commit 11bf7237333a685ccc629e0b2536a34c79a4e217
Author: Steve Traylen <steve.traylen@cern.ch>
Date:   Mon Dec 7 15:51:19 2020 +0100

    lint_fix results

diff --git a/manifests/bridges.pp b/manifests/bridges.pp
index 01ed75e..0f23510 100644
--- a/manifests/bridges.pp
+++ b/manifests/bridges.pp
@@ -1,9 +1,9 @@
 # allow forwarding traffic on bridges
-class nftables::bridges(
+class nftables::bridges (
   Enum['present','absent']
-    $ensure = 'present',
+  $ensure = 'present',
   Regexp
-    $bridgenames = /^br.+/
+  $bridgenames = /^br.+/
 ) {
   if $ensure == 'present' {
     $interfaces = keys($facts['networking']['interfaces'])
diff --git a/manifests/chain.pp b/manifests/chain.pp
index 29bfbfe..25f65d6 100644
--- a/manifests/chain.pp
+++ b/manifests/chain.pp
@@ -1,19 +1,19 @@
 # manage a chain
-define nftables::chain(
+define nftables::chain (
   Pattern[/^(ip|ip6|inet)-[a-zA-Z0-9_]+$/]
-    $table = 'inet-filter',
+  $table = 'inet-filter',
   Pattern[/^[a-zA-Z0-9_]+$/]
-    $chain = $title,
+  $chain = $title,
   Optional[Pattern[/^\d\d-[a-zA-Z0-9_]+$/]]
-    $inject = undef,
+  $inject = undef,
   Optional[String]
-    $inject_iif = undef,
+  $inject_iif = undef,
   Optional[String]
-    $inject_oif = undef,
-){
+  $inject_oif = undef,
+) {
   $concat_name = "nftables-${table}-chain-${chain}"
 
-  concat{
+  concat {
     $concat_name:
       path           => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",
       owner          => root,
@@ -21,16 +21,16 @@ define nftables::chain(
       mode           => '0640',
       ensure_newline => true,
       require        => Package['nftables'],
-  } ~> Exec['nft validate'] -> file{
+  } ~> Exec['nft validate'] -> file {
     "/etc/nftables/puppet/${table}-chain-${chain}.nft":
-    ensure => file,
-    source => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",
-    owner  => root,
-    group  => root,
-    mode   => '0640',
+      ensure => file,
+      source => "/etc/nftables/puppet-preflight/${table}-chain-${chain}.nft",
+      owner  => root,
+      group  => root,
+      mode   => '0640',
   } ~> Service['nftables']
 
-  concat::fragment{
+  concat::fragment {
     default:
       target => $concat_name;
     "${concat_name}-header":
@@ -51,7 +51,7 @@ define nftables::chain(
       undef => '',
       default => "oifname ${inject_oif} ",
     }
-    nftables::rule{ "${data[1]}-jump_${chain}":
+    nftables::rule { "${data[1]}-jump_${chain}":
       order   => $data[0],
       content => "${iif}${oif}jump ${chain}",
     }
diff --git a/manifests/config.pp b/manifests/config.pp
index f07b1f0..99e8ae9 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -1,26 +1,26 @@
 # manage a config snippet
-define nftables::config(
+define nftables::config (
   Optional[String]
-    $content = undef,
+  $content = undef,
   Optional[Variant[String,Array[String,1]]]
-    $source = undef,
-){
+  $source = undef,
+) {
   $concat_name = "nftables-${name}"
 
-  Package['nftables'] -> concat{
+  Package['nftables'] -> concat {
     $concat_name:
       path           => "/etc/nftables/puppet-preflight/${name}.nft",
       ensure_newline => true,
       owner          => root,
       group          => root,
       mode           => '0640',
-  } ~> Exec['nft validate'] -> file{
+  } ~> Exec['nft validate'] -> file {
     "/etc/nftables/puppet/${name}.nft":
-    ensure => file,
-    source => "/etc/nftables/puppet-preflight/${name}.nft",
-    owner  => root,
-    group  => root,
-    mode   => '0640',
+      ensure => file,
+      source => "/etc/nftables/puppet-preflight/${name}.nft",
+      owner  => root,
+      group  => root,
+      mode   => '0640',
   } ~> Service['nftables']
 
   $data = split($name, '-')
diff --git a/manifests/inet_filter.pp b/manifests/inet_filter.pp
index 687e9ed..133f073 100644
--- a/manifests/inet_filter.pp
+++ b/manifests/inet_filter.pp
@@ -1,6 +1,5 @@
 # manage basic chains in table inet filter
 class nftables::inet_filter inherits nftables {
-
   $_reject_rule = epp('nftables/reject_rule.epp',
     {
       'log_prefix' => sprintf($nftables::log_prefix, { 'chain' => '%<chain>s', 'comment' => 'Rejected: ' }),
@@ -8,12 +7,12 @@ class nftables::inet_filter inherits nftables {
     }
   )
 
-  nftables::config{
+  nftables::config {
     'inet-filter':
       source => 'puppet:///modules/nftables/config/puppet-inet-filter.nft';
   }
 
-  nftables::chain{
+  nftables::chain {
     [
       'INPUT',
       'OUTPUT',
@@ -21,7 +20,7 @@ class nftables::inet_filter inherits nftables {
     ]:;
   }
 
-  nftables::chain{
+  nftables::chain {
     'default_in':
       inject => '10-INPUT';
     'default_out':
@@ -31,7 +30,7 @@ class nftables::inet_filter inherits nftables {
   }
 
   # inet-filter-chain-INPUT
-  nftables::rule{
+  nftables::rule {
     'INPUT-type':
       order   => '01',
       content => 'type filter hook input priority 0';
@@ -49,14 +48,14 @@ class nftables::inet_filter inherits nftables {
       content => sprintf($_reject_rule, { 'chain' => 'INPUT' }),
   }
   if $nftables::reject_with {
-    nftables::rule{
+    nftables::rule {
       'INPUT-reject':
         order   => '98',
         content => "reject with ${$nftables::reject_with}";
     }
   }
   if $nftables::in_out_conntrack {
-    nftables::rule{
+    nftables::rule {
       'INPUT-accept_established_related':
         order   => '05',
         content => 'ct state established,related accept';
@@ -67,7 +66,7 @@ class nftables::inet_filter inherits nftables {
   }
 
   # inet-filter-chain-OUTPUT
-  nftables::rule{
+  nftables::rule {
     'OUTPUT-type':
       order   => '01',
       content => 'type filter hook output priority 0';
@@ -85,14 +84,14 @@ class nftables::inet_filter inherits nftables {
       content => sprintf($_reject_rule, { 'chain' => 'OUTPUT' }),
   }
   if $nftables::reject_with {
-    nftables::rule{
+    nftables::rule {
       'OUTPUT-reject':
         order   => '98',
         content => "reject with ${$nftables::reject_with}";
     }
   }
   if $nftables::in_out_conntrack {
-    nftables::rule{
+    nftables::rule {
       'OUTPUT-accept_established_related':
         order   => '05',
         content => 'ct state established,related accept';
@@ -103,7 +102,7 @@ class nftables::inet_filter inherits nftables {
   }
 
   # inet-filter-chain-FORWARD
-  nftables::rule{
+  nftables::rule {
     'FORWARD-type':
       order   => '01',
       content => 'type filter hook forward priority 0';
@@ -118,14 +117,14 @@ class nftables::inet_filter inherits nftables {
       content => sprintf($_reject_rule, { 'chain' => 'FORWARD' });
   }
   if $nftables::reject_with {
-    nftables::rule{
+    nftables::rule {
       'FORWARD-reject':
         order   => '98',
         content => "reject with ${$nftables::reject_with}";
     }
   }
   if $nftables::fwd_conntrack {
-    nftables::rule{
+    nftables::rule {
       'FORWARD-accept_established_related':
         order   => '05',
         content => 'ct state established,related accept';
diff --git a/manifests/init.pp b/manifests/init.pp
index a30b419..5f10024 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -95,24 +95,23 @@ class nftables (
   Hash $sets                     = {},
   String $log_prefix             = '[nftables] %<chain>s %<comment>s',
   Variant[Boolean[false], String]
-    $log_limit                   = '3/minute burst 5 packets',
+  $log_limit                   = '3/minute burst 5 packets',
   Variant[Boolean[false], Pattern[
-    /icmp(v6|x)? type .+|tcp reset/]]
-    $reject_with                 = 'icmpx type port-unreachable',
+  /icmp(v6|x)? type .+|tcp reset/]]
+  $reject_with                 = 'icmpx type port-unreachable',
   Variant[Boolean[false], Enum['mask']]
-    $firewalld_enable            = 'mask',
+  $firewalld_enable            = 'mask',
   Optional[Array[Pattern[/^(ip|ip6|inet)-[-a-zA-Z0-9_]+$/],1]]
-    $noflush_tables = undef,
+  $noflush_tables = undef,
 ) {
-
-  package{'nftables':
+  package { 'nftables':
     ensure => installed,
-  } -> file_line{
+  } -> file_line {
     'enable_nftables':
       line   => 'include "/etc/nftables/puppet.nft"',
       path   => '/etc/sysconfig/nftables.conf',
       notify => Service['nftables'],
-  } -> file{
+  } -> file {
     default:
       owner => 'root',
       group => 'root',
@@ -126,11 +125,11 @@ class nftables (
     '/etc/nftables/puppet-preflight.nft':
       ensure  => file,
       content => epp('nftables/config/puppet.nft.epp', { 'nat' => $nat, 'noflush' => $noflush_tables });
-  } ~> exec{
+  } ~> exec {
     'nft validate':
       refreshonly => true,
       command     => '/usr/sbin/nft -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft || ( /usr/bin/echo "#CONFIG BROKEN" >> /etc/nftables/puppet-preflight.nft && /bin/false)';
-  } -> file{
+  } -> file {
     default:
       owner => 'root',
       group => 'root',
@@ -144,21 +143,21 @@ class nftables (
       purge   => true,
       force   => true,
       recurse => true;
-  } ~> service{'nftables':
+  } ~> service { 'nftables':
     ensure     => running,
     enable     => true,
     hasrestart => true,
     restart    => '/usr/bin/systemctl reload nftables',
   }
 
-  systemd::dropin_file{'puppet_nft.conf':
+  systemd::dropin_file { 'puppet_nft.conf':
     ensure  => present,
     unit    => 'nftables.service',
     content => epp('nftables/systemd/puppet_nft.conf.epp', { 'noflush' => $noflush_tables }),
     notify  => Service['nftables'],
   }
 
-  service{'firewalld':
+  service { 'firewalld':
     ensure => stopped,
     enable => $firewalld_enable,
   }
@@ -170,17 +169,17 @@ class nftables (
 
   # inject custom rules e.g. from hiera
   $rules.each |$n,$v| {
-    nftables::rule{
+    nftables::rule {
       $n:
-        * => $v
+        * => $v,
     }
   }
 
   # inject custom sets e.g. from hiera
   $sets.each |$n,$v| {
-    nftables::set{
+    nftables::set {
       $n:
-        * => $v
+        * => $v,
     }
   }
 }
diff --git a/manifests/ip_nat.pp b/manifests/ip_nat.pp
index 022dbc5..1ff2984 100644
--- a/manifests/ip_nat.pp
+++ b/manifests/ip_nat.pp
@@ -1,14 +1,13 @@
 # manage basic chains in table ip nat
 class nftables::ip_nat inherits nftables {
-
-  nftables::config{
+  nftables::config {
     'ip-nat':
       source => 'puppet:///modules/nftables/config/puppet-ip-nat.nft';
     'ip6-nat':
       source => 'puppet:///modules/nftables/config/puppet-ip6-nat.nft';
   }
 
-  nftables::chain{
+  nftables::chain {
     [
       'PREROUTING',
       'POSTROUTING',
@@ -16,7 +15,7 @@ class nftables::ip_nat inherits nftables {
       table => 'ip-nat';
   }
 
-  nftables::chain{
+  nftables::chain {
     [
       'PREROUTING6',
       'POSTROUTING6',
@@ -25,7 +24,7 @@ class nftables::ip_nat inherits nftables {
   }
 
   # ip-nat-chain-PREROUTING
-  nftables::rule{
+  nftables::rule {
     'PREROUTING-type':
       table   => 'ip-nat',
       order   => '01',
@@ -45,7 +44,7 @@ class nftables::ip_nat inherits nftables {
   }
 
   # ip-nat-chain-POSTROUTING
-  nftables::rule{
+  nftables::rule {
     'POSTROUTING-type':
       table   => 'ip-nat',
       order   => '01',
diff --git a/manifests/rule.pp b/manifests/rule.pp
index 7a74238..9c575ec 100644
--- a/manifests/rule.pp
+++ b/manifests/rule.pp
@@ -1,21 +1,20 @@
 # manage a chain rule
 # Name should be:
 #   CHAIN_NAME-rulename
-define nftables::rule(
+define nftables::rule (
   Enum['present','absent']
-    $ensure = 'present',
+  $ensure = 'present',
   Pattern[/^[a-zA-Z0-9_]+-[a-zA-Z0-9_]+(-\d+)?$/]
-    $rulename = $title,
+  $rulename = $title,
   Pattern[/^\d\d$/]
-    $order = '50',
+  $order = '50',
   Optional[String]
-    $table = 'inet-filter',
+  $table = 'inet-filter',
   Optional[String]
-    $content = undef,
+  $content = undef,
   Optional[Variant[String,Array[String,1]]]
-    $source = undef,
-){
-
+  $source = undef,
+) {
   if $ensure == 'present' {
     $data = split($rulename, '-')
 
@@ -25,24 +24,24 @@ define nftables::rule(
       $fragment = "nftables-${table}-chain-${data[0]}-rule-${data[1]}"
     }
 
-    concat::fragment{"${fragment}_header":
+    concat::fragment { "${fragment}_header":
       content => "#   Start of fragment order:${order} rulename:${rulename}",
       order   => "${order}-${fragment}-a",
       target  => "nftables-${table}-chain-${data[0]}",
     }
 
-    concat::fragment{
+    concat::fragment {
       $fragment:
         order  => "${order}-${fragment}-b",
         target => "nftables-${table}-chain-${data[0]}",
     }
 
     if $content {
-      Concat::Fragment[$fragment]{
+      Concat::Fragment[$fragment] {
         content => "  ${content}",
       }
     } else {
-      Concat::Fragment[$fragment]{
+      Concat::Fragment[$fragment] {
         source => $source,
       }
     }
diff --git a/manifests/rules/afs3_callback.pp b/manifests/rules/afs3_callback.pp
index ead6bde..075177b 100644
--- a/manifests/rules/afs3_callback.pp
+++ b/manifests/rules/afs3_callback.pp
@@ -8,9 +8,7 @@
 class nftables::rules::afs3_callback (
   Array[Stdlib::IP::Address::V4,1] $saddr = ['0.0.0.0/0'],
 ) {
-
-  nftables::rule{'default_in-afs3_callback':
-    content =>  "ip saddr { ${saddr.join(', ')} } udp dport 7001 accept";
+  nftables::rule { 'default_in-afs3_callback':
+    content => "ip saddr { ${saddr.join(', ')} } udp dport 7001 accept";
   }
-
 }
diff --git a/manifests/rules/ceph.pp b/manifests/rules/ceph.pp
index ccd05c8..1fc33be 100644
--- a/manifests/rules/ceph.pp
+++ b/manifests/rules/ceph.pp
@@ -2,7 +2,7 @@
 # Enable this to support Ceph's Object Storage Daemons (OSD),
 # Metadata Server Daemons (MDS), or Manager Daemons (MGR).
 class nftables::rules::ceph {
-  nftables::rule{
+  nftables::rule {
     'default_in-ceph':
       content => 'tcp dport 6800-7300 accept comment "Accept Ceph OSD, MDS, MGR"',
   }
diff --git a/manifests/rules/ceph_mon.pp b/manifests/rules/ceph_mon.pp
index 1cde9d0..7549452 100644
--- a/manifests/rules/ceph_mon.pp
+++ b/manifests/rules/ceph_mon.pp
@@ -1,9 +1,9 @@
 # Ceph is a distributed object store and file system.
 # Enable this option to support Ceph's Monitor Daemon.
-class nftables::rules::ceph_mon(
+class nftables::rules::ceph_mon (
   Array[Integer,1] $ports = [3300, 6789],
-){
-  nftables::rule{
+) {
+  nftables::rule {
     'default_in-ceph_mon':
       content => "tcp dport {${$ports.join(', ')}} accept comment \"Accept Ceph MON\"",
   }
diff --git a/manifests/rules/dhcpv6_client.pp b/manifests/rules/dhcpv6_client.pp
index a187212..a7c014c 100644
--- a/manifests/rules/dhcpv6_client.pp
+++ b/manifests/rules/dhcpv6_client.pp
@@ -1,5 +1,5 @@
 class nftables::rules::dhcpv6_client {
-  nftables::rule{
+  nftables::rule {
     'default_in-dhcpv6_client':
       content => 'ip6 saddr fe80::/10 ip6 daddr fe80::/10 udp sport 547 udp dport 546 accept',
   }
diff --git a/manifests/rules/dnat4.pp b/manifests/rules/dnat4.pp
index 46e4fa7..6d63c21 100644
--- a/manifests/rules/dnat4.pp
+++ b/manifests/rules/dnat4.pp
@@ -1,25 +1,24 @@
 # manage a ipv4 dnat rule
-define nftables::rules::dnat4(
+define nftables::rules::dnat4 (
   Pattern[/^[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}\.[12]?\d{1,2}$/]
-    $daddr,
+  $daddr,
   Variant[String,Integer[1,65535]]
-    $port,
+  $port,
   Pattern[/^[a-zA-Z0-9_]+$/]
-    $rulename = $title,
+  $rulename = $title,
   Pattern[/^\d\d$/]
-    $order = '50',
+  $order = '50',
   String[1]
-    $chain = 'default_fwd',
+  $chain = 'default_fwd',
   Optional[String[1]]
-    $iif = undef,
+  $iif = undef,
   Enum['tcp','udp']
-    $proto = 'tcp',
+  $proto = 'tcp',
   Optional[Variant[String,Integer[1,65535]]]
-    $dport = '',
+  $dport = '',
   Enum['present','absent']
-    $ensure = 'present',
+  $ensure = 'present',
 ) {
-
   $iifname = $iif ? {
     undef   => '',
     default => "iifname ${iif} ",
@@ -33,7 +32,7 @@ define nftables::rules::dnat4(
     default => ":${dport}",
   }
 
-  nftables::rule{
+  nftables::rule {
     default:
       ensure => $ensure,
       order  => $order;
diff --git a/manifests/rules/dns.pp b/manifests/rules/dns.pp
index 144a8cd..2bb23fa 100644
--- a/manifests/rules/dns.pp
+++ b/manifests/rules/dns.pp
@@ -1,9 +1,9 @@
 # manage in dns
-class nftables::rules::dns(
+class nftables::rules::dns (
   Array[Integer,1]
-    $ports = [53],
+  $ports = [53],
 ) {
-  nftables::rule{
+  nftables::rule {
     'default_in-dns_tcp':
       content => "tcp dport {${join($ports,', ')}} accept";
     'default_in-dns_udp':
diff --git a/manifests/rules/http.pp b/manifests/rules/http.pp
index 73e390b..2d5d2d4 100644
--- a/manifests/rules/http.pp
+++ b/manifests/rules/http.pp
@@ -1,6 +1,6 @@
 # manage in http
 class nftables::rules::http {
-  nftables::rule{
+  nftables::rule {
     'default_in-http':
       content => 'tcp dport 80 accept',
   }
diff --git a/manifests/rules/https.pp b/manifests/rules/https.pp
index c97e2c7..3834096 100644
--- a/manifests/rules/https.pp
+++ b/manifests/rules/https.pp
@@ -1,6 +1,6 @@
 # manage in https
 class nftables::rules::https {
-  nftables::rule{
+  nftables::rule {
     'default_in-https':
       content => 'tcp dport 443 accept',
   }
diff --git a/manifests/rules/icinga2.pp b/manifests/rules/icinga2.pp
index cbfc9c4..32ec68c 100644
--- a/manifests/rules/icinga2.pp
+++ b/manifests/rules/icinga2.pp
@@ -1,9 +1,9 @@
 # manage in icinga2
-class nftables::rules::icinga2(
+class nftables::rules::icinga2 (
   Array[Integer,1]
-    $ports = [5665],
+  $ports = [5665],
 ) {
-  nftables::rule{
+  nftables::rule {
     'default_in-icinga2':
       content => "tcp dport {${join($ports,', ')}} accept",
   }
diff --git a/manifests/rules/icmp.pp b/manifests/rules/icmp.pp
index a699ff8..068d34c 100644
--- a/manifests/rules/icmp.pp
+++ b/manifests/rules/icmp.pp
@@ -5,33 +5,33 @@ class nftables::rules::icmp (
 ) {
   if $v4_types {
     $v4_types.each | String $icmp_type | {
-      nftables::rule{
+      nftables::rule {
         "default_in-accept_icmpv4_${regsubst(split($icmp_type, ' ')[0], '-', '_', 'G')}":
           content => "ip protocol icmp icmp type ${icmp_type} accept",
           order   => $order,
       }
     }
   } else {
-    nftables::rule{
+    nftables::rule {
       'default_in-accept_icmpv4':
         content => 'ip protocol icmp accept',
         order   => $order,
-      }
+    }
   }
 
   if $v6_types {
     $v6_types.each | String $icmp_type | {
-      nftables::rule{
+      nftables::rule {
         "default_in-accept_icmpv6_${regsubst(split($icmp_type, ' ')[0], '-', '_', 'G')}":
           content => "ip6 nexthdr ipv6-icmp icmpv6 type ${icmp_type} accept",
           order   => $order,
       }
     }
   } else {
-    nftables::rule{
+    nftables::rule {
       'default_in-accept_icmpv6':
         content => 'ip6 nexthdr ipv6-icmp accept',
         order   => $order,
-      }
+    }
   }
 }
diff --git a/manifests/rules/masquerade.pp b/manifests/rules/masquerade.pp
index 5dfc959..d2d7943 100644
--- a/manifests/rules/masquerade.pp
+++ b/manifests/rules/masquerade.pp
@@ -1,25 +1,24 @@
 # masquerade all outgoing traffic
-define nftables::rules::masquerade(
+define nftables::rules::masquerade (
   Pattern[/^[a-zA-Z0-9_]+$/]
-    $rulename = $title,
+  $rulename = $title,
   Pattern[/^\d\d$/]
-    $order = '70',
+  $order = '70',
   String[1]
-    $chain = 'POSTROUTING',
+  $chain = 'POSTROUTING',
   Optional[String[1]]
-    $oif = undef,
+  $oif = undef,
   Optional[String[1]]
-    $saddr = undef,
+  $saddr = undef,
   Optional[String[1]]
-    $daddr = undef,
+  $daddr = undef,
   Optional[Enum['tcp','udp']]
-    $proto = undef,
+  $proto = undef,
   Optional[Variant[String,Integer[1,65535]]]
-    $dport = undef,
+  $dport = undef,
   Enum['present','absent']
-    $ensure = 'present',
+  $ensure = 'present',
 ) {
-
   $oifname = $oif ? {
     undef   => '',
     default => "oifname ${oif} ",
@@ -47,7 +46,7 @@ define nftables::rules::masquerade(
     $port     = ''
   }
 
-  nftables::rule{
+  nftables::rule {
     "${chain}-${rulename}":
       ensure  => $ensure,
       table   => 'ip-nat',
diff --git a/manifests/rules/nfs.pp b/manifests/rules/nfs.pp
index 2f00147..868f1df 100644
--- a/manifests/rules/nfs.pp
+++ b/manifests/rules/nfs.pp
@@ -1,6 +1,6 @@
 # manage in nfs4
 class nftables::rules::nfs {
-  nftables::rule{
+  nftables::rule {
     'default_in-nfs4':
       content => 'tcp dport nfs accept comment "Accept NFS4"',
   }
diff --git a/manifests/rules/nfs3.pp b/manifests/rules/nfs3.pp
index 30fbe29..446288a 100644
--- a/manifests/rules/nfs3.pp
+++ b/manifests/rules/nfs3.pp
@@ -1,6 +1,6 @@
 # manage in nfs3
 class nftables::rules::nfs3 {
-  nftables::rule{
+  nftables::rule {
     'default_in-nfs3':
       content => 'meta l4proto { tcp, udp } dport nfs accept comment "Accept NFS3"',
   }
diff --git a/manifests/rules/node_exporter.pp b/manifests/rules/node_exporter.pp
index 345c1c2..42fb106 100644
--- a/manifests/rules/node_exporter.pp
+++ b/manifests/rules/node_exporter.pp
@@ -1,28 +1,27 @@
 # manage in node exporter
-class nftables::rules::node_exporter(
+class nftables::rules::node_exporter (
   Optional[Variant[String,Array[String,1]]]
-    $prometheus_server = undef,
+  $prometheus_server = undef,
   Integer
-    $port = 9100,
+  $port = 9100,
 ) {
   if $prometheus_server {
     any2array($prometheus_server).each |$index,$prom| {
-
-      nftables::rule{
+      nftables::rule {
         "default_in-node_exporter-${index}":
       }
       if $prom =~ /:/ {
-        Nftables::Rule["default_in-node_exporter-${index}"]{
+        Nftables::Rule["default_in-node_exporter-${index}"] {
           content => "ip6 saddr ${prom} tcp dport ${port} accept",
         }
       } else {
-        Nftables::Rule["default_in-node_exporter-${index}"]{
+        Nftables::Rule["default_in-node_exporter-${index}"] {
           content => "ip saddr ${prom} tcp dport ${port} accept",
         }
       }
     }
   } else {
-    nftables::rule{
+    nftables::rule {
       'default_in-node_exporter':
         content => "tcp dport ${port} accept";
     }
diff --git a/manifests/rules/ospf.pp b/manifests/rules/ospf.pp
index b5effc9..97b4752 100644
--- a/manifests/rules/ospf.pp
+++ b/manifests/rules/ospf.pp
@@ -1,6 +1,6 @@
 # manage in ospf
 class nftables::rules::ospf {
-  nftables::rule{
+  nftables::rule {
     'default_in-ospf':
       content => 'ip daddr { 224.0.0.5, 224.0.0.6 } meta l4proto ospf accept',
   }
diff --git a/manifests/rules/ospf3.pp b/manifests/rules/ospf3.pp
index 6a755be..526ad0e 100644
--- a/manifests/rules/ospf3.pp
+++ b/manifests/rules/ospf3.pp
@@ -1,6 +1,6 @@
 # manage in ospf3
 class nftables::rules::ospf3 {
-  nftables::rule{
+  nftables::rule {
     'default_in-ospf3':
       content => 'ip6 saddr fe80::/64 ip6 daddr { ff02::5, ff02::6 } meta l4proto ospf accept',
   }
diff --git a/manifests/rules/out/all.pp b/manifests/rules/out/all.pp
index 2ca52ae..37c58a8 100644
--- a/manifests/rules/out/all.pp
+++ b/manifests/rules/out/all.pp
@@ -1,9 +1,8 @@
 # allow all outbound
 class nftables::rules::out::all {
-  nftables::rule{
+  nftables::rule {
     'default_out-all':
       order   => '90',
       content => 'accept',
-
   }
 }
diff --git a/manifests/rules/out/ceph_client.pp b/manifests/rules/out/ceph_client.pp
index 3fc27a2..e30049a 100644
--- a/manifests/rules/out/ceph_client.pp
+++ b/manifests/rules/out/ceph_client.pp
@@ -2,10 +2,10 @@
 # Enable this to be a client of Ceph's Monitor (MON),
 # Object Storage Daemons (OSD), Metadata Server Daemons (MDS),
 # and Manager Daemons (MGR).
-class nftables::rules::out::ceph_client(
+class nftables::rules::out::ceph_client (
   Array[Integer,1] $ports = [3300, 6789],
-){
-  nftables::rule{
+) {
+  nftables::rule {
     'default_out-ceph_client':
       content => "tcp dport { ${$ports.join(', ')}, 6800-7300 } accept comment \"Accept Ceph MON, OSD, MDS, MGR\"",
   }
diff --git a/manifests/rules/out/chrony.pp b/manifests/rules/out/chrony.pp
index a79568b..5e856fd 100644
--- a/manifests/rules/out/chrony.pp
+++ b/manifests/rules/out/chrony.pp
@@ -1,6 +1,6 @@
 # manage out chrony
 class nftables::rules::out::chrony {
-  nftables::rule{
+  nftables::rule {
     'default_out-chrony':
       content => 'udp dport 123 accept',
   }
diff --git a/manifests/rules/out/dhcp.pp b/manifests/rules/out/dhcp.pp
index 90193fd..c5b6b19 100644
--- a/manifests/rules/out/dhcp.pp
+++ b/manifests/rules/out/dhcp.pp
@@ -1,6 +1,6 @@
 # manage out dhcp
 class nftables::rules::out::dhcp {
-  nftables::rule{
+  nftables::rule {
     'default_out-dhcpc':
       content => 'udp sport {67, 68} udp dport {67, 68} accept';
   }
diff --git a/manifests/rules/out/dhcpv6_client.pp b/manifests/rules/out/dhcpv6_client.pp
index 5c4f7d2..dfb8852 100644
--- a/manifests/rules/out/dhcpv6_client.pp
+++ b/manifests/rules/out/dhcpv6_client.pp
@@ -1,5 +1,5 @@
 class nftables::rules::out::dhcpv6_client {
-  nftables::rule{
+  nftables::rule {
     'default_out-dhcpv6_client':
       content => 'ip6 saddr fe80::/10 udp sport 546 udp dport 547 accept',
   }
diff --git a/manifests/rules/out/dns.pp b/manifests/rules/out/dns.pp
index 32c3600..513cfa4 100644
--- a/manifests/rules/out/dns.pp
+++ b/manifests/rules/out/dns.pp
@@ -1,39 +1,38 @@
 # manage out dns
 class nftables::rules::out::dns (
   Optional[Variant[String,Array[String,1]]]
-    $dns_server = undef,
+  $dns_server = undef,
 ) {
   if $dns_server {
     any2array($dns_server).each |$index,$dns| {
-
-      nftables::rule{
+      nftables::rule {
         "default_out-dnsudp-${index}":
       }
       if $dns =~ /:/ {
-        Nftables::Rule["default_out-dnsudp-${index}"]{
+        Nftables::Rule["default_out-dnsudp-${index}"] {
           content => "ip6 daddr ${dns} udp dport 53 accept",
         }
       } else {
-        Nftables::Rule["default_out-dnsudp-${index}"]{
+        Nftables::Rule["default_out-dnsudp-${index}"] {
           content => "ip daddr ${dns} udp dport 53 accept",
         }
       }
 
-      nftables::rule{
+      nftables::rule {
         "default_out-dnstcp-${index}":
       }
       if $dns =~ /:/ {
-        Nftables::Rule["default_out-dnstcp-${index}"]{
+        Nftables::Rule["default_out-dnstcp-${index}"] {
           content => "ip6 daddr ${dns} tcp dport 53 accept",
         }
       } else {
-        Nftables::Rule["default_out-dnstcp-${index}"]{
+        Nftables::Rule["default_out-dnstcp-${index}"] {
           content => "ip daddr ${dns} tcp dport 53 accept",
         }
       }
     }
   } else {
-    nftables::rule{
+    nftables::rule {
       'default_out-dnsudp':
         content => 'udp dport 53 accept';
       'default_out-dnstcp':
diff --git a/manifests/rules/out/http.pp b/manifests/rules/out/http.pp
index 656a2c6..6de9eb3 100644
--- a/manifests/rules/out/http.pp
+++ b/manifests/rules/out/http.pp
@@ -1,6 +1,6 @@
 # manage out http
 class nftables::rules::out::http {
-  nftables::rule{
+  nftables::rule {
     'default_out-http':
       content => 'tcp dport 80 accept';
   }
diff --git a/manifests/rules/out/https.pp b/manifests/rules/out/https.pp
index b5c2734..84212b3 100644
--- a/manifests/rules/out/https.pp
+++ b/manifests/rules/out/https.pp
@@ -1,6 +1,6 @@
 # manage out https
 class nftables::rules::out::https {
-  nftables::rule{
+  nftables::rule {
     'default_out-https':
       content => 'tcp dport 443 accept';
   }
diff --git a/manifests/rules/out/icmp.pp b/manifests/rules/out/icmp.pp
index a67304a..d6171ac 100644
--- a/manifests/rules/out/icmp.pp
+++ b/manifests/rules/out/icmp.pp
@@ -5,33 +5,33 @@ class nftables::rules::out::icmp (
 ) {
   if $v4_types {
     $v4_types.each | String $icmp_type | {
-      nftables::rule{
+      nftables::rule {
         'default_out-accept_icmpv4':
           content => "ip protocol icmp icmp type ${icmp_type} accept",
           order   => $order,
       }
     }
   } else {
-    nftables::rule{
+    nftables::rule {
       'default_out-accept_icmpv4':
         content => 'ip protocol icmp accept',
         order   => $order,
-      }
+    }
   }
 
   if $v6_types {
     $v6_types.each | String $icmp_type | {
-      nftables::rule{
+      nftables::rule {
         'default_out-accept_icmpv6':
           content => "ip6 nexthdr ipv6-icmp icmpv6 type ${icmp_type} accept",
           order   => $order,
       }
     }
   } else {
-    nftables::rule{
+    nftables::rule {
       'default_out-accept_icmpv6':
         content => 'ip6 nexthdr ipv6-icmp accept',
         order   => $order,
-      }
+    }
   }
 }
diff --git a/manifests/rules/out/kerberos.pp b/manifests/rules/out/kerberos.pp
index f6e1a32..395b92c 100644
--- a/manifests/rules/out/kerberos.pp
+++ b/manifests/rules/out/kerberos.pp
@@ -1,11 +1,9 @@
 # @summary allows outbound access for kerberos
 class nftables::rules::out::kerberos {
-
-  nftables::rule{
+  nftables::rule {
     'default_out-kerberos_udp':
-      content =>  'udp dport 88 accept';
+      content => 'udp dport 88 accept';
     'default_out-kerberos_tcp':
-      content =>  'tcp dport 88 accept';
+      content => 'tcp dport 88 accept';
   }
-
 }
diff --git a/manifests/rules/out/mysql.pp b/manifests/rules/out/mysql.pp
index ba39ce7..6cc929d 100644
--- a/manifests/rules/out/mysql.pp
+++ b/manifests/rules/out/mysql.pp
@@ -1,6 +1,6 @@
 # manage out mysql
 class nftables::rules::out::mysql {
-  nftables::rule{
+  nftables::rule {
     'default_out-mysql':
       content => 'tcp dport 3306 accept';
   }
diff --git a/manifests/rules/out/nfs.pp b/manifests/rules/out/nfs.pp
index e201bc5..9333339 100644
--- a/manifests/rules/out/nfs.pp
+++ b/manifests/rules/out/nfs.pp
@@ -1,6 +1,6 @@
 # manage out nfs
 class nftables::rules::out::nfs {
-  nftables::rule{
+  nftables::rule {
     'default_out-nfs4':
       content => 'tcp dport nfs accept comment "Accept NFS4"',
   }
diff --git a/manifests/rules/out/nfs3.pp b/manifests/rules/out/nfs3.pp
index 3a309ac..8fbbcf5 100644
--- a/manifests/rules/out/nfs3.pp
+++ b/manifests/rules/out/nfs3.pp
@@ -1,6 +1,6 @@
 # manage out nfs3
 class nftables::rules::out::nfs3 {
-  nftables::rule{
+  nftables::rule {
     'default_out-nfs3':
       content => 'meta l4proto { tcp, udp } dport nfs accept comment "Accept NFS3"',
   }
diff --git a/manifests/rules/out/openafs_client.pp b/manifests/rules/out/openafs_client.pp
index 97098ea..a11a170 100644
--- a/manifests/rules/out/openafs_client.pp
+++ b/manifests/rules/out/openafs_client.pp
@@ -5,14 +5,12 @@
 #
 # @see https://wiki.openafs.org/devel/AFSServicePorts/ AFS Service Ports
 #
-class nftables::rules::out::openafs_client(
+class nftables::rules::out::openafs_client (
   Array[Integer,1] $ports = [7000, 7002, 7003],
-){
-
+) {
   include nftables::rules::out::kerberos
 
-  nftables::rule{'default_out-openafs_client':
+  nftables::rule { 'default_out-openafs_client':
     content => "udp dport {${$ports.join(', ')}} accept";
   }
-
 }
diff --git a/manifests/rules/out/ospf.pp b/manifests/rules/out/ospf.pp
index c14a1b3..bb9112c 100644
--- a/manifests/rules/out/ospf.pp
+++ b/manifests/rules/out/ospf.pp
@@ -1,6 +1,6 @@
 # manage out ospf
 class nftables::rules::out::ospf {
-  nftables::rule{
+  nftables::rule {
     'default_out-ospf':
       content => 'ip daddr { 224.0.0.5, 224.0.0.6 } meta l4proto ospf accept',
   }
diff --git a/manifests/rules/out/ospf3.pp b/manifests/rules/out/ospf3.pp
index ee5d9ba..a0e5a4e 100644
--- a/manifests/rules/out/ospf3.pp
+++ b/manifests/rules/out/ospf3.pp
@@ -1,6 +1,6 @@
 # manage out ospf3
 class nftables::rules::out::ospf3 {
-  nftables::rule{
+  nftables::rule {
     'default_out-ospf3':
       content => 'ip6 saddr fe80::/64 ip6 daddr { ff02::5, ff02::6 } meta l4proto ospf accept',
   }
diff --git a/manifests/rules/out/postgres.pp b/manifests/rules/out/postgres.pp
index 08fd880..4482253 100644
--- a/manifests/rules/out/postgres.pp
+++ b/manifests/rules/out/postgres.pp
@@ -1,6 +1,6 @@
 # manage out postgres
 class nftables::rules::out::postgres {
-  nftables::rule{
+  nftables::rule {
     'default_out-postgres':
       content => 'tcp dport 5432 accept';
   }
diff --git a/manifests/rules/out/puppet.pp b/manifests/rules/out/puppet.pp
index 79035e3..f078301 100644
--- a/manifests/rules/out/puppet.pp
+++ b/manifests/rules/out/puppet.pp
@@ -1,20 +1,20 @@
 # manage outgoing puppet
-class nftables::rules::out::puppet(
+class nftables::rules::out::puppet (
   Variant[String,Array[String,1]]
-    $puppetmaster,
+  $puppetmaster,
   Integer
-    $puppetserver_port = 8140,
+  $puppetserver_port = 8140,
 ) {
   any2array($puppetmaster).each |$index,$pm| {
-    nftables::rule{
+    nftables::rule {
       "default_out-puppet-${index}":
     }
     if $pm =~ /:/ {
-      Nftables::Rule["default_out-puppet-${index}"]{
+      Nftables::Rule["default_out-puppet-${index}"] {
         content => "ip6 daddr ${pm} tcp dport ${puppetserver_port} accept",
       }
     } else {
-      Nftables::Rule["default_out-puppet-${index}"]{
+      Nftables::Rule["default_out-puppet-${index}"] {
         content => "ip daddr ${pm} tcp dport ${puppetserver_port} accept",
       }
     }
diff --git a/manifests/rules/out/smtp.pp b/manifests/rules/out/smtp.pp
index 2988ef5..2b9a036 100644
--- a/manifests/rules/out/smtp.pp
+++ b/manifests/rules/out/smtp.pp
@@ -1,6 +1,6 @@
 # manage out smtp
 class nftables::rules::out::smtp {
-  nftables::rule{
+  nftables::rule {
     'default_out-smtp':
       content => 'tcp dport 25 accept',
   }
diff --git a/manifests/rules/out/ssh.pp b/manifests/rules/out/ssh.pp
index e5676d5..632b4b9 100644
--- a/manifests/rules/out/ssh.pp
+++ b/manifests/rules/out/ssh.pp
@@ -1,6 +1,6 @@
 # manage out ssh
 class nftables::rules::out::ssh {
-  nftables::rule{
+  nftables::rule {
     'default_out-ssh':
       content => 'tcp dport 22 accept',
   }
diff --git a/manifests/rules/out/ssh/remove.pp b/manifests/rules/out/ssh/remove.pp
index 2b5bc6f..35b22cc 100644
--- a/manifests/rules/out/ssh/remove.pp
+++ b/manifests/rules/out/ssh/remove.pp
@@ -1,6 +1,6 @@
 # disable outgoing ssh
 class nftables::rules::out::ssh::remove inherits nftables::rules::out::ssh {
-  Nftables::Rule['default_out-ssh']{
+  Nftables::Rule['default_out-ssh'] {
     ensure => absent,
   }
 }
diff --git a/manifests/rules/out/tor.pp b/manifests/rules/out/tor.pp
index 951f484..74be385 100644
--- a/manifests/rules/out/tor.pp
+++ b/manifests/rules/out/tor.pp
@@ -1,6 +1,6 @@
 # manage out tor
 class nftables::rules::out::tor {
-  nftables::rule{
+  nftables::rule {
     'default_out-tor':
       content => 'tcp dport 9001 accept',
   }
diff --git a/manifests/rules/out/wireguard.pp b/manifests/rules/out/wireguard.pp
index bc30bfb..075cfc5 100644
--- a/manifests/rules/out/wireguard.pp
+++ b/manifests/rules/out/wireguard.pp
@@ -1,9 +1,9 @@
 # manage out wireguard
 class nftables::rules::out::wireguard (
   Array[Integer,1]
-    $ports = [51820],
+  $ports = [51820],
 ) {
-  nftables::rule{
+  nftables::rule {
     'default_out-wireguard':
       content => "udp dport {${join($ports,', ')}} accept",
   }
diff --git a/manifests/rules/puppet.pp b/manifests/rules/puppet.pp
index 2829fa3..53a2bb1 100644
--- a/manifests/rules/puppet.pp
+++ b/manifests/rules/puppet.pp
@@ -1,9 +1,9 @@
 # manage in puppet
-class nftables::rules::puppet(
+class nftables::rules::puppet (
   Array[Integer,1]
-    $ports = [8140],
+  $ports = [8140],
 ) {
-  nftables::rule{
+  nftables::rule {
     'default_in-puppet':
       content => "tcp dport {${join($ports,', ')}} accept",
   }
diff --git a/manifests/rules/smtp.pp b/manifests/rules/smtp.pp
index 3088e3e..76ae429 100644
--- a/manifests/rules/smtp.pp
+++ b/manifests/rules/smtp.pp
@@ -1,6 +1,6 @@
 # manage in smtp
 class nftables::rules::smtp {
-  nftables::rule{
+  nftables::rule {
     'default_in-smtp':
       content => 'tcp dport 25 accept',
   }
diff --git a/manifests/rules/smtp_submission.pp b/manifests/rules/smtp_submission.pp
index c926030..5166e47 100644
--- a/manifests/rules/smtp_submission.pp
+++ b/manifests/rules/smtp_submission.pp
@@ -1,6 +1,6 @@
 # manage in smtp submission
 class nftables::rules::smtp_submission {
-  nftables::rule{
+  nftables::rule {
     'default_in-smtp_submission':
       content => 'tcp dport 587 accept',
   }
diff --git a/manifests/rules/smtps.pp b/manifests/rules/smtps.pp
index 291ae79..e653f9c 100644
--- a/manifests/rules/smtps.pp
+++ b/manifests/rules/smtps.pp
@@ -1,6 +1,6 @@
 # manage in smtps
 class nftables::rules::smtps {
-  nftables::rule{
+  nftables::rule {
     'default_in-smtps':
       content => 'tcp dport 465 accept',
   }
diff --git a/manifests/rules/snat4.pp b/manifests/rules/snat4.pp
index 3fc8501..565110e 100644
--- a/manifests/rules/snat4.pp
+++ b/manifests/rules/snat4.pp
@@ -1,25 +1,24 @@
 # manage a ipv4 snat rule
-define nftables::rules::snat4(
+define nftables::rules::snat4 (
   String[1]
-    $snat,
+  $snat,
   Pattern[/^[a-zA-Z0-9_]+$/]
-    $rulename = $title,
+  $rulename = $title,
   Pattern[/^\d\d$/]
-    $order = '70',
+  $order = '70',
   String[1]
-    $chain = 'POSTROUTING',
+  $chain = 'POSTROUTING',
   Optional[String[1]]
-    $oif = undef,
+  $oif = undef,
   Optional[String[1]]
-    $saddr = undef,
+  $saddr = undef,
   Optional[Enum['tcp','udp']]
-    $proto = undef,
+  $proto = undef,
   Optional[Variant[String,Integer[1,65535]]]
-    $dport = undef,
+  $dport = undef,
   Enum['present','absent']
-    $ensure = 'present',
+  $ensure = 'present',
 ) {
-
   $oifname = $oif ? {
     undef   => '',
     default => "oifname ${oif} ",
@@ -43,7 +42,7 @@ define nftables::rules::snat4(
     $port     = ''
   }
 
-  nftables::rule{
+  nftables::rule {
     "${chain}-${rulename}":
       ensure  => $ensure,
       table   => 'ip-nat',
diff --git a/manifests/rules/ssh.pp b/manifests/rules/ssh.pp
index 6659e76..878817c 100644
--- a/manifests/rules/ssh.pp
+++ b/manifests/rules/ssh.pp
@@ -1,9 +1,9 @@
 # manage in ssh
-class nftables::rules::ssh(
+class nftables::rules::ssh (
   Array[Integer,1]
-    $ports = [22],
+  $ports = [22],
 ) {
-  nftables::rule{
+  nftables::rule {
     'default_in-ssh':
       content => "tcp dport {${join($ports,', ')}} accept",
   }
diff --git a/manifests/rules/tor.pp b/manifests/rules/tor.pp
index 0f03129..c70c581 100644
--- a/manifests/rules/tor.pp
+++ b/manifests/rules/tor.pp
@@ -1,9 +1,9 @@
 # manage in tor
-class nftables::rules::tor(
+class nftables::rules::tor (
   Array[Integer,1]
-    $ports = [9001],
+  $ports = [9001],
 ) {
-  nftables::rule{
+  nftables::rule {
     'default_in-tor':
       content => "tcp dport {${join($ports,', ')}} accept",
   }
diff --git a/manifests/rules/wireguard.pp b/manifests/rules/wireguard.pp
index 3881099..780a8ce 100644
--- a/manifests/rules/wireguard.pp
+++ b/manifests/rules/wireguard.pp
@@ -1,9 +1,9 @@
 # manage in wireguard
-class nftables::rules::wireguard(
+class nftables::rules::wireguard (
   Array[Integer,1]
-    $ports = [51820],
+  $ports = [51820],
 ) {
-  nftables::rule{
+  nftables::rule {
     'default_in-wireguard':
       content => "udp dport {${join($ports,', ')}} accept",
   }
diff --git a/manifests/set.pp b/manifests/set.pp
index 6437b82..2bdbcc0 100644
--- a/manifests/set.pp
+++ b/manifests/set.pp
@@ -1,35 +1,34 @@
 # manage a named set
-define nftables::set(
+define nftables::set (
   Enum['present','absent']
-    $ensure = 'present',
+  $ensure = 'present',
   Pattern[/^[-a-zA-Z0-9_]+$/]
-    $setname = $title,
+  $setname = $title,
   Pattern[/^\d\d$/]
-    $order = '10',
+  $order = '10',
   Optional[Enum['ipv4_addr', 'ipv6_addr', 'ether_addr', 'inet_proto', 'inet_service', 'mark']]
-    $type = undef,
+  $type = undef,
   String
-    $table = 'inet-filter',
+  $table = 'inet-filter',
   Array[Enum['constant', 'dynamic', 'interval', 'timeout'], 0, 4]
-    $flags = [],
+  $flags = [],
   Optional[Integer]
-    $timeout = undef,
+  $timeout = undef,
   Optional[Integer]
-    $gc_interval = undef,
+  $gc_interval = undef,
   Optional[Array[String]]
-    $elements = undef,
+  $elements = undef,
   Optional[Integer]
-    $size = undef,
+  $size = undef,
   Optional[Enum['performance', 'memory']]
-    $policy = undef,
+  $policy = undef,
   Boolean
-    $auto_merge = false,
+  $auto_merge = false,
   Optional[String]
-    $content = undef,
+  $content = undef,
   Optional[Variant[String,Array[String,1]]]
-    $source = undef,
-){
-
+  $source = undef,
+) {
   if $size and $elements {
     if length($elements) > $size {
       fail("Max size of set ${setname} of ${size} is not being respected")
@@ -37,25 +36,25 @@ define nftables::set(
   }
 
   if $ensure == 'present' {
-    concat::fragment{
+    concat::fragment {
       "nftables-${table}-set-${setname}":
         order  => $order,
         target => "nftables-${table}",
     }
 
     if $content {
-      Concat::Fragment["nftables-${table}-set-${setname}"]{
+      Concat::Fragment["nftables-${table}-set-${setname}"] {
         content => "  ${content}",
       }
     } elsif $source {
-      Concat::Fragment["nftables-${table}-set-${setname}"]{
+      Concat::Fragment["nftables-${table}-set-${setname}"] {
         source => $source,
       }
     } else {
       if $type == undef {
         fail('The way the resource is configured must have a type set')
       }
-      Concat::Fragment["nftables-${table}-set-${setname}"]{
+      Concat::Fragment["nftables-${table}-set-${setname}"] {
         content => epp('nftables/set.epp',
           {
             'name'        => $setname,
