From db0ecf8394156e7eef82125bfa556dcf8b396b86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Romain=20Tarti=C3=A8re?= <romain@blogreen.org>
Date: Mon, 26 Dec 2022 08:43:07 -1000
Subject: [PATCH 1/2] Fix remaining legacy facts

Now that we can remove legacy facts from Puppet (`puppet config set
include_legacy_facts false`) we can use this to ensure the module behave
as expected.

While here, also remove artifacts from the Puppet 3.x era.
---
 manifests/config.pp  | 4 ++--
 manifests/init.pp    | 8 ++++----
 manifests/install.pp | 2 +-
 manifests/user.pp    | 2 +-
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/manifests/config.pp b/manifests/config.pp
index 664e40e..9325b64 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -10,7 +10,7 @@
     }
   }
 
-  if $::osfamily == 'FreeBSD' {
+  if fact('os.family') == 'FreeBSD' {
     file_line {
       default:
         path => '/etc/rc.conf',
@@ -83,7 +83,7 @@
     content => template('opendkim/etc/opendkim.conf.erb'),
   }
 
-  if $::osfamily == 'RedHat' {
+  if fact('os.family') == 'RedHat' {
     file {'/etc/tmpfiles.d/opendkim.conf':
       ensure  => present,
       owner   => 'root',
diff --git a/manifests/init.pp b/manifests/init.pp
index ba029a6..ab04f7d 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -53,10 +53,10 @@
 ) inherits opendkim::params {
 
   anchor { 'opendkim::begin': }
-  -> class { '::opendkim::user': }
-  -> class { '::opendkim::install': }
-  -> class { '::opendkim::config': }
-  ~> class { '::opendkim::service': }
+  -> class { 'opendkim::user': }
+  -> class { 'opendkim::install': }
+  -> class { 'opendkim::config': }
+  ~> class { 'opendkim::service': }
   -> anchor { 'opendkim::end': }
 
 }
diff --git a/manifests/install.pp b/manifests/install.pp
index c87cbe6..657b743 100644
--- a/manifests/install.pp
+++ b/manifests/install.pp
@@ -2,7 +2,7 @@
 
   package { 'opendkim':
     ensure => installed,
-    name   => $::opendkim::package_name,
+    name   => $opendkim::package_name,
   }
 
 }
diff --git a/manifests/user.pp b/manifests/user.pp
index 136ae87..cb4135b 100644
--- a/manifests/user.pp
+++ b/manifests/user.pp
@@ -12,7 +12,7 @@
     }
   }
 
-  $shelluser = $::osfamily ? {
+  $shelluser = fact('os.family') ? {
     'RedHat' => '/sbin/nologin',
     default  => '/usr/sbin/nologin',
   }

From 09252da67a242440585c84f52044a221b5276b32 Mon Sep 17 00:00:00 2001
From: cruelsmith <92088441+cruelsmith@users.noreply.github.com>
Date: Wed, 23 Aug 2023 10:19:40 +0200
Subject: [PATCH 2/2] Rework module to hiera and epp templates

* replace params with hiera layer usage
* replace erb templates with epp templates
* replace tmpfile.d with RuntimeDirectory in systemd service
* add rundir_mode parameter
* remove anchor usage
* remove inherits usage
* mark all classes upside from init as private
* add puppet strings
* set user as system user to use system user ids per default
* first package install and update the user itself
** to ensur proper uid / gid usage
---
 data/FreeBSD.yaml                             |   9 +
 data/RedHat.yaml                              |   3 +
 files/tmpfiles.d/opendkim.conf                |   2 -
 hiera.yaml                                    |  14 ++
 manifests/config.pp                           | 201 ++++++++++--------
 manifests/init.pp                             | 198 ++++++++++++-----
 manifests/install.pp                          |   7 +-
 manifests/params.pp                           |  67 ------
 manifests/service.pp                          |   7 +-
 manifests/user.pp                             |  73 ++-----
 metadata.json                                 | 128 ++++++-----
 templates/etc/KeyTable.epp                    |   8 +
 templates/etc/KeyTable.erb                    |   5 -
 templates/etc/SigningTable.epp                |   9 +
 templates/etc/SigningTable.erb                |   7 -
 .../{TrustedHosts.erb => TrustedHosts.epp}    |   8 +-
 .../{opendkim.conf.erb => opendkim.conf.epp}  | 140 +++++++-----
 templates/public-rsa-key.epp                  |  13 ++
 templates/public-rsa-key.erb                  |   7 -
 .../sysconfig/{opendkim.erb => opendkim.epp}  |  13 +-
 types/key.pp                                  |  10 +
 21 files changed, 512 insertions(+), 417 deletions(-)
 create mode 100644 data/FreeBSD.yaml
 create mode 100644 data/RedHat.yaml
 delete mode 100644 files/tmpfiles.d/opendkim.conf
 create mode 100644 hiera.yaml
 delete mode 100644 manifests/params.pp
 create mode 100644 templates/etc/KeyTable.epp
 delete mode 100644 templates/etc/KeyTable.erb
 create mode 100644 templates/etc/SigningTable.epp
 delete mode 100644 templates/etc/SigningTable.erb
 rename templates/etc/{TrustedHosts.erb => TrustedHosts.epp} (76%)
 rename templates/etc/{opendkim.conf.erb => opendkim.conf.epp} (51%)
 create mode 100644 templates/public-rsa-key.epp
 delete mode 100644 templates/public-rsa-key.erb
 rename templates/sysconfig/{opendkim.erb => opendkim.epp} (67%)
 create mode 100644 types/key.pp

diff --git a/data/FreeBSD.yaml b/data/FreeBSD.yaml
new file mode 100644
index 0000000..364b7e7
--- /dev/null
+++ b/data/FreeBSD.yaml
@@ -0,0 +1,9 @@
+---
+opendkim::user: 'mailnull'
+opendkim::group: 'mailnull'
+opendkim::service_name: 'milter-opendkim'
+opendkim::configfile: '/usr/local/etc/mail/opendkim.conf'
+opendkim::sysconfigfile: ~
+opendkim::configdir: '/usr/local/etc/mail/opendkim'
+opendkim::homedir: '/var/run/opendkim'
+opendkim::pidfile: '/var/run/opendkim/opendkim.pid'
diff --git a/data/RedHat.yaml b/data/RedHat.yaml
new file mode 100644
index 0000000..b6994e0
--- /dev/null
+++ b/data/RedHat.yaml
@@ -0,0 +1,3 @@
+---
+opendkim::sysconfigfile: '/etc/sysconfig/opendkim'
+opendkim::user_shell: '/sbin/nologin'
diff --git a/files/tmpfiles.d/opendkim.conf b/files/tmpfiles.d/opendkim.conf
deleted file mode 100644
index 5806655..0000000
--- a/files/tmpfiles.d/opendkim.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-# Managed by Puppet
-D /var/run/opendkim 0755 opendkim opendkim -
diff --git a/hiera.yaml b/hiera.yaml
new file mode 100644
index 0000000..218dcc6
--- /dev/null
+++ b/hiera.yaml
@@ -0,0 +1,14 @@
+---
+version: 5
+defaults:
+  datadir: 'data'
+  data_hash: 'yaml_data'
+hierarchy:
+  - name: 'Major Version'
+    path: '%{facts.os.name}-%{facts.os.release.major}.yaml'
+  - name: 'Distribution Name'
+    path: '%{facts.os.name}.yaml'
+  - name: 'OS Family Major Version'
+    path: '%{facts.os.family}-%{facts.os.release.major}.yaml'
+  - name: 'common'
+    path: 'common.yaml'
diff --git a/manifests/config.pp b/manifests/config.pp
index 9325b64..87f585f 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -1,12 +1,21 @@
-# Class opendkim::config
-class opendkim::config inherits opendkim {
+# @summary Configure opendkim
+#
+# @api private
+class opendkim::config {
+  assert_private()
+
   if $opendkim::sysconfigfile {
     file { $opendkim::sysconfigfile:
-      ensure  => 'file',
+      ensure  => file,
       owner   => 'root',
       group   => 'root',
       mode    => '0640',
-      content => template('opendkim/sysconfig/opendkim.erb'),
+      content => epp("${module_name}/sysconfig/opendkim.epp", {
+          'socket'     => $opendkim::socket,
+          'configfile' => $opendkim::configfile,
+          'configdir'  => $opendkim::configdir,
+          'pidfile'    => $opendkim::pidfile,
+      }),
     }
   }
 
@@ -26,24 +35,36 @@
     }
   }
 
-  $piddir = dirname($opendkim::pidfile )
-  file { $piddir:
-    ensure => 'directory',
-    owner  => $opendkim::user,
-    group  => $opendkim::group,
-    mode   => '0755',
-  }
+  $_piddir = dirname($opendkim::pidfile)
+  if fact('os.family') == 'RedHat' {
+    file_line { "${opendkim::service_name}.service RuntimeDirectory":
+      path  => "/usr/lib/systemd/system/${opendkim::service_name}.service",
+      line  => "RuntimeDirectory=${basename($_piddir)}",
+      match => '^RuntimeDirectory=',
+      after => '^Restart=',
+    }
+    -> file_line { "${opendkim::service_name}.service RuntimeDirectoryMode":
+      path  => "/usr/lib/systemd/system/${opendkim::service_name}.service",
+      line  => "RuntimeDirectoryMode=${opendkim::rundir_mode}",
+      match => '^RuntimeDirectoryMode=',
+      after => '^RuntimeDirectory=',
+    }
 
-  file { "${opendkim::configdir}/keys":
-    ensure => 'directory',
-    owner  => 'root',
-    group  => $opendkim::group,
-    mode   => '0640',
+    file { '/etc/tmpfiles.d/opendkim.conf':
+      ensure => absent,
+    }
+  } else {
+    file { $_piddir:
+      ensure => directory,
+      owner  => $opendkim::user,
+      group  => $opendkim::group,
+      mode   => $opendkim::rundir_mode,
+    }
   }
 
-  if !defined(File[$opendkim::homedir]) {
+  unless defined(File[$opendkim::homedir]) or $opendkim::homedir == $_piddir {
     file { $opendkim::homedir:
-      ensure => 'directory',
+      ensure => directory,
       owner  => $opendkim::user,
       group  => $opendkim::group,
       mode   => '0755',
@@ -51,7 +72,7 @@
   }
 
   file { $opendkim::configdir:
-    ensure  => 'directory',
+    ensure  => directory,
     recurse => true,
     purge   => true,
     owner   => 'root',
@@ -59,54 +80,64 @@
     mode    => '0640',
   }
 
-  if($opendkim::configdir != '/etc/opendkim') {
-    file { '/etc/opendkim':
-      ensure => 'absent',
-      force  => true,
-    }
+  file { "${opendkim::configdir}/keys":
+    ensure => directory,
+    owner  => 'root',
+    group  => $opendkim::group,
+    mode   => '0640',
   }
 
-  if($opendkim::configdir != '/etc/dkim') {
-    file { '/etc/dkim':
-      ensure => 'absent',
+  $_other_configdirs = ['/etc/opendkim', '/etc/dkim'] - $opendkim::configdir
+  $_other_configdirs.each |Stdlib::Absolutepath $_file| {
+    file { $_file:
+      ensure => absent,
       force  => true,
     }
   }
 
-
-  file { 'opendkim-conf':
+  file { $opendkim::configfile:
     ensure  => 'file',
-    path    => $opendkim::configfile,
     owner   => 'root',
     group   => $opendkim::group,
     mode    => '0640',
-    content => template('opendkim/etc/opendkim.conf.erb'),
-  }
-
-  if fact('os.family') == 'RedHat' {
-    file {'/etc/tmpfiles.d/opendkim.conf':
-      ensure  => present,
-      owner   => 'root',
-      group   => 'root',
-      mode    => '0644',
-      source  => 'puppet:///modules/opendkim/tmpfiles.d/opendkim.conf',
-    }
+    content => epp("${module_name}/etc/opendkim.conf.epp", {
+        'pidfile'              => $opendkim::pidfile,
+        'mode'                 => $opendkim::mode,
+        'log_why'              => $opendkim::log_why,
+        'user'                 => $opendkim::user,
+        'group'                => $opendkim::group,
+        'socket'               => $opendkim::socket,
+        'umask'                => $opendkim::umask,
+        'canonicalization'     => $opendkim::canonicalization,
+        'alldomain'            => $opendkim::alldomain,
+        'selector'             => $opendkim::selector,
+        'configdir'            => $opendkim::configdir,
+        'subdomains'           => $opendkim::subdomains,
+        'nameservers'          => $opendkim::nameservers,
+        'removeoldsignatures'  => $opendkim::removeoldsignatures,
+        'maximum_signed_bytes' => $opendkim::maximum_signed_bytes,
+        'trustanchorfile'      => $opendkim::trustanchorfile,
+        'senderheaders'        => $opendkim::senderheaders,
+        'signaturealgorithm'   => $opendkim::signaturealgorithm,
+        'minimumkeybits'       => $opendkim::minimumkeybits,
+        'additional_options'   => $opendkim::additional_options,
+    }),
   }
 
-  file { 'opendkim-TrustedHosts':
-    ensure  => 'file',
-    path    => "${opendkim::configdir}/TrustedHosts",
+  file { "${opendkim::configdir}/TrustedHosts":
+    ensure  => file,
     owner   => 'root',
     group   => $opendkim::group,
     mode    => '0640',
-    content => template('opendkim/etc/TrustedHosts.erb'),
+    content => epp("${module_name}/etc/TrustedHosts.epp", {
+        'trusted_hosts' => $opendkim::trusted_hosts,
+    }),
   }
 
   if $opendkim::alldomain {
-
-    if($opendkim::manage_private_keys == true) {
+    if $opendkim::manage_private_keys == true {
       file { "${opendkim::configdir}/keys/${opendkim::selector}":
-        ensure  => 'file',
+        ensure  => file,
         content => $opendkim::privatekey,
         owner   => 'root',
         group   => $opendkim::group,
@@ -114,56 +145,51 @@
       }
     }
 
-    $selector = $opendkim::selector
-    $domain = 'all'
-    $publickey = $opendkim::publickey
-
-    if ($opendkim::publickeyextended) {
-      $publickeyextended = $opendkim::publickeyextended
-    }
-
-    if ($opendkim::hash_algorithms) {
-      $hash_algorithms = $opendkim::hash_algorithms
-    }
-
     file { "${opendkim::configdir}/keys/${opendkim::selector}.txt":
       ensure  => 'file',
-      content => template('opendkim/public-rsa-key.erb'),
+      content => epp("${module_name}/public-rsa-key.epp", {
+          'selector'          => $opendkim::selector,
+          'domain'            => 'all',
+          'publickey'         => $opendkim::publickey,
+          'publickeyextended' => pick_default($opendkim::publickeyextended, undef),
+          'hash_algorithms'   => pick_default($opendkim::hash_algorithms, undef),
+      }),
       owner   => 'root',
       group   => $opendkim::group,
       mode    => '0640',
     }
-
   } else {
-
-    file { 'opendkim-SigningTable':
+    file { "${opendkim::configdir}/SigningTable":
       ensure  => 'file',
-      path    => "${opendkim::configdir}/SigningTable",
       owner   => 'root',
       group   => $opendkim::group,
       mode    => '0640',
-      content => template('opendkim/etc/SigningTable.erb'),
+      content => epp("${module_name}/etc/SigningTable.epp", {
+          'keys' => $opendkim::keys,
+      }),
     }
 
-    file { 'opendkim-KeyTable':
+    file { "${opendkim::configdir}/KeyTable":
       ensure  => 'file',
-      path    => "${opendkim::configdir}/KeyTable",
       owner   => 'root',
       group   => $opendkim::group,
       mode    => '0640',
-      content => template('opendkim/etc/KeyTable.erb'),
+      content => epp("${module_name}/etc/KeyTable.epp", {
+          'keys'      => $opendkim::keys,
+          'configdir' => $opendkim::configdir,
+      }),
     }
 
     $opendkim::keys.each |Hash $key| {
       ensure_resource('file', "${opendkim::configdir}/keys/${key['domain']}", {
-        ensure  => 'directory',
-        recurse => true,
-        owner   => 'root',
-        group   => $opendkim::group,
-        mode    => '0710',
+          ensure  => directory,
+          recurse => true,
+          owner   => 'root',
+          group   => $opendkim::group,
+          mode    => '0710',
       })
 
-      if($opendkim::manage_private_keys == true) {
+      if $opendkim::manage_private_keys == true {
         file { "${opendkim::configdir}/keys/${key['domain']}/${key['selector']}":
           ensure  => 'file',
           content => $key['privatekey'],
@@ -173,28 +199,19 @@
         }
       }
 
-      $selector = $key['selector']
-      $domain = $key['domain']
-      $publickey = $key['publickey']
-
-      if ($key['publickeyextended']) {
-        $publickeyextended = $key['publickeyextended']
-      }
-
-      if ($key['hash_algorithms']) {
-        $hash_algorithms = $key['hash_algorithms']
-      }
-
       file { "${opendkim::configdir}/keys/${key['domain']}/${key['selector']}.txt":
-        ensure  => 'file',
-        content => template('opendkim/public-rsa-key.erb'),
+        ensure  => file,
+        content => epp("${module_name}/public-rsa-key.epp", {
+            'selector'          => $key['selector'],
+            'domain'            => $key['domain'],
+            'publickey'         => $key['publickey'],
+            'publickeyextended' => $key.get('publickeyextended'),
+            'hash_algorithms'   => $key.get('hash_algorithms'),
+        }),
         owner   => 'root',
         group   => $opendkim::group,
         mode    => '0640',
       }
-
     }
-
   }
-
 }
diff --git a/manifests/init.pp b/manifests/init.pp
index ab04f7d..0336bc6 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,62 +1,152 @@
-# == Class: opendkim
+# @summary This class manages the opendkim service.
 #
-#This class manages the opendkim service.
+# @param user
+#   Name of the user running the service.
+# @param uid
+#   UserID from the user running the service.
+# @param user_shell
+#   Sets the login shell of user running the service.
+# @param user_system
+#   Switch if user should be use systemuser uid range or normal user uid range.
+# @param homedir
+#   Homedir of the user running the service.
+# @param group
+#   Name of the group running the service.
+#   Also also set as primary group of the user running the service.
+# @param gid
+#   GroupID from the group running the service.
+# @param group_system
+#   Switch if group should be use systemgroup gid range or normal group gid range.
+# @param configdir
+#   Directory where the configurations will be located.
+# @param configfile
+#   Path of the main config file.
+# @param pidfile
+#   Path of the process id file of the service.
+# @param rundir_mode
+#   Run directory permission of the service.
+# @param sysconfigfile
+#   Path of the sysconfig file.
+# @param package_name
+#   Name of the package providing opendkim.
+# @param service_name
+#   Name of the service
+# @param service_ensure
+#   Defines the state of the service.
+# @param service_enable
+#   Switch if service should boot at startup.
 #
-#Please see the README.md
-class opendkim(
-  String                    $user                 = $opendkim::params::user,
-  String                    $group                = $opendkim::params::group,
-  Integer[-1]               $uid                  = $opendkim::params::uid,
-  Integer[-1]               $gid                  = $opendkim::params::gid,
+# @param log_why
+#   If logging is enabled, issues very detailed logging about the logic behind the filter’s decision to either sign a message or verify it.
+# @param subdomains
+#   Sign subdomains of those listed by the Domain parameter as well as the actual domains.
+# @param socket
+#   The socket the service should listen on.
+# @param umask
+#   Requests a specific permissions mask to be used for file creation. This only really applies to creation of the socket when Socket
+#   specifies a UNIX domain socket, and to the PidFile.
+# @param nameservers
+#   List of IP addresses that are to be used when doing DNS queries to retrieve DKIM keys, VBR records, etc.
+# @param mode
+#   Selects operating modes. The string is a concatenation of characters that indicate which mode(s) of operation are desired.
+# @param canonicalization
+#   Selects the canonicalization method(s) to be used when signing messages. When verifying, the message’s DKIM-Signature: header field
+#   specifies the canonicalization method. The recognized values are relaxed and simple as defined by the DKIM specification. The value may
+#   include two different canonicalizations separated by a slash ("/") character, in which case the first will be applied to the header and
+#   the second to the body.
+# @param removeoldsignatures
+#   Removes all existing signatures when operating in signing mode.
+# @param maximum_signed_bytes
+#   Specifies the maximum number of bytes of message body to be signed. Messages shorter than this limit will be signed in their entirety.
+# @param trustanchorfile
+#   Specifies a file from which trust anchor data should be read when doing DNS queries and applying the DNSSEC protocol.
+# @param senderheaders
+#   Specifies an ordered list of header fields that should be searched to determine the sender of a message. The first header field found
+#   is the one whose value is used. This is mainly used when signing for deciding which signing request(s) to make.
+# @param signaturealgorithm
+#   Selects the signing algorithm to use when generating signatures.
+# @param minimumkeybits
+#   Establishes a minimum key size for acceptable signatures. Signatures with smaller key sizes, even if they otherwise pass DKIM
+#   validation, will me marked as invalid.
+# @param additional_options
+#   These options will be also written into the opendkim config file
+#
+# @param trusted_hosts
+#   Hosts that may send mail through the server as one of the signing domains without credentials and whose mail should be signed rather
+#   than verified.
+# @param manage_private_keys
+#   Switch for the mangement of the private key files.
+# @param keys
+#   Structure of the keys to manage and to generate the configure from.
+#
+# @param alldomain
+#   Switch for an alternative mangement mode that only configures one key that will be used to sign all domains.
+# @param selector
+#   The selector used for signing in alldomain mode.
+# @param publickey
+#   The publickey used for signing in alldomain mode.
+# @param publickeyextended
+#   The publickeyextended used for signing in alldomain mode.
+# @param privatekey
+#   The privatekey used for signing in alldomain mode.
+# @param hash_algorithms
+#   The hash_algorithms used for signing in alldomain mode.
+#
+# @see Please see the README.md
+class opendkim (
+  String[1]                       $user                 = 'opendkim',
+  Optional[Integer[0]]            $uid                  = undef,
+  Stdlib::Absolutepath            $user_shell           = '/usr/sbin/nologin',
+  Boolean                         $user_system          = true,
+  Stdlib::Absolutepath            $homedir              = '/run/opendkim',
+  String[1]                       $group                = 'opendkim',
+  Optional[Integer[0]]            $gid                  = undef,
+  Boolean                         $group_system         = true,
+
+  Stdlib::Absolutepath            $configdir            = '/etc/opendkim',
+  Stdlib::Absolutepath            $configfile           = '/etc/opendkim.conf',
+  Stdlib::Absolutepath            $pidfile              = '/run/opendkim/opendkim.pid',
+  Pattern[/\A[0-7]{3,4}\z/]       $rundir_mode          = '0755',
+  Optional[Stdlib::Absolutepath]  $sysconfigfile        = '/etc/sysconfig/opendkim', # lint:ignore:optional_default
+  String[1]                       $package_name         = 'opendkim',
+  String[1]                       $service_name         = 'opendkim',
+  Stdlib::Ensure::Service         $service_ensure       = 'running',
+  Boolean                         $service_enable       = true,
 
-  Stdlib::Absolutepath      $homedir              = $opendkim::params::homedir,
-  Stdlib::Absolutepath      $configdir            = $opendkim::params::configdir,
-  Stdlib::Absolutepath      $configfile           = $opendkim::params::configfile,
-  Stdlib::Absolutepath      $pidfile              = $opendkim::params::pidfile,
-  Optional[Stdlib::Absolutepath] $sysconfigfile   = $opendkim::params::sysconfigfile,
-  String                    $package_name         = $opendkim::params::package_name,
-  String                    $log_why              = $opendkim::params::log_why,
-  String                    $subdomains           = $opendkim::params::subdomains,
-  String                    $socket               = $opendkim::params::socket,
-  String                    $umask                = $opendkim::params::umask,
-  Optional[String]          $nameservers          = $opendkim::params::nameservers,
-  Array[String]             $trusted_hosts        = $opendkim::params::trusted_hosts,
-  String                    $mode                 = $opendkim::params::mode,
-  String                    $canonicalization     = $opendkim::params::canonicalization,
-  String                    $removeoldsignatures  = $opendkim::params::removeoldsignatures,
-  Optional[Integer]         $maximum_signed_bytes = $opendkim::params::maximum_signed_bytes,
-  Optional[String]          $trustanchorfile      = $opendkim::params::trustanchorfile,
-  Optional[Array]           $senderheaders        = $opendkim::params::senderheaders,
-  Boolean                   $manage_private_keys  = $opendkim::params::manage_private_keys,
-  Boolean                   $alldomain            = $opendkim::params::alldomain,
-  Optional[String]          $selector             = $opendkim::params::selector,
-  Optional[String]          $publickey            = $opendkim::params::publickey,
-  Optional[String]          $publickeyextended    = $opendkim::params::publickeyextended,
-  Optional[String]          $privatekey           = $opendkim::params::privatekey,
-  Optional[String]          $hash_algorithms      = $opendkim::params::hash_algorithms,
-  Optional[String]          $signaturealgorithm   = $opendkim::params::signaturealgorithm,
-  Optional[Integer]         $minimumkeybits       = $opendkim::params::minimumkeybits,
+  Variant[Boolean,Enum['yes','no']]                $log_why              = 'no',
+  Variant[Boolean,Enum['yes','no']]                $subdomains           = 'yes',
+  String                          $socket               = 'inet:8891@127.0.0.1',
+  Pattern[/\A[0-7]{3,4}\z/]       $umask                = '0022',
+  Array[Stdlib::IP::Address]      $nameservers          = [],
+  Pattern[/\A[sv]{1,2}\z/]        $mode                 = 'sv',
+  Pattern[/\A((relaxed|simple)\/)?(relaxed|simple)\z/] $canonicalization = 'relaxed/simple',
+  Variant[Boolean,Enum['yes','no']]                $removeoldsignatures  = 'no',
+  Optional[Integer[1]]            $maximum_signed_bytes = undef,
+  Optional[Stdlib::Absolutepath]  $trustanchorfile      = undef,
+  Optional[Array[String,1]]       $senderheaders        = undef,
 
-  Array[Struct[{
-    domain            => String,
-    selector          => String,
-    hash_algorithms   => Optional[String],
-    publickey         => String,
-    publickeyextended => Optional[String],
-    privatekey        => Variant[String,Deferred],
-    signingdomains    => Array[String],
-  }]]                       $keys                 = $opendkim::params::keys,
+  Optional[String[1]]             $signaturealgorithm   = undef,
+  Optional[Integer[1]]            $minimumkeybits       = undef,
+  Hash[String,Variant[Array[String],String,Integer,Boolean]]             $additional_options   = {},
 
-  Enum['running','stopped'] $service_ensure       = $opendkim::params::service_ensure,
-  Boolean                   $service_enable       = $opendkim::params::service_enable,
-  String                    $service_name         = $opendkim::params::service_name,
-) inherits opendkim::params {
+  Array[String,1]                 $trusted_hosts        = ['::1', '127.0.0.1', 'localhost'],
+  Boolean                         $manage_private_keys  = true,
+  Array[Opendkim::Key]            $keys                 = [],
 
-  anchor { 'opendkim::begin': }
-  -> class { 'opendkim::user': }
-  -> class { 'opendkim::install': }
-  -> class { 'opendkim::config': }
-  ~> class { 'opendkim::service': }
-  -> anchor { 'opendkim::end': }
+  Boolean                         $alldomain            = false,
+  Optional[String[1]]             $selector             = undef,
+  Optional[String[1]]             $publickey            = undef,
+  Optional[String[1]]             $publickeyextended    = undef,
+  Optional[String[1]]             $privatekey           = undef,
+  Optional[String[1]]             $hash_algorithms      = undef,
+) {
+  contain opendkim::install
+  contain opendkim::user
+  contain opendkim::config
+  contain opendkim::service
 
+  Class['opendkim::install']
+  -> Class['opendkim::user']
+  -> Class['opendkim::config']
+  ~> Class['opendkim::service']
 }
diff --git a/manifests/install.pp b/manifests/install.pp
index 657b743..97b8eef 100644
--- a/manifests/install.pp
+++ b/manifests/install.pp
@@ -1,8 +1,11 @@
-class opendkim::install inherits opendkim {
+# @summary Managing the opendkim installation
+#
+# @api private
+class opendkim::install {
+  assert_private()
 
   package { 'opendkim':
     ensure => installed,
     name   => $opendkim::package_name,
   }
-
 }
diff --git a/manifests/params.pp b/manifests/params.pp
deleted file mode 100644
index 9754baa..0000000
--- a/manifests/params.pp
+++ /dev/null
@@ -1,67 +0,0 @@
-class opendkim::params {
-  $uid = -1
-  $gid = -1
-
-  $pidfile = '/var/run/opendkim/opendkim.pid'
-  $homedir = '/var/run/opendkim'
-  $mode = 'sv'
-
-  $package_name = 'opendkim'
-
-  $log_why = 'no'
-  $canonicalization = 'relaxed/simple'
-  $subdomains = 'yes'
-  $socket = 'inet:8891@127.0.0.1'
-  $umask = '0022'
-  $trusted_hosts = ['::1', '127.0.0.1', 'localhost']
-  $maximum_signed_bytes = undef
-  $trustanchorfile  = undef
-  $senderheaders = undef
-  $manage_private_keys = true
-  $alldomain = false
-  $selector = undef
-  $publickey = undef
-  $publickeyextended = undef
-  $privatekey = undef
-  $hash_algorithms = undef
-  $signaturealgorithm = undef
-  $minimumkeybits = undef
-
-  $keys = []
-  $nameservers       = undef
-
-  $removeoldsignatures = 'no'
-
-  $service_enable    = true
-  $service_ensure    = 'running'
-
-  case fact('os.family') {
-    'Debian': {
-      $user             = 'opendkim'
-      $group            = 'opendkim'
-      $service_name     = 'opendkim'
-      $configfile       = '/etc/opendkim.conf'
-      $sysconfigfile    = '/etc/default/opendkim'
-      $configdir        = '/etc/opendkim'
-    }
-    'FreeBSD': {
-      $user             = 'mailnull'
-      $group            = 'mailnull'
-      $service_name     = 'milter-opendkim'
-      $configfile       = '/usr/local/etc/mail/opendkim.conf'
-      $sysconfigfile    = undef
-      $configdir        = '/usr/local/etc/mail/opendkim'
-    }
-    'Redhat': {
-      $user             = 'opendkim'
-      $group            = 'opendkim'
-      $service_name     = 'opendkim'
-      $configfile       = '/etc/opendkim.conf'
-      $sysconfigfile    = '/etc/sysconfig/opendkim'
-      $configdir        = '/etc/opendkim'
-    }
-    default: {
-      fail("${fact('os.family')} is not supported by this module.")
-    }
-  }
-}
diff --git a/manifests/service.pp b/manifests/service.pp
index ac982a5..365a344 100644
--- a/manifests/service.pp
+++ b/manifests/service.pp
@@ -1,4 +1,9 @@
-class opendkim::service inherits opendkim {
+# @summary Managing the opendkim service
+#
+# @api private
+class opendkim::service {
+  assert_private()
+
   service { 'opendkim':
     ensure     => $opendkim::service_ensure,
     enable     => $opendkim::service_enable,
diff --git a/manifests/user.pp b/manifests/user.pp
index cb4135b..282b612 100644
--- a/manifests/user.pp
+++ b/manifests/user.pp
@@ -1,59 +1,24 @@
-class opendkim::user inherits opendkim {
-  if $opendkim::gid > -1 {
-    group { 'opendkim':
-      ensure => 'present',
-      name   => $opendkim::group,
-      gid    => $opendkim::gid,
-    }
-  } else {
-    group { 'opendkim':
-      ensure => 'present',
-      name   => $opendkim::group,
-    }
-  }
+# @summary Managing the opendkim user
+#
+# @api private
+class opendkim::user {
+  assert_private()
 
-  $shelluser = fact('os.family') ? {
-    'RedHat' => '/sbin/nologin',
-    default  => '/usr/sbin/nologin',
+  group { 'opendkim':
+    ensure => present,
+    name   => $opendkim::group,
+    gid    => $opendkim::gid,
+    system => $opendkim::group_system,
   }
 
-  if $opendkim::uid > -1 and $opendkim::gid > -1 {
-    user { 'opendkim':
-      ensure   => 'present',
-      name     => $opendkim::user,
-      gid      => $opendkim::gid,
-      home     => $opendkim::homedir,
-      password => '!!',
-      shell    => $shelluser,
-      uid      => $opendkim::uid,
-    }
-  } elsif $opendkim::uid > -1 {
-    user { 'opendkim':
-      ensure   => 'present',
-      name     => $opendkim::user,
-      home     => $opendkim::homedir,
-      password => '!!',
-      shell    => $shelluser,
-      uid      => $opendkim::uid,
-    }
-
-  } elsif $opendkim::gid > -1 {
-    user { 'opendkim':
-      ensure   => 'present',
-      name     => $opendkim::user,
-      gid      => $opendkim::gid,
-      home     => $opendkim::homedir,
-      password => '!!',
-      shell    => $shelluser,
-    }
-
-  } else {
-    user { 'opendkim':
-      ensure   => 'present',
-      name     => $opendkim::user,
-      home     => $opendkim::homedir,
-      password => '!!',
-      shell    => $shelluser,
-    }
+  user { 'opendkim':
+    ensure   => present,
+    gid      => $opendkim::gid,
+    home     => $opendkim::homedir,
+    name     => $opendkim::user,
+    password => '!!',
+    shell    => $opendkim::user_shell,
+    system   => $opendkim::user_system,
+    uid      => $opendkim::uid,
   }
 }
diff --git a/metadata.json b/metadata.json
index e9c68a4..ccb819b 100644
--- a/metadata.json
+++ b/metadata.json
@@ -1,68 +1,64 @@
 {
-    "name": "lvicainne-opendkim",
-    "version": "0.3.0",
-    "author": "lvicainne",
-    "license": "Apache-2.0",
-    "summary": "Manage an OpenDKIM configuration",
-    "description": "Manage OpenDKIM installation and configuration with Puppet.",
-    "source": "https://github.com/lvicainne/puppet-opendkim",
-    "project_page": "http://github.com/lvicainne/puppet-opendkim",
-    "issues_url": "https://github.com/lvicainne/puppet-opendkim/issues",
-    "tags": ["dkim", "opendkim", "mail", "smtp"],
-    "operatingsystem_support": [
-        {
-            "operatingsystem": "RedHat",
-            "operatingsystemrelease": [
-                "5",
-                "6",
-                "7",
-                "8",
-                "9"
-            ]
-        },
-        {
-            "operatingsystem": "CentOS",
-            "operatingsystemrelease": [
-                "5",
-                "6",
-                "7",
-                "8",
-                "9"
-            ]
-        },
-        {
-            "operatingsystem": "Debian",
-            "operatingsystemrelease": [
-                "6",
-                "7",
-                "8",
-                "9"
-            ]
-        },
-        {
-            "operatingsystem": "Ubuntu",
-            "operatingsystemrelease": [
-                "16.04"
-            ]
-        },
-        {
-            "operatingsystem": "FreeBSD",
-            "operatingsystemrelease": [
-                "11",
-                "12"
-            ]
-        }
-    ],
-    "dependencies": [
-        {
-            "name": "puppetlabs/stdlib",
-            "version_requirement": ">= 4.13.0 < 9.0.0"
-        }
-    ],
-    "requirements": [
-        {
-            "name": "puppet",
-            "version_requirement": ">= 4.8.0 < 7.0.0"
-        }
-    ]
+  "name": "lvicainne-opendkim",
+  "version": "0.3.0",
+  "author": "lvicainne",
+  "license": "Apache-2.0",
+  "summary": "Manage an OpenDKIM configuration",
+  "source": "https://github.com/lvicainne/puppet-opendkim",
+  "project_page": "http://github.com/lvicainne/puppet-opendkim",
+  "issues_url": "https://github.com/lvicainne/puppet-opendkim/issues",
+  "tags": ["dkim", "opendkim", "mail", "smtp"],
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "RedHat",
+      "operatingsystemrelease": [
+        "7",
+        "8",
+        "9"
+      ]
+    },
+    {
+      "operatingsystem": "CentOS",
+      "operatingsystemrelease": [
+        "7",
+        "8",
+        "9"
+      ]
+    },
+    {
+      "operatingsystem": "Debian",
+      "operatingsystemrelease": [
+        "9",
+        "10",
+        "11"
+      ]
+    },
+    {
+      "operatingsystem": "Ubuntu",
+      "operatingsystemrelease": [
+        "18.04",
+        "20.04",
+        "22.04"
+      ]
+    },
+    {
+      "operatingsystem": "FreeBSD",
+      "operatingsystemrelease": [
+        "12",
+        "13"
+      ]
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "puppetlabs/stdlib",
+      "version_requirement": ">= 4.13.0 < 10.0.0"
+    }
+  ],
+  "requirements": [
+    {
+      "name": "puppet",
+      "version_requirement": ">= 6.24.0 < 8.0.0"
+    }
+  ]
 }
diff --git a/templates/etc/KeyTable.epp b/templates/etc/KeyTable.epp
new file mode 100644
index 0000000..dc10d37
--- /dev/null
+++ b/templates/etc/KeyTable.epp
@@ -0,0 +1,8 @@
+<%- | Array[Opendkim::Key] $keys,
+      Stdlib::Absolutepath $configdir
+| -%>
+# THIS FILE IS MANAGED BY PUPPET
+
+<% $keys.each |$_key| { -%>
+<%= $_key['selector'] %>._domainkey.<%= $_key['domain'] %> <%= $_key['domain'] %>:<%= $_key['selector'] %>:<%= $configdir %>/keys/<%= $_key['domain'] %>/<%= $_key['selector'] %>
+<% } -%>
diff --git a/templates/etc/KeyTable.erb b/templates/etc/KeyTable.erb
deleted file mode 100644
index eafd1bc..0000000
--- a/templates/etc/KeyTable.erb
+++ /dev/null
@@ -1,5 +0,0 @@
-# THIS FILE IS MANAGED BY PUPPET
-
-<% @keys.each do |mykey| -%>
-<%= mykey['selector'] %>._domainkey.<%= mykey['domain'] %> <%= mykey['domain'] %>:<%= mykey['selector'] %>:<%= @configdir %>/keys/<%= mykey['domain'] %>/<%= mykey['selector'] %>
-<% end -%>
diff --git a/templates/etc/SigningTable.epp b/templates/etc/SigningTable.epp
new file mode 100644
index 0000000..5fb8a43
--- /dev/null
+++ b/templates/etc/SigningTable.epp
@@ -0,0 +1,9 @@
+<%- | Array[Opendkim::Key] $keys
+| -%>
+# THIS FILE IS MANAGED BY PUPPET
+
+<% $keys.each |$_key| { -%>
+<% $_key['signingdomains'].each |$_signingdomain| { -%>
+<%= $_signingdomain %> <%= $_key['selector'] %>._domainkey.<%= $_key['domain'] %>
+<% } -%>
+<% } -%>
diff --git a/templates/etc/SigningTable.erb b/templates/etc/SigningTable.erb
deleted file mode 100644
index 38703c9..0000000
--- a/templates/etc/SigningTable.erb
+++ /dev/null
@@ -1,7 +0,0 @@
-# THIS FILE IS MANAGED BY PUPPET
-
-<% @keys.each do |mykey| -%>
-<% mykey['signingdomains'].each do |signingdomain| -%>
-<%= signingdomain %> <%= mykey['selector'] %>._domainkey.<%= mykey['domain'] %>
-<% end -%>
-<% end -%>
diff --git a/templates/etc/TrustedHosts.erb b/templates/etc/TrustedHosts.epp
similarity index 76%
rename from templates/etc/TrustedHosts.erb
rename to templates/etc/TrustedHosts.epp
index 53a168d..64b1167 100644
--- a/templates/etc/TrustedHosts.erb
+++ b/templates/etc/TrustedHosts.epp
@@ -1,3 +1,5 @@
+<%- | Array[String,1] $trusted_hosts
+| -%>
 # THIS FILE IS MANAGED BY PUPPET
 
 # To use this file, uncomment the #ExternalIgnoreList and/or the #InternalHosts
@@ -5,6 +7,6 @@
 # may be added on separate lines (IP addresses, hostnames, or CIDR ranges).
 # The localhost IP (127.0.0.1) should always be the first entry in this file.
 
-<% @trusted_hosts.each do |host| -%>
-<%= host %>
-<% end -%>
+<% $trusted_hosts.each |$_host| { -%>
+<%= $_host %>
+<% } -%>
diff --git a/templates/etc/opendkim.conf.erb b/templates/etc/opendkim.conf.epp
similarity index 51%
rename from templates/etc/opendkim.conf.erb
rename to templates/etc/opendkim.conf.epp
index 2d4f73c..5aa7358 100644
--- a/templates/etc/opendkim.conf.erb
+++ b/templates/etc/opendkim.conf.epp
@@ -1,10 +1,31 @@
+<%- | Stdlib::Absolutepath $pidfile,
+      String $mode,
+      Variant[Boolean,Enum['yes','no']] $log_why,
+      String[1] $user,
+      String[1] $group,
+      String $socket,
+      Pattern[/\A[0-7]{3,4}\z/] $umask,
+      String $canonicalization,
+      Boolean $alldomain,
+      Optional[String[1]] $selector,
+      Stdlib::Absolutepath $configdir,
+      Variant[Boolean,Enum['yes','no']] $subdomains,
+      Array[Stdlib::IP::Address] $nameservers,
+      Variant[Boolean,Enum['yes','no']] $removeoldsignatures,
+      Optional[Integer] $maximum_signed_bytes,
+      Optional[Stdlib::Absolutepath] $trustanchorfile,
+      Optional[Array[String,1]] $senderheaders,
+      Optional[String[1]] $signaturealgorithm,
+      Optional[Integer[1]] $minimumkeybits,
+      Hash[String,Variant[Array[String],String,Integer,Boolean]] $additional_options
+| -%>
 # THIS FILE IS MANAGED BY PUPPET
 
 # Specifies the path to the process ID file.
-PidFile <%= @pidfile %>
+PidFile <%= $pidfile %>
 
 # Selects operating modes. Valid modes are s (signer) and v (verifier). Default is v.
-Mode <%= @mode %>
+Mode <%= $mode %>
 
 # Log activity to the system log.
 Syslog  yes
@@ -15,17 +36,17 @@ SyslogSuccess yes
 # If logging is enabled, include detailed logging about why or why not a message was
 # signed or verified. This causes a large increase in the amount of log data generated
 # for each message, so it should be limited to debugging use only.
-LogWhy <%= @log_why %>
+LogWhy <%= $log_why ? { true => 'yes', false => 'no', default => $log_why } %>
 
 # Attempt to become the specified user before starting operations.
-UserID  <%= @user %>:<%= @group %>
+UserID  <%= $user %>:<%= $group %>
 
 # Create a socket through which your MTA can communicate.
-Socket  <%= @socket %>
+Socket  <%= $socket %>
 
 # Required to use local socket with MTAs that access the socket as a non-
 # privileged user (e.g. Postfix)
-Umask   <%= @umask %>
+Umask   <%= $umask %>
 
 # This specifies a file in which to store DKIM transaction statistics.
 #Statistics              /var/spool/opendkim/stats.dat
@@ -33,55 +54,55 @@ Umask   <%= @umask %>
 ## SIGNING OPTIONS
 
 # Selects the canonicalization method(s) to be used when signing messages.
-Canonicalization        <%= @canonicalization %>
+Canonicalization        <%= $canonicalization %>
 
 # Domain(s) whose mail should be signed by this filter. Mail from other domains will
 # be verified rather than being signed. Uncomment and use your domain name.
 # This parameter is not required if a SigningTable is in use.
-<% if @alldomain -%>
+<% if $alldomain { -%>
 Domain *
-<% else -%>
+<% } else { -%>
 #Domain                  test.fr
-<% end -%>
+<% } -%>
 
 # Defines the name of the selector to be used when signing messages.
-<% if @alldomain -%>
-Selector                <%= @selector %>
-<% else -%>
+<% if $alldomain { -%>
+Selector                <%= $selector %>
+<% } else { -%>
 #Selector                default
-<% end -%>
+<% } -%>
 
 # Gives the location of a private key to be used for signing ALL messages.
-<% if @alldomain -%>
-KeyFile                 <%= @configdir %>/keys/<%= @selector %>
-<% else -%>
+<% if $alldomain { -%>
+KeyFile                 <%= $configdir %>/keys/<%= $selector %>
+<% } else { -%>
 #KeyFile                 /etc/opendkim/keys/default.private
-<% end -%>
+<% } -%>
 
 # Gives the location of a file mapping key names to signing keys. In simple terms,
 # this tells OpenDKIM where to find your keys. If present, overrides any KeyFile
 # setting in the configuration file.
-<% if @alldomain -%>
+<% if $alldomain { -%>
 #KeyTable                /etc/opendkim/KeyTable
-<% else -%>
-KeyTable                refile:<%= @configdir %>/KeyTable
-<% end -%>
+<% } else { -%>
+KeyTable                refile:<%= $configdir %>/KeyTable
+<% } -%>
 
 # Defines a table used to select one or more signatures to apply to a message based
 # on the address found in the From: header field. In simple terms, this tells
 # OpenDKIM how to use your keys.
-<% if @alldomain -%>
+<% if $alldomain { -%>
 #SigningTable            refile:/etc/opendkim/SigningTable
-<% else -%>
-SigningTable            refile:<%= @configdir %>/SigningTable
-<% end -%>
+<% } else { -%>
+SigningTable            refile:<%= $configdir %>/SigningTable
+<% } -%>
 
 # Identifies a set of "external" hosts that may send mail through the server as one
 # of the signing domains without credentials as such.
-ExternalIgnoreList      refile:<%= @configdir %>/TrustedHosts
+ExternalIgnoreList      refile:<%= $configdir %>/TrustedHosts
 
 # Identifies a set internal hosts whose mail should be signed rather than verified.
-InternalHosts           refile:<%= @configdir %>/TrustedHosts
+InternalHosts           refile:<%= $configdir %>/TrustedHosts
 
 # Contains a list of IP addresses, CIDR blocks, hostnames or domain names
 # whose mail should be neither signed nor verified by this filter.  See man
@@ -95,37 +116,50 @@ InternalHosts           refile:<%= @configdir %>/TrustedHosts
 # somewhat security sensitive.
 OversignHeaders         From
 
-SubDomains             <%= @subdomains %>
+SubDomains             <%= $subdomains ? { true => 'yes', false => 'no', default => $subdomains } %>
 
-<% if @nameservers -%>
-Nameservers            <%= @nameservers %>
-<% end -%>
+<% unless $nameservers.empty { -%>
+Nameservers            <%= $nameservers.join(',') %>
+<% } -%>
 
 # Removes all existing signatures when operating in signing mode.
-RemoveOldSignatures    <%= @removeoldsignatures %>
+RemoveOldSignatures    <%= $removeoldsignatures ? { true => 'yes', false => 'no', default => $removeoldsignatures } %>
 
-<% if @maximum_signed_bytes -%>
+<% unless $maximum_signed_bytes.empty { -%>
 ##  MaximumSignedBytes n
 ##
 ##  Don't sign more than "n" bytes of the message.  The default is to
 ##  sign the entire message.  Setting this implies "BodyLengths".
 
-MaximumSignedBytes <%= @maximum_signed_bytes %>
-<% end -%>
-
-<% if @trustanchorfile -%>
-TrustAnchorFile        <%= @trustanchorfile %>
-
-<% end -%>
-<% if @senderheaders -%>
-
-SenderHeaders          <%= @senderheaders.join(',') %>
-<% end -%>
-<% if @signaturealgorithm -%>
-SignatureAlgorithm     <%= @signaturealgorithm %>
-
-<% end -%>
-<% if @minimumkeybits -%>
-MinimumKeyBits         <%= @minimumkeybits %>
-
-<% end -%>
+MaximumSignedBytes <%= $maximum_signed_bytes %>
+<% } -%>
+
+<% unless $trustanchorfile.empty { -%>
+TrustAnchorFile        <%= $trustanchorfile %>
+
+<% } -%>
+<% unless $senderheaders.empty { -%>
+
+SenderHeaders          <%= $senderheaders.join(',') %>
+<% } -%>
+<% unless $signaturealgorithm.empty { -%>
+SignatureAlgorithm     <%= $signaturealgorithm %>
+
+<% } -%>
+<% unless $minimumkeybits.empty { -%>
+MinimumKeyBits         <%= $minimumkeybits %>
+
+<% } -%>
+<% $additional_options.each |String $_key, Variant[Array[String],String,Integer,Boolean] $_value| { -%>
+<%   case $_value { -%>
+<%     Array[String,1]: { -%>
+<%= $_key %> <%= $_value.join(',') %>
+<%     } -%>
+<%     Boolean: { -%>
+<%= $_key %> <%= $_value ? { true => 'yes', false => 'no', default => $_value } %>
+<%     } -%>
+<%     String, Integer: { -%>
+<%= $_key %> <%= $_value %>
+<%     } -%>
+<%   } -%>
+<% } -%>
diff --git a/templates/public-rsa-key.epp b/templates/public-rsa-key.epp
new file mode 100644
index 0000000..dea027b
--- /dev/null
+++ b/templates/public-rsa-key.epp
@@ -0,0 +1,13 @@
+<%- | String[1] $selector,
+      Optional[String[1]] $hash_algorithms,
+      String[1] $publickey,
+      Optional[String[1]] $publickeyextended,
+      String[1] $domain
+| -%>
+<%= $selector -%>._domainkey      IN      TXT     ( "v=DKIM1; <% if $hash_algorithms { -%>h=<%= $hash_algorithms -%>; <% } -%>k=rsa; "
+       <%- if $publickeyextended { -%>
+         "<%= $publickey -%>"
+         "<%= $publickeyextended -%>" )  ; ----- DKIM key <%= $selector %> for <%= $domain %>
+       <%- } else { -%>
+         "<%= $publickey -%>" )  ; ----- DKIM key <%= $selector %> for <%= $domain %>
+       <%- } -%>
diff --git a/templates/public-rsa-key.erb b/templates/public-rsa-key.erb
deleted file mode 100644
index 5bba897..0000000
--- a/templates/public-rsa-key.erb
+++ /dev/null
@@ -1,7 +0,0 @@
-<%= @selector -%>._domainkey      IN      TXT     ( "v=DKIM1; <% if @hash_algorithms -%>h=<%= @hash_algorithms -%>; <% end -%>k=rsa; "
-       <% if @publickey and @publickeyextended -%>
-         "<%= @publickey -%>"
-         "<%= @publickeyextended -%>" )  ; ----- DKIM key <%= @selector -%> for <%= @domain -%>
-       <% else -%>
-         "<%= @publickey -%>" )  ; ----- DKIM key <%= @selector -%> for <%= @domain -%>
-       <% end -%>
diff --git a/templates/sysconfig/opendkim.erb b/templates/sysconfig/opendkim.epp
similarity index 67%
rename from templates/sysconfig/opendkim.erb
rename to templates/sysconfig/opendkim.epp
index 1a3f3c6..2c3abde 100755
--- a/templates/sysconfig/opendkim.erb
+++ b/templates/sysconfig/opendkim.epp
@@ -1,6 +1,11 @@
+<%- | String[1] $socket,
+      Stdlib::Absolutepath $configfile,
+      Stdlib::Absolutepath $configdir,
+      Stdlib::Absolutepath $pidfile
+| -%>
 # THIS FILE IS MANAGED BY PUPPET
 
-#ALL IS MANAGED BY init.d script and <%= @configfile %>
+#ALL IS MANAGED BY init.d script and <%= $configfile %>
 
 # Command-line options specified here will override the contents of
 # /etc/opendkim.conf. See opendkim(8) for a complete list of options.
@@ -21,10 +26,10 @@
 # listen on 192.0.2.1 on port 12345
 #SOCKET="inet:12345@192.0.2.1"
 
-SOCKET="<%= @socket %>"
+SOCKET="<%= $socket %>"
 
 # Set the necessary startup options
-#OPTIONS="-x <%= @configfile %> -P <%= @pidfile %>"
+#OPTIONS="-x <%= $configfile %> -P <%= $pidfile %>"
 
 # Set the default DKIM key location
-DKIM_KEYDIR=<%= @configdir %>/keys
+DKIM_KEYDIR=<%= $configdir %>/keys
diff --git a/types/key.pp b/types/key.pp
new file mode 100644
index 0000000..035bf4c
--- /dev/null
+++ b/types/key.pp
@@ -0,0 +1,10 @@
+# @summary Validate an opendkim key struct
+type Opendkim::Key = Struct[{
+    domain            => String[1],
+    selector          => String[1],
+    hash_algorithms   => Optional[String[1]],
+    publickey         => String[1],
+    publickeyextended => Optional[String[1]],
+    privatekey        => Variant[String[1],Deferred],
+    signingdomains    => Array[String[1]],
+}]