Repository: sensson/puppet-powerdns
Pull request #184: replace params.pp with hiera data
Author: login: saz
Labels: name: enhancement
description: New feature or request
Created: 2025-03-07T17:28:35Z | Merged: 2025-03-09T09:27:54Z

There are some changes to parameters, which makes this a backwards-incompatible change, but I'd say, it should anyways treated as such, even if there wouldn't be any change.




Diff:
diff --git a/data/common.yaml b/data/common.yaml
index 2fbf0ff..071942e 100644
--- a/data/common.yaml
+++ b/data/common.yaml
@@ -1 +1,6 @@
---- {}
+---
+powerdns::authoritative_package_ensure: installed
+powerdns::authoritative_extra_packages_ensure: installed
+powerdns::authoritative_version: '4.8'
+powerdns::recursor_package_ensure: installed
+powerdns::recursor_version: '4.9'
diff --git a/data/os/Archlinux.yaml b/data/os/Archlinux.yaml
new file mode 100644
index 0000000..0ed35e8
--- /dev/null
+++ b/data/os/Archlinux.yaml
@@ -0,0 +1,21 @@
+---
+powerdns::db_dir: /var/lib/powerdns
+powerdns::db_file: "%{lookup('powerdns::db_dir')}/powerdns.sqlite3"
+powerdns::mysql_schema_file: /usr/share/doc/powerdns/schema.mysql.sql
+powerdns::pgsql_schema_file: /usr/share/doc/powerdns/schema.pgsql.sql
+powerdns::sqlite_schema_file: /usr/share/doc/powerdns/schema.sqlite3.sql
+powerdns::mysql_backend_package_name: nil
+powerdns::ldap_backend_package_name: nil
+powerdns::pgsql_backend_package_name: nil
+powerdns::sqlite_backend_package_name: nil
+powerdns::lmdb_backend_package_name: nil
+powerdns::sqlite_package_name: sqlite
+powerdns::authoritative_package_name: powerdns
+powerdns::authoritative_extra_packages: []
+powerdns::authoritative_service_name: pdns
+powerdns::authoritative_configdir: /etc/powerdns
+powerdns::authoritative_config: "%{lookup('powerdns::authoritative_configdir')}/pdns.conf"
+powerdns::recursor_configdir: /etc/powerdns
+powerdns::recursor_config: "%{lookup('powerdns::recursor_configdir')}/recursor.conf"
+powerdns::recursor_package_name: powerdns-recursor
+powerdns::recursor_service_name: pdns-recursor
diff --git a/data/os/Debian.yaml b/data/os/Debian.yaml
new file mode 100644
index 0000000..ff7e452
--- /dev/null
+++ b/data/os/Debian.yaml
@@ -0,0 +1,22 @@
+---
+powerdns::db_dir: /var/lib/powerdns
+powerdns::db_file: "%{lookup('powerdns::db_dir')}/powerdns.sqlite3"
+powerdns::mysql_schema_file: /usr/share/doc/pdns-backend-mysql/schema.mysql.sql
+powerdns::pgsql_schema_file: /usr/share/doc/pdns-backend-pgsql/schema.pgsql.sql
+powerdns::sqlite_schema_file: /usr/share/doc/pdns-backend-sqlite3/schema.sqlite3.sql
+powerdns::mysql_backend_package_name: pdns-backend-mysql
+powerdns::ldap_backend_package_name: pdns-backend-ldap
+powerdns::pgsql_backend_package_name: pdns-backend-pgsql
+powerdns::sqlite_backend_package_name: pdns-backend-sqlite3
+powerdns::lmdb_backend_package_name: pdns-backend-lmdb
+powerdns::sqlite_package_name: sqlite3
+powerdns::authoritative_package_name: pdns-server
+powerdns::authoritative_extra_packages:
+  - dirmngr
+powerdns::authoritative_service_name: pdns
+powerdns::authoritative_configdir: /etc/powerdns
+powerdns::authoritative_config: "%{lookup('powerdns::authoritative_configdir')}/pdns.conf"
+powerdns::recursor_configdir: /etc/powerdns
+powerdns::recursor_config: "%{lookup('powerdns::recursor_configdir')}/recursor.conf"
+powerdns::recursor_package_name: pdns-recursor
+powerdns::recursor_service_name: pdns-recursor
diff --git a/data/os/FreeBSD.yaml b/data/os/FreeBSD.yaml
new file mode 100644
index 0000000..ffeefb0
--- /dev/null
+++ b/data/os/FreeBSD.yaml
@@ -0,0 +1,21 @@
+---
+powerdns::db_dir: /var/db/powerdns
+powerdns::db_file: "%{lookup('powerdns::db_dir')}/powerdns.sqlite3"
+powerdns::mysql_schema_file: /usr/local/share/doc/powerdns/schema.mysql.sql
+powerdns::pgsql_schema_file: /usr/local/share/doc/powerdns/schema.pgsql.sql
+powerdns::sqlite_schema_file: /usr/local/share/doc/powerdns/schema.sqlite3.sql
+powerdns::mysql_backend_package_name: pdns-backend-mysql
+powerdns::ldap_backend_package_name: nil
+powerdns::pgsql_backend_package_name: nil
+powerdns::sqlite_backend_package_name: nil
+powerdns::lmdb_backend_package_name: nil
+powerdns::sqlite_package_name: sqlite3
+powerdns::authoritative_package_name: powerdns
+powerdns::authoritative_extra_packages: []
+powerdns::authoritative_service_name: pdns
+powerdns::authoritative_configdir: /usr/local/etc/pdns
+powerdns::authoritative_config: "%{lookup('powerdns::authoritative_configdir')}/pdns.conf"
+powerdns::recursor_configdir: /usr/local/etc/pdns
+powerdns::recursor_config: "%{lookup('powerdns::recursor_configdir')}/recursor.conf"
+powerdns::recursor_package_name: powerdns-recursor
+powerdns::recursor_service_name: pdns-recursor
diff --git a/data/os/RedHat.yaml b/data/os/RedHat.yaml
new file mode 100644
index 0000000..7378d09
--- /dev/null
+++ b/data/os/RedHat.yaml
@@ -0,0 +1,21 @@
+---
+powerdns::db_dir: /var/lib/powerdns
+powerdns::db_file: "%{lookup('powerdns::db_dir')}/powerdns.sqlite3"
+powerdns::mysql_schema_file: /usr/share/doc/pdns-backend-mysql-4.8.1/schema.mysql.sql
+powerdns::pgsql_schema_file: /usr/share/doc/pdns-backend-postgresql-4.8.1/schema.pgsql.sql
+powerdns::sqlite_schema_file: /usr/share/doc/pdns-backend-sqlite-4.8.1/schema.sqlite.sql
+powerdns::mysql_backend_package_name: pdns-backend-mysql
+powerdns::ldap_backend_package_name: pdns-backend-ldap
+powerdns::pgsql_backend_package_name: pdns-backend-postgresql
+powerdns::sqlite_backend_package_name: pdns-backend-sqlite
+powerdns::lmdb_backend_package_name: pdns-backend-lmdb
+powerdns::sqlite_package_name: sqlite
+powerdns::authoritative_package_name: pdns
+powerdns::authoritative_extra_packages: []
+powerdns::authoritative_service_name: pdns
+powerdns::authoritative_configdir: /etc/pdns
+powerdns::authoritative_config: "%{lookup('powerdns::authoritative_configdir')}/pdns.conf"
+powerdns::recursor_configdir: /etc/pdns-recursor
+powerdns::recursor_config: "%{lookup('powerdns::recursor_configdir')}/recursor.conf"
+powerdns::recursor_package_name: pdns-recursor
+powerdns::recursor_service_name: pdns-recursor
diff --git a/manifests/authoritative.pp b/manifests/authoritative.pp
index 72fd1a1..5cd76e7 100644
--- a/manifests/authoritative.pp
+++ b/manifests/authoritative.pp
@@ -1,34 +1,19 @@
 # powerdns::authoritative
 class powerdns::authoritative (
-  $package_ensure = $powerdns::params::default_package_ensure,
-  Optional[Array[String]] $install_packages = $powerdns::install_packages,
 ) inherits powerdns {
   # install the powerdns package
-  package { $powerdns::params::authoritative_package:
-    ensure => $package_ensure,
+  package { $powerdns::authoritative_package_name:
+    ensure => $powerdns::authoritative_package_ensure,
   }
 
-  stdlib::ensure_packages($install_packages)
-
-  $supported_backends = [
-    'mysql',
-    'bind',
-    'postgresql',
-    'ldap',
-    'sqlite',
-    'lmdb',
-  ]
-
-  unless $powerdns::backend in $supported_backends {
-    fail("${powerdns::backend} is not supported. We only support ${supported_backends.join(', ')} at the moment.")
-  }
+  stdlib::ensure_packages($powerdns::authoritative_extra_packages, { 'ensure' => $powerdns::authoritative_extra_packages_ensure })
 
   include "powerdns::backends::${powerdns::backend}"
 
   service { 'pdns':
     ensure  => running,
-    name    => $powerdns::params::authoritative_service,
+    name    => $powerdns::authoritative_service_name,
     enable  => true,
-    require => Package[$powerdns::params::authoritative_package],
+    require => Package[$powerdns::authoritative_package_name],
   }
 }
diff --git a/manifests/backends/bind.pp b/manifests/backends/bind.pp
index a02b88c..70e740f 100644
--- a/manifests/backends/bind.pp
+++ b/manifests/backends/bind.pp
@@ -3,9 +3,9 @@
   # Remove the default simplebind configuration as we prefer to manage PowerDNS
   # consistently across all operating systems. This file is added to Debian
   # based systems due to Debian's policies.
-  file { "${powerdns::params::authoritative_configdir}/pdns.d/pdns.simplebind.conf":
+  file { "${powerdns::authoritative_configdir}/pdns.d/pdns.simplebind.conf":
     ensure  => absent,
-    require => Package[$powerdns::params::authoritative_package],
+    require => Package[$powerdns::authoritative_package_name],
   }
 
   # set the configuration variables
@@ -19,33 +19,33 @@
   powerdns::config { 'bind-config':
     ensure  => present,
     setting => 'bind-config',
-    value   => "${powerdns::params::authoritative_configdir}/named.conf",
+    value   => "${powerdns::authoritative_configdir}/named.conf",
     type    => 'authoritative',
-    require => Package[$powerdns::params::authoritative_package],
+    require => Package[$powerdns::authoritative_package_name],
   }
 
-  file { "${powerdns::params::authoritative_configdir}/named.conf":
+  file { "${powerdns::authoritative_configdir}/named.conf":
     ensure  => file,
     mode    => '0644',
     owner   => 'root',
-    group   => 'root',
-    require => Package[$powerdns::params::authoritative_package],
+    group   => 0,
+    require => Package[$powerdns::authoritative_package_name],
   }
 
   file_line { 'powerdns-bind-baseconfig':
     ensure  => present,
-    path    => "${powerdns::params::authoritative_configdir}/named.conf",
-    line    => "options { directory \"${powerdns::params::authoritative_configdir}/named\"; };",
+    path    => "${powerdns::authoritative_configdir}/named.conf",
+    line    => "options { directory \"${powerdns::authoritative_configdir}/named\"; };",
     match   => 'options',
     notify  => Service['pdns'],
-    require => File["${powerdns::params::authoritative_configdir}/named.conf"],
+    require => File["${powerdns::authoritative_configdir}/named.conf"],
   }
 
-  file { "${powerdns::params::authoritative_configdir}/named":
+  file { "${powerdns::authoritative_configdir}/named":
     ensure  => directory,
     mode    => '0755',
     owner   => 'root',
-    group   => 'root',
-    require => Package[$powerdns::params::authoritative_package],
+    group   => 0,
+    require => Package[$powerdns::authoritative_package_name],
   }
 }
diff --git a/manifests/backends/ldap.pp b/manifests/backends/ldap.pp
index 0d4ae24..fa53d78 100644
--- a/manifests/backends/ldap.pp
+++ b/manifests/backends/ldap.pp
@@ -1,11 +1,12 @@
 # ldap backend for powerdns
-class powerdns::backends::ldap ($package_ensure = $powerdns::params::default_package_ensure) inherits powerdns {
+class powerdns::backends::ldap (
+) inherits powerdns {
   if $facts['os']['family'] == 'Debian' {
     # The pdns-server package from the Debian APT repo automatically installs the bind
     # backend package which we do not want when using another backend such as ldap.
     package { 'pdns-backend-bind':
       ensure  => purged,
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
   }
 
@@ -31,15 +32,10 @@
     type    => 'authoritative',
   }
 
-  $_ldap_secret = $powerdns::ldap_secret =~ Sensitive ? {
-    true => $powerdns::ldap_secret.unwrap,
-    false => $powerdns::ldap_secret
-  }
-
   powerdns::config { 'ldap-secret':
     ensure  => present,
     setting => 'ldap-secret',
-    value   => $_ldap_secret,
+    value   => $powerdns::ldap_secret,
     type    => 'authoritative',
   }
 
@@ -57,12 +53,12 @@
     type    => 'authoritative',
   }
 
-  if $powerdns::params::ldap_backend_package_name {
+  if $powerdns::ldap_backend_package_name {
     # set up the powerdns backend
-    package { $powerdns::params::ldap_backend_package_name:
-      ensure  => $package_ensure,
+    package { $powerdns::ldap_backend_package_name:
+      ensure  => $powerdns::authoritative_package_ensure,
       before  => Service['pdns'],
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
   }
 
diff --git a/manifests/backends/lmdb.pp b/manifests/backends/lmdb.pp
index ab888ba..dbf0721 100644
--- a/manifests/backends/lmdb.pp
+++ b/manifests/backends/lmdb.pp
@@ -1,19 +1,18 @@
 # lmdb backend for powerdns
 class powerdns::backends::lmdb (
-  $package_ensure = $powerdns::params::default_package_ensure
 ) inherits powerdns {
   if $facts['os']['family'] == 'Debian' {
     # The pdns-server package from the Debian APT repo automatically installs the bind
     # backend package which we do not want when using another backend such as ldap.
     package { 'pdns-backend-bind':
       ensure  => purged,
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
 
     # The pdns-backend-lmdb package installs a configuration file that conflicts with this module's backend configuration.
-    file { "${powerdns::params::authoritative_configdir}/pdns.d/lmdb.conf":
+    file { "${powerdns::authoritative_configdir}/pdns.d/lmdb.conf":
       ensure  => absent,
-      require => Package[$powerdns::params::lmdb_backend_package_name],
+      require => Package[$powerdns::lmdb_backend_package_name],
       before  => Service['pdns'],
     }
   }
@@ -35,12 +34,12 @@
     }
   }
 
-  if $powerdns::params::lmdb_backend_package_name {
+  if $powerdns::lmdb_backend_package_name {
     # set up the powerdns backend
-    package { $powerdns::params::lmdb_backend_package_name:
-      ensure  => $package_ensure,
+    package { $powerdns::lmdb_backend_package_name:
+      ensure  => $powerdns::authoritative_package_ensure,
       before  => Service['pdns'],
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
   }
 
diff --git a/manifests/backends/mysql.pp b/manifests/backends/mysql.pp
index f592407..de31d0d 100644
--- a/manifests/backends/mysql.pp
+++ b/manifests/backends/mysql.pp
@@ -1,5 +1,6 @@
 # mysql backend for powerdns
-class powerdns::backends::mysql ($package_ensure = $powerdns::params::default_package_ensure) inherits powerdns {
+class powerdns::backends::mysql (
+) inherits powerdns {
   # set the configuration variables
   powerdns::config { 'launch':
     ensure  => present,
@@ -29,16 +30,11 @@
     type    => 'authoritative',
   }
 
-  $_db_password = $powerdns::db_password =~ Sensitive ? {
-    true => $powerdns::db_password.unwrap,
-    false => $powerdns::db_password
-  }
-
-  if $_db_password {
+  if $powerdns::db_password {
     powerdns::config { 'gmysql-password':
       ensure  => present,
       setting => 'gmysql-password',
-      value   => $_db_password,
+      value   => $powerdns::db_password,
       type    => 'authoritative',
     }
   }
@@ -50,24 +46,19 @@
     type    => 'authoritative',
   }
 
-  if $powerdns::params::mysql_backend_package_name {
+  if $powerdns::mysql_backend_package_name {
     # set up the powerdns backend
-    package { $powerdns::params::mysql_backend_package_name:
-      ensure  => $package_ensure,
+    package { $powerdns::mysql_backend_package_name:
+      ensure  => $powerdns::authoritative_package_ensure,
       before  => Service['pdns'],
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
   }
   if $powerdns::backend_install {
     # mysql database
     if ! defined(Class['mysql::server']) {
-      $_db_root_password = $powerdns::db_root_password =~ Sensitive ? {
-        true => $powerdns::db_root_password.unwrap,
-        false => $powerdns::db_root_password
-      }
-
       class { 'mysql::server':
-        root_password      => $_db_root_password,
+        root_password      => $powerdns::db_root_password,
         create_root_my_cnf => true,
       }
     }
@@ -77,15 +68,15 @@
     }
   }
 
-  if $powerdns::backend_create_tables and $_db_password {
+  if $powerdns::backend_create_tables and $powerdns::db_password {
     # make sure the database exists
     mysql::db { $powerdns::db_name:
       user     => $powerdns::db_username,
-      password => $_db_password,
+      password => $powerdns::db_password,
       host     => $powerdns::db_host,
       grant    => ['ALL'],
       sql      => [$powerdns::mysql_schema_file],
-      require  => Package[$powerdns::params::mysql_backend_package_name],
+      require  => Package[$powerdns::mysql_backend_package_name],
     }
   }
 }
diff --git a/manifests/backends/postgresql.pp b/manifests/backends/postgresql.pp
index 41ab380..7a46551 100644
--- a/manifests/backends/postgresql.pp
+++ b/manifests/backends/postgresql.pp
@@ -1,18 +1,19 @@
 # postgresql backend for powerdns
-class powerdns::backends::postgresql ($package_ensure = $powerdns::params::default_package_ensure) inherits powerdns {
+class powerdns::backends::postgresql (
+) inherits powerdns {
   if $facts['os']['family'] == 'Debian' {
     # Remove the debconf gpgsql configuration file auto-generated when using the package
     # from Debian repository as it interferes with this module's backend configuration.
-    file { "${powerdns::params::authoritative_configdir}/pdns.d/pdns.local.gpgsql.conf":
+    file { "${powerdns::authoritative_configdir}/pdns.d/pdns.local.gpgsql.conf":
       ensure  => absent,
-      require => Package[$powerdns::params::pgsql_backend_package_name],
+      require => Package[$powerdns::pgsql_backend_package_name],
     }
 
     # The pdns-server package from the Debian APT repo automatically installs the bind
     # backend package which we do not want when using another backend such as pgsql.
     package { 'pdns-backend-bind':
       ensure  => purged,
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
   }
 
@@ -38,16 +39,11 @@
     type    => 'authoritative',
   }
 
-  $_db_password = $powerdns::db_password =~ Sensitive ? {
-    true => $powerdns::db_password.unwrap,
-    false => $powerdns::db_password
-  }
-
-  if $_db_password {
+  if $powerdns::db_password {
     powerdns::config { 'gpgsql-password':
       ensure  => present,
       setting => 'gpgsql-password',
-      value   => $_db_password,
+      value   => $powerdns::db_password,
       type    => 'authoritative',
     }
   }
@@ -60,22 +56,17 @@
   }
 
   # set up the powerdns backend
-  if $powerdns::params::pgsql_backend_package_name {
-    package { $powerdns::params::pgsql_backend_package_name:
-      ensure  => $package_ensure,
+  if $powerdns::pgsql_backend_package_name {
+    package { $powerdns::pgsql_backend_package_name:
+      ensure  => $powerdns::authoritative_package_ensure,
       before  => Service['pdns'],
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
   }
   if $powerdns::backend_install {
     if ! defined(Class['postgresql::server']) {
-      $_db_root_password = $powerdns::db_root_password =~ Sensitive ? {
-        true => $powerdns::db_root_password.unwrap,
-        false => $powerdns::db_root_password
-      }
-
       class { 'postgresql::server':
-        postgres_password => $_db_root_password,
+        postgres_password => $powerdns::db_root_password,
       }
     }
   }
@@ -83,17 +74,22 @@
   if $powerdns::backend_create_tables {
     $password_hash = $powerdns::db_password ? {
       Undef   => undef,
-      default => postgresql::postgresql_password($powerdns::db_username, $_db_password),
+      default => postgresql::postgresql_password($powerdns::db_username, $powerdns::db_password),
     }
 
     postgresql::server::db { $powerdns::db_name:
       user     => $powerdns::db_username,
       owner    => $powerdns::db_username,
       password => $password_hash,
-      require  => Package[$powerdns::params::pgsql_backend_package_name],
+      require  => Package[$powerdns::pgsql_backend_package_name],
     }
 
     # define connection settings for powerdns user in order to create tables
+    $_db_password = $powerdns::db_password =~ Sensitive ? {
+      true => $powerdns::db_password.unwrap,
+      false => $powerdns::db_password
+    }
+
     $connection_settings_powerdns = {
       'PGUSER'     => $powerdns::db_username,
       'PGPASSWORD' => $_db_password,
diff --git a/manifests/backends/sqlite.pp b/manifests/backends/sqlite.pp
index 51bd134..8fa5667 100644
--- a/manifests/backends/sqlite.pp
+++ b/manifests/backends/sqlite.pp
@@ -1,5 +1,6 @@
 # sqlite backend for powerdns
-class powerdns::backends::sqlite ($package_ensure = $powerdns::params::default_package_ensure) inherits powerdns {
+class powerdns::backends::sqlite (
+) inherits powerdns {
   # set the configuration variables
   powerdns::config { 'launch':
     ensure  => present,
@@ -16,17 +17,17 @@
   }
 
   # set up the powerdns backend
-  if $powerdns::params::sqlite_backend_package_name {
-    package { $powerdns::params::sqlite_backend_package_name:
-      ensure  => $package_ensure,
+  if $powerdns::sqlite_backend_package_name {
+    package { $powerdns::sqlite_backend_package_name:
+      ensure  => $powerdns::authoritative_package_ensure,
       before  => Service['pdns'],
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
   }
   if $powerdns::backend_install {
     if ! defined(Package[$powerdns::sqlite_package_name]) {
       package { $powerdns::sqlite_package_name:
-        ensure => $package_ensure,
+        ensure => $powerdns::authoritative_package_ensure,
       }
     }
   }
@@ -47,7 +48,7 @@
       command => "/usr/bin/env sqlite3 ${powerdns::db_file} < ${powerdns::sqlite_schema_file}",
       unless  => "/usr/bin/env test `echo '.tables domains' | sqlite3 ${powerdns::db_file} | wc -l` -eq 1",
       before  => Service['pdns'],
-      require => Package[$powerdns::params::authoritative_package],
+      require => Package[$powerdns::authoritative_package_name],
     }
   }
 }
diff --git a/manifests/config.pp b/manifests/config.pp
index 4afbc26..51affa5 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -1,9 +1,9 @@
 # powerdns::config
 define powerdns::config (
-  String                            $setting = $title,
-  Powerdns::ConfigValue             $value   = '',
-  Enum['present', 'absent']         $ensure  = 'present',
-  Enum['authoritative', 'recursor'] $type    = 'authoritative'
+  String[1] $setting = $title,
+  Powerdns::ConfigValue $value = '',
+  Enum['present', 'absent'] $ensure = 'present',
+  Enum['authoritative', 'recursor'] $type = 'authoritative'
 ) {
   $empty_value_allowed = [
     'gmysql-dnssec',
@@ -28,12 +28,12 @@
   }
 
   if $type == 'authoritative' {
-    $path            = $powerdns::params::authoritative_config
-    $require_package = $powerdns::params::authoritative_package
+    $path            = $powerdns::authoritative_config
+    $require_package = $powerdns::authoritative_package_name
     $notify_service  = 'pdns'
   } else {
-    $path            = $powerdns::params::recursor_config
-    $require_package = $powerdns::params::recursor_package
+    $path            = $powerdns::recursor_config
+    $require_package = $powerdns::recursor_package_name
     $notify_service  = 'pdns-recursor'
   }
 
diff --git a/manifests/init.pp b/manifests/init.pp
index 1984ed2..a09e918 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -14,53 +14,58 @@
 #   Sync mode for LMDB. One of 'nosync', 'sync', 'nometasync', 'mapasync'
 #
 class powerdns (
-  Boolean                    $authoritative                      = true,
-  Boolean                    $recursor                           = false,
-  Enum[
-    'ldap',
-    'mysql',
-    'bind',
-    'postgresql',
-    'sqlite',
-    'lmdb'
-  ]                          $backend                            = 'mysql',
-  Boolean                    $backend_install                    = true,
-  Boolean                    $backend_create_tables              = true,
-  Powerdns::Secret           $db_root_password                   = undef,
-  String[1]                  $db_username                        = 'powerdns',
-  Powerdns::Secret           $db_password                        = undef,
-  String[1]                  $db_name                            = 'powerdns',
-  String[1]                  $db_host                            = 'localhost',
-  Integer[1]                 $db_port                            = 3306,
-  String[1]                  $db_dir                             = $powerdns::params::db_dir,
-  String[1]                  $db_file                            = $powerdns::params::db_file,
-  Boolean                    $require_db_password                = true,
-  String[1]                  $ldap_host                          = 'ldap://localhost/',
-  Optional[String[1]]        $ldap_basedn                        = undef,
-  String[1]                  $ldap_method                        = 'strict',
-  Optional[String[1]]        $ldap_binddn                        = undef,
-  Powerdns::Secret           $ldap_secret                        = undef,
-  Stdlib::Absolutepath       $lmdb_filename                      = '/var/lib/powerdns/pdns.lmdb',
-  Optional[Integer]          $lmdb_schema_version                = undef,
-  Optional[Integer]          $lmdb_shards                        = undef,
-  Optional[
-    Enum[
-      'nosync',
-      'sync',
-      'nometasync',
-      'mapasync'
-    ]
-  ]                          $lmdb_sync_mode                     = undef,
-  Boolean                    $custom_repo                        = false,
-  Boolean                    $custom_epel                        = false,
-  Pattern[/4\.[0-9]+/]       $authoritative_version              = $powerdns::params::authoritative_version,
-  Pattern[/[4,5]\.[0-9]+/]   $recursor_version                   = $powerdns::params::recursor_version,
-  String[1]                  $mysql_schema_file                  = $powerdns::params::mysql_schema_file,
-  String[1]                  $pgsql_schema_file                  = $powerdns::params::pgsql_schema_file,
-  Hash                       $forward_zones                      = {},
-  Powerdns::Autoprimaries    $autoprimaries                      = {},
-  Boolean                    $purge_autoprimaries                = false,
-) inherits powerdns::params {
+  String[1] $authoritative_package_name,
+  String[1] $authoritative_package_ensure,
+  Optional[Array[String[1]]] $authoritative_extra_packages,
+  String[1] $authoritative_extra_packages_ensure,
+  String[1] $authoritative_service_name,
+  Stdlib::Absolutepath $authoritative_configdir,
+  Stdlib::Absolutepath $authoritative_config,
+  Pattern[/4\.[0-9]+/] $authoritative_version,
+  Stdlib::Absolutepath $db_dir,
+  Stdlib::Absolutepath $db_file,
+  Stdlib::Absolutepath $mysql_schema_file,
+  Stdlib::Absolutepath $pgsql_schema_file,
+  Stdlib::Absolutepath $sqlite_schema_file,
+  String[1] $recursor_package_name,
+  String[1] $recursor_package_ensure,
+  String[1] $recursor_service_name,
+  Stdlib::Absolutepath $recursor_configdir,
+  Stdlib::Absolutepath $recursor_config,
+  Pattern[/[4,5]\.[0-9]+/] $recursor_version,
+  String[1] $sqlite_package_name,
+  Optional[String[1]] $mysql_backend_package_name,
+  Optional[String[1]] $ldap_backend_package_name,
+  Optional[String[1]] $pgsql_backend_package_name,
+  Optional[String[1]] $sqlite_backend_package_name,
+  Optional[String[1]] $lmdb_backend_package_name,
+  Boolean $authoritative = true,
+  Boolean $recursor = false,
+  Powerdns::Backends $backend = 'mysql',
+  Boolean $backend_install = true,
+  Boolean $backend_create_tables = true,
+  Powerdns::Secret $db_root_password = undef,
+  String[1] $db_username = 'powerdns',
+  Powerdns::Secret $db_password = undef,
+  String[1] $db_name = 'powerdns',
+  Stdlib::Host $db_host = 'localhost',
+  Stdlib::Port $db_port = 3306,
+  Boolean $require_db_password = true,
+  String[1] $ldap_host = 'ldap://localhost/',
+  Optional[String[1]] $ldap_basedn = undef,
+  Powerdns::LdapMethod $ldap_method = 'strict',
+  Optional[String[1]] $ldap_binddn = undef,
+  Powerdns::Secret $ldap_secret = undef,
+  Stdlib::Absolutepath $lmdb_filename = '/var/lib/powerdns/pdns.lmdb',
+  Optional[Integer] $lmdb_schema_version = undef,
+  Optional[Integer] $lmdb_shards = undef,
+  Powerdns::LmdbSyncMode $lmdb_sync_mode = undef,
+  Boolean $custom_repo = false,
+  Boolean $custom_epel = false,
+  Hash $forward_zones = {},
+  Powerdns::Autoprimaries $autoprimaries = {},
+  Boolean $purge_autoprimaries = false,
+) {
   # Do some additional checks. In certain cases, some parameters are no longer optional.
   if $authoritative {
     if $require_db_password and !($powerdns::backend in ['bind', 'ldap', 'sqlite', 'lmdb']) {
diff --git a/manifests/params.pp b/manifests/params.pp
deleted file mode 100644
index 066f1ce..0000000
--- a/manifests/params.pp
+++ /dev/null
@@ -1,101 +0,0 @@
-# powerdns::params
-class powerdns::params {
-  $default_package_ensure = installed
-  $authoritative_version = '4.8'
-  $recursor_version = '4.9'
-
-  case $facts['os']['family'] {
-    'RedHat': {
-      $mysql_schema_file = '/usr/share/doc/pdns-backend-mysql-4.8.1/schema.mysql.sql'
-      $pgsql_schema_file = '/usr/share/doc/pdns-backend-postgresql-4.8.1/schema.pgsql.sql'
-      $sqlite_schema_file = '/usr/share/doc/pdns-backend-sqlite-4.8.1/schema.sqlite.sql'
-      $authoritative_package = 'pdns'
-      $authoritative_service = 'pdns'
-      $authoritative_config = '/etc/pdns/pdns.conf'
-      $db_dir = '/var/lib/powerdns'
-      $db_file = "${db_dir}/powerdns.sqlite3"
-      $mysql_backend_package_name = 'pdns-backend-mysql'
-      $ldap_backend_package_name = 'pdns-backend-ldap'
-      $pgsql_backend_package_name = 'pdns-backend-postgresql'
-      $sqlite_backend_package_name = 'pdns-backend-sqlite'
-      $lmdb_backend_package_name = 'pdns-backend-lmdb'
-      $sqlite_package_name = 'sqlite'
-      $authoritative_configdir = '/etc/pdns'
-      $recursor_package = 'pdns-recursor'
-      $recursor_service = 'pdns-recursor'
-      $recursor_dir = '/etc/pdns-recursor'
-      $recursor_config = "${recursor_dir}/recursor.conf"
-      $install_packages = []
-    }
-    'Debian': {
-      $authoritative_package = 'pdns-server'
-      $authoritative_service = 'pdns'
-      $authoritative_config = '/etc/powerdns/pdns.conf'
-      $db_dir = '/var/lib/powerdns'
-      $db_file = "${db_dir}/powerdns.sqlite3"
-      $mysql_backend_package_name = 'pdns-backend-mysql'
-      $ldap_backend_package_name = 'pdns-backend-ldap'
-      $pgsql_backend_package_name = 'pdns-backend-pgsql'
-      $sqlite_backend_package_name = 'pdns-backend-sqlite3'
-      $lmdb_backend_package_name = 'pdns-backend-lmdb'
-      $mysql_schema_file = '/usr/share/doc/pdns-backend-mysql/schema.mysql.sql'
-      $pgsql_schema_file = '/usr/share/doc/pdns-backend-pgsql/schema.pgsql.sql'
-      $sqlite_schema_file = '/usr/share/doc/pdns-backend-sqlite3/schema.sqlite3.sql'
-      $sqlite_package_name = 'sqlite3'
-      $authoritative_configdir = '/etc/powerdns'
-      $recursor_package = 'pdns-recursor'
-      $recursor_service = 'pdns-recursor'
-      $recursor_dir = '/etc/powerdns'
-      $recursor_config = "${recursor_dir}/recursor.conf"
-      $install_packages = ['dirmngr']
-    }
-    'FreeBSD': {
-      $authoritative_package = 'powerdns'
-      $authoritative_service = 'pdns'
-      $authoritative_config = '/usr/local/etc/pdns/pdns.conf'
-      $db_dir = '/var/db/powerdns'
-      $db_file = "${db_dir}/powerdns.sqlite3"
-      $mysql_backend_package_name = 'pdns-backend-mysql'
-      $ldap_backend_package_name = undef
-      $pgsql_backend_package_name = undef
-      $sqlite_backend_package_name = undef
-      $lmdb_backend_package_name = undef
-      $mysql_schema_file = '/usr/local/share/doc/powerdns/schema.mysql.sql'
-      $pgsql_schema_file = '/usr/local/share/doc/powerdns/schema.pgsql.sql'
-      $sqlite_schema_file = '/usr/local/share/doc/powerdns/schema.sqlite3.sql'
-      $sqlite_package_name = 'sqlite3'
-      $authoritative_configdir = '/usr/local/etc/pdns'
-      $recursor_package = 'powerdns-recursor'
-      $recursor_service = 'pdns-recursor'
-      $recursor_dir = '/usr/local/etc/pdns'
-      $recursor_config = "${recursor_dir}/recursor.conf"
-      $install_packages = []
-    }
-    'Archlinux': {
-      $authoritative_package = 'powerdns'
-      $authoritative_service = 'pdns'
-      $recursor_package = 'powerdns-recursor'
-      $recursor_service = 'pdns-recursor'
-      $mysql_schema_file = '/usr/share/doc/powerdns/schema.mysql.sql'
-      $pgsql_schema_file = '/usr/share/doc/powerdns/schema.pgsql.sql'
-      $sqlite_schema_file = '/usr/share/doc/powerdns/schema.sqlite3.sql'
-      $db_dir = '/var/lib/powerdns'
-      $db_file = "${db_dir}/powerdns.sqlite3"
-      $service_provider = 'systemd'
-      $install_packages = []
-      $mysql_backend_package_name = undef
-      $ldap_backend_package_name = undef
-      $pgsql_backend_package_name = undef
-      $sqlite_backend_package_name = undef
-      $lmdb_backend_package_name = undef
-      $authoritative_config = '/etc/powerdns/pdns.conf'
-      $recursor_dir = '/etc/powerdns'
-      $recursor_config = "${recursor_dir}/recursor.conf"
-      $sqlite_package_name = 'sqlite'
-      $authoritative_configdir = '/etc/powerdns'
-    }
-    default: {
-      fail("${facts['os']['family']} is not supported yet.")
-    }
-  }
-}
diff --git a/manifests/recursor.pp b/manifests/recursor.pp
index 88567a0..d167839 100644
--- a/manifests/recursor.pp
+++ b/manifests/recursor.pp
@@ -1,26 +1,21 @@
 # @summary powerdns recursor
-
-# @param package_ensure
+#
 # @param forward_zones
 #   Hash containing zone => dns servers pairs
-# @param recursor_dir
-#   Configuration directory for recursor
 #
 class powerdns::recursor (
-  String $package_ensure = $powerdns::params::default_package_ensure,
-  Hash   $forward_zones  = $powerdns::forward_zones,
-  String $recursor_dir   = $powerdns::recursor_dir,
+  Hash $forward_zones = $powerdns::forward_zones,
 ) inherits powerdns {
-  package { $powerdns::recursor_package:
-    ensure => $package_ensure,
+  package { $powerdns::recursor_package_name:
+    ensure => $powerdns::recursor_package_ensure,
   }
 
   if !empty($forward_zones) {
-    $zone_config = "${recursor_dir}/forward_zones.conf"
+    $zone_config = "${powerdns::recursor_configdir}/forward_zones.conf"
     file { $zone_config:
       ensure  => file,
       owner   => 'root',
-      group   => 'root',
+      group   => 0,
       content => template('powerdns/forward_zones.conf.erb'),
       notify  => Service['pdns-recursor'],
     }
@@ -33,8 +28,8 @@
 
   service { 'pdns-recursor':
     ensure  => running,
-    name    => $powerdns::params::recursor_service,
+    name    => $powerdns::recursor_service_name,
     enable  => true,
-    require => Package[$powerdns::params::recursor_package],
+    require => Package[$powerdns::recursor_package_name],
   }
 }
diff --git a/manifests/repo.pp b/manifests/repo.pp
index 940366d..bd2a5b1 100644
--- a/manifests/repo.pp
+++ b/manifests/repo.pp
@@ -11,8 +11,8 @@
         include epel
       }
 
-      Yumrepo['powerdns'] -> Package <| title == $powerdns::params::authoritative_package |>
-      Yumrepo['powerdns-recursor'] -> Package <| title == $powerdns::params::recursor_package |>
+      Yumrepo['powerdns'] -> Package <| title == $powerdns::authoritative_package_name |>
+      Yumrepo['powerdns-recursor'] -> Package <| title == $powerdns::recursor_package_name |>
 
       if ($facts['os']['name'] == 'Rocky') {
         $mirrorlist = "https://mirrors.rockylinux.org/mirrorlist?arch=\$basearch&repo=PowerTools-\$releasever"
@@ -103,8 +103,8 @@
         require    => Apt::Pin['powerdns'],
       }
 
-      Apt::Pin['powerdns'] -> Package <| title == $powerdns::params::authoritative_package |>
-      Apt::Pin['powerdns-recursor'] -> Package <| title == $powerdns::params::recursor_package |>
+      Apt::Pin['powerdns'] -> Package <| title == $powerdns::authoritative_package_name |>
+      Apt::Pin['powerdns'] -> Package <| title == $powerdns::recursor_package_name |>
     }
 
     'FreeBSD','Archlinux': {
diff --git a/spec/classes/powerdns_init_spec.rb b/spec/classes/powerdns_init_spec.rb
index 41dc17a..e5a848f 100644
--- a/spec/classes/powerdns_init_spec.rb
+++ b/spec/classes/powerdns_init_spec.rb
@@ -110,8 +110,6 @@
             }
           end
 
-          it { is_expected.to contain_class('powerdns::params') }
-
           # Check the repositories
           it { is_expected.to contain_class('powerdns::repo') }
           case facts[:osfamily]
@@ -399,7 +397,7 @@
               }
             end
 
-            it { is_expected.to contain_powerdns__config('ldap-secret').with('value' => 'secret_bar') }
+            it { is_expected.to contain_powerdns__config('ldap-secret').with('value' => sensitive('secret_bar')) }
           end
 
           context 'with backend_install set to true' do
@@ -531,7 +529,7 @@
             }
           end
 
-          it { is_expected.to contain_mysql__db('powerdns').with('user' => 'foo', 'password' => 'TopSecret', 'host' => 'localhost') }
+          it { is_expected.to contain_mysql__db('powerdns').with('user' => 'foo', 'password' => sensitive('TopSecret'), 'host' => 'localhost') }
         end
 
         context 'powerdns with postgresql backend and Sensitive password' do
@@ -545,7 +543,7 @@
             }
           end
 
-          it { is_expected.to contain_powerdns__config('gpgsql-password').with(value: 'TopSecret') }
+          it { is_expected.to contain_powerdns__config('gpgsql-password').with(value: sensitive('TopSecret')) }
           it { is_expected.to contain_postgresql__server__db('powerdns').with('user' => 'foo') }
         end
 
@@ -562,7 +560,6 @@
           end
 
           it { is_expected.to compile.with_all_deps }
-          it { is_expected.to contain_class('powerdns::params') }
 
           # Check the authoritative server
           it { is_expected.to contain_class('powerdns::recursor') }
@@ -611,11 +608,7 @@
             }
           end
 
-          it {
-            is_expected.to raise_error(
-              %r{'backend' expects a match for Enum\['bind', 'ldap', 'lmdb', 'mysql', 'postgresql', 'sqlite'\]},
-            )
-          }
+          it { is_expected.not_to compile }
         end
 
         context 'powerdns version 4.7' do
diff --git a/types/backends.pp b/types/backends.pp
new file mode 100644
index 0000000..f8ecaaa
--- /dev/null
+++ b/types/backends.pp
@@ -0,0 +1,8 @@
+type Powerdns::Backends = Enum[
+  'ldap',
+  'mysql',
+  'bind',
+  'postgresql',
+  'sqlite',
+  'lmdb',
+]
diff --git a/types/ldapmethod.pp b/types/ldapmethod.pp
new file mode 100644
index 0000000..cc6eeed
--- /dev/null
+++ b/types/ldapmethod.pp
@@ -0,0 +1,5 @@
+type Powerdns::LdapMethod = Enum[
+  'simple',
+  'tree',
+  'strict',
+]
diff --git a/types/lmdbsyncmode.pp b/types/lmdbsyncmode.pp
new file mode 100644
index 0000000..09d90b5
--- /dev/null
+++ b/types/lmdbsyncmode.pp
@@ -0,0 +1,8 @@
+type Powerdns::LmdbSyncMode = Optional[
+  Enum[
+    'nosync',
+    'sync',
+    'nometasync',
+    'mapasync',
+  ]
+]


Reviews:
user: login: ju5t
body: This is a huge PR, thank you so much @saz! I only have two questions, but everything else looks good to me. 
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-09T08:55:25Z
user: login: saz
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-09T09:14:43Z
user: login: saz
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-09T09:18:55Z
user: login: ju5t
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-09T09:19:05Z
user: login: ju5t
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-09T09:24:00Z

Review comments:
diff_hunk: @@ -19,33 +19,33 @@
   powerdns::config { 'bind-config':
     ensure  => present,
     setting => 'bind-config',
-    value   => "${powerdns::params::authoritative_configdir}/named.conf",
+    value   => "${powerdns::authoritative_configdir}/named.conf",
     type    => 'authoritative',
-    require => Package[$powerdns::params::authoritative_package],
+    require => Package[$powerdns::authoritative_package_name],
   }
 
-  file { "${powerdns::params::authoritative_configdir}/named.conf":
+  file { "${powerdns::authoritative_configdir}/named.conf":
     ensure  => file,
     mode    => '0644',
     owner   => 'root',
-    group   => 'root',
-    require => Package[$powerdns::params::authoritative_package],
+    group   => 0,
path: manifests/backends/bind.pp
user: login: ju5t
body: Does changing this have any benefits on some operating systems? I haven't seen many systems with more users in group 0.
created_at: 2025-03-09T08:45:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,11 +1,12 @@
 # ldap backend for powerdns
-class powerdns::backends::ldap ($package_ensure = $powerdns::params::default_package_ensure) inherits powerdns {
+class powerdns::backends::ldap (
path: manifests/backends/ldap.pp
user: login: ju5t
body: Is it the convention to add the `inherits powerdns` on a new line?
created_at: 2025-03-09T08:49:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -19,33 +19,33 @@
   powerdns::config { 'bind-config':
     ensure  => present,
     setting => 'bind-config',
-    value   => "${powerdns::params::authoritative_configdir}/named.conf",
+    value   => "${powerdns::authoritative_configdir}/named.conf",
     type    => 'authoritative',
-    require => Package[$powerdns::params::authoritative_package],
+    require => Package[$powerdns::authoritative_package_name],
   }
 
-  file { "${powerdns::params::authoritative_configdir}/named.conf":
+  file { "${powerdns::authoritative_configdir}/named.conf":
     ensure  => file,
     mode    => '0644',
     owner   => 'root',
-    group   => 'root',
-    require => Package[$powerdns::params::authoritative_package],
+    group   => 0,
path: manifests/backends/bind.pp
user: login: saz
body: There's no group 'root' on FreeBSD. 0 will be 'root' on Linux and 'wheel' on FreeBSD.
created_at: 2025-03-09T09:14:43Z
author_association: MEMBER
diff_hunk: @@ -1,11 +1,12 @@
 # ldap backend for powerdns
-class powerdns::backends::ldap ($package_ensure = $powerdns::params::default_package_ensure) inherits powerdns {
+class powerdns::backends::ldap (
path: manifests/backends/ldap.pp
user: login: saz
body: It's not explicitly written, but if you read through https://www.puppet.com/docs/puppet/8/style_guide.html#style_guide_classes-internal-organization-classes-defined-types it seems logical. Besides, if there are multiple parameters, it's easier to read this way.

That's why I tried (if I've not kissed anything) to stick to the same schema.
created_at: 2025-03-09T09:18:55Z
author_association: MEMBER
diff_hunk: @@ -19,33 +19,33 @@
   powerdns::config { 'bind-config':
     ensure  => present,
     setting => 'bind-config',
-    value   => "${powerdns::params::authoritative_configdir}/named.conf",
+    value   => "${powerdns::authoritative_configdir}/named.conf",
     type    => 'authoritative',
-    require => Package[$powerdns::params::authoritative_package],
+    require => Package[$powerdns::authoritative_package_name],
   }
 
-  file { "${powerdns::params::authoritative_configdir}/named.conf":
+  file { "${powerdns::authoritative_configdir}/named.conf":
     ensure  => file,
     mode    => '0644',
     owner   => 'root',
-    group   => 'root',
-    require => Package[$powerdns::params::authoritative_package],
+    group   => 0,
path: manifests/backends/bind.pp
user: login: ju5t
body: Got it. It's been a really long time since I've worked with BSD :)
created_at: 2025-03-09T09:19:05Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,11 +1,12 @@
 # ldap backend for powerdns
-class powerdns::backends::ldap ($package_ensure = $powerdns::params::default_package_ensure) inherits powerdns {
+class powerdns::backends::ldap (
path: manifests/backends/ldap.pp
user: login: ju5t
body: Ok. In that case we'll leave things as is. Thanks for answering so quickly!
created_at: 2025-03-09T09:24:00Z
author_association: CONTRIBUTOR

PR comments:
user: login: saz
created_at: 2025-03-07T18:08:35Z
body: @ju5t I know it's a big PR, but would be happy if you can have a look at it.
author_association: MEMBER
user: login: ju5t
created_at: 2025-03-09T09:25:29Z
body: @saz I fixed the merge conflict. This happened because I merged your PR for `apt::pin` earlier this morning. 
author_association: CONTRIBUTOR