commit 771b32567c8da84bea7a2d1f7dca316a3e6bf535
Author: Nacho Barrientos <nacho.barrientos@cern.ch>
Date:   Mon Mar 15 14:59:17 2021 +0100

    Add rules for Apache ActiveMQ

diff --git a/REFERENCE.md b/REFERENCE.md
index 82f44d8..1fdbab0 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -10,6 +10,7 @@
 * [`nftables::bridges`](#nftablesbridges): allow forwarding traffic on bridges
 * [`nftables::inet_filter`](#nftablesinet_filter): manage basic chains in table inet filter
 * [`nftables::ip_nat`](#nftablesip_nat): manage basic chains in table ip nat
+* [`nftables::rules::activemq`](#nftablesrulesactivemq): Provides input rules for Apache ActiveMQ
 * [`nftables::rules::afs3_callback`](#nftablesrulesafs3_callback): Open call back port for AFS clients
 * [`nftables::rules::ceph`](#nftablesrulesceph): Ceph is a distributed object store and file system. Enable this to support Ceph's Object Storage Daemons (OSD), Metadata Server Daemons (MDS)
 * [`nftables::rules::ceph_mon`](#nftablesrulesceph_mon): Ceph is a distributed object store and file system.
@@ -333,6 +334,42 @@ manage basic chains in table inet filter
 
 manage basic chains in table ip nat
 
+### <a name="nftablesrulesactivemq"></a>`nftables::rules::activemq`
+
+Provides input rules for Apache ActiveMQ
+
+#### Parameters
+
+The following parameters are available in the `nftables::rules::activemq` class:
+
+* [`tcp`](#tcp)
+* [`udp`](#udp)
+* [`port`](#port)
+
+##### <a name="tcp"></a>`tcp`
+
+Data type: `Boolean`
+
+Create the rule for TCP traffic.
+
+Default value: ``true``
+
+##### <a name="udp"></a>`udp`
+
+Data type: `Boolean`
+
+Create the rule for UDP traffic.
+
+Default value: ``true``
+
+##### <a name="port"></a>`port`
+
+Data type: `Stdlib::Port`
+
+The port number for the ActiveMQ daemon.
+
+Default value: `61616`
+
 ### <a name="nftablesrulesafs3_callback"></a>`nftables::rules::afs3_callback`
 
 Open call back port for AFS clients
diff --git a/manifests/rules/activemq.pp b/manifests/rules/activemq.pp
new file mode 100644
index 0000000..bddc95d
--- /dev/null
+++ b/manifests/rules/activemq.pp
@@ -0,0 +1,29 @@
+# @summary Provides input rules for Apache ActiveMQ
+#
+# @param tcp
+#   Create the rule for TCP traffic.
+#
+# @param udp
+#   Create the rule for UDP traffic.
+#
+# @param port
+#   The port number for the ActiveMQ daemon.
+class nftables::rules::activemq (
+  Boolean $tcp = true,
+  Boolean $udp = true,
+  Stdlib::Port $port = 61616,
+) {
+  if $tcp {
+    nftables::rule {
+      'default_in-activemq_tcp':
+        content => "tcp dport ${port} accept",
+    }
+  }
+
+  if $udp {
+    nftables::rule {
+      'default_in-activemq_udp':
+        content => "udp dport ${port} accept",
+    }
+  }
+}
diff --git a/spec/acceptance/all_rules_spec.rb b/spec/acceptance/all_rules_spec.rb
index c476a26..b9f263f 100644
--- a/spec/acceptance/all_rules_spec.rb
+++ b/spec/acceptance/all_rules_spec.rb
@@ -37,6 +37,7 @@ describe 'nftables class' do
       include nftables::rules::smtp
       include nftables::rules::ceph
       include nftables::rules::samba
+      include nftables::rules::activemq
       include nftables::rules::out::postgres
       include nftables::rules::out::icmp
       include nftables::rules::out::dns
diff --git a/spec/classes/rules/activemq_spec.rb b/spec/classes/rules/activemq_spec.rb
new file mode 100644
index 0000000..a9c09b7
--- /dev/null
+++ b/spec/classes/rules/activemq_spec.rb
@@ -0,0 +1,39 @@
+require 'spec_helper'
+
+describe 'nftables::rules::activemq' do
+  on_supported_os.each do |os, os_facts|
+    context "on #{os}" do
+      let(:facts) { os_facts }
+
+      context 'default options' do
+        it { is_expected.to compile }
+        it { is_expected.to contain_nftables__rule('default_in-activemq_tcp').with_content('tcp dport 61616 accept') }
+        it { is_expected.to contain_nftables__rule('default_in-activemq_udp').with_content('udp dport 61616 accept') }
+      end
+
+      context 'with tcp set to false' do
+        let(:params) do
+          {
+            tcp: false,
+          }
+        end
+
+        it { is_expected.to compile }
+        it { is_expected.not_to contain_nftables__rule('default_in-activemq_tcp').with_content('tcp dport 61616 accept') }
+        it { is_expected.to contain_nftables__rule('default_in-activemq_udp').with_content('udp dport 61616 accept') }
+      end
+
+      context 'with udp set to false' do
+        let(:params) do
+          {
+            udp: false,
+          }
+        end
+
+        it { is_expected.to compile }
+        it { is_expected.to contain_nftables__rule('default_in-activemq_tcp').with_content('tcp dport 61616 accept') }
+        it { is_expected.not_to contain_nftables__rule('default_in-activemq_udp').with_content('udp dport 61616 accept') }
+      end
+    end
+  end
+end
