commit 008c95d75ced5a8eb679aaac279dd25554266168
Author: Kienan Stewart <kienan@koumbit.org>
Date:   Fri Jan 15 18:06:15 2021 -0500

    Add Debian support

diff --git a/data/os/Archlinux.yaml b/data/os/Archlinux.yaml
index 4210ce4..0a1cf05 100644
--- a/data/os/Archlinux.yaml
+++ b/data/os/Archlinux.yaml
@@ -5,3 +5,4 @@ nftables::firewalld_enable: false
 
 nftables::configuration_path: /etc/nftables.conf
 nftables::nft_path: /usr/bin/nft
+nftables::echo: /usr/bin/echo
diff --git a/data/os/Debian.yaml b/data/os/Debian.yaml
new file mode 100644
index 0000000..28f0f02
--- /dev/null
+++ b/data/os/Debian.yaml
@@ -0,0 +1,7 @@
+---
+
+# firewalld is not installed by default in Debian
+nftables::firewalld_enable: false
+nftables::echo: /bin/echo
+nftables::configuration_path: /etc/nftables.conf
+nftables::nft_path: /usr/sbin/nft
diff --git a/data/os/RedHat.yaml b/data/os/RedHat.yaml
index 442775e..ac8a91f 100644
--- a/data/os/RedHat.yaml
+++ b/data/os/RedHat.yaml
@@ -1,2 +1,3 @@
 ---
 nftables::nft_path: /usr/sbin/nft
+nftables::echo: /usr/bin/echo
diff --git a/manifests/init.pp b/manifests/init.pp
index dd3af25..a25c2c1 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -117,7 +117,7 @@ class nftables (
   Variant[Boolean[false], Pattern[/icmp(v6|x)? type .+|tcp reset/]] $reject_with = 'icmpx type port-unreachable',
   Variant[Boolean[false], Enum['mask']] $firewalld_enable = 'mask',
   Optional[Array[Pattern[/^(ip|ip6|inet)-[-a-zA-Z0-9_]+$/],1]] $noflush_tables = undef,
-  Stdlib::Unixpath $echo = '/usr/bin/echo',
+  Stdlib::Unixpath $echo,
   Stdlib::Unixpath $configuration_path,
   Stdlib::Unixpath $nft_path,
 ) {
diff --git a/metadata.json b/metadata.json
index aba560e..b3312b9 100644
--- a/metadata.json
+++ b/metadata.json
@@ -51,6 +51,12 @@
     },
     {
       "operatingsystem": "Archlinux"
+    },
+    {
+      "operatingsystem": "Debian",
+      "operatingsystemrelease": [
+        "11"
+      ]
     }
   ],
   "requirements": [
diff --git a/spec/acceptance/all_rules_spec.rb b/spec/acceptance/all_rules_spec.rb
index 4fcef61..5de4446 100644
--- a/spec/acceptance/all_rules_spec.rb
+++ b/spec/acceptance/all_rules_spec.rb
@@ -80,6 +80,7 @@ describe 'nftables class' do
       }
       $config_path = $facts['os']['family'] ? {
         'Archlinux' => '/etc/nftables.conf',
+        'Debian' => '/etc/nftables.conf',
         default => '/etc/sysconfig/nftables.conf',
       }
       $nft_path = $facts['os']['family'] ? {
diff --git a/spec/acceptance/default_spec.rb b/spec/acceptance/default_spec.rb
index 08ad2b2..b991982 100644
--- a/spec/acceptance/default_spec.rb
+++ b/spec/acceptance/default_spec.rb
@@ -13,6 +13,7 @@ describe 'nftables class' do
       }
       $config_path = $facts['os']['family'] ? {
         'Archlinux' => '/etc/nftables.conf',
+        'Debian' => '/etc/nftables.conf',
         default => '/etc/sysconfig/nftables.conf',
       }
       $nft_path = $facts['os']['family'] ? {
@@ -68,6 +69,7 @@ describe 'nftables class' do
       }
       $config_path = $facts['os']['family'] ? {
         'Archlinux' => '/etc/nftables.conf',
+        'Debian' => '/etc/nftables.conf',
         default => '/etc/sysconfig/nftables.conf',
       }
       $nft_path = $facts['os']['family'] ? {
@@ -108,6 +110,7 @@ describe 'nftables class' do
       }
       $config_path = $facts['os']['family'] ? {
         'Archlinux' => '/etc/nftables.conf',
+        'Debian' => '/etc/nftables.conf',
         default => '/etc/sysconfig/nftables.conf',
       }
       $nft_path = $facts['os']['family'] ? {
@@ -148,6 +151,7 @@ describe 'nftables class' do
       }
       $config_path = $facts['os']['family'] ? {
         'Archlinux' => '/etc/nftables.conf',
+        'Debian' => '/etc/nftables.conf',
         default => '/etc/sysconfig/nftables.conf',
       }
       $nft_path = $facts['os']['family'] ? {
diff --git a/spec/classes/nftables_spec.rb b/spec/classes/nftables_spec.rb
index e31e687..8a067ce 100644
--- a/spec/classes/nftables_spec.rb
+++ b/spec/classes/nftables_spec.rb
@@ -15,6 +15,12 @@ describe 'nftables' do
                  else
                    '/usr/sbin/nft'
                  end
+      nft_config = case os_facts[:os]['family']
+                   when 'RedHat'
+                     '/etc/sysconfig/nftables.conf'
+                   else
+                     '/etc/nftables.conf'
+                   end
 
       it { is_expected.to compile.with_all_deps }
 
@@ -89,12 +95,14 @@ describe 'nftables' do
         )
       }
 
-      if os_facts[:os]['family'] == 'Archlinux'
-        it {
-          expect(subject).to contain_systemd__dropin_file('puppet_nft.conf').with(
-            content: %r{^ExecReload=#{nft_path} -I /etc/nftables/puppet -f /etc/nftables.conf$}
-          )
-        }
+      it {
+        expect(subject).to contain_systemd__dropin_file('puppet_nft.conf').with(
+          content: %r{^ExecReload=#{nft_path} -I /etc/nftables/puppet -f #{nft_config}$}
+        )
+      }
+
+      case os_facts[:os]['family']
+      when 'Archlinux'
 
         it {
           expect(subject).to contain_service('firewalld').with(
@@ -102,13 +110,14 @@ describe 'nftables' do
             enable: false
           )
         }
-      else
+      when 'Debian'
         it {
-          expect(subject).to contain_systemd__dropin_file('puppet_nft.conf').with(
-            content: %r{^ExecReload=#{nft_path} -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf$}
+          is_expected.to contain_service('firewalld').with(
+            ensure: 'stopped',
+            enable: false
           )
         }
-
+      else
         it {
           expect(subject).to contain_service('firewalld').with(
             ensure: 'stopped',
