commit 8842a597f82f297a5f4a6f4e20efbf5bf614676b
Author: Tim Meusel <tim@bastelfreak.de>
Date:   Mon Jul 4 18:42:54 2022 +0200

    make path to `nft` binary configureable

diff --git a/REFERENCE.md b/REFERENCE.md
index 54582e1..efe929a 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -144,6 +144,7 @@ The following parameters are available in the `nftables` class:
 * [`noflush_tables`](#noflush_tables)
 * [`rules`](#rules)
 * [`configuration_path`](#configuration_path)
+* [`nft_path`](#nft_path)
 
 ##### <a name="out_all"></a>`out_all`
 
@@ -327,6 +328,12 @@ Data type: `Stdlib::Unixpath`
 The absolute path to the principal nftables configuration file. The default
 varies depending on the system, and is set in the module's data.
 
+##### <a name="nft_path"></a>`nft_path`
+
+Data type: `Stdlib::Unixpath`
+
+Path to the nft binary
+
 ### <a name="nftablesbridges"></a>`nftables::bridges`
 
 allow forwarding traffic on bridges
diff --git a/data/os/Archlinux.yaml b/data/os/Archlinux.yaml
index cde7617..4210ce4 100644
--- a/data/os/Archlinux.yaml
+++ b/data/os/Archlinux.yaml
@@ -4,3 +4,4 @@
 nftables::firewalld_enable: false
 
 nftables::configuration_path: /etc/nftables.conf
+nftables::nft_path: /usr/bin/nft
diff --git a/data/os/RedHat.yaml b/data/os/RedHat.yaml
new file mode 100644
index 0000000..442775e
--- /dev/null
+++ b/data/os/RedHat.yaml
@@ -0,0 +1,2 @@
+---
+nftables::nft_path: /usr/sbin/nft
diff --git a/manifests/init.pp b/manifests/init.pp
index fd79eaf..d63e791 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -90,6 +90,9 @@
 #   The absolute path to the principal nftables configuration file. The default
 #   varies depending on the system, and is set in the module's data.
 #
+# @param nft_path
+#   Path to the nft binary
+#
 class nftables (
   Boolean $in_ssh = true,
   Boolean $in_icmp = true,
@@ -112,6 +115,7 @@ class nftables (
   Variant[Boolean[false], Enum['mask']] $firewalld_enable = 'mask',
   Optional[Array[Pattern[/^(ip|ip6|inet)-[-a-zA-Z0-9_]+$/],1]] $noflush_tables = undef,
   Stdlib::Unixpath $configuration_path,
+  Stdlib::Unixpath $nft_path,
 ) {
   package { 'nftables':
     ensure => installed,
@@ -145,7 +149,7 @@ class nftables (
   } ~> exec {
     'nft validate':
       refreshonly => true,
-      command     => '/usr/sbin/nft -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft || ( /usr/bin/echo "#CONFIG BROKEN" >> /etc/nftables/puppet-preflight.nft && /bin/false)';
+      command     => "${nft_path} -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft || ( /usr/bin/echo '#CONFIG BROKEN' >> /etc/nftables/puppet-preflight.nft && /bin/false)";
   } -> file {
     default:
       owner => 'root',
@@ -177,6 +181,7 @@ class nftables (
     unit    => 'nftables.service',
     content => epp('nftables/systemd/puppet_nft.conf.epp', {
         'configuration_path' => $configuration_path,
+        'nft_path'           => $nft_path,
     }),
     notify  => Service['nftables'],
   }
diff --git a/spec/acceptance/all_rules_spec.rb b/spec/acceptance/all_rules_spec.rb
index 91eba9e..4fcef61 100644
--- a/spec/acceptance/all_rules_spec.rb
+++ b/spec/acceptance/all_rules_spec.rb
@@ -78,13 +78,13 @@ describe 'nftables class' do
         elements   => ['192.168.0.1', '10.0.0.2'],
         table      => ['inet-filter', 'ip-nat'],
       }
-      $config_path = case $facts['os']['family'] {
-        'Archlinux': {
-          '/etc/nftables.conf'
-        }
-        default: {
-          '/etc/sysconfig/nftables.conf'
-        }
+      $config_path = $facts['os']['family'] ? {
+        'Archlinux' => '/etc/nftables.conf',
+        default => '/etc/sysconfig/nftables.conf',
+      }
+      $nft_path = $facts['os']['family'] ? {
+        'Archlinux' => '/usr/bin/nft',
+        default => '/usr/sbin/nft',
       }
       # nftables cannot be started in docker so replace service with a validation only.
       systemd::dropin_file{"zzz_docker_nft.conf":
@@ -93,9 +93,9 @@ describe 'nftables class' do
         content => [
           "[Service]",
           "ExecStart=",
-          "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
           "ExecReload=",
-          "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
           "",
           ].join("\n"),
         notify  => Service["nftables"],
diff --git a/spec/acceptance/default_spec.rb b/spec/acceptance/default_spec.rb
index fac6da7..08ad2b2 100644
--- a/spec/acceptance/default_spec.rb
+++ b/spec/acceptance/default_spec.rb
@@ -11,13 +11,13 @@ describe 'nftables class' do
       class { 'nftables':
         firewalld_enable => false,
       }
-      $config_path = case $facts['os']['family'] {
-        'Archlinux': {
-          '/etc/nftables.conf'
-        }
-        default: {
-          '/etc/sysconfig/nftables.conf'
-        }
+      $config_path = $facts['os']['family'] ? {
+        'Archlinux' => '/etc/nftables.conf',
+        default => '/etc/sysconfig/nftables.conf',
+      }
+      $nft_path = $facts['os']['family'] ? {
+        'Archlinux' => '/usr/bin/nft',
+        default => '/usr/sbin/nft',
       }
       # nftables cannot be started in docker so replace service with a validation only.
       systemd::dropin_file{"zzz_docker_nft.conf":
@@ -26,9 +26,9 @@ describe 'nftables class' do
         content => [
           "[Service]",
           "ExecStart=",
-          "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
           "ExecReload=",
-          "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f ${config_path}",
           "",
           ].join("\n"),
         notify  => Service["nftables"],
@@ -66,13 +66,13 @@ describe 'nftables class' do
       nftables::rule{'default_out-junk':
         content => 'A load of junk',
       }
-      $config_path = case $facts['os']['family'] {
-        'Archlinux': {
-          '/etc/nftables.conf'
-        }
-        default: {
-          '/etc/sysconfig/nftables.conf'
-        }
+      $config_path = $facts['os']['family'] ? {
+        'Archlinux' => '/etc/nftables.conf',
+        default => '/etc/sysconfig/nftables.conf',
+      }
+      $nft_path = $facts['os']['family'] ? {
+        'Archlinux' => '/usr/bin/nft',
+        default => '/usr/sbin/nft',
       }
       # nftables cannot be started in docker so replace service with a validation only.
       systemd::dropin_file{"zzz_docker_nft.conf":
@@ -81,9 +81,9 @@ describe 'nftables class' do
         content => [
           "[Service]",
           "ExecStart=",
-          "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
           "ExecReload=",
-          "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
           "",
           ].join("\n"),
         notify  => Service["nftables"],
@@ -106,13 +106,13 @@ describe 'nftables class' do
         inet_filter => false,
         nat => false,
       }
-      $config_path = case $facts['os']['family'] {
-        'Archlinux': {
-          '/etc/nftables.conf'
-        }
-        default: {
-          '/etc/sysconfig/nftables.conf'
-        }
+      $config_path = $facts['os']['family'] ? {
+        'Archlinux' => '/etc/nftables.conf',
+        default => '/etc/sysconfig/nftables.conf',
+      }
+      $nft_path = $facts['os']['family'] ? {
+        'Archlinux' => '/usr/bin/nft',
+        default => '/usr/sbin/nft',
       }
       # nftables cannot be started in docker so replace service with a validation only.
       systemd::dropin_file{"zzz_docker_nft.conf":
@@ -121,9 +121,9 @@ describe 'nftables class' do
         content => [
           "[Service]",
           "ExecStart=",
-          "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
           "ExecReload=",
-          "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
           "",
           ].join("\n"),
         notify  => Service["nftables"],
@@ -146,13 +146,13 @@ describe 'nftables class' do
         nat => true,
         nat_table_name => 'mycustomtablename',
       }
-      $config_path = case $facts['os']['family'] {
-        'Archlinux': {
-          '/etc/nftables.conf'
-        }
-        default: {
-          '/etc/sysconfig/nftables.conf'
-        }
+      $config_path = $facts['os']['family'] ? {
+        'Archlinux' => '/etc/nftables.conf',
+        default => '/etc/sysconfig/nftables.conf',
+      }
+      $nft_path = $facts['os']['family'] ? {
+        'Archlinux' => '/usr/bin/nft',
+        default => '/usr/sbin/nft',
       }
       # nftables cannot be started in docker so replace service with a validation only.
       systemd::dropin_file{"zzz_docker_nft.conf":
@@ -161,9 +161,9 @@ describe 'nftables class' do
         content => [
           "[Service]",
           "ExecStart=",
-          "ExecStart=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecStart=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
           "ExecReload=",
-          "ExecReload=/sbin/nft -c -I /etc/nftables/puppet -f $config_path",
+          "ExecReload=${nft_path} -c -I /etc/nftables/puppet -f $config_path",
           "",
           ].join("\n"),
         notify  => Service["nftables"],
diff --git a/spec/classes/nftables_spec.rb b/spec/classes/nftables_spec.rb
index 52141e0..599e4c3 100644
--- a/spec/classes/nftables_spec.rb
+++ b/spec/classes/nftables_spec.rb
@@ -9,7 +9,14 @@ describe 'nftables' do
     context "on #{os}" do
       let(:facts) { os_facts }
 
-      it { is_expected.to compile }
+      nft_path = case os_facts[:os]['family']
+                 when 'Archlinux'
+                   '/usr/bin/nft'
+                 else
+                   '/usr/sbin/nft'
+                 end
+
+      it { is_expected.to compile.with_all_deps }
 
       it { is_expected.to contain_package('nftables') }
 
@@ -69,7 +76,7 @@ describe 'nftables' do
       it {
         expect(subject).to contain_exec('nft validate').with(
           refreshonly: true,
-          command: %r{^/usr/sbin/nft -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft.*}
+          command: %r{^#{nft_path} -I /etc/nftables/puppet-preflight -c -f /etc/nftables/puppet-preflight.nft.*}
         )
       }
 
@@ -85,7 +92,7 @@ describe 'nftables' do
       if os_facts[:os]['family'] == 'Archlinux'
         it {
           expect(subject).to contain_systemd__dropin_file('puppet_nft.conf').with(
-            content: %r{^ExecReload=/sbin/nft -I /etc/nftables/puppet -f /etc/nftables.conf$}
+            content: %r{^ExecReload=#{nft_path} -I /etc/nftables/puppet -f /etc/nftables.conf$}
           )
         }
 
@@ -98,7 +105,7 @@ describe 'nftables' do
       else
         it {
           expect(subject).to contain_systemd__dropin_file('puppet_nft.conf').with(
-            content: %r{^ExecReload=/sbin/nft -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf$}
+            content: %r{^ExecReload=#{nft_path} -I /etc/nftables/puppet -f /etc/sysconfig/nftables.conf$}
           )
         }
 
diff --git a/templates/systemd/puppet_nft.conf.epp b/templates/systemd/puppet_nft.conf.epp
index b975ab9..f02b517 100644
--- a/templates/systemd/puppet_nft.conf.epp
+++ b/templates/systemd/puppet_nft.conf.epp
@@ -1,7 +1,10 @@
+<%- | Stdlib::Unixpath $nft_path,
+      Stdlib::Unixpath $configuration_path,
+| -%>
 # Puppet Deployed
 [Service]
 RemainAfterExit=yes
 ExecStart=
-ExecStart=/sbin/nft -I /etc/nftables/puppet -f <%= $configuration_path %>
+ExecStart=<%= $nft_path %> -I /etc/nftables/puppet -f <%= $configuration_path %>
 ExecReload=
-ExecReload=/sbin/nft -I /etc/nftables/puppet -f <%= $configuration_path %>
+ExecReload=<%= $nft_path %> -I /etc/nftables/puppet -f <%= $configuration_path %>
