Merge remote-tracking branch 'riseup/master'

32 files changed, 452 insertions, 267 deletions

diff --git a/.fixtures.yml b/.fixtures.yml
new file mode 100644
index 0000000..ba96496
--- /dev/null
+++ b/.fixtures.yml
@@ -0,0 +1,6 @@
+fixtures:
+  repositories:
+    "concat":
+      "repo": "https://github.com/puppetlabs/puppetlabs-concat.git"
+  symlinks:
+    "tor": "#{source_dir}"
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..611058c
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,39 @@
+image: ruby:2.1
+before_script:
+  - bundle install --jobs $(nproc) --without system_tests --path=/var/cache/gitlab-runner/ "${FLAGS[@]}"
+
+.job_template: &job_definition
+  script:
+    # don't fail on lint warnings
+    - bundle exec rake lint || /bin/true
+    - bundle exec rake syntax
+    - bundle exec rake validate
+    - bundle exec rake spec
+
+# Default debian jessie versions
+test:puppet37:
+  variables:
+    PUPPET_VERSION: "~> 3.7.2"
+    FACTER_VERSION: '~> 2.2.0'
+  <<: *job_definition
+
+test:puppet38_future_parser:
+  variables:
+    PUPPET_VERSION: '~> 3.8'
+    FACTER_VERSION: '~> 2.2.0'
+    FUTURE_PARSER:  'yes'
+  <<: *job_definition
+
+# Default debian stretch versions
+test:puppet48:
+  variables:
+    PUPPET_VERSION: "~> 4.8.2"
+    FACTER_VERSION: '~> 2.4.6'
+  <<: *job_definition
+
+# Latest greatest
+test:puppet4x:
+  variables:
+    PUPPET_VERSION: "> 4"
+    FACTER_VERSION: '> 2'
+  <<: *job_definition
diff --git a/Gemfile b/Gemfile
new file mode 100644
index 0000000..7a16b94
--- /dev/null
+++ b/Gemfile
@@ -0,0 +1,23 @@
+source "https://rubygems.org"
+
+group :development, :unit_tests do
+  gem "rake"
+  gem "rspec-puppet", "~> 2.1", :require => false
+  gem "rspec-core"
+  gem "puppetlabs_spec_helper"
+  gem "semantic_puppet"
+  gem "metadata-json-lint"
+  gem "rspec-puppet-facts"
+  gem "mocha"
+end
+
+group :system_tests do
+  gem 'beaker'
+  gem 'beaker-rspec'
+  gem 'beaker_spec_helper'
+  gem 'serverspec'
+end
+
+gem "puppet", ENV['PUPPET_VERSION'] || ENV['GEM_PUPPET_VERSION'] || ENV['PUPPET_GEM_VERSION'] || '~> 3.7.0'
+gem "facter", ENV['FACTER_VERSION'] || ENV['GEM_FACTER_VERSION'] || ENV['FACTER_GEM_VERSION'] || '~> 2.2.0'
+
diff --git a/README b/README
deleted file mode 100644
index 188acca..0000000
--- a/README
+++ /dev/null
@@ -1,214 +0,0 @@
-puppet module for managing tor
-==============================
-
-This module tries to manage tor, making sure it is installed, running, has munin
-graphs if desired and allows for configuration of relays, hidden services, exit
-policies, etc.
-
-! Upgrade Notice !
-
- previously, if you did not set the $outbound_bindaddress variable, it was being 
- automatically set to the $listen_address variable. Now this is not being done
- and instead you will need to set the $outbound_bindaddress explicitly for it to 
- be set. 
-
- the tor::relay{} variables $bandwidth_rate and $bandwidth_burst were previously
- used for the tor configuration variables RelayBandwidthRate and
- RelayBandwidthBurst, these have been renamed to $relay_bandwidth_rate and
- $relay_bandwidth_burst. If you were using these, please rename your variables in
- your configuration.
-
- The variables $bandwidth_rate and $bandwidth_burst are now used for the tor
- configuration variables BandwidthRate and BandwidthBurst. If you used
- $bandwidth_rate or $bandwidth_burst please be aware that these values have
- changed and adjust your configuration as necessary.
-
- The $tor_ensure_version was converted to a parameter for the tor and
- tor::daemon classes.
-
- The $torsocks_ensure_version was converted to a parameter for the
- tor::torsocks class.
-
- The options that used to be settable with the
- tor::daemon::global_opts define now are parameters for the
- tor::daemon class, and tor::daemon::global_opts was
- removed accordingly.
-
-
-Dependencies
-============
-
-This module needs:
-
-- the concat module: git://labs.riseup.net/shared-concat
-
-Usage
-=====
-
-Installing tor
---------------
-
-To install tor, simply include the 'tor' class in your manifests:
-
-    class { 'tor': }
-
-You can specify the $ensure_version class parameter to get a specific
-version installed.
-
-However, if you want to make configuration changes to your tor daemon, you will
-want to instead include the 'tor::daemon' class in your manifests, which will
-inherit the 'tor' class from above:
-
-    class { '::tor::daemon': }
-
-You have the following class parameters that you can specify:
-
-data_dir    (default: '/var/lib/tor')
-config_file (default: '/etc/tor/torrc')
-use_bridges (default: 0)
-automap_hosts_on_resolve (default: 0)
-log_rules   (default: ['notice file /var/log/tor/notices.log'])
-
-The data_dir will be used for the tor user's $HOME, and the tor DataDirectory
-value.
-
-The config_file will be managed and the daemon restarted when
-it changed.
-
-use_bridges and automap_hosts_on_resolve are used to set the
-UseBridges and AutomapHostsOnResolve torrc settings.
-
-The log_rules can be an array of different Log lines, each will be added to the
-config, for example the following will use syslog:
-
-    class { '::tor::daemon':
-        log_rules => [ 'notice syslog' ],
-    }
-
-If you want to set specific options for the tor class,
-you may pass them directly to the tor::daemon in your manifests,
-e.g.:
-
-    class { '::tor::daemon':
-      use_munin                 => true,
-      automap_hosts_on_resolve  => 1,
-    }
-
-Configuring socks
------------------
-
-To configure tor socks support, you can do the following:
-
-  tor::daemon::socks { "listen_locally": listen_addresses => [ '127.0.0.1' ]; }
-
-this will setup the SocksListenAddress to be 127.0.0.1. You also can pass the
-following options to tor::daemon::socks:
-
-$port = 0       - SocksPort
-$listen_address - can pass multiple values to configure SocksListenAddress lines
-$policies       - can pass multiple values to configure SocksPolicy lines
-
-Installing torsocks
--------------------
-
-To install torsocks, simply include the 'torsocks' class in your manifests:
-
-    class { 'tor::torsocks': }
-
-You can specify the $ensure_version class parameter to get a specific
-version installed.
-
-Configuring relays
-==================
-
-An example relay configuration:
-
- tor::daemon::relay { "foobar":
-   port => 9001, listen_addresses => '192.168.0.1', address => '192.168.0.1',
-   bandwidth_rate => '256', bandwidth_burst => '256', contact_info => "Foo <collective at example dot com>",
-   my_family => '<long family string here>'
- }
-
-You have the following options that can be passed to a relay, with the defaults shown:
- 
-$port                    = 0,
-$listen_addresses        = [],
-$portforwarding          = 0,     # PortForwarding 0|1, set for opening ports at the router via UPnP.
-                                  # Requires 'tor-fw-helper' binary present.
-$bandwidth_rate          = '',    # KB/s, defaulting to using tor's default: 5120KB/s
-$bandwidth_burst         = '',    # KB/s, defaulting to using tor's default: 10240KB/s
-$relay_bandwidth_rate    = 0,     # KB/s, 0 for no limit.
-$relay_bandwidth_burst   = 0,     # KB/s, 0 for no limit.
-$accounting_max          = 0,     # GB, 0 for no limit.
-$accounting_start        = [],
-$contact_info            = '',
-$my_family               = '', # TODO: autofill with other relays
-$address                 = "tor.${domain}",
-$bridge_relay            = 0,
-$ensure                  = present
-$nickname                = $name
-
-Configuring the control 
------------------------
-
-To pass parameters to configure the ControlPort and the HashedControlPassword,
-you would do something like this:
-
- tor::daemon::control { "foo-control": 
-  port => '80', hashed_control_password => '<somehash>',
-  ensure => present 
-}
-
-Note: you must pass a hashed password to the control port, if you are going to
-use it.
-
-
-Configuring hidden services
----------------------------
-
-To configure a tor hidden service you can do something like the following:
-
- tor::daemon::hidden_service { "hidden_ssh": ports => 22 }
-
-The HiddenServiceDir is set to the ${data_dir}/${name}.
-
-Configuring directories
------------------------
-
-An example directory configuration:
-
- tor::daemon::directory { 'ssh_directory':
-   port => 80, listen_address => '192.168.0.1', 
-   port_front_page => '/etc/tor/tor.html'
- }
-  
-Configuring exit policies
---------------------------
-
-To configure exit policies, you can do the following:
- 
-tor::daemon::exit_policy { "ssh_exit_policy":
-        accept => "192.168.0.1:22",
-        reject => "*:*";
-      }
-    }
-
-
-Polipo
-======
-
-Polipo support can be enabled by doing:
-
-    include tor::polipo
-
-this will inherit the tor class by default, remove privoxy if its installed, and
-install polipo, making sure it is running.
-  
-
-Munin
-=====
-
-If you are using munin, and have the puppet munin module installed, you can set
-the use_munin parameter to true when defining the tor::daemon class to have
-graphs setup for you.
-
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..2cf89df
--- /dev/null
+++ b/README.md
@@ -0,0 +1,245 @@
+# tor
+
+#### Table of Contents
+
+* [Overview](#overview)
+  * [Upgrade Notice](#upgrade-notice)
+* [Dependencies](#dependencies)
+* [Usage](#usage)
+  * [Installing tor](#installing-tor)
+  * [Configuring SOCKS](#configuring-socks)
+  * [Installing torsocks](#installing-torsocks)
+  * [Configuring relays](#configuring-relays)
+  * [Configuring the control](#configuring-control)
+  * [Configuring hidden services](#configuring-hidden-services)
+  * [Configuring directories](#configuring-directories)
+  * [Configuring exit policies](#configuring-exit-policies)
+  * [Configuring transport plugins](#configuring-transport-plugins)
+* [Polipo](#polipo)
+* [Munin](#munin)
+
+# Overview<a name="overview"></a>
+
+This module tries to manage tor, making sure it is installed, running, has
+munin graphs if desired and allows for configuration of relays, hidden services,
+exit policies, etc.
+
+## Upgrade Notice<a name="upgrade-notice"></a>
+
+ * All of the `listen_address` variables have been deprecated, since they have
+   been deprecated in tor since 0.2.3.x-alpha. Please read the new tor man page
+   if you were using those variables.
+
+ * Previously, if you did not set the `$outbound_bindaddress` variable, it was
+   being automatically set to the `$listen_address variable`. Now this is not
+   being done and instead you will need to set the `$outbound_bindaddress`
+   explicitly for it to be set.
+
+ * The `tor::relay{}` variables `$bandwidth_rate` and `$bandwidth_burst` were
+   previously used for the tor configuration variables `RelayBandwidthRate` and
+   `RelayBandwidthBurst`, these have been renamed to `$relay_bandwidth_rate`
+   and `$relay_bandwidth_burst`. If you were using these, please rename your
+   variables in your configuration.
+
+ * The variables `$bandwidth_rate` and `$bandwidth_burst` are now used for the
+   tor configuration variables `BandwidthRate` and `BandwidthBurst`. If you
+   used `$bandwidth_rate` or `$bandwidth_burst` please be aware that these
+   values have changed and adjust your configuration as necessary.
+
+ * The `$tor_ensure_version` was converted to a parameter for the tor and
+   `tor::daemon` classes.
+
+ * The `$torsocks_ensure_version` was converted to a parameter for the
+   `tor::torsocks` class.
+
+ * The options that used to be settable with the `tor::daemon::global_opts`
+   define now are parameters for the `tor::daemon class`, and
+   `tor::daemon::global_opts` was removed accordingly.
+
+
+# Dependencies<a name="dependencies"></a>
+
+This module needs:
+
+ * the [concat module](https://github.com/puppetlabs/puppetlabs-concat.git)
+
+# Usage<a name="usage"></a>
+
+## Installing tor<a name="installing-tor"></a>
+
+To install tor, simply include the 'tor' class in your manifests:
+
+    class { 'tor': }
+
+You can specify the `$ensure_version` class parameter to get a specific
+version installed.
+
+However, if you want to make configuration changes to your tor daemon, you will
+want to instead include the `tor::daemon` class in your manifests, which will
+inherit the `tor` class from above:
+
+    class { '::tor::daemon': }
+
+You have the following class parameters that you can specify:
+
+    data_dir    (default: '/var/lib/tor')
+    config_file (default: '/etc/tor/torrc')
+    use_bridges (default: 0)
+    automap_hosts_on_resolve (default: 0)
+    log_rules   (default: ['notice file /var/log/tor/notices.log'])
+
+The `data_dir` will be used for the tor user's `$HOME`, and the tor
+`DataDirectory` value.
+
+The `config_file` will be managed and the daemon restarted when it changed.
+
+`use_bridges` and `automap_hosts_on_resolve` are used to set the `UseBridges`
+and `AutomapHostsOnResolve` torrc settings.
+
+The `log_rules` can be an array of different Log lines, each will be added to
+the config, for example the following will use syslog:
+
+    class { '::tor::daemon':
+        log_rules => [ 'notice syslog' ],
+    }
+
+If you want to set specific options for the tor class, you may pass them
+directly to the tor::daemon in your manifests, e.g.:
+
+    class { '::tor::daemon':
+      use_munin                 => true,
+      automap_hosts_on_resolve  => 1,
+    }
+
+## Configuring SOCKS<a name="configuring-socks"></a>
+
+To configure tor socks support, you can do the following:
+
+    tor::daemon::socks { "listen_locally":
+      port     => 0,
+      policies => 'your super policy';
+    }
+
+## Installing torsocks<a name="installing-torsocks"></a>
+
+To install torsocks, simply include the `torsocks` class in your manifests:
+
+    class { 'tor::torsocks': }
+
+You can specify the `$ensure_version` class parameter to get a specific
+version installed.
+
+# Configuring relays<a name="configuring-relays"></a>
+
+An example relay configuration:
+
+    tor::daemon::relay { "foobar":
+      port             => '9001',
+      address          => '192.168.0.1',
+      bandwidth_rate   => '256',
+      bandwidth_burst  => '256',
+      contact_info     => "Foo <collective at example dot com>",
+      my_family        => '<long family string here>';
+    }
+
+You have the following options that can be passed to a relay, with the defaults
+shown:
+ 
+    $port                    = 0,
+    $portforwarding          = 0,     # PortForwarding 0|1, set for opening ports at the router via UPnP.
+                                      # Requires 'tor-fw-helper' binary present.
+    $bandwidth_rate          = '',    # KB/s, defaulting to using tor's default: 5120KB/s
+    $bandwidth_burst         = '',    # KB/s, defaulting to using tor's default: 10240KB/s
+    $relay_bandwidth_rate    = 0,     # KB/s, 0 for no limit.
+    $relay_bandwidth_burst   = 0,     # KB/s, 0 for no limit.
+    $accounting_max          = 0,     # GB, 0 for no limit.
+    $accounting_start        = [],
+    $contact_info            = '',
+    $my_family               = '', # TODO: autofill with other relays
+    $address                 = "tor.${domain}",
+    $bridge_relay            = 0,
+    $ensure                  = present
+    $nickname                = $name
+
+## Configuring the control<a name="configuring-control"></a>
+
+To pass parameters to configure the `ControlPort` and the
+`HashedControlPassword`, you would do something like this:
+
+    tor::daemon::control { "foo-control": 
+      port                    => '80',
+      hashed_control_password => '<somehash>',
+      ensure                  => present;
+    }
+
+Note: you must pass a hashed password to the control port, if you are going to
+use it.
+
+## Configuring hidden services<a name="configuring-hidden-services"></a>
+
+To configure a tor hidden service you can do something like the following:
+
+    tor::daemon::hidden_service { "hidden_ssh":
+      ports => 22;
+    }
+
+The `HiddenServiceDir` is set to the `${data_dir}/${name}`, but you can override
+it with the parameter `datadir`.
+
+If you wish to enable v3-style hidden services to correspond with the v2-style
+hidden services (the same configuration will be applied to both), you can pass
+the parameter `v3 => true`. The default is `false`.
+
+If you wish to enable single-hop onion addresses, you can enable them by
+passing `single_hop => true`. The default is `false`.
+
+## Configuring directories<a name="configuring-directories"></a>
+
+An example directory configuration:
+
+    tor::daemon::directory { 'ssh_directory':
+      port             => '80',
+      port_front_page  => '/etc/tor/tor.html';
+    }
+  
+## Configuring exit policies<a name="configuring-exit-policies"></a>
+
+To configure exit policies, you can do the following:
+ 
+    tor::daemon::exit_policy { "ssh_exit_policy":
+      accept => "192.168.0.1:22",
+      reject => "*:*";
+    }
+
+## Configuring transport plugins<a name="configuring-transport-plugins"></a>
+
+To configure transport plugins, you can do the following:
+
+    tor::daemon::transport_plugins { "obfs4":
+      ext_port                => '80',
+      servertransport_plugin  => 'obfs4 exec /usr/bin/obfs4proxy',
+    }
+
+If you wish to use `obfs4proxy`, you will also need to install the required
+Debian package, as the puppet module will not do it for you.
+
+Other options for transport plugins are also available but not defined by
+default:
+
+    $servertransport_listenaddr  #Set a different address for the transport plugin mechanism
+    $servertransport_options     #Pass a k=v parameters to the transport proxy
+
+# Polipo<a name="polipo"></a>
+
+Polipo support can be enabled by doing:
+
+    include tor::polipo
+
+This will inherit the `tor` class by default, remove `privoxy` if it's
+installed, and install `polipo`, making sure it is running.
+  
+# Munin<a name="munin"></a>
+
+If you are using `munin`, and have the puppet munin module installed, you can
+set the `use_munin` parameter to `true` when defining the `tor::daemon` class
+to have graphs setup for you.
diff --git a/Rakefile b/Rakefile
new file mode 100644
index 0000000..85326bb
--- /dev/null
+++ b/Rakefile
@@ -0,0 +1,19 @@
+require 'puppetlabs_spec_helper/rake_tasks'
+require 'puppet-lint/tasks/puppet-lint'
+PuppetLint.configuration.send('disable_80chars')
+PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
+
+desc "Validate manifests, templates, and ruby files"
+task :validate do
+  Dir['manifests/**/*.pp'].each do |manifest|
+    sh "puppet parser validate --noop #{manifest}"
+  end
+  Dir['spec/**/*.rb','lib/**/*.rb'].each do |ruby_file|
+    sh "ruby -c #{ruby_file}" unless ruby_file =~ /spec\/fixtures/
+  end
+  Dir['templates/**/*.erb'].each do |template|
+    sh "erb -P -x -T '-' #{template} | ruby -c"
+  end
+end
+
+task :test => [:lint, :syntax , :validate, :spec]
diff --git a/manifests/daemon/base.pp b/manifests/daemon/base.pp
index c0c82ac..f3bbc37 100644
--- a/manifests/daemon/base.pp
+++ b/manifests/daemon/base.pp
@@ -56,7 +56,6 @@ class tor::daemon::base inherits tor::base {
 
   # config file headers
   concat::fragment { '00.header':
-    ensure  => present,
     content => template('tor/torrc.header.erb'),
     order   => 00,
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/bridge.pp b/manifests/daemon/bridge.pp
index 83d74e0..a448f82 100644
--- a/manifests/daemon/bridge.pp
+++ b/manifests/daemon/bridge.pp
@@ -2,11 +2,9 @@
 define tor::daemon::bridge(
   $ip,
   $port,
-  $fingerprint = false,
-  $ensure      = present ) {
+  $fingerprint = false ) {
 
   concat::fragment { "10.bridge.${name}":
-    ensure  => $ensure,
     content => template('tor/torrc.bridge.erb'),
     order   => 10,
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/control.pp b/manifests/daemon/control.pp
index ee425f3..4137c3e 100644
--- a/manifests/daemon/control.pp
+++ b/manifests/daemon/control.pp
@@ -19,7 +19,6 @@ define tor::daemon::control(
     }
 
   concat::fragment { '04.control':
-    ensure  => $ensure,
     content => template('tor/torrc.control.erb'),
     order   => 04,
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/directory.pp b/manifests/daemon/directory.pp
index e2e405d..3eaef9f 100644
--- a/manifests/daemon/directory.pp
+++ b/manifests/daemon/directory.pp
@@ -1,12 +1,10 @@
 # directory advertising
 define tor::daemon::directory (
   $port             = 0,
-  $listen_addresses = [],
   $port_front_page  = '/etc/tor/tor-exit-notice.html',
   $ensure           = present ) {
 
   concat::fragment { '06.directory':
-    ensure  => $ensure,
     content => template('tor/torrc.directory.erb'),
     order   => 06,
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/dns.pp b/manifests/daemon/dns.pp
index e8d4fc8..599abd8 100644
--- a/manifests/daemon/dns.pp
+++ b/manifests/daemon/dns.pp
@@ -1,11 +1,8 @@
 # DNS definition
 define tor::daemon::dns(
-  $port             = 0,
-  $listen_addresses = [],
-  $ensure           = present ) {
+  $port             = 0 ) {
 
   concat::fragment { "08.dns.${name}":
-    ensure  => $ensure,
     content => template('tor/torrc.dns.erb'),
     order   => '08',
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/exit_policy.pp b/manifests/daemon/exit_policy.pp
index df0fb99..c117d5d 100644
--- a/manifests/daemon/exit_policy.pp
+++ b/manifests/daemon/exit_policy.pp
@@ -2,11 +2,9 @@
 define tor::daemon::exit_policy(
   $accept         = [],
   $reject         = [],
-  $reject_private = 1,
-  $ensure         = present ) {
+  $reject_private = 1 ) {
 
   concat::fragment { "07.exit_policy.${name}":
-    ensure  => $ensure,
     content => template('tor/torrc.exit_policy.erb'),
     order   => 07,
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/hidden_service.pp b/manifests/daemon/hidden_service.pp
index d91bdc8..9e053cc 100644
--- a/manifests/daemon/hidden_service.pp
+++ b/manifests/daemon/hidden_service.pp
@@ -3,8 +3,8 @@ define tor::daemon::hidden_service(
   $ports         = [],
   $single_hop    = false,
   $v3            = false,
-  $data_dir      = $tor::daemon::data_dir,
-  $ensure        = present ) {
+  $data_dir      = $tor::daemon::data_dir ) {
+
 
 
   if $single_hop {
@@ -14,7 +14,6 @@ define tor::daemon::hidden_service(
   }
 
   concat::fragment { "05.hidden_service.${name}":
-    ensure  => $ensure,
     content => template('tor/torrc.hidden_service.erb'),
     order   => 05,
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/map_address.pp b/manifests/daemon/map_address.pp
index ac624a0..1829eae 100644
--- a/manifests/daemon/map_address.pp
+++ b/manifests/daemon/map_address.pp
@@ -1,11 +1,9 @@
 # map address definition
 define tor::daemon::map_address(
   $address    = '',
-  $newaddress = '',
-  $ensure     = 'present') {
+  $newaddress = '' ) {
 
   concat::fragment { "08.map_address.${name}":
-    ensure  => $ensure,
     content => template('tor/torrc.map_address.erb'),
     order   => '08',
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/relay.pp b/manifests/daemon/relay.pp
index 555587c..fa908f5 100644
--- a/manifests/daemon/relay.pp
+++ b/manifests/daemon/relay.pp
@@ -1,7 +1,6 @@
 # relay definition
 define tor::daemon::relay(
   $port                    = 0,
-  $listen_addresses        = [],
   $outbound_bindaddresses  = [],
   $portforwarding          = 0,
   # KB/s, defaulting to using tor's default: 5120KB/s
@@ -14,7 +13,7 @@ define tor::daemon::relay(
   $relay_bandwidth_burst   = 0,
   # GB, 0 for no limit
   $accounting_max          = 0,
-  $accounting_start        = [],
+  $accounting_start        = "month 1 0:00",
   $contact_info            = '',
   # TODO: autofill with other relays
   $my_family               = '',
@@ -31,7 +30,6 @@ define tor::daemon::relay(
   }
 
   concat::fragment { '03.relay':
-    ensure  => $ensure,
     content => template('tor/torrc.relay.erb'),
     order   => 03,
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/snippet.pp b/manifests/daemon/snippet.pp
index 7e1494c..5a4c091 100644
--- a/manifests/daemon/snippet.pp
+++ b/manifests/daemon/snippet.pp
@@ -1,10 +1,8 @@
 # Arbitrary torrc snippet definition
 define tor::daemon::snippet(
-  $content = '',
-  $ensure  = present ) {
+  $content = '' ) {
 
   concat::fragment { "99.snippet.${name}":
-    ensure  => $ensure,
     content => $content,
     order   => 99,
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/socks.pp b/manifests/daemon/socks.pp
index 54c8b6a..cb130d9 100644
--- a/manifests/daemon/socks.pp
+++ b/manifests/daemon/socks.pp
@@ -1,7 +1,6 @@
 # socks definition
 define tor::daemon::socks(
   $port = 0,
-  $listen_addresses = [],
   $policies = [] ) {
 
   concat::fragment { '02.socks':
diff --git a/manifests/daemon/transparent.pp b/manifests/daemon/transparent.pp
index 6ac7b44..90c0142 100644
--- a/manifests/daemon/transparent.pp
+++ b/manifests/daemon/transparent.pp
@@ -1,11 +1,8 @@
 # Transparent proxy definition
 define tor::daemon::transparent(
-  $port             = 0,
-  $listen_addresses = [],
-  $ensure           = present ) {
+  $port             = 0 ) {
 
   concat::fragment { "09.transparent.${name}":
-    ensure  => $ensure,
     content => template('tor/torrc.transparent.erb'),
     order   => '09',
     target  => $tor::daemon::config_file,
diff --git a/manifests/daemon/transport_plugin.pp b/manifests/daemon/transport_plugin.pp
new file mode 100644
index 0000000..1921282
--- /dev/null
+++ b/manifests/daemon/transport_plugin.pp
@@ -0,0 +1,13 @@
+# transport plugin
+define tor::daemon::transport_plugin(
+  $servertransport_plugin     = '',
+  $servertransport_listenaddr = '',
+  $servertransport_options    = '',
+  $ext_port                   = '' ) {
+
+  concat::fragment { '11.transport_plugin':
+    content => template('tor/torrc.transport_plugin.erb'),
+    order   => 11,
+    target  => $tor::daemon::config_file,
+  }
+}
diff --git a/metadata.json b/metadata.json
new file mode 100644
index 0000000..72e3701
--- /dev/null
+++ b/metadata.json
@@ -0,0 +1,29 @@
+{
+  "name": "smash-tor",
+  "version": "1.0.0",
+  "author": "SMASH",
+  "summary": "This project tracks the tor puppet module that manages the tor onion routing system.",
+  "license": "GPL-3.0",
+  "source": "https://gitlab.com/shared-puppet-modules-group/tor",
+  "project_page": "https://gitlab.com/shared-puppet-modules-group/tor",
+  "issues_url": "https://gitlab.com/shared-puppet-modules-group/tor/issues",
+  "dependencies": [
+    { "name":"puppetlabs/concat" }
+  ],
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "Debian",
+      "operatingsystemrelease": [
+        "8",
+        "9"
+      ]
+    }
+  ],
+  "requirements": [
+    {
+      "name": "puppet",
+      "version_requirement": "4.X"
+    }
+  ],
+  "description": "This module tries to manage tor, making sure it is installed, running, has  munin graphs if desired and allows for configuration of relays, hidden services, exit policies, etc."
+}
diff --git a/spec/acceptance/nodesets/default.yml b/spec/acceptance/nodesets/default.yml
new file mode 100644
index 0000000..f09ad62
--- /dev/null
+++ b/spec/acceptance/nodesets/default.yml
@@ -0,0 +1,19 @@
+HOSTS:
+  debian-8-x64:
+    platform: debian-8-amd64
+    image: debian:8
+    hypervisor: docker
+    docker_preserve_image: true
+    docker_cmd: '["/sbin/init"]'
+    docker_image_commands:
+      - 'apt-get install -y wget locales-all puppet git'
+      - 'rm -f /usr/sbin/policy-rc.d'
+
+CONFIG:
+  type: foss
+  #log_level: verbose
+  #log_level: debug
+
+ssh:
+  password: root
+  auth_methods: ["password"]
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
new file mode 100644
index 0000000..3cca63a
--- /dev/null
+++ b/spec/spec_helper.rb
@@ -0,0 +1,12 @@
+# https://puppetlabs.com/blog/testing-modules-in-the-puppet-forge
+require 'puppetlabs_spec_helper/module_spec_helper'
+
+fixture_path = File.expand_path(File.join(__FILE__, '..', 'fixtures'))
+
+RSpec.configure do |c|
+
+  c.manifest_dir = File.join(fixture_path, 'manifests')
+  c.module_path  = File.join(fixture_path, 'modules')
+
+  c.color = true
+end
diff --git a/spec/spec_helper_acceptance.rb b/spec/spec_helper_acceptance.rb
new file mode 100644
index 0000000..e6a2cd8
--- /dev/null
+++ b/spec/spec_helper_acceptance.rb
@@ -0,0 +1,18 @@
+require 'beaker-rspec'
+
+RSpec.configure do |c|
+  module_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+  module_name = module_root.split('-').last
+
+  # Readable test descriptions
+  c.formatter = :documentation
+
+  # Configure all nodes in nodeset
+  c.before :suite do
+    # Install module and dependencies
+    puppet_module_install(:source => module_root, :module_name => module_name)
+    hosts.each do |host|
+      shell('git clone https://github.com/puppetlabs/puppetlabs-concat.git /etc/puppet/modules/concat')
+    end
+  end
+end
diff --git a/templates/torrc.directory.erb b/templates/torrc.directory.erb
index 23ed339..d70ab39 100644
--- a/templates/torrc.directory.erb
+++ b/templates/torrc.directory.erb
@@ -2,9 +2,6 @@
 <%  if @port != '0' -%>
 DirPort <%= @port %>
 <%  end -%>
-<%  @listen_addresses.each do |listen_address| -%>
-DirListenAddress <%= listen_address %>
-<%  end -%>
 <%  if @port_front_page != '' -%>
 DirPortFrontPage <%= @port_front_page %>
 <%- end -%>
diff --git a/templates/torrc.dns.erb b/templates/torrc.dns.erb
index 57cf46d..a89ba31 100644
--- a/templates/torrc.dns.erb
+++ b/templates/torrc.dns.erb
@@ -1,5 +1,2 @@
 # DNS
 DNSPort <%= @port %>
-<% @listen_addresses.each do |listen_address|  -%>
-DNSListenAddress <%= listen_address %>
-<% end -%>
diff --git a/templates/torrc.exit_policy.erb b/templates/torrc.exit_policy.erb
index a30d43b..5481914 100644
--- a/templates/torrc.exit_policy.erb
+++ b/templates/torrc.exit_policy.erb
@@ -2,10 +2,10 @@
 <% if @reject_private != '1' -%>
 ExitPolicyRejectPrivate <%= @reject_private %>
 <% end -%>
-<% @accept.each do |policy| -%>
+<% Array(@accept).each do |policy| -%>
 ExitPolicy accept <%= policy %>
 <% end -%>
-<% @reject.each do |policy| -%>
+<% Array(@reject).each do |policy| -%>
 ExitPolicy reject <%= policy %>
 <% end -%>
 
diff --git a/templates/torrc.global.erb b/templates/torrc.global.erb
index a02afc8..c29b76b 100644
--- a/templates/torrc.global.erb
+++ b/templates/torrc.global.erb
@@ -8,7 +8,7 @@ DataDirectory <%= v %>
 <% if (rules=scope.lookupvar('tor::daemon::log_rules')).empty? -%>
 Log notice syslog
 <%  else -%>
-<%   rules.each do |log_rule| -%>
+<%   Array(rules).each do |log_rule| -%>
 Log <%= log_rule %>
 <%    end -%>
 <%  end -%>
diff --git a/templates/torrc.hidden_service.erb b/templates/torrc.hidden_service.erb
index 8a691c6..c7dbe9e 100644
--- a/templates/torrc.hidden_service.erb
+++ b/templates/torrc.hidden_service.erb
@@ -6,7 +6,7 @@ SOCKSPort 0
 
 # hidden service <%= @name %>
 HiddenServiceDir <%= @data_dir %>/<%= @name %>
-<% @ports.each do |port| -%>
+<% Array(@ports).each do |port| -%>
 HiddenServicePort <%= port %>
 <% end -%>
 
@@ -14,7 +14,7 @@ HiddenServicePort <%= port %>
 # hidden service v3 static
 HiddenServiceDir <%= @data_dir %>/<%= @name -%>3
 HiddenServiceVersion 3
-<% @ports.each do |port| -%>
+<% Array(@ports).each do |port| -%>
 HiddenServicePort <%= port %>
 <% end -%>
 <% end -%>
diff --git a/templates/torrc.relay.erb b/templates/torrc.relay.erb
index a286459..7735b47 100644
--- a/templates/torrc.relay.erb
+++ b/templates/torrc.relay.erb
@@ -1,10 +1,7 @@
 # relay
 <% if @port != 0 -%>
 ORPort <%= @port %>
-<%   @listen_addresses.each do |listen_address| -%>
-ORListenAddress <%= @listen_address %>
-<%   end -%>
-<%   @real_outbound_bindaddresses.each do |outbound_bindaddress| -%>
+<%   Array(@real_outbound_bindaddresses).each do |outbound_bindaddress| -%>
 OutboundBindAddress <%= @outbound_bindaddress %>
 <%   end -%>
 <%   if @nickname != '' -%>
diff --git a/templates/torrc.socks.erb b/templates/torrc.socks.erb
index 4bc3ddc..c6aba60 100644
--- a/templates/torrc.socks.erb
+++ b/templates/torrc.socks.erb
@@ -1,9 +1,6 @@
 # socks
 SocksPort <%= @port %>
-<% @listen_addresses.each do |listen_address| -%>
-SocksListenAddress <%= listen_address %>
-<% end -%>
-<% @policies.each do |policy| -%>
+<% Array(@policies).each do |policy| -%>
 SocksPolicy <%= policy %>
 <% end -%>
 
diff --git a/templates/torrc.transparent.erb b/templates/torrc.transparent.erb
index c683150..c57d138 100644
--- a/templates/torrc.transparent.erb
+++ b/templates/torrc.transparent.erb
@@ -1,5 +1,2 @@
 # Transparent proxy
 TransPort <%= @port %>
-<% @listen_addresses.each do |listen_address| -%>
-TransListenAddress <%= listen_address %>
-<% end -%>
diff --git a/templates/torrc.transport_plugin.erb b/templates/torrc.transport_plugin.erb
new file mode 100644
index 0000000..d57f0e8
--- /dev/null
+++ b/templates/torrc.transport_plugin.erb
@@ -0,0 +1,13 @@
+# transport plugin
+<% if @servertransport_plugin != '' -%>
+ServerTransportPlugin <%= @servertransport_plugin %>
+<% end -%>
+<% if @servertransport_listenaddr != '' -%>
+ServerTransportListenAddr <%= @servertransport_listenaddr %>
+<% end -%>
+<% if @servertransport_options != '' -%>
+ServerTransportOptions <%= @servertransport_options %>
+<% end -%>
+<% if @ext_port != '' -%>
+ExtORPort <%= @ext_port %>
+<% end -%>