsyslog::package_status,
+    }
+  }
+
+  if $rsyslog::relp_package_name != false {
+    package { $rsyslog::relp_package_name:
+      ensure => $rsyslog::package_status
+    }
+  }
+
+  if $rsyslog::gnutls_package_name != false {
+    package { $rsyslog::gnutls_package_name:
+      ensure => $rsyslog::package_status
+    }
+  }
+
+}
diff --git a/puppet/modules/rsyslog/manifests/modload.pp b/puppet/modules/rsyslog/manifests/modload.pp
new file mode 100644
index 00000000..7a838af1
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/modload.pp
@@ -0,0 +1,15 @@
+# == Class: rsyslog::modload
+#
+
+class rsyslog::modload (
+  $modload_filename = '10-modload.conf',
+) {
+  file { "${rsyslog::rsyslog_d}${modload_filename}":
+    ensure  => file,
+    owner   => 'root',
+    group   => $rsyslog::run_group,
+    content => template('rsyslog/modload.erb'),
+    require => Class['rsyslog::install'],
+    notify  => Class['rsyslog::service'],
+  }
+}
diff --git a/puppet/modules/rsyslog/manifests/params.pp b/puppet/modules/rsyslog/manifests/params.pp
new file mode 100644
index 00000000..12a67cef
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/params.pp
@@ -0,0 +1,222 @@
+# == Class: rsyslog::params
+#
+# This defines default configuration values for rsyslog.
+# You don't want to use it directly.
+#
+# === Parameters
+#
+# === Variables
+#
+# === Examples
+#
+#  class { 'rsyslog::params': }
+#
+class rsyslog::params {
+
+  $max_message_size           = '2k'
+  $purge_rsyslog_d            = false
+  $extra_modules              = []
+  $run_user                   = 'root'
+  $log_user                   = 'root'
+  $preserve_fqdn              = false
+
+  case $::osfamily {
+    debian: {
+      $rsyslog_package_name   = 'rsyslog'
+      $relp_package_name      = 'rsyslog-relp'
+      $mysql_package_name     = 'rsyslog-mysql'
+      $pgsql_package_name     = 'rsyslog-pgsql'
+      $gnutls_package_name    = 'rsyslog-gnutls'
+      $package_status         = 'latest'
+      $rsyslog_d              = '/etc/rsyslog.d/'
+      $rsyslog_conf           = '/etc/rsyslog.conf'
+      $rsyslog_default        = '/etc/default/rsyslog'
+      $default_config_file    = 'rsyslog_default'
+      $run_group              = 'root'
+      $log_group              = 'adm'
+      $log_style              = 'debian'
+      $umask                  = false
+      $perm_file              = '0640'
+      $perm_dir               = '0755'
+      $spool_dir              = '/var/spool/rsyslog'
+      $service_name           = 'rsyslog'
+      $client_conf            = 'client'
+      $server_conf            = 'server'
+      $ssl                    = false
+      $modules                = [
+        '$ModLoad imuxsock # provides support for local system logging',
+        '$ModLoad imklog   # provides kernel logging support (previously done by rklogd)',
+        '#$ModLoad immark  # provides --MARK-- message capability',
+      ]
+      $service_hasrestart     = true
+      $service_hasstatus      = true
+
+    }
+    redhat: {
+      if $::operatingsystem == 'Amazon' {
+        $rsyslog_package_name   = 'rsyslog'
+        $mysql_package_name     = 'rsyslog-mysql'
+        $pgsql_package_name     = 'rsyslog-pgsql'
+        $gnutls_package_name    = 'rsyslog-gnutls'
+        $relp_package_name      = false
+        $default_config_file    = 'rsyslog_default'
+        $modules                = [
+          '$ModLoad imuxsock # provides support for local system logging',
+          '$ModLoad imklog   # provides kernel logging support (previously done by rklogd)',
+          '#$ModLoad immark  # provides --MARK-- message capability',
+        ]
+      }
+      elsif $::operatingsystemmajrelease == 6 {
+        $rsyslog_package_name   = 'rsyslog'
+        $mysql_package_name     = 'rsyslog-mysql'
+        $pgsql_package_name     = 'rsyslog-pgsql'
+        $gnutls_package_name    = 'rsyslog-gnutls'
+        $relp_package_name      = 'rsyslog-relp'
+        $default_config_file    = 'rsyslog_default'
+        $modules                = [
+          '$ModLoad imuxsock # provides support for local system logging',
+          '$ModLoad imklog   # provides kernel logging support (previously done by rklogd)',
+          '#$ModLoad immark  # provides --MARK-- message capability',
+        ]
+      }
+      elsif $::operatingsystemmajrelease >= 7 {
+        $rsyslog_package_name   = 'rsyslog'
+        $mysql_package_name     = 'rsyslog-mysql'
+        $pgsql_package_name     = 'rsyslog-pgsql'
+        $gnutls_package_name    = 'rsyslog-gnutls'
+        $relp_package_name      = 'rsyslog-relp'
+        $default_config_file    = 'rsyslog_default_rhel7'
+        $modules                = [
+          '$ModLoad imuxsock # provides support for local system logging',
+          '$ModLoad imjournal # provides access to the systemd journal',
+          '#$ModLoad imklog   # provides kernel logging support (previously done by rklogd)',
+          '#$ModLoad immark  # provides --MARK-- message capability',
+        ]
+      } else {
+        $rsyslog_package_name   = 'rsyslog5'
+        $mysql_package_name     = 'rsyslog5-mysql'
+        $pgsql_package_name     = 'rsyslog5-pgsql'
+        $gnutls_package_name    = 'rsyslog5-gnutls'
+        $relp_package_name      = 'librelp'
+        $default_config_file    = 'rsyslog_default'
+        $modules                = [
+          '$ModLoad imuxsock # provides support for local system logging',
+          '$ModLoad imklog   # provides kernel logging support (previously done by rklogd)',
+          '#$ModLoad immark  # provides --MARK-- message capability',
+        ]
+      }
+      $package_status         = 'latest'
+      $rsyslog_d              = '/etc/rsyslog.d/'
+      $rsyslog_conf           = '/etc/rsyslog.conf'
+      $rsyslog_default        = '/etc/sysconfig/rsyslog'
+      $run_group              = 'root'
+      $log_group              = 'root'
+      $log_style              = 'redhat'
+      $umask                  = '0000'
+      $perm_file              = '0600'
+      $perm_dir               = '0750'
+      $spool_dir              = '/var/lib/rsyslog'
+      $service_name           = 'rsyslog'
+      $client_conf            = 'client'
+      $server_conf            = 'server'
+      $ssl                    = false
+      $service_hasrestart     = true
+      $service_hasstatus      = true
+    }
+    suse: {
+      $rsyslog_package_name   = 'rsyslog'
+      $relp_package_name      = false
+      $mysql_package_name     = false
+      $pgsql_package_name     = false
+      $gnutls_package_name    = false
+      $package_status         = 'latest'
+      $rsyslog_d              = '/etc/rsyslog.d/'
+      $rsyslog_conf           = '/etc/rsyslog.conf'
+      $rsyslog_default        = '/etc/sysconfig/syslog'
+      $run_group              = 'root'
+      $log_group              = 'root'
+      $log_style              = 'debian'
+      $umask                  = false
+      $perm_file              = '0600'
+      $perm_dir               = '0750'
+      $spool_dir              = '/var/spool/rsyslog/'
+      $service_name           = 'syslog'
+      $client_conf            = 'client'
+      $server_conf            = 'server'
+      $modules                = [
+        '$ModLoad imuxsock # provides support for local system logging',
+        '$ModLoad imklog   # provides kernel logging support (previously done by rklogd)',
+        '#$ModLoad immark  # provides --MARK-- message capability',
+      ]
+  }
+    freebsd: {
+      $rsyslog_package_name   = 'sysutils/rsyslog5'
+      $relp_package_name      = 'sysutils/rsyslog5-relp'
+      $mysql_package_name     = 'sysutils/rsyslog5-mysql'
+      $pgsql_package_name     = 'sysutils/rsyslog5-pgsql'
+      $gnutls_package_name    = 'sysutils/rsyslog5-gnutls'
+      $package_status         = 'present'
+      $rsyslog_d              = '/etc/syslog.d/'
+      $rsyslog_conf           = '/etc/syslog.conf'
+      $rsyslog_default        = '/etc/defaults/syslogd'
+      $default_config_file    = 'rsyslog_default'
+      $run_group              = 'wheel'
+      $log_group              = 'wheel'
+      $log_style              = 'debian'
+      $umask                  = false
+      $perm_file              = '0640'
+      $perm_dir               = '0755'
+      $spool_dir              = '/var/spool/syslog'
+      $service_name           = 'syslogd'
+      $client_conf            = 'client'
+      $server_conf            = 'server'
+      $ssl                    = false
+      $modules                = [
+        '$ModLoad imuxsock # provides support for local system logging',
+        '$ModLoad imklog   # provides kernel logging support (previously done by rklogd)',
+        '#$ModLoad immark  # provides --MARK-- message capability',
+      ]
+      $service_hasrestart     = true
+      $service_hasstatus      = true
+    }
+
+    default: {
+      case $::operatingsystem {
+        gentoo: {
+          $rsyslog_package_name   = 'app-admin/rsyslog'
+          $relp_package_name      = false
+          $mysql_package_name     = 'rsyslog-mysql'
+          $pgsql_package_name     = 'rsyslog-pgsql'
+          $gnutls_package_name    = false
+          $package_status         = 'latest'
+          $rsyslog_d              = '/etc/rsyslog.d/'
+          $rsyslog_conf           = '/etc/rsyslog.conf'
+          $rsyslog_default        = '/etc/conf.d/rsyslog'
+          $default_config_file    = 'rsyslog_default_gentoo'
+          $run_group              = 'root'
+          $log_group              = 'adm'
+          $log_style              = 'debian'
+          $umask                  = false
+          $perm_file              = '0640'
+          $perm_dir               = '0755'
+          $spool_dir              = '/var/spool/rsyslog'
+          $service_name           = 'rsyslog'
+          $client_conf            = 'client'
+          $server_conf            = 'server'
+          $ssl                    = false
+          $modules                = [
+            '$ModLoad imuxsock # provides support for local system logging',
+            '$ModLoad imklog   # provides kernel logging support (previously done by rklogd)',
+            '#$ModLoad immark  # provides --MARK-- message capability',
+          ]
+          $service_hasrestart     = true
+          $service_hasstatus      = true
+
+        }
+        default: {
+          fail("The ${module_name} module is not supported on ${::osfamily}/${::operatingsystem}.")
+        }
+      }
+    }
+  }
+}
diff --git a/puppet/modules/rsyslog/manifests/server.pp b/puppet/modules/rsyslog/manifests/server.pp
new file mode 100644
index 00000000..13ee56de
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/server.pp
@@ -0,0 +1,70 @@
+# == Class: rsyslog::server
+#
+# This class configures rsyslog for a server role.
+#
+# === Parameters
+#
+# [*enable_tcp*]
+# [*enable_udp*]
+# [*enable_onefile*]
+# [*server_dir*]
+# [*custom_config*]
+# [*high_precision_timestamps*]
+# [*ssl_ca*]
+# [*ssl_cert*]
+# [*ssl_key*]
+#
+# === Variables
+#
+# === Examples
+#
+#  Defaults
+#
+#  class { 'rsyslog::server': }
+#
+#  Create seperate directory per host
+#
+#  class { 'rsyslog::server':
+#    custom_config => 'rsyslog/server-hostname.conf.erb'
+#  }
+#
+class rsyslog::server (
+  $enable_tcp                = true,
+  $enable_udp                = true,
+  $enable_onefile            = false,
+  $server_dir                = '/srv/log/',
+  $custom_config             = undef,
+  $port                      = '514',
+  $high_precision_timestamps = false,
+  $ssl_ca                    = undef,
+  $ssl_cert                  = undef,
+  $ssl_key                   = undef,
+  $rotate                    = undef
+) inherits rsyslog {
+
+  ### Logrotate policy
+  $logpath = $rotate ? {
+    'year'   => '/%$YEAR%/',
+    'YEAR'   => '/%$YEAR%/',
+    'month'  => '/%$YEAR%/%$MONTH%/',
+    'MONTH'  => '/%$YEAR%/%$MONTH%/',
+    'day'    => '/%$YEAR%/%$MONTH%/%$DAY%/',
+    'DAY'    => '/%$YEAR%/%$MONTH%/%$DAY%/',
+    default  => '/',
+  }
+
+  if $custom_config {
+    $real_content = template($custom_config)
+  } else {
+    $real_content = template("${module_name}/server-default.conf.erb")
+  }
+
+  rsyslog::snippet { $rsyslog::server_conf:
+    ensure  => present,
+    content => $real_content,
+  }
+
+  if $rsyslog::ssl and (!$enable_tcp or $ssl_ca == undef or $ssl_cert == undef or $ssl_key == undef) {
+    fail('You need to define all the ssl options and enable tcp in order to use SSL.')
+  }
+}
diff --git a/puppet/modules/rsyslog/manifests/service.pp b/puppet/modules/rsyslog/manifests/service.pp
new file mode 100644
index 00000000..4be19999
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/service.pp
@@ -0,0 +1,21 @@
+# == Class: rsyslog::service
+#
+# This class enforces running of the rsyslog service.
+#
+# === Parameters
+#
+# === Variables
+#
+# === Examples
+#
+#  class { 'rsyslog::service': }
+#
+class rsyslog::service {
+  service { $rsyslog::service_name:
+    ensure     => running,
+    enable     => true,
+    hasstatus  => $rsyslog::service_hasstatus,
+    hasrestart => $rsyslog::service_hasrestart,
+    require    => Class['rsyslog::config'],
+  }
+}
diff --git a/puppet/modules/rsyslog/manifests/snippet.pp b/puppet/modules/rsyslog/manifests/snippet.pp
new file mode 100644
index 00000000..f6383963
--- /dev/null
+++ b/puppet/modules/rsyslog/manifests/snippet.pp
@@ -0,0 +1,35 @@
+# == Define: rsyslog::snippet
+#
+# This class allows for you to create a rsyslog configuration file with
+# whatever content you pass in.
+#
+# === Parameters
+#
+# [*content*] - The actual content to place in the file.
+# [*ensure*]  - How to enforce the file (default: present)
+#
+# === Variables
+#
+# === Examples
+#
+#  rsyslog::snippet { 'my-rsyslog-config':
+#    content => '<Some rsyslog directive>',
+#  }
+#
+define rsyslog::snippet(
+  $content,
+  $ensure = 'present'
+) {
+
+  include rsyslog
+
+  file { "${rsyslog::rsyslog_d}${name}.conf":
+    ensure  => $ensure,
+    owner   => $rsyslog::run_user,
+    group   => $rsyslog::run_group,
+    content => "# This file is managed by Puppet, changes may be overwritten\n${content}\n",
+    require => Class['rsyslog::config'],
+    notify  => Class['rsyslog::service'],
+  }
+
+}
diff --git a/puppet/modules/rsyslog/metadata.json b/puppet/modules/rsyslog/metadata.json
new file mode 100644
index 00000000..c9338eef
--- /dev/null
+++ b/puppet/modules/rsyslog/metadata.json
@@ -0,0 +1,62 @@
+{
+  "name": "saz-rsyslog",
+  "version": "3.4.0",
+  "author": "saz",
+  "summary": "Manage rsyslog client and server",
+  "license": "Apache License, Version 2.0",
+  "source": "https://github.com/saz/puppet-rsyslog.git",
+  "project_page": "https://github.com/saz/puppet-rsyslog",
+  "issues_url": "https://github.com/saz/puppet-rsyslog/issues",
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "RedHat"
+    },
+    {
+      "operatingsystem": "Amazon"
+    },
+    {
+      "operatingsystem": "CentOS"
+    },
+    {
+      "operatingsystem": "SuSe"
+    },
+    {
+      "operatingsystem": "SLES"
+    },
+    {
+      "operatingsystem": "OracleLinux"
+    },
+    {
+      "operatingsystem": "Scientific"
+    },
+    {
+      "operatingsystem": "Debian"
+    },
+    {
+      "operatingsystem": "Ubuntu"
+    },
+    {
+      "operatingsystem": "FreeBSD"
+    },
+    {
+      "operatingsystem": "Gentoo"
+    }
+  ],
+  "requirements": [
+    {
+      "name": "pe",
+      "version_requirement": ">= 3.2.0 < 3.4.0"
+    },
+    {
+      "name": "puppet",
+      "version_requirement": "3.x"
+    }
+  ],
+  "description": "Manage rsyslog client and server via Puppet",
+  "types": [
+  
+  ],
+  "dependencies": [
+  
+  ]
+}
diff --git a/puppet/modules/rsyslog/spec/classes/rsyslog_client_spec.rb b/puppet/modules/rsyslog/spec/classes/rsyslog_client_spec.rb
new file mode 100644
index 00000000..82865db9
--- /dev/null
+++ b/puppet/modules/rsyslog/spec/classes/rsyslog_client_spec.rb
@@ -0,0 +1,146 @@
+require 'spec_helper'
+
+describe 'rsyslog::client', :type => :class do
+
+  context "Rsyslog version >= 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '8.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-client-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/client.conf')
+        end
+      end
+    end
+
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-client-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/client.conf')
+        end
+      end
+    end
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-client-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/client.conf')
+        end
+      end
+    end
+  end
+
+  context "Rsyslog version =< 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '7.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-client-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/client.conf')
+        end
+      end
+    end
+
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-client-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/client.conf')
+        end
+      end
+    end
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      context "default usage (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-client-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/client.conf')
+        end
+      end
+    end
+  end
+
+  context "Rsyslog version = nil" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => nil
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-client-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/client.conf')
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/rsyslog/spec/classes/rsyslog_database_spec.rb b/puppet/modules/rsyslog/spec/classes/rsyslog_database_spec.rb
new file mode 100644
index 00000000..0421135a
--- /dev/null
+++ b/puppet/modules/rsyslog/spec/classes/rsyslog_database_spec.rb
@@ -0,0 +1,308 @@
+require 'spec_helper'
+
+describe 'rsyslog::database', :type => :class do
+
+  context "Rsyslog version >= 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '8.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      context "default usage mysql (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-database-mysql' }
+
+        let (:params) {
+          {
+            'backend'  => 'mysql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('rsyslog-mysql')
+          should contain_file('/etc/rsyslog.d/mysql.conf')
+        end
+      end
+
+      context "default usage pgsql (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-database-pgsql' }
+
+        let (:params) {
+          {
+            'backend'  => 'pgsql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('rsyslog-pgsql')
+          should contain_file('/etc/rsyslog.d/pgsql.conf')
+        end
+      end
+    end
+
+
+
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+
+      context "default usage mysql (osfamily = Debian)" do
+        let(:title) { 'rsyslog-database-mysql' }
+
+        let (:params) {
+          {
+            'backend'  => 'mysql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('rsyslog-mysql')
+          should contain_file('/etc/rsyslog.d/mysql.conf')
+        end
+      end
+
+      context "default usage pgsql (osfamily = Debian)" do
+        let(:title) { 'rsyslog-database-pgsql' }
+
+        let (:params) {
+          {
+            'backend'  => 'pgsql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('rsyslog-pgsql')
+          should contain_file('/etc/rsyslog.d/pgsql.conf')
+        end
+      end
+    end
+
+
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      context "default usage mysql (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-database-mysql' }
+
+        let (:params) {
+          {
+            'backend'  => 'mysql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('sysutils/rsyslog5-mysql')
+          should contain_file('/etc/syslog.d/mysql.conf')
+        end
+      end
+
+      context "default usage pgsql (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-database-pgsql' }
+
+        let (:params) {
+          {
+            'backend'  => 'pgsql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('sysutils/rsyslog5-pgsql')
+          should contain_file('/etc/syslog.d/pgsql.conf')
+        end
+      end
+    end
+  end
+
+  context "Rsyslog version =< 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '7.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      context "default usage mysql (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-database-mysql' }
+
+        let (:params) {
+          {
+            'backend'  => 'mysql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('rsyslog-mysql')
+          should contain_file('/etc/rsyslog.d/mysql.conf')
+        end
+      end
+
+      context "default usage pgsql (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-database-pgsql' }
+
+        let (:params) {
+          {
+            'backend'  => 'pgsql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('rsyslog-pgsql')
+          should contain_file('/etc/rsyslog.d/pgsql.conf')
+        end
+      end
+    end
+
+
+
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+
+      context "default usage mysql (osfamily = Debian)" do
+        let(:title) { 'rsyslog-database-mysql' }
+
+        let (:params) {
+          {
+            'backend'  => 'mysql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('rsyslog-mysql')
+          should contain_file('/etc/rsyslog.d/mysql.conf')
+        end
+      end
+
+      context "default usage pgsql (osfamily = Debian)" do
+        let(:title) { 'rsyslog-database-pgsql' }
+
+        let (:params) {
+          {
+            'backend'  => 'pgsql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('rsyslog-pgsql')
+          should contain_file('/etc/rsyslog.d/pgsql.conf')
+        end
+      end
+    end
+
+
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      context "default usage mysql (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-database-mysql' }
+
+        let (:params) {
+          {
+            'backend'  => 'mysql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('sysutils/rsyslog5-mysql')
+          should contain_file('/etc/syslog.d/mysql.conf')
+        end
+      end
+
+      context "default usage pgsql (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-database-pgsql' }
+
+        let (:params) {
+          {
+            'backend'  => 'pgsql',
+            'server'   => 'localhost',
+            'database' => 'rsyslog',
+            'username' => 'us3rname',
+            'password' => 'passw0rd',
+          }
+        }
+
+        it 'should compile' do
+          should contain_package('sysutils/rsyslog5-pgsql')
+          should contain_file('/etc/syslog.d/pgsql.conf')
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/rsyslog/spec/classes/rsyslog_server_spec.rb b/puppet/modules/rsyslog/spec/classes/rsyslog_server_spec.rb
new file mode 100644
index 00000000..8f57656b
--- /dev/null
+++ b/puppet/modules/rsyslog/spec/classes/rsyslog_server_spec.rb
@@ -0,0 +1,182 @@
+require 'spec_helper'
+
+describe 'rsyslog::server', :type => :class do
+
+  context "Rsyslog version >= 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '8.1.2'
+      }
+    end
+
+    ['RedHat', 'Debian'].each do |osfamily|
+      context "osfamily = #{osfamily}" do
+        let :facts do
+          default_facts.merge!({
+            :osfamily               => osfamily,
+            :operatingsystem        => osfamily,
+            :operatingsystemmajrelease => 6,
+          })
+        end
+
+        context "default usage (osfamily = #{osfamily})" do
+          let(:title) { 'rsyslog-server-basic' }
+        
+          it 'should compile' do
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/auth.log/)
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/messages/)
+          end
+        end
+
+        context "enable_onefile (osfamily = #{osfamily})" do
+          let(:title) { 'rsyslog-server-onefile' }
+          let(:params) { {'enable_onefile' => 'true'} }
+    
+          it 'should compile' do
+            should_not contain_file('/etc/rsyslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/auth.log/)
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/messages/)
+          end
+        end
+
+        context "hostname_template (osfamily = #{osfamily})" do
+          let(:title) { 'rsyslog-server-onefile' }
+          let(:params) { {'custom_config' => 'rsyslog/server-hostname.conf.erb'} }
+    
+          it 'should compile' do
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/%hostname%\/auth.log/)
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/%hostname%\/messages/)
+          end
+        end
+
+      end
+    end
+
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      context "default usage (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-server-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/auth.log/)
+          should contain_file('/etc/syslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/messages/)
+        end
+      end
+
+      context "enable_onefile (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-server-onefile' }
+        let(:params) { {'enable_onefile' => 'true'} }
+ 
+        it 'should compile' do
+          should_not contain_file('/etc/syslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/auth.log/)
+          should contain_file('/etc/syslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/messages/)
+        end
+      end
+
+      context "hostname_template (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-server-onefile' }
+        let(:params) { {'custom_config' => 'rsyslog/server-hostname.conf.erb'} }
+ 
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/server.conf').with_content(/%hostname%\/auth.log/)
+          should contain_file('/etc/syslog.d/server.conf').with_content(/%hostname%\/messages/)
+        end
+      end
+
+    end
+  end
+
+  context "Rsyslog version =< 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '7.1.2'
+      }
+    end
+
+    ['RedHat', 'Debian'].each do |osfamily|
+      context "osfamily = #{osfamily}" do
+        let :facts do
+          default_facts.merge!({
+            :osfamily               => osfamily,
+            :operatingsystem        => osfamily,
+            :operatingsystemmajrelease => 6,
+          })
+        end
+
+        context "default usage (osfamily = #{osfamily})" do
+          let(:title) { 'rsyslog-server-basic' }
+        
+          it 'should compile' do
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/auth.log/)
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/messages/)
+          end
+        end
+
+        context "enable_onefile (osfamily = #{osfamily})" do
+          let(:title) { 'rsyslog-server-onefile' }
+          let(:params) { {'enable_onefile' => 'true'} }
+    
+          it 'should compile' do
+            should_not contain_file('/etc/rsyslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/auth.log/)
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/messages/)
+          end
+        end
+
+        context "hostname_template (osfamily = #{osfamily})" do
+          let(:title) { 'rsyslog-server-onefile' }
+          let(:params) { {'custom_config' => 'rsyslog/server-hostname.conf.erb'} }
+    
+          it 'should compile' do
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/%hostname%\/auth.log/)
+            should contain_file('/etc/rsyslog.d/server.conf').with_content(/%hostname%\/messages/)
+          end
+        end
+
+      end
+    end
+
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      context "default usage (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-server-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/auth.log/)
+          should contain_file('/etc/syslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/messages/)
+        end
+      end
+
+      context "enable_onefile (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-server-onefile' }
+        let(:params) { {'enable_onefile' => 'true'} }
+ 
+        it 'should compile' do
+          should_not contain_file('/etc/syslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/auth.log/)
+          should contain_file('/etc/syslog.d/server.conf').with_content(/\(\[A-Za-z-\]\*\)--end%\/messages/)
+        end
+      end
+
+      context "hostname_template (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-server-onefile' }
+        let(:params) { {'custom_config' => 'rsyslog/server-hostname.conf.erb'} }
+ 
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/server.conf').with_content(/%hostname%\/auth.log/)
+          should contain_file('/etc/syslog.d/server.conf').with_content(/%hostname%\/messages/)
+        end
+      end
+
+    end
+  end
+end # describe 'rsyslog::server'
diff --git a/puppet/modules/rsyslog/spec/classes/rsyslog_spec.rb b/puppet/modules/rsyslog/spec/classes/rsyslog_spec.rb
new file mode 100644
index 00000000..344d7174
--- /dev/null
+++ b/puppet/modules/rsyslog/spec/classes/rsyslog_spec.rb
@@ -0,0 +1,469 @@
+require 'spec_helper'
+
+describe 'rsyslog', :type => :class do
+
+  context "Rsyslog version >= 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '8.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+  
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_class('rsyslog::install')
+          should contain_class('rsyslog::config')
+          should contain_class('rsyslog::service')
+        end
+      end
+    end
+  
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_class('rsyslog::install')
+          should contain_class('rsyslog::config')
+          should contain_class('rsyslog::service')
+        end
+      end
+    end
+  
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+  
+      context "default usage (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_class('rsyslog::install')
+          should contain_class('rsyslog::config')
+          should contain_class('rsyslog::service')
+        end
+      end
+    end
+  
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+  
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.conf')
+          should contain_file('/etc/rsyslog.d/')
+        end
+      end
+    end
+  
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.conf')
+          should contain_file('/etc/rsyslog.d/')
+        end
+      end
+    end
+  
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_file('/etc/syslog.conf')
+          should contain_file('/etc/syslog.d/')
+        end
+      end
+    end
+  
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+  
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-install-basic' }
+  
+        it 'should compile' do
+          should contain_package('rsyslog')
+          should contain_package('rsyslog-relp')
+        end
+      end
+    end
+  
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-install-basic' }
+  
+        it 'should compile' do
+          should contain_package('rsyslog')
+          should contain_package('rsyslog-relp')
+        end
+      end
+    end
+  
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-install-basic' }
+  
+        it 'should compile' do
+          should contain_package('sysutils/rsyslog5')
+          should contain_package('sysutils/rsyslog5-relp')
+        end
+      end
+    end
+  
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+  
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-service-basic' }
+  
+        it 'should compile' do
+          should contain_service('rsyslog')
+        end
+      end
+    end
+  
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-service-basic' }
+  
+        it 'should compile' do
+          should contain_service('rsyslog')
+        end
+      end
+    end
+  
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-service-basic' }
+  
+        it 'should compile' do
+          should contain_service('syslogd')
+        end
+      end
+    end
+  end
+
+  context "Rsyslog version =< 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '7.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+  
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_class('rsyslog::install')
+          should contain_class('rsyslog::config')
+          should contain_class('rsyslog::service')
+        end
+      end
+    end
+  
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_class('rsyslog::install')
+          should contain_class('rsyslog::config')
+          should contain_class('rsyslog::service')
+        end
+      end
+    end
+  
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+  
+      context "default usage (osfamily = FreeBSD)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_class('rsyslog::install')
+          should contain_class('rsyslog::config')
+          should contain_class('rsyslog::service')
+        end
+      end
+    end
+  
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+  
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.conf')
+          should contain_file('/etc/rsyslog.d/')
+        end
+      end
+    end
+  
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.conf')
+          should contain_file('/etc/rsyslog.d/')
+        end
+      end
+    end
+  
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-basic' }
+  
+        it 'should compile' do
+          should contain_file('/etc/syslog.conf')
+          should contain_file('/etc/syslog.d/')
+        end
+      end
+    end
+  
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+  
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-install-basic' }
+  
+        it 'should compile' do
+          should contain_package('rsyslog')
+          should contain_package('rsyslog-relp')
+        end
+      end
+    end
+  
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-install-basic' }
+  
+        it 'should compile' do
+          should contain_package('rsyslog')
+          should contain_package('rsyslog-relp')
+        end
+      end
+    end
+  
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-install-basic' }
+  
+        it 'should compile' do
+          should contain_package('sysutils/rsyslog5')
+          should contain_package('sysutils/rsyslog5-relp')
+        end
+      end
+    end
+  
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+  
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-service-basic' }
+  
+        it 'should compile' do
+          should contain_service('rsyslog')
+        end
+      end
+    end
+  
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-service-basic' }
+  
+        it 'should compile' do
+          should contain_service('rsyslog')
+        end
+      end
+    end
+  
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+  
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-service-basic' }
+  
+        it 'should compile' do
+          should contain_service('syslogd')
+        end
+      end
+    end
+  end
+
+  context "Rsyslog version >= 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => nil
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      context "default usage (osfamily = RedHat)" do
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.conf')
+          should contain_file('/etc/rsyslog.d/')
+        end
+      end
+    end
+  end
+end
diff --git a/puppet/modules/rsyslog/spec/defines/rsyslog_imfile_spec.rb b/puppet/modules/rsyslog/spec/defines/rsyslog_imfile_spec.rb
new file mode 100644
index 00000000..1c505eb7
--- /dev/null
+++ b/puppet/modules/rsyslog/spec/defines/rsyslog_imfile_spec.rb
@@ -0,0 +1,169 @@
+require 'spec_helper'
+
+describe 'rsyslog::imfile', :type => :define do
+
+  context "Rsyslog version >= 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '8.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      let (:params) {
+        {
+          'file_name'     => 'mylogfile',
+          'file_tag'      => 'mytag',
+          'file_facility' => 'myfacility',
+        }
+      }
+
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-imfile-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/rsyslog-imfile-basic.conf')
+        end
+      end
+    end
+
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+
+      let (:params) {
+        {
+          'file_name'     => 'mylogfile',
+          'file_tag'      => 'mytag',
+          'file_facility' => 'myfacility',
+        }
+      }
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-imfile-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/rsyslog-imfile-basic.conf')
+        end
+      end
+    end
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      let (:params) {
+        {
+          'file_name'     => 'mylogfile',
+          'file_tag'      => 'mytag',
+          'file_facility' => 'myfacility',
+        }
+      }
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-imfile-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/rsyslog-imfile-basic.conf')
+        end
+      end
+    end
+  end
+
+  context "Rsyslog version =< 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '7.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'RedHat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      let (:params) {
+        {
+          'file_name'     => 'mylogfile',
+          'file_tag'      => 'mytag',
+          'file_facility' => 'myfacility',
+        }
+      }
+
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-imfile-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/rsyslog-imfile-basic.conf')
+        end
+      end
+    end
+
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+
+      let (:params) {
+        {
+          'file_name'     => 'mylogfile',
+          'file_tag'      => 'mytag',
+          'file_facility' => 'myfacility',
+        }
+      }
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-imfile-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/rsyslog-imfile-basic.conf')
+        end
+      end
+    end
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      let (:params) {
+        {
+          'file_name'     => 'mylogfile',
+          'file_tag'      => 'mytag',
+          'file_facility' => 'myfacility',
+        }
+      }
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-imfile-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/rsyslog-imfile-basic.conf')
+        end
+      end
+    end
+  end
+
+end
diff --git a/puppet/modules/rsyslog/spec/defines/rsyslog_snippet_spec.rb b/puppet/modules/rsyslog/spec/defines/rsyslog_snippet_spec.rb
new file mode 100644
index 00000000..6cc68839
--- /dev/null
+++ b/puppet/modules/rsyslog/spec/defines/rsyslog_snippet_spec.rb
@@ -0,0 +1,157 @@
+require 'spec_helper'
+
+describe 'rsyslog::snippet', :type => :define do
+
+  context "Rsyslog version >= 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '8.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'Redhat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      let (:params) {
+        {
+          'content' => 'Random Content',
+        }
+      }
+
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-snippet-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/rsyslog-snippet-basic.conf').with_content("# This file is managed by Puppet, changes may be overwritten\nRandom Content\n")
+        end
+      end
+    end
+
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+
+      let (:params) {
+        {
+          'content' => 'Random Content',
+        }
+      }
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-snippet-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/rsyslog-snippet-basic.conf').with_content("# This file is managed by Puppet, changes may be overwritten\nRandom Content\n")
+        end
+      end
+    end
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      let (:params) {
+        {
+          'content' => 'Random Content',
+        }
+      }
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-snippet-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/rsyslog-snippet-basic.conf').with_content("# This file is managed by Puppet, changes may be overwritten\nRandom Content\n")
+        end
+      end
+    end
+  end
+
+  context "Rsyslog version =< 8" do
+    let(:default_facts) do
+      {
+        :rsyslog_version => '7.1.2'
+      }
+    end
+
+    context "osfamily = RedHat" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily               => 'RedHat',
+          :operatingsystem        => 'Redhat',
+          :operatingsystemmajrelease => 6,
+        })
+      end
+
+      let (:params) {
+        {
+          'content' => 'Random Content',
+        }
+      }
+
+      context "default usage (osfamily = RedHat)" do
+        let(:title) { 'rsyslog-snippet-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/rsyslog-snippet-basic.conf').with_content("# This file is managed by Puppet, changes may be overwritten\nRandom Content\n")
+        end
+      end
+    end
+
+    context "osfamily = Debian" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'Debian',
+        })
+      end
+
+      let (:params) {
+        {
+          'content' => 'Random Content',
+        }
+      }
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-snippet-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/rsyslog.d/rsyslog-snippet-basic.conf').with_content("# This file is managed by Puppet, changes may be overwritten\nRandom Content\n")
+        end
+      end
+    end
+
+    context "osfamily = FreeBSD" do
+      let :facts do
+        default_facts.merge!({
+          :osfamily        => 'freebsd',
+        })
+      end
+
+      let (:params) {
+        {
+          'content' => 'Random Content',
+        }
+      }
+
+      context "default usage (osfamily = Debian)" do
+        let(:title) { 'rsyslog-snippet-basic' }
+
+        it 'should compile' do
+          should contain_file('/etc/syslog.d/rsyslog-snippet-basic.conf').with_content("# This file is managed by Puppet, changes may be overwritten\nRandom Content\n")
+        end
+      end
+    end
+  end
+
+end
diff --git a/puppet/modules/rsyslog/spec/spec.opts b/puppet/modules/rsyslog/spec/spec.opts
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/rsyslog/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/rsyslog/spec/spec_helper.rb b/puppet/modules/rsyslog/spec/spec_helper.rb
new file mode 100644
index 00000000..12bb0b7f
--- /dev/null
+++ b/puppet/modules/rsyslog/spec/spec_helper.rb
@@ -0,0 +1,28 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
+
+RSpec.configure do |c|
+  c.mock_with :rspec do |mock|
+    mock.syntax = [:expect, :should]
+  end
+  c.include PuppetlabsSpec::Files
+
+  c.before :each do
+    # Ensure that we don't accidentally cache facts and environment
+    # between test cases.
+    Facter::Util::Loader.any_instance.stubs(:load_all)
+    Facter.clear
+    Facter.clear_messages
+
+    # Store any environment variables away to be restored later
+    @old_env = {}
+    ENV.each_key {|k| @old_env[k] = ENV[k]}
+
+    if Gem::Version.new(`puppet --version`) >= Gem::Version.new('3.5')
+      Puppet.settings[:strict_variables]=true
+    end
+  end
+
+  c.after :each do
+    PuppetlabsSpec::Files.cleanup
+  end
+end
diff --git a/puppet/modules/rsyslog/templates/client.conf.erb b/puppet/modules/rsyslog/templates/client.conf.erb
new file mode 100644
index 00000000..c05ae797
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/client.conf.erb
@@ -0,0 +1,180 @@
+
+# An "In-Memory Queue" is created for remote logging.
+$WorkDirectory <%= scope.lookupvar('rsyslog::spool_dir') -%>    # where to place spool files
+$ActionQueueFileName queue      # unique name prefix for spool files
+$ActionQueueMaxDiskSpace <%= scope.lookupvar('rsyslog::client::spool_size') -%>     # spool space limit (use as much as possible)
+$ActionQueueSaveOnShutdown on   # save messages to disk on shutdown
+$ActionQueueType LinkedList     # run asynchronously
+$ActionResumeRetryCount -1      # infinety retries if host is down
+<% if scope.lookupvar('rsyslog::client::log_templates') and ! scope.lookupvar('rsyslog::client::log_templates').empty?-%>
+
+# Define custom logging templates
+<% scope.lookupvar('rsyslog::client::log_templates').flatten.compact.each do |log_template| -%>
+$template <%= log_template['name'] %>,"<%= log_template['template'] %>"
+<% end -%>
+<% end -%>
+<% if scope.lookupvar('rsyslog::client::actionfiletemplate') -%>
+
+# Using specified format for default logging format:
+$ActionFileDefaultTemplate <%= scope.lookupvar('rsyslog::client::actionfiletemplate') %>
+<% else -%>
+
+#Using default format for default logging format:
+$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
+<% end -%>
+<% if scope.lookupvar('rsyslog::client::ssl') -%>
+
+# Setup SSL connection.
+# CA/Cert
+$DefaultNetStreamDriverCAFile <%= scope.lookupvar('rsyslog::client::ssl_ca') %>
+
+# Connection settings.
+$DefaultNetstreamDriver gtls
+$ActionSendStreamDriverMode 1
+$ActionSendStreamDriverAuthMode anon
+<% end -%>
+<% if scope.lookupvar('rsyslog::client::remote_servers')  -%>
+
+<% scope.lookupvar('rsyslog::client::remote_servers').flatten.compact.each do |server| -%>
+<% if server['pattern'] and server['pattern'] != ''-%>
+<% pattern = server['pattern'] -%>
+<% else -%>
+<% pattern = '*.*' -%>
+<% end -%>
+<% if server['protocol'] == 'TCP' or server['protocol'] == 'tcp'-%>
+<% protocol = '@@' -%>
+<% protocol_type = 'TCP' -%>
+<% else -%>
+<% protocol = '@' -%>
+<% protocol_type = 'UDP' -%>
+<% end -%>
+<% if server['host'] and server['host'] != ''-%>
+<% host = server['host'] -%>
+<% else -%>
+<% host = 'localhost' -%>
+<% end -%>
+<% if server['port'] and server['port'] != ''-%>
+<% port = server['port'] -%>
+<% else -%>
+<% port = '514' -%>
+<% end -%>
+<% if server['format'] -%>
+<% format = ";#{server['format']}" -%>
+<% format_type = server['format'] -%>
+<% else -%>
+<% format = '' -%>
+<% format_type = 'the default' -%>
+<% end -%>
+# Sending logs that match <%= pattern %> to <%= host %> via <%= protocol_type %> on <%= port %> using <%=format_type %> format.
+<%= pattern %> <%= protocol %><%= host %>:<%= port %><%= format %>
+<% end -%>
+<% elsif scope.lookupvar('rsyslog::client::log_remote') -%>
+
+# Log to remote syslog server using <%= scope.lookupvar('rsyslog::client::remote_type') %>
+<% if scope.lookupvar('rsyslog::client::remote_type') == 'tcp' -%>
+*.* @@<%= scope.lookupvar('rsyslog::client::server') -%>:<%= scope.lookupvar('rsyslog::client::port') -%>;<%= scope.lookupvar('remote_forward_format') -%>
+<% else -%>
+*.* @<%= scope.lookupvar('rsyslog::client::server') -%>:<%= scope.lookupvar('rsyslog::client::port') -%>;<%= scope.lookupvar('remote_forward_format') -%>
+<% end -%>
+<% end -%>
+<% if scope.lookupvar('rsyslog::client::log_auth_local') or scope.lookupvar('rsyslog::client::log_local') -%>
+
+# Logging locally.
+
+<% if scope.lookupvar('rsyslog::log_style') == 'debian' -%>
+# Log auth messages locally
+auth,authpriv.*                 /var/log/auth.log
+<% elsif scope.lookupvar('rsyslog::log_style') == 'redhat' -%>
+# Log auth messages locally
+auth,authpriv.*                 /var/log/secure
+<% end -%>
+<% end -%>
+<% if scope.lookupvar('rsyslog::client::log_local') -%>
+<% if scope.lookupvar('rsyslog::log_style') == 'debian' -%>
+# First some standard log files.  Log by facility.
+#
+*.*;auth,authpriv.none         -/var/log/syslog
+cron.*                          /var/log/cron.log
+daemon.*                       -/var/log/daemon.log
+kern.*                         -/var/log/kern.log
+#lpr.*                          -/var/log/lpr.log
+mail.*                         -/var/log/mail.log
+user.*                         -/var/log/user.log
+
+#
+# Logging for the mail system.  Split it up so that
+# it is easy to write scripts to parse these files.
+#
+mail.info                      -/var/log/mail.info
+mail.warn                      -/var/log/mail.warn
+mail.err                        /var/log/mail.err
+
+#
+# Logging for INN news system.
+#
+news.crit                       /var/log/news/news.crit
+news.err                        /var/log/news/news.err
+news.notice                     -/var/log/news/news.notice
+
+#
+# Some "catch-all" log files.
+#
+*.=debug;\
+       auth,authpriv.none;\
+       news.none;mail.none     -/var/log/debug
+*.=info;*.=notice;*.=warn;\
+       auth,authpriv.none;\
+       cron,daemon.none;\
+       mail,news.none          -/var/log/messages
+
+#
+# I like to have messages displayed on the console, but only on a virtual
+# console I usually leave idle.
+#
+#daemon,mail.*;\
+#       news.=crit;news.=err;news.=notice;\
+#       *.=debug;*.=info;\
+#       *.=notice;*.=warn       /dev/tty8
+
+# The named pipe /dev/xconsole is for the `xconsole' utility.  To use it,
+# you must invoke `xconsole' with the `-file' option:
+#
+#    $ xconsole -file /dev/xconsole [...]
+#
+# NOTE: adjust the list below, or you'll go crazy if you have a reasonably
+#      busy site..
+#
+daemon.*;mail.*;\
+        news.err;\
+        *.=debug;*.=info;\
+        *.=notice;*.=warn       |/dev/xconsole
+<% elsif scope.lookupvar('rsyslog::log_style') == 'redhat' -%>
+# Log all kernel messages to the console.
+# Logging much else clutters up the screen.
+#kern.*                                                 /dev/console
+
+# Log anything (except mail) of level info or higher.
+# Don't log private authentication messages!
+*.info;mail.none;authpriv.none;cron.none                /var/log/messages
+
+# Log all the mail messages in one place.
+mail.*                         -/var/log/maillog
+
+
+# Log cron stuff
+cron.*                         /var/log/cron
+
+# Everybody gets emergency messages
+<% if @rsyslog_version and @rsyslog_version.split('.')[0].to_i >= 8 -%>
+*.emerg       :omusrmsg:*
+<% else -%>
+*.emerg				*
+<% end -%>
+
+# Save news errors of level crit and higher in a special file.
+uucp,news.crit                 -/var/log/spooler
+
+# Save boot messages also to boot.log
+local7.*                       -/var/log/boot.log
+<% end -%>
+<% end -%>
diff --git a/puppet/modules/rsyslog/templates/database.conf.erb b/puppet/modules/rsyslog/templates/database.conf.erb
new file mode 100644
index 00000000..3934d6cf
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/database.conf.erb
@@ -0,0 +1,6 @@
+# File is managed by Puppet
+
+## Configuration file for rsyslog-<%= @backend %>
+
+$ModLoad <%= @db_module %>
+*.* :<%= @db_module -%>:<%= @server -%>,<%= @database -%>,<%= @username -%>,<%= @password %>
diff --git a/puppet/modules/rsyslog/templates/imfile.erb b/puppet/modules/rsyslog/templates/imfile.erb
new file mode 100644
index 00000000..4a11c728
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/imfile.erb
@@ -0,0 +1,15 @@
+<% if @extra_modules.empty?() or !@extra_modules.include?('imfile') -%>
+$ModLoad imfile
+<% end -%>
+
+
+$InputFileName <%= @file_name %>
+$InputFileTag <%= @file_tag %>
+$InputFileStateFile state-<%= @name %>
+$InputFileSeverity <%= @file_severity %>
+$InputFileFacility <%= @file_facility %>
+$InputFilePollInterval <%= @polling_interval %>
+$InputFilePersistStateInterval <%= @persist_state_interval %>
+<% if @run_file_monitor == true -%>
+$InputRunFileMonitor
+<% end -%>
diff --git a/puppet/modules/rsyslog/templates/modload.erb b/puppet/modules/rsyslog/templates/modload.erb
new file mode 100644
index 00000000..a14a612a
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/modload.erb
@@ -0,0 +1,3 @@
+<% @extra_modules.each do |mod| -%>
+$ModLoad <%= mod %>
+<% end -%>
diff --git a/puppet/modules/rsyslog/templates/rsyslog.conf.erb b/puppet/modules/rsyslog/templates/rsyslog.conf.erb
new file mode 100644
index 00000000..406aa49c
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/rsyslog.conf.erb
@@ -0,0 +1,49 @@
+# file is managed by puppet
+
+#################
+#### MODULES ####
+#################
+
+<% scope.lookupvar('rsyslog::modules').each do |module_row| -%>
+<%= module_row %>
+<% end -%>
+
+###########################
+#### GLOBAL DIRECTIVES ####
+###########################
+#
+# Set max message size for sending and receiving
+#
+$MaxMessageSize <%= scope.lookupvar('rsyslog::max_message_size') %>
+
+#
+# Set the default permissions for all log files.
+#
+<% if scope.lookupvar('rsyslog::preserve_fqdn') -%>
+$PreserveFQDN on
+<% end -%>
+$FileOwner <%= scope.lookupvar('rsyslog::log_user') %>
+$FileGroup <%= scope.lookupvar('rsyslog::log_group') %>
+$FileCreateMode <%= scope.lookupvar('rsyslog::perm_file') %>
+$DirOwner <%= scope.lookupvar('rsyslog::log_user') %>
+$DirGroup <%= scope.lookupvar('rsyslog::log_group') %>
+$DirCreateMode <%= scope.lookupvar('rsyslog::perm_dir') %>
+$PrivDropToUser <%= scope.lookupvar('rsyslog::run_user') %>
+$PrivDropToGroup <%= scope.lookupvar('rsyslog::run_group') %>
+<% if scope.lookupvar('rsyslog::umask') -%>
+$Umask <%= scope.lookupvar('rsyslog::umask') %>
+<% end -%>
+
+#
+# Include all config files in <%= scope.lookupvar('rsyslog::rsyslog_d') %>
+#
+$IncludeConfig <%= scope.lookupvar('rsyslog::rsyslog_d') -%>*.conf
+
+#
+# Emergencies are sent to everybody logged in.
+#
+<% if @rsyslog_version and @rsyslog_version.split('.')[0].to_i >= 8 -%>
+*.emerg       :omusrmsg:*
+<% else -%>
+*.emerg				*
+<% end -%>
diff --git a/puppet/modules/rsyslog/templates/rsyslog_default.erb b/puppet/modules/rsyslog/templates/rsyslog_default.erb
new file mode 100644
index 00000000..a49eb59e
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/rsyslog_default.erb
@@ -0,0 +1,9 @@
+# File is managed by puppet
+
+<% if @rsyslog_version and @rsyslog_version.split('.')[0].to_i < 7 -%>
+# Debian, Ubuntu
+RSYSLOGD_OPTIONS="-c4"
+<% end -%>
+
+# CentOS, RedHat, Fedora
+SYSLOGD_OPTIONS="${RSYSLOGD_OPTIONS}"
diff --git a/puppet/modules/rsyslog/templates/rsyslog_default_gentoo.erb b/puppet/modules/rsyslog/templates/rsyslog_default_gentoo.erb
new file mode 100644
index 00000000..f5de7b58
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/rsyslog_default_gentoo.erb
@@ -0,0 +1,16 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/app-admin/rsyslog/files/7-stable/rsyslog.confd,v 1.1 2012/11/20 13:03:36 ultrabug Exp $
+
+# Configuration file
+CONFIGFILE="/etc/rsyslog.conf"
+
+# PID file
+PIDFILE="/var/run/rsyslogd.pid"
+
+# Options to rsyslogd
+# See rsyslogd(8) for more details
+# Notes:
+# * Do not specify another PIDFILE but use the variable above to change the location
+# * Do not specify another CONFIGFILE but use the variable above to change the location
+RSYSLOG_OPTS=""
diff --git a/puppet/modules/rsyslog/templates/rsyslog_default_rhel7.erb b/puppet/modules/rsyslog/templates/rsyslog_default_rhel7.erb
new file mode 100644
index 00000000..c3b95c7f
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/rsyslog_default_rhel7.erb
@@ -0,0 +1,2 @@
+# File is managed by puppet
+SYSLOGD_OPTIONS=""
diff --git a/puppet/modules/rsyslog/templates/server-default.conf.erb b/puppet/modules/rsyslog/templates/server-default.conf.erb
new file mode 100644
index 00000000..0c7f67fe
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/server-default.conf.erb
@@ -0,0 +1,42 @@
+# File is managed by puppet
+
+<% # Common header across all templates -%>
+<%= scope.function_template(['rsyslog/server/_default-header.conf.erb']) %>
+
+# Log files are stored in directories matching the short hostname, excluding numbers
+# i.e. web01 web02 and web03 will all log to a the web directory
+<% if scope.lookupvar('rsyslog::server::enable_onefile') == false -%>
+
+# Templates
+$Template dynAuthLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>auth.log"
+$Template dynSyslog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>syslog"
+$Template dynCronLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>cron.log"
+$Template dynDaemonLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>daemon.log"
+$Template dynKernLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>kern.log"
+$Template dynUserLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>user.log"
+$Template dynMailLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>mail.log"
+$Template dynDebug,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>debug"
+$Template dynMessages,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>messages"
+
+# Rules
+auth,authpriv.*         ?dynAuthLog
+*.*;auth,authpriv.none,mail.none,cron.none      -?dynSyslog
+cron.*              ?dynCronLog
+daemon.*            -?dynDaemonLog
+kern.*              -?dynKernLog
+mail.*              -?dynMailLog
+user.*              -?dynUserLog
+*.=info;*.=notice;*.=warn;\
+    auth.none,authpriv.none;\
+    cron.none,daemon.none;\
+    mail.none,news.none     -?dynMessages
+<% else -%>
+# Template
+$Template dynAllMessages,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%source:R,ERE,1,DFLT:([A-Za-z-]*)--end%<%= scope.lookupvar('rsyslog::server::logpath') -%>messages"
+
+# Rules
+*.*                 -?dynAllMessages
+<% end -%>
+
+<% # Common footer across all templates -%>
+<%= scope.function_template(['rsyslog/server/_default-footer.conf.erb']) %>
diff --git a/puppet/modules/rsyslog/templates/server-hostname.conf.erb b/puppet/modules/rsyslog/templates/server-hostname.conf.erb
new file mode 100644
index 00000000..67158d95
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/server-hostname.conf.erb
@@ -0,0 +1,41 @@
+# File is managed by puppet
+
+<% # Common header across all templates -%>
+<%= scope.function_template(['rsyslog/server/_default-header.conf.erb']) %>
+
+# Log files are stored in directories matching the hostname
+<% if scope.lookupvar('rsyslog::server::enable_onefile') == false -%>
+
+# Templates
+$Template dynAuthLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>auth.log"
+$Template dynSyslog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>syslog"
+$Template dynCronLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>cron.log"
+$Template dynDaemonLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>daemon.log"
+$Template dynKernLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>kern.log"
+$Template dynUserLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>user.log"
+$Template dynMailLog,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>mail.log"
+$Template dynDebug,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>debug"
+$Template dynMessages,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>messages"
+
+# Rules
+auth,authpriv.*         ?dynAuthLog
+*.*;auth,authpriv.none,mail.none,cron.none      -?dynSyslog
+cron.*              ?dynCronLog
+daemon.*            -?dynDaemonLog
+kern.*              -?dynKernLog
+mail.*              -?dynMailLog
+user.*              -?dynUserLog
+*.=info;*.=notice;*.=warn;\
+    auth.none,authpriv.none;\
+    cron.none,daemon.none;\
+    mail.none,news.none     -?dynMessages
+<% else -%>
+# Template
+$Template dynAllMessages,"<%= scope.lookupvar('rsyslog::server::server_dir') -%>%hostname%<%= scope.lookupvar('rsyslog::server::logpath') -%>messages"
+
+# Rules
+*.*                 -?dynAllMessages
+<% end -%>
+
+<% # Common footer across all templates -%>
+<%= scope.function_template(['rsyslog/server/_default-footer.conf.erb']) %>
diff --git a/puppet/modules/rsyslog/templates/server/_default-footer.conf.erb b/puppet/modules/rsyslog/templates/server/_default-footer.conf.erb
new file mode 100644
index 00000000..d8bd00ad
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/server/_default-footer.conf.erb
@@ -0,0 +1,13 @@
+
+# Switch back to default ruleset
+$RuleSet RSYSLOG_DefaultRuleset
+
+<% if scope.lookupvar('rsyslog::server::enable_udp') -%>
+$InputUDPServerBindRuleset remote
+$UDPServerRun <%= scope.lookupvar('rsyslog::server::port') %>
+<% end -%>
+
+<% if scope.lookupvar('rsyslog::server::enable_tcp') -%>
+$InputTCPServerBindRuleset remote
+$InputTCPServerRun <%= scope.lookupvar('rsyslog::server::port') %>
+<% end -%>
diff --git a/puppet/modules/rsyslog/templates/server/_default-header.conf.erb b/puppet/modules/rsyslog/templates/server/_default-header.conf.erb
new file mode 100644
index 00000000..4bffa858
--- /dev/null
+++ b/puppet/modules/rsyslog/templates/server/_default-header.conf.erb
@@ -0,0 +1,36 @@
+<% if scope.lookupvar('rsyslog::server::enable_udp') -%>
+# Load UDP module
+$ModLoad imudp
+<% end -%>
+
+<% if scope.lookupvar('rsyslog::server::enable_tcp') -%>
+# Load TCP module
+$ModLoad imtcp
+<% end -%>
+
+#
+<% if scope.lookupvar('rsyslog::server::high_precision_timestamps') == false -%>
+# Use traditional timestamp format.
+#
+$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
+<% else -%>
+# Use high precision timestamp format.
+#
+$ActionFileDefaultTemplate RSYSLOG_FileFormat
+<% end -%>
+
+<% if scope.lookupvar('rsyslog::server::ssl') -%>
+# Server side SSL.
+$DefaultNetstreamDriver gtls
+
+# Cert files.
+$DefaultNetstreamDriverCAFile <%= scope.lookupvar('rsyslog::server::ssl_ca') %>
+$DefaultNetstreamDriverCertFile <%= scope.lookupvar('rsyslog::server::ssl_cert') %>
+$DefaultNetstreamDriverKeyFile <%= scope.lookupvar('rsyslog::server::ssl_key') %>
+
+$InputTCPServerStreamDriverMode 1
+$InputTCPServerStreamDriverAuthMode anon
+<% end -%>
+
+# Switch to remote ruleset
+$RuleSet remote
diff --git a/puppet/modules/rsyslog/tests/database.pp b/puppet/modules/rsyslog/tests/database.pp
new file mode 100644
index 00000000..269be696
--- /dev/null
+++ b/puppet/modules/rsyslog/tests/database.pp
@@ -0,0 +1,9 @@
+include rsyslog
+
+class { 'rsyslog::database':
+  backend  => 'mysql',
+  server   => 'localhost',
+  database => 'Syslog',
+  username => 'rsyslog',
+  password => 'secret',
+}
diff --git a/puppet/modules/rsyslog/tests/init.pp b/puppet/modules/rsyslog/tests/init.pp
new file mode 100644
index 00000000..7fc50c8b
--- /dev/null
+++ b/puppet/modules/rsyslog/tests/init.pp
@@ -0,0 +1 @@
+include rsyslog
diff --git a/puppet/modules/rsyslog/tests/log_templates.pp b/puppet/modules/rsyslog/tests/log_templates.pp
new file mode 100644
index 00000000..a6bf75b7
--- /dev/null
+++ b/puppet/modules/rsyslog/tests/log_templates.pp
@@ -0,0 +1,9 @@
+class { 'rsyslog::client':
+  log_templates => [
+    {
+      name      => 'RFC3164fmt',
+      template  => '<%PRI%>%TIMESTAMP% %HOSTNAME% %syslogtag%%msg%',
+    },
+  ],
+  actionfiletemplate => 'RFC3164fmt',
+}
diff --git a/puppet/modules/rsyslog/tests/multiple_hosts.pp b/puppet/modules/rsyslog/tests/multiple_hosts.pp
new file mode 100644
index 00000000..9e5a60ed
--- /dev/null
+++ b/puppet/modules/rsyslog/tests/multiple_hosts.pp
@@ -0,0 +1,17 @@
+class { 'rsyslog::client':
+  remote_servers => [
+    {
+      host       => 'logs.example.org',
+    },
+    {
+      port       => '55514',
+    },
+    {
+      host       => 'logs.somewhere.com',
+      port       => '555',
+      pattern    => '*.log',
+      protocol   => 'tcp',
+      format     => 'RFC3164fmt',
+    },
+  ]
+}
-- 
cgit v1.2.3


From 6a895ece94a86c9ccc32c9bec51413d4e4f0df8e Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:29 -0400
Subject: git subrepo clone https://leap.se/git/puppet_backupninja
 puppet/modules/backupninja

subrepo:
  subdir:   "puppet/modules/backupninja"
  merged:   "5268a87"
upstream:
  origin:   "https://leap.se/git/puppet_backupninja"
  branch:   "master"
  commit:   "5268a87"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I147608fbb12a35fe83642d4d031009dcc62cecee
---
 puppet/modules/backupninja/.gitrepo                |  11 +
 puppet/modules/backupninja/LICENSE                 | 674 +++++++++++++++++++++
 puppet/modules/backupninja/README                  | 202 ++++++
 puppet/modules/backupninja/files/checkbackups.pl   | 194 ++++++
 .../files/nagios_plugins/duplicity/README.md       |  24 +
 .../duplicity/backupninja_duplicity_freshness.sh   | 268 ++++++++
 .../duplicity/check_backupninja_duplicity.py       | 123 ++++
 puppet/modules/backupninja/manifests/cron.pp       |  17 +
 puppet/modules/backupninja/manifests/duplicity.pp  | 147 +++++
 .../backupninja/manifests/generate_sshkey.pp       |  33 +
 puppet/modules/backupninja/manifests/init.pp       |  52 ++
 puppet/modules/backupninja/manifests/key.pp        |  41 ++
 puppet/modules/backupninja/manifests/labelmount.pp |  62 ++
 puppet/modules/backupninja/manifests/maildir.pp    |  43 ++
 puppet/modules/backupninja/manifests/mysql.pp      |  38 ++
 .../manifests/nagios_plugin/duplicity.pp           |  45 ++
 puppet/modules/backupninja/manifests/pgsql.pp      |  27 +
 puppet/modules/backupninja/manifests/rdiff.pp      | 109 ++++
 puppet/modules/backupninja/manifests/rsync.pp      | 128 ++++
 puppet/modules/backupninja/manifests/server.pp     | 147 +++++
 puppet/modules/backupninja/manifests/sh.pp         |  25 +
 puppet/modules/backupninja/manifests/svn.pp        |  28 +
 puppet/modules/backupninja/manifests/sys.pp        |  45 ++
 .../backupninja/templates/backupninja.conf.erb     |  25 +
 .../backupninja/templates/backupninja.cron.erb     |   6 +
 puppet/modules/backupninja/templates/dup.conf.erb  |  46 ++
 .../backupninja/templates/labelmount.conf.erb      |   2 +
 .../backupninja/templates/labelmount.handler       |  17 +
 .../modules/backupninja/templates/maildir.conf.erb |  14 +
 .../modules/backupninja/templates/mysql.conf.erb   |  25 +
 .../modules/backupninja/templates/pgsql.conf.erb   |  13 +
 .../modules/backupninja/templates/rdiff.conf.erb   |  38 ++
 .../modules/backupninja/templates/rsync.conf.erb   |  49 ++
 puppet/modules/backupninja/templates/sh.conf.erb   |  10 +
 puppet/modules/backupninja/templates/svn.conf.erb  |  10 +
 puppet/modules/backupninja/templates/sys.conf.erb  |  18 +
 .../modules/backupninja/templates/umount.conf.erb  |   1 +
 .../modules/backupninja/templates/umount.handler   |  15 +
 38 files changed, 2772 insertions(+)
 create mode 100644 puppet/modules/backupninja/.gitrepo
 create mode 100644 puppet/modules/backupninja/LICENSE
 create mode 100644 puppet/modules/backupninja/README
 create mode 100755 puppet/modules/backupninja/files/checkbackups.pl
 create mode 100644 puppet/modules/backupninja/files/nagios_plugins/duplicity/README.md
 create mode 100644 puppet/modules/backupninja/files/nagios_plugins/duplicity/backupninja_duplicity_freshness.sh
 create mode 100644 puppet/modules/backupninja/files/nagios_plugins/duplicity/check_backupninja_duplicity.py
 create mode 100644 puppet/modules/backupninja/manifests/cron.pp
 create mode 100644 puppet/modules/backupninja/manifests/duplicity.pp
 create mode 100644 puppet/modules/backupninja/manifests/generate_sshkey.pp
 create mode 100644 puppet/modules/backupninja/manifests/init.pp
 create mode 100644 puppet/modules/backupninja/manifests/key.pp
 create mode 100644 puppet/modules/backupninja/manifests/labelmount.pp
 create mode 100644 puppet/modules/backupninja/manifests/maildir.pp
 create mode 100644 puppet/modules/backupninja/manifests/mysql.pp
 create mode 100644 puppet/modules/backupninja/manifests/nagios_plugin/duplicity.pp
 create mode 100644 puppet/modules/backupninja/manifests/pgsql.pp
 create mode 100644 puppet/modules/backupninja/manifests/rdiff.pp
 create mode 100644 puppet/modules/backupninja/manifests/rsync.pp
 create mode 100644 puppet/modules/backupninja/manifests/server.pp
 create mode 100644 puppet/modules/backupninja/manifests/sh.pp
 create mode 100644 puppet/modules/backupninja/manifests/svn.pp
 create mode 100644 puppet/modules/backupninja/manifests/sys.pp
 create mode 100644 puppet/modules/backupninja/templates/backupninja.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/backupninja.cron.erb
 create mode 100644 puppet/modules/backupninja/templates/dup.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/labelmount.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/labelmount.handler
 create mode 100644 puppet/modules/backupninja/templates/maildir.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/mysql.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/pgsql.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/rdiff.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/rsync.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/sh.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/svn.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/sys.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/umount.conf.erb
 create mode 100644 puppet/modules/backupninja/templates/umount.handler

(limited to 'puppet/modules')

diff --git a/puppet/modules/backupninja/.gitrepo b/puppet/modules/backupninja/.gitrepo
new file mode 100644
index 00000000..ea7862f0
--- /dev/null
+++ b/puppet/modules/backupninja/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_backupninja
+	branch = master
+	commit = 5268a87c329f895017f8ea6c6abc377a4f9a6a77
+	parent = 1e1e25286b64790141c9627f81b50f579b13b719
+	cmdver = 0.3.0
diff --git a/puppet/modules/backupninja/LICENSE b/puppet/modules/backupninja/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/backupninja/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/backupninja/README b/puppet/modules/backupninja/README
new file mode 100644
index 00000000..42a8bfe2
--- /dev/null
+++ b/puppet/modules/backupninja/README
@@ -0,0 +1,202 @@
+Backupninja Module
+-------------------
+
+This module helps you configure all of your backups with puppet, using
+backupninja!
+
+!! UPGRADE NOTICE !!
+
+If you were previously using this module, some pieces have changed,
+and you need to carefully change your use of them, or you will find
+your backups could stop working or get duplicated.
+
+The backupninja::client class has been renamed to backupninja, and is
+now *required* in all node manifests. Make sure the backupninja class
+is now declared in all your node manifests! This new class now defines
+defaults which were previously provided by backupninja::client::defaults,
+and can now be overridden thanks to the brand new technology of class
+parameters. This class also manages the backupninja configuration file,
+replacing the backupninja::config ressource.
+
+The backupninja::server class now takes parameters, replacing several
+global variables such as $backupdir, $backupserver_tag and
+$nagios_server. The $manage_nagios parameter also replaces the
+$use_nagios global.
+
+As for handlers, they don't include the backupninja::client anymore and
+now read several default values from the backupninja base class. The
+$installkey parameter used in several handlers has been renamed to
+$keymanage, to keep in line with the base class parameter.
+
+If you were using the rdiff-backup handler, you need to read the
+following section carefully.
+
+Changes to the rdiff-backup handler
+-----------------------------------
+
+You will need to make sure you change all of your "$directory"
+parameters to be "$home" instead, and on your backupserver you will need
+to move all of your backups into "$home"/rdiff-backup. Previously, they
+were put in "$directory", which doubled as the home for the user that
+was created. This caused problems with rdiff-backup because of dot files
+and other things which were not part of any rdiff-backup.
+
+The rdiff resource name is now used as the subdirectory where rdiff
+backups are sent. This was previously hardcoded to "rdiff-backup", but
+in order to support multiple rdiff backups per host, we now use the
+resource name. So if you were using the following resource:
+
+    backupninja::rdiff { 'main': }
+
+You will want to use the following resource:
+
+    backupninja::rdiff { 'rdiff-backup': }
+    file { '/etc/backup.d/90_main.rdiff': ensure => absent; }
+
+Otherwise your backups may be duplicated!
+
+Changes to nagios integration
+-----------------------------
+
+The default nagios passive service name has changed from "backups" to
+"backups-${name}". If you want it to be automatically created on your
+nagios host, you will need to set $backupninja::manage_nagios to true.
+on the client.
+
+Use the following resource to remove the old "backups" passive service.
+
+    nagios::service { 'backups': ensure => absent }
+
+Getting started
+---------------
+
+This module requires Puppet versions 2.7 and up.
+
+An up-to-date version of the puppet-stdlib module is also required.
+
+Configure your backup server
+----------------------------
+
+Now you will need to configure a backup server by adding the following
+to your node definition for that server:
+
+  include backupninja::server
+
+The default configuration will store backup data in the "/backup"
+directory. To change this you may declare the class with a "backupdir"
+parameter:
+
+  class { 'backupninja::server':
+    backupdir => '/mnt/backupdata'
+  }
+
+By configuring a backupninja::server, this module will automatically
+create sandboxed users on the server for each client for their
+backups.
+
+Configure your backup clients
+-----------------------------
+
+First, you need to include the backupninja class or declare it with
+custom parameters:
+
+  class { 'backupninja':
+	loglvl => 3,
+	usecolors => false,
+	reportsuccess => false,
+	reportwarning => true,
+    ensure_backupninja_version => '1.0.1-1',
+    ensure_rdiffbackup_version => '1.2.8-7'
+  }
+
+In this case, the module will make sure that the backupninja package
+is installed (using puppet's ensure parameter language) and create the
+/etc/backupninja.conf configuration file.
+
+If you need to specify a specific version of either backupninja itself,
+or the specific programs that the handler class installs, you can
+specify the version you need installed by providing a class parameter,
+as shown in the example.
+
+Configuring handlers
+--------------------
+
+Depending on which backup method you want to use on your client, you
+can simply specify some configuration options for that handler that are
+necessary for your client.
+
+Each handler has its own configuration options necessary to make it
+work, each of those are available as puppet parameters. You can see
+the handler documentation, or look at the handler puppet files
+included in this module to see your different options.
+
+Included below are some configuration examples for different handlers.
+
+* An example mysql handler configuration:
+
+backupninja::mysql { 'all_databases':
+	user => root,
+	backupdir => '/var/backups',
+	compress => true,
+	sqldump => true
+}
+
+* An example rdiff-backup handler configuration:
+
+backupninja::rdiff { 'backup_all':
+	directory => '/media/backupdisk',
+	include => ['/var/backups', '/home', '/var/lib/dpkg/status'],
+	exclude => '/home/*/.gnupg'
+}
+
+* A remote rdiff-backup handler:
+
+backupninja::rdiff { 'main':
+    host => 'backup.example.com',
+    type => 'remote',
+    directory => "/backup/${::fqdn}",
+    user => "backup-${::hostname}",
+}
+
+Automatic creation of ssh-keys for duplicity
+--------------------------------------------
+
+backupninja::duplicity can be used to
+
+- create an ssh keypair for a client
+- place the keypair on the puppetmaster in a given location
+- place the keypair in /root/.ssh on the client
+
+i.e.:
+
+  backupninja::duplicity { "duplicity_${::fqdn}":
+    sshoptions        => "-oIdentityFile=/root/.ssh/backupninja_${::hostname}_id_rsa",
+    desthost          => 'HOST',
+    destdir           => "/var/backup/backupninja/${::fqdn}",
+    destuser          => "backupninja_${::hostname}",
+    encryptkey        => 'KEYID',
+    password          => 'PW',
+    backupkeystore    => 'puppet:///keys',
+    backupkeystorefspath => '/etc/puppet/modules/keys/files',
+    backupkeydestname => "backupninja_${::hostname}_id_rsa",
+    createkey         => true,
+    installkey        => true,
+    ...
+  }
+
+
+Nagios alerts about backup freshness
+------------------------------------
+
+If you set the $backupninja::server::nagios_server variable to be the
+name of your nagios server, then a passive nagios service gets setup so
+that the backup server pushes checks, via a cronjob that calls
+/usr/local/bin/checkbackups.pl, to the nagios server to alert about
+relative backup freshness.
+
+To use this feature a few pre-requisites are necessary:
+
+ . configure nsca on your backup server (not done via puppet yet)
+ . configure nsca on your nagios server (not done via puppet yet)
+ . server backup directories are named after their $fqdn
+ . backups must be under $home/dup, $home/rdiff-backup depending on method
diff --git a/puppet/modules/backupninja/files/checkbackups.pl b/puppet/modules/backupninja/files/checkbackups.pl
new file mode 100755
index 00000000..39914469
--- /dev/null
+++ b/puppet/modules/backupninja/files/checkbackups.pl
@@ -0,0 +1,194 @@
+#!/usr/bin/perl -w
+
+# This script is designed to check a backup directory populated with
+# subdirectories named after hosts, within which there are backups of various
+# types.
+#
+# Example:
+# /home/backup:
+# foo.example.com
+# 
+# foo.example.com:
+# rdiff-backup .ssh
+#
+# rdiff-backup:
+# root home rdiff-backup-data usr var
+#
+# There are heuristics to determine the backup type. Currently, the following
+# types are supported:
+#
+# rdiff-backup: assumes there is a rdiff-backup/rdiff-backup-data/backup.log file
+# duplicity: assumes there is a dup subdirectory, checks the latest file
+# dump files: assumes there is a dump subdirectory, checks the latest file
+#
+# This script returns output suitable for send_nsca to send the results to
+# nagios and should therefore be used like this:
+#
+# checkbackups.sh | send_nsca -H nagios.example.com
+
+use Getopt::Std;
+
+# XXX: taken from utils.sh from nagios-plugins-basic
+my $STATE_OK=0;
+my $STATE_WARNING=1;
+my $STATE_CRITICAL=2;
+my $STATE_UNKNOWN=3;
+my $STATE_DEPENDENT=4;
+my %ERRORS=(0=>'OK',1=>'WARNING',2=>'CRITICAL',3=>'UNKNOWN',4=>'DEPENDENT');
+
+# gross hack: we look into subdirs to find vservers
+my @vserver_dirs = qw{/var/lib/vservers /vservers};
+
+our $opt_d = "/backup";
+our $opt_c = 48 * 60 * 60;
+our $opt_w = 24 * 60 * 60;
+our $opt_v = 0;
+our $opt_o;
+our $opt_s;
+
+if (!getopts('d:c:w:s:vo')) {
+	print <<EOF
+Usage: $0 [ -d <backupdir> ] [ -c <threshold> ] [ -w <threshold> ] [ -o ] [ -s <host> ] [ -v ]
+EOF
+	;
+	exit();
+}
+
+sub check_rdiff {
+    my ($host, $dir, $optv) = @_;
+    my $flag="$dir/rdiff-backup-data/backup.log";
+    my $extra_msg = '';
+    my @vservers;
+    if (open(FLAG, $flag)) {
+        while (<FLAG>) {
+            if (/EndTime ([0-9]*).[0-9]* \((.*)\)/) {
+                $last_bak = $1;
+                $extra_msg = ' [backup.log]';
+                $opt_v && print STDERR "found timestamp $1 ($2) in $flag\n";
+            }
+        }
+        if (!$last_bak) {
+            print_status($host, $STATE_UNKNOWN, "cannot parse $flag for a valid timestamp");
+            next;
+        }
+    } else {
+        $opt_v && print STDERR "cannot open $flag\n";
+    }
+    close(FLAG);
+    ($state, $delta) = check_age($last_bak);
+    $dir =~ /([^\/]+)\/?$/;
+    $service = "backups-$1";
+    print_status($host, $state, "$delta hours old$extra_msg", $service);
+    foreach my $vserver_dir (@vserver_dirs) {
+        $vsdir = "$dir/$vserver_dir";
+        if (opendir(DIR, $vsdir)) {
+            @vservers = grep { /^[^\.]/ && -d "$vsdir/$_" } readdir(DIR);
+            $opt_v && print STDERR "found vservers $vsdir: @vservers\n";
+            closedir DIR;
+        } else {
+            $opt_v && print STDERR "no vserver in $vsdir\n";
+        }
+    }
+    my @dom_sufx = split(/\./, $host);
+    my $dom_sufx = join('.', @dom_sufx[1,-1]);
+    foreach my $vserver (@vservers) {
+        print_status("$vserver.$dom_sufx", $state, "$delta hours old$extra_msg, same as parent: $host");
+    }
+}
+
+sub check_age {
+    my ($last_bak) = @_;
+    my $t = time();
+    my $delta = $t - $last_bak;
+    if ($delta > $opt_c) {
+        $state = $STATE_CRITICAL;
+    } elsif ($delta > $opt_w) {
+        $state = $STATE_WARNING;
+    } elsif ($delta >= 0) {
+        $state = $STATE_OK;
+    }
+    $delta = sprintf '%.2f', $delta/3600.0;
+    return ($state, $delta);
+}
+
+sub print_status {
+    my ($host, $state, $message, $service) = @_;
+    my $state_msg = $ERRORS{$state};
+    if (!$service) {
+        $service = 'backups';
+    }
+    $line = "$host\t$service\t$state\t$state_msg $message\n";
+    if ($opt_s) {
+	$opt_v && print STDERR "sending results to nagios...\n";
+        open(NSCA, "|/usr/sbin/send_nsca -H $opt_s") or die("cannot start send_nsca: $!\n");
+        print NSCA $line;
+        close(NSCA) or warn("could not close send_nsca pipe correctly: $!\n");
+    }
+    if (!$opt_s || $opt_v) {
+        printf $line;
+    }
+}
+
+sub check_flag {
+    my ($host, $flag) = @_;
+    my @stats = stat($flag);
+    if (not @stats) {
+        print_status($host, $STATE_UNKNOWN, "cannot stat flag $flag");
+    }
+    else {
+        ($state, $delta) = check_age($stats[9]);
+        print_status($host, $state, "$delta hours old");
+    }
+}
+
+my $backupdir= $opt_d;
+
+my @hosts;
+if (defined($opt_o)) {
+	@hosts=qx{hostname -f};
+} else {
+	# XXX: this should be a complete backup registry instead
+	@hosts=qx{ls $backupdir | grep -v lost+found};
+}
+
+chdir($backupdir);
+my ($delta, $state, $host);
+foreach $host (@hosts) {
+	chomp($host);
+	if ($opt_o) {
+		$dir = $backupdir;
+	} else {
+		$dir = $host;
+	}
+	my $flag;
+	if (-d $dir) {
+                # guess the backup type and find a proper stamp file to compare
+                @rdiffs = glob("$dir/*/rdiff-backup-data");
+                foreach $subdir (@rdiffs) {
+                    $subdir =~ s/rdiff-backup-data$//;
+                    $opt_v && print STDERR "inspecting dir $subdir\n";
+                    check_rdiff($host, $subdir, $opt_v);
+                    $flag = 1;
+                }
+		if (-d "$dir/dump") {
+			# XXX: this doesn't check backup consistency
+			$flag="$dir/dump/" . `ls -tr $dir/dump | tail -1`;
+			chomp($flag);
+			check_flag($host, $flag);
+		} elsif (-d "$dir/dup") {
+			# XXX: this doesn't check backup consistency
+			$flag="$dir/dup/" . `ls -tr $dir/dup | tail -1`;
+			chomp($flag);
+			check_flag($host, $flag);
+		} elsif (-r "$dir/rsync.log") {
+			# XXX: this doesn't check backup consistency
+			$flag="$dir/rsync.log";
+			check_flag($host, $flag);
+		}
+                if (!$flag) {
+                        print_status($host, $STATE_UNKNOWN, 'unknown system');
+		}
+	} else {
+            print_status($host, $STATE_UNKNOWN, 'no directory');
+	}
+}
diff --git a/puppet/modules/backupninja/files/nagios_plugins/duplicity/README.md b/puppet/modules/backupninja/files/nagios_plugins/duplicity/README.md
new file mode 100644
index 00000000..1cd349af
--- /dev/null
+++ b/puppet/modules/backupninja/files/nagios_plugins/duplicity/README.md
@@ -0,0 +1,24 @@
+duplicity-backup-status
+=======================
+
+Backupninja generates duplicity configfiles, this nagios plugin can check their freshness. Currently only the config files generated by backupninja can be parsed and we depend on that.
+
+## Prerequisites
+
+Make sure you have python-argparse installed (yes an extra dependency, getopt doubles the amount of code, so I gave up on that). The Python script will look for the duplicity_freshness.sh shell script in /usr/local/lib/nagios/plugins/ or /usr/lib/nagios/plugins/ make sure you copy it there and make executable. 
+
+## Getting started
+
+Run the python script from your nagios. Don't forget to specify some extras like when warnings or criticalities should be emerged.
+
+-  -w WARNINC   Number of hours allowed for incremential backup warning level default 28
+-  -W WARNFULL  Number of hours allowed for incremential backup critical level default 40
+-  -c CRITINC   Number of days allowed for full backup warning level default 52
+-  -C CRITFULL  Number of days allowed for full backup critical level default 60
+
+
+## TODO:
+
+- make it cuter, tidy up
+- make it more robust
+- support other config backends as backupninja - this can be done by writing more scripts like backupninja_duplicity_freshness.sh and parsing an extra parameter
diff --git a/puppet/modules/backupninja/files/nagios_plugins/duplicity/backupninja_duplicity_freshness.sh b/puppet/modules/backupninja/files/nagios_plugins/duplicity/backupninja_duplicity_freshness.sh
new file mode 100644
index 00000000..7af2bf7f
--- /dev/null
+++ b/puppet/modules/backupninja/files/nagios_plugins/duplicity/backupninja_duplicity_freshness.sh
@@ -0,0 +1,268 @@
+#!/bin/bash
+# -*- mode: sh; sh-basic-offset: 3; indent-tabs-mode: nil; -*-
+# vim: set filetype=sh sw=3 sts=3 expandtab autoindent:
+
+# Load backupninja library/helpers, because why reinventing the wheel? [Because my wheels weren't round]
+# some duplication is to be expected
+# this is only supposed to work with duplicity
+
+## Functions
+# simple lowercase function
+function tolower() {
+   echo "$1" | tr '[:upper:]' '[:lower:]'
+}
+
+# we grab the current time once, since processing
+# all the configs might take more than an hour.
+nowtime=`LC_ALL=C date +%H`
+nowday=`LC_ALL=C date +%d`
+nowdayofweek=`LC_ALL=C date +%A`
+nowdayofweek=`tolower "$nowdayofweek"`
+
+conffile="/etc/backupninja.conf"
+
+# find $libdirectory
+libdirectory=`grep '^libdirectory' $conffile | /usr/bin/awk '{print $3}'`
+if [ -z "$libdirectory" ]; then
+   if [ -d "/usr/lib/backupninja" ]; then
+      libdirectory="/usr/lib/backupninja"
+   else
+      echo "Could not find entry 'libdirectory' in $conffile."
+      fatal "Could not find entry 'libdirectory' in $conffile."
+   fi
+else
+   if [ ! -d "$libdirectory" ]; then
+      echo "Lib directory $libdirectory not found."
+      fatal "Lib directory $libdirectory not found."
+   fi
+fi
+
+. $libdirectory/tools
+
+setfile $conffile
+
+# get global config options (second param is the default)
+getconf configdirectory /etc/backup.d
+getconf scriptdirectory /usr/share/backupninja
+getconf reportdirectory
+getconf reportemail
+getconf reporthost
+getconf reportspace
+getconf reportsuccess yes
+getconf reportinfo no
+getconf reportuser
+getconf reportwarning yes
+getconf loglevel 3
+getconf when "Everyday at 01:00"
+defaultwhen=$when
+getconf logfile /var/log/backupninja.log
+getconf usecolors "yes"
+getconf SLAPCAT /usr/sbin/slapcat
+getconf LDAPSEARCH /usr/bin/ldapsearch
+getconf RDIFFBACKUP /usr/bin/rdiff-backup
+getconf CSTREAM /usr/bin/cstream
+getconf MYSQLADMIN /usr/bin/mysqladmin
+getconf MYSQL /usr/bin/mysql
+getconf MYSQLHOTCOPY /usr/bin/mysqlhotcopy
+getconf MYSQLDUMP /usr/bin/mysqldump
+getconf PGSQLDUMP /usr/bin/pg_dump
+getconf PGSQLDUMPALL /usr/bin/pg_dumpall
+getconf PGSQLUSER postgres
+getconf GZIP /bin/gzip
+getconf GZIP_OPTS --rsyncable
+getconf RSYNC /usr/bin/rsync
+getconf admingroup root
+
+if [ ! -d "$configdirectory" ]; then
+   echo "Configuration directory '$configdirectory' not found."
+   fatal "Configuration directory '$configdirectory' not found."
+fi
+
+# get the duplicity configuration
+function get_dupconf(){
+   setfile $1
+   getconf options
+   getconf testconnect yes
+   getconf nicelevel 0
+   getconf tmpdir
+   
+   setsection gpg
+   getconf password
+   getconf sign no
+   getconf encryptkey
+   getconf signkey
+   
+   setsection source
+   getconf include
+   getconf vsnames all
+   getconf vsinclude
+   getconf exclude
+   
+   setsection dest
+   getconf incremental yes
+   getconf increments 30
+   getconf keep 60
+   getconf keepincroffulls all
+   getconf desturl
+   getconf awsaccesskeyid
+   getconf awssecretaccesskey
+   getconf cfusername
+   getconf cfapikey
+   getconf cfauthurl
+   getconf ftp_password
+   getconf sshoptions
+   getconf bandwidthlimit 0
+   getconf desthost
+   getconf destdir
+   getconf destuser
+   destdir=${destdir%/}
+}
+
+### some voodoo to mangle the correct commands
+
+function mangle_cli(){
+
+   execstr_options="$options "
+   execstr_source=
+   if [ -n "$desturl" ]; then
+      [ -z "$destuser" ] || warning 'the configured destuser is ignored since desturl is set'
+      [ -z "$desthost" ] || warning 'the configured desthost is ignored since desturl is set'
+      [ -z "$destdir" ] || warning 'the configured destdir is ignored since desturl is set'
+      execstr_serverpart="$desturl"
+   else
+      execstr_serverpart="scp://$destuser@$desthost/$destdir"
+   fi
+   
+   
+   ### Symmetric or asymmetric (public/private key pair) encryption
+   if [ -n "$encryptkey" ]; then
+      execstr_options="${execstr_options} --encrypt-key $encryptkey"
+   fi
+   
+   ### Data signing (or not)
+   if [ "$sign" == yes ]; then
+      # duplicity is not able to sign data when using symmetric encryption
+      [ -n "$encryptkey" ] || fatal "The encryptkey option must be set when signing."
+      # if needed, initialize signkey to a value that is not empty (checked above)
+      [ -n "$signkey" ] || signkey="$encryptkey"
+      execstr_options="${execstr_options} --sign-key $signkey"
+   fi
+   
+   ### Temporary directory
+   precmd=
+   if [ -n "$tmpdir" ]; then
+      if [ ! -d "$tmpdir" ]; then
+         #info "Temporary directory ($tmpdir) does not exist, creating it."
+         mkdir -p "$tmpdir"
+         [ $? -eq 0 ] || fatal "Could not create temporary directory ($tmpdir)."
+         chmod 0700 "$tmpdir"
+      fi
+      #info "Using $tmpdir as TMPDIR"
+      precmd="${precmd}TMPDIR=$tmpdir "
+   fi
+   
+   ### Source
+   
+   set -o noglob
+   
+   # excludes
+   SAVEIFS=$IFS
+   IFS=$(echo -en "\n\b")
+   for i in $exclude; do
+      str="${i//__star__/*}"
+      execstr_source="${execstr_source} --exclude '$str'"
+   done
+   IFS=$SAVEIFS
+   
+   # includes
+   SAVEIFS=$IFS
+   IFS=$(echo -en "\n\b")
+   for i in $include; do
+      [ "$i" != "/" ] || fatal "Sorry, you cannot use 'include = /'"
+      str="${i//__star__/*}"
+      execstr_source="${execstr_source} --include '$str'"
+   done
+   IFS=$SAVEIFS
+   
+   set +o noglob
+   
+   execstr_options="${execstr_options} --ssh-options '$sshoptions'"
+   if [ "$bandwidthlimit" != 0 ]; then
+      [ -z "$desturl" ] || warning 'The bandwidthlimit option is not used when desturl is set.'
+      execstr_precmd="trickle -s -d $bandwidthlimit -u $bandwidthlimit"
+   fi
+}
+
+#function findlastdates(){
+#   outputfile=$1
+#   lastfull=0
+#   lastinc=0
+#   backuptime=0
+#   
+#   while read line; do
+#      atime=0
+#      arr=()
+#      sort=''
+#      test=$(echo $line|awk '{if (NF == 7); if ($1 == "Full" || $1 == "Incremental") {print $4, $3, $6, $5}}'  )
+#   
+#      if [ -n "$test"  ]; then
+#         backuptime=$(date -u -d "$test" +%s)
+#   
+#         arr=($(echo $line|awk '{print $1, $2, $3, $4, $5, $6}'))
+#         if [ ${arr[0]} == "Incremental" ] && [ "$lastinc" -lt "$backuptime" ] ; then
+#            lastinc=$backuptime
+#         elif [ ${arr[0]} == "Full" ] && [ "$lastfull" -lt "$backuptime" ] ; then
+#            lastfull=$backuptime
+#         fi
+#   
+#      fi
+#   
+#   done < $outputfile
+#      # a full backup can be seen as incremental too
+#      lastinc=$(echo $lastinc | awk 'max=="" || $1 > max {max=$1} END{ print max}')
+#}
+
+function check_status() {
+   grep -q 'No orphaned or incomplete backup sets found.' $1
+   if [ $? -ne 0 ] ; then
+     exit 2
+   fi
+}
+
+##
+## this function handles the freshness check of a backup action
+##
+
+function process_action() {
+   local file="$1"
+   local suffix="$2"
+   setfile $file
+   get_dupconf $1
+   mangle_cli
+   
+   outputfile=`maketemp backupout`
+   export PASSPHRASE=$password
+   export FTP_PASSWORD=$ftp_password
+   output=` su -c \
+            "$execstr_precmd duplicity $execstr_options collection-status $execstr_serverpart >$outputfile 2>&1"`
+   exit_code=$?
+   echo -n $outputfile
+
+   #check_status
+   #findlastdates
+}
+
+files=`find $configdirectory -follow -mindepth 1 -maxdepth 1 -type f ! -name '.*.swp' | sort -n`
+
+for file in $files; do
+   [ -f "$file" ] || continue
+   suffix="${file##*.}"
+   base=`basename $file`
+   if [ "${base:0:1}" == "0" -o "$suffix" == "disabled" ]; then
+      continue
+   fi
+   if [ -e "$scriptdirectory/$suffix" -a "$suffix" == "dup" ]; then
+      process_action $file $suffix
+   fi
+done
+
diff --git a/puppet/modules/backupninja/files/nagios_plugins/duplicity/check_backupninja_duplicity.py b/puppet/modules/backupninja/files/nagios_plugins/duplicity/check_backupninja_duplicity.py
new file mode 100644
index 00000000..8ed9ce68
--- /dev/null
+++ b/puppet/modules/backupninja/files/nagios_plugins/duplicity/check_backupninja_duplicity.py
@@ -0,0 +1,123 @@
+#!/usr/bin/env python
+
+# Inspired by Arne Schwabe <arne-nagios@rfc2549.org> [with BSD license]
+# Inspired by backupninja [that's gpl some version]
+# minor changes by someon who doesn't understand all the license quirks
+
+from subprocess import Popen,PIPE
+import sys
+import time
+import os
+import argparse
+import getopt
+
+def main():
+    # getopt = much more writing
+    parser = argparse.ArgumentParser(description='Nagios Duplicity status checker')
+
+    parser.add_argument("-w", dest="warninc", default=28, type=int, 
+                        help="Number of hours allowed for incremential backup warning level, default 28")
+    parser.add_argument("-W", dest="warnfull", default=31, type=int, 
+                        help="Number of days allowed for full backup warning level, default 31")
+    parser.add_argument("-c", dest="critinc", default=52, type=int, 
+                        help="Number of hours allowed for incremential backup critical level, default 52")
+    parser.add_argument("-C", dest="critfull", default=33, type=int, 
+                        help="Number of days allowed for full backup critical level, default 33")
+    args = parser.parse_args()
+    
+    okay = 0
+
+    # *sigh* check_output is from python 2.7 and onwards. Debian, upgrade yourself.
+    #output , err = check_output(['/root/freshness.sh'])
+
+    if os.path.isfile("/usr/lib/nagios/plugins/backupninja_duplicity_freshness.sh") and os.access("/usr/lib/nagios/plugins/backupninja_duplicity_freshness.sh", os.X_OK):
+      checkstatus, err = Popen(['/bin/bash', '/usr/lib/nagios/plugins/backupninja_duplicity_freshness.sh'], stdout=PIPE, stderr=PIPE, env={'HOME': '/root', 'PATH': os.environ['PATH']}).communicate()
+    elif os.path.isfile("/usr/local/lib/nagios/plugins/backupninja_duplicity_freshness.sh") and os.access("/usr/local/lib/nagios/plugins/backupninja_duplicity_freshness.sh", os.X_OK):
+      checkstatus, err = Popen(['/bin/bash', '/usr/local/lib/nagios/plugins/backupninja_duplicity_freshness.sh'], stdout=PIPE, stderr=PIPE, env={'HOME': '/root', 'PATH': os.environ['PATH']}).communicate()
+
+    # Don't use exec(), popen(), etc. to execute external commands without explicity using the full path of the external program.  Hijacked search path could be problematic.
+    #checkstatus, err = Popen(['/bin/bash', './freshness.sh'], stdout=PIPE, stderr=PIPE, env={'HOME': '/root', 'PATH': os.environ['PATH']}).communicate()
+
+    #another sigh: Debian testing, upgrade yourself, this is only needed because Debian testing uses duplicity 0.6.18-3 
+    # open file read/write
+    f = open (checkstatus,"r")
+    checklines = f.readlines()
+    f.close()
+
+    # remove the line that says Import of duplicity.backends.giobackend Failed: No module named gio
+    f = open(checkstatus,"w")
+    for line in checklines:
+      if not 'Import of duplicity.backends.giobackend Failed: No module named gio' in line:
+        f.write(line)
+    f.close()
+
+    output = open(checkstatus).read()
+
+    lastfull, lastinc = findlastdates(output)
+
+    sincelastfull = time.time() - lastfull 
+    sincelastinc  =  time.time() - lastinc 
+
+    msg = "OK: "
+    
+    if sincelastfull > (args.warnfull * 24 * 3600) or sincelastinc > (args.warninc * 3600):
+        okay = 1
+        msg = "WARNING: "
+    if sincelastfull > (args.critfull * 24 * 3600) or sincelastinc > (args.critinc * 3600):
+        okay = 2
+        msg = "CRITICAL: "
+    if not checkoutput(output):
+        okay = max(okay,1)
+        msg = "WARNING: duplicity output: %s " % repr(output)
+    if err:
+        okay=2
+        msg = "Unexpected output: %s, " % repr(err)
+
+    print msg, "last full %s ago, last incremential %s ago|lastfull=%d, lastinc=%d" % ( formattime(sincelastfull), formattime(sincelastinc), sincelastfull, sincelastinc)
+    
+    #clean up cruft
+    os.remove(checkstatus)
+    sys.exit(okay)
+
+def checkoutput(output):
+    if not 'No orphaned or incomplete backup sets found.' in output:
+        return False
+    
+    return True
+
+def formattime(seconds):
+    days = seconds / (3600 * 24)
+    hours = seconds / 3600 % 24
+
+    if days:
+        return "%d days %d hours" % (days,hours)
+    else:
+        return "%d hours" % hours
+
+
+def findlastdates(output):
+    lastfull = 0
+    lastinc = 0
+
+    for line in output.split("\n"):
+        parts = line.split()
+
+        # ['Incremental', 'Sun', 'Oct', '31', '03:00:04', '2010', '1']
+        if len (parts) == 7 and parts[0] in ["Full","Incremental"]:
+            foo = time.strptime(" ".join(parts[1:6]),"%a %b %d %H:%M:%S %Y")
+    
+            backuptime =  time.mktime(foo)
+    
+            if parts[0] == "Incremental" and lastinc < backuptime:
+                lastinc = backuptime
+            elif parts[0] == "Full" and lastfull < backuptime:
+                lastfull = backuptime
+        
+
+    # Count a full backup as incremental backup
+    lastinc = max(lastfull,lastinc)
+    return (lastfull, lastinc)
+	
+
+if __name__=='__main__':
+   main()
diff --git a/puppet/modules/backupninja/manifests/cron.pp b/puppet/modules/backupninja/manifests/cron.pp
new file mode 100644
index 00000000..bd4e857c
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/cron.pp
@@ -0,0 +1,17 @@
+# Write the backupninja cron job, allowing you to specify an alternate backupninja
+# command (if you want to wrap it in any other commands, e.g. to allow it to use
+# the monkeysphere for authentication), or a different schedule to run it on.
+define backupninja::cron(
+  $backupninja_cmd = '/usr/sbin/backupninja',
+  $backupninja_test_cmd = $backupninja_cmd,
+  $cronfile = "/etc/cron.d/backupninja",
+  $min = "0", $hour = "*", $dom = "*", $month = "*",
+  $dow = "*")
+{
+  file { $cronfile:
+    content => template('backupninja/backupninja.cron.erb'),
+    owner => root,
+    group => root,
+    mode => 0644
+  }
+}
diff --git a/puppet/modules/backupninja/manifests/duplicity.pp b/puppet/modules/backupninja/manifests/duplicity.pp
new file mode 100644
index 00000000..a05da876
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/duplicity.pp
@@ -0,0 +1,147 @@
+# Run duplicity-backup as part of a backupninja run.
+#
+# Valid attributes for this type are:
+#
+#   order:
+#
+#      The prefix to give to the handler config filename, to set order in
+#      which the actions are executed during the backup run.
+#
+#   ensure:
+#
+#      Allows you to delete an entry if you don't want it any more (but be
+#      sure to keep the configdir, name, and order the same, so that we can
+#      find the correct file to remove).
+#
+#   options, nicelevel, testconnect, tmpdir, sign, encryptkey, signkey,
+#   password, include, exclude, vsinclude, incremental, keep, bandwidthlimit,
+#   sshoptions, destdir, desthost, desuser:
+#
+#      As defined in the backupninja documentation.  The options will be
+#      placed in the correct sections automatically.  The include and
+#      exclude options should be given as arrays if you want to specify
+#      multiple directories.
+#
+#   directory, ssh_dir_manage, ssh_dir, authorized_keys_file, installuser,
+#   installkey, backuptag:
+#
+#      Options for the bakupninja::server::sandbox define, check that
+#      definition for more info.
+#
+# Some notes about this handler:
+#
+#   - When specifying a password, be sure to enclose it in single quotes,
+#     this is particularly important if you have any special characters, such
+#     as a $ which puppet will attempt to interpret resulting in a different
+#     password placed in the file than you expect!
+#   - There's no support for a 'local' type in backupninja's duplicity
+#     handler on version 0.9.6-4, which is the version available in stable and
+#     testing debian repositories by the time of this writing.
+define backupninja::duplicity( $order  = 90,
+                               $ensure = present,
+                               # options to the config file
+                               $options     = false,
+                               $nicelevel   = false,
+                               $testconnect = false,
+                               $tmpdir      = false,
+                               # [gpg]
+                               $sign       = false,
+                               $encryptkey = false,
+                               $signkey    = false,
+                               $password   = false,
+                               # [source]
+                               $include = [ "/var/spool/cron/crontabs",
+                                            "/var/backups",
+                                            "/etc",
+                                            "/root",
+                                            "/home",
+                                            "/usr/local/*bin",
+                                            "/var/lib/dpkg/status*" ],
+                               $exclude = [ "/home/*/.gnupg",
+                                            "/home/*/.local/share/Trash",
+                                            "/home/*/.Trash",
+                                            "/home/*/.thumbnails",
+                                            "/home/*/.beagle",
+                                            "/home/*/.aMule",
+                                            "/home/*/.gnupg",
+                                            "/home/*/.gpg",
+                                            "/home/*/.ssh",
+                                            "/home/*/gtk-gnutella-downloads",
+                                            "/etc/ssh/*" ],
+                               $vsinclude = false,
+                               # [dest]
+                               $incremental   = "yes",
+                               $increments   = false,
+                               $keep          = false,
+                               $keepincroffulls = false,
+                               $bandwidthlimit = false,
+                               $sshoptions    = false,
+                               $destdir       = false,
+                               $desthost      = false,
+                               $destuser      = false,
+                               $desturl       = false,
+                               # configs to backupninja client
+                               $backupkeystore       = $backupninja::keystore,
+                               $backupkeystorefspath = $backupninja::keystorefspath,
+                               $backupkeytype        = $backupninja::keytype,
+                               $backupkeydest        = $backupninja::keydest,
+                               $backupkeydestname    = $backupninja::keydestname,
+                               # options to backupninja server sandbox
+                               $ssh_dir_manage       = true,
+                               $ssh_dir              = "${destdir}/.ssh",
+                               $authorized_keys_file = 'authorized_keys',
+                               $installuser          = true,
+                               $backuptag            = "backupninja-${::fqdn}",
+                               # key options
+                               $createkey            = false,
+                               $keymanage            = $backupninja::keymanage ) {
+
+  # install client dependencies
+  ensure_resource('package', 'duplicity', {'ensure' => $backupninja::ensure_duplicity_version})
+
+  case $desthost { false: { err("need to define a destination host for remote backups!") } }
+  case $destdir { false: { err("need to define a destination directory for remote backups!") } }
+  case $password { false: { err("a password is necessary either to unlock the GPG key, or for symmetric encryption!") } }
+
+  # guarantees there's a configured backup space for this backup
+  backupninja::server::sandbox { "${user}-${name}":
+    user                 => $destuser,
+    host                 => $desthost,
+    dir                  => $destdir,
+    manage_ssh_dir       => $ssh_dir_manage,
+    ssh_dir              => $ssh_dir,
+    authorized_keys_file => $authorized_keys_file,
+    installuser          => $installuser,
+    backuptag            => $backuptag,
+    backupkeys           => $backupkeystore,
+    keytype              => $backupkeytype,
+  }
+
+  # the client's ssh key
+  backupninja::key { "${destuser}-${name}":
+    user           => $destuser,
+    createkey      => $createkey,
+    keymanage      => $keymanage,
+    keytype        => $backupkeytype,
+    keystore       => $backupkeystore,
+    keystorefspath => $backupkeystorefspath,
+    keydest        => $backupkeydest,
+    keydestname    => $backupkeydestname
+  }
+
+  # the backupninja rule for this duplicity backup
+  file { "${backupninja::configdir}/${order}_${name}.dup":
+    ensure  => $ensure,
+    content => template('backupninja/dup.conf.erb'),
+    owner   => root,
+    group   => root,
+    mode    => 0600,
+    require => File["${backupninja::configdir}"]
+  }
+
+  if $backupninja::manage_nagios {
+    nagios::service::passive { $nagios_description: }
+  }
+
+}
+
diff --git a/puppet/modules/backupninja/manifests/generate_sshkey.pp b/puppet/modules/backupninja/manifests/generate_sshkey.pp
new file mode 100644
index 00000000..a3008e50
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/generate_sshkey.pp
@@ -0,0 +1,33 @@
+define backupninja::generate_sshkey(
+  $ssh_key_basepath = '/etc/puppet/modules/keys/files/backupkeys',
+){
+
+  # generate backupninja ssh keypair
+  $ssh_key_name = "backup_${::hostname}_id_rsa"
+  $ssh_keys = ssh_keygen("${ssh_key_basepath}/${ssh_key_name}")
+  $public = split($ssh_keys[1],' ')
+  $public_type = $public[0]
+  $public_key = $public[1]
+
+  file { '/root/.ssh':
+    ensure => directory,
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0600';
+  }
+
+  # install ssh keypair on client
+  file { "/root/.ssh/$ssh_key_name":
+    content => $ssh_keys[0],
+    owner   => root,
+    group   => 0,
+    mode    => '0600';
+  }
+
+  file { "/root/.ssh/$ssh_key_name.pub":
+    content => $public_key,
+    owner   => root,
+    group   => 0,
+    mode    => '0666';
+  }
+}
diff --git a/puppet/modules/backupninja/manifests/init.pp b/puppet/modules/backupninja/manifests/init.pp
new file mode 100644
index 00000000..e453e703
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/init.pp
@@ -0,0 +1,52 @@
+# configure backupninja
+class backupninja (
+  $ensure_backupninja_version = 'installed',
+  $ensure_rsync_version = 'installed',
+  $ensure_rdiffbackup_version = 'installed',
+  $ensure_debconfutils_version = 'installed',
+  $ensure_hwinfo_version = 'installed',
+  $ensure_duplicity_version = 'installed',
+  $configdir = '/etc/backup.d',
+  $keystore = "${::fileserver}/keys/backupkeys",
+  $keystorefspath = false,
+  $keytype = 'rsa',
+  $keydest = '/root/.ssh',
+  $keyowner = 0,
+  $keygroup = 0,
+  $keymanage = true,
+  $configfile = '/etc/backupninja.conf',
+  $loglvl = 4,
+  $when = 'everyday at 01:00',
+  $reportemail = 'root',
+  $reportsuccess = false,
+  $reportwarning = true,
+  $reporthost = undef,
+  $reportuser = undef,
+  $reportdirectory = undef,
+  $logfile = '/var/log/backupninja.log',
+  $scriptdir = '/usr/share/backupninja',
+  $libdir = '/usr/lib/backupninja',
+  $usecolors = true,
+  $vservers = false,
+  $manage_nagios = false,
+) {
+
+  # install client dependencies
+  ensure_resource('package', 'backupninja', {'ensure' => $ensure_backupninja_version})
+
+  # set up backupninja config directory
+  file { $configdir:
+    ensure => directory,
+    mode   => '0750',
+    owner  => 0,
+    group  => 0;
+  }
+
+  file { $configfile:
+    content => template('backupninja/backupninja.conf.erb'),
+    owner   => root,
+    group   => 0,
+    mode    => '0644'
+  }
+
+}
diff --git a/puppet/modules/backupninja/manifests/key.pp b/puppet/modules/backupninja/manifests/key.pp
new file mode 100644
index 00000000..9d34cdbd
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/key.pp
@@ -0,0 +1,41 @@
+# generate and deploy backupninja sshkeys
+define backupninja::key(
+  $user = $name,
+  $createkey = false,
+  $keymanage = $backupninja::keymanage,
+  $keyowner = $backupninja::keyowner,
+  $keygroup = $backupninja::keygroup,
+  $keystore= $backupninja::keystore,
+  $keystorefspath = $backupninja::keystorefspath,
+  $keytype = $backupninja::keytype,
+  $keydest = $backupninja::keydest,
+  $keydestname = "id_${backupninja::keytype}" )
+{
+
+  # generate the key
+  if $createkey == true {
+    if $keystorefspath == false {
+      err('need to define a destination directory for sshkey creation!')
+    }
+    $ssh_keys = ssh_keygen("${keystorefspath}/${keydestname}")
+  }
+
+  # deploy/manage the key
+  if $keymanage == true {
+    $keydestfile = "${keydest}/${keydestname}"
+    ensure_resource('file', $keydest, {
+      'ensure' => 'directory',
+      'mode'   => '0700',
+      'owner'  => $keyowner,
+      'group'  => $keygroup
+    })
+    ensure_resource('file', $keydestfile, {
+      'ensure'  => 'present',
+      'source'  => "${keystore}/${user}_id_${keytype}",
+      'mode'    => '0700',
+      'owner'   => $keyowner,
+      'group'   => $keygroup,
+      'require' => File[$keydest],
+    })
+  }
+}
diff --git a/puppet/modules/backupninja/manifests/labelmount.pp b/puppet/modules/backupninja/manifests/labelmount.pp
new file mode 100644
index 00000000..8974cec1
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/labelmount.pp
@@ -0,0 +1,62 @@
+# Mount a labelled partition on a directory as part of a backupninja run.
+#
+# This type will automatically create an unmount action with an order of 99
+# for the destination directory you specify here.
+#
+# Valid attributes for this type are:
+#
+#   order: The prefix to give to the handler config filename, to set
+#      order in which the actions are executed during the backup run.  Note
+#      that the value given here should be less than any action which
+#      requires the filesystem to be mounted!
+#
+#   ensure: Allows you to delete an entry if you don't want it any more
+#      (but be sure to keep the configdir, name, and order the same, so
+#      that we can find the correct file to remove).
+#
+#   label: The partition label to mount.
+#
+#   dest: The directory to mount the partition onto.
+# 
+define backupninja::labelmount($order = 10,
+                               $ensure = present,
+                               $label,
+                               $dest
+                              ) {
+	file { "${backupninja::configdir}/${order}_${name}.labelmount":
+		ensure => $ensure,
+		content => template('backupninja/labelmount.conf.erb'),
+		owner => root,
+		group => root,
+		mode => 0600,
+		require => File["${backupninja::configdir}"]
+	}
+
+	file { "${backupninja::configdir}/99_${name}.umount":
+		ensure => $ensure,
+		content => template('backupninja/umount.conf.erb'),
+		owner => root,
+		group => root,
+		mode => 0600,
+		require => File["${backupninja::configdir}"]
+	}
+	
+	# Copy over the handler scripts themselves, since they're not in the
+	# standard distribution, and are unlikely to end up there any time
+	# soon because backupninja's "build" system is balls.
+	file { "/usr/share/backupninja/labelmount":
+		content => template('backupninja/labelmount.handler'),
+		owner => root,
+		group => root,
+		mode => 0755,
+		require => Package[backupninja]
+	}
+
+	file { "/usr/share/backupninja/umount":
+		content => template('backupninja/umount.handler'),
+		owner => root,
+		group => root,
+		mode => 0755,
+		require => Package[backupninja]
+	}
+}
diff --git a/puppet/modules/backupninja/manifests/maildir.pp b/puppet/modules/backupninja/manifests/maildir.pp
new file mode 100644
index 00000000..2454b82d
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/maildir.pp
@@ -0,0 +1,43 @@
+# maildir handler, as part of a backupninja run.
+#
+# The maildir handler slowly creates a backup of each user's
+# maildir to a remote server. It is designed to be run with
+# low overhead in terms of CPU and bandwidth, so it runs pretty
+# slow. Hardlinking is used to save storage space. The actual
+# maildir is stored within each snapshot directory.
+#
+# Valid attributes for this type are:
+#
+#   order: The prefix to give to the handler config filename, to set
+#      order in which the actions are executed during the backup run.
+#
+#   ensure: Allows you to delete an entry if you don't want it any more
+#      (but be sure to keep the configdir, name, and order the same, so
+#      that we can find the correct file to remove).
+#
+# 
+define backupninja::maildir(
+  $order = 99, $ensure = present,
+  $when = 'everyday at 21:00', $srcdir = false,
+  $destdir = false, $desthost = false, $destuser = false, $destid_file = false,
+  $remove = false, $multiconnection = yes, $keepdaily='4', $keepweekly='2',
+  $keepmonthly='2')
+{
+  # install client dependencies
+  ensure_resource('package', 'rsync', {'ensure' => $backupninja::ensure_rsync_version})
+
+  case $srcdir { false: { err("need to define a source directory to backup!") } }
+  case $destdir { false: { err("need to define a destination directory to backup!") } }
+  case $desthost { false: { err("need to define a destination host for backups!") } }
+  case $destuser { false: { err("need to define a destination user for backups!") } }
+  case $destid_file { false: { err("need to define a ssh key id file to use!") } }
+  
+  file { "${backupninja::configdir}/${order}_${name}.maildir":
+    ensure => $ensure,
+    content => template('backupninja/maildir.conf.erb'),
+    owner => root,
+    group => root,
+    mode => 0600,
+    require => File["${backupninja::configdir}"]
+  }
+}
diff --git a/puppet/modules/backupninja/manifests/mysql.pp b/puppet/modules/backupninja/manifests/mysql.pp
new file mode 100644
index 00000000..b8877c05
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/mysql.pp
@@ -0,0 +1,38 @@
+# Safe MySQL dumps, as part of a backupninja run.
+#
+# Valid attributes for this type are:
+#
+#   order: The prefix to give to the handler config filename, to set
+#      order in which the actions are executed during the backup run.
+#
+#   ensure: Allows you to delete an entry if you don't want it any more
+#      (but be sure to keep the configdir, name, and order the same, so
+#      that we can find the correct file to remove).
+#
+#   user, dbusername, dbpassword, dbhost, databases, backupdir,
+#   hotcopy, sqldump, compress, configfile: As defined in the
+#   backupninja documentation, with the caveat that hotcopy, sqldump,
+#   and compress take true/false rather than yes/no.
+# 
+define backupninja::mysql(
+  $order = 10, $ensure = present, $user = false, $dbusername = false, $dbpassword = false,
+  $dbhost = 'localhost', $databases = 'all', $backupdir = false, $hotcopy = false,
+  $sqldump = false, $compress = false, $configfile = true,
+  $vsname = false, $sqldumpoptions = '--lock-tables --complete-insert --add-drop-table --quick --quote-names',
+  $nodata = false)
+{
+  
+  $real_configfile = $configfile ? {
+    true => "/etc/mysql/debian.cnf",
+    default => $configfile,
+  }
+
+  file { "${backupninja::configdir}/${order}_${name}.mysql":
+    ensure => $ensure,
+    content => template('backupninja/mysql.conf.erb'),
+    owner => root,
+    group => root,
+    mode => 0600,
+    require => File["${backupninja::configdir}"]
+  }
+}
diff --git a/puppet/modules/backupninja/manifests/nagios_plugin/duplicity.pp b/puppet/modules/backupninja/manifests/nagios_plugin/duplicity.pp
new file mode 100644
index 00000000..7dbd2633
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/nagios_plugin/duplicity.pp
@@ -0,0 +1,45 @@
+class backupninja::nagios_plugin::duplicity {
+  case $::operatingsystem {
+    'Debian': { package { 'python-argparse': ensure => installed, } }
+    'Ubuntu': { package { 'python-argh':     ensure => installed, } }
+    default:  {
+      notify {'Backupninja-Duplicity Nagios check needs python-argparse to be installed !':}  }
+  }
+
+  file { '/usr/lib/nagios/plugins/check_backupninja_duplicity.py':
+    source => 'puppet:///modules/backupninja/nagios_plugins/duplicity/check_backupninja_duplicity.py',
+    mode   => '0755',
+    owner  => 'nagios',
+    group  => 'nagios',
+  }
+
+  # deploy helper script
+  file { '/usr/lib/nagios/plugins/backupninja_duplicity_freshness.sh':
+    source => 'puppet:///modules/backupninja/nagios_plugins/duplicity/backupninja_duplicity_freshness.sh',
+    mode   => '0755',
+    owner  => 'nagios',
+    group  => 'nagios',
+  }
+
+  nagios::nrpe::command { 'check_backupninja_duplicity':
+    command_line => "sudo ${::nagios::nrpe::nagios_plugin_dir}/check_backupninja_duplicity.py"
+  }
+  sudo::spec {'nrpe_check_backupninja_duplicity':
+      ensure    => present,
+      users     => 'nagios',
+      hosts     => 'ALL',
+      commands  => "NOPASSWD: ${::nagios::nrpe::nagios_plugin_dir}/check_backupninja_duplicity.py";
+  }
+
+  nagios::service { "Backupninja Duplicity $::fqdn":
+    use_nrpe              => true,
+    check_command         => 'check_backupninja_duplicity',
+    nrpe_timeout          => '60',
+    # check only twice a day
+    normal_check_interval => '720',
+    # recheck every hour
+    retry_check_interval  => '60',
+  }
+
+
+}
diff --git a/puppet/modules/backupninja/manifests/pgsql.pp b/puppet/modules/backupninja/manifests/pgsql.pp
new file mode 100644
index 00000000..d4814be9
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/pgsql.pp
@@ -0,0 +1,27 @@
+# Safe PGSQL dumps, as part of a backupninja run.
+#
+# Valid attributes for this type are:
+#
+#   order: The prefix to give to the handler config filename, to set
+#      order in which the actions are executed during the backup run.
+#
+#   ensure: Allows you to delete an entry if you don't want it any more
+#      (but be sure to keep the configdir, name, and order the same, so
+#      that we can find the correct file to remove).
+#
+#   backupdir, compress, configfile: As defined in the
+#   backupninja documentation, with the caveat that hotcopy, sqldump,
+#   and compress take true/false rather than yes/no.
+# 
+define backupninja::pgsql(
+  $order = 10, $ensure = present, $databases = 'all', $backupdir = "/var/backups/postgres", $compress = true, $vsname = false)
+{
+  file { "${backupninja::configdir}/${order}_${name}.pgsql":
+    ensure => $ensure,
+    content => template('backupninja/pgsql.conf.erb'),
+    owner => root,
+    group => root,
+    mode => 0600,
+    require => File["${backupninja::configdir}"]
+  }
+}
diff --git a/puppet/modules/backupninja/manifests/rdiff.pp b/puppet/modules/backupninja/manifests/rdiff.pp
new file mode 100644
index 00000000..cd73d22c
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/rdiff.pp
@@ -0,0 +1,109 @@
+# Run rdiff-backup as part of a backupninja run.
+#
+# Valid attributes for this type are:
+#
+#   order: The prefix to give to the handler config filename, to set
+#      order in which the actions are executed during the backup run.
+#
+#   ensure: Allows you to delete an entry if you don't want it any more
+#      (but be sure to keep the configdir, name, and order the same, so
+#      that we can find the correct file to remove).
+#
+#   keep, include, exclude, type, host, directory, user, sshoptions: As
+#      defined in the backupninja documentation.  The options will be placed
+#      in the correct sections automatically.  The include and exclude
+#      options should be given as arrays if you want to specify multiple
+#      directories.
+# 
+define backupninja::rdiff( $order  = 90,
+                           $ensure = present,
+                           # [general]
+                           $options = '--force',
+                           $extras  = false,
+                           # [source]
+                           $include = [ "/var/spool/cron/crontabs",
+                                        "/var/backups",
+                                        "/etc",
+                                        "/root",
+                                        "/home",
+                                        "/usr/local/*bin",
+                                        "/var/lib/dpkg/status*"
+                                      ],
+                           $exclude = [ "/home/*/.gnupg",
+                                        "/home/*/.local/share/Trash",
+                                        "/home/*/.Trash",
+                                        "/home/*/.thumbnails",
+                                        "/home/*/.beagle",
+                                        "/home/*/.aMule",
+                                        "/home/*/gtk-gnutella-downloads"
+                                      ],
+                           $vsinclude = false,
+                           # [dest]
+                           $type       = 'local',
+                           $host       = false,
+                           $user       = false,
+                           $home       = "/home/${user}-${name}",
+                           $keep       = 30,
+                           $sshoptions = false,
+                           # ssh keypair config
+                           $key            = false,
+                           $keymanage      = $backupninja::keymanage,
+                           $backupkeystore = $backupninja::keystore,
+                           $backupkeytype  = $backupninja::keytype,
+                           $ssh_dir_manage = true,
+                           $ssh_dir        = "${home}/.ssh",
+                           $authorized_keys_file = 'authorized_keys',
+                           # sandbox config
+                           $installuser = true,
+                           $backuptag   = "backupninja-${::fqdn}",
+                           # monitoring
+                           $nagios_description = "backups-${name}" ) {
+
+  # install client dependencies
+  ensure_resource('package', 'rdiff-backup', {'ensure' => $backupninja::ensure_rdiffbackup_version})
+
+  $directory = "$home/$name/"
+
+  case $type {
+    'remote': {
+      case $host { false: { err("need to define a host for remote backups!") } }
+
+      backupninja::server::sandbox { "${user}-${name}":
+        user                 => $user,
+        host                 => $host,
+        dir                  => $home,
+        manage_ssh_dir       => $ssh_dir_manage,
+        ssh_dir              => $ssh_dir,
+        key                  => $key,
+        authorized_keys_file => $authorized_keys_file,
+        installuser          => $installuser,
+        backuptag            => $backuptag,
+        backupkeys           => $backupkeystore,
+        keytype              => $backupkeytype,
+      }
+     
+      backupninja::key { "${user}-${name}":
+        user      => $user,
+        keymanage => $keymanage,
+        keytype   => $backupkeytype,
+        keystore  => $backupkeystore,
+      }
+    }
+  }
+
+
+  file { "${backupninja::configdir}/${order}_${name}.rdiff":
+    ensure  => $ensure,
+    content => template('backupninja/rdiff.conf.erb'),
+    owner   => root,
+    group   => root,
+    mode    => 0600,
+    require => File["${backupninja::configdir}"]
+  }
+
+  if $backupninja::manage_nagios {
+    nagios::service::passive { $nagios_description: }
+  }
+
+}
+  
diff --git a/puppet/modules/backupninja/manifests/rsync.pp b/puppet/modules/backupninja/manifests/rsync.pp
new file mode 100644
index 00000000..fc59950b
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/rsync.pp
@@ -0,0 +1,128 @@
+# Run rsync as part of a backupninja run.
+# Based on backupninja::rdiff
+
+define backupninja::rsync( $order  = 90,
+                           $ensure = present,
+                           # [general]
+                           $log             = false,
+                           $partition       = false,
+                           $fscheck         = false,
+                           $read_only       = false,
+                           $mountpoint      = false,
+                           $format          = false,
+                           $days            = false,
+                           $keepdaily       = false,
+                           $keepweekly      = false,
+                           $keepmonthly     = false,
+                           $lockfile        = false,
+                           $nicelevel       = 0,
+                           $tmp             = false,
+                           $multiconnection = false,
+                           $enable_mv_timestamp_bug = false,
+                           # [source]
+                           $include = [ "/var/spool/cron/crontabs",
+                                        "/var/backups",
+                                        "/etc",
+                                        "/root",
+                                        "/home",
+                                        "/usr/local/*bin",
+                                        "/var/lib/dpkg/status*"
+                                      ],
+                           $exclude = [ "/home/*/.gnupg",
+                                        "/home/*/.local/share/Trash",
+                                        "/home/*/.Trash",
+                                        "/home/*/.thumbnails",
+                                        "/home/*/.beagle",
+                                        "/home/*/.aMule",
+                                        "/home/*/gtk-gnutella-downloads"
+                                      ],
+                           # [dest]
+                           $host           = false,
+                           $user           = false,
+                           $home           = "/home/${user}-${name}",
+                           $subfolder      = 'rsync',
+                           $testconnect    = false,
+                           $ssh            = false,
+                           $protocol       = false,
+                           $numericids     = false,
+                           $compress       = false,
+                           $port           = false,
+                           $bandwidthlimit = false,
+                           $remote_rsync   = false,
+                           $batch          = false,
+                           $batchbase      = false,
+                           $fakesuper      = false,
+                           $id_file        = false,
+                           # [services]
+                           $initscripts = false,
+                           $service     = false,
+                           # [system]
+                           $rm    = false,
+                           $cp    = false,
+                           $touch = false,
+                           $mv    = false,
+                           $fsck  = false,
+                           # ssh keypair config
+                           $key                  = false,
+                           $keymanage            = $backupninja::keymanage,
+                           $backupkeystore       = $backupninja::keystore,
+                           $backupkeytype        = $backupninja::keytype,
+                           $ssh_dir_manage       = true,
+                           $ssh_dir              = "${home}/.ssh",
+                           $authorized_keys_file = 'authorized_keys',
+                           # sandbox config
+                           $installuser = true,
+                           $backuptag   = "backupninja-${::fqdn}",
+                           # monitoring
+                           $nagios_description = "backups-${name}" ) {
+
+  # install client dependencies
+  ensure_resource('package', 'rsync', {'ensure' => $backupninja::ensure_rsync_version})
+
+  # Right now just local origin with remote destination is supported.
+  $from = 'local'
+  $dest = 'remote'
+
+  case $dest {
+    'remote': {
+      case $host { false: { err("need to define a host for remote backups!") } }
+
+      $directory = "${home}/${subfolder}/"
+
+      backupninja::server::sandbox { "${user}-${name}":
+        user                 => $user,
+        host                 => $host,
+        dir                  => $home,
+        manage_ssh_dir       => $ssh_dir_manage,
+        ssh_dir              => $ssh_dir,
+        key                  => $key,
+        authorized_keys_file => $authorized_keys_file,
+        installuser          => $installuser,
+        backuptag            => $backuptag,
+        keytype              => $backupkeytype,
+        backupkeys           => $backupkeystore,
+      }
+     
+      backupninja::key { "${user}-${name}":
+        user       => $user,
+        keymanage  => $keymanage,
+        keytype    => $backupkeytype,
+        keystore   => $backupkeystore,
+      }
+    }
+  }
+
+  file { "${backupninja::configdir}/${order}_${name}.rsync":
+    ensure  => $ensure,
+    content => template('backupninja/rsync.conf.erb'),
+    owner   => root,
+    group   => root,
+    mode    => 0600,
+    require => File["${backupninja::configdir}"]
+  }
+
+  if $backupninja::manage_nagios {
+    nagios::service::passive { $nagios_description: }
+  }
+
+}
diff --git a/puppet/modules/backupninja/manifests/server.pp b/puppet/modules/backupninja/manifests/server.pp
new file mode 100644
index 00000000..49e42a0f
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/server.pp
@@ -0,0 +1,147 @@
+# this define realizes all needed resources for a hosted backup
+define backupninja_server_realize($host) {
+  User               <<| tag == "backupninja-$host" |>>
+  File               <<| tag == "backupninja-$host" |>>
+  Ssh_authorized_key <<| tag == "backupninja-$host" |>>
+}
+
+class backupninja::server (
+  $backupdir = '/backup',
+  $backupdir_ensure = 'directory',
+  $manage_nagios = false,
+  $nagios_server = undef,
+  $nagios_warn_level = 129600,
+  $nagios_crit_level = 216000,
+) {
+
+  group { "backupninjas":
+    ensure => "present",
+    gid => 700
+  }
+  
+  file { $backupdir:
+    ensure => $backupdir_ensure,
+    mode => 0710, owner => root, group => "backupninjas",
+    require => $backupdir_ensure ? {
+      'directory' => undef,
+      default     => File["$backupdir_ensure"],
+    }
+  }
+
+  if $manage_nagios {
+
+    case $nagios_server { undef: { err('Cannot manage nagios without nagios_server parameter!') } }
+
+    include nagios::nsca::client
+    
+    file { "/usr/local/bin/checkbackups":
+      ensure => "present",
+      source => "puppet:///modules/backupninja/checkbackups.pl",
+      mode => 0755, owner => root, group => root,
+    }
+
+    cron { checkbackups:
+      command => "/usr/local/bin/checkbackups -d ${backupdir} -s ${nagios_server} -w ${nagios_warn_level} -c ${nagios_crit_level} | grep -v 'sent to host successfully'",
+      user => "root",
+      hour => "8-23",
+      minute => 59,
+      require => [ File["/usr/local/bin/checkbackups"], Package['nsca'] ]
+    }
+  }
+
+  # collect all resources from hosted backups
+  Backupninja_server_realize <<| tag == $::fqdn |>>
+
+  # this define allows nodes to declare a remote backup sandbox, that have to
+  # get created on the server
+  define sandbox (
+    $user = $name,
+    $host = $::fqdn,
+    $installuser = true,
+    $dir,
+    $manage_ssh_dir = true,
+    $ssh_dir = "${dir}/.ssh",
+    $authorized_keys_file = 'authorized_keys',
+    $key = false,
+    $keytype = 'dss',
+    $backupkeys = "${fileserver}/keys/backupkeys",
+    $uid = false,
+    $gid = "backupninjas",
+    $backuptag = "backupninja-${::fqdn}",
+  ) {
+
+    if !defined(Backupninja_server_realize["${::fqdn}@${host}"]) {
+      @@backupninja_server_realize { "${::fqdn}@${host}":
+        host => $::fqdn,
+        tag  => $host,
+      }
+    }
+
+    if !defined(File["$dir"]) {
+      @@file { "$dir":
+        ensure => directory,
+        mode => 0750, owner => $user, group => 0,
+        tag => "$backuptag",
+      }
+    }
+
+    if $installuser {
+
+       if $manage_ssh_dir {
+        if !defined(File["$ssh_dir"]) {
+          @@file { "${ssh_dir}":
+            ensure => directory,
+            mode => 0700, owner => $user, group => 0,
+            require => [User[$user], File["$dir"]],
+            tag => "$backuptag",
+          }
+         }
+       } 
+
+      if $key {
+        # $key contais ssh public key
+        if !defined(Ssh_autorized_key["$user"]) {
+          @@ssh_authorized_key{ "$user":
+            type    => $keytype,
+            key     => $key,
+            user    => $user,
+            target  => "${ssh_dir}/${authorized_keys_file}",
+            tag     => "$backuptag",
+            require => User[$user],
+          }
+        }
+      }
+      else {
+        # get ssh public key exists from server
+        if !defined(File["${ssh_dir}/${authorized_keys_file}"]) {
+          @@file { "${ssh_dir}/${authorized_keys_file}":
+            ensure => present,
+            mode => 0644, owner => 0, group => 0,
+            source => "${backupkeys}/${user}_id_${keytype}.pub",
+            require => File["${ssh_dir}"],
+            tag => "$backuptag",
+          }
+        }
+      }
+      
+      if !defined(User["$user"]) {
+        @@user { "$user":
+          ensure   => "present",
+          uid      => $uid ? {
+              false   => undef,
+              default => $uid
+          },
+          gid      => "$gid",
+          comment  => "$user backup sandbox",
+          home     => "$dir",
+          managehome => true,
+          shell    => "/bin/bash",
+          password => '*',
+          require  => Group['backupninjas'],
+          tag      => "$backuptag"
+        }
+      }
+    }
+  }
+}
+
diff --git a/puppet/modules/backupninja/manifests/sh.pp b/puppet/modules/backupninja/manifests/sh.pp
new file mode 100644
index 00000000..4a60e5fa
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/sh.pp
@@ -0,0 +1,25 @@
+# sh handler, as part of a backupninja run.
+#
+# Valid attributes for this type are:
+#
+#   order: The prefix to give to the handler config filename, to set
+#      order in which the actions are executed during the backup run.
+#
+#   ensure: Allows you to delete an entry if you don't want it any more
+#      (but be sure to keep the configdir, name, and order the same, so
+#      that we can find the correct file to remove).
+#
+# 
+define backupninja::sh($order = 50,
+                           $ensure = present,
+                           $command_string
+                          ) {
+	file { "${backupninja::configdir}/${order}_${name}.sh":
+		ensure => $ensure,
+		content => template('backupninja/sh.conf.erb'),
+		owner => root,
+		group => root,
+		mode => 0600,
+		require => File["${backupninja::configdir}"]
+	}
+}
diff --git a/puppet/modules/backupninja/manifests/svn.pp b/puppet/modules/backupninja/manifests/svn.pp
new file mode 100644
index 00000000..1ab0597f
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/svn.pp
@@ -0,0 +1,28 @@
+# Subversion dumps, as part of a backupninja run.
+#
+# Valid attributes for this type are:
+#
+#   order: The prefix to give to the handler config filename, to set
+#      order in which the actions are executed during the backup run.
+#
+#   ensure: Allows you to delete an entry if you don't want it any more
+#      (but be sure to keep the configdir, name, and order the same, so
+#      that we can find the correct file to remove).
+#
+# 
+define backupninja::svn($order = 20,
+                           $ensure = present,
+                           $src = '/var/lib/svn',
+                           $dest = '/var/backups/svn',
+                           $tmp = '/var/backups/svn.tmp',
+                           $vsname = false
+                          ) {
+	file { "${backupninja::configdir}/${order}_${name}.svn":
+		ensure => $ensure,
+		content => template('backupninja/svn.conf.erb'),
+		owner => root,
+		group => root,
+		mode => 0600,
+		require => File["${backupninja::configdir}"]
+	}
+}
diff --git a/puppet/modules/backupninja/manifests/sys.pp b/puppet/modules/backupninja/manifests/sys.pp
new file mode 100644
index 00000000..946a525e
--- /dev/null
+++ b/puppet/modules/backupninja/manifests/sys.pp
@@ -0,0 +1,45 @@
+# sys handler, as part of a backupninja run.
+#
+# Valid attributes for this type are:
+#
+#   order: The prefix to give to the handler config filename, to set
+#      order in which the actions are executed during the backup run.
+#
+#   ensure: Allows you to delete an entry if you don't want it any more
+#      (but be sure to keep the configdir, name, and order the same, so
+#      that we can find the correct file to remove).
+#
+# 
+define backupninja::sys($order = 30,
+                           $ensure = present,
+                           $parentdir = '/var/backups',
+                           $packages = true,
+                           $packagesfile = '/var/backups/dpkg-selections.txt',
+                           $partitions = true,
+                           $partitionsfile = '/var/backups/partitions.__star__.txt',
+                           $dosfdisk = true,
+                           $hardware = true,
+                           $hardwarefile = '/var/backups/hardware.txt',
+                           $dohwinfo = true,
+                           $doluks = false,
+                           $dolvm = false
+                          ) {
+
+  # install client dependencies
+  case $operatingsystem {
+    debian,ubuntu: {
+      ensure_resource('package', 'debconf-utils', {'ensure' => $backupninja::ensure_debconfutils_version})
+      ensure_resource('package', 'hwinfo', {'ensure' => $backupninja::ensure_hwinfo_version})
+    }
+    default: {}
+  }
+
+	file { "${backupninja::configdir}/${order}_${name}.sys":
+		ensure => $ensure,
+		content => template('backupninja/sys.conf.erb'),
+		owner => root,
+		group => root,
+		mode => 0600,
+		require => File["${backupninja::configdir}"]
+	}
+}
diff --git a/puppet/modules/backupninja/templates/backupninja.conf.erb b/puppet/modules/backupninja/templates/backupninja.conf.erb
new file mode 100644
index 00000000..7706a615
--- /dev/null
+++ b/puppet/modules/backupninja/templates/backupninja.conf.erb
@@ -0,0 +1,25 @@
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+loglevel = <%= @loglvl %>
+when = <%= send(:when) %>
+reportemail = <%= @reportemail %>
+reportsuccess = <%= @reportsuccess ? 'yes' : 'no' %>
+reportwarning = <%= @reportwarning ? 'yes' : 'no' %>
+<% if reporthost.is_a? String -%>
+<%= 'reporthost = ' + @reporthost %>
+<% end -%>
+<% if reportuser.is_a? String -%>
+<%= 'reportuser = ' + @reportuser %>
+<% end -%>
+<% if reportdirectory.is_a? String -%>
+<%= 'reportdirectory = ' + @reportdirectory %>
+<% end -%>
+logfile = <%= @logfile %>
+configdirectory = <%= @configdir %>
+scriptdirectory = <%= @scriptdir %>
+libdirectory = <%= @libdir %>
+usecolors = <%= @usecolors ? 'yes' : 'no' %>
+vservers = <%= @vservers ? 'yes' : 'no' %>
diff --git a/puppet/modules/backupninja/templates/backupninja.cron.erb b/puppet/modules/backupninja/templates/backupninja.cron.erb
new file mode 100644
index 00000000..ec392ca9
--- /dev/null
+++ b/puppet/modules/backupninja/templates/backupninja.cron.erb
@@ -0,0 +1,6 @@
+# /etc/cron.d/backupninja -- cron tab entry for package backupninja
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+
+# # run backupninja 
+<%= min %> <%= hour %> <%= dom %> <%= month %> <%= dow %> root if [ -x <%= backupninja_test_cmd %> ]; then <%= backupninja_cmd %>; fi
diff --git a/puppet/modules/backupninja/templates/dup.conf.erb b/puppet/modules/backupninja/templates/dup.conf.erb
new file mode 100644
index 00000000..4f15e789
--- /dev/null
+++ b/puppet/modules/backupninja/templates/dup.conf.erb
@@ -0,0 +1,46 @@
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+<%= 'options = ' + options if options %>
+<%= 'nicelevel = ' + nicelevel if nicelevel %>
+<%= 'testconnect = ' + testconnect if testconnect %>
+<%= 'tmpdir = ' + tmpdir if tmpdir %>
+
+[gpg]
+<%= 'sign = ' + sign if sign %>
+<%= 'encryptkey = ' + encryptkey if encryptkey %>
+<%= 'signkey = ' + signkey if signkey %>
+<%= 'password = ' + password if password %>
+
+[source]
+<% if include.is_a? String -%>
+<%= 'include = ' + include %>
+<% elsif include.is_a? Array -%>
+<%= include.map { |i| "include = #{i}" }.join("\n") %>
+<% end -%>
+
+<% if exclude.is_a? String -%>
+<%= 'exclude = ' + exclude %>
+<% elsif exclude.is_a? Array -%>
+<%= exclude.map { |i| "exclude = #{i}" }.join("\n") %>
+<% end -%>
+
+<% if vsinclude.is_a? String -%>
+<%= 'vsinclude = ' + vsinclude %>
+<% elsif vsinclude.is_a? Array -%>
+<%= vsinclude.map { |i| "vsinclude = #{i}" }.join("\n") %>
+<% end -%>
+
+[dest]
+<%= 'incremental = ' + incremental if incremental %>
+<%= 'increments = ' + increments if increments %>
+<%= 'keep = ' + keep if keep %>
+<%= 'keepincroffulls = ' + keepincroffulls if keepincroffulls %>
+<%= 'bandwidthlimit = ' + bandwidthlimit if bandwidthlimit %>
+<%= 'sshoptions = ' + sshoptions if sshoptions %>
+<%= 'destdir = ' + destdir if destdir %>
+<%= 'desthost = ' + desthost if desthost %>
+<%= 'destuser = ' + destuser if destuser %>
+<%= 'desturl = ' + desturl if desturl %>
diff --git a/puppet/modules/backupninja/templates/labelmount.conf.erb b/puppet/modules/backupninja/templates/labelmount.conf.erb
new file mode 100644
index 00000000..e40c49d3
--- /dev/null
+++ b/puppet/modules/backupninja/templates/labelmount.conf.erb
@@ -0,0 +1,2 @@
+label = <%= label %>
+dest = <%= dest %>
diff --git a/puppet/modules/backupninja/templates/labelmount.handler b/puppet/modules/backupninja/templates/labelmount.handler
new file mode 100644
index 00000000..22090bd4
--- /dev/null
+++ b/puppet/modules/backupninja/templates/labelmount.handler
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# Mount a block device with the specified label ('label') onto the given
+# directory ('dest').
+
+getconf label
+getconf dest
+
+if [ ! -b "/dev/disk/by-label/$label" ]; then
+	halt "No partition labelled '$label' is available"
+fi
+
+if [ ! -d "$dest" ]; then
+	halt "Destination directory does not exist"
+fi
+
+mount -t auto /dev/disk/by-label/$label $dest || halt "Mount failed"
diff --git a/puppet/modules/backupninja/templates/maildir.conf.erb b/puppet/modules/backupninja/templates/maildir.conf.erb
new file mode 100644
index 00000000..351f3824
--- /dev/null
+++ b/puppet/modules/backupninja/templates/maildir.conf.erb
@@ -0,0 +1,14 @@
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+<% %w{when srcdir destdir desthost destuser destid_file keepdaily keepweekly keepmonthly}.each do |v|
+	if send(v)
+		-%><%= v + ' = ' + send(v) + "\n" %><%
+	end
+end -%>
+
+remove = <%= remove ? 'yes' : 'no' %>
+multiconnection = <%= multiconnection ? 'yes' : 'no' %>
+
diff --git a/puppet/modules/backupninja/templates/mysql.conf.erb b/puppet/modules/backupninja/templates/mysql.conf.erb
new file mode 100644
index 00000000..b7ac5e8f
--- /dev/null
+++ b/puppet/modules/backupninja/templates/mysql.conf.erb
@@ -0,0 +1,25 @@
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+<% %w{user dbusername dbpassword dbhost databases backupdir vsname sqldumpoptions}.each do |v|
+	if send(v)
+		-%><%= v + ' = ' + send(v) + "\n" %><%
+	end
+end -%>
+
+hotcopy = <%= hotcopy ? 'yes' : 'no' %>
+sqldump = <%= sqldump ? 'yes' : 'no' %>
+compress = <%= compress ? 'yes' : 'no' %>
+
+<% if real_configfile %>
+configfile = <%= real_configfile %>
+<% end %>
+
+<% if nodata.is_a? String -%>
+<%= 'nodata = ' + nodata %>
+<% elsif nodata.is_a? Array -%>
+<%= "nodata = " + nodata.map { |i| "#{i}" }.join(" ") %>
+<% end -%>
+
diff --git a/puppet/modules/backupninja/templates/pgsql.conf.erb b/puppet/modules/backupninja/templates/pgsql.conf.erb
new file mode 100644
index 00000000..5ffa89c0
--- /dev/null
+++ b/puppet/modules/backupninja/templates/pgsql.conf.erb
@@ -0,0 +1,13 @@
+<% if vsname %>
+vsname = <%= vsname %>
+<% end %>
+<% if backupdir %>
+backupdir = <%= backupdir %>
+<% end %>
+<% if databases.is_a? String -%>
+<%= 'databases = ' + databases %>
+<% elsif databases.is_a? Array -%>
+<%= "databases = " + databases.map { |i| "#{i}" }.join(" ") %>
+<% end -%>
+compress = <%= compress ? 'yes' : 'no' %>
+
diff --git a/puppet/modules/backupninja/templates/rdiff.conf.erb b/puppet/modules/backupninja/templates/rdiff.conf.erb
new file mode 100644
index 00000000..23c336fc
--- /dev/null
+++ b/puppet/modules/backupninja/templates/rdiff.conf.erb
@@ -0,0 +1,38 @@
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+<%= 'options = ' + options if options %>
+
+<%= extras if extras %>
+
+[source]
+type = local
+<%= 'keep = ' + keep if keep %>
+
+<% if include.is_a? String -%>
+<%= 'include = ' + include %>
+<% elsif include.is_a? Array -%>
+<%= include.map { |i| "include = #{i}" }.join("\n") %>
+<% end -%>
+
+<% if exclude.is_a? String -%>
+<%= 'exclude = ' + exclude %>
+<% elsif exclude.is_a? Array -%>
+<%= exclude.map { |i| "exclude = #{i}" }.join("\n") %>
+<% end -%>
+
+<% if vsinclude.is_a? String -%>
+<%= 'vsinclude = ' + vsinclude %>
+<% elsif vsinclude.is_a? Array -%>
+<%= vsinclude.map { |i| "vsinclude = #{i}" }.join("\n") %>
+<% end -%>
+
+[dest]
+<%- %w{type host directory user sshoptions}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + ' = ' + instance_variable_get("@#{v}").to_s %>
+<%-
+    end
+end -%>
diff --git a/puppet/modules/backupninja/templates/rsync.conf.erb b/puppet/modules/backupninja/templates/rsync.conf.erb
new file mode 100644
index 00000000..778676fc
--- /dev/null
+++ b/puppet/modules/backupninja/templates/rsync.conf.erb
@@ -0,0 +1,49 @@
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+[general]
+<%- %w{log partition fscheck read_only mountpoint backupdir format days keepdaily keepweekly keepmonthly lockfile nicelevel enable_mv_timestamp_bug, tmp, multiconnection}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + ' = ' + instance_variable_get("@#{v}").to_s %>
+<%-
+    end
+end -%>
+
+[source]
+<% unless from.empty? and from.to_s != "false" -%>
+from = <%= from %>
+<% end -%>
+<%- %w{include exclude}.each do |v|
+    if has_variable?(v)
+      instance_variable_get("@#{v}").to_a.each do |parameter| -%>
+<%= v + ' = ' + parameter %>
+<%-
+      end
+    end
+end -%>
+
+[dest]
+<%- %w{dest testconnect ssh protocol numericids compress host port user id_file bandwidthlimit remote_rsync batch batchbase fakesuper}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + ' = ' + instance_variable_get("@#{v}").to_s %>
+<%-
+    end
+end -%>
+
+[services]
+<%- %w{initscripts service}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + ' = ' + instance_variable_get("@#{v}").to_s %>
+<%-
+    end
+end -%>
+
+[system]
+<%- %w{rm cp touch mv fsck}.each do |v|
+    if has_variable?(v) and instance_variable_get("@#{v}").to_s != "false" -%>
+<%= v + ' = ' + instance_variable_get("@#{v}").to_s %>
+<%-
+    end
+end -%>
diff --git a/puppet/modules/backupninja/templates/sh.conf.erb b/puppet/modules/backupninja/templates/sh.conf.erb
new file mode 100644
index 00000000..f1b4161a
--- /dev/null
+++ b/puppet/modules/backupninja/templates/sh.conf.erb
@@ -0,0 +1,10 @@
+#!/bin/sh
+#
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+<% @command_string.each_line do |line| -%>
+<%= line %>
+<% end -%>
diff --git a/puppet/modules/backupninja/templates/svn.conf.erb b/puppet/modules/backupninja/templates/svn.conf.erb
new file mode 100644
index 00000000..465cc673
--- /dev/null
+++ b/puppet/modules/backupninja/templates/svn.conf.erb
@@ -0,0 +1,10 @@
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+<% %w{src dest tmp vsname}.each do |v|
+	if send(v)
+		-%><%= v + ' = ' + send(v) + "\n" %><%
+	end
+end -%>
\ No newline at end of file
diff --git a/puppet/modules/backupninja/templates/sys.conf.erb b/puppet/modules/backupninja/templates/sys.conf.erb
new file mode 100644
index 00000000..a684e8b7
--- /dev/null
+++ b/puppet/modules/backupninja/templates/sys.conf.erb
@@ -0,0 +1,18 @@
+# This configuration file was auto-generated by the Puppet configuration
+# management system.  Any changes you make to this file will be overwritten
+# the next time Puppet runs.  Please make configuration changes to this
+# service in Puppet.
+
+<% %w{parentdir packagesfile partitionsfile hardwarefile}.each do |v|
+	if send(v)
+		-%><%= v + ' = ' + send(v) + "\n" %><%
+	end
+end -%>
+
+packages = <%= packages ? 'yes' : 'no' %>
+partitions = <%= partitions ? 'yes' : 'no' %>
+dosfdisk = <%= dosfdisk ? 'yes' : 'no' %>
+hardware = <%= hardware ? 'yes' : 'no' %>
+dohwinfo = <%= dohwinfo ? 'yes' : 'no' %>
+luksheaders = <%= doluks ? 'yes' : 'no' %>
+lvm = <%= dolvm ? 'yes' : 'no' %>
diff --git a/puppet/modules/backupninja/templates/umount.conf.erb b/puppet/modules/backupninja/templates/umount.conf.erb
new file mode 100644
index 00000000..59bfaec8
--- /dev/null
+++ b/puppet/modules/backupninja/templates/umount.conf.erb
@@ -0,0 +1 @@
+dir = <%= dest %>
diff --git a/puppet/modules/backupninja/templates/umount.handler b/puppet/modules/backupninja/templates/umount.handler
new file mode 100644
index 00000000..4fea195a
--- /dev/null
+++ b/puppet/modules/backupninja/templates/umount.handler
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+# Unmount the specified directory ('dir'), forcefully if necessary.
+
+getconf dir
+
+if ! umount $dir; then
+	warning "Simple unmount failed for $dir; being forceful"
+	if ! umount -f $dir; then
+		warning "Forceful unmount failed for $dir; being lazy"
+		if ! umount -l $dir; then
+			warning "Lazy unmount failed for $dir; you're on your own"
+		fi
+	fi
+fi
-- 
cgit v1.2.3


From a75fea409bf8e62e55ba341672c202aab5fa480e Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:31 -0400
Subject: git subrepo clone https://leap.se/git/puppet_sysctl
 puppet/modules/sysctl

subrepo:
  subdir:   "puppet/modules/sysctl"
  merged:   "975852b"
upstream:
  origin:   "https://leap.se/git/puppet_sysctl"
  branch:   "master"
  commit:   "975852b"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: Ica1925ea414df32850d0358ae17d6c704ae6fa7d
---
 puppet/modules/sysctl/.gitrepo            | 11 +++++++++++
 puppet/modules/sysctl/README              | 20 ++++++++++++++++++++
 puppet/modules/sysctl/manifests/config.pp | 18 ++++++++++++++++++
 puppet/modules/sysctl/manifests/init.pp   | 10 ++++++++++
 4 files changed, 59 insertions(+)
 create mode 100644 puppet/modules/sysctl/.gitrepo
 create mode 100644 puppet/modules/sysctl/README
 create mode 100644 puppet/modules/sysctl/manifests/config.pp
 create mode 100644 puppet/modules/sysctl/manifests/init.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/sysctl/.gitrepo b/puppet/modules/sysctl/.gitrepo
new file mode 100644
index 00000000..a6d7f8fe
--- /dev/null
+++ b/puppet/modules/sysctl/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_sysctl
+	branch = master
+	commit = 975852b7acc1125b4cd9d4d490b9abd8d31217e6
+	parent = 6a895ece94a86c9ccc32c9bec51413d4e4f0df8e
+	cmdver = 0.3.0
diff --git a/puppet/modules/sysctl/README b/puppet/modules/sysctl/README
new file mode 100644
index 00000000..a3980f70
--- /dev/null
+++ b/puppet/modules/sysctl/README
@@ -0,0 +1,20 @@
+sysctl module
+-------------
+
+This puppet module handles the setting of variables in sysctl.conf, its
+a simple module that utilizes the puppet augeas built-in type and the
+sysctl binary. You must have the augeas ruby libraries installed to 
+use this type.
+
+You can set a value and a comment for that value using this module,
+some examples:
+
+sysctl::config { "vm.mmap_min_addr":
+    value => 32768,
+    comment => "Never mmap into the first 32k of memory",
+} 
+
+sysctl::config { "fs.file-max":
+    value => 65536,
+    comment => "Maximum number of filehandles",
+} 
diff --git a/puppet/modules/sysctl/manifests/config.pp b/puppet/modules/sysctl/manifests/config.pp
new file mode 100644
index 00000000..79ddd295
--- /dev/null
+++ b/puppet/modules/sysctl/manifests/config.pp
@@ -0,0 +1,18 @@
+define sysctl::config ($value, $comment) {
+
+  include sysctl
+
+  augeas { "sysctl_${name}":
+    context => '/files/etc/sysctl.conf',
+    changes => [ "set ${name} ${value}", "insert #comment before ${name}",
+                 "set #comment[last()] '${comment}'" ],
+    onlyif  => "get ${name} != ${value}",
+    notify  => Exec["sysctl_${name}"],
+  }
+
+  exec { "sysctl_${name}":
+    command     => '/sbin/sysctl -p',
+    subscribe   => File['/etc/sysctl.conf'],
+    refreshonly => true,
+  }
+}
diff --git a/puppet/modules/sysctl/manifests/init.pp b/puppet/modules/sysctl/manifests/init.pp
new file mode 100644
index 00000000..43d9299e
--- /dev/null
+++ b/puppet/modules/sysctl/manifests/init.pp
@@ -0,0 +1,10 @@
+class sysctl {
+
+  file { '/etc/sysctl.conf':
+    ensure => present,
+    mode   => '0644',
+    owner  => root,
+    group  => root
+  }
+}
+
-- 
cgit v1.2.3


From 56a771a3008d10720dd05fd815aeafbacdd1e08e Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:32 -0400
Subject: git subrepo clone https://leap.se/git/puppet_check_mk
 puppet/modules/check_mk

subrepo:
  subdir:   "puppet/modules/check_mk"
  merged:   "aa02571"
upstream:
  origin:   "https://leap.se/git/puppet_check_mk"
  branch:   "master"
  commit:   "aa02571"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: I6cb060eb80966dd6ae346f7a8105289caa9ccbaf
---
 puppet/modules/check_mk/.gitignore                 |   3 +
 puppet/modules/check_mk/.gitrepo                   |  11 +
 puppet/modules/check_mk/Changelog                  |  27 +
 puppet/modules/check_mk/LICENSE                    | 674 +++++++++++++++++++++
 puppet/modules/check_mk/Modulefile                 |  10 +
 puppet/modules/check_mk/README.md                  | 268 ++++++++
 puppet/modules/check_mk/Rakefile                   |   2 +
 puppet/modules/check_mk/TODO                       |   5 +
 puppet/modules/check_mk/debian.md                  |  35 ++
 puppet/modules/check_mk/example.yaml               |  93 +++
 .../files/agent/local_checks/all_hosts/README.md   |   2 +
 puppet/modules/check_mk/files/use_ssh.mk           |   5 +
 puppet/modules/check_mk/manifests/agent.pp         |  70 +++
 puppet/modules/check_mk/manifests/agent/config.pp  |  59 ++
 .../check_mk/manifests/agent/generate_sshkey.pp    |  70 +++
 puppet/modules/check_mk/manifests/agent/install.pp |  70 +++
 .../check_mk/manifests/agent/install_local.pp      |  12 +
 .../check_mk/manifests/agent/local_checks.pp       |  11 +
 puppet/modules/check_mk/manifests/agent/mrpe.pp    |  19 +
 puppet/modules/check_mk/manifests/agent/ps.pp      |  17 +
 .../modules/check_mk/manifests/agent/register.pp   |   8 +
 puppet/modules/check_mk/manifests/agent/service.pp |   8 +
 puppet/modules/check_mk/manifests/config.pp        | 109 ++++
 puppet/modules/check_mk/manifests/host.pp          |  18 +
 puppet/modules/check_mk/manifests/hostgroup.pp     |  24 +
 puppet/modules/check_mk/manifests/htpasswd.pp      |  12 +
 puppet/modules/check_mk/manifests/init.pp          |  44 ++
 puppet/modules/check_mk/manifests/install.pp       |  50 ++
 .../modules/check_mk/manifests/install_tarball.pp  |  92 +++
 puppet/modules/check_mk/manifests/omd_repo.pp      |   6 +
 puppet/modules/check_mk/manifests/ps.pp            |  34 ++
 .../check_mk/manifests/server/collect_hosts.pp     |   6 +
 .../check_mk/manifests/server/collect_ps.pp        |  30 +
 .../check_mk/manifests/server/configure_ssh.pp     |  16 +
 puppet/modules/check_mk/manifests/service.pp       |  23 +
 .../modules/check_mk/templates/agent/check_mk.erb  |  39 ++
 puppet/modules/check_mk/templates/main.mk.erb      |   4 +
 puppet/modules/check_mk/templates/setup.conf.erb   |  29 +
 38 files changed, 2015 insertions(+)
 create mode 100644 puppet/modules/check_mk/.gitignore
 create mode 100644 puppet/modules/check_mk/.gitrepo
 create mode 100644 puppet/modules/check_mk/Changelog
 create mode 100644 puppet/modules/check_mk/LICENSE
 create mode 100644 puppet/modules/check_mk/Modulefile
 create mode 100644 puppet/modules/check_mk/README.md
 create mode 100644 puppet/modules/check_mk/Rakefile
 create mode 100644 puppet/modules/check_mk/TODO
 create mode 100644 puppet/modules/check_mk/debian.md
 create mode 100644 puppet/modules/check_mk/example.yaml
 create mode 100644 puppet/modules/check_mk/files/agent/local_checks/all_hosts/README.md
 create mode 100644 puppet/modules/check_mk/files/use_ssh.mk
 create mode 100644 puppet/modules/check_mk/manifests/agent.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/config.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/generate_sshkey.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/install.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/install_local.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/local_checks.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/mrpe.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/ps.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/register.pp
 create mode 100644 puppet/modules/check_mk/manifests/agent/service.pp
 create mode 100644 puppet/modules/check_mk/manifests/config.pp
 create mode 100644 puppet/modules/check_mk/manifests/host.pp
 create mode 100644 puppet/modules/check_mk/manifests/hostgroup.pp
 create mode 100644 puppet/modules/check_mk/manifests/htpasswd.pp
 create mode 100644 puppet/modules/check_mk/manifests/init.pp
 create mode 100644 puppet/modules/check_mk/manifests/install.pp
 create mode 100644 puppet/modules/check_mk/manifests/install_tarball.pp
 create mode 100644 puppet/modules/check_mk/manifests/omd_repo.pp
 create mode 100644 puppet/modules/check_mk/manifests/ps.pp
 create mode 100644 puppet/modules/check_mk/manifests/server/collect_hosts.pp
 create mode 100644 puppet/modules/check_mk/manifests/server/collect_ps.pp
 create mode 100644 puppet/modules/check_mk/manifests/server/configure_ssh.pp
 create mode 100644 puppet/modules/check_mk/manifests/service.pp
 create mode 100644 puppet/modules/check_mk/templates/agent/check_mk.erb
 create mode 100644 puppet/modules/check_mk/templates/main.mk.erb
 create mode 100644 puppet/modules/check_mk/templates/setup.conf.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/check_mk/.gitignore b/puppet/modules/check_mk/.gitignore
new file mode 100644
index 00000000..f6dc3f68
--- /dev/null
+++ b/puppet/modules/check_mk/.gitignore
@@ -0,0 +1,3 @@
+pkg/
+metadata.json
+*.swp
diff --git a/puppet/modules/check_mk/.gitrepo b/puppet/modules/check_mk/.gitrepo
new file mode 100644
index 00000000..05058447
--- /dev/null
+++ b/puppet/modules/check_mk/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_check_mk
+	branch = master
+	commit = aa02571537af90ac73309e6e216c9417802548c3
+	parent = a75fea409bf8e62e55ba341672c202aab5fa480e
+	cmdver = 0.3.0
diff --git a/puppet/modules/check_mk/Changelog b/puppet/modules/check_mk/Changelog
new file mode 100644
index 00000000..0b2f8a15
--- /dev/null
+++ b/puppet/modules/check_mk/Changelog
@@ -0,0 +1,27 @@
+0.3.0:
+
+* Added host tags to agent config so that host groups can be auto-populated
+
+* Fixed incorrect package name when using a file store that was causing the
+package existence check to fail always causing an often failing reinstall
+
+* Enable a static list of hosts to be specified for those without the Puppet
+check_mk module installed
+
+0.2.0:
+
+* Switched to using OMD rather than manually compiling check_mk
+
+* Added support for host tags and creating host groups based on these tags
+
+* Allow local check_mk configuration to be specified in
+/etc/check_mk/main.mk.local that is appended to /etc/check_mk/main.mk as
+check_mk can do a lot more than is covered by this module
+
+0.1.1:
+
+* Brown paper bag release to fix a silly typo
+
+0.1:
+
+* Initial release
diff --git a/puppet/modules/check_mk/LICENSE b/puppet/modules/check_mk/LICENSE
new file mode 100644
index 00000000..94a9ed02
--- /dev/null
+++ b/puppet/modules/check_mk/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<http://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<http://www.gnu.org/philosophy/why-not-lgpl.html>.
diff --git a/puppet/modules/check_mk/Modulefile b/puppet/modules/check_mk/Modulefile
new file mode 100644
index 00000000..60c355a3
--- /dev/null
+++ b/puppet/modules/check_mk/Modulefile
@@ -0,0 +1,10 @@
+name    'erwbgy-check_mk'
+version '0.3.0'
+source 'https://github.com/erwbgy/puppet-check_mk.git'
+author 'erwbgy'
+license 'Apache License, Version 2.0'
+summary 'install and configure check_mk'
+description 'Install and configure check_mk agent and Nagios plugin'
+project_page 'https://github.com/erwbgy/puppet-check_mk'
+dependency 'puppetlabs/stdlib', '>= 2.6.0'
+dependency 'ripienaar/concat', '>= 0.2.0'
diff --git a/puppet/modules/check_mk/README.md b/puppet/modules/check_mk/README.md
new file mode 100644
index 00000000..81e1bc87
--- /dev/null
+++ b/puppet/modules/check_mk/README.md
@@ -0,0 +1,268 @@
+# check_mk
+
+Puppet module for:
+
+* Installing and configuring the Open Monitoring Distribution (OMD) which
+  includes Nagios, check_mk and lots of other tools
+
+* Installing and configuring check_mk agents
+
+Agent hostnames are automatically added to the server all_hosts configuration
+using stored configs.
+
+Currently only tested on Redhat-like systems and on Debian.
+
+For examples how to use this class on a debian wheezy system, check out following 
+snippets: https://git.codecoop.org/snippets/1, https://git.codecoop.org/snippets/2
+
+## Server
+
+* Installs omd package either using the system repository (eg. yum, apt) or
+  from a package file retrieved from the Puppet file store
+
+* Use check_mk::omd_repo to enable a debian repository for omd
+  (requires apt module from i.e. https://labs.riseup.net/code/projects/shared-apt).
+  For now, you need to fetch the omd apt-key manually from 
+  http://labs.consol.de/nagios/omd-repository/, put it into your site_apt/files/keys
+  directory and pass the custom_key_dir parameter to the apt class, like 
+    
+
+    class { 'apt': 
+      custom_key_dir      => 'puppet:///modules/site-apt/keys'
+    }
+
+* Populates the all_hosts array in /etc/check_mk/main.mk with hostnames
+  exported by check::agent classes on agent hosts
+
+### Example 1
+
+    include check_mk
+
+Installs the 'monitoring' package from the system repository. The default 'monitoring' site is used.
+
+### Example 2
+
+    class { 'check_mk':
+      filestore => 'puppet:///files/check_mk',
+      package   => 'omd-0.56-rh60-29.x86_64.rpm'
+    }
+
+Installs the specified omd package after retrieving it from the Puppet file store.
+
+### Example 3
+
+    class { 'check_mk':
+      site => 'acme',
+    }
+
+Installs the omd package from the system repository.  A site called 'acme' is
+created making the URL http://hostname/acme/check_mk/ running as the 'acme' user.
+
+### check_mk parameters
+
+*package*: The omd package (rpm or deb) to install. Optional.
+
+*filestore*: The Puppet file store location where the package can be found (eg. 'puppet:///files/check_mk'). Optional.
+
+*host_groups*: A hash with the host group names as the keys with a list of host tags to match as values. (See 'Host groups and tags' below). Optional.
+
+*site*: The name of the omd site (and the user/group it runs as). Default: 'monitoring'
+
+*workspace*: The directory to use to store files used during installation.  Default: '/root/check_mk'
+
+*omdadmin_htpasswd*: changes the htpasswd of the amdadmin user (requires apache module from i.e. 
+                     https://labs.riseup.net/code/projects/shared-apache)
+
+*use_ssh*: Configures ssh to agents that use the same parameter.
+           Default: false.
+
+*inventory_only_on_changes*: By default (parameter set to `true`) these two execs are called
+                             only when config files changes:
+                               - Exec['check_mk-refresh'] (which runs a check inventory by calling `check_mk -II`)
+                               - Exec['check_mk-reload']  (which generates the nagios config and reloads nagios by calling `check_mk -O`)
+                             By setting this parameter to `false` these execs will be called on each puppetrun.
+
+### Notes
+
+* A user and group with the same value as the site parameter is created.  By default this is 'monitoring'.
+
+* The URL is http://yourhostname/sitename/check_mk/ - for example http://monhost.domain/monitoring/check_mk/
+
+* The default username/password is omdadmin/omd. To change this or add additional users log in as the site user and run htpasswd - for example:
+
+    monitoring$ htpasswd -b ~/etc/htpasswd guest guest
+
+* A user called 'guest' is configured as a guest user but is not enabled unless a password is set (as above).
+
+* RedHat-like RPM downloads from http://files.omdistro.org/releases/centos_rhel/
+
+## Agent
+
+* Installs the check_mk-agent and check_mk-agent-logwatch packages
+
+* Configures the /etc/xinetd.d/check_mk configuration file
+
+### Example 1
+
+    include check_mk::agent
+
+Installs the check_mk and check_mk_logwatch packages from the system repository
+and configures /etc/xinetd.d/check_mk with no IP whitelist restrictions.
+
+### Example 2
+
+    class { 'check_mk::agent':
+      version => '1.2.0p3-1',
+      ip_whitelist => [ '10.7.96.21', '10.7.96.22' ],
+    }
+
+Installs the specified versions of the check_mk and check_mk_logwatch packages
+after retrieving them from the Puppet file store.  Configures
+/etc/xinetd.d/check_mk so that only the specified IPs (and localhost/127.0.0.1)
+are allowed to connect.
+
+### check_mk::agent parameters
+
+*filestore*: The Puppet file store location where the packages can be found (eg. 'puppet:///files/check_mk'). Optional.
+
+*ip_whitelist*: The list of IP addresses that are allowed to retrieve check_mk
+data. (Note that localhost is always allowed to connect.) By default any IP can
+connect.
+
+*port*: The port the check_mk agent listens on. Default: '6556'
+
+*server_dir*: The directory in which the check_mk_agent executable is located.
+Default: '/usr/bin'
+
+*use_cache*: Whether or not to cache the results - useful with redundant
+monitoring server setups.  Default: 'false'
+
+*user*: The user that the agent runs as. Default: 'root'
+
+*version*: The version in the check_mk packages - for example if the RPM is
+'check_mk-agent-1.2.0p3-1.noarch.rpm' then the version is '1.2.0p3-1'.
+Only required if a filestore is used.
+
+*workspace*: The directory to use to store files used during installation.
+Default: '/root/check_mk'
+
+*method*:  "xinetd" (default) or "ssh"
+           "ssh": Use ssh instead of the tcp wrapper in order to allows the server to 
+           execute the agent on the client.
+
+*generate_sshkey*: true or false (default)
+
+           * Deploys ssh keypair on server (in /opt/omd/sites/monitoring/.ssh)
+           * Saves keypair on puppetmaster (/etc/puppet/modules/keys/files/check_mk_keys by default)
+           * Deploys public key on client in /root/.ssh/authorized_keys (restricting allows command to "/usr/bin/check_mk_agent")
+
+## Host groups and tags
+
+By default check_mk puts all hosts into a group called 'check_mk' but where you
+have more than a few you will often want your own groups.  We can do this by
+setting host tags on the agents and then configuring host groups on the server
+side to match hosts with these tags.
+
+For example in the hiera config for your agent hosts you could have:
+
+    check_mk::agent::host_tags:
+      - '%{osfamily}'
+
+and on the monitoring host you could have:
+
+    check_mk::host_groups:
+      RedHat:
+        description: 'RedHat or_CentOS hosts'
+        host_tags:
+          - RedHat
+      Debian:
+        description: 'Debian or Ubuntu_hosts'
+        host_tags:
+          - Debian
+      SuSE:
+        description: 'SuSE hosts'
+        host_tags:
+          - Suse
+
+You can of course have as many host tags as you like. I have custom facts for
+the server role and the environment type (dev, qa, stage, prod) and define
+groups based on the role and envtype host tags.
+
+Remember to run the Puppet agent on your agent hosts to export any host tags
+and run the Puppet agent on the monitoring host to pick up any changes to the
+host groups.
+
+## Static host config
+
+Hosts that do not run Puppet with the check_mk module are not automatically
+added to the all_hosts list in main.mk. To manually include these hosts you can
+add them to '/omd/sites/monitoring/etc/check_mk/all_hosts_static' (replacing
+'monitoring' with your site name).  Use the quoted fully qualified domain name
+with a two-space prefix and a comma suffix - for example:
+
+      'host1.domain',
+      'host2.domain',
+
+You can also include host tags - for example:
+
+      'host1.domain|windows|dev',
+      'host2.domain|windows|prod',
+
+Remember to run the Puppet agent on your monitoring host to pick up any changes.
+
+## Migrating from nagios-statd
+
+nagios-statd provides several features that can be replaced with check_mk
+plugins.
+
+*nagios-stat-proc*: checks processes on the agent system
+If you previously used the nagios puppet module to do something like:
+
+       check_command => 'nagios-stat-proc!/usr/sbin/foo!1!1!proc'
+
+you can now use the check_mk ps check:
+
+       check_mk::agent::ps {
+         'foo':
+           procname => '/usr/local/weirdpath/foo',
+           levels => '1, 2, 2, 3',
+           owner => 'alice'
+       }
+
+defaults:
+  procname: "/usr/sbin/${name}"
+  levels:   '1, 1, 1, 1'
+  owner: not required
+
+Run check_mk with '-M ps' for the manpage explaining the parameters.
+
+*swap*: check_mk has a 'mem.used' check which is enabled by default. But
+  as it's manpage explains if you want to measure swappiness you are
+  better off using the 'kernel' check and measuring 'Major Page Faults'
+  (pgmajfault).
+
+*disk*: check_mk has a 'df' check which is enabled by default.
+ 
+## Migrating from nrpe to mrpe
+
+If you were using nrpe to run a nagios plugin locally, first check if a
+native check_mk check exists with the same functionality, if not consider
+writing one. But if continuing to use the nagios plugin makes sense you
+can switch to mrpe.
+
+* Continue to deliver the plugin to the agent system
+* include check_mk::agent::mrpe
+* add a line to the mrpe.cfg file using augeas
+
+       augeas {
+         "Foo":
+           incl    => '/etc/check_mk/mrpe.cfg',
+           lens    => 'Spacevars.lns',
+           changes => 'set FOO /usr/local/lib/nagios/plugins/check_foo',
+           require => [ File['/usr/local/lib/nagios/plugins' ], Package['check-mk-agent'] ];
+       }
+
+
+This is the riseup clone, available at:
+
+git://labs.riseup.net/module_check_mk
diff --git a/puppet/modules/check_mk/Rakefile b/puppet/modules/check_mk/Rakefile
new file mode 100644
index 00000000..14f1c246
--- /dev/null
+++ b/puppet/modules/check_mk/Rakefile
@@ -0,0 +1,2 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/rake_tasks'
diff --git a/puppet/modules/check_mk/TODO b/puppet/modules/check_mk/TODO
new file mode 100644
index 00000000..1697f34b
--- /dev/null
+++ b/puppet/modules/check_mk/TODO
@@ -0,0 +1,5 @@
+Use nagios_hostgroup type rather than clumsily creating our own.
+Add support for ignored_services to eliminate false alerts.
+Implement support for choosing either upstream install or distro supplied
+  packages. If using distro packages, detect distro and set package names
+  to reasonable default (currently requires overriding).
diff --git a/puppet/modules/check_mk/debian.md b/puppet/modules/check_mk/debian.md
new file mode 100644
index 00000000..96d32a4e
--- /dev/null
+++ b/puppet/modules/check_mk/debian.md
@@ -0,0 +1,35 @@
+Examples for using this check_mk repository on debian
+=====================================================
+
+What it does
+============
+
+* ssh authentication is configured to allow the server to execute check_mk on the client
+* omd is installed on the server
+* check_mk is installed as package on the client
+
+On the client
+=============
+
+    class site_check_mk::client {
+      class { 'check_mk::agent':
+        agent_package_name          => 'check-mk-agent',
+        agent_logwatch_package_name => 'check-mk-agent-logwatch',
+        use_ssh                     => true,
+        register_agent              => false
+      }
+    }
+
+
+On the server
+=============
+
+    include check_mk::omd_repo
+    class { 'check_mk':
+      package           => 'omd',
+      omd_service_name  => 'omd-1.00',
+      http_service_name => 'apache2',
+      omdadmin_htpasswd => trocla("${::fqdn}_omdadmin"),
+      use_ssh           => true;
+    }
+
diff --git a/puppet/modules/check_mk/example.yaml b/puppet/modules/check_mk/example.yaml
new file mode 100644
index 00000000..de82ecc5
--- /dev/null
+++ b/puppet/modules/check_mk/example.yaml
@@ -0,0 +1,93 @@
+# Monitoring Server
+check_mk::filestore: 'puppet:///files/check_mk'
+check_mk::package:   'omd-0.56-rh60-29.x86_64.rpm'
+
+#check_parameters = [
+#  ( (95, 99), ALL_HOSTS, [ "fs_/boot" ]),
+#  ( (3192, 3584), ALL_HOSTS, [ "JVM PODDSv3 Memory" ]),
+#  ( (150, 200), ALL_HOSTS, [ "JVM PODDSv3 Threads" ]),
+#  ( (4000, 6000), [ 'coherence' ], ALL_HOSTS, [ "Number of threads" ]),
+#]
+# Defaults:
+#   hosts: ALL_HOSTS
+#   tags: undef
+check_mk::check_parameters:
+  'fs_/boot':
+    warning:  '95'
+    critical: '99'
+  'JVM MyApp Memory':
+    warning:  '3192'
+    critical: '3584'
+  'JVM MyApp Threads':
+    warning:  '150'
+    critical: '200'
+  'Number of threads':
+    tags: [ 'coherence' ]
+    warning: '4000'
+    critical: '6000'
+  'fs_/':
+    hosts: [ 'myhost1.domain.com', 'myhost2.domain.com' ]
+    warning:  '60'
+    critical: '70'    
+
+check_mk::host_groups:
+  'Puppet_Masters':
+    host_tags:
+      - 'puppet-master'
+
+  'My_App':
+    description: 'My Application'
+    host_tags:
+      - 'my-app'
+
+  'My_DB':
+    description: 'My Database'
+    host_tags:
+      - 'my-db'
+
+#ignored_services = [
+#  ( [ "windows" ], ALL_HOSTS, [ "LOG Security" ] ),
+#  ( ALL_HOSTS, [ "NFS mount /home/" ] )
+#]
+
+check_mk::ignored_services:
+  'LOG security':
+    tags:
+      'windows'
+  'NFS mount /home/':
+    hosts:
+      - 'lnxuser1.domain.com'
+      - 'lnxuser2.domain.com'
+
+# Monitoring Agent
+check_mk::agent::filestore: 'puppet:///files/check_mk'
+check_mk::agent::version: '1.2.0p3-1'
+
+# Set host tags based on built-in and custom facts
+check_mk::agent::host_tags:
+  - '%{envtype}'
+  - '%{kernel}'
+  - '%{role}'
+  - '%{location}'
+
+check_mk::agent::jolokia::server:   '127.0.0.1'
+check_mk::agent::jolokia::port:     '8080'
+check_mk::agent::jolokia::user:     'monitoring'
+check_mk::agent::jolokia::password: 'tinstaafl'
+check_mk::agent::jolokia::suburi:   'jolokia'
+
+check_mk::agent::jolokia::instances:
+  'My-App':
+    server: '10.0.0.1'
+    port:   '8190'
+
+check_mk::agent::logwatch::keep_defaults: 'true'
+check_mk::agent::logwatch::logfiles:
+  '/apps/tomcat1/logs/tomcat/catalina.*.log':
+    critical:
+      - '^SERVERE:'
+      - '^ERROR:'
+    warning:
+      - '^WARNING:'
+    ignore:
+      - '^INFO'
diff --git a/puppet/modules/check_mk/files/agent/local_checks/all_hosts/README.md b/puppet/modules/check_mk/files/agent/local_checks/all_hosts/README.md
new file mode 100644
index 00000000..f5234cbf
--- /dev/null
+++ b/puppet/modules/check_mk/files/agent/local_checks/all_hosts/README.md
@@ -0,0 +1,2 @@
+Place local checks in this directory, 
+see http://mathias-kettner.de/checkmk_localchecks.html
diff --git a/puppet/modules/check_mk/files/use_ssh.mk b/puppet/modules/check_mk/files/use_ssh.mk
new file mode 100644
index 00000000..b5d77c62
--- /dev/null
+++ b/puppet/modules/check_mk/files/use_ssh.mk
@@ -0,0 +1,5 @@
+# http://mathias-kettner.de/checkmk_datasource_programs.html
+datasource_programs = [
+ ( "ssh -l root -i /omd/sites/monitoring/.ssh/monitoring_<HOST>_id_rsa <IP> check_mk_agent", ['ssh'], ALL_HOSTS ),
+]
+
diff --git a/puppet/modules/check_mk/manifests/agent.pp b/puppet/modules/check_mk/manifests/agent.pp
new file mode 100644
index 00000000..64109ae9
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent.pp
@@ -0,0 +1,70 @@
+class check_mk::agent (
+  $filestore    = undef,
+  $host_tags    = undef,
+  $ip_whitelist = undef,
+  $port         = '6556',
+  $server_dir   = '/usr/bin',
+  $keydir       = '/omd/sites/monitoring',
+  $authdir      = '/omd/sites/monitoring',
+  $authfile     = undef,
+  $use_cache    = false,
+  $user         = 'root',
+  $version      = undef,
+  $workspace    = '/root/check_mk',
+  $agent_package_name           = 'check_mk-agent',
+  $agent_logwatch_package_name  = 'check_mk-agent-logwatch',
+  $method                       = 'xinetd',
+  $generate_sshkey              = false,
+  $sshuser                      = undef,
+  $use_ssh_tag                  = 'ssh',
+  $hostname                     = $::fqdn,
+  $register_agent               = true
+) {
+
+  case $method {
+    'xinetd': {
+      $tags = $host_tags
+      include check_mk::agent::service
+    }
+    'ssh': {
+      if ( $host_tags == undef ) or ( $host_tags == '' ) {
+        $tags = $use_ssh_tag
+      } else {
+        $tags = "${host_tags}|${use_ssh_tag}"
+      }
+    }
+    default: {}
+  }
+
+  class { 'check_mk::agent::install':
+    version                     => $version,
+    filestore                   => $filestore,
+    workspace                   => $workspace,
+    agent_package_name          => $agent_package_name,
+    agent_logwatch_package_name => $agent_logwatch_package_name,
+    method                      => $method
+  }
+
+  class { 'check_mk::agent::config':
+    ip_whitelist    => $ip_whitelist,
+    port            => $port,
+    server_dir      => $server_dir,
+    keydir          => $keydir,
+    authdir         => $authdir,
+    authfile        => $authfile,
+    use_cache       => $use_cache,
+    user            => $user,
+    method          => $method,
+    generate_sshkey => $generate_sshkey,
+    sshuser         => $sshuser,
+    hostname        => $hostname,
+    require         => Class['check_mk::agent::install'],
+  }
+
+  if ( $register_agent ) {
+    class { 'check_mk::agent::register':
+      host_tags => $tags,
+      hostname  => $hostname,
+    }
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/config.pp b/puppet/modules/check_mk/manifests/agent/config.pp
new file mode 100644
index 00000000..8ee5f185
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/config.pp
@@ -0,0 +1,59 @@
+class check_mk::agent::config (
+  $ip_whitelist    = '',
+  $port,
+  $server_dir,
+  $keydir,
+  $authdir,
+  $authfile        = undef,
+  $use_cache,
+  $user,
+  $method          = 'xinetd',
+  $generate_sshkey = false,
+  $sshuser         = undef,
+  $hostname        = $::fqdn
+) {
+  if $use_cache {
+    $server = "${server_dir}/check_mk_caching_agent"
+  } else {
+    $server = "${server_dir}/check_mk_agent"
+  }
+
+  case $method {
+    'xinetd': {
+      if $ip_whitelist {
+        $only_from = join($ip_whitelist, ' ')
+      } else {
+        $only_from = undef
+      }
+
+      file { '/etc/xinetd.d/check_mk':
+        ensure  => present,
+        owner   => 'root',
+        group   => 'root',
+        mode    => '0444',
+        content => template('check_mk/agent/check_mk.erb'),
+        require => Package['check_mk-agent','check_mk-agent-logwatch'],
+        notify  => Class['check_mk::agent::service'],
+      }
+    }
+
+    'ssh': {
+      if $generate_sshkey {
+        check_mk::agent::generate_sshkey { "check_mk_key_${hostname}":
+          keydir   => $keydir,
+          authdir  => $authdir,
+          authfile => $authfile,
+          sshuser  => $sshuser,
+          hostname => $hostname
+        }
+      }
+
+      # make sure the xinetd method is not configured
+      file { '/etc/xinetd.d/check_mk':
+        ensure  => absent;
+      }
+    }
+
+    default : {}
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/generate_sshkey.pp b/puppet/modules/check_mk/manifests/agent/generate_sshkey.pp
new file mode 100644
index 00000000..b00271f5
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/generate_sshkey.pp
@@ -0,0 +1,70 @@
+define check_mk::agent::generate_sshkey (
+  # dir on the check-mk-server where the collected key pairs are stored
+  $keydir,
+  # user/group the key should be owned by on the check-mk-server
+  $keyuser          = 'nagios',
+  $keygroup         = 'nagios',
+  # dir on the check-mk-agent where the authorized_keys file is stored
+  $authdir,
+  # name of the authorized_keys file
+  $authfile         = undef,
+  # dir on the puppetmaster where keys are stored
+  # FIXME: need a way to ensure this dir is setup on the puppetmaster correctly
+  #$ssh_key_basepath = "${common::moduledir::module_dir_path}/check_mk/keys",
+  #  for now use a dir we know works
+  $ssh_key_basepath = '/etc/puppet/modules/check_mk/keys',
+  # user on the client the check_mk server will ssh to, to run the agent
+  $sshuser          = 'root',
+  $hostname         = $::fqdn,
+  $check_mk_tag     = 'check_mk_sshkey'
+){
+
+  # generate check-mk ssh keypair, stored on puppetmaster
+  $ssh_key_name = "${hostname}_id_rsa"
+  $ssh_keys     = ssh_keygen("${ssh_key_basepath}/${ssh_key_name}")
+  $public       = split($ssh_keys[1],' ')
+  $public_type  = $public[0]
+  $public_key   = $public[1]
+  $secret_key   = $ssh_keys[0]
+
+  # if we're not root we need to use sudo
+  if $sshuser != 'root' {
+    $command = 'sudo /usr/bin/check_mk_agent'
+  } else {
+    $command = '/usr/bin/check_mk_agent'
+  }
+
+  # setup the public half of the key in authorized_keys on the agent
+  #  and restrict it to running only the agent
+  if $authdir or $authfile {
+    # if $authkey or $authdir are set, override authorized_keys path and file
+    # and also override using the built-in ssh_authorized_key since it may
+    # not be able to write to $authdir
+    sshd::ssh_authorized_key { $ssh_key_name:
+        type             => 'ssh-rsa',
+        key              => $public_key,
+        user             => $sshuser,
+        target           => "${authdir}/${authfile}",
+        override_builtin => true,
+        options          => "command=\"${command}\"";
+    }
+  } else {
+    # otherwise use the defaults
+    sshd::ssh_authorized_key { $ssh_key_name:
+        type    => 'ssh-rsa',
+        key     => $public_key,
+        user    => $sshuser,
+        options => "command=\"${command}\"";
+    }
+  }
+
+  # resource collector for the private half of the keys, these end up on
+  #  the check-mk-server host, and the user running check-mk needs access
+  @@file { "${keydir}/${ssh_key_name}":
+    content => $secret_key,
+    owner   => $keyuser,
+    group   => $keygroup,
+    mode    => '0600',
+    tag     => $check_mk_tag;
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/install.pp b/puppet/modules/check_mk/manifests/agent/install.pp
new file mode 100644
index 00000000..5c0b56ef
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/install.pp
@@ -0,0 +1,70 @@
+class check_mk::agent::install (
+  $version = '',
+  $filestore = '',
+  $workspace,
+  $agent_package_name,
+  $agent_logwatch_package_name,
+  $method = 'xinetd',
+) {
+  if $method == 'xinetd' {
+    if ! defined($require_method) {
+      package { 'xinetd':
+        ensure => latest,
+      }
+    }
+    $require_method = 'Package[\'xinetd\']'
+  } else {
+    $require_method = undef
+  }
+
+  if $filestore {
+    if ! defined(File[$workspace]) {
+      file { $workspace:
+        ensure => directory,
+      }
+    }
+    file { "${workspace}/check_mk-agent-${version}.noarch.rpm":
+      ensure  => latest,
+      source  => "${filestore}/check_mk-agent-${version}.noarch.rpm",
+      require => $require_method,
+    }
+    file { "${workspace}/check_mk-agent-logwatch-${version}.noarch.rpm":
+      ensure  => latest,
+      source  => "${filestore}/check_mk-agent-logwatch-${version}.noarch.rpm",
+      require => $require_method,
+    }
+    package { 'check_mk-agent':
+      ensure   => latest,
+      provider => 'rpm',
+      source   => "${workspace}/check_mk-agent-${version}.noarch.rpm",
+      require  => File["${workspace}/check_mk-agent-${version}.noarch.rpm"],
+    }
+    package { 'check_mk-agent-logwatch':
+      ensure   => latest,
+      provider => 'rpm',
+      source   => "${workspace}/check_mk-agent-logwatch-${version}.noarch.rpm",
+      require  => [
+        File["${workspace}/check_mk-agent-logwatch-${version}.noarch.rpm"],
+        Package['check_mk-agent'],
+      ],
+    }
+  }
+  else {
+    if $version {
+      $agent_package_version = $version
+    } else {
+      $agent_package_version = latest
+    }
+
+    package { 'check_mk-agent':
+      ensure  => $agent_package_version,
+      name    => $agent_package_name,
+      require => $require_method,
+    }
+    package { 'check_mk-agent-logwatch':
+      ensure  => $agent_package_version,
+      name    => $agent_logwatch_package_name,
+      require => Package['check_mk-agent'],
+    }
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/install_local.pp b/puppet/modules/check_mk/manifests/agent/install_local.pp
new file mode 100644
index 00000000..7238440f
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/install_local.pp
@@ -0,0 +1,12 @@
+define check_mk::agent::install_local($source=undef, $content=undef, $ensure='present') {
+  @file { "/usr/lib/check_mk_agent/local/${name}" :
+    ensure  => $ensure,
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0755',
+    content => $content,
+    source  => $source,
+    tag     => 'check_mk::local',
+    require => Package['check-mk-agent'],
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/local_checks.pp b/puppet/modules/check_mk/manifests/agent/local_checks.pp
new file mode 100644
index 00000000..04896b0a
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/local_checks.pp
@@ -0,0 +1,11 @@
+class check_mk::agent::local_checks{
+  file { '/usr/lib/check_mk_agent/local':
+    ensure  => directory,
+    source  => [
+      'puppet:///modules/site_check_mk/agent/local_checks/all_hosts',
+      'puppet:///modules/check_mk/agent/local_checks/all_hosts' ],
+    recurse => true,
+    require => Package['check_mk-agent'],
+  }
+
+}
diff --git a/puppet/modules/check_mk/manifests/agent/mrpe.pp b/puppet/modules/check_mk/manifests/agent/mrpe.pp
new file mode 100644
index 00000000..5bc5f331
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/mrpe.pp
@@ -0,0 +1,19 @@
+class check_mk::agent::mrpe {
+  # check_mk can use standard nagios plugins using
+  # a wrapper called mrpe
+  # see http://mathias-kettner.de/checkmk_mrpe.html
+  # this subclass is provided to be included by checks that use mrpe
+
+  # FIXME: this is Debian specific and should be made more generic
+  if !defined(Package['nagios-plugins-basic']) {
+    package { 'nagios-plugins-basic':
+      ensure => latest,
+    }
+  }
+
+  # ensure the config file exists, individual checks will add lines to it
+  file { '/etc/check_mk/mrpe.cfg':
+    ensure  => present,
+    require => Package['check-mk-agent']
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/ps.pp b/puppet/modules/check_mk/manifests/agent/ps.pp
new file mode 100644
index 00000000..67a999f5
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/ps.pp
@@ -0,0 +1,17 @@
+define check_mk::agent::ps (
+  # procname and levels have defaults in check_mk::ps
+  $procname = undef,
+  $levels = undef,
+  # user is optional
+  $user = undef
+) {
+
+  @@check_mk::ps { "${::fqdn}_${name}":
+    desc     => $name,
+    host     => $::fqdn,
+    procname => $procname,
+    user     => $user,
+    levels   => $levels,
+    tag      => 'check_mk_ps';
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/register.pp b/puppet/modules/check_mk/manifests/agent/register.pp
new file mode 100644
index 00000000..46cdeaee
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/register.pp
@@ -0,0 +1,8 @@
+class check_mk::agent::register (
+  $host_tags = '',
+  $hostname  = $::fqdn
+) {
+  @@check_mk::host { $hostname:
+    host_tags => $host_tags,
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/agent/service.pp b/puppet/modules/check_mk/manifests/agent/service.pp
new file mode 100644
index 00000000..0f707082
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/agent/service.pp
@@ -0,0 +1,8 @@
+class check_mk::agent::service {
+  if ! defined(Service['xinetd']) {
+    service { 'xinetd':
+      ensure => 'running',
+      enable => true,
+    }
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/config.pp b/puppet/modules/check_mk/manifests/config.pp
new file mode 100644
index 00000000..fba68361
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/config.pp
@@ -0,0 +1,109 @@
+# Deploy check_mk config
+class check_mk::config (
+  $site,
+  $host_groups               = undef,
+  $etc_dir                   = "/omd/sites/${site}/etc",
+  $nagios_subdir             = 'nagios',
+  $bin_dir                   = "/omd/sites/${site}/bin",
+  $use_storedconfigs         = true,
+  $inventory_only_on_changes = true
+) {
+  file {
+    # for local check_mk checks
+    "${etc_dir}/${nagios_subdir}/local":
+      ensure => directory;
+
+    # package provided and check_mk generated files, defined so the nagios
+    #  module doesn't purge them
+    "${etc_dir}/${nagios_subdir}/conf.d":
+      ensure => directory;
+    "${etc_dir}/${nagios_subdir}/conf.d/check_mk":
+      ensure => directory;
+  }
+  file_line { 'nagios-add-check_mk-cfg_dir':
+    ensure  => present,
+    line    => "cfg_dir=${etc_dir}/${nagios_subdir}/local",
+    path    => "${etc_dir}/${nagios_subdir}/nagios.cfg",
+    require => File["${etc_dir}/${nagios_subdir}/local"],
+    #notify  => Class['check_mk::service'],
+  }
+  file_line { 'add-guest-users':
+    ensure => present,
+    line   => 'guest_users = [ "guest" ]',
+    path   => "${etc_dir}/check_mk/multisite.mk",
+    #notify => Class['check_mk::service'],
+  }
+  concat { "${etc_dir}/check_mk/main.mk":
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0644',
+    notify => Exec['check_mk-refresh'],
+  }
+  # all_hosts
+  concat::fragment { 'all_hosts-header':
+    target  => "${etc_dir}/check_mk/main.mk",
+    content => "all_hosts = [\n",
+    order   => 10,
+  }
+  concat::fragment { 'all_hosts-footer':
+    target  => "${etc_dir}/check_mk/main.mk",
+    content => "]\n",
+    order   => 19,
+  }
+  if ( $use_storedconfigs ) {
+    class { 'check_mk::server::collect_hosts': }
+    class { 'check_mk::server::collect_ps': }
+  }
+
+
+  # local list of hosts is in /omd/sites/${site}/etc/check_mk/all_hosts_static and is appended
+  concat::fragment { 'all-hosts-static':
+    ensure => "${etc_dir}/check_mk/all_hosts_static",
+    target => "${etc_dir}/check_mk/main.mk",
+    order  => 18,
+  }
+  # host_groups
+  if $host_groups {
+    file { "${etc_dir}/nagios/local/hostgroups":
+      ensure => directory,
+    }
+    concat::fragment { 'host_groups-header':
+      target  => "${etc_dir}/check_mk/main.mk",
+      content => "host_groups = [\n",
+      order   => 20,
+    }
+    concat::fragment { 'host_groups-footer':
+      target  => "${etc_dir}/check_mk/main.mk",
+      content => "]\n",
+      order   => 29,
+    }
+    $groups = keys($host_groups)
+    check_mk::hostgroup { $groups:
+      dir        => "${etc_dir}/nagios/local/hostgroups",
+      hostgroups => $host_groups,
+      target     => "${etc_dir}/check_mk/main.mk",
+      notify     => Exec['check_mk-refresh']
+    }
+  }
+  # local config is in /omd/sites/${site}/etc/check_mk/main.mk.local and is appended
+  concat::fragment { 'check_mk-local-config':
+    ensure => "${etc_dir}/check_mk/main.mk.local",
+    target => "${etc_dir}/check_mk/main.mk",
+    order  => 99,
+  }
+  # re-read config if it changes
+  exec { 'check_mk-refresh':
+    command     => "/bin/su -l -c '${bin_dir}/check_mk -II' ${site}",
+    refreshonly => $inventory_only_on_changes,
+    notify      => Exec['check_mk-reload'],
+  }
+  exec { 'check_mk-reload':
+    command     => "/bin/su -l -c '${bin_dir}/check_mk -O' ${site}",
+    refreshonly => $inventory_only_on_changes,
+  }
+  # re-read inventory at least daily
+  exec { 'check_mk-refresh-inventory-daily':
+    command  => "/bin/su -l -c '${bin_dir}/check_mk -O' ${site}",
+    schedule => 'daily',
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/host.pp b/puppet/modules/check_mk/manifests/host.pp
new file mode 100644
index 00000000..49f038b5
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/host.pp
@@ -0,0 +1,18 @@
+define check_mk::host (
+  $target,
+  $host_tags = [],
+) {
+  $host = $title
+  if size($host_tags) > 0 {
+    $taglist = join(any2array($host_tags),'|')
+    $entry = "${host}|${taglist}"
+  }
+  else {
+    $entry = $host
+  }
+  concat::fragment { "check_mk-${host}":
+    target  => $target,
+    content => "  '${entry}',\n",
+    order   => 11,
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/hostgroup.pp b/puppet/modules/check_mk/manifests/hostgroup.pp
new file mode 100644
index 00000000..baec45f9
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/hostgroup.pp
@@ -0,0 +1,24 @@
+define check_mk::hostgroup (
+  $dir,
+  $hostgroups,
+  $target,
+) {
+  $group = $title
+  $group_tags = sprintf("'%s'", join($hostgroups[$group]['host_tags'], "', '"))
+  concat::fragment { "check_mk-hostgroup-${group}":
+    target  => $target,
+    content => "  ( '${group}', [ ${group_tags} ], ALL_HOSTS ),\n",
+    order   => 21,
+  }
+  if $hostgroups[$group]['description'] {
+    $description = $hostgroups[$group]['description']
+  }
+  else {
+    $description = regsubst($group, '_', ' ')
+  }
+  file { "${dir}/${group}.cfg":
+    ensure  => present,
+    content => "define hostgroup {\n  hostgroup_name ${group}\n  alias ${description}\n}\n",
+    require => File[$dir],
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/htpasswd.pp b/puppet/modules/check_mk/manifests/htpasswd.pp
new file mode 100644
index 00000000..2bd24cc5
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/htpasswd.pp
@@ -0,0 +1,12 @@
+class check_mk::htpasswd (
+  $password,
+  $username = 'omdadmin',
+  $path = '/opt/omd/sites/monitoring/etc/htpasswd' ) {
+
+  apache::htpasswd_user { $username:
+    ensure   => present,
+    username => $username,
+    password => $password,
+    path     => $path
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/init.pp b/puppet/modules/check_mk/manifests/init.pp
new file mode 100644
index 00000000..4aab837d
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/init.pp
@@ -0,0 +1,44 @@
+# configure check_mk server
+class check_mk (
+  $filestore                 = undef,
+  $host_groups               = undef,
+  $package                   = 'omd-0.56',
+  $site                      = 'monitoring',
+  $workspace                 = '/root/check_mk',
+  $omd_service_name          = 'omd',
+  $http_service_name         = 'httpd',
+  $xinitd_service_name       = 'xinetd',
+  $omdadmin_htpasswd         = undef,
+  $use_ssh                   = false,
+  $shelluser                 = 'monitoring',
+  $shellgroup                = 'monitoring',
+  $use_storedconfigs         = true,
+  $inventory_only_on_changes = true) {
+
+  class { 'check_mk::install':
+    filestore => $filestore,
+    package   => $package,
+    site      => $site,
+    workspace => $workspace,
+  }
+  class { 'check_mk::config':
+    host_groups               => $host_groups,
+    site                      => $site,
+    use_storedconfigs         => $use_storedconfigs,
+    inventory_only_on_changes => $inventory_only_on_changes,
+    require                   => Class['check_mk::install'],
+  }
+  class { 'check_mk::service':
+    require   => Class['check_mk::config'],
+  }
+  if $omdadmin_htpasswd {
+    class { 'check_mk::htpasswd':
+      password => $omdadmin_htpasswd
+    }
+  }
+
+  if ( $use_ssh == true ) {
+    class { 'check_mk::server::configure_ssh': }
+  }
+
+}
diff --git a/puppet/modules/check_mk/manifests/install.pp b/puppet/modules/check_mk/manifests/install.pp
new file mode 100644
index 00000000..5f8a4a0d
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/install.pp
@@ -0,0 +1,50 @@
+class check_mk::install (
+  $filestore = '',
+  $version = '',
+  $package,
+  $site,
+  $workspace,
+) {
+  if $filestore {
+    if ! defined(File[$workspace]) {
+      file { $workspace:
+        ensure => directory,
+      }
+    }
+    file { "${workspace}/${package}":
+      ensure  => latest,
+      source  => "${filestore}/${package}",
+      require => File[$workspace],
+    }
+    # omd-0.56-rh60-29.x86_64.rpm
+    if $package =~ /^(omd-\d+\.\d+)-(.*?)\.(rpm|deb)$/ {
+      $package_name = $1
+      $type         = $3
+      package { $package_name:
+        ensure   => installed,
+        provider => $type,
+        source   => "${workspace}/${package}",
+        require  => File["${workspace}/${package}"],
+      }
+    }
+  }
+  else {
+    $package_name = $package
+
+    if $version {
+      $server_package_version = $version
+    } else {
+      $server_package_version = latest
+    }
+
+    package { $package_name:
+      ensure => $server_package_version,
+    }
+  }
+  $etc_dir = "/omd/sites/${site}/etc"
+  exec { 'omd-create-site':
+    command => "/usr/bin/omd create ${site}",
+    creates => $etc_dir,
+    require => Package[$package_name],
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/install_tarball.pp b/puppet/modules/check_mk/manifests/install_tarball.pp
new file mode 100644
index 00000000..af40a267
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/install_tarball.pp
@@ -0,0 +1,92 @@
+class check_mk::install_tarball (
+  $filestore,
+  $version,
+  $workspace,
+) {
+  package { 'nagios':
+    ensure => present,
+    notify => Exec['set-nagiosadmin-password', 'set-guest-password', 'add-apache-to-nagios-group'],
+  }
+  file { '/etc/nagios/passwd':
+    ensure => present,
+    owner  => 'root',
+    group  => 'apache',
+    mode   => '0640',
+  }
+  exec { 'set-nagiosadmin-password':
+    command     => '/usr/bin/htpasswd -b /etc/nagios/passwd nagiosadmin letmein',
+    refreshonly => true,
+    require     => File['/etc/nagios/passwd'],
+  }
+  exec { 'set-guest-password':
+    command     => '/usr/bin/htpasswd -b /etc/nagios/passwd guest guest',
+    refreshonly => true,
+    require     => File['/etc/nagios/passwd'],
+  }
+  exec { 'add-apache-to-nagios-group':
+    command     => '/usr/sbin/usermod -a -G nagios apache',
+    refreshonly => true,
+  }
+  package { 'nagios-plugins-all':
+    ensure  => present,
+    require => Package['nagios'],
+  }
+  # FIXME: this should get and check $use_ssh before requiring xinetd
+  package { [ 'xinetd', 'mod_python', 'make', 'gcc-c++', 'tar', 'gzip' ]:
+    ensure  => present,
+  }
+  file { "${workspace}/check_mk-${version}.tar.gz":
+    ensure  => present,
+    source  => "${filestore}/check_mk-${version}.tar.gz",
+  }
+  exec { 'unpack-check_mk-tarball':
+    command     => "/bin/tar -zxf ${workspace}/check_mk-${version}.tar.gz",
+    cwd         => $workspace,
+    creates     => "${workspace}/check_mk-${version}",
+    require     => File["${workspace}/check_mk-${version}.tar.gz"],
+  }
+  exec { 'change-setup-config-location':
+    command => "/usr/bin/perl -pi -e 's#^SETUPCONF=.*?$#SETUPCONF=${workspace}/check_mk_setup.conf#' ${workspace}/check_mk-${version}/setup.sh",
+    unless  => "/bin/egrep '^SETUPCONF=${workspace}/check_mk_setup.conf$' ${workspace}/check_mk-${version}/setup.sh",
+    require => Exec['unpack-check_mk-tarball'],
+  }
+  # Avoid header like 'Written by setup of check_mk 1.2.0p3 at Thu Feb  7 12:26:17 GMT 2013'
+  # that changes every time the setup script is run
+  exec { 'remove-setup-header':
+    command => "/usr/bin/perl -pi -e 's#^DIRINFO=.*?$#DIRINFO=#' ${workspace}/check_mk-${version}/setup.sh",
+    unless  => "/bin/egrep '^DIRINFO=$' ${workspace}/check_mk-${version}/setup.sh",
+    require => Exec['unpack-check_mk-tarball'],
+  }
+  file { "${workspace}/check_mk_setup.conf":
+    ensure  => present,
+    content => template('check_mk/setup.conf.erb'),
+    notify  => Exec['check_mk-setup'],
+  }
+  file { '/etc/nagios/check_mk':
+    ensure  => directory,
+    owner   => 'nagios',
+    group   => 'nagios',
+    recurse => true,
+    require => Package['nagios'],
+  }
+  file { '/etc/nagios/check_mk/hostgroups':
+    ensure  => directory,
+    owner   => 'nagios',
+    group   => 'nagios',
+    require => File['/etc/nagios/check_mk'],
+  }
+  exec { 'check_mk-setup':
+    command     => "${workspace}/check_mk-${version}/setup.sh --yes",
+    cwd         => "${workspace}/check_mk-${version}",
+    refreshonly => true,
+    require     => [
+      Exec['change-setup-config-location'],
+      Exec['remove-setup-header'],
+      Exec['unpack-check_mk-tarball'],
+      File["${workspace}/check_mk_setup.conf"],
+      File['/etc/nagios/check_mk'],
+      Package['nagios'],
+    ],
+    notify      => Class['check_mk::service'],
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/omd_repo.pp b/puppet/modules/check_mk/manifests/omd_repo.pp
new file mode 100644
index 00000000..2100f378
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/omd_repo.pp
@@ -0,0 +1,6 @@
+class check_mk::omd_repo {
+  apt::sources_list { 'omd.list':
+    content => "deb http://labs.consol.de/OMD/debian ${::lsbdistcodename} main",
+    before  => Package['omd']
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/ps.pp b/puppet/modules/check_mk/manifests/ps.pp
new file mode 100644
index 00000000..1171a135
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/ps.pp
@@ -0,0 +1,34 @@
+define check_mk::ps (
+  $target,
+  $host,
+  $desc,
+  $procname = "/usr/sbin/${desc}",
+  $levels = '1, 1, 1, 1',
+  $user = undef
+) {
+  # This class is called on check-mk agent machines in order to create
+  # checks using the built-in ps check type. They create stored configs
+  # and then the check_mk::server::collect_ps class on the server
+  # generates the config file to set them up
+
+  # lines in the ps.mk config file look like
+  # ( "foo.example.com", "ps", "NAME", ( "/usr/sbin/foo", 1, 1, 1, 1 ) )
+  # or with a user
+  # ( "foo.example.com", "ps", "NAME", ( "/usr/sbin/foo", "user", 1, 1, 1, 1 ) )
+  if $user {
+    $check = "  ( \"${host}\", \"ps\", \"${desc}\", ( \"${procname}\", ${user}, ${levels} ) ),\n"
+  } else {
+    $check = "  ( \"${host}\", \"ps\", \"${desc}\", ( \"${procname}\", ${levels} ) ),\n"
+  }
+
+  # FIXME: we could be smarter about this and consolidate host checks
+  # that have identical settings and that would make the config file
+  # make more sense for humans. but for now we'll just do separate
+  # lines (which may result in a very large file, but check-mk is fine)
+  concat::fragment { "check_mk_ps-${host}_${desc}":
+    target  => $target,
+    content => $check,
+    order   => 20
+  }
+}
+
diff --git a/puppet/modules/check_mk/manifests/server/collect_hosts.pp b/puppet/modules/check_mk/manifests/server/collect_hosts.pp
new file mode 100644
index 00000000..6d07897b
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/server/collect_hosts.pp
@@ -0,0 +1,6 @@
+class check_mk::server::collect_hosts {
+  Check_mk::Host <<| |>> {
+    target => "${::check_mk::config::etc_dir}/check_mk/main.mk",
+    notify => Exec['check_mk-refresh']
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/server/collect_ps.pp b/puppet/modules/check_mk/manifests/server/collect_ps.pp
new file mode 100644
index 00000000..067a25c9
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/server/collect_ps.pp
@@ -0,0 +1,30 @@
+class check_mk::server::collect_ps (
+  $config = "${::check_mk::config::etc_dir}/check_mk/conf.d/ps.mk"
+) {
+
+  # this class gets run on the check-mk server in order to collect the
+  # stored configs created on clients and assemble the ps.mk config file
+  concat { $config:
+    owner  => 'root',
+    group  => 'root',
+    mode   => '0644',
+    notify => Exec['check_mk-refresh'],
+  }
+
+  concat::fragment{'check_mk_ps_header':
+    target  => $config,
+    content => "checks += [\n",
+    order   => 10,
+  }
+
+  Check_mk::Ps <<| tag == 'check_mk_ps' |>> {
+    target => $config,
+    notify => Exec['check_mk-refresh']
+  }
+
+  concat::fragment{'check_mk_ps_footer':
+    target  => $config,
+    content => "]\n",
+    order   => 90,
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/server/configure_ssh.pp b/puppet/modules/check_mk/manifests/server/configure_ssh.pp
new file mode 100644
index 00000000..987cc7af
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/server/configure_ssh.pp
@@ -0,0 +1,16 @@
+class check_mk::server::configure_ssh (
+  $check_mk_tag     = 'check_mk_sshkey'
+) {
+  # collect exported files from client::generate_sshkey
+  File <<| tag == $check_mk_tag |>>
+
+  # configure ssh access to agents which have 'ssh' tags
+  file { "${check_mk::config::etc_dir}/check_mk/conf.d/use_ssh.mk":
+    source => [ 'puppet:///modules/site_check_mk/use_ssh.mk',
+                'puppet:///modules/check_mk/use_ssh.mk' ],
+    owner  => $::check_mk::shelluser,
+    group  => $::check_mk::shellgroup,
+    mode   => '0644',
+    notify => Exec['check_mk-refresh']
+  }
+}
diff --git a/puppet/modules/check_mk/manifests/service.pp b/puppet/modules/check_mk/manifests/service.pp
new file mode 100644
index 00000000..36fb2d16
--- /dev/null
+++ b/puppet/modules/check_mk/manifests/service.pp
@@ -0,0 +1,23 @@
+class check_mk::service {
+
+  if ! defined(Service[$check_mk::http_service_name]) {
+    service { $check_mk::http_service_name:
+      ensure => 'running',
+      enable => true,
+    }
+  }
+  # FIXME: this should get and check $use_ssh before doing this
+  if ! defined(Service[xinetd]) {
+    service { 'xinetd':
+      ensure    => 'running',
+      name      => $check_mk::xinitd_service_name,
+      hasstatus => false,
+      enable    => true,
+    }
+  }
+  service { 'omd':
+    ensure => 'running',
+    name   => $check_mk::omd_service_name,
+    enable => true,
+  }
+}
diff --git a/puppet/modules/check_mk/templates/agent/check_mk.erb b/puppet/modules/check_mk/templates/agent/check_mk.erb
new file mode 100644
index 00000000..47824a9f
--- /dev/null
+++ b/puppet/modules/check_mk/templates/agent/check_mk.erb
@@ -0,0 +1,39 @@
+# +------------------------------------------------------------------+
+# |             ____ _               _        __  __ _  __           |
+# |            / ___| |__   ___  ___| | __   |  \/  | |/ /           |
+# |           | |   | '_ \ / _ \/ __| |/ /   | |\/| | ' /            |
+# |           | |___| | | |  __/ (__|   <    | |  | | . \            |
+# |            \____|_| |_|\___|\___|_|\_\___|_|  |_|_|\_\           |
+# |                                                                  |
+# | Copyright Mathias Kettner 2012             mk@mathias-kettner.de |
+# +------------------------------------------------------------------+
+#
+# This file is part of Check_MK.
+# The official homepage is at http://mathias-kettner.de/check_mk.
+#
+# check_mk is free software;  you can redistribute it and/or modify it
+# under the  terms of the  GNU General Public License  as published by
+# the Free Software Foundation in version 2.  check_mk is  distributed
+# in the hope that it will be useful, but WITHOUT ANY WARRANTY;  with-
+# out even the implied warranty of  MERCHANTABILITY  or  FITNESS FOR A
+# PARTICULAR PURPOSE. See the  GNU General Public License for more de-
+# ails.  You should have  received  a copy of the  GNU  General Public
+# License along with GNU Make; see the file  COPYING.  If  not,  write
+# to the Free Software Foundation, Inc., 51 Franklin St,  Fifth Floor,
+# Boston, MA 02110-1301 USA.
+
+service check_mk
+{
+	type           = UNLISTED
+	port           = <%= @port %>
+	socket_type    = stream
+	protocol       = tcp
+	wait           = no
+	user           = <%= @user %>
+	server         = <%= @server %>
+<% if @only_from -%>
+	only_from      = 127.0.0.1 <%= @only_from %>
+<% end -%>
+	log_on_success =
+	disable        = no
+}
diff --git a/puppet/modules/check_mk/templates/main.mk.erb b/puppet/modules/check_mk/templates/main.mk.erb
new file mode 100644
index 00000000..e1fbe81c
--- /dev/null
+++ b/puppet/modules/check_mk/templates/main.mk.erb
@@ -0,0 +1,4 @@
+all_hosts = [
+  'lnxmgt-01.sbetenv.ads',
+  'lnxmgt-02.sbetenv.ads',
+]
diff --git a/puppet/modules/check_mk/templates/setup.conf.erb b/puppet/modules/check_mk/templates/setup.conf.erb
new file mode 100644
index 00000000..41e1143b
--- /dev/null
+++ b/puppet/modules/check_mk/templates/setup.conf.erb
@@ -0,0 +1,29 @@
+
+bindir='/usr/bin'
+confdir='/etc/check_mk'
+sharedir='/usr/share/check_mk'
+docdir='/usr/share/doc/check_mk'
+checkmandir='/usr/share/doc/check_mk/checks'
+vardir='/var/lib/check_mk'
+agentslibdir='/usr/lib/check_mk_agent'
+agentsconfdir='/etc/check_mk'
+nagiosuser='nagios'
+wwwuser='apache'
+wwwgroup='nagios'
+nagios_binary='/usr/sbin/nagios'
+nagios_config_file='/etc/nagios/nagios.cfg'
+nagconfdir='/etc/nagios/check_mk'
+nagios_startscript='/etc/init.d/nagios'
+nagpipe='/var/spool/nagios/cmd/nagios.cmd'
+check_result_path='/var/log/nagios/spool/checkresults'
+nagios_status_file='/var/log/nagios/status.dat'
+check_icmp_path='/usr/lib64/nagios/plugins/check_icmp'
+url_prefix='/'
+apache_config_dir='/etc/httpd/conf.d'
+htpasswd_file='/etc/nagios/passwd'
+nagios_auth_name='Nagios Access'
+pnptemplates='/usr/share/nagios/html/pnp4nagios/templates'
+enable_livestatus='yes'
+libdir='/usr/lib/check_mk'
+livesock='/var/spool/nagios/cmd/live'
+livebackendsdir='/usr/share/check_mk/livestatus'
-- 
cgit v1.2.3


From fae09e7fad7bc3230dc6184d256ddcd58b4484c7 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 16:46:34 -0400
Subject: git subrepo clone https://leap.se/git/puppet_systemd
 puppet/modules/systemd

subrepo:
  subdir:   "puppet/modules/systemd"
  merged:   "6d47fd4"
upstream:
  origin:   "https://leap.se/git/puppet_systemd"
  branch:   "master"
  commit:   "6d47fd4"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "1e79595"

Change-Id: If71ec55d9f038b04fcab6d4ce5620db89168f75c
---
 puppet/modules/systemd/.gitignore                  | 10 ++++
 puppet/modules/systemd/.gitrepo                    | 11 ++++
 puppet/modules/systemd/.puppet-lint.rc             |  5 ++
 puppet/modules/systemd/.sync.yml                   |  3 +
 puppet/modules/systemd/.travis.yml                 | 32 +++++++++++
 puppet/modules/systemd/CHANGELOG.md                | 65 ++++++++++++++++++++++
 puppet/modules/systemd/Gemfile                     | 47 ++++++++++++++++
 puppet/modules/systemd/HISTORY.md                  | 62 +++++++++++++++++++++
 puppet/modules/systemd/README.md                   | 38 +++++++++++++
 puppet/modules/systemd/Rakefile                    | 23 ++++++++
 puppet/modules/systemd/manifests/init.pp           | 18 ++++++
 puppet/modules/systemd/metadata.json               | 48 ++++++++++++++++
 .../acceptance/nodesets/centos-5-x86_64-docker.yml | 15 +++++
 .../acceptance/nodesets/centos-6-x86_64-docker.yml | 15 +++++
 .../nodesets/centos-6-x86_64-openstack.yml         | 14 +++++
 .../nodesets/centos-6-x86_64-vagrant.yml           | 11 ++++
 .../acceptance/nodesets/centos-7-x86_64-docker.yml | 15 +++++
 .../nodesets/centos-7-x86_64-openstack.yml         | 14 +++++
 .../nodesets/centos-7-x86_64-vagrant.yml           | 11 ++++
 .../acceptance/nodesets/debian-6-x86_64-docker.yml | 15 +++++
 .../nodesets/debian-6-x86_64-openstack.yml         | 14 +++++
 .../nodesets/debian-6-x86_64-vagrant.yml           | 11 ++++
 .../acceptance/nodesets/debian-7-x86_64-docker.yml | 15 +++++
 .../nodesets/debian-7-x86_64-openstack.yml         | 14 +++++
 .../nodesets/debian-7-x86_64-vagrant.yml           | 11 ++++
 .../acceptance/nodesets/debian-8-x86_64-docker.yml | 15 +++++
 .../nodesets/debian-8-x86_64-openstack.yml         | 14 +++++
 .../nodesets/debian-8-x86_64-vagrant.yml           | 11 ++++
 .../nodesets/ubuntu-10.04-x86_64-docker.yml        | 13 +++++
 .../nodesets/ubuntu-12.04-x86_64-docker.yml        | 15 +++++
 .../nodesets/ubuntu-12.04-x86_64-openstack.yml     | 14 +++++
 .../nodesets/ubuntu-14.04-x86_64-docker.yml        | 15 +++++
 .../nodesets/ubuntu-14.04-x86_64-openstack.yml     | 14 +++++
 .../nodesets/ubuntu-14.04-x86_64-vagrant.yml       | 11 ++++
 .../nodesets/ubuntu-14.10-x86_64-docker.yml        | 15 +++++
 .../nodesets/ubuntu-14.10-x86_64-openstack.yml     | 14 +++++
 .../nodesets/ubuntu-15.04-x86_64-docker.yml        | 15 +++++
 .../nodesets/ubuntu-15.04-x86_64-openstack.yml     | 14 +++++
 puppet/modules/systemd/spec/spec.opts              |  6 ++
 puppet/modules/systemd/spec/spec_helper.rb         | 42 ++++++++++++++
 40 files changed, 765 insertions(+)
 create mode 100644 puppet/modules/systemd/.gitignore
 create mode 100644 puppet/modules/systemd/.gitrepo
 create mode 100644 puppet/modules/systemd/.puppet-lint.rc
 create mode 100644 puppet/modules/systemd/.sync.yml
 create mode 100644 puppet/modules/systemd/.travis.yml
 create mode 100644 puppet/modules/systemd/CHANGELOG.md
 create mode 100644 puppet/modules/systemd/Gemfile
 create mode 100644 puppet/modules/systemd/HISTORY.md
 create mode 100644 puppet/modules/systemd/README.md
 create mode 100644 puppet/modules/systemd/Rakefile
 create mode 100644 puppet/modules/systemd/manifests/init.pp
 create mode 100644 puppet/modules/systemd/metadata.json
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/centos-5-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-vagrant.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-vagrant.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-10.04-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-12.04-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-12.04-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.10-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.10-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-15.04-x86_64-docker.yml
 create mode 100644 puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-15.04-x86_64-openstack.yml
 create mode 100644 puppet/modules/systemd/spec/spec.opts
 create mode 100644 puppet/modules/systemd/spec/spec_helper.rb

(limited to 'puppet/modules')

diff --git a/puppet/modules/systemd/.gitignore b/puppet/modules/systemd/.gitignore
new file mode 100644
index 00000000..65839fa0
--- /dev/null
+++ b/puppet/modules/systemd/.gitignore
@@ -0,0 +1,10 @@
+pkg/
+Gemfile.lock
+vendor/
+spec/fixtures/
+.vagrant/
+.bundle/
+coverage/
+log/
+.*.swp
+*~
diff --git a/puppet/modules/systemd/.gitrepo b/puppet/modules/systemd/.gitrepo
new file mode 100644
index 00000000..1548a815
--- /dev/null
+++ b/puppet/modules/systemd/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_systemd
+	branch = master
+	commit = 6d47fd4999fe03eba6fb11c4490dcbb90d937900
+	parent = 56a771a3008d10720dd05fd815aeafbacdd1e08e
+	cmdver = 0.3.0
diff --git a/puppet/modules/systemd/.puppet-lint.rc b/puppet/modules/systemd/.puppet-lint.rc
new file mode 100644
index 00000000..d8f5c59e
--- /dev/null
+++ b/puppet/modules/systemd/.puppet-lint.rc
@@ -0,0 +1,5 @@
+--fail-on-warnings
+--relative
+--no-80chars
+--no-documentation
+--no-class_inherits_from_params_class-check
diff --git a/puppet/modules/systemd/.sync.yml b/puppet/modules/systemd/.sync.yml
new file mode 100644
index 00000000..5fffcb05
--- /dev/null
+++ b/puppet/modules/systemd/.sync.yml
@@ -0,0 +1,3 @@
+---
+.travis.yml:
+  forge_password: "ASTRdmLjJNa1NvHy2LRGvmvUeth6W3Fh/alYWvcvI8nDDsdkweHk0iXhcXZwtMQReb0NI5vJiRNXNy7a3XySC4+SP3hfHuDU58H2FqC4Ff0EHRPRHTEiXf7xmN53RxXYXZQvrFfqUb6tIsBNVKVmsYWNe01k8NVKPyYDfQB75PQ="
diff --git a/puppet/modules/systemd/.travis.yml b/puppet/modules/systemd/.travis.yml
new file mode 100644
index 00000000..467045c5
--- /dev/null
+++ b/puppet/modules/systemd/.travis.yml
@@ -0,0 +1,32 @@
+---
+language: ruby
+sudo: false
+cache: bundler
+bundler_args: --without system_tests
+script: ["bundle exec rake validate", "bundle exec rake lint", "bundle exec rake spec SPEC_OPTS='--format documentation'", "bundle exec rake metadata"]
+matrix:
+  fast_finish: true
+  include:
+  - rvm: 1.8.7
+    env: PUPPET_GEM_VERSION="~> 3.0" FACTER_GEM_VERSION="~> 1.7.0"
+  - rvm: 1.9.3
+    env: PUPPET_GEM_VERSION="~> 3.0"
+  - rvm: 2.0.0
+    env: PUPPET_GEM_VERSION="~> 3.0"
+  - rvm: 2.0.0
+    env: PUPPET_GEM_VERSION="~> 3.0" FUTURE_PARSER="yes"
+  - rvm: 2.1.6
+    env: PUPPET_GEM_VERSION="~> 4.0"
+notifications:
+  email: false
+deploy:
+  provider: puppetforge
+  user: camptocamp
+  password:
+    secure: "ASTRdmLjJNa1NvHy2LRGvmvUeth6W3Fh/alYWvcvI8nDDsdkweHk0iXhcXZwtMQReb0NI5vJiRNXNy7a3XySC4+SP3hfHuDU58H2FqC4Ff0EHRPRHTEiXf7xmN53RxXYXZQvrFfqUb6tIsBNVKVmsYWNe01k8NVKPyYDfQB75PQ="
+  on:
+    tags: true
+    # all_branches is required to use tags
+    all_branches: true
+    # Only publish if our main Ruby target builds
+    rvm: 1.9.3
diff --git a/puppet/modules/systemd/CHANGELOG.md b/puppet/modules/systemd/CHANGELOG.md
new file mode 100644
index 00000000..11e84399
--- /dev/null
+++ b/puppet/modules/systemd/CHANGELOG.md
@@ -0,0 +1,65 @@
+# Change Log
+
+## [0.2.2](https://forge.puppetlabs.com/camptocamp/systemd/0.2.2) (2015-08-25)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.2.1...0.2.2)
+
+**Implemented enhancements:**
+
+- Add 'systemd-tmpfiles-create' [\#1](https://github.com/camptocamp/puppet-systemd/pull/1) ([roidelapluie](https://github.com/roidelapluie))
+
+
+## [0.2.1](https://forge.puppetlabs.com/camptocamp/systemd/0.2.1) (2015-08-21)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.2.0...0.2.1)
+
+- Use docker for acceptance tests
+
+## [0.1.15](https://forge.puppetlabs.com/camptocamp/systemd/0.1.15) (2015-06-26)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.14...0.1.15)
+
+- Fix strict_variables activation with rspec-puppet 2.2
+
+## [0.1.14](https://forge.puppetlabs.com/camptocamp/systemd/0.1.14) (2015-05-28)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.13...0.1.14)
+
+- Add beaker_spec_helper to Gemfile
+
+## [0.1.13](https://forge.puppetlabs.com/camptocamp/systemd/0.1.13) (2015-05-26)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.12...0.1.13)
+
+- Use random application order in nodeset
+
+## [0.1.12](https://forge.puppetlabs.com/camptocamp/systemd/0.1.12) (2015-05-26)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.11...0.1.12)
+
+- Add utopic & vivid nodesets
+
+## [0.1.11](https://forge.puppetlabs.com/camptocamp/systemd/0.1.11) (2015-05-25)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.10...0.1.11)
+
+- Don't allow failure on Puppet 4
+
+## [0.1.10](https://forge.puppetlabs.com/camptocamp/systemd/0.1.10) (2015-05-13)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.9...0.1.10)
+
+- Add puppet-lint-file_source_rights-check gem
+
+## [0.1.9](https://forge.puppetlabs.com/camptocamp/systemd/0.1.9) (2015-05-12)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.8...0.1.9)
+
+- Don't pin beaker
+
+## [0.1.8](https://forge.puppetlabs.com/camptocamp/systemd/0.1.8) (2015-04-27)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.7...0.1.8)
+
+- Add nodeset ubuntu-12.04-x86_64-openstack
+
+## [0.1.7](https://forge.puppetlabs.com/camptocamp/systemd/0.1.7) (2015-04-03)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.6...0.1.7)
+
+- Confine rspec pinning to ruby 1.8
+
+
+\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
+
+
+\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
\ No newline at end of file
diff --git a/puppet/modules/systemd/Gemfile b/puppet/modules/systemd/Gemfile
new file mode 100644
index 00000000..0cb59337
--- /dev/null
+++ b/puppet/modules/systemd/Gemfile
@@ -0,0 +1,47 @@
+source ENV['GEM_SOURCE'] || "https://rubygems.org"
+
+group :development, :unit_tests do
+  gem 'rake',                                              :require => false
+  gem 'rspec', '< 3.2',                                    :require => false if RUBY_VERSION =~ /^1.8/
+  gem 'rspec-puppet',                                      :require => false
+  gem 'puppetlabs_spec_helper',                            :require => false
+  gem 'metadata-json-lint',                                :require => false
+  gem 'puppet-lint',                                       :require => false
+  gem 'puppet-lint-unquoted_string-check',                 :require => false
+  gem 'puppet-lint-empty_string-check',                    :require => false
+  gem 'puppet-lint-spaceship_operator_without_tag-check',  :require => false
+  gem 'puppet-lint-variable_contains_upcase',              :require => false
+  gem 'puppet-lint-absolute_classname-check',              :require => false
+  gem 'puppet-lint-undef_in_function-check',               :require => false
+  gem 'puppet-lint-leading_zero-check',                    :require => false
+  gem 'puppet-lint-trailing_comma-check',                  :require => false
+  gem 'puppet-lint-file_ensure-check',                     :require => false
+  gem 'puppet-lint-version_comparison-check',              :require => false
+  gem 'puppet-lint-fileserver-check',                      :require => false
+  gem 'puppet-lint-file_source_rights-check',              :require => false
+  gem 'puppet-lint-alias-check',                           :require => false
+  gem 'rspec-puppet-facts',                                :require => false
+  gem 'github_changelog_generator',                        :require => false, :git => 'https://github.com/raphink/github-changelog-generator.git', :branch => 'dev/all_patches' if RUBY_VERSION !~ /^1.8/
+  gem 'puppet-blacksmith',                                 :require => false if RUBY_VERSION !~ /^1.8/
+end
+
+group :system_tests do
+  gem 'beaker',              :require => false
+  gem 'beaker-rspec',        :require => false
+  gem 'beaker_spec_helper',  :require => false
+  gem 'serverspec',          :require => false
+end
+
+if facterversion = ENV['FACTER_GEM_VERSION']
+  gem 'facter', facterversion, :require => false
+else
+  gem 'facter', :require => false
+end
+
+if puppetversion = ENV['PUPPET_GEM_VERSION']
+  gem 'puppet', puppetversion, :require => false
+else
+  gem 'puppet', :require => false
+end
+
+# vim:ft=ruby
diff --git a/puppet/modules/systemd/HISTORY.md b/puppet/modules/systemd/HISTORY.md
new file mode 100644
index 00000000..c7bf2b4e
--- /dev/null
+++ b/puppet/modules/systemd/HISTORY.md
@@ -0,0 +1,62 @@
+## [0.2.2](https://forge.puppetlabs.com/camptocamp/systemd/0.2.2) (2015-08-25)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.2.1...0.2.2)
+
+**Implemented enhancements:**
+
+- Add 'systemd-tmpfiles-create' [\#1](https://github.com/camptocamp/puppet-systemd/pull/1) ([roidelapluie](https://github.com/roidelapluie))
+
+## [0.2.1](https://forge.puppetlabs.com/camptocamp/systemd/0.2.1) (2015-08-21)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.2.0...0.2.1)
+
+- Use docker for acceptance tests
+
+## [0.1.15](https://forge.puppetlabs.com/camptocamp/systemd/0.1.15) (2015-06-26)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.14...0.1.15)
+
+- Fix strict_variables activation with rspec-puppet 2.2
+
+## [0.1.14](https://forge.puppetlabs.com/camptocamp/systemd/0.1.14) (2015-05-28)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.13...0.1.14)
+
+- Add beaker_spec_helper to Gemfile
+
+## [0.1.13](https://forge.puppetlabs.com/camptocamp/systemd/0.1.13) (2015-05-26)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.12...0.1.13)
+
+- Use random application order in nodeset
+
+## [0.1.12](https://forge.puppetlabs.com/camptocamp/systemd/0.1.12) (2015-05-26)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.11...0.1.12)
+
+- Add utopic & vivid nodesets
+
+## [0.1.11](https://forge.puppetlabs.com/camptocamp/systemd/0.1.11) (2015-05-25)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.10...0.1.11)
+
+- Don't allow failure on Puppet 4
+
+## [0.1.10](https://forge.puppetlabs.com/camptocamp/systemd/0.1.10) (2015-05-13)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.9...0.1.10)
+
+- Add puppet-lint-file_source_rights-check gem
+
+## [0.1.9](https://forge.puppetlabs.com/camptocamp/systemd/0.1.9) (2015-05-12)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.8...0.1.9)
+
+- Don't pin beaker
+
+## [0.1.8](https://forge.puppetlabs.com/camptocamp/systemd/0.1.8) (2015-04-27)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.7...0.1.8)
+
+- Add nodeset ubuntu-12.04-x86_64-openstack
+
+## [0.1.7](https://forge.puppetlabs.com/camptocamp/systemd/0.1.7) (2015-04-03)
+[Full Changelog](https://github.com/camptocamp/puppet-systemd/compare/0.1.6...0.1.7)
+
+- Confine rspec pinning to ruby 1.8
+
+
+\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
+
+
+\* *This Change Log was automatically generated by [github_changelog_generator](https://github.com/skywinder/Github-Changelog-Generator)*
diff --git a/puppet/modules/systemd/README.md b/puppet/modules/systemd/README.md
new file mode 100644
index 00000000..f70bcb0c
--- /dev/null
+++ b/puppet/modules/systemd/README.md
@@ -0,0 +1,38 @@
+# Systemd
+
+[![Puppet Forge](http://img.shields.io/puppetforge/v/camptocamp/systemd.svg)](https://forge.puppetlabs.com/camptocamp/systemd)
+[![Build Status](https://travis-ci.org/camptocamp/puppet-systemd.png?branch=master)](https://travis-ci.org/camptocamp/puppet-systemd)
+
+## Overview
+
+This module declares exec resources that you can use when you change systemd units or configuration files.
+
+## Examples
+
+### systemctl --daemon-reload
+
+```puppet
+include ::systemd
+file { '/usr/lib/systemd/system/foo.service':
+  ensure => file,
+  owner  => 'root',
+  group  => 'root',
+  mode   => '0644',
+  source => "puppet:///modules/${module_name}/foo.service",
+} ~>
+Exec['systemctl-daemon-reload']
+```
+
+### systemd-tmpfiles --create
+
+```puppet
+include ::systemd
+file { '/etc/tmpfiles.d/foo.conf':
+  ensure => file,
+  owner  => 'root',
+  group  => 'root',
+  mode   => '0644',
+  source => "puppet:///modules/${module_name}/foo.conf",
+} ~>
+Exec['systemd-tmpfiles-create']
+```
diff --git a/puppet/modules/systemd/Rakefile b/puppet/modules/systemd/Rakefile
new file mode 100644
index 00000000..adcac180
--- /dev/null
+++ b/puppet/modules/systemd/Rakefile
@@ -0,0 +1,23 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+
+Rake::Task[:lint].clear
+PuppetLint::RakeTask.new :lint do |config|
+  config.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp", "vendor/**/*.pp"]
+  config.disable_checks = ['80chars']
+  config.fail_on_warnings = true
+end
+
+PuppetSyntax.exclude_paths = ["spec/fixtures/**/*.pp", "vendor/**/*"]
+
+# Publishing tasks
+unless RUBY_VERSION =~ /^1\.8/
+  require 'puppet_blacksmith'
+  require 'puppet_blacksmith/rake_tasks'
+  require 'github_changelog_generator/task'
+  GitHubChangelogGenerator::RakeTask.new :changelog do |config|
+    m = Blacksmith::Modulefile.new
+    config.future_release = m.version
+    config.release_url = "https://forge.puppetlabs.com/#{m.author}/#{m.name}/%s"
+  end
+end
diff --git a/puppet/modules/systemd/manifests/init.pp b/puppet/modules/systemd/manifests/init.pp
new file mode 100644
index 00000000..5e6ad792
--- /dev/null
+++ b/puppet/modules/systemd/manifests/init.pp
@@ -0,0 +1,18 @@
+class systemd {
+
+  Exec {
+    refreshonly => true,
+    path        => $::path,
+  }
+
+  exec {
+    'systemctl-daemon-reload':
+      command => 'systemctl daemon-reload',
+  }
+
+  exec {
+    'systemd-tmpfiles-create':
+      command => 'systemd-tmpfiles --create',
+  }
+
+}
diff --git a/puppet/modules/systemd/metadata.json b/puppet/modules/systemd/metadata.json
new file mode 100644
index 00000000..abdd481e
--- /dev/null
+++ b/puppet/modules/systemd/metadata.json
@@ -0,0 +1,48 @@
+{
+  "name": "camptocamp-systemd",
+  "version": "0.2.2",
+  "author": "camptocamp",
+  "summary": "Puppet Systemd module",
+  "license": "Apache-2.0",
+  "source": "https://github.com/camptocamp/puppet-systemd",
+  "project_page": "https://github.com/camptocamp/puppet-systemd",
+  "issues_url": "https://github.com/camptocamp/puppet-systemd/issues",
+  "dependencies": [
+
+  ],
+  "requirements": [
+    {
+      "name": "pe",
+      "version_requirement": "3.x"
+    },
+    {
+      "name": "puppet",
+      "version_requirement": "3.x"
+    }
+  ],
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "Debian",
+      "operatingsystemrelease": [
+        "8"
+      ]
+    },
+    {
+      "operatingsystem": "RedHat",
+      "operatingsystemrelease": [
+        "7"
+      ]
+    }
+  ],
+  "puppet_version": [
+    "2.7",
+    "3.0",
+    "3.1",
+    "3.2",
+    "3.3",
+    "3.4",
+    "3.5",
+    "3.6",
+    "3.7"
+  ]
+}
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/centos-5-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/centos-5-x86_64-docker.yml
new file mode 100644
index 00000000..679afb04
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/centos-5-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  centos-5-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-5-x86_64
+    hypervisor : docker
+    image: centos:5
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'yum install -y crontabs tar wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-docker.yml
new file mode 100644
index 00000000..9cab03d0
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  centos-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-6-x86_64
+    hypervisor : docker
+    image: centos:6
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'yum install -y crontabs tar wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-openstack.yml
new file mode 100644
index 00000000..e325b9e9
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  centos-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-6-x86_64
+    hypervisor : openstack
+    flavor: m1.small
+    image: centos-6-latest
+    user: root
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-vagrant.yml b/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-vagrant.yml
new file mode 100644
index 00000000..f06036ec
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/centos-6-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  centos-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-6-x86_64
+    hypervisor : vagrant
+    box : camptocamp/centos-6-x86_64
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-docker.yml
new file mode 100644
index 00000000..0bc97271
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : docker
+    image: centos:7
+    docker_preserve_image: true
+    docker_cmd: '["/usr/sbin/init"]'
+    docker_image_commands:
+      - 'yum install -y crontabs tar wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml
new file mode 100644
index 00000000..9003c867
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : openstack
+    flavor: m1.small
+    image: centos-7-latest
+    user: centos
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml b/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml
new file mode 100644
index 00000000..95402e54
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/centos-7-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  centos-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: el-7-x86_64
+    hypervisor : vagrant
+    box : camptocamp/centos-7-x86_64
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-docker.yml
new file mode 100644
index 00000000..359dae7d
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  debian-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-6-amd64
+    hypervisor : docker
+    image: debian:6
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-openstack.yml
new file mode 100644
index 00000000..c6c192fe
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  debian-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-6-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: debian-6-latest
+    user: debian
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml
new file mode 100644
index 00000000..03db0fa7
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-6-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  debian-6-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-6-amd64
+    hypervisor : vagrant
+    box : puppetlabs/debian-6.0.10-64-nocm
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-docker.yml
new file mode 100644
index 00000000..fc11f574
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : docker
+    image: debian:7
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y cron wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml
new file mode 100644
index 00000000..017b4c74
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: debian-7-latest
+    user: debian
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml
new file mode 100644
index 00000000..8ed1264d
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-7-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  debian-7-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-7-amd64
+    hypervisor : vagrant
+    box : camptocamp/debian-7-amd64
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-docker.yml
new file mode 100644
index 00000000..86a55e15
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  debian-8-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-8-amd64
+    hypervisor : docker
+    image: debian:8
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y cron wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml
new file mode 100644
index 00000000..003b6f4b
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  debian-8-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-8-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: debian-8-latest
+    user: debian
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-vagrant.yml b/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-vagrant.yml
new file mode 100644
index 00000000..5cc7f0c5
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/debian-8-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  debian-8-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: debian-8-amd64
+    hypervisor : vagrant
+    box : camptocamp/debian-8-amd64
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-10.04-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-10.04-x86_64-docker.yml
new file mode 100644
index 00000000..933dee60
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-10.04-x86_64-docker.yml
@@ -0,0 +1,13 @@
+HOSTS:
+  ubuntu-1004-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-10.04-amd64
+    hypervisor : docker
+    image: ubuntu:10.04
+    # This stops the image from being deleted on completion, speeding up the process.
+    docker_preserve_image: true
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-12.04-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-12.04-x86_64-docker.yml
new file mode 100644
index 00000000..f0ec72b8
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-12.04-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  ubuntu-1204-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-12.04-amd64
+    hypervisor : docker
+    image: ubuntu:12.04
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-12.04-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-12.04-x86_64-openstack.yml
new file mode 100644
index 00000000..f81b04b7
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-12.04-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  ubuntu-1204-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-12.04-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: ubuntu-1204-latest
+    user: ubuntu
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-docker.yml
new file mode 100644
index 00000000..6fb9281e
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  ubuntu-1404-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.04-amd64
+    hypervisor : docker
+    image: ubuntu:14.04
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-openstack.yml
new file mode 100644
index 00000000..2eeb912d
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  ubuntu-1404-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.04-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: ubuntu-1404-latest
+    user: ubuntu
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml
new file mode 100644
index 00000000..3b376953
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.04-x86_64-vagrant.yml
@@ -0,0 +1,11 @@
+HOSTS:
+  ubuntu-1404-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.04-amd64
+    hypervisor : vagrant
+    box : puppetlabs/ubuntu-14.04-64-nocm
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.10-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.10-x86_64-docker.yml
new file mode 100644
index 00000000..2be425c5
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.10-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  ubuntu-1410-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.10-amd64
+    hypervisor : docker
+    image: ubuntu:14.10
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.10-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.10-x86_64-openstack.yml
new file mode 100644
index 00000000..58a2acd2
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-14.10-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  ubuntu-1410-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-14.10-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: ubuntu-1410-latest
+    user: ubuntu
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-15.04-x86_64-docker.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-15.04-x86_64-docker.yml
new file mode 100644
index 00000000..caed722c
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-15.04-x86_64-docker.yml
@@ -0,0 +1,15 @@
+HOSTS:
+  ubuntu-1504-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-15.04-amd64
+    hypervisor : docker
+    image: ubuntu:15.04
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget'
+CONFIG:
+  type: foss
+  log_level: debug
diff --git a/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-15.04-x86_64-openstack.yml b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-15.04-x86_64-openstack.yml
new file mode 100644
index 00000000..22ef76c4
--- /dev/null
+++ b/puppet/modules/systemd/spec/acceptance/nodesets/ubuntu-15.04-x86_64-openstack.yml
@@ -0,0 +1,14 @@
+HOSTS:
+  ubuntu-1504-x64:
+    default_apply_opts:
+      order: random
+      strict_variables:
+    platform: ubuntu-15.04-amd64
+    hypervisor : openstack
+    flavor: m1.small
+    image: ubuntu-1504-latest
+    user: ubuntu
+CONFIG:
+  type: foss
+  log_level: debug
+  openstack_network: default
diff --git a/puppet/modules/systemd/spec/spec.opts b/puppet/modules/systemd/spec/spec.opts
new file mode 100644
index 00000000..91cd6427
--- /dev/null
+++ b/puppet/modules/systemd/spec/spec.opts
@@ -0,0 +1,6 @@
+--format
+s
+--colour
+--loadby
+mtime
+--backtrace
diff --git a/puppet/modules/systemd/spec/spec_helper.rb b/puppet/modules/systemd/spec/spec_helper.rb
new file mode 100644
index 00000000..94d30d5c
--- /dev/null
+++ b/puppet/modules/systemd/spec/spec_helper.rb
@@ -0,0 +1,42 @@
+require 'puppetlabs_spec_helper/module_spec_helper'
+require 'rspec-puppet-facts'
+include RspecPuppetFacts
+
+
+RSpec.configure do |c|
+  c.include PuppetlabsSpec::Files
+
+  c.before :each do
+    # Store any environment variables away to be restored later
+    @old_env = {}
+    ENV.each_key {|k| @old_env[k] = ENV[k]}
+
+    c.strict_variables = Gem::Version.new(Puppet.version) >= Gem::Version.new('3.5')
+    Puppet.features.stubs(:root?).returns(true)
+  end
+
+  c.after :each do
+    PuppetlabsSpec::Files.cleanup
+  end
+end
+
+require 'pathname'
+dir = Pathname.new(__FILE__).parent
+Puppet[:modulepath] = File.join(dir, 'fixtures', 'modules')
+
+# There's no real need to make this version dependent, but it helps find
+# regressions in Puppet
+#
+# 1. Workaround for issue #16277 where default settings aren't initialised from
+# a spec and so the libdir is never initialised (3.0.x)
+# 2. Workaround for 2.7.20 that now only loads types for the current node
+# environment (#13858) so Puppet[:modulepath] seems to get ignored
+# 3. Workaround for 3.5 where context hasn't been configured yet,
+# ticket https://tickets.puppetlabs.com/browse/MODULES-823
+#
+ver = Gem::Version.new(Puppet.version.split('-').first)
+if Gem::Requirement.new("~> 2.7.20") =~ ver || Gem::Requirement.new("~> 3.0.0") =~ ver || Gem::Requirement.new("~> 3.5") =~ ver || Gem::Requirement.new("~> 4.0")
+  puts "augeasproviders: setting Puppet[:libdir] to work around broken type autoloading"
+  # libdir is only a single dir, so it can only workaround loading of one external module
+  Puppet[:libdir] = "#{Puppet[:modulepath]}/augeasproviders_core/lib"
+end
-- 
cgit v1.2.3


From f3f78ebaf5f3fd3233bc35596fefb51f6e5ed9d9 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 13 Jun 2016 20:11:23 +0200
Subject: Notify Exec[shorewall_check] not Service[shorew..]

Latest shorewall module does `shorewall check` (executed
by `Exec[shorewall_check]`) so every related resource change
must notify this Exec instead of `Service[shorewall]` as before.
---
 puppet/modules/site_couchdb/manifests/init.pp                 | 2 +-
 puppet/modules/site_nickserver/manifests/init.pp              | 2 +-
 puppet/modules/site_shorewall/manifests/defaults.pp           | 7 ++++---
 puppet/modules/site_shorewall/manifests/eip.pp                | 3 ++-
 puppet/modules/site_shorewall/manifests/ip_forward.pp         | 3 ++-
 puppet/modules/site_shorewall/manifests/mx.pp                 | 3 ++-
 puppet/modules/site_shorewall/manifests/obfsproxy.pp          | 2 +-
 puppet/modules/site_shorewall/manifests/service/webapp_api.pp | 2 +-
 puppet/modules/site_shorewall/manifests/soledad.pp            | 3 ++-
 puppet/modules/site_shorewall/manifests/sshd.pp               | 2 +-
 puppet/modules/site_shorewall/manifests/stunnel/server.pp     | 2 +-
 puppet/modules/site_shorewall/manifests/tor.pp                | 2 +-
 puppet/modules/site_sshd/manifests/mosh.pp                    | 3 ++-
 13 files changed, 21 insertions(+), 15 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_couchdb/manifests/init.pp b/puppet/modules/site_couchdb/manifests/init.pp
index 554bf813..5a73ae87 100644
--- a/puppet/modules/site_couchdb/manifests/init.pp
+++ b/puppet/modules/site_couchdb/manifests/init.pp
@@ -42,7 +42,7 @@ class site_couchdb {
   include site_couchdb::plain
 
   Class['site_config::default']
-    -> Service['shorewall']
+    -> Exec['shorewall_check']
     -> Exec['refresh_stunnel']
     -> Class['couchdb']
     -> Class['site_couchdb::setup']
diff --git a/puppet/modules/site_nickserver/manifests/init.pp b/puppet/modules/site_nickserver/manifests/init.pp
index eb4415e7..ad97f829 100644
--- a/puppet/modules/site_nickserver/manifests/init.pp
+++ b/puppet/modules/site_nickserver/manifests/init.pp
@@ -149,7 +149,7 @@ class site_nickserver {
 
   file { '/etc/shorewall/macro.nickserver':
     content => "PARAM   -       -       tcp    ${nickserver_port}",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall'];
   }
 
diff --git a/puppet/modules/site_shorewall/manifests/defaults.pp b/puppet/modules/site_shorewall/manifests/defaults.pp
index ceb17868..725e0880 100644
--- a/puppet/modules/site_shorewall/manifests/defaults.pp
+++ b/puppet/modules/site_shorewall/manifests/defaults.pp
@@ -1,3 +1,4 @@
+# Configure basic firewall rules for shorewall
 class site_shorewall::defaults {
 
   include shorewall
@@ -55,7 +56,7 @@ class site_shorewall::defaults {
     mode    => '0644',
     source  => 'puppet:///modules/site_shorewall/Debian/shorewall.service',
     require => Package['shorewall'],
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     } ~>
     Exec['systemctl-daemon-reload']
 
@@ -66,14 +67,14 @@ class site_shorewall::defaults {
       lens    => 'Shellvars.lns',
       incl    => '/etc/shorewall/shorewall.conf',
       require => Package['shorewall'],
-      notify  => Service['shorewall'];
+      notify  => Exec['shorewall_check'];
     # require that the interface exist
     'shorewall_REQUIRE_INTERFACE':
       changes => 'set /files/etc/shorewall/shorewall.conf/REQUIRE_INTERFACE Yes',
       lens    => 'Shellvars.lns',
       incl    => '/etc/shorewall/shorewall.conf',
       require => Package['shorewall'],
-      notify  => Service['shorewall'];
+      notify  => Exec['shorewall_check'];
     # configure shorewall-init
     'shorewall-init':
       changes => 'set /files/etc/default/shorewall-init/PRODUCTS shorewall',
diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp
index 8fbba658..21934761 100644
--- a/puppet/modules/site_shorewall/manifests/eip.pp
+++ b/puppet/modules/site_shorewall/manifests/eip.pp
@@ -1,3 +1,4 @@
+# Configure shorewall on eip/vpn nodes
 class site_shorewall::eip {
 
   include site_shorewall::defaults
@@ -9,7 +10,7 @@ class site_shorewall::eip {
     content => "PARAM   -       -       tcp     1194
     PARAM   -       -       udp     1194
     ",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall']
   }
 
diff --git a/puppet/modules/site_shorewall/manifests/ip_forward.pp b/puppet/modules/site_shorewall/manifests/ip_forward.pp
index d53ee8a5..beb1f055 100644
--- a/puppet/modules/site_shorewall/manifests/ip_forward.pp
+++ b/puppet/modules/site_shorewall/manifests/ip_forward.pp
@@ -1,10 +1,11 @@
+# Configure ip forwarding for shorewall
 class site_shorewall::ip_forward {
   include augeas
   augeas { 'enable_ip_forwarding':
     changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING Yes',
     lens    => 'Shellvars.lns',
     incl    => '/etc/shorewall/shorewall.conf',
-    notify  => Service[shorewall],
+    notify  => Exec['shorewall_check'],
     require => [ Class[augeas], Package[shorewall] ];
   }
 }
diff --git a/puppet/modules/site_shorewall/manifests/mx.pp b/puppet/modules/site_shorewall/manifests/mx.pp
index 332f164e..2500668f 100644
--- a/puppet/modules/site_shorewall/manifests/mx.pp
+++ b/puppet/modules/site_shorewall/manifests/mx.pp
@@ -1,3 +1,4 @@
+# Configure leap-mx shorewall rules
 class site_shorewall::mx {
 
   include site_shorewall::defaults
@@ -7,7 +8,7 @@ class site_shorewall::mx {
   # define macro for incoming services
   file { '/etc/shorewall/macro.leap_mx':
     content => "PARAM   -       -       tcp    ${smtpd_ports} ",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall']
   }
 
diff --git a/puppet/modules/site_shorewall/manifests/obfsproxy.pp b/puppet/modules/site_shorewall/manifests/obfsproxy.pp
index 75846705..3c82dc40 100644
--- a/puppet/modules/site_shorewall/manifests/obfsproxy.pp
+++ b/puppet/modules/site_shorewall/manifests/obfsproxy.pp
@@ -10,7 +10,7 @@ class site_shorewall::obfsproxy {
   # define macro for incoming services
   file { '/etc/shorewall/macro.leap_obfsproxy':
     content => "PARAM   -       -       tcp    ${scram_port} ",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall']
   }
 
diff --git a/puppet/modules/site_shorewall/manifests/service/webapp_api.pp b/puppet/modules/site_shorewall/manifests/service/webapp_api.pp
index d3a1aeed..e3ae4200 100644
--- a/puppet/modules/site_shorewall/manifests/service/webapp_api.pp
+++ b/puppet/modules/site_shorewall/manifests/service/webapp_api.pp
@@ -7,7 +7,7 @@ class site_shorewall::service::webapp_api {
   # define macro for incoming services
   file { '/etc/shorewall/macro.leap_webapp_api':
     content => "PARAM   -       -       tcp    ${api_port} ",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall']
   }
 
diff --git a/puppet/modules/site_shorewall/manifests/soledad.pp b/puppet/modules/site_shorewall/manifests/soledad.pp
index 518d8689..5bee07af 100644
--- a/puppet/modules/site_shorewall/manifests/soledad.pp
+++ b/puppet/modules/site_shorewall/manifests/soledad.pp
@@ -1,3 +1,4 @@
+# Setup soledad server
 class site_shorewall::soledad {
 
   $soledad      = hiera('soledad')
@@ -8,7 +9,7 @@ class site_shorewall::soledad {
   # define macro for incoming services
   file { '/etc/shorewall/macro.leap_soledad':
     content => "PARAM   -       -       tcp    ${soledad_port}",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall']
   }
 
diff --git a/puppet/modules/site_shorewall/manifests/sshd.pp b/puppet/modules/site_shorewall/manifests/sshd.pp
index e2332592..ba129002 100644
--- a/puppet/modules/site_shorewall/manifests/sshd.pp
+++ b/puppet/modules/site_shorewall/manifests/sshd.pp
@@ -9,7 +9,7 @@ class site_shorewall::sshd {
   # define macro for incoming sshd
   file { '/etc/shorewall/macro.leap_sshd':
     content => "PARAM   -       -       tcp    ${ssh_port}",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall']
   }
 
diff --git a/puppet/modules/site_shorewall/manifests/stunnel/server.pp b/puppet/modules/site_shorewall/manifests/stunnel/server.pp
index 798cd631..dae4142a 100644
--- a/puppet/modules/site_shorewall/manifests/stunnel/server.pp
+++ b/puppet/modules/site_shorewall/manifests/stunnel/server.pp
@@ -8,7 +8,7 @@ define site_shorewall::stunnel::server($port) {
 
   file { "/etc/shorewall/macro.stunnel_server_${name}":
     content => "PARAM   -       -       tcp    ${port}",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall']
   }
   shorewall::rule {
diff --git a/puppet/modules/site_shorewall/manifests/tor.pp b/puppet/modules/site_shorewall/manifests/tor.pp
index 324b4844..f4d5ed92 100644
--- a/puppet/modules/site_shorewall/manifests/tor.pp
+++ b/puppet/modules/site_shorewall/manifests/tor.pp
@@ -9,7 +9,7 @@ class site_shorewall::tor {
   # define macro for incoming services
   file { '/etc/shorewall/macro.leap_tor':
     content => "PARAM   -       -       tcp    ${tor_port} ",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall']
   }
 
diff --git a/puppet/modules/site_sshd/manifests/mosh.pp b/puppet/modules/site_sshd/manifests/mosh.pp
index 49f56ca0..5282d239 100644
--- a/puppet/modules/site_sshd/manifests/mosh.pp
+++ b/puppet/modules/site_sshd/manifests/mosh.pp
@@ -1,3 +1,4 @@
+# setup mosh on server
 class site_sshd::mosh ( $ensure = present, $ports = '60000-61000' ) {
 
   package { 'mosh':
@@ -7,7 +8,7 @@ class site_sshd::mosh ( $ensure = present, $ports = '60000-61000' ) {
   file { '/etc/shorewall/macro.mosh':
     ensure  => $ensure,
     content => "PARAM   -       -       udp    ${ports}",
-    notify  => Service['shorewall'],
+    notify  => Exec['shorewall_check'],
     require => Package['shorewall'];
   }
 
-- 
cgit v1.2.3


From 50d30b2aa77efc304f0cc5e4f6f561a8e770986b Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sat, 11 Jun 2016 22:58:26 +0200
Subject: Newest passenger module dont manage munin by default

---
 puppet/modules/site_webapp/manifests/apache.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_webapp/manifests/apache.pp b/puppet/modules/site_webapp/manifests/apache.pp
index 80c7b29b..e559217d 100644
--- a/puppet/modules/site_webapp/manifests/apache.pp
+++ b/puppet/modules/site_webapp/manifests/apache.pp
@@ -18,7 +18,7 @@ class site_webapp::apache {
   include apache::module::removeip
   include site_webapp::common_vhost
 
-  class { 'passenger': use_munin => false }
+  class { 'passenger': }
 
   apache::vhost::file {
     'api':
-- 
cgit v1.2.3


From 68544ba2ffdfa988c060b3b4c5bd075f7304a022 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 11:11:56 -0400
Subject: Block MTAs that claim they are 'localhost'.

Nobody should be claiming that they are localhost when they are
connecting over smtpd

Change-Id: Ifb7df855b4e12021c58b89b2053e31fb10806096
---
 puppet/modules/site_postfix/templates/checks/helo_access.erb | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_postfix/templates/checks/helo_access.erb b/puppet/modules/site_postfix/templates/checks/helo_access.erb
index bac2c45a..e0708605 100644
--- a/puppet/modules/site_postfix/templates/checks/helo_access.erb
+++ b/puppet/modules/site_postfix/templates/checks/helo_access.erb
@@ -19,3 +19,5 @@
 # Reject anybody that HELO's as being in our own domain(s)
 # anyone who identifies themselves as us is a virus/spammer
 <%= @domain %> 554 You are not in domain <%= @domain %>
+localhost 554 You are not localhost
+
-- 
cgit v1.2.3


From bbdc193f05cb2f1624d6c7bbffd27f8060de35c8 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 12 Jul 2016 11:20:58 -0400
Subject: Block ip-based helo at MTA (#8139).

Numeric helo is a very strong indicator of spam. When this is blocked, a
very significant amount of spam stops.

Change-Id: Ieb340190faf37638950d1aa60b52268659e0b7f6
---
 puppet/modules/site_postfix/files/checks/helo_access.pcre | 2 ++
 puppet/modules/site_postfix/manifests/mx/checks.pp        | 7 +++++++
 puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp  | 2 +-
 3 files changed, 10 insertions(+), 1 deletion(-)
 create mode 100644 puppet/modules/site_postfix/files/checks/helo_access.pcre

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_postfix/files/checks/helo_access.pcre b/puppet/modules/site_postfix/files/checks/helo_access.pcre
new file mode 100644
index 00000000..4ebd42e6
--- /dev/null
+++ b/puppet/modules/site_postfix/files/checks/helo_access.pcre
@@ -0,0 +1,2 @@
+!/[[:alpha:]]/ REJECT Numeric HELO is a sign of spam, please contact us if this is in error
+
diff --git a/puppet/modules/site_postfix/manifests/mx/checks.pp b/puppet/modules/site_postfix/manifests/mx/checks.pp
index f406ad34..9678c205 100644
--- a/puppet/modules/site_postfix/manifests/mx/checks.pp
+++ b/puppet/modules/site_postfix/manifests/mx/checks.pp
@@ -1,3 +1,4 @@
+# management of specific MTA checks
 class site_postfix::mx::checks {
 
   file {
@@ -13,6 +14,12 @@ class site_postfix::mx::checks {
       mode    => '0644',
       owner   => root,
       group   => root;
+
+    '/etc/postfix/checks/helo_checks.pcre':
+      source => 'puppet:///modules/site_postfix/checks/helo_access.pcre',
+      mode   => '0644',
+      owner  => root,
+      group  => root;
   }
 
   exec {
diff --git a/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp b/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp
index 291d7ee4..162e6d86 100644
--- a/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp
+++ b/puppet/modules/site_postfix/manifests/mx/smtpd_checks.pp
@@ -28,7 +28,7 @@ class site_postfix::mx::smtpd_checks {
     'smtps_relay_restrictions':
       value => 'permit_mynetworks, permit_tls_clientcerts, defer_unauth_destination';
     'smtps_helo_restrictions':
-      value => 'permit_mynetworks, check_helo_access hash:$checks_dir/helo_checks, permit';
+      value => 'permit_mynetworks, check_helo_access hash:$checks_dir/helo_checks, check_helo_access pcre:$checks_dir/helo_checks.pcre, permit';
     'smtpd_sender_restrictions':
       value => 'permit_mynetworks, reject_non_fqdn_sender, reject_unknown_sender_domain, permit';
     }
-- 
cgit v1.2.3


From d6b064672d49e421e34f2165513178ffa7cee8ab Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 14 Jul 2016 11:04:19 -0400
Subject: Only use the 'main' repository for apt (#8253)

Change-Id: If39222dc9ec68d1786c70c4b82b740e0a06773c4
---
 puppet/modules/site_apt/manifests/init.pp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index 455425c1..26bd2c6a 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -25,7 +25,8 @@ class site_apt {
     debian_url       => $apt_url_basic,
     security_url     => $apt_url_security,
     backports_url    => $apt_url_backports,
-    use_next_release => $use_next_release
+    use_next_release => $use_next_release,
+    repos            => 'main'
   }
 
   # enable http://deb.leap.se debian package repository
-- 
cgit v1.2.3


From d6719731dce8ee7e048a16a447a426abcaa44f24 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 21 Jul 2016 12:13:24 -0700
Subject: remove openvpn submodule

---
 puppet/modules/openvpn/.fixtures.yml               |   6 -
 puppet/modules/openvpn/.gitignore                  |   3 -
 puppet/modules/openvpn/.gitrepo                    |  11 -
 puppet/modules/openvpn/.rvmrc                      |  38 ----
 puppet/modules/openvpn/.travis.yml                 |  29 ---
 puppet/modules/openvpn/Gemfile                     |   7 -
 puppet/modules/openvpn/Gemfile.lock                |  36 ----
 puppet/modules/openvpn/LICENSE                     | 177 ----------------
 puppet/modules/openvpn/Modulefile                  |  11 -
 puppet/modules/openvpn/Rakefile                    |   2 -
 puppet/modules/openvpn/Readme.markdown             |  54 -----
 puppet/modules/openvpn/Vagrantfile                 |  42 ----
 puppet/modules/openvpn/manifests/client.pp         | 187 -----------------
 .../openvpn/manifests/client_specific_config.pp    |  79 -------
 puppet/modules/openvpn/manifests/config.pp         |  52 -----
 puppet/modules/openvpn/manifests/init.pp           |  43 ----
 puppet/modules/openvpn/manifests/install.pp        |  46 ----
 puppet/modules/openvpn/manifests/params.pp         |  37 ----
 puppet/modules/openvpn/manifests/server.pp         | 233 ---------------------
 puppet/modules/openvpn/manifests/service.pp        |  36 ----
 .../openvpn/spec/classes/openvpn_config_spec.rb    |  15 --
 .../openvpn/spec/classes/openvpn_init_spec.rb      |   9 -
 .../openvpn/spec/classes/openvpn_install_spec.rb   |  11 -
 .../openvpn/spec/classes/openvpn_service_spec.rb   |  13 --
 .../openvpn/spec/defines/openvpn_client_spec.rb    |  88 --------
 .../defines/openvpn_client_specific_config_spec.rb |  40 ----
 .../openvpn/spec/defines/openvpn_server_spec.rb    | 165 ---------------
 puppet/modules/openvpn/spec/spec_helper.rb         |   2 -
 puppet/modules/openvpn/templates/client.erb        |  26 ---
 .../openvpn/templates/client_specific_config.erb   |  10 -
 .../openvpn/templates/etc-default-openvpn.erb      |  20 --
 puppet/modules/openvpn/templates/server.erb        |  37 ----
 puppet/modules/openvpn/templates/vars.erb          |  68 ------
 puppet/modules/openvpn/vagrant/client.pp           |   5 -
 puppet/modules/openvpn/vagrant/server.pp           |  23 --
 35 files changed, 1661 deletions(-)
 delete mode 100644 puppet/modules/openvpn/.fixtures.yml
 delete mode 100644 puppet/modules/openvpn/.gitignore
 delete mode 100644 puppet/modules/openvpn/.gitrepo
 delete mode 100644 puppet/modules/openvpn/.rvmrc
 delete mode 100644 puppet/modules/openvpn/.travis.yml
 delete mode 100644 puppet/modules/openvpn/Gemfile
 delete mode 100644 puppet/modules/openvpn/Gemfile.lock
 delete mode 100644 puppet/modules/openvpn/LICENSE
 delete mode 100644 puppet/modules/openvpn/Modulefile
 delete mode 100644 puppet/modules/openvpn/Rakefile
 delete mode 100644 puppet/modules/openvpn/Readme.markdown
 delete mode 100644 puppet/modules/openvpn/Vagrantfile
 delete mode 100644 puppet/modules/openvpn/manifests/client.pp
 delete mode 100644 puppet/modules/openvpn/manifests/client_specific_config.pp
 delete mode 100644 puppet/modules/openvpn/manifests/config.pp
 delete mode 100644 puppet/modules/openvpn/manifests/init.pp
 delete mode 100644 puppet/modules/openvpn/manifests/install.pp
 delete mode 100644 puppet/modules/openvpn/manifests/params.pp
 delete mode 100644 puppet/modules/openvpn/manifests/server.pp
 delete mode 100644 puppet/modules/openvpn/manifests/service.pp
 delete mode 100644 puppet/modules/openvpn/spec/classes/openvpn_config_spec.rb
 delete mode 100644 puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
 delete mode 100644 puppet/modules/openvpn/spec/classes/openvpn_install_spec.rb
 delete mode 100644 puppet/modules/openvpn/spec/classes/openvpn_service_spec.rb
 delete mode 100644 puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
 delete mode 100644 puppet/modules/openvpn/spec/defines/openvpn_client_specific_config_spec.rb
 delete mode 100644 puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
 delete mode 100644 puppet/modules/openvpn/spec/spec_helper.rb
 delete mode 100644 puppet/modules/openvpn/templates/client.erb
 delete mode 100644 puppet/modules/openvpn/templates/client_specific_config.erb
 delete mode 100644 puppet/modules/openvpn/templates/etc-default-openvpn.erb
 delete mode 100644 puppet/modules/openvpn/templates/server.erb
 delete mode 100644 puppet/modules/openvpn/templates/vars.erb
 delete mode 100644 puppet/modules/openvpn/vagrant/client.pp
 delete mode 100644 puppet/modules/openvpn/vagrant/server.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/openvpn/.fixtures.yml b/puppet/modules/openvpn/.fixtures.yml
deleted file mode 100644
index 1125ecca..00000000
--- a/puppet/modules/openvpn/.fixtures.yml
+++ /dev/null
@@ -1,6 +0,0 @@
-fixtures:
-  repositories:
-    concat: git://github.com/ripienaar/puppet-concat.git
-  symlinks:
-    openvpn: "#{source_dir}"
-
diff --git a/puppet/modules/openvpn/.gitignore b/puppet/modules/openvpn/.gitignore
deleted file mode 100644
index 6fd248b3..00000000
--- a/puppet/modules/openvpn/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-pkg
-spec/fixtures
-.vagrant
diff --git a/puppet/modules/openvpn/.gitrepo b/puppet/modules/openvpn/.gitrepo
deleted file mode 100644
index 0c191cd8..00000000
--- a/puppet/modules/openvpn/.gitrepo
+++ /dev/null
@@ -1,11 +0,0 @@
-; DO NOT EDIT (unless you know what you are doing)
-;
-; This subdirectory is a git "subrepo", and this file is maintained by the
-; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
-;
-[subrepo]
-	remote = https://leap.se/git/puppet_openvpn
-	branch = master
-	commit = 26d4edc669853a268a65d2cbbfb42c19f1333de7
-	parent = 7ce3190986cf8e5fe037a7ccd4c1076505b117f4
-	cmdver = 0.3.0
diff --git a/puppet/modules/openvpn/.rvmrc b/puppet/modules/openvpn/.rvmrc
deleted file mode 100644
index 6fbfb7f1..00000000
--- a/puppet/modules/openvpn/.rvmrc
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-
-# This is an RVM Project .rvmrc file, used to automatically load the ruby
-# development environment upon cd'ing into the directory
-
-# First we specify our desired <ruby>[@<gemset>], the @gemset name is optional,
-# Only full ruby name is supported here, for short names use:
-#     echo "rvm use 1.9.3" > .rvmrc
-environment_id="ruby-1.9.3-p194@puppet"
-
-# Uncomment the following lines if you want to verify rvm version per project
-# rvmrc_rvm_version="1.15.8 (stable)" # 1.10.1 seams as a safe start
-# eval "$(echo ${rvm_version}.${rvmrc_rvm_version} | awk -F. '{print "[[ "$1*65536+$2*256+$3" -ge "$4*65536+$5*256+$6" ]]"}' )" || {
-#   echo "This .rvmrc file requires at least RVM ${rvmrc_rvm_version}, aborting loading."
-#   return 1
-# }
-
-# First we attempt to load the desired environment directly from the environment
-# file. This is very fast and efficient compared to running through the entire
-# CLI and selector. If you want feedback on which environment was used then
-# insert the word 'use' after --create as this triggers verbose mode.
-if [[ -d "${rvm_path:-$HOME/.rvm}/environments"
-  && -s "${rvm_path:-$HOME/.rvm}/environments/$environment_id" ]]
-then
-  \. "${rvm_path:-$HOME/.rvm}/environments/$environment_id"
-  [[ -s "${rvm_path:-$HOME/.rvm}/hooks/after_use" ]] &&
-    \. "${rvm_path:-$HOME/.rvm}/hooks/after_use" || true
-  if [[ $- == *i* ]] # check for interactive shells
-  then echo "Using: $(tput setaf 2)$GEM_HOME$(tput sgr0)" # show the user the ruby and gemset they are using in green
-  else echo "Using: $GEM_HOME" # don't use colors in non-interactive shells
-  fi
-else
-  # If the environment file has not yet been created, use the RVM CLI to select.
-  rvm --create use  "$environment_id" || {
-    echo "Failed to create RVM environment '${environment_id}'."
-    return 1
-  }
-fi
diff --git a/puppet/modules/openvpn/.travis.yml b/puppet/modules/openvpn/.travis.yml
deleted file mode 100644
index da5c389d..00000000
--- a/puppet/modules/openvpn/.travis.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-language: ruby
-bundler_args: --without development
-script: "bundle exec rake spec SPEC_OPTS='--format documentation'"
-rvm:
-  - 1.8.7
-  - 1.9.3
-  - 2.0.0
-script:
-  - "rake lint"
-  - "rake spec SPEC_OPTS='--format documentation'"
-env:
-  - PUPPET_VERSION="~> 2.7.0"
-  - PUPPET_VERSION="~> 3.0.0"
-  - PUPPET_VERSION="~> 3.1.0"
-  - PUPPET_VERSION="~> 3.2.0"
-matrix:
-  exclude:
-    - rvm: 1.9.3
-      env: PUPPET_VERSION="~> 2.7.0"
-    - rvm: 2.0.0
-      env: PUPPET_VERSION="~> 2.7.0"
-    - rvm: 2.0.0
-      env: PUPPET_VERSION="~> 3.0.0"
-    - rvm: 2.0.0
-      env: PUPPET_VERSION="~> 3.1.0"
-notifications:
-  email: false
-  on_success: always
-  on_failure: always
diff --git a/puppet/modules/openvpn/Gemfile b/puppet/modules/openvpn/Gemfile
deleted file mode 100644
index 68e10e7d..00000000
--- a/puppet/modules/openvpn/Gemfile
+++ /dev/null
@@ -1,7 +0,0 @@
-source :rubygems
-
-puppetversion = ENV['PUPPET_VERSION']
-gem 'puppet', puppetversion, :require => false
-gem 'puppet-lint'
-gem 'rspec-puppet'
-gem 'puppetlabs_spec_helper'
diff --git a/puppet/modules/openvpn/Gemfile.lock b/puppet/modules/openvpn/Gemfile.lock
deleted file mode 100644
index 9fce3f98..00000000
--- a/puppet/modules/openvpn/Gemfile.lock
+++ /dev/null
@@ -1,36 +0,0 @@
-GEM
-  remote: http://rubygems.org/
-  specs:
-    diff-lcs (1.1.3)
-    facter (1.6.17)
-    hiera (1.0.0)
-    metaclass (0.0.1)
-    mocha (0.13.1)
-      metaclass (~> 0.0.1)
-    puppet (3.0.2)
-      facter (~> 1.6.11)
-      hiera (~> 1.0.0)
-    puppetlabs_spec_helper (0.4.0)
-      mocha (>= 0.10.5)
-      rake
-      rspec (>= 2.9.0)
-      rspec-puppet (>= 0.1.1)
-    rake (10.0.3)
-    rspec (2.12.0)
-      rspec-core (~> 2.12.0)
-      rspec-expectations (~> 2.12.0)
-      rspec-mocks (~> 2.12.0)
-    rspec-core (2.12.2)
-    rspec-expectations (2.12.1)
-      diff-lcs (~> 1.1.3)
-    rspec-mocks (2.12.1)
-    rspec-puppet (0.1.5)
-      rspec
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  puppet
-  puppetlabs_spec_helper
-  rspec-puppet
diff --git a/puppet/modules/openvpn/LICENSE b/puppet/modules/openvpn/LICENSE
deleted file mode 100644
index f433b1a5..00000000
--- a/puppet/modules/openvpn/LICENSE
+++ /dev/null
@@ -1,177 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
diff --git a/puppet/modules/openvpn/Modulefile b/puppet/modules/openvpn/Modulefile
deleted file mode 100644
index 679e7e64..00000000
--- a/puppet/modules/openvpn/Modulefile
+++ /dev/null
@@ -1,11 +0,0 @@
-name    'luxflux-openvpn'
-version '2.1.0'
-source 'https://github.com/luxflux/puppet-openvpn'
-author 'luxflux'
-license 'Apache 2.0'
-summary 'OpenVPN server puppet module'
-description 'Puppet module to manage OpenVPN servers'
-project_page 'https://github.com/luxflux/puppet-openvpn'
-
-## Add dependencies, if any:
-dependency 'ripienaar/concat', '0.2.0'
diff --git a/puppet/modules/openvpn/Rakefile b/puppet/modules/openvpn/Rakefile
deleted file mode 100644
index 14f1c246..00000000
--- a/puppet/modules/openvpn/Rakefile
+++ /dev/null
@@ -1,2 +0,0 @@
-require 'rubygems'
-require 'puppetlabs_spec_helper/rake_tasks'
diff --git a/puppet/modules/openvpn/Readme.markdown b/puppet/modules/openvpn/Readme.markdown
deleted file mode 100644
index 6bcf49ea..00000000
--- a/puppet/modules/openvpn/Readme.markdown
+++ /dev/null
@@ -1,54 +0,0 @@
-# OpenVPN Puppet module
-
-Puppet module to manage OpenVPN servers
-
-## Features:
-
-* Client-specific rules and access policies
-* Generated client configurations and SSL-Certificates
-* Downloadable client configurations and SSL-Certificates for easy client configuration
-* Support for multiple server instances
-
-Tested on Ubuntu Precise Pangolin, CentOS 6, RedHat 6.
-
-
-## Dependencies
-  - [puppet-concat](https://github.com/ripienaar/puppet-concat)
-
-
-## Example
-
-```puppet
-  # add a server instance
-  openvpn::server { 'winterthur':
-    country      => 'CH',
-    province     => 'ZH',
-    city         => 'Winterthur',
-    organization => 'example.org',
-    email        => 'root@example.org',
-    server       => '10.200.200.0 255.255.255.0'
-  }
-
-  # define clients
-  openvpn::client { 'client1':
-    server => 'winterthur'
-  }
-  openvpn::client { 'client2':
-    server   => 'winterthur'
-  }
-
-  openvpn::client_specific_config { 'client1':
-    server => 'winterthur',
-    ifconfig => '10.200.200.50 255.255.255.0'
-  }
-```
-
-Don't forget the [sysctl](https://github.com/luxflux/puppet-sysctl) directive ```net.ipv4.ip_forward```!
-
-
-# Contributors
-
-These fine folks helped to get this far with this module:
-* [@jlambert121](https://github.com/jlambert121)
-* [@jlk](https://github.com/jlk)
-* [@elisiano](https://github.com/elisiano)
diff --git a/puppet/modules/openvpn/Vagrantfile b/puppet/modules/openvpn/Vagrantfile
deleted file mode 100644
index 88875ff8..00000000
--- a/puppet/modules/openvpn/Vagrantfile
+++ /dev/null
@@ -1,42 +0,0 @@
-# -*- mode: ruby -*-
-# vi: set ft=ruby :
-
-def server_config(config)
-  config.vm.provision :puppet, :module_path => '..' do |puppet|
-    puppet.manifests_path = "vagrant"
-    puppet.manifest_file  = "server.pp"
-  end
-end
-
-def client_config(config)
-  config.vm.provision :puppet, :module_path => '..' do |puppet|
-    puppet.manifests_path = "vagrant"
-    puppet.manifest_file  = "client.pp"
-  end
-end
-
-Vagrant::Config.run do |config|
-
-  config.vm.define :server_ubuntu do |c|
-    c.vm.box = 'precise64'
-    server_config c
-    c.vm.network :hostonly, '10.255.255.10'
-  end
-
-  config.vm.define :server_centos do |c|
-    c.vm.box = 'centos63'
-
-    c.vm.provision :shell, :inline => 'if [ ! -f rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm ]; then wget -q http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm; fi'
-    c.vm.provision :shell, :inline => 'yum install -y rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm || exit 0'
-
-    server_config c
-    c.vm.network :hostonly, '10.255.255.11'
-  end
-
-  config.vm.define :client_ubuntu do |c|
-    c.vm.box = 'precise64'
-    client_config c
-    c.vm.network :hostonly, '10.255.255.20'
-  end
-
-end
diff --git a/puppet/modules/openvpn/manifests/client.pp b/puppet/modules/openvpn/manifests/client.pp
deleted file mode 100644
index 92c6aa4e..00000000
--- a/puppet/modules/openvpn/manifests/client.pp
+++ /dev/null
@@ -1,187 +0,0 @@
-# == Define: openvpn::client
-#
-# This define creates the client certs for a specified openvpn server as well
-# as creating a tarball that can be directly imported into openvpn clients
-#
-#
-# === Parameters
-#
-# [*server*]
-#   String.  Name of the corresponding openvpn endpoint
-#   Required
-#
-# [*compression*]
-#   String.  Which compression algorithim to use
-#   Default: comp-lzo
-#   Options: comp-lzo or '' (disable compression)
-#
-# [*dev*]
-#   String.  Device method
-#   Default: tun
-#   Options: tun (routed connections), tap (bridged connections)
-#
-# [*mute*]
-#   Integer.  Set log mute level
-#   Default: 20
-#
-# [*mute_replay_warnings*]
-#   Boolean.  Silence duplicate packet warnings (common on wireless networks)
-#   Default: true
-#
-# [*nobind*]
-#   Boolean.  Whether or not to bind to a specific port number
-#   Default: true
-#
-# [*persist_key*]
-#   Boolean.  Try to retain access to resources that may be unavailable
-#     because of privilege downgrades
-#   Default: true
-#
-# [*persist_tun*]
-#   Boolean.  Try to retain access to resources that may be unavailable
-#     because of privilege downgrades
-#   Default: true
-#
-# [*port*]
-#   Integer.  The port the openvpn server service is running on
-#   Default: 1194
-#
-# [*proto*]
-#   String.  What IP protocol is being used.
-#   Default: tcp
-#   Options: tcp or udp
-#
-# [*remote_host*]
-#   String.  The IP or hostname of the openvpn server service
-#   Default: FQDN
-#
-# [*resolv_retry*]
-#   Integer/String. How many seconds should the openvpn client try to resolve
-#     the server's hostname
-#   Default: infinite
-#   Options: Integer or infinite
-#
-# [*verb*]
-#   Integer.  Level of logging verbosity
-#   Default: 3
-#
-#
-# === Examples
-#
-#   openvpn::client {
-#     'my_user':
-#       server      => 'contractors',
-#       remote_host => 'vpn.mycompany.com'
-#    }
-#
-# * Removal:
-#     Manual process right now, todo for the future
-#
-#
-# === Authors
-#
-# * Raffael Schmid <mailto:raffael@yux.ch>
-# * John Kinsella <mailto:jlkinsel@gmail.com>
-# * Justin Lambert <mailto:jlambert@letsevenup.com>
-#
-# === License
-#
-# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-define openvpn::client(
-  $server,
-  $compression = 'comp-lzo',
-  $dev = 'tun',
-  $mute = '20',
-  $mute_replay_warnings = true,
-  $nobind = true,
-  $persist_key = true,
-  $persist_tun = true,
-  $port = '1194',
-  $proto = 'tcp',
-  $remote_host = $::fqdn,
-  $resolv_retry = 'infinite',
-  $verb = '3',
-) {
-
-  Openvpn::Server[$server] ->
-  Openvpn::Client[$name]
-
-  exec {
-    "generate certificate for ${name} in context of ${server}":
-      command  => ". ./vars && ./pkitool ${name}",
-      cwd      => "/etc/openvpn/${server}/easy-rsa",
-      creates  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.crt",
-      provider => 'shell';
-  }
-
-  file {
-    [ "/etc/openvpn/${server}/download-configs/${name}",
-      "/etc/openvpn/${server}/download-configs/${name}/keys"]:
-        ensure  => directory;
-
-    "/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt":
-      ensure  => link,
-      target  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.crt",
-      require => Exec["generate certificate for ${name} in context of ${server}"];
-
-    "/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key":
-      ensure  => link,
-      target  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.key",
-      require => Exec["generate certificate for ${name} in context of ${server}"];
-
-    "/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt":
-      ensure  => link,
-      target  => "/etc/openvpn/${server}/easy-rsa/keys/ca.crt",
-      require => Exec["generate certificate for ${name} in context of ${server}"];
-
-    "/etc/openvpn/${server}/download-configs/${name}/${name}.conf":
-      owner   => root,
-      group   => root,
-      mode    => '0444',
-      content => template('openvpn/client.erb'),
-      notify  => Exec["tar the thing ${server} with ${name}"];
-  }
-
-  exec {
-    "tar the thing ${server} with ${name}":
-      cwd         => "/etc/openvpn/${server}/download-configs/",
-      command     => "/bin/rm ${name}.tar.gz; tar --exclude=\\*.conf.d -chzvf ${name}.tar.gz ${name}",
-      refreshonly => true,
-      require     => [  File["/etc/openvpn/${server}/download-configs/${name}/${name}.conf"],
-                        File["/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt"],
-                        File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key"],
-                        File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt"]
-                      ],
-      notify      => Exec["generate ${name}.ovpn in ${server}"];
-  }
-
-  exec {
-    "generate ${name}.ovpn in ${server}":
-      cwd         => "/etc/openvpn/${server}/download-configs/",
-      command     => "/bin/rm ${name}.ovpn; cat  ${name}/${name}.conf|perl -lne 'if(m|^ca keys/ca.crt|){ chomp(\$ca=`cat ${name}/keys/ca.crt`); print \"<ca>\n\$ca\n</ca>\"} elsif(m|^cert keys/${name}.crt|) { chomp(\$crt=`cat ${name}/keys/${name}.crt`); print \"<cert>\n\$crt\n</cert>\"} elsif(m|^key keys/${name}.key|){ chomp(\$key=`cat ${name}/keys/${name}.key`); print \"<key>\n\$key\n</key>\"} else { print} ' > ${name}.ovpn",
-      refreshonly => true,
-      require     => [  File["/etc/openvpn/${server}/download-configs/${name}/${name}.conf"],
-                        File["/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt"],
-                        File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key"],
-                        File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt"],
-                      ],
-  }
-
-  file { "/etc/openvpn/${server}/download-configs/${name}.ovpn":
-    mode    => '0400',
-    require => Exec["generate ${name}.ovpn in ${server}"],
-  }
-}
diff --git a/puppet/modules/openvpn/manifests/client_specific_config.pp b/puppet/modules/openvpn/manifests/client_specific_config.pp
deleted file mode 100644
index 4287421a..00000000
--- a/puppet/modules/openvpn/manifests/client_specific_config.pp
+++ /dev/null
@@ -1,79 +0,0 @@
-# == Define: openvpn::client_specific_config
-#
-# This define configures options which will be pushed by the server to a
-# specific client only. This feature is explained here:
-#  http://openvpn.net/index.php/open-source/documentation/howto.html#policy
-#
-# === Parameters
-#
-# All the parameters are explained in the openvpn documentation:
-#   http://openvpn.net/index.php/open-source/documentation/howto.html#policy
-#
-# [*server*]
-#   String.  Name of the corresponding openvpn endpoint
-#   Required
-#
-# [*iroute*]
-#   Array.  Array of iroute combinations.
-#   Default: []
-#
-# [*ifconfig*]
-#   String.  IP configuration to push to the client.
-#   Default: false
-#
-# [*dhcp_options]
-#   Array.  DHCP options to push to the client.
-#   Default: []
-#
-#
-# === Examples
-#
-#   openvpn::client_specific_config {
-#     'vpn_client':
-#       server       => 'contractors',
-#       iroute       => ['10.0.1.0 255.255.255.0'],
-#       ifconfig     => '10.10.10.1 10.10.10.2',
-#       dhcp_options => ['DNS 8.8.8.8']
-#    }
-#
-# * Removal:
-#     Manual process right now, todo for the future
-#
-#
-# === Authors
-#
-# * Raffael Schmid <mailto:raffael@yux.ch>
-#
-# === License
-#
-# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-define openvpn::client_specific_config(
-  $server,
-  $iroute       = [],
-  $ifconfig     = false,
-  $dhcp_options = []
-) {
-
-  Openvpn::Server[$server] ->
-  Openvpn::Client[$name] ->
-  Openvpn::Client_specific_config[$name]
-
-  file { "/etc/openvpn/${server}/client-configs/${name}":
-    ensure  => present,
-    content => template('openvpn/client_specific_config.erb')
-  }
-
-}
diff --git a/puppet/modules/openvpn/manifests/config.pp b/puppet/modules/openvpn/manifests/config.pp
deleted file mode 100644
index 32b32094..00000000
--- a/puppet/modules/openvpn/manifests/config.pp
+++ /dev/null
@@ -1,52 +0,0 @@
-# == Class: openvpn::config
-#
-# This class sets up the openvpn enviornment as well as the default config file
-#
-#
-# === Examples
-#
-# This class should not be directly invoked
-#
-# === Authors
-#
-# * Raffael Schmid <mailto:raffael@yux.ch>
-# * John Kinsella <mailto:jlkinsel@gmail.com>
-# * Justin Lambert <mailto:jlambert@letsevenup.com>
-#
-# === License
-#
-# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-class openvpn::config {
-
-  if $::osfamily == 'Debian' {
-    include concat::setup
-
-    concat {
-      '/etc/default/openvpn':
-        owner  => root,
-        group  => root,
-        mode   => 644,
-        warn   => true;
-    }
-
-    concat::fragment {
-      'openvpn.default.header':
-        content => template('openvpn/etc-default-openvpn.erb'),
-        target  => '/etc/default/openvpn',
-        order   => 01;
-    }
-  }
-}
diff --git a/puppet/modules/openvpn/manifests/init.pp b/puppet/modules/openvpn/manifests/init.pp
deleted file mode 100644
index 7e07f025..00000000
--- a/puppet/modules/openvpn/manifests/init.pp
+++ /dev/null
@@ -1,43 +0,0 @@
-# == Class: openvpn
-#
-# This module installs the openvpn service, configures vpn endpoints, generates
-# client certificates, and generates client config files
-#
-#
-# === Examples
-#
-# * Installation:
-#     class { 'openvpn': }
-#
-#
-# === Authors
-#
-# * Raffael Schmid <mailto:raffael@yux.ch>
-# * John Kinsella <mailto:jlkinsel@gmail.com>
-# * Justin Lambert <mailto:jlambert@letsevenup.com>
-#
-# === License
-#
-# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-class openvpn {
-
-  class {'openvpn::params': } ->
-  class {'openvpn::install': } ->
-  class {'openvpn::config': } ~>
-  class {'openvpn::service': } ->
-  Class['openvpn']
-
-}
diff --git a/puppet/modules/openvpn/manifests/install.pp b/puppet/modules/openvpn/manifests/install.pp
deleted file mode 100644
index a230373a..00000000
--- a/puppet/modules/openvpn/manifests/install.pp
+++ /dev/null
@@ -1,46 +0,0 @@
-# == Class: openvpn
-#
-# This module installs the openvpn service, configures vpn endpoints, generates
-# client certificates, and generates client config files
-#
-#
-# === Examples
-#
-# This class should not be directly invoked
-#
-#
-# === Authors
-#
-# * Raffael Schmid <mailto:raffael@yux.ch>
-# * John Kinsella <mailto:jlkinsel@gmail.com>
-# * Justin Lambert <mailto:jlambert@letsevenup.com>
-#
-# === License
-#
-# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-class openvpn::install {
-
-  package {
-    'openvpn':
-      ensure => installed;
-  }
-
-  file {
-    [ '/etc/openvpn', '/etc/openvpn/keys' ]:
-      ensure  => directory,
-      require => Package['openvpn'];
-  }
-}
diff --git a/puppet/modules/openvpn/manifests/params.pp b/puppet/modules/openvpn/manifests/params.pp
deleted file mode 100644
index 33495270..00000000
--- a/puppet/modules/openvpn/manifests/params.pp
+++ /dev/null
@@ -1,37 +0,0 @@
-# === License
-#
-# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-class openvpn::params {
-
-  $group = $::osfamily ? {
-    'RedHat' => 'nobody',
-    default  => 'nogroup'
-  }
-
-  $easyrsa_source = $::osfamily ? {
-    'RedHat'  => $::operatingsystemmajrelease ? {
-      6 => '/usr/share/openvpn/easy-rsa/2.0',
-      default => '/usr/share/doc/openvpn-2.2.2/easy-rsa/2.0'
-    },
-    default   => '/usr/share/doc/openvpn/examples/easy-rsa/2.0'
-  }
-
-  $link_openssl_cnf = $::osfamily ? {
-    /(Debian|RedHat)/ => true,
-    default           => false
-  }
-
-}
diff --git a/puppet/modules/openvpn/manifests/server.pp b/puppet/modules/openvpn/manifests/server.pp
deleted file mode 100644
index 649048c4..00000000
--- a/puppet/modules/openvpn/manifests/server.pp
+++ /dev/null
@@ -1,233 +0,0 @@
-# == Define: openvpn::server
-#
-# This define creates the openvpn server instance and ssl certificates
-#
-#
-# === Parameters
-#
-# [*country*]
-#   String.  Country to be used for the SSL certificate
-#
-# [*province*]
-#   String.  Province to be used for the SSL certificate
-#
-# [*city*]
-#   String.  City to be used for the SSL certificate
-#
-# [*organization*]
-#   String.  Organization to be used for the SSL certificate
-#
-# [*email*]
-#   String.  Email address to be used for the SSL certificate
-#
-# [*compression*]
-#   String.  Which compression algorithim to use
-#   Default: comp-lzo
-#   Options: comp-lzo or '' (disable compression)
-#
-# [*dev*]
-#   String.  Device method
-#   Default: tun
-#   Options: tun (routed connections), tap (bridged connections)
-#
-# [*user*]
-#   String.  Group to drop privileges to after startup
-#   Default: nobody
-#
-# [*group*]
-#   String.  User to drop privileges to after startup
-#   Default: depends on your $::osfamily
-#
-# [*ipp*]
-#   Boolean.  Persist ifconfig information to a file to retain client IP
-#     addresses between sessions
-#   Default: false
-#
-# [*local*]
-#   String.  Interface for openvpn to bind to.
-#   Default: $::ipaddress_eth0
-#   Options: An IP address or '' to bind to all ip addresses
-#
-# [*logfile*]
-#   String.  Logfile for this openvpn server
-#   Default: false
-#   Options: false (syslog) or log file name
-#
-# [*port*]
-#   Integer.  The port the openvpn server service is running on
-#   Default: 1194
-#
-# [*proto*]
-#   String.  What IP protocol is being used.
-#   Default: tcp
-#   Options: tcp or udp
-#
-# [*status_log*]
-#   String.  Logfile for periodic dumps of the vpn service status
-#   Default: "${name}/openvpn-status.log"
-#
-# [*server*]
-#   String.  Network to assign client addresses out of
-#   Default: None.  Required in tun mode, not in tap mode
-#
-# [*push*]
-#   Array.  Options to push out to the client.  This can include routes, DNS
-#     servers, DNS search domains, and many other options.
-#   Default: []
-#
-#
-# === Examples
-#
-#   openvpn::client {
-#     'my_user':
-#       server      => 'contractors',
-#       remote_host => 'vpn.mycompany.com'
-#    }
-#
-# * Removal:
-#     Manual process right now, todo for the future
-#
-#
-# === Authors
-#
-# * Raffael Schmid <mailto:raffael@yux.ch>
-# * John Kinsella <mailto:jlkinsel@gmail.com>
-# * Justin Lambert <mailto:jlambert@letsevenup.com>
-#
-# === License
-#
-# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-define openvpn::server(
-  $country,
-  $province,
-  $city,
-  $organization,
-  $email,
-  $compression = 'comp-lzo',
-  $dev = 'tun0',
-  $user = 'nobody',
-  $group = false,
-  $ipp = false,
-  $ip_pool = [],
-  $local = $::ipaddress_eth0,
-  $logfile = false,
-  $port = '1194',
-  $proto = 'tcp',
-  $status_log = "${name}/openvpn-status.log",
-  $server = '',
-  $push = []
-) {
-
-  include openvpn
-  Class['openvpn::install'] ->
-  Openvpn::Server[$name] ~>
-  Class['openvpn::service']
-
-  $tls_server = $proto ? {
-    /tcp/   => true,
-    default => false
-  }
-
-  $group_to_set = $group ? {
-    false   => $openvpn::params::group,
-    default => $group
-  }
-
-  file {
-    ["/etc/openvpn/${name}", "/etc/openvpn/${name}/client-configs", "/etc/openvpn/${name}/download-configs" ]:
-      ensure  => directory;
-  }
-
-  exec {
-    "copy easy-rsa to openvpn config folder ${name}":
-      command => "/bin/cp -r ${openvpn::params::easyrsa_source} /etc/openvpn/${name}/easy-rsa",
-      creates => "/etc/openvpn/${name}/easy-rsa",
-      notify  => Exec["fix_easyrsa_file_permissions_${name}"],
-      require => File["/etc/openvpn/${name}"];
-  }
-
-  exec {
-    "fix_easyrsa_file_permissions_${name}":
-      refreshonly => true,
-      command     => "/bin/chmod 755 /etc/openvpn/${name}/easy-rsa/*";
-  }
-
-  file {
-    "/etc/openvpn/${name}/easy-rsa/vars":
-      ensure  => present,
-      content => template('openvpn/vars.erb'),
-      require => Exec["copy easy-rsa to openvpn config folder ${name}"];
-  }
-
-  file {
-    "/etc/openvpn/${name}/easy-rsa/openssl.cnf":
-      require => Exec["copy easy-rsa to openvpn config folder ${name}"];
-  }
-
-  if $openvpn::params::link_openssl_cnf == true {
-    File["/etc/openvpn/${name}/easy-rsa/openssl.cnf"] {
-      ensure => link,
-      target => "/etc/openvpn/${name}/easy-rsa/openssl-1.0.0.cnf"
-    }
-  }
-
-  exec {
-    "generate dh param ${name}":
-      command  => '. ./vars && ./clean-all && ./build-dh',
-      cwd      => "/etc/openvpn/${name}/easy-rsa",
-      creates  => "/etc/openvpn/${name}/easy-rsa/keys/dh1024.pem",
-      provider => 'shell',
-      require  => File["/etc/openvpn/${name}/easy-rsa/vars"];
-
-    "initca ${name}":
-      command  => '. ./vars && ./pkitool --initca',
-      cwd      => "/etc/openvpn/${name}/easy-rsa",
-      creates  => "/etc/openvpn/${name}/easy-rsa/keys/ca.key",
-      provider => 'shell',
-      require  => [ Exec["generate dh param ${name}"], File["/etc/openvpn/${name}/easy-rsa/openssl.cnf"] ];
-
-    "generate server cert ${name}":
-      command  => '. ./vars && ./pkitool --server server',
-      cwd      => "/etc/openvpn/${name}/easy-rsa",
-      creates  => "/etc/openvpn/${name}/easy-rsa/keys/server.key",
-      provider => 'shell',
-      require  => Exec["initca ${name}"];
-  }
-
-  file {
-    "/etc/openvpn/${name}/keys":
-      ensure  => link,
-      target  => "/etc/openvpn/${name}/easy-rsa/keys",
-      require => Exec["copy easy-rsa to openvpn config folder ${name}"];
-  }
-
-  if $::osfamily == 'Debian' {
-    concat::fragment {
-      "openvpn.default.autostart.${name}":
-        content => "AUTOSTART=\"\$AUTOSTART ${name}\"\n",
-        target  => '/etc/default/openvpn',
-        order   => 10;
-    }
-  }
-
-  file {
-    "/etc/openvpn/${name}.conf":
-      owner   => root,
-      group   => root,
-      mode    => '0444',
-      content => template('openvpn/server.erb');
-  }
-}
diff --git a/puppet/modules/openvpn/manifests/service.pp b/puppet/modules/openvpn/manifests/service.pp
deleted file mode 100644
index 54e8db7d..00000000
--- a/puppet/modules/openvpn/manifests/service.pp
+++ /dev/null
@@ -1,36 +0,0 @@
-# == Class: openvpn::config
-#
-# This class maintains the openvpn service
-#
-#
-# === Examples
-#
-# This class should not be directly invoked
-#
-# === Authors
-#
-# * Raffael Schmid <mailto:raffael@yux.ch>
-# * John Kinsella <mailto:jlkinsel@gmail.com>
-# * Justin Lambert <mailto:jlambert@letsevenup.com>
-#
-# === License
-#
-# Copyright 2013 Raffael Schmid, <raffael@yux.ch>
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# lied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-class openvpn::service {
-  service {
-    'openvpn':
-      ensure     => running,
-      enable     => true,
-      hasrestart => true,
-      hasstatus  => true;
-  }
-}
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_config_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_config_spec.rb
deleted file mode 100644
index bbb63a77..00000000
--- a/puppet/modules/openvpn/spec/classes/openvpn_config_spec.rb
+++ /dev/null
@@ -1,15 +0,0 @@
-require 'spec_helper'
- 
-describe 'openvpn::config', :type => :class do
-  
-  it { should create_class('openvpn::config') }
-  
-  context "on Debian based machines" do
-    let (:facts) { { :osfamily => 'Debian', :concat_basedir => '/var/lib/puppet/concat' } }
-
-    it { should contain_class('concat::setup') }
-    it { should contain_concat('/etc/default/openvpn') }
-    it { should contain_concat__fragment('openvpn.default.header') }
-  end
-
-end
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
deleted file mode 100644
index 45dcc9bf..00000000
--- a/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-require 'spec_helper'
- 
-describe 'openvpn', :type => :class do
-
-  let (:facts) { { :concat_basedir => '/var/lib/puppet/concat' } }
-
-  it { should create_class('openvpn') }
-
-end
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_install_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_install_spec.rb
deleted file mode 100644
index cdb31358..00000000
--- a/puppet/modules/openvpn/spec/classes/openvpn_install_spec.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-require 'spec_helper'
- 
-describe 'openvpn::install', :type => :class do
-
-  it { should create_class('openvpn::install') }
-  it { should contain_package('openvpn') }
-
-  it { should contain_file('/etc/openvpn').with('ensure' => 'directory') }
-  it { should contain_file('/etc/openvpn/keys').with('ensure' => 'directory') }
-
-end
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_service_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_service_spec.rb
deleted file mode 100644
index f427e7f1..00000000
--- a/puppet/modules/openvpn/spec/classes/openvpn_service_spec.rb
+++ /dev/null
@@ -1,13 +0,0 @@
-require 'spec_helper'
- 
-describe 'openvpn::service', :type => :class do
-
-  let (:facts) { { :concat_basedir => '/var/lib/puppet/concat' } }
-
-  it { should create_class('openvpn::service') }
-  it { should contain_service('openvpn').with(
-    'ensure'  => 'running',
-    'enable'  => true
-  ) }
-
-end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
deleted file mode 100644
index a4b580e8..00000000
--- a/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
+++ /dev/null
@@ -1,88 +0,0 @@
-require 'spec_helper'
- 
-describe 'openvpn::client', :type => :define do
-  let(:title) { 'test_client' }
-  let(:params) { { 'server' => 'test_server' } }
-  let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
-  let(:pre_condition) do
-    'openvpn::server { "test_server":
-      country       => "CO",
-      province      => "ST",
-      city          => "Some City",
-      organization  => "example.org",
-      email         => "testemail@example.org"
-    }'
-  end
-
-  it { should contain_exec('generate certificate for test_client in context of test_server') }
-
-  [ 'test_client', 'test_client/keys'].each do |directory|
-    it { should contain_file("/etc/openvpn/test_server/download-configs/#{directory}") }
-  end
-
-  [ 'test_client.crt', 'test_client.key', 'ca.crt' ].each do |file|
-    it { should contain_file("/etc/openvpn/test_server/download-configs/test_client/keys/#{file}").with(
-      'ensure'  => 'link',
-      'target'  => "/etc/openvpn/test_server/easy-rsa/keys/#{file}"
-    )}
-  end
-  
-  it { should contain_exec('tar the thing test_server with test_client').with(
-    'cwd'     => '/etc/openvpn/test_server/download-configs/',
-    'command' => '/bin/rm test_client.tar.gz; tar --exclude=\*.conf.d -chzvf test_client.tar.gz test_client'
-  ) }
-
-  context "setting the minimum parameters" do
-    let(:params) { { 'server' => 'test_server' } }
-    let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
-
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^client$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^ca\s+keys\/ca\.crt$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^cert\s+keys\/test_client.crt$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^key\s+keys\/test_client\.key$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^dev\s+tun$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^proto\s+tcp$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^remote\s+somehost\s+1194$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^comp-lzo$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^resolv-retry\s+infinite$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^nobind$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^persist-key$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^persist-tun$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^mute-replay-warnings$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^ns\-cert\-type\s+server$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^verb\s+3$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^mute\s+20$/)}
-  end
-
-  context "setting all of the parameters" do
-    let(:params) { { 
-      'server'                => 'test_server',
-      'compression'           => 'comp-something',
-      'dev'                   => 'tap',
-      'mute'                  => 10,
-      'mute_replay_warnings'  => false,
-      'nobind'                => false,
-      'persist_key'           => false,
-      'persist_tun'           => false,
-      'port'                  => '123',
-      'proto'                 => 'udp',
-      'remote_host'           => 'somewhere',
-      'resolv_retry'          => '2m',
-      'verb'                  => '1'
-    } }
-    let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
-
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^client$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^ca\s+keys\/ca\.crt$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^cert\s+keys\/test_client.crt$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^key\s+keys\/test_client\.key$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^dev\s+tap$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^proto\s+udp$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^remote\s+somewhere\s+123$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^comp-something$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^resolv-retry\s+2m$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^verb\s+1$/)}
-    it { should contain_file('/etc/openvpn/test_server/download-configs/test_client/test_client.conf').with_content(/^mute\s+10$/)}
-  end
-
-end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_client_specific_config_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_client_specific_config_spec.rb
deleted file mode 100644
index cfdab389..00000000
--- a/puppet/modules/openvpn/spec/defines/openvpn_client_specific_config_spec.rb
+++ /dev/null
@@ -1,40 +0,0 @@
-require 'spec_helper'
-
-describe 'openvpn::client_specific_config', :type => :define do
-  let(:title) { 'test_client' }
-  let(:params) { { 'server' => 'test_server' } }
-  let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
-  let(:pre_condition) do
-    [
-      'openvpn::server { "test_server":
-        country       => "CO",
-        province      => "ST",
-        city          => "Some City",
-        organization  => "example.org",
-        email         => "testemail@example.org"
-      }',
-      'openvpn::client { "test_client":
-        server => "test_server"
-      }'
-    ].join
-  end
-
-  it { should contain_file('/etc/openvpn/test_server/client-configs/test_client') }
-
-  describe "setting no paramter at all" do
-    it { should contain_file('/etc/openvpn/test_server/client-configs/test_client').with_content(/\A\n\z/) }
-  end
-
-  describe "setting all parameters" do
-    let(:params) do
-      {:server       => 'test_server',
-       :iroute       => ['10.0.1.0 255.255.255.0'],
-       :ifconfig     => '10.10.10.2 255.255.255.0',
-       :dhcp_options => ['DNS 8.8.8.8']}
-    end
-
-    it { should contain_file('/etc/openvpn/test_server/client-configs/test_client').with_content(/^iroute 10.0.1.0 255.255.255.0$/) }
-    it { should contain_file('/etc/openvpn/test_server/client-configs/test_client').with_content(/^ifconfig-push 10.10.10.2 255.255.255.0$/) }
-    it { should contain_file('/etc/openvpn/test_server/client-configs/test_client').with_content(/^push dhcp-option DNS 8.8.8.8$/) }
-  end
-end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
deleted file mode 100644
index 467be6aa..00000000
--- a/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
+++ /dev/null
@@ -1,165 +0,0 @@
-require 'spec_helper'
-
-describe 'openvpn::server', :type => :define do
-
-  let(:title) { 'test_server' }
-
-  context "creating a server with the minimum parameters" do
-    let(:params) { {
-      'country'       => 'CO',
-      'province'      => 'ST',
-      'city'          => 'Some City',
-      'organization'  => 'example.org',
-      'email'         => 'testemail@example.org'
-    } }
-
-    let (:facts) { {
-      :ipaddress_eth0 => '1.2.3.4',
-      :network_eth0   => '1.2.3.0',
-      :netmask_eth0   => '255.255.255.0',
-      :concat_basedir => '/var/lib/puppet/concat',
-      :osfamily       => 'anything_else'
-    } }
-
-    # Files associated with a server config
-    it { should contain_file('/etc/openvpn/test_server').with('ensure' => 'directory')}
-    it { should contain_file('/etc/openvpn/test_server/client-configs').with('ensure' => 'directory')}
-    it { should contain_file('/etc/openvpn/test_server/download-configs').with('ensure' => 'directory')}
-    it { should contain_file('/etc/openvpn/test_server/easy-rsa/vars')}
-    it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf')}
-    it { should contain_file('/etc/openvpn/test_server/keys').with(
-      'ensure'  => 'link',
-      'target'  => '/etc/openvpn/test_server/easy-rsa/keys'
-    )}
-
-    # Execs to working with certificates
-    it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
-      'command' => '/bin/cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
-    )}
-    it { should contain_exec('generate dh param test_server') }
-    it { should contain_exec('initca test_server') }
-    it { should contain_exec('generate server cert test_server') }
-
-    # VPN server config file itself
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^mode\s+server$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^client\-config\-dir\s+\/etc\/openvpn\/test_server\/client\-configs$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^ca\s+\/etc\/openvpn\/test_server\/keys\/ca.crt$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^cert\s+\/etc\/openvpn\/test_server\/keys\/server.crt$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^key\s+\/etc\/openvpn\/test_server\/keys\/server.key$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^dh\s+\/etc\/openvpn\/test_server\/keys\/dh1024.pem$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^proto\s+tcp-server$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^tls-server$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^port\s+1194$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^comp-lzo$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^group\s+nogroup$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^user\s+nobody$/) }
-    it { should_not contain_file('/etc/openvpn/test_server.conf').with_content(/^log\-append\s+test_server\/openvpn\.log$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^status\s+test_server\/openvpn\-status\.log$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^dev\s+tun0$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^local\s+1\.2\.3\.4$/) }
-    it { should_not contain_file('/etc/openvpn/test_server.conf').with_content(/^ifconfig-pool-persist/) }
-  end
-
-  context "creating a server setting all parameters" do
-    let(:params) { {
-      'country'       => 'CO',
-      'province'      => 'ST',
-      'city'          => 'Some City',
-      'organization'  => 'example.org',
-      'email'         => 'testemail@example.org',
-      'compression'   => 'fake_compression',
-      'port'          => '123',
-      'proto'         => 'udp',
-      'group'         => 'someone',
-      'user'          => 'someone',
-      'logfile'       => '/var/log/openvpn/test_server.log',
-      'status_log'    => '/var/log/openvpn/test_server_status.log',
-      'dev'           => 'tun1',
-      'local'         => '2.3.4.5',
-      'ipp'           => true,
-      'server'        => '2.3.4.0 255.255.0.0',
-      'push'          => [ 'dhcp-option DNS 172.31.0.30', 'route 172.31.0.0 255.255.0.0' ]
-    } }
-
-    let (:facts) { {
-      :ipaddress_eth0 => '1.2.3.4',
-      :network_eth0   => '1.2.3.0',
-      :netmask_eth0   => '255.255.255.0',
-      :concat_basedir => '/var/lib/puppet/concat'
-    } }
-
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^mode\s+server$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^client\-config\-dir\s+\/etc\/openvpn\/test_server\/client\-configs$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^ca\s+\/etc\/openvpn\/test_server\/keys\/ca.crt$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^cert\s+\/etc\/openvpn\/test_server\/keys\/server.crt$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^key\s+\/etc\/openvpn\/test_server\/keys\/server.key$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^dh\s+\/etc\/openvpn\/test_server\/keys\/dh1024.pem$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^proto\s+udp$/) }
-    it { should_not contain_file('/etc/openvpn/test_server.conf').with_content(/^proto\s+tls-server$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^port\s+123$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^fake_compression$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^group\s+someone$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^user\s+someone$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^log\-append\s+\/var\/log\/openvpn\/test_server\.log$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^status\s+\/var\/log\/openvpn\/test_server_status\.log$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^dev\s+tun1$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^local\s+2\.3\.4\.5$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^server\s+2\.3\.4\.0\s+255\.255\.0\.0$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^push\s+dhcp-option\s+DNS\s+172\.31\.0\.30$/) }
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^push\s+route\s+172\.31\.0\.0\s+255\.255\.0\.0$/) }
-  end
-
-  context "when RedHat based machine" do
-    let(:params) { {
-      'country'       => 'CO',
-      'province'      => 'ST',
-      'city'          => 'Some City',
-      'organization'  => 'example.org',
-      'email'         => 'testemail@example.org'
-    } }
-
-    let(:facts) { { :osfamily => 'RedHat', :concat_basedir => '/var/lib/puppet/concat' } }
-
-    it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf').with(
-      'ensure'  => 'link',
-      'target'  => '/etc/openvpn/test_server/easy-rsa/openssl-1.0.0.cnf'
-    )}
-
-    it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
-      'command' => '/bin/cp -r /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
-    )}
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^group\s+nobody$/) }
-
-  end
-
-  context "when Debian based machine" do
-    let(:params) { {
-      'country'       => 'CO',
-      'province'      => 'ST',
-      'city'          => 'Some City',
-      'organization'  => 'example.org',
-      'email'         => 'testemail@example.org'
-    } }
-
-    let(:facts) { { :osfamily => 'Debian', :concat_basedir => '/var/lib/puppet/concat' } }
-
-    it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf').with(
-      'ensure'  => 'link',
-      'target'  => '/etc/openvpn/test_server/easy-rsa/openssl-1.0.0.cnf'
-    )}
-
-    it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
-      'command' => '/bin/cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
-    )}
-
-    # Configure to start vpn session
-    it { should contain_concat__fragment('openvpn.default.autostart.test_server').with(
-      'content' => "AUTOSTART=\"$AUTOSTART test_server\"\n",
-      'target'  => '/etc/default/openvpn'
-    )}
-
-    it { should contain_file('/etc/openvpn/test_server.conf').with_content(/^group\s+nogroup$/) }
-
-  end
-
-end
diff --git a/puppet/modules/openvpn/spec/spec_helper.rb b/puppet/modules/openvpn/spec/spec_helper.rb
deleted file mode 100644
index dc7e9f4a..00000000
--- a/puppet/modules/openvpn/spec/spec_helper.rb
+++ /dev/null
@@ -1,2 +0,0 @@
-require 'rubygems'
-require 'puppetlabs_spec_helper/module_spec_helper'
diff --git a/puppet/modules/openvpn/templates/client.erb b/puppet/modules/openvpn/templates/client.erb
deleted file mode 100644
index 021ed617..00000000
--- a/puppet/modules/openvpn/templates/client.erb
+++ /dev/null
@@ -1,26 +0,0 @@
-client
-ca keys/ca.crt
-cert keys/<%= scope.lookupvar('name') %>.crt
-key keys/<%= scope.lookupvar('name') %>.key
-dev <%= scope.lookupvar('dev') %>
-proto <%= scope.lookupvar('proto') %>
-remote <%= scope.lookupvar('remote_host') %> <%= scope.lookupvar('port') %>
-<% if scope.lookupvar('compression') != '' -%>
-<%= scope.lookupvar('compression') %>
-<% end -%>
-resolv-retry <%= scope.lookupvar('resolv_retry') %>
-<% if scope.lookupvar('nobind') -%>
-nobind
-<% end -%>
-<% if scope.lookupvar('persist_key') -%>
-persist-key
-<% end -%>
-<% if scope.lookupvar('persist_tun') -%>
-persist-tun
-<% end -%>
-<% if scope.lookupvar('mute_replay_warnings') -%>
-mute-replay-warnings
-<% end -%>
-ns-cert-type server
-verb <%= scope.lookupvar('verb') %>
-mute <%= scope.lookupvar('mute') %>
diff --git a/puppet/modules/openvpn/templates/client_specific_config.erb b/puppet/modules/openvpn/templates/client_specific_config.erb
deleted file mode 100644
index 62cc0e7a..00000000
--- a/puppet/modules/openvpn/templates/client_specific_config.erb
+++ /dev/null
@@ -1,10 +0,0 @@
-<% scope.lookupvar('iroute').each do |route| -%>
-iroute <%= route %>
-<% end -%>
-<% if ifconfig = scope.lookupvar('ifconfig') -%>
-ifconfig-push <%= ifconfig %>
-<% end -%>
-<% scope.lookupvar('dhcp_options').each do |option| -%>
-push dhcp-option <%= option %>
-<% end -%>
-
diff --git a/puppet/modules/openvpn/templates/etc-default-openvpn.erb b/puppet/modules/openvpn/templates/etc-default-openvpn.erb
deleted file mode 100644
index 310e462e..00000000
--- a/puppet/modules/openvpn/templates/etc-default-openvpn.erb
+++ /dev/null
@@ -1,20 +0,0 @@
-# This is the configuration file for /etc/init.d/openvpn
-
-#
-# Start only these VPNs automatically via init script.
-# Allowed values are "all", "none" or space separated list of
-# names of the VPNs. If empty, "all" is assumed.
-#
-#AUTOSTART="all"
-#AUTOSTART="none"
-#AUTOSTART="home office"
-#
-# Refresh interval (in seconds) of default status files
-# located in /var/run/openvpn.$NAME.status
-# Defaults to 10, 0 disables status file generation
-#
-#STATUSREFRESH=10
-#STATUSREFRESH=0
-# Optional arguments to openvpn's command line
-OPTARGS=""
-AUTOSTART=""
diff --git a/puppet/modules/openvpn/templates/server.erb b/puppet/modules/openvpn/templates/server.erb
deleted file mode 100644
index 6ef13263..00000000
--- a/puppet/modules/openvpn/templates/server.erb
+++ /dev/null
@@ -1,37 +0,0 @@
-mode server
-client-config-dir /etc/openvpn/<%= scope.lookupvar('name') %>/client-configs
-ca /etc/openvpn/<%= scope.lookupvar('name') %>/keys/ca.crt
-cert /etc/openvpn/<%= scope.lookupvar('name') %>/keys/server.crt
-key /etc/openvpn/<%= scope.lookupvar('name') %>/keys/server.key
-dh /etc/openvpn/<%= scope.lookupvar('name') %>/keys/dh1024.pem
-<% if scope.lookupvar('proto') == 'tcp' -%>
-proto <%= scope.lookupvar('proto') %>-server
-<% else -%>
-proto <%= scope.lookupvar('proto') %>
-<% end -%>
-port <%= scope.lookupvar('port') %>
-<% if scope.lookupvar('tls_server') -%>
-tls-server
-<% end -%>
-<% if scope.lookupvar('compression') != '' -%>
-<%= scope.lookupvar('compression') %>
-<% end -%>
-group <%= scope.lookupvar('group_to_set') %>
-user <%= scope.lookupvar('user') %>
-<% if scope.lookupvar('logfile') -%>
-log-append <%= scope.lookupvar('logfile') %>
-<% end -%>
-status <%= scope.lookupvar('status_log') %>
-dev <%= scope.lookupvar('dev') %>
-<% if scope.lookupvar('local') != '' -%>
-local <%= scope.lookupvar('local') %>
-<% end -%>
-<% if scope.lookupvar('ipp') -%>
-ifconfig-pool-persist <%= scope.lookupvar('name') %>/vpn-ipp.txt
-<% end -%>
-<% if scope.lookupvar('server') != '' -%>
-server <%= scope.lookupvar('server') %>
-<% end -%>
-<% scope.lookupvar('push').each do |item| -%>
-push <%= item %>
-<% end -%>
diff --git a/puppet/modules/openvpn/templates/vars.erb b/puppet/modules/openvpn/templates/vars.erb
deleted file mode 100644
index 20448b8b..00000000
--- a/puppet/modules/openvpn/templates/vars.erb
+++ /dev/null
@@ -1,68 +0,0 @@
-# easy-rsa parameter settings
-
-# NOTE: If you installed from an RPM,
-# don't edit this file in place in
-# /usr/share/openvpn/easy-rsa --
-# instead, you should copy the whole
-# easy-rsa directory to another location
-# (such as /etc/openvpn) so that your
-# edits will not be wiped out by a future
-# OpenVPN package upgrade.
-
-# This variable should point to
-# the top level of the easy-rsa
-# tree.
-export EASY_RSA="/etc/openvpn/<%= @name %>/easy-rsa"
-
-#
-# This variable should point to
-# the requested executables
-#
-export OPENSSL="openssl"
-export PKCS11TOOL="pkcs11-tool"
-export GREP="grep"
-
-
-# This variable should point to
-# the openssl.cnf file included
-# with easy-rsa.
-export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
-
-# Edit this variable to point to
-# your soon-to-be-created key
-# directory.
-#
-# WARNING: clean-all will do
-# a rm -rf on this directory
-# so make sure you define
-# it correctly!
-export KEY_DIR="$EASY_RSA/keys"
-
-# Issue rm -rf warning
-echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
-
-# PKCS11 fixes
-export PKCS11_MODULE_PATH="dummy"
-export PKCS11_PIN="dummy"
-
-# Increase this to 2048 if you
-# are paranoid.  This will slow
-# down TLS negotiation performance
-# as well as the one-time DH parms
-# generation process.
-export KEY_SIZE=1024
-
-# In how many days should the root CA key expire?
-export CA_EXPIRE=3650
-
-# In how many days should certificates expire?
-export KEY_EXPIRE=3650
-
-# These are the default values for fields
-# which will be placed in the certificate.
-# Don't leave any of these fields blank.
-export KEY_COUNTRY="<%= @country %>"
-export KEY_PROVINCE="<%= @province %>"
-export KEY_CITY="<%= @city %>"
-export KEY_ORG="<%= @organization %>"
-export KEY_EMAIL="<%= @email %>"
diff --git a/puppet/modules/openvpn/vagrant/client.pp b/puppet/modules/openvpn/vagrant/client.pp
deleted file mode 100644
index 7ebeb1d7..00000000
--- a/puppet/modules/openvpn/vagrant/client.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-node default {
-
-  package { 'openvpn': ensure => installed; }
-
-}
diff --git a/puppet/modules/openvpn/vagrant/server.pp b/puppet/modules/openvpn/vagrant/server.pp
deleted file mode 100644
index a95def06..00000000
--- a/puppet/modules/openvpn/vagrant/server.pp
+++ /dev/null
@@ -1,23 +0,0 @@
-node default {
-  openvpn::server { 'winterthur':
-    country      => 'CH',
-    province     => 'ZH',
-    city         => 'Winterthur',
-    organization => 'example.org',
-    email        => 'root@example.org',
-    server       => '10.200.200.0 255.255.255.0'
-  }
-
-  openvpn::client { 'client1':
-    server => 'winterthur';
-  }
-
-  openvpn::client_specific_config { 'client1':
-    server   => 'winterthur',
-    ifconfig => '10.200.200.100 255.255.255.0'
-  }
-
-  openvpn::client { 'client2':
-    server => 'winterthur';
-  }
-}
-- 
cgit v1.2.3


From 2df23a682b9a1a99502c79d7112dcefeecf63619 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 21 Jul 2016 12:13:33 -0700
Subject: git subrepo clone https://leap.se/git/puppet_openvpn
 puppet/modules/openvpn

subrepo:
  subdir:   "puppet/modules/openvpn"
  merged:   "ba7ec7a"
upstream:
  origin:   "https://leap.se/git/puppet_openvpn"
  branch:   "master"
  commit:   "ba7ec7a"
git-subrepo:
  version:  "0.3.0"
  origin:   "https://github.com/ingydotnet/git-subrepo"
  commit:   "cb2995b"
---
 puppet/modules/openvpn/.fixtures.yml               |   6 +
 puppet/modules/openvpn/.gitignore                  |   2 +
 puppet/modules/openvpn/.gitrepo                    |  11 ++
 puppet/modules/openvpn/Modulefile                  |  11 ++
 puppet/modules/openvpn/Rakefile                    |   2 +
 puppet/modules/openvpn/Readme.markdown             | 123 +++++++++++++++++
 puppet/modules/openvpn/manifests/client.pp         | 142 +++++++++++++++++++
 puppet/modules/openvpn/manifests/init.pp           |  45 ++++++
 puppet/modules/openvpn/manifests/option.pp         |  24 ++++
 puppet/modules/openvpn/manifests/server.pp         | 153 +++++++++++++++++++++
 .../openvpn/spec/classes/openvpn_init_spec.rb      |  20 +++
 .../openvpn/spec/defines/openvpn_client_spec.rb    | 116 ++++++++++++++++
 .../openvpn/spec/defines/openvpn_option_spec.rb    |  42 ++++++
 .../openvpn/spec/defines/openvpn_server_spec.rb    | 109 +++++++++++++++
 puppet/modules/openvpn/spec/spec_helper.rb         |   2 +
 .../openvpn/templates/etc-default-openvpn.erb      |  20 +++
 puppet/modules/openvpn/templates/vars.erb          |  69 ++++++++++
 17 files changed, 897 insertions(+)
 create mode 100644 puppet/modules/openvpn/.fixtures.yml
 create mode 100644 puppet/modules/openvpn/.gitignore
 create mode 100644 puppet/modules/openvpn/.gitrepo
 create mode 100644 puppet/modules/openvpn/Modulefile
 create mode 100644 puppet/modules/openvpn/Rakefile
 create mode 100644 puppet/modules/openvpn/Readme.markdown
 create mode 100644 puppet/modules/openvpn/manifests/client.pp
 create mode 100644 puppet/modules/openvpn/manifests/init.pp
 create mode 100644 puppet/modules/openvpn/manifests/option.pp
 create mode 100644 puppet/modules/openvpn/manifests/server.pp
 create mode 100644 puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/defines/openvpn_option_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
 create mode 100644 puppet/modules/openvpn/spec/spec_helper.rb
 create mode 100644 puppet/modules/openvpn/templates/etc-default-openvpn.erb
 create mode 100644 puppet/modules/openvpn/templates/vars.erb

(limited to 'puppet/modules')

diff --git a/puppet/modules/openvpn/.fixtures.yml b/puppet/modules/openvpn/.fixtures.yml
new file mode 100644
index 00000000..1125ecca
--- /dev/null
+++ b/puppet/modules/openvpn/.fixtures.yml
@@ -0,0 +1,6 @@
+fixtures:
+  repositories:
+    concat: git://github.com/ripienaar/puppet-concat.git
+  symlinks:
+    openvpn: "#{source_dir}"
+
diff --git a/puppet/modules/openvpn/.gitignore b/puppet/modules/openvpn/.gitignore
new file mode 100644
index 00000000..12c29e7d
--- /dev/null
+++ b/puppet/modules/openvpn/.gitignore
@@ -0,0 +1,2 @@
+pkg
+spec/fixtures
diff --git a/puppet/modules/openvpn/.gitrepo b/puppet/modules/openvpn/.gitrepo
new file mode 100644
index 00000000..54c861da
--- /dev/null
+++ b/puppet/modules/openvpn/.gitrepo
@@ -0,0 +1,11 @@
+; DO NOT EDIT (unless you know what you are doing)
+;
+; This subdirectory is a git "subrepo", and this file is maintained by the
+; git-subrepo command. See https://github.com/git-commands/git-subrepo#readme
+;
+[subrepo]
+	remote = https://leap.se/git/puppet_openvpn
+	branch = master
+	commit = ba7ec7abd25cd4c5031e11cd3ae17872ef31b24b
+	parent = d6719731dce8ee7e048a16a447a426abcaa44f24
+	cmdver = 0.3.0
diff --git a/puppet/modules/openvpn/Modulefile b/puppet/modules/openvpn/Modulefile
new file mode 100644
index 00000000..55b6eba0
--- /dev/null
+++ b/puppet/modules/openvpn/Modulefile
@@ -0,0 +1,11 @@
+name    'luxflux-openvpn'
+version '1.0.2'
+source 'https://github.com/luxflux/puppet-openvpn'
+author 'luxflux'
+license 'UNKNOWN'
+summary 'UNKNOWN'
+description 'UNKNOWN'
+project_page 'UNKNOWN'
+
+## Add dependencies, if any:
+dependency 'ripienaar/concat'
diff --git a/puppet/modules/openvpn/Rakefile b/puppet/modules/openvpn/Rakefile
new file mode 100644
index 00000000..14f1c246
--- /dev/null
+++ b/puppet/modules/openvpn/Rakefile
@@ -0,0 +1,2 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/rake_tasks'
diff --git a/puppet/modules/openvpn/Readme.markdown b/puppet/modules/openvpn/Readme.markdown
new file mode 100644
index 00000000..d2a1f67b
--- /dev/null
+++ b/puppet/modules/openvpn/Readme.markdown
@@ -0,0 +1,123 @@
+# OpenVPN Puppet module
+
+OpenVPN module for puppet including client config/cert creation (tarball to download)
+
+## Dependencies
+  - [puppet-concat](https://github.com/ripienaar/puppet-concat)
+
+## Supported OS
+  - Debian Squeeze (should, as it works on Ubuntu Lucid)
+  - Ubuntu 10.4, 12.04 (other untested)
+  - CentOS
+
+## Example
+
+    # add a server instance
+    openvpn::server {
+        "server1":
+            country      => "CH",
+            province     => "ZH",
+            city         => "Winterthur",
+            organization => "example.org",
+            email        => "root@example.org";
+    }
+
+    # configure server
+    openvpn::option {
+        "dev server1":
+            key    => "dev",
+            value  => "tun0",
+            server => "server1";
+        "script-security server1":
+            key    => "script-security",
+            value  => "3",
+            server => "server1";
+        "daemon server1":
+            key    => "daemon",
+            server => "server1";
+        "keepalive server1":
+            key    => "keepalive",
+            value  => "10 60",
+            server => "server1";
+        "ping-timer-rem server1":
+            key    => "ping-timer-rem",
+            server => "server1";
+        "persist-tun server1":
+            key    => "persist-tun",
+            server => "server1";
+        "persist-key server1":
+            key    => "persist-key",
+            server => "server1";
+        "proto server1":
+            key    => "proto",
+            value  => "tcp-server",
+            server => "server1";
+        "cipher server1":
+            key    => "cipher",
+            value  => "BF-CBC",
+            server => "server1";
+        "local server1":
+            key    => "local",
+            value  => $ipaddress,
+            server => "server1";
+        "tls-server server1":
+            key    => "tls-server",
+            server => "server1";
+        "server server1":
+            key    => "server",
+            value  => "10.10.10.0 255.255.255.0",
+            server => "server1";
+        "lport server1":
+            key    => "lport",
+            value  => "1194",
+            server => "server1";
+        "management server1":
+            key    => "management",
+            value  => "/var/run/openvpn-server1.sock unix",
+            server => "server1";
+        "comp-lzo server1":
+            key    => "comp-lzo",
+            server => "server1";
+        "topology server1":
+            key    => "topology",
+            value  => "subnet",
+            server => "server1";
+        "client-to-client server1":
+            key    => "client-to-client",
+            server => "server1";
+    }
+
+
+    # define clients
+    openvpn::client {
+        [ "client1.example.org", "client2.example.org" ]:
+            server      => "server1";
+    }
+
+    # add options to the client-config-dir file
+    openvpn::option {
+        "iroute server1 client1.example.org home network":
+            key    => "iroute",
+            value  => "192.168.0.0 255.255.255.0",
+            client => "client1.example.org",
+            server => "server1",
+            csc    => true;
+    }
+
+    # add an option to the client config
+    openvpn::option {
+        "ifconfig server1 client2.example.org":
+            key    => "ifconfig-push",
+            value  => "10.10.10.2 255.255.255.0",
+            client => "client2.example.org",
+            server => "server1";
+    }
+
+Don't forget the [sysctl](https://github.com/luxflux/puppet-sysctl) directive ```net.ipv4.ip_forward```!
+
+
+# Contributors
+
+These fine folks helped to get this far with this module:
+* [@jlk](https://github.com/jlk)
+* [@jlambert121](https://github.com/jlambert121)
diff --git a/puppet/modules/openvpn/manifests/client.pp b/puppet/modules/openvpn/manifests/client.pp
new file mode 100644
index 00000000..ed11b3a9
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/client.pp
@@ -0,0 +1,142 @@
+# client.pp
+
+define openvpn::client($server, $remote_host = $::fqdn) {
+    exec {
+        "generate certificate for ${name} in context of ${server}":
+            command  => ". ./vars && ./pkitool ${name}",
+            cwd      => "/etc/openvpn/${server}/easy-rsa",
+            creates  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.crt",
+            provider => 'shell',
+            require  => Exec["generate server cert ${server}"];
+    }
+
+    file {
+        "/etc/openvpn/${server}/download-configs/${name}":
+            ensure  => directory,
+            require => File["/etc/openvpn/${server}/download-configs"];
+
+        "/etc/openvpn/${server}/download-configs/${name}/keys":
+            ensure  => directory,
+            require => File["/etc/openvpn/${server}/download-configs/${name}"];
+
+        "/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt":
+            ensure  => link,
+            target  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.crt",
+            require => [  Exec["generate certificate for ${name} in context of ${server}"],
+                          File["/etc/openvpn/${server}/download-configs/${name}/keys"] ];
+
+        "/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key":
+            ensure  => link,
+            target  => "/etc/openvpn/${server}/easy-rsa/keys/${name}.key",
+            require => [  Exec["generate certificate for ${name} in context of ${server}"],
+                          File["/etc/openvpn/${server}/download-configs/${name}/keys"] ];
+
+        "/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt":
+            ensure  => link,
+            target  => "/etc/openvpn/${server}/easy-rsa/keys/ca.crt",
+            require => [  Exec["generate certificate for ${name} in context of ${server}"],
+                          File["/etc/openvpn/${server}/download-configs/${name}/keys"] ];
+    }
+
+
+    openvpn::option {
+        "ca ${server} with ${name}":
+            key    => 'ca',
+            value  => 'keys/ca.crt',
+            client => $name,
+            server => $server;
+        "cert ${server} with ${name}":
+            key    => 'cert',
+            value  => "keys/${name}.crt",
+            client => $name,
+            server => $server;
+        "key ${server} with ${name}":
+            key    => 'key',
+            value  => "keys/${name}.key",
+            client => $name,
+            server => $server;
+        "client ${server} with ${name}":
+            key    => 'client',
+            client => $name,
+            server => $server;
+        "dev ${server} with ${name}":
+            key    => 'dev',
+            value  => 'tun',
+            client => $name,
+            server => $server;
+        "proto ${server} with ${name}":
+            key    => 'proto',
+            value  => 'tcp',
+            client => $name,
+            server => $server;
+        "remote ${server} with ${name}":
+            key    => 'remote',
+            value  => "${remote_host} 1194",
+            client => $name,
+            server => $server;
+        "resolv-retry ${server} with ${name}":
+            key    => 'resolv-retry',
+            value  => 'infinite',
+            client => $name,
+            server => $server;
+        "nobind ${server} with ${name}":
+            key    => 'nobind',
+            client => $name,
+            server => $server;
+        "persist-key ${server} with ${name}":
+            key    => 'persist-key',
+            client => $name,
+            server => $server;
+        "persist-tun ${server} with ${name}":
+            key    => 'persist-tun',
+            client => $name,
+            server => $server;
+        "mute-replay-warnings ${server} with ${name}":
+            key    => 'mute-replay-warnings',
+            client => $name,
+            server => $server;
+        "ns-cert-type ${server} with ${name}":
+            key    => 'ns-cert-type',
+            value  => 'server',
+            client => $name,
+            server => $server;
+        "comp-lzo ${server} with ${name}":
+            key    => 'comp-lzo',
+            client => $name,
+            server => $server;
+        "verb ${server} with ${name}":
+            key    => 'verb',
+            value  => '3',
+            client => $name,
+            server => $server;
+        "mute ${server} with ${name}":
+            key    => 'mute',
+            value  => '20',
+            client => $name,
+            server => $server;
+    }
+
+    exec {
+        "tar the thing ${server} with ${name}":
+            cwd         => "/etc/openvpn/${server}/download-configs/",
+            command     => "/bin/rm ${name}.tar.gz; tar --exclude=\\*.conf.d -chzvf ${name}.tar.gz ${name}",
+            refreshonly => true,
+            require     => [  File["/etc/openvpn/${server}/download-configs/${name}/${name}.conf"],
+                              File["/etc/openvpn/${server}/download-configs/${name}/keys/ca.crt"],
+                              File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.key"],
+                              File["/etc/openvpn/${server}/download-configs/${name}/keys/${name}.crt"] ];
+    }
+
+
+    concat {
+        [ "/etc/openvpn/${server}/client-configs/${name}", "/etc/openvpn/${server}/download-configs/${name}/${name}.conf" ]:
+            owner   => root,
+            group   => root,
+            mode    => 644,
+            warn    => true,
+            force   => true,
+            notify  => Exec["tar the thing ${server} with ${name}"],
+            require => [ File['/etc/openvpn'], File["/etc/openvpn/${server}/download-configs/${name}"] ];
+    }
+
+}
diff --git a/puppet/modules/openvpn/manifests/init.pp b/puppet/modules/openvpn/manifests/init.pp
new file mode 100644
index 00000000..a3dd70c0
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/init.pp
@@ -0,0 +1,45 @@
+# openvpn.pp
+
+class openvpn {
+    package {
+        'openvpn':
+            ensure => installed;
+    }
+    service {
+        'openvpn':
+            ensure     => running,
+            enable     => true,
+            hasrestart => true,
+            hasstatus  => true,
+            require    => Exec['concat_/etc/default/openvpn'];
+    }
+    file {
+        '/etc/openvpn':
+            ensure  => directory,
+            require => Package['openvpn'];
+    }
+    file {
+        '/etc/openvpn/keys':
+            ensure  => directory,
+            require => File['/etc/openvpn'];
+    }
+
+    include concat::setup
+
+    concat {
+        '/etc/default/openvpn':
+            owner  => root,
+            group  => root,
+            mode   => 644,
+            warn   => true,
+            notify => Service['openvpn'];
+    }
+
+    concat::fragment {
+        'openvpn.default.header':
+            content => template('openvpn/etc-default-openvpn.erb'),
+            target  => '/etc/default/openvpn',
+            order   => 01;
+    }
+
+}
diff --git a/puppet/modules/openvpn/manifests/option.pp b/puppet/modules/openvpn/manifests/option.pp
new file mode 100644
index 00000000..eb3d5a72
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/option.pp
@@ -0,0 +1,24 @@
+# option.pp
+
+define openvpn::option($key, $server, $value = '', $client = '', $csc = false) {
+    $content = $value ? {
+        ''      => $key,
+        default => "${key} ${value}"
+    }
+
+    if $client == '' {
+        $path = "/etc/openvpn/${server}.conf"
+    } else {
+        if $csc {
+            $path = "/etc/openvpn/${server}/client-configs/${client}"
+        } else {
+            $path = "/etc/openvpn/${server}/download-configs/${client}/${client}.conf"
+        }
+    }
+
+    concat::fragment {
+        "openvpn.${server}.${client}.${name}":
+            target  => $path,
+            content => "${content}\n";
+    }
+}
diff --git a/puppet/modules/openvpn/manifests/server.pp b/puppet/modules/openvpn/manifests/server.pp
new file mode 100644
index 00000000..bfcaad83
--- /dev/null
+++ b/puppet/modules/openvpn/manifests/server.pp
@@ -0,0 +1,153 @@
+# server.pp
+
+define openvpn::server($country, $province, $city, $organization, $email) {
+    include openvpn
+
+    $easyrsa_source = $::osfamily ? {
+      'RedHat'  => '/usr/share/doc/openvpn-2.2.2/easy-rsa/2.0',
+      default   => '/usr/share/doc/openvpn/examples/easy-rsa/2.0'
+    }
+
+    $link_openssl_cnf = $::osfamily ? {
+      /(Debian|RedHat)/ => true,
+      default           => false
+    }
+
+    file {
+        "/etc/openvpn/${name}":
+            ensure  => directory,
+            require => Package['openvpn'];
+    }
+    file {
+        "/etc/openvpn/${name}/client-configs":
+            ensure  => directory,
+            require => File["/etc/openvpn/${name}"];
+        "/etc/openvpn/${name}/download-configs":
+            ensure  => directory,
+            require => File["/etc/openvpn/${name}"];
+    }
+
+    openvpn::option {
+        "client-config-dir ${name}":
+            key     => 'client-config-dir',
+            value   => "/etc/openvpn/${name}/client-configs",
+            server  => $name,
+            require => File["/etc/openvpn/${name}"];
+        "mode ${name}":
+            key     => 'mode',
+            value   => 'server',
+            server  => $name;
+    }
+
+    exec {
+        "copy easy-rsa to openvpn config folder ${name}":
+            command => "/bin/cp -r ${easyrsa_source} /etc/openvpn/${name}/easy-rsa",
+            creates => "/etc/openvpn/${name}/easy-rsa",
+            notify  => Exec['fix_easyrsa_file_permissions'],
+            require => File["/etc/openvpn/${name}"];
+    }
+    exec {
+        'fix_easyrsa_file_permissions':
+            refreshonly => true,
+            command     => "/bin/chmod 755 /etc/openvpn/${name}/easy-rsa/*";
+    }
+    file {
+        "/etc/openvpn/${name}/easy-rsa/vars":
+            ensure  => present,
+            content => template('openvpn/vars.erb'),
+            require => Exec["copy easy-rsa to openvpn config folder ${name}"];
+    }
+
+    file {
+      "/etc/openvpn/${name}/easy-rsa/openssl.cnf":
+        require => Exec["copy easy-rsa to openvpn config folder ${name}"];
+    }
+    if $link_openssl_cnf == true {
+        File["/etc/openvpn/${name}/easy-rsa/openssl.cnf"] {
+            ensure => link,
+            target => "/etc/openvpn/${name}/easy-rsa/openssl-1.0.0.cnf"
+        }
+    }
+
+    exec {
+        "generate dh param ${name}":
+            command  => '. ./vars && ./clean-all && ./build-dh',
+            cwd      => "/etc/openvpn/${name}/easy-rsa",
+            creates  => "/etc/openvpn/${name}/easy-rsa/keys/dh1024.pem",
+            provider => 'shell',
+            require  => File["/etc/openvpn/${name}/easy-rsa/vars"];
+
+        "initca ${name}":
+            command  => '. ./vars && ./pkitool --initca',
+            cwd      => "/etc/openvpn/${name}/easy-rsa",
+            creates  => "/etc/openvpn/${name}/easy-rsa/keys/ca.key",
+            provider => 'shell',
+            require  => [ Exec["generate dh param ${name}"], File["/etc/openvpn/${name}/easy-rsa/openssl.cnf"] ];
+
+        "generate server cert ${name}":
+            command  => '. ./vars && ./pkitool --server server',
+            cwd      => "/etc/openvpn/${name}/easy-rsa",
+            creates  => "/etc/openvpn/${name}/easy-rsa/keys/server.key",
+            provider => 'shell',
+            require  => Exec["initca ${name}"];
+    }
+
+    file {
+        "/etc/openvpn/${name}/keys":
+            ensure  => link,
+            target  => "/etc/openvpn/${name}/easy-rsa/keys",
+            require => Exec["copy easy-rsa to openvpn config folder ${name}"];
+    }
+
+    openvpn::option {
+        "ca ${name}":
+            key     => 'ca',
+            value   => "/etc/openvpn/${name}/keys/ca.crt",
+            require => Exec["initca ${name}"],
+            server  => $name;
+        "cert ${name}":
+            key     => 'cert',
+            value   => "/etc/openvpn/${name}/keys/server.crt",
+            require => Exec["generate server cert ${name}"],
+            server  => $name;
+        "key ${name}":
+            key     => 'key',
+            value   => "/etc/openvpn/${name}/keys/server.key",
+            require => Exec["generate server cert ${name}"],
+            server  => $name;
+        "dh ${name}":
+            key     => 'dh',
+            value   => "/etc/openvpn/${name}/keys/dh1024.pem",
+            require => Exec["generate dh param ${name}"],
+            server  => $name;
+            
+        "proto ${name}":
+            key     => 'proto',
+            value   => 'tcp',
+            require => Exec["generate dh param ${name}"],
+            server  => $name;
+            
+        "comp-lzo ${name}":
+            key     => 'comp-lzo',
+            require => Exec["generate dh param ${name}"],
+            server  => $name;            
+    }
+
+    concat::fragment {
+        "openvpn.default.autostart.${name}":
+            content => "AUTOSTART=\"\$AUTOSTART ${name}\"\n",
+            target  => '/etc/default/openvpn',
+            order   => 10;
+    }
+
+    concat {
+        "/etc/openvpn/${name}.conf":
+            owner   => root,
+            group   => root,
+            mode    => 644,
+            warn    => true,
+            require => File['/etc/openvpn'],
+            notify  => Service['openvpn'];
+    }
+
+}
diff --git a/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb b/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
new file mode 100644
index 00000000..cdfdea19
--- /dev/null
+++ b/puppet/modules/openvpn/spec/classes/openvpn_init_spec.rb
@@ -0,0 +1,20 @@
+require 'spec_helper'
+ 
+describe 'openvpn', :type => :class do
+
+  let (:facts) { { :concat_basedir => '/var/lib/puppet/concat' } }
+
+  it { should create_class('openvpn') }
+  it { should contain_class('concat::setup') }
+  it { should contain_package('openvpn') }
+  it { should contain_service('openvpn').with(
+    'ensure'  => 'running',
+    'enable'  => true
+  ) }
+
+  it { should contain_file('/etc/openvpn').with('ensure' => 'directory') }
+  it { should contain_file('/etc/openvpn/keys').with('ensure' => 'directory') }
+
+  it { should contain_concat__fragment('openvpn.default.header') }
+
+end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
new file mode 100644
index 00000000..da71d63d
--- /dev/null
+++ b/puppet/modules/openvpn/spec/defines/openvpn_client_spec.rb
@@ -0,0 +1,116 @@
+require 'spec_helper'
+ 
+describe 'openvpn::client', :type => :define do
+  let(:title) { 'test_client' }
+  let(:params) { { 'server' => 'test_server' } }
+  let(:facts) { { :fqdn => 'somehost', :concat_basedir => '/var/lib/puppet/concat' } }
+
+  it { should contain_exec('generate certificate for test_client in context of test_server') }
+
+  [ 'test_client', 'test_client/keys'].each do |directory|
+    it { should contain_file("/etc/openvpn/test_server/download-configs/#{directory}") }
+  end
+
+  [ 'test_client.crt', 'test_client.key', 'ca.crt' ].each do |file|
+    it { should contain_file("/etc/openvpn/test_server/download-configs/test_client/keys/#{file}").with(
+      'ensure'  => 'link',
+      'target'  => "/etc/openvpn/test_server/easy-rsa/keys/#{file}"
+    )}
+  end
+  
+  it { should contain_exec('tar the thing test_server with test_client').with(
+    'cwd'     => '/etc/openvpn/test_server/download-configs/',
+    'command' => '/bin/rm test_client.tar.gz; tar --exclude=\*.conf.d -chzvf test_client.tar.gz test_client'
+  ) }
+
+  it { should contain_openvpn__option('ca test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'ca', 
+    'value'   => 'keys/ca.crt'
+  )}
+  it { should contain_openvpn__option('cert test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'cert', 
+    'value'   => 'keys/test_client.crt'
+  )}
+  it { should contain_openvpn__option('key test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'key', 
+    'value'   => 'keys/test_client.key'
+  )}
+  it { should contain_openvpn__option('client test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'client'
+  )}
+  it { should contain_openvpn__option('dev test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'dev', 
+    'value'   => 'tun'
+  )}
+  it { should contain_openvpn__option('proto test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'proto', 
+    'value'   => 'tcp'
+  )}
+  it { should contain_openvpn__option('remote test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'remote', 
+    'value'   => 'somehost 1194'
+  )}
+  it { should contain_openvpn__option('resolv-retry test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'resolv-retry', 
+    'value'   => 'infinite'
+  )}
+  it { should contain_openvpn__option('nobind test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'nobind'
+  )}
+  it { should contain_openvpn__option('persist-key test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'persist-key'
+  )}
+  it { should contain_openvpn__option('persist-tun test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'persist-tun'
+  )}
+  it { should contain_openvpn__option('mute-replay-warnings test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'mute-replay-warnings'
+  )}
+  it { should contain_openvpn__option('ns-cert-type test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'ns-cert-type', 
+    'value'   => 'server'
+  )}
+  it { should contain_openvpn__option('comp-lzo test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'comp-lzo'
+  )}
+  it { should contain_openvpn__option('verb test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'verb', 
+    'value'   => '3'
+  )}
+  it { should contain_openvpn__option('mute test_server with test_client').with(
+    'server'  => 'test_server', 
+    'client'  => 'test_client',
+    'key'     => 'mute', 
+    'value'   => '20'
+  )}
+end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_option_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_option_spec.rb
new file mode 100644
index 00000000..a2d1661d
--- /dev/null
+++ b/puppet/modules/openvpn/spec/defines/openvpn_option_spec.rb
@@ -0,0 +1,42 @@
+require 'spec_helper'
+ 
+describe 'openvpn::option', :type => :define do
+
+  let(:title) { 'test_param' }
+  
+  context "when key => 'test_key', server => 'test_server'" do
+    let(:params) { { 'key' => 'test_key', 'server' => 'test_server' } }
+
+    it { should contain_concat__fragment('openvpn.test_server..test_param').with(
+      'target'  => '/etc/openvpn/test_server.conf',
+      'content' => "test_key\n"
+    ) }
+  end
+
+  context "when key => 'test_key', value => 'test_value', server => 'test_server'" do
+    let(:params) { { 'key' => 'test_key', 'value' => 'test_value', 'server' => 'test_server' } }
+
+    it { should contain_concat__fragment('openvpn.test_server..test_param').with(
+      'target'  => '/etc/openvpn/test_server.conf',
+      'content' => "test_key test_value\n"
+    ) }
+  end
+  
+  context "when key => 'test_key', server => 'test_server', client => 'test_client'" do
+    let(:params) { { 'key' => 'test_key', 'server' => 'test_server', 'client' => 'test_client' } }
+
+    it { should contain_concat__fragment('openvpn.test_server.test_client.test_param').with(
+      'target'  => '/etc/openvpn/test_server/download-configs/test_client/test_client.conf',
+      'content' => "test_key\n"
+    ) }
+  end
+
+  context "when key => 'test_key', server => 'test_server', client => 'test_client', csc => true" do
+    let(:params) { { 'key' => 'test_key', 'server' => 'test_server', 'client' => 'test_client', 'csc' => 'true' } }
+
+    it { should contain_concat__fragment('openvpn.test_server.test_client.test_param').with(
+      'target'  => '/etc/openvpn/test_server/client-configs/test_client',
+      'content' => "test_key\n"
+    ) }
+  end
+end
diff --git a/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb b/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
new file mode 100644
index 00000000..1032302e
--- /dev/null
+++ b/puppet/modules/openvpn/spec/defines/openvpn_server_spec.rb
@@ -0,0 +1,109 @@
+require 'spec_helper'
+ 
+describe 'openvpn::server', :type => :define do
+  
+  let(:title) { 'test_server' }
+  let(:params) { {
+    'country'       => 'CO',
+    'province'      => 'ST',
+    'city'          => 'Some City',
+    'organization'  => 'example.org',
+    'email'         => 'testemail@example.org'
+  } }
+
+  let (:facts) { { :concat_basedir => '/var/lib/puppet/concat' } }
+  
+  # Files associated with a server config
+  it { should contain_file('/etc/openvpn/test_server').with('ensure' => 'directory')}
+  it { should contain_file('/etc/openvpn/test_server/client-configs').with('ensure' => 'directory')}
+  it { should contain_file('/etc/openvpn/test_server/download-configs').with('ensure' => 'directory')}
+  it { should contain_file('/etc/openvpn/test_server/easy-rsa/vars')}
+  it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf')}
+  it { should contain_file('/etc/openvpn/test_server/keys').with(
+    'ensure'  => 'link',
+    'target'  => '/etc/openvpn/test_server/easy-rsa/keys'
+  )}
+  
+  it { should contain_concat__fragment('openvpn.default.autostart.test_server').with(
+    'content' => "AUTOSTART=\"$AUTOSTART test_server\"\n",
+    'target'  => '/etc/default/openvpn'
+  )}
+  
+  # Execs to working with certificates
+  it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
+    'command' => '/bin/cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
+  )}
+  it { should contain_exec('generate dh param test_server') }
+  it { should contain_exec('initca test_server') }
+  it { should contain_exec('generate server cert test_server') }
+  
+  # Options that should be set
+  it { should contain_openvpn__option('client-config-dir test_server').with(
+    'server'  => 'test_server',
+    'key'     => 'client-config-dir',
+    'value'   => '/etc/openvpn/test_server/client-configs'
+  )}
+  it { should contain_openvpn__option('mode test_server').with(
+    'server'  => 'test_server', 
+    'key'     => 'mode', 
+    'value'   => 'server'
+  )}
+  it { should contain_openvpn__option('ca test_server').with(
+    'server'  => 'test_server', 
+    'key'     => 'ca', 
+    'value'   => '/etc/openvpn/test_server/keys/ca.crt'
+  )}
+  it { should contain_openvpn__option('cert test_server').with(
+    'server'  => 'test_server', 
+    'key'     => 'cert', 
+    'value'   => '/etc/openvpn/test_server/keys/server.crt'
+  )}
+  it { should contain_openvpn__option('key test_server').with(
+    'server'  => 'test_server', 
+    'key'     => 'key', 
+    'value'   => '/etc/openvpn/test_server/keys/server.key'
+  )}
+  it { should contain_openvpn__option('dh test_server').with(
+    'server'  => 'test_server', 
+    'key'     => 'dh', 
+    'value'   => '/etc/openvpn/test_server/keys/dh1024.pem'
+  )}
+  it { should contain_openvpn__option('proto test_server').with(
+    'server'  => 'test_server', 
+    'key'     => 'proto', 
+    'value'   => 'tcp'
+  )}
+  it { should contain_openvpn__option('comp-lzo test_server').with(
+    'server'  => 'test_server', 
+    'key'     => 'comp-lzo'
+  )}  
+
+  context "when RedHat based machine" do
+    let(:facts) { { :osfamily => 'RedHat', :concat_basedir => '/var/lib/puppet/concat' } }
+    
+    it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf').with(
+      'ensure'  => 'link',
+      'target'  => '/etc/openvpn/test_server/easy-rsa/openssl-1.0.0.cnf'
+    )}
+    
+    it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
+      'command' => '/bin/cp -r /usr/share/doc/openvpn-2.2.2/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
+    )}
+    
+  end
+    
+  context "when Debian based machine" do 
+    let(:facts) { { :osfamily => 'Debian', :concat_basedir => '/var/lib/puppet/concat' } }
+
+    it { should contain_file('/etc/openvpn/test_server/easy-rsa/openssl.cnf').with(
+      'ensure'  => 'link',
+      'target'  => '/etc/openvpn/test_server/easy-rsa/openssl-1.0.0.cnf'
+    )}
+    
+    it { should contain_exec('copy easy-rsa to openvpn config folder test_server').with(
+      'command' => '/bin/cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 /etc/openvpn/test_server/easy-rsa'
+    )}
+
+  end
+    
+end
diff --git a/puppet/modules/openvpn/spec/spec_helper.rb b/puppet/modules/openvpn/spec/spec_helper.rb
new file mode 100644
index 00000000..dc7e9f4a
--- /dev/null
+++ b/puppet/modules/openvpn/spec/spec_helper.rb
@@ -0,0 +1,2 @@
+require 'rubygems'
+require 'puppetlabs_spec_helper/module_spec_helper'
diff --git a/puppet/modules/openvpn/templates/etc-default-openvpn.erb b/puppet/modules/openvpn/templates/etc-default-openvpn.erb
new file mode 100644
index 00000000..310e462e
--- /dev/null
+++ b/puppet/modules/openvpn/templates/etc-default-openvpn.erb
@@ -0,0 +1,20 @@
+# This is the configuration file for /etc/init.d/openvpn
+
+#
+# Start only these VPNs automatically via init script.
+# Allowed values are "all", "none" or space separated list of
+# names of the VPNs. If empty, "all" is assumed.
+#
+#AUTOSTART="all"
+#AUTOSTART="none"
+#AUTOSTART="home office"
+#
+# Refresh interval (in seconds) of default status files
+# located in /var/run/openvpn.$NAME.status
+# Defaults to 10, 0 disables status file generation
+#
+#STATUSREFRESH=10
+#STATUSREFRESH=0
+# Optional arguments to openvpn's command line
+OPTARGS=""
+AUTOSTART=""
diff --git a/puppet/modules/openvpn/templates/vars.erb b/puppet/modules/openvpn/templates/vars.erb
new file mode 100644
index 00000000..de988f45
--- /dev/null
+++ b/puppet/modules/openvpn/templates/vars.erb
@@ -0,0 +1,69 @@
+# easy-rsa parameter settings
+
+# NOTE: If you installed from an RPM,
+# don't edit this file in place in
+# /usr/share/openvpn/easy-rsa --
+# instead, you should copy the whole
+# easy-rsa directory to another location
+# (such as /etc/openvpn) so that your
+# edits will not be wiped out by a future
+# OpenVPN package upgrade.
+
+# This variable should point to
+# the top level of the easy-rsa
+# tree.
+export EASY_RSA="/etc/openvpn/<%= name %>/easy-rsa"
+
+#
+# This variable should point to
+# the requested executables
+#
+export OPENSSL="openssl"
+export PKCS11TOOL="pkcs11-tool"
+export GREP="grep"
+
+
+# This variable should point to
+# the openssl.cnf file included
+# with easy-rsa.
+export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
+
+# Edit this variable to point to
+# your soon-to-be-created key
+# directory.
+#
+# WARNING: clean-all will do
+# a rm -rf on this directory
+# so make sure you define
+# it correctly!
+export KEY_DIR="$EASY_RSA/keys"
+
+# Issue rm -rf warning
+echo NOTE: If you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
+
+# PKCS11 fixes
+export PKCS11_MODULE_PATH="dummy"
+export PKCS11_PIN="dummy"
+
+# Increase this to 2048 if you
+# are paranoid.  This will slow
+# down TLS negotiation performance
+# as well as the one-time DH parms
+# generation process.
+export KEY_SIZE=1024
+
+# In how many days should the root CA key expire?
+export CA_EXPIRE=3650
+
+# In how many days should certificates expire?
+export KEY_EXPIRE=3650
+
+# These are the default values for fields
+# which will be placed in the certificate.
+# Don't leave any of these fields blank.
+export KEY_COUNTRY="<%= country %>"
+export KEY_PROVINCE="<%= province %>"
+export KEY_CITY="<%= city %>"
+export KEY_ORG="<%= organization %>"
+export KEY_EMAIL="<%= email %>"
+
-- 
cgit v1.2.3


From 26537fa81d6f97c6643fa41e5bfc5b8d0151049e Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 21 Jul 2016 21:10:54 -0700
Subject: fix couchdb's backupninja

---
 puppet/modules/site_couchdb/manifests/backup.pp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_couchdb/manifests/backup.pp b/puppet/modules/site_couchdb/manifests/backup.pp
index 8b5aa6ea..a9771776 100644
--- a/puppet/modules/site_couchdb/manifests/backup.pp
+++ b/puppet/modules/site_couchdb/manifests/backup.pp
@@ -1,8 +1,8 @@
 class site_couchdb::backup {
 
   # general backupninja config
-  backupninja::config { 'backupninja_config':
-    usecolors     => false,
+  class { 'backupninja':
+    usecolors => false
   }
 
   # dump all DBs locally to /var/backups/couchdb once a day
-- 
cgit v1.2.3


From 2aa19e3197e592ecabfa8d8b8ec29735b951ed08 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 21 Jul 2016 21:11:31 -0700
Subject: fix site_static's call to passenger

---
 puppet/modules/site_static/manifests/init.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 0acfc223..462e6e05 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -56,7 +56,7 @@ class site_static {
   if (member($formats, 'rack')) {
     include site_apt::preferences::passenger
     class { 'passenger':
-      use_munin => false,
+      manage_munin => false,
       require   => Class['site_apt::preferences::passenger']
     }
   }
-- 
cgit v1.2.3


From 5dfa7c46d09beaa15efec7248719833e9b6a9e20 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 2 Aug 2016 14:50:18 -0400
Subject: Set TCP_NODELAY option for couchdb (#8264)

Mochiweb in couchdb by default sets the TCP socket option SO_NODELAY to
false. This means that small data sent to the TCP socket, like the reply
to a document write request (or reading a very small document), will not
be sent immediately to the network - TCP will buffer it for a while
hoping that it will be asked to send more data through the same socket
and then send all the data at once for increased performance.

Setting this increases the couchdb speed significantly.

Change-Id: Ib493ef061ff62c9bdee501e44ce2b55990fe14b7
---
 puppet/modules/site_couchdb/files/local.ini | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_couchdb/files/local.ini b/puppet/modules/site_couchdb/files/local.ini
index b921a927..a6f4d981 100644
--- a/puppet/modules/site_couchdb/files/local.ini
+++ b/puppet/modules/site_couchdb/files/local.ini
@@ -6,3 +6,6 @@
 
 [compactions]
 _default = [{db_fragmentation, "70%"}, {view_fragmentation, "60%"}, {from, "03:00"}, {to, "05:00"}]
+
+[httpd]
+socket_options = [{nodelay, true}]
-- 
cgit v1.2.3


From 8af8d4ec1ba1448fa65792903d04adb80ce0bf9c Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 4 Aug 2016 10:15:44 -0400
Subject: Remove site-apache symlink.

There is no need to keep this symlink around any longer, it was there
for older puppet.

Change-Id: Ie7a380821d478e5ad69df39f03009d773afb73f3
---
 puppet/modules/site-apache | 1 -
 1 file changed, 1 deletion(-)
 delete mode 120000 puppet/modules/site-apache

(limited to 'puppet/modules')

diff --git a/puppet/modules/site-apache b/puppet/modules/site-apache
deleted file mode 120000
index f0517fa5..00000000
--- a/puppet/modules/site-apache
+++ /dev/null
@@ -1 +0,0 @@
-site_apache
\ No newline at end of file
-- 
cgit v1.2.3


From 5d6a4c389b93486ab1aa0012284b5bdcfbbc8a20 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 4 Aug 2016 14:57:03 -0400
Subject: Disallow intra-client connectivity (#8272).

If you connect to the VPN with a client, you can make direct network
connections to the other connected clients.

This allows communication to the eip gateways, but disallows any other
connections.

Change-Id: I73e5bb5715e4d91256cbf95eda8c0ec70aa75f93
---
 puppet/modules/site_shorewall/manifests/eip.pp | 34 ++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp
index 21934761..b31f5c6f 100644
--- a/puppet/modules/site_shorewall/manifests/eip.pp
+++ b/puppet/modules/site_shorewall/manifests/eip.pp
@@ -85,6 +85,40 @@ class site_shorewall::eip {
       proto           => 'tcp',
       destinationport => 'domain',
       order           => 301;
+
+    'accept_all_eip_to_eip_gateway_udp_unlimited':
+      action          => 'ACCEPT',
+      source          => 'eip',
+      destination     => 'eip:10.41.0.1',
+      proto           => 'all',
+      order           => 302;
+
+    'accept_all_eip_to_eip_gateway_tcp_unlimited':
+      action          => 'ACCEPT',
+      source          => 'eip',
+      destination     => 'eip:10.42.0.1',
+      proto           => 'all',
+      order           => 303;
+
+    'accept_all_eip_to_eip_gateway_udp_limited':
+      action          => 'ACCEPT',
+      source          => 'eip',
+      destination     => 'eip:10.43.0.1',
+      proto           => 'all',
+      order           => 302;
+
+    'accept_all_eip_to_eip_gateway_tcp_limited':
+      action          => 'ACCEPT',
+      source          => 'eip',
+      destination     => 'eip:10.44.0.1',
+      proto           => 'all',
+      order           => 303;
+
+    'reject_all_other_eip_to_eip':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'eip',
+      order           => 304;
   }
 
   # create dnat rule for each port
-- 
cgit v1.2.3


From 9c2025cd0dbd8b8e19a838c3be2669a288f8a6b9 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 4 Aug 2016 14:57:03 -0400
Subject: Disallow intra-client connectivity (#8272).

If you connect to the VPN with a client, you can make direct network
connections to the other connected clients.

This allows communication to the eip gateways, but disallows any other
connections.

Change-Id: I73e5bb5715e4d91256cbf95eda8c0ec70aa75f93
---
 puppet/modules/site_shorewall/manifests/eip.pp | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp
index b31f5c6f..9da0ae3a 100644
--- a/puppet/modules/site_shorewall/manifests/eip.pp
+++ b/puppet/modules/site_shorewall/manifests/eip.pp
@@ -105,20 +105,19 @@ class site_shorewall::eip {
       source          => 'eip',
       destination     => 'eip:10.43.0.1',
       proto           => 'all',
-      order           => 302;
+      order           => 304;
 
     'accept_all_eip_to_eip_gateway_tcp_limited':
       action          => 'ACCEPT',
       source          => 'eip',
       destination     => 'eip:10.44.0.1',
-      proto           => 'all',
-      order           => 303;
+      order           => 305;
 
     'reject_all_other_eip_to_eip':
       action          => 'REJECT',
       source          => 'eip',
       destination     => 'eip',
-      order           => 304;
+      order           => 306;
   }
 
   # create dnat rule for each port
-- 
cgit v1.2.3


From 7a3c80abc416bd022bf9d53d8641fc383c51b23d Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Thu, 4 Aug 2016 15:34:14 -0400
Subject: Stricter VPN egress firewall (#8289)

Change-Id: Ie09a6a34dfa8fe3d72568d2de0b208e7d947412f
---
 puppet/modules/site_shorewall/manifests/eip.pp | 115 +++++++++++++++++++++++++
 1 file changed, 115 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_shorewall/manifests/eip.pp b/puppet/modules/site_shorewall/manifests/eip.pp
index 9da0ae3a..5aac4fdd 100644
--- a/puppet/modules/site_shorewall/manifests/eip.pp
+++ b/puppet/modules/site_shorewall/manifests/eip.pp
@@ -118,6 +118,121 @@ class site_shorewall::eip {
       source          => 'eip',
       destination     => 'eip',
       order           => 306;
+    # Strict egress filtering:
+    # SMTP (TCP 25)
+    # Trivial File Transfer Protocol - TFTP (UDP 69)
+    # MS RPC (TCP & UDP 135)
+    # NetBIOS/IP (TCP/UDP 139 & UDP 137, UDP 138)
+    # Simple Network Management Protocol – SNMP (UDP/TCP 161-162)
+    # SMB/IP (TCP/UDP 445)
+    # Syslog (UDP 514)
+    # Gamqowi trojan: TCP 4661
+    # Mneah trojan: TCP 4666
+    'reject_outgoing_smtp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => 'smtp',
+      order           => 401;
+    'reject_outgoing_tftp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => 'tftp',
+      order           => 402;
+    'reject_outgoing_ms_rpc_tcp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => '135',
+      order           => 403;
+    'reject_outgoing_ms_rpc_udp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => '135',
+      order           => 404;
+    'reject_outgoing_netbios_tcp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => '139',
+      order           => 405;
+    'reject_outgoing_netbios_udp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => '139',
+      order           => 406;
+    'reject_outgoing_netbios_2':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => '137',
+      order           => 407;
+    'reject_outgoing_netbios_3':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => '138',
+      order           => 408;
+    'reject_outgoing_snmp_udp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => 'snmp',
+      order           => 409;
+    'reject_outgoing_snmp_tcp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => 'snmp',
+      order           => 410;
+    'reject_outgoing_smb_udp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => '445',
+      order           => 411;
+    'reject_outgoing_smb_tcp':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => '445',
+      order           => 412;
+    'reject_outgoing_syslog':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'udp',
+      destinationport => 'syslog',
+      order           => 413;
+    'reject_outgoing_gamqowi':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => '4661',
+      order           => 414;
+    'reject_outgoing_mneah':
+      action          => 'REJECT',
+      source          => 'eip',
+      destination     => 'net',
+      proto           => 'tcp',
+      destinationport => '4666',
+      order           => 415;
   }
 
   # create dnat rule for each port
-- 
cgit v1.2.3


From 31dfdfc32439980e92e6472a8392850e2c9b6bd0 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 16 Aug 2016 14:23:16 -0400
Subject: ignore noisy 401 errors from soledad log.

Change-Id: Ia1764cb28e263353856523c11f351a39774bf3b4
---
 puppet/modules/site_check_mk/files/agent/logwatch/soledad.cfg | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/soledad.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/soledad.cfg
index 3af5045b..11ad3a54 100644
--- a/puppet/modules/site_check_mk/files/agent/logwatch/soledad.cfg
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/soledad.cfg
@@ -1,4 +1,7 @@
 /var/log/soledad.log
+# Ignore 401 errors because they are quite noisy due to scanners giving us many false
+# positives, and we do not need to see those
+ I \".*401 [0-9]+
  C WSGI application error
  C Error
  C error
-- 
cgit v1.2.3


From c6aea725ed673a50ad0c9291c2f90ade44f20d8c Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Fri, 19 Aug 2016 08:21:06 -0400
Subject: Fix rsyslog auth.log entries (#8381).

The auth.log rsyslog entry was accidentally removed in #7863.

Change-Id: I4ebffeafedbca5df902041ddd2bcb80d3f68b230
---
 puppet/modules/site_rsyslog/templates/client.conf.erb | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_rsyslog/templates/client.conf.erb b/puppet/modules/site_rsyslog/templates/client.conf.erb
index 553b8373..12d6ea9b 100644
--- a/puppet/modules/site_rsyslog/templates/client.conf.erb
+++ b/puppet/modules/site_rsyslog/templates/client.conf.erb
@@ -83,7 +83,7 @@ $ActionSendStreamDriverAuthMode anon
 
 <% if scope.lookupvar('rsyslog::log_style') == 'debian' -%>
 # Log auth messages locally
-.*;auth,authpriv.none;mail.none -/var/log/syslog
+auth,authpriv.*                 /var/log/auth.log
 <% elsif scope.lookupvar('rsyslog::log_style') == 'redhat' -%>
 # Log auth messages locally
 auth,authpriv.*                 /var/log/secure
@@ -93,6 +93,7 @@ auth,authpriv.*                 /var/log/secure
 <% if scope.lookupvar('rsyslog::log_style') == 'debian' -%>
 # First some standard log files.  Log by facility.
 #
+*.*;auth,authpriv.none;mail.none -/var/log/syslog
 cron.*                          /var/log/cron.log
 daemon.*                       -/var/log/daemon.log
 kern.*                         -/var/log/kern.log
-- 
cgit v1.2.3


From d0532dbe3463a2103ae4a0757c5168478a1ffb99 Mon Sep 17 00:00:00 2001
From: Micah <micah@leap.se>
Date: Tue, 23 Aug 2016 09:08:27 -0400
Subject: syslog: remove duplicate messages (#8405).

Change-Id: I90f8d160d2293288066847bcc199f480d06d877d
---
 puppet/modules/site_rsyslog/templates/client.conf.erb | 4 ----
 1 file changed, 4 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_rsyslog/templates/client.conf.erb b/puppet/modules/site_rsyslog/templates/client.conf.erb
index 12d6ea9b..1a1e4b6d 100644
--- a/puppet/modules/site_rsyslog/templates/client.conf.erb
+++ b/puppet/modules/site_rsyslog/templates/client.conf.erb
@@ -106,10 +106,6 @@ user.*                         -/var/log/user.log
 *.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug
-*.=info;*.=notice;*.=warn;\
-       auth,authpriv.none;\
-       cron,daemon.none;\
-       mail,news.none          -/var/log/messages
 
 # Log anything (except mail) of level info or higher.
 # Don't log private authentication messages!
-- 
cgit v1.2.3


From dadac49e55f19e7ac814ae798dcfb87fddbef0ba Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 29 Aug 2016 18:31:42 +0200
Subject: [feat] Use twisted 16.2 from jessie-backports

New soledad packages now depend on Twisted 16.2.0 (see
https://leap.se/code/issues/8412), so we need to pin twisted to get
installed from jessie-backports.

- Resolves: #8418
---
 .../site_apt/manifests/preferences/twisted.pp      | 11 +++++++
 puppet/modules/site_webapp/manifests/init.pp       | 35 +++++++++++-----------
 2 files changed, 29 insertions(+), 17 deletions(-)
 create mode 100644 puppet/modules/site_apt/manifests/preferences/twisted.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apt/manifests/preferences/twisted.pp b/puppet/modules/site_apt/manifests/preferences/twisted.pp
new file mode 100644
index 00000000..a3fa0950
--- /dev/null
+++ b/puppet/modules/site_apt/manifests/preferences/twisted.pp
@@ -0,0 +1,11 @@
+# Pin twisted to jessie-backports in order to
+# use 16.2.0 for i.e. soledad
+class site_apt::preferences::twisted {
+
+  apt::preferences_snippet { 'twisted':
+    package  => 'python-twisted*',
+    release  => "${::lsbdistcodename}-backports",
+    priority => 999;
+  }
+
+}
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index 15925aba..cdad206a 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -16,21 +16,22 @@ class site_webapp {
 
   Class['site_config::default'] -> Class['site_webapp']
 
-  include site_config::ruby::dev
-  include site_webapp::apache
-  include site_webapp::couchdb
-  include site_haproxy
-  include site_webapp::cron
-  include site_config::default
-  include site_config::x509::cert
-  include site_config::x509::key
-  include site_config::x509::ca
-  include site_config::x509::client_ca::ca
-  include site_config::x509::client_ca::key
-  include site_nickserver
+  include ::site_config::ruby::dev
+  include ::site_webapp::apache
+  include ::site_webapp::couchdb
+  include ::site_haproxy
+  include ::site_webapp::cron
+  include ::site_config::default
+  include ::site_config::x509::cert
+  include ::site_config::x509::key
+  include ::site_config::x509::ca
+  include ::site_config::x509::client_ca::ca
+  include ::site_config::x509::client_ca::key
+  include ::site_nickserver
+  include ::site_apt::preferences::twisted
 
   # remove leftovers from previous installations on webapp nodes
-  include site_config::remove::webapp
+  include ::site_config::remove::webapp
 
   group { 'leap-webapp':
     ensure    => present,
@@ -163,17 +164,17 @@ class site_webapp {
   if $tor {
     $hidden_service = $tor['hidden_service']
     if $hidden_service['active'] {
-      include site_webapp::hidden_service
+      include ::site_webapp::hidden_service
     }
   }
 
 
   # needed for the soledad-sync check which is run on the
   # webapp node
-  include soledad::client
+  include ::soledad::client
 
   leap::logfile { 'webapp': }
 
-  include site_shorewall::webapp
-  include site_check_mk::agent::webapp
+  include ::site_shorewall::webapp
+  include ::site_check_mk::agent::webapp
 }
-- 
cgit v1.2.3


From d3bde1463bd31121a0015a93ad29f4db69fd77c7 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 29 Aug 2016 18:35:31 +0200
Subject: lint site_webapp/manifests/init.pp

---
 puppet/modules/site_webapp/manifests/init.pp | 36 +++++++++++++++++++---------
 1 file changed, 25 insertions(+), 11 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index cdad206a..83cf99a9 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -92,12 +92,16 @@ class site_webapp {
     '/srv/leap/webapp/config/provider':
       ensure  => directory,
       require => Vcsrepo['/srv/leap/webapp'],
-      owner   => leap-webapp, group => leap-webapp, mode => '0755';
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
+      mode    => '0755';
 
     '/srv/leap/webapp/config/provider/provider.json':
       content => $provider,
       require => Vcsrepo['/srv/leap/webapp'],
-      owner   => leap-webapp, group => leap-webapp, mode => '0644';
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
+      mode    => '0644';
 
     '/srv/leap/webapp/public/ca.crt':
       ensure  => link,
@@ -107,27 +111,37 @@ class site_webapp {
     "/srv/leap/webapp/public/${api_version}":
       ensure  => directory,
       require => Vcsrepo['/srv/leap/webapp'],
-      owner   => leap-webapp, group => leap-webapp, mode => '0755';
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
+      mode    => '0755';
 
     "/srv/leap/webapp/public/${api_version}/config/":
       ensure  => directory,
       require => Vcsrepo['/srv/leap/webapp'],
-      owner   => leap-webapp, group => leap-webapp, mode => '0755';
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
+      mode    => '0755';
 
     "/srv/leap/webapp/public/${api_version}/config/eip-service.json":
       content => $eip_service,
       require => Vcsrepo['/srv/leap/webapp'],
-      owner   => leap-webapp, group => leap-webapp, mode => '0644';
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
+      mode    => '0644';
 
     "/srv/leap/webapp/public/${api_version}/config/soledad-service.json":
       content => $soledad_service,
       require => Vcsrepo['/srv/leap/webapp'],
-      owner   => leap-webapp, group => leap-webapp, mode => '0644';
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
+      mode    => '0644';
 
     "/srv/leap/webapp/public/${api_version}/config/smtp-service.json":
       content => $smtp_service,
       require => Vcsrepo['/srv/leap/webapp'],
-      owner   => leap-webapp, group => leap-webapp, mode => '0644';
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
+      mode    => '0644';
   }
 
   try::file {
@@ -136,8 +150,8 @@ class site_webapp {
       recurse => true,
       purge   => true,
       force   => true,
-      owner   => leap-webapp,
-      group   => leap-webapp,
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
       mode    => 'u=rwX,go=rX',
       require => Vcsrepo['/srv/leap/webapp'],
       notify  => Exec['compile_assets'],
@@ -154,8 +168,8 @@ class site_webapp {
   file {
     '/srv/leap/webapp/config/config.yml':
       content => template('site_webapp/config.yml.erb'),
-      owner   => leap-webapp,
-      group   => leap-webapp,
+      owner   => 'leap-webapp',
+      group   => 'leap-webapp',
       mode    => '0600',
       require => Vcsrepo['/srv/leap/webapp'],
       notify  => Service['apache'];
-- 
cgit v1.2.3


From 1b4a1aaa6097e0fda72a7829ea3eb029a9e16c93 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 31 Aug 2016 09:47:08 +0200
Subject: Document site_check_mk::agent::soledad

---
 puppet/modules/site_check_mk/manifests/agent/soledad.pp | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/manifests/agent/soledad.pp b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
index f4a3f3a6..d6aa810a 100644
--- a/puppet/modules/site_check_mk/manifests/agent/soledad.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
@@ -1,3 +1,4 @@
+# Configure soledad check_mk checks
 class site_check_mk::agent::soledad {
 
   file { '/etc/check_mk/logwatch.d/soledad.cfg':
-- 
cgit v1.2.3


From b0c33b9c66116eb49f583a05d7baaaab7b6e7a15 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 31 Aug 2016 21:36:44 +0200
Subject: [style] lint soledad::server

---
 puppet/modules/soledad/manifests/server.pp | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/soledad/manifests/server.pp b/puppet/modules/soledad/manifests/server.pp
index 6cf806d0..c5e2455d 100644
--- a/puppet/modules/soledad/manifests/server.pp
+++ b/puppet/modules/soledad/manifests/server.pp
@@ -2,8 +2,8 @@
 class soledad::server {
   tag 'leap_service'
 
-  include site_config::default
-  include soledad::common
+  include ::site_config::default
+  include ::soledad::common
 
   $soledad              = hiera('soledad')
   $couchdb_user         = $soledad['couchdb_soledad_user']['username']
@@ -90,11 +90,11 @@ class soledad::server {
   }
   user {
     'soledad':
-      ensure    => present,
-      system    => true,
-      gid       => 'soledad',
-      home      => '/srv/leap/soledad',
-      require   => Group['soledad'];
+      ensure  => present,
+      system  => true,
+      gid     => 'soledad',
+      home    => '/srv/leap/soledad',
+      require => Group['soledad'];
     'soledad-admin':
       ensure  => present,
       system  => true,
-- 
cgit v1.2.3


From 9ef0d00b4302b7ddfc9d5620eeb4fad90d3a15aa Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 31 Aug 2016 22:11:49 +0200
Subject: [bug] Remove Nagios soledad procs check

leap_cli already checks for running procs

- Resolves: #8380
---
 puppet/modules/site_check_mk/manifests/agent/soledad.pp | 10 ----------
 puppet/modules/site_config/manifests/remove/soledad.pp  | 12 ++++++++++++
 puppet/modules/soledad/manifests/server.pp              |  1 +
 3 files changed, 13 insertions(+), 10 deletions(-)
 create mode 100644 puppet/modules/site_config/manifests/remove/soledad.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/manifests/agent/soledad.pp b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
index d6aa810a..a8febaae 100644
--- a/puppet/modules/site_check_mk/manifests/agent/soledad.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
@@ -5,14 +5,4 @@ class site_check_mk::agent::soledad {
     source => 'puppet:///modules/site_check_mk/agent/logwatch/soledad.cfg',
   }
 
-  # local nagios plugin checks via mrpe
-
-  augeas { 'Soledad_Procs':
-    incl    => '/etc/check_mk/mrpe.cfg',
-    lens    => 'Spacevars.lns',
-    changes => [
-      'rm /files/etc/check_mk/mrpe.cfg/Soledad_Procs',
-      'set Soledad_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --uid=soledad --gid=soledad --pidfile=/var/run/soledad.pid --logfile=/var/log/soledad.log web --wsgi=leap.soledad.server.application --port=ssl:2323:privateKey=/etc/x509/keys/leap.key:certKey=/etc/x509/certs/leap.crt:sslmethod=SSLv23_METHOD"\'' ],
-    require => File['/etc/check_mk/mrpe.cfg'];
-  }
 }
diff --git a/puppet/modules/site_config/manifests/remove/soledad.pp b/puppet/modules/site_config/manifests/remove/soledad.pp
new file mode 100644
index 00000000..46c23f26
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/soledad.pp
@@ -0,0 +1,12 @@
+# remove possible leftovers on soledad nodes
+class site_config::remove::soledad {
+
+  # remove soledad procs check because leap_cli already checks for them
+  augeas { 'Soledad_Procs':
+    incl    => '/etc/check_mk/mrpe.cfg',
+    lens    => 'Spacevars.lns',
+    changes => [ 'rm /files/etc/check_mk/mrpe.cfg/Soledad_Procs' ],
+    require => File['/etc/check_mk/mrpe.cfg'];
+  }
+
+}
diff --git a/puppet/modules/soledad/manifests/server.pp b/puppet/modules/soledad/manifests/server.pp
index c5e2455d..81f51188 100644
--- a/puppet/modules/soledad/manifests/server.pp
+++ b/puppet/modules/soledad/manifests/server.pp
@@ -4,6 +4,7 @@ class soledad::server {
 
   include ::site_config::default
   include ::soledad::common
+  include ::site_config::remove::soledad
 
   $soledad              = hiera('soledad')
   $couchdb_user         = $soledad['couchdb_soledad_user']['username']
-- 
cgit v1.2.3


From 07c0e60e6bdc5b8bfe1f42f76dae9f0a79e7abb0 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Mon, 29 Aug 2016 16:35:14 -0700
Subject: moved infrastructure tests run by `leap run` to tests/server-tests

---
 puppet/modules/site_config/manifests/remove/files.pp | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_config/manifests/remove/files.pp b/puppet/modules/site_config/manifests/remove/files.pp
index 3de8d695..ac2350a0 100644
--- a/puppet/modules/site_config/manifests/remove/files.pp
+++ b/puppet/modules/site_config/manifests/remove/files.pp
@@ -12,11 +12,28 @@
 class site_config::remove::files {
 
   #
-  # Platform X removals
+  # Platform 0.9 removals
   #
 
   tidy {
+    # moved to /srv/static/public/provider.json
+    # for permissions reasons.
     '/srv/leap/provider.json':;
+
+    # tests are moved to /srv/leap/tests/server-tests
+    # by rsync is not able to clean up the old location,
+    # so, we do it here:
+    '/srv/leap/tests/order.rb':;
+    '/srv/leap/tests/README.md':;
+    '/srv/leap/tests/helpers':
+      recurse => true,
+      rmdirs => true;
+    '/srv/leap/tests/puppet':
+      recurse => true,
+      rmdirs => true;
+    '/srv/leap/tests/white-box':
+      recurse => true,
+      rmdirs => true;
   }
 
   #
-- 
cgit v1.2.3


From 8116e007cfd4dbee8282247348cf45473dcde45e Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 31 Aug 2016 14:54:46 -0700
Subject: added support for Let's Encrypt

---
 puppet/modules/site_apache/files/conf.d/acme.conf  | 10 ++++++
 puppet/modules/site_apache/manifests/common.pp     |  2 ++
 .../modules/site_apache/manifests/common/acme.pp   | 38 ++++++++++++++++++++++
 .../site_config/manifests/x509/commercial/ca.pp    | 10 ++++--
 4 files changed, 58 insertions(+), 2 deletions(-)
 create mode 100644 puppet/modules/site_apache/files/conf.d/acme.conf
 create mode 100644 puppet/modules/site_apache/manifests/common/acme.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/files/conf.d/acme.conf b/puppet/modules/site_apache/files/conf.d/acme.conf
new file mode 100644
index 00000000..cdddf53e
--- /dev/null
+++ b/puppet/modules/site_apache/files/conf.d/acme.conf
@@ -0,0 +1,10 @@
+#
+# Allow ACME certificate verification if /srv/acme exists.
+#
+<IfModule mod_headers.c>
+  Alias "/.well-known/acme-challenge/" "/srv/acme/"
+  <Directory "/srv/acme/*">
+    Require all granted
+    Header set Content-Type "application/jose+json"
+  </Directory>
+</IfModule>
diff --git a/puppet/modules/site_apache/manifests/common.pp b/puppet/modules/site_apache/manifests/common.pp
index 8a11759a..208c15d5 100644
--- a/puppet/modules/site_apache/manifests/common.pp
+++ b/puppet/modules/site_apache/manifests/common.pp
@@ -27,4 +27,6 @@ class site_apache::common {
   }
 
   include site_apache::common::tls
+  include site_apache::common::acme
+
 }
diff --git a/puppet/modules/site_apache/manifests/common/acme.pp b/puppet/modules/site_apache/manifests/common/acme.pp
new file mode 100644
index 00000000..eda4148b
--- /dev/null
+++ b/puppet/modules/site_apache/manifests/common/acme.pp
@@ -0,0 +1,38 @@
+#
+# Allows for potential ACME validations (aka Let's Encrypt)
+#
+class site_apache::common::acme {
+  #
+  # well, this doesn't work:
+  #
+  # apache::config::global {'acme.conf':}
+  #
+  # since /etc/apache2/conf.d is NEVER LOADED BY APACHE
+  # https://gitlab.com/shared-puppet-modules-group/apache/issues/11
+  #
+
+  file {
+    '/etc/apache2/conf-available/acme.conf':
+      ensure  => present,
+      source  => 'puppet:///modules/site_apache/conf.d/acme.conf',
+      require => Package[apache],
+      notify  => Service[apache];
+    '/etc/apache2/conf-enabled/acme.conf':
+      ensure  => link,
+      target  => '/etc/apache2/conf-available/acme.conf',
+      require => Package[apache],
+      notify  => Service[apache];
+  }
+
+  file {
+    '/srv/acme':
+      ensure => 'directory',
+      owner => 'www-data',
+      group => 'www-data',
+      mode => '0755';
+    '/srv/acme/ok':
+      owner => 'www-data',
+      group => 'www-data',
+      content => 'ok';
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/commercial/ca.pp b/puppet/modules/site_config/manifests/x509/commercial/ca.pp
index c76a9dbb..21d57445 100644
--- a/puppet/modules/site_config/manifests/x509/commercial/ca.pp
+++ b/puppet/modules/site_config/manifests/x509/commercial/ca.pp
@@ -5,7 +5,13 @@ class site_config::x509::commercial::ca {
   $x509      = hiera('x509')
   $ca        = $x509['commercial_ca_cert']
 
-  x509::ca { $site_config::params::commercial_ca_name:
-    content => $ca
+  #
+  # CA cert might be empty, if it was bundled with 'commercial_cert'
+  # instead of specified separately.
+  #
+  if ($ca) {
+    x509::ca { $site_config::params::commercial_ca_name:
+      content => $ca
+    }
   }
 }
-- 
cgit v1.2.3


From 90e4bca777f6edfbde29b590313cf938f75c53a7 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 5 Sep 2016 14:18:55 +0200
Subject: [style] lint ::site_static class

---
 puppet/modules/site_static/manifests/init.pp | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 462e6e05..824619b4 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -16,14 +16,14 @@ class site_static {
   file {
     '/srv/static/':
       ensure => 'directory',
-      owner => 'root',
-      group => 'root',
-      mode  => '0744';
+      owner  => 'root',
+      group  => 'root',
+      mode   => '0744';
     '/srv/static/public':
       ensure => 'directory',
-      owner => 'root',
-      group => 'root',
-      mode  => '0744';
+      owner  => 'root',
+      group  => 'root',
+      mode   => '0744';
   }
 
   if $bootstrap['enabled'] {
@@ -57,7 +57,7 @@ class site_static {
     include site_apt::preferences::passenger
     class { 'passenger':
       manage_munin => false,
-      require   => Class['site_apt::preferences::passenger']
+      require      => Class['site_apt::preferences::passenger']
     }
   }
 
-- 
cgit v1.2.3


From 67591d5f91b33bd8196137c14ea6ae4a01321aea Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 6 Sep 2016 11:45:58 +0200
Subject: [feat] Add check_mk config values, dont set them

When setting values like

    ignored_services = [...]

this will override other `ignored_services` that might get parsed
before. Instead, we use `+=` so multiple files can add sth to this
config value.
---
 puppet/modules/site_check_mk/files/ignored_services.mk | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/files/ignored_services.mk b/puppet/modules/site_check_mk/files/ignored_services.mk
index 35dc4433..8a6705ac 100644
--- a/puppet/modules/site_check_mk/files/ignored_services.mk
+++ b/puppet/modules/site_check_mk/files/ignored_services.mk
@@ -1,3 +1,5 @@
-ignored_services = [
+# ignore NTP Time because this check was
+# very flaky in the past (see https://leap.se/code/issues/6407)
+ignored_services += [
   ( ALL_HOSTS, [ "NTP Time" ] )
 ]
-- 
cgit v1.2.3


From d6e6b05c093bf6e3c2abc5dc40cda466760b5f32 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 7 Sep 2016 10:44:57 +0200
Subject: Fix dependencies for clamd service

Sometimes, after a deploy from scratch `leap test`
fails because clamd could not get started (even when
the deploy log says so).
This fixes the dependencies of all resources needed in
order to let clamd start reliable.

Resolves: #8431
---
 puppet/modules/clamav/manifests/daemon.pp | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/clamav/manifests/daemon.pp b/puppet/modules/clamav/manifests/daemon.pp
index 2e13a8fb..c0a4a450 100644
--- a/puppet/modules/clamav/manifests/daemon.pp
+++ b/puppet/modules/clamav/manifests/daemon.pp
@@ -15,7 +15,6 @@ class clamav::daemon {
       pattern    => '/usr/sbin/clamd',
       enable     => true,
       hasrestart => true,
-      subscribe  => File['/etc/default/clamav-daemon'],
       require    => Package['clamav-daemon'];
   }
 
@@ -25,19 +24,23 @@ class clamav::daemon {
       mode    => '0750',
       owner   => clamav,
       group   => postfix,
-      require => [Package['postfix'], Package['clamav-daemon']];
+      require => [Package['postfix'], Package['clamav-daemon']],
+      notify  => Service['clamav-daemon'];
 
     '/var/lib/clamav':
       mode    => '0755',
       owner   => clamav,
       group   => clamav,
-      require => Package['clamav-daemon'];
+      require => Package['clamav-daemon'],
+      notify  => Service['clamav-daemon'];
 
     '/etc/default/clamav-daemon':
-      source => 'puppet:///modules/clamav/clamav-daemon_default',
-      mode   => '0644',
-      owner  => root,
-      group  => root;
+      source  => 'puppet:///modules/clamav/clamav-daemon_default',
+      mode    => '0644',
+      owner   => root,
+      group   => root,
+      require => Package['clamav-daemon'],
+      notify  => Service['clamav-daemon'];
 
     # this file contains additional domains that we want the clamav
     # phishing process to look for (our domain)
@@ -46,7 +49,8 @@ class clamav::daemon {
       mode    => '0644',
       owner   => clamav,
       group   => clamav,
-      require => Package['clamav-daemon'];
+      require => Package['clamav-daemon'],
+      notify  => Service['clamav-daemon'];
   }
 
   file_line {
-- 
cgit v1.2.3


From f5db49cf6b3ca0a5830b849c0aac074e371b95d9 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 8 Sep 2016 14:27:39 +0200
Subject: Add systemd::enable define

---
 puppet/modules/systemd/manifests/enable.pp | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 puppet/modules/systemd/manifests/enable.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/systemd/manifests/enable.pp b/puppet/modules/systemd/manifests/enable.pp
new file mode 100644
index 00000000..e1bee18a
--- /dev/null
+++ b/puppet/modules/systemd/manifests/enable.pp
@@ -0,0 +1,8 @@
+# enables a systemd resource
+define systemd::enable () {
+
+  exec { "enable_systemd_${name}":
+    refreshonly => true,
+    command     => "/bin/systemctl enable ${name}"
+  }
+}
-- 
cgit v1.2.3


From a3af8acba8cd479f47d76784082d95100c0833ef Mon Sep 17 00:00:00 2001
From: Christoph Kluenter <ckluente@thoughtworks.com>
Date: Wed, 7 Sep 2016 15:36:54 +0200
Subject: start clamav after definitions are downloaded

freshclam might not be able to start clamav via the socket because
the socket might not be there. This systemd unit watches for the
definitions and then starts clamav.

Resolves: #8431
---
 puppet/modules/clamav/files/clamav-daemon.path     | 12 +++++++++++
 puppet/modules/clamav/manifests/daemon.pp          |  1 +
 .../modules/clamav/manifests/daemon/activation.pp  | 24 ++++++++++++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 puppet/modules/clamav/files/clamav-daemon.path
 create mode 100644 puppet/modules/clamav/manifests/daemon/activation.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/clamav/files/clamav-daemon.path b/puppet/modules/clamav/files/clamav-daemon.path
new file mode 100644
index 00000000..6e57d187
--- /dev/null
+++ b/puppet/modules/clamav/files/clamav-daemon.path
@@ -0,0 +1,12 @@
+[Unit]
+Description=Path Activation for Clam AntiVirus userspace daemon
+Documentation=man:clamd(8) man:clamd.conf(5) http://www.clamav.net/lang/en/doc/
+
+[Path]
+# Check and wait for database existence before starting up
+PathExistsGlob=/var/lib/clamav/main.{c[vl]d,inc}
+PathExistsGlob=/var/lib/clamav/daily.{c[vl]d,inc}
+
+[Install]
+WantedBy=sockets.target
+
diff --git a/puppet/modules/clamav/manifests/daemon.pp b/puppet/modules/clamav/manifests/daemon.pp
index 2e13a8fb..b51a07e9 100644
--- a/puppet/modules/clamav/manifests/daemon.pp
+++ b/puppet/modules/clamav/manifests/daemon.pp
@@ -1,5 +1,6 @@
 # deploy clamav daemon
 class clamav::daemon {
+  include clamav::daemon::activation
 
   $domain_hash           = hiera('domain')
   $domain                = $domain_hash['full_suffix']
diff --git a/puppet/modules/clamav/manifests/daemon/activation.pp b/puppet/modules/clamav/manifests/daemon/activation.pp
new file mode 100644
index 00000000..09c1e55e
--- /dev/null
+++ b/puppet/modules/clamav/manifests/daemon/activation.pp
@@ -0,0 +1,24 @@
+# ensure clamav starts after the definitions are downloaded
+# needed because sometimes clamd cannot get started by freshclam,
+# see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=827909
+class clamav::daemon::activation {
+
+  file { '/etc/systemd/system/clamav-daemon.path':
+    source => 'puppet:///modules/clamav/clamav-daemon.path',
+    mode   => '0644',
+    owner  => root,
+    group  => root,
+    notify => [ Exec['systemctl-daemon-reload'], Systemd::Enable['clamav-daemon.path'] ]
+  }
+
+  systemd::enable { 'clamav-daemon.path':
+    require => Exec['systemctl-daemon-reload'],
+    notify  => Exec['start_clamd_path_monitor']
+  }
+
+  exec { 'start_clamd_path_monitor':
+      command     => '/bin/systemctl start clamav-daemon.path',
+      refreshonly => true,
+      before      => Service['freshclam']
+  }
+}
-- 
cgit v1.2.3


From a063280eab5e8749c74381aabbe641c30887e9f6 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Fri, 2 Sep 2016 12:35:09 -0700
Subject: [bugfix] static sites: only enable hidden service by default if one
 domain is configured

The problem is that we have a single onion address per server, so if more
than one domain is configured we need to make sure they don't both try to
use the same onion address.
---
 puppet/modules/site_static/manifests/domain.pp       | 1 +
 puppet/modules/site_static/manifests/init.pp         | 8 ++++++++
 puppet/modules/site_static/templates/apache.conf.erb | 2 +-
 3 files changed, 10 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_static/manifests/domain.pp b/puppet/modules/site_static/manifests/domain.pp
index b26cc9e3..6cf2c653 100644
--- a/puppet/modules/site_static/manifests/domain.pp
+++ b/puppet/modules/site_static/manifests/domain.pp
@@ -4,6 +4,7 @@ define site_static::domain (
   $key,
   $cert,
   $tls_only=true,
+  $use_hidden_service=false,
   $locations=undef,
   $aliases=undef,
   $apache_config=undef) {
diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index 824619b4..dd3f912d 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -77,6 +77,14 @@ class site_static {
     if $hidden_service['active'] {
       include site_static::hidden_service
     }
+    # Currently, we only support a single hidden service address per server.
+    # So if there is more than one domain configured, then we need to make sure
+    # we don't enable the hidden service for every domain.
+    if size(keys($domains)) == 1 {
+      $always_use_hidden_service = true
+    } else {
+      $always_use_hidden_service = false
+    }
   }
 
   create_resources(site_static::domain, $domains)
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index af9a520d..dd04ca43 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -74,7 +74,7 @@
   Require all granted
 </Directory>
 
-<%- if @tor -%>
+<%- if @tor && (@always_use_hidden_service || @use_hidden_service) -%>
 ##
 ## Tor
 ##
-- 
cgit v1.2.3


From 291d5718607a2df22ca58a0c110bee75452a085c Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 28 Sep 2016 11:01:19 +0200
Subject: lint site_mx class

---
 puppet/modules/site_mx/manifests/init.pp | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_mx/manifests/init.pp b/puppet/modules/site_mx/manifests/init.pp
index a9b0198b..d18f4287 100644
--- a/puppet/modules/site_mx/manifests/init.pp
+++ b/puppet/modules/site_mx/manifests/init.pp
@@ -1,20 +1,21 @@
+# Configure leap_mx on mx server
 class site_mx {
   tag 'leap_service'
-  Class['site_config::default'] -> Class['site_mx']
+  Class['::site_config::default'] -> Class['::site_mx']
 
-  include site_config::default
-  include site_config::x509::cert
-  include site_config::x509::key
-  include site_config::x509::ca
-  include site_config::x509::client_ca::ca
-  include site_config::x509::client_ca::key
+  include ::site_config::default
+  include ::site_config::x509::cert
+  include ::site_config::x509::key
+  include ::site_config::x509::ca
+  include ::site_config::x509::client_ca::ca
+  include ::site_config::x509::client_ca::key
 
-  include site_stunnel
+  include ::site_stunnel
 
-  include site_postfix::mx
-  include site_haproxy
-  include site_shorewall::mx
-  include site_shorewall::service::smtp
-  include leap_mx
-  include site_check_mk::agent::mx
+  include ::site_postfix::mx
+  include ::site_haproxy
+  include ::site_shorewall::mx
+  include ::site_shorewall::service::smtp
+  include ::leap_mx
+  include ::site_check_mk::agent::mx
 }
-- 
cgit v1.2.3


From c752039fdf59e5c8a18c5dc7c611bd996e323eec Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 28 Sep 2016 11:06:05 +0200
Subject: [feat] Use twisted 16.2 from jessie-backports

New soledad packages now depend on Twisted 16.2.0 (see
https://leap.se/code/issues/8412), so we need to pin twisted to get
installed from jessie-backports.

- Resolves: #8418
---
 puppet/modules/site_mx/manifests/init.pp   | 2 ++
 puppet/modules/soledad/manifests/common.pp | 3 +++
 2 files changed, 5 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_mx/manifests/init.pp b/puppet/modules/site_mx/manifests/init.pp
index d18f4287..c910a45a 100644
--- a/puppet/modules/site_mx/manifests/init.pp
+++ b/puppet/modules/site_mx/manifests/init.pp
@@ -18,4 +18,6 @@ class site_mx {
   include ::site_shorewall::service::smtp
   include ::leap_mx
   include ::site_check_mk::agent::mx
+  # install twisted from jessie backports
+  include ::site_apt::preferences::twisted
 }
diff --git a/puppet/modules/soledad/manifests/common.pp b/puppet/modules/soledad/manifests/common.pp
index 8d8339d4..35969362 100644
--- a/puppet/modules/soledad/manifests/common.pp
+++ b/puppet/modules/soledad/manifests/common.pp
@@ -1,6 +1,9 @@
 # install soledad-common, both needed both soledad-client and soledad-server
 class soledad::common {
 
+  # install twisted from jessie backports
+  include ::site_apt::preferences::twisted
+
   package { 'soledad-common':
     ensure  => latest;
   }
-- 
cgit v1.2.3


From 73ca4fe4b3bad52b1d4c6c950d06b16e2db014ae Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Oct 2016 16:10:30 +0200
Subject: Lint site_couchdb::setup

---
 puppet/modules/site_couchdb/manifests/setup.pp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_couchdb/manifests/setup.pp b/puppet/modules/site_couchdb/manifests/setup.pp
index 7477d24c..84659745 100644
--- a/puppet/modules/site_couchdb/manifests/setup.pp
+++ b/puppet/modules/site_couchdb/manifests/setup.pp
@@ -17,11 +17,11 @@ class site_couchdb::setup {
   # (i.e. using curl/wget without passing credentials)
   file {
     '/etc/couchdb/couchdb.netrc':
-      ensure  => link,
-      target  => "/etc/couchdb/couchdb-${user}.netrc";
+      ensure => link,
+      target => "/etc/couchdb/couchdb-${user}.netrc";
     '/root/.netrc':
-      ensure  => link,
-      target  => '/etc/couchdb/couchdb.netrc';
+      ensure => link,
+      target => '/etc/couchdb/couchdb.netrc';
   }
 
   # setup /etc/couchdb/couchdb-soledad-admin.netrc file for couchdb admin
-- 
cgit v1.2.3


From 0b279d8a66293bdf5fe20a77b557055a95a66a46 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 12 Oct 2016 18:41:35 +0200
Subject: Setup couch for soledad before starting soledad

When the soledad couch user is not present, soledad-server
refuses to start, so we need to ensure that couch is setup correctly
before starting soledad-server.

see https://leap.se/code/issues/8535
---
 puppet/modules/site_couchdb/manifests/add_users.pp  | 3 ++-
 puppet/modules/site_couchdb/manifests/create_dbs.pp | 3 ++-
 puppet/modules/site_couchdb/manifests/setup.pp      | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_couchdb/manifests/add_users.pp b/puppet/modules/site_couchdb/manifests/add_users.pp
index c905316b..f12c5a5e 100644
--- a/puppet/modules/site_couchdb/manifests/add_users.pp
+++ b/puppet/modules/site_couchdb/manifests/add_users.pp
@@ -33,7 +33,8 @@ class site_couchdb::add_users {
     roles   => '["tokens"]',
     pw      => $site_couchdb::couchdb_soledad_pw,
     salt    => $site_couchdb::couchdb_soledad_salt,
-    require => Couchdb::Query::Setup['localhost']
+    require => Couchdb::Query::Setup['localhost'],
+    notify  => Service['soledad-server'];
   }
 
   ## webapp couchdb user
diff --git a/puppet/modules/site_couchdb/manifests/create_dbs.pp b/puppet/modules/site_couchdb/manifests/create_dbs.pp
index a2d1c655..ddfb7d65 100644
--- a/puppet/modules/site_couchdb/manifests/create_dbs.pp
+++ b/puppet/modules/site_couchdb/manifests/create_dbs.pp
@@ -44,7 +44,8 @@ class site_couchdb::create_dbs {
   ## r/w: soledad
   couchdb::create_db { 'shared':
     members => "{ \"names\": [\"${site_couchdb::couchdb_soledad_user}\"], \"roles\": [\"replication\"] }",
-    require => Couchdb::Query::Setup['localhost']
+    require => Couchdb::Query::Setup['localhost'],
+    notify  => Service['soledad-server'];
   }
 
   ## tickets database
diff --git a/puppet/modules/site_couchdb/manifests/setup.pp b/puppet/modules/site_couchdb/manifests/setup.pp
index 84659745..a749c628 100644
--- a/puppet/modules/site_couchdb/manifests/setup.pp
+++ b/puppet/modules/site_couchdb/manifests/setup.pp
@@ -33,7 +33,8 @@ class site_couchdb::setup {
       mode    => '0400',
       owner   => 'soledad-admin',
       group   => 'root',
-      require => [ Package['couchdb'], User['soledad-admin'] ];
+      require => [ Package['couchdb'], User['soledad-admin'] ],
+      notify  => Service['soledad-server'];
     }
   }
 
-- 
cgit v1.2.3


From 53ddc64b6aa98653b35b23c334df605ed26ea60b Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Mon, 24 Oct 2016 11:29:59 -0400
Subject: Set X-Content-Type-Options nosniff.

Setting this header will prevent the browser from interpreting files as
something else than declared by the content type in the HTTP
headers. This will prevent the browser from MIME-sniffing a response
away from the declared content-type.

When this is not set, older versions of Internet Explorer and Chrome
perform MIME-sniffing on the response body, potentially causing the
response body to be interpreted and displayed as a content type other
than the declared content type.
---
 puppet/modules/site_apache/templates/vhosts.d/api.conf.erb | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index bfa5d04d..5e27a9e4 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -23,6 +23,7 @@ Listen 0.0.0.0:<%= @api_port %>
 <% end -%>
     Header always unset X-Powered-By
     Header always unset X-Runtime
+    Header always set X-Content-Type-Options: nosniff
   </IfModule>
 
   DocumentRoot /srv/leap/webapp/public
-- 
cgit v1.2.3


From 4db1e7c4454ea05c524be4cc385ede1bab2e1be4 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@riseup.net>
Date: Mon, 24 Oct 2016 11:31:41 -0400
Subject: Set X-XSS-Protection HTTP response header to '1'.

This HTTP response header enables the Cross-site scripting (XSS) filter
built into some modern web browsers. This header is usually enabled by
default anyway, so the role of this header is to re-enable the filter
if it was disabled maliciously, or by accident.
---
 puppet/modules/site_apache/templates/vhosts.d/api.conf.erb | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index 5e27a9e4..e68b9ebe 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -23,6 +23,7 @@ Listen 0.0.0.0:<%= @api_port %>
 <% end -%>
     Header always unset X-Powered-By
     Header always unset X-Runtime
+    Header always set X-XSS-Protection "1; mode=block"
     Header always set X-Content-Type-Options: nosniff
   </IfModule>
 
-- 
cgit v1.2.3