diff --git a/manifests/config.pp b/manifests/config.pp
index bb55566..01ce28e 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -1,297 +1,299 @@
 # @summary Manage NGINX bootstrap and configuration
 # @api private
 class nginx::config {
   assert_private()
 
   $client_body_temp_path          = $nginx::client_body_temp_path
   $confd_only                     = $nginx::confd_only
   $confd_purge                    = $nginx::confd_purge
   $conf_dir                       = $nginx::conf_dir
   $daemon                         = $nginx::daemon
   $daemon_user                    = $nginx::daemon_user
   $daemon_group                   = $nginx::daemon_group
   $dynamic_modules                = $nginx::dynamic_modules
   $global_owner                   = $nginx::global_owner
   $global_group                   = $nginx::global_group
   $global_mode                    = $nginx::global_mode
   $limit_req_zone                 = $nginx::limit_req_zone
   $log_dir                        = $nginx::log_dir
   $log_user                       = $nginx::log_user
   $log_group                      = $nginx::log_group
   $log_mode                       = $nginx::log_mode
   $http_access_log                = $nginx::http_access_log
   $http_format_log                = $nginx::http_format_log
   $nginx_error_log                = $nginx::nginx_error_log
   $nginx_error_log_severity       = $nginx::nginx_error_log_severity
   $pid                            = $nginx::pid
   $proxy_temp_path                = $nginx::proxy_temp_path
   $root_group                     = $nginx::root_group
   $run_dir                        = $nginx::run_dir
   $sites_available_owner          = $nginx::sites_available_owner
   $sites_available_group          = $nginx::sites_available_group
   $sites_available_mode           = $nginx::sites_available_mode
   $super_user                     = $nginx::super_user
   $temp_dir                       = $nginx::temp_dir
   $server_purge                   = $nginx::server_purge
   $absolute_redirect              = $nginx::absolute_redirect
   $accept_mutex                   = $nginx::accept_mutex
   $accept_mutex_delay             = $nginx::accept_mutex_delay
   $client_body_buffer_size        = $nginx::client_body_buffer_size
   $client_max_body_size           = $nginx::client_max_body_size
   $client_body_timeout            = $nginx::client_body_timeout
   $send_timeout                   = $nginx::send_timeout
   $lingering_timeout              = $nginx::lingering_timeout
   $lingering_close                = $nginx::lingering_close
   $lingering_time                 = $nginx::lingering_time
   $etag                           = $nginx::etag
   $events_use                     = $nginx::events_use
   $debug_connections              = $nginx::debug_connections
   $fastcgi_cache_inactive         = $nginx::fastcgi_cache_inactive
   $fastcgi_cache_key              = $nginx::fastcgi_cache_key
   $fastcgi_cache_keys_zone        = $nginx::fastcgi_cache_keys_zone
   $fastcgi_cache_levels           = $nginx::fastcgi_cache_levels
   $fastcgi_cache_max_size         = $nginx::fastcgi_cache_max_size
   $fastcgi_cache_path             = $nginx::fastcgi_cache_path
   $fastcgi_cache_use_stale        = $nginx::fastcgi_cache_use_stale
   $gzip                           = $nginx::gzip
   $gzip_buffers                   = $nginx::gzip_buffers
   $gzip_comp_level                = $nginx::gzip_comp_level
   $gzip_disable                   = $nginx::gzip_disable
   $gzip_min_length                = $nginx::gzip_min_length
   $gzip_http_version              = $nginx::gzip_http_version
   $gzip_proxied                   = $nginx::gzip_proxied
   $gzip_types                     = $nginx::gzip_types
   $gzip_vary                      = $nginx::gzip_vary
   $gzip_static                    = $nginx::gzip_static
   $http_raw_prepend               = $nginx::http_raw_prepend
   $http_raw_append                = $nginx::http_raw_append
   $http_cfg_prepend               = $nginx::http_cfg_prepend
   $http_cfg_append                = $nginx::http_cfg_append
   $http_tcp_nodelay               = $nginx::http_tcp_nodelay
   $http_tcp_nopush                = $nginx::http_tcp_nopush
   $keepalive_timeout              = $nginx::keepalive_timeout
   $keepalive_requests             = $nginx::keepalive_requests
   $log_format                     = $nginx::log_format
   $mail                           = $nginx::mail
   $mime_types_path                = $nginx::mime_types_path
   $stream                         = $nginx::stream
   $mime_types                     = $nginx::mime_types_preserve_defaults ? {
     true    => merge($nginx::params::mime_types,$nginx::mime_types),
     default => $nginx::mime_types,
   }
   $multi_accept                   = $nginx::multi_accept
   $names_hash_bucket_size         = $nginx::names_hash_bucket_size
   $names_hash_max_size            = $nginx::names_hash_max_size
   $nginx_cfg_prepend              = $nginx::nginx_cfg_prepend
   $proxy_buffers                  = $nginx::proxy_buffers
   $proxy_buffer_size              = $nginx::proxy_buffer_size
   $proxy_busy_buffers_size        = $nginx::proxy_busy_buffers_size
   $proxy_cache_inactive           = $nginx::proxy_cache_inactive
   $proxy_cache_keys_zone          = $nginx::proxy_cache_keys_zone
   $proxy_cache_levels             = $nginx::proxy_cache_levels
   $proxy_cache_max_size           = $nginx::proxy_cache_max_size
   $proxy_cache_path               = $nginx::proxy_cache_path
   $proxy_cache_loader_files       = $nginx::proxy_cache_loader_files
   $proxy_cache_loader_sleep       = $nginx::proxy_cache_loader_sleep
   $proxy_cache_loader_threshold   = $nginx::proxy_cache_loader_threshold
   $proxy_use_temp_path            = $nginx::proxy_use_temp_path
   $proxy_connect_timeout          = $nginx::proxy_connect_timeout
   $proxy_headers_hash_bucket_size = $nginx::proxy_headers_hash_bucket_size
   $proxy_http_version             = $nginx::proxy_http_version
   $proxy_max_temp_file_size       = $nginx::proxy_max_temp_file_size
   $proxy_read_timeout             = $nginx::proxy_read_timeout
   $proxy_redirect                 = $nginx::proxy_redirect
   $proxy_send_timeout             = $nginx::proxy_send_timeout
   $proxy_set_header               = $nginx::proxy_set_header
   $proxy_hide_header              = $nginx::proxy_hide_header
   $proxy_pass_header              = $nginx::proxy_pass_header
   $sendfile                       = $nginx::sendfile
   $server_tokens                  = $nginx::server_tokens
   $spdy                           = $nginx::spdy
   $http2                          = $nginx::http2
   $ssl_buffer_size                = $nginx::ssl_buffer_size
   $ssl_ciphers                    = $nginx::ssl_ciphers
   $ssl_crl                        = $nginx::ssl_crl
   $ssl_dhparam                    = $nginx::ssl_dhparam
   $ssl_ecdh_curve                 = $nginx::ssl_ecdh_curve
   $ssl_session_cache              = $nginx::ssl_session_cache
   $ssl_session_timeout            = $nginx::ssl_session_timeout
   $ssl_session_tickets            = $nginx::ssl_session_tickets
   $ssl_session_ticket_key         = $nginx::ssl_session_ticket_key
   $ssl_stapling                   = $nginx::ssl_stapling
   $ssl_stapling_file              = $nginx::ssl_stapling_file
   $ssl_stapling_responder         = $nginx::ssl_stapling_responder
   $ssl_stapling_verify            = $nginx::ssl_stapling_verify
   $ssl_trusted_certificate        = $nginx::ssl_trusted_certificate
   $ssl_password_file              = $nginx::ssl_password_file
   $ssl_prefer_server_ciphers      = $nginx::ssl_prefer_server_ciphers
   $ssl_protocols                  = $nginx::ssl_protocols
   $ssl_verify_depth               = $nginx::ssl_verify_depth
   $types_hash_bucket_size         = $nginx::types_hash_bucket_size
   $types_hash_max_size            = $nginx::types_hash_max_size
   $worker_connections             = $nginx::worker_connections
   $worker_processes               = $nginx::worker_processes
   $worker_rlimit_nofile           = $nginx::worker_rlimit_nofile
   $include_modules_enabled        = $nginx::include_modules_enabled
 
   # Non-configurable settings
   $conf_template                  = 'nginx/conf.d/nginx.conf.erb'
   $mime_template                  = 'nginx/conf.d/mime.types.epp'
   $proxy_conf_template            = undef
 
   File {
     owner => $global_owner,
     group => $global_group,
     mode  => $global_mode,
   }
 
   file { $conf_dir:
     ensure => directory,
   }
 
   file { "${conf_dir}/conf.stream.d":
     ensure => directory,
   }
 
   file { "${conf_dir}/conf.d":
     ensure => directory,
   }
 
   if $confd_purge {
     # Err on the side of caution - make sure *both* $server_purge and
     # $confd_purge are set if $confd_only is set, before purging files
     # ${conf_dir}/conf.d
     if (($confd_only and $server_purge) or !$confd_only) {
       File["${conf_dir}/conf.d"] {
         purge   => true,
         recurse => true,
         notify  => Class['nginx::service'],
       }
 
       File["${conf_dir}/conf.stream.d"] {
         purge   => true,
         recurse => true,
         notify  => Class['nginx::service'],
       }
     }
   }
 
   file { "${conf_dir}/conf.mail.d":
     ensure => directory,
   }
 
   if $confd_purge == true {
     File["${conf_dir}/conf.mail.d"] {
       purge   => true,
       recurse => true,
     }
   }
 
   file { $run_dir:
     ensure => directory,
     mode   => '0644',
   }
 
   if $nginx::manage_snippets_dir {
     file { $nginx::snippets_dir:
       ensure => directory,
     }
   }
 
   file { $log_dir:
     ensure => directory,
     mode   => $log_mode,
     owner  => $log_user,
     group  => $log_group,
   }
 
   if $client_body_temp_path {
     file { $client_body_temp_path:
       ensure => directory,
       owner  => $daemon_user,
+      mode   => '0700',
     }
   }
 
   if $proxy_temp_path {
     file { $proxy_temp_path:
       ensure => directory,
       owner  => $daemon_user,
+      mode   => '0700',
     }
   }
 
   unless $confd_only {
     file { "${conf_dir}/sites-available":
       ensure => directory,
       owner  => $sites_available_owner,
       group  => $sites_available_group,
       mode   => $sites_available_mode,
     }
 
     file { "${conf_dir}/sites-enabled":
       ensure => directory,
       owner  => $sites_available_owner,
       group  => $sites_available_group,
       mode   => $sites_available_mode,
     }
 
     if $server_purge {
       File["${conf_dir}/sites-available"] {
         purge   => true,
         recurse => true,
       }
 
       File["${conf_dir}/sites-enabled"] {
         purge   => true,
         recurse => true,
       }
     }
 
     # No real reason not to make these even if $stream is not enabled.
     file { "${conf_dir}/streams-enabled":
       ensure => directory,
       owner  => $sites_available_owner,
       group  => $sites_available_group,
       mode   => $sites_available_mode,
     }
 
     file { "${conf_dir}/streams-available":
       ensure => directory,
       owner  => $sites_available_owner,
       group  => $sites_available_group,
       mode   => $sites_available_mode,
     }
 
     if $server_purge {
       File["${conf_dir}/streams-enabled"] {
         purge   => true,
         recurse => true,
       }
     }
   }
 
   file { "${conf_dir}/nginx.conf":
     ensure  => file,
     content => template($conf_template),
     tag     => 'nginx_config_file',
   }
 
   file { "${conf_dir}/mime.types":
     ensure  => file,
     content => epp($mime_template),
     tag     => 'nginx_config_file',
   }
 
   file { "${temp_dir}/nginx.d":
     ensure  => absent,
     purge   => true,
     recurse => true,
     force   => true,
   }
 
   file { "${temp_dir}/nginx.mail.d":
     ensure  => absent,
     purge   => true,
     recurse => true,
     force   => true,
   }
 }
diff --git a/spec/classes/nginx_spec.rb b/spec/classes/nginx_spec.rb
index 20877b1..d01dc0a 100644
--- a/spec/classes/nginx_spec.rb
+++ b/spec/classes/nginx_spec.rb
@@ -1,1510 +1,1510 @@
 require 'spec_helper'
 
 describe 'nginx' do
   on_supported_os.each do |os, facts|
     context "on #{os} with Facter #{facts[:facterversion]} and Puppet #{facts[:puppetversion]}" do
       let(:facts) do
         facts
       end
 
       let :params do
         {
           nginx_upstreams: { 'upstream1' => { 'members' => { 'localhost' => { 'port' => 3000 } } } },
           nginx_servers: { 'test2.local' => { 'www_root' => '/' } },
           nginx_servers_defaults: { 'listen_options' => 'default_server' },
           nginx_locations: { 'test2.local' => { 'server' => 'test2.local', 'www_root' => '/' } },
           nginx_locations_defaults: { 'expires' => '@12h34m' },
           nginx_mailhosts: { 'smtp.test2.local' => { 'auth_http' => 'server2.example/cgi-bin/auth', 'protocol' => 'smtp', 'listen_port' => 587 } },
           nginx_mailhosts_defaults: { 'listen_options' => 'default_server_smtp' },
           nginx_streamhosts: { 'streamhost1' => { 'proxy' => 'streamproxy' } }
         }
       end
 
       describe 'with defaults' do
         it { is_expected.to compile.with_all_deps }
         it { is_expected.to contain_class('nginx') }
         it { is_expected.to contain_class('nginx::config').that_requires('Class[nginx::package]') }
         it { is_expected.to contain_class('nginx::service').that_subscribes_to('Class[nginx::package]') }
         it { is_expected.to contain_class('nginx::service').that_subscribes_to('Class[nginx::config]') }
         it { is_expected.to contain_nginx__resource__upstream('upstream1') }
         it { is_expected.to contain_nginx__resource__server('test2.local') }
         it { is_expected.to contain_nginx__resource__server('test2.local').with_listen_options('default_server') }
         it { is_expected.to contain_nginx__resource__location('test2.local') }
         it { is_expected.to contain_nginx__resource__location('test2.local').with_expires('@12h34m') }
         it { is_expected.to contain_nginx__resource__mailhost('smtp.test2.local') }
         it { is_expected.to contain_nginx__resource__mailhost('smtp.test2.local').with_listen_options('default_server_smtp') }
         it { is_expected.to contain_nginx__resource__streamhost('streamhost1').with_proxy('streamproxy') }
       end
 
       context 'nginx::package' do
         case facts[:osfamily]
         when 'RedHat'
           context 'using defaults' do
             it { is_expected.to contain_package('nginx') }
             it do
               is_expected.to contain_yumrepo('nginx-release').with(
                 'baseurl'  => "https://nginx.org/packages/#{%w[CentOS VirtuozzoLinux].include?(facts[:operatingsystem]) ? 'centos' : 'rhel'}/#{facts[:operatingsystemmajrelease]}/$basearch/",
                 'descr'    => 'nginx repo',
                 'enabled'  => '1',
                 'gpgcheck' => '1',
                 'priority' => '1',
                 'gpgkey'   => 'https://nginx.org/keys/nginx_signing.key'
               )
             end
             it do
               is_expected.to contain_yumrepo('passenger').with(
                 'ensure' => 'absent'
               )
             end
             it { is_expected.to contain_yumrepo('nginx-release').that_comes_before('Package[nginx]') }
             it { is_expected.to contain_yumrepo('passenger').that_comes_before('Package[nginx]') }
           end
 
           context 'using default repo without passenger' do
             let(:params) { { purge_passenger_repo: false } }
 
             it { is_expected.to contain_package('nginx') }
             it do
               is_expected.to contain_yumrepo('nginx-release').with(
                 'baseurl'  => "https://nginx.org/packages/#{%w[CentOS VirtuozzoLinux].include?(facts[:operatingsystem]) ? 'centos' : 'rhel'}/#{facts[:operatingsystemmajrelease]}/$basearch/",
                 'descr'    => 'nginx repo',
                 'enabled'  => '1',
                 'gpgcheck' => '1',
                 'priority' => '1',
                 'gpgkey'   => 'https://nginx.org/keys/nginx_signing.key'
               )
             end
 
             it { is_expected.not_to contain_yumrepo('passenger') }
           end
 
           context 'package_source => nginx-mainline' do
             let(:params) { { package_source: 'nginx-mainline' } }
 
             it do
               is_expected.to contain_yumrepo('nginx-release').with(
                 'baseurl' => "https://nginx.org/packages/mainline/#{%w[CentOS VirtuozzoLinux].include?(facts[:operatingsystem]) ? 'centos' : 'rhel'}/#{facts[:operatingsystemmajrelease]}/$basearch/"
               )
             end
             it do
               is_expected.to contain_yumrepo('passenger').with(
                 'ensure' => 'absent'
               )
             end
             it { is_expected.to contain_yumrepo('nginx-release').that_comes_before('Package[nginx]') }
             it { is_expected.to contain_yumrepo('passenger').that_comes_before('Package[nginx]') }
           end
 
           context 'package_source => passenger' do
             let(:params) { { package_source: 'passenger' } }
 
             it do
               is_expected.to contain_yumrepo('passenger').with(
                 'baseurl'       => "https://oss-binaries.phusionpassenger.com/yum/passenger/el/#{facts[:operatingsystemmajrelease]}/$basearch",
                 'gpgcheck'      => '0',
                 'repo_gpgcheck' => '1',
                 'gpgkey'        => 'https://oss-binaries.phusionpassenger.com/auto-software-signing-gpg-key.txt'
               )
             end
             it do
               is_expected.to contain_yumrepo('nginx-release').with(
                 'ensure' => 'absent'
               )
             end
             it { is_expected.to contain_yumrepo('passenger').that_comes_before('Package[nginx]') }
             it { is_expected.to contain_yumrepo('nginx-release').that_comes_before('Package[nginx]') }
             it { is_expected.to contain_package('passenger').with('ensure' => 'present') }
           end
 
           describe 'installs the requested passenger package version' do
             let(:params) { { package_source: 'passenger', passenger_package_ensure: '4.1.0-1.el9' } }
 
             it 'installs specified version exactly' do
               is_expected.to contain_package('passenger').with('ensure' => '4.1.0-1.el9')
             end
           end
 
           context 'manage_repo => false' do
             let(:params) { { manage_repo: false } }
 
             it { is_expected.to contain_package('nginx') }
             it { is_expected.not_to contain_yumrepo('nginx-release') }
           end
 
           describe 'installs the requested package version' do
             let(:params) { { package_ensure: '3.0.0' } }
 
             it 'installs 3.0.0 exactly' do
               is_expected.to contain_package('nginx').with('ensure' => '3.0.0')
             end
           end
 
         when 'Debian'
           context 'using defaults' do
             it { is_expected.to contain_package('nginx') }
             it { is_expected.not_to contain_package('passenger') }
             it do
               is_expected.to contain_apt__source('nginx').with(
                 'location'   => "https://nginx.org/packages/#{facts[:operatingsystem].downcase}",
                 'repos'      => 'nginx',
                 'key' => { 'id' => '573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62' }
               )
             end
           end
 
           context 'repo_source' do
             let(:params) { { repo_source: 'https://example.com/nginx' } }
 
             it do
               is_expected.to contain_apt__source('nginx').with(
                 'location' => 'https://example.com/nginx'
               )
             end
           end
 
           context 'package_source => nginx-mainline' do
             let(:params) { { package_source: 'nginx-mainline' } }
 
             it do
               is_expected.to contain_apt__source('nginx').with(
                 'location' => "https://nginx.org/packages/mainline/#{facts[:operatingsystem].downcase}"
               )
             end
           end
 
           context "package_source => 'passenger'" do
             let(:params) { { package_source: 'passenger' } }
 
             it { is_expected.to contain_package('nginx') }
             if facts[:lsbdistid] == 'Debian' && %w[9 10].include?(facts.dig(:os, 'release', 'major')) ||
                facts[:lsbdistid] == 'Ubuntu' && %w[bionic focal].include?(facts[:lsbdistcodename])
               it { is_expected.to contain_package('libnginx-mod-http-passenger') }
             else
               it { is_expected.to contain_package('passenger') }
             end
             it do
               is_expected.to contain_apt__source('nginx').with(
                 'location'   => 'https://oss-binaries.phusionpassenger.com/apt/passenger',
                 'repos'      => 'main',
                 'key'        => { 'id' => '16378A33A6EF16762922526E561F9B9CAC40B2F7' }
               )
             end
           end
 
           context 'manage_repo => false' do
             let(:params) { { manage_repo: false } }
 
             it { is_expected.to contain_package('nginx') }
             it { is_expected.not_to contain_apt__source('nginx') }
             it { is_expected.not_to contain_package('passenger') }
           end
         when 'Archlinux'
           context 'using defaults' do
             it { is_expected.to contain_package('nginx-mainline') }
           end
         else
           it { is_expected.to contain_package('nginx') }
         end
       end
 
       context 'nginx::service' do
         let :params do
           {
             service_ensure: 'running',
             service_enable: true,
             service_name: 'nginx',
             service_manage: true
           }
         end
 
         context 'using default parameters' do
           it do
             is_expected.to contain_service('nginx').with(
               ensure: 'running',
               enable: true
             )
           end
 
           it { is_expected.to contain_service('nginx').without_restart }
         end
 
         context "when service_restart => 'a restart command'" do
           let :params do
             {
               service_restart: 'a restart command',
               service_ensure: 'running',
               service_enable: true,
               service_name: 'nginx'
             }
           end
 
           it { is_expected.to contain_service('nginx').with_restart('a restart command') }
         end
 
         describe "when service_name => 'nginx14" do
           let :params do
             {
               service_name: 'nginx14'
             }
           end
 
           it { is_expected.to contain_service('nginx14') }
         end
 
         describe 'when service_manage => false' do
           let :params do
             {
               service_manage: false
             }
           end
 
           it { is_expected.not_to contain_service('nginx') }
         end
       end
 
       # nginx::config
       context 'nginx::config' do
         context 'with defaults' do
           it do
             is_expected.to contain_file('/etc/nginx').only_with(
               path: '/etc/nginx',
               ensure: 'directory',
               owner: 'root',
               group: 'root',
               mode: '0644'
             )
           end
           it do
             is_expected.to contain_file('/etc/nginx/conf.d').only_with(
               path: '/etc/nginx/conf.d',
               ensure: 'directory',
               owner: 'root',
               group: 'root',
               mode: '0644'
             )
           end
           it do
             is_expected.to contain_file('/etc/nginx/conf.stream.d').only_with(
               path: '/etc/nginx/conf.stream.d',
               ensure: 'directory',
               owner: 'root',
               group: 'root',
               mode: '0644'
             )
           end
           it do
             is_expected.to contain_file('/etc/nginx/conf.mail.d').only_with(
               path: '/etc/nginx/conf.mail.d',
               ensure: 'directory',
               owner: 'root',
               group: 'root',
               mode: '0644'
             )
           end
           it do
             case facts[:osfamily]
             when 'Debian'
               is_expected.to contain_file('/run/nginx').with(
                 ensure: 'directory',
                 owner: 'root',
                 group: 'root',
                 mode: '0644'
               )
             else
               is_expected.to contain_file('/var/nginx').with(
                 ensure: 'directory',
                 owner: 'root',
                 group: 'root',
                 mode: '0644'
               )
             end
           end
           it do
             case facts[:osfamily]
             when 'Debian'
               is_expected.to contain_file('/run/nginx/client_body_temp').with(
                 ensure: 'directory',
                 group: 'root',
-                mode: '0644'
+                mode: '0700'
               )
             else
               is_expected.to contain_file('/var/nginx/client_body_temp').with(
                 ensure: 'directory',
                 group: 'root',
-                mode: '0644'
+                mode: '0700'
               )
             end
           end
           it do
             case facts[:osfamily]
             when 'Debian'
               is_expected.to contain_file('/run/nginx/proxy_temp').with(
                 ensure: 'directory',
                 group: 'root',
-                mode: '0644'
+                mode: '0700'
               )
             else
               is_expected.to contain_file('/var/nginx/proxy_temp').with(
                 ensure: 'directory',
                 group: 'root',
-                mode: '0644'
+                mode: '0700'
               )
             end
           end
           it do
             is_expected.to contain_file('/etc/nginx/nginx.conf').with(
               ensure: 'file',
               owner: 'root',
               group: 'root',
               mode: '0644'
             )
           end
           it do
             is_expected.to contain_file('/etc/nginx/mime.types').with(
               ensure: 'file',
               owner: 'root',
               group: 'root',
               mode: '0644'
             )
           end
           it do
             is_expected.to contain_file('/tmp/nginx.d').with(
               ensure: 'absent',
               purge: true,
               recurse: true
             )
           end
           it do
             is_expected.to contain_file('/tmp/nginx.mail.d').with(
               ensure: 'absent',
               purge: true,
               recurse: true
             )
           end
           case facts[:osfamily]
           when 'RedHat'
             it { is_expected.to contain_file('/var/nginx/client_body_temp').with(owner: 'nginx') }
             it { is_expected.to contain_file('/var/nginx/proxy_temp').with(owner: 'nginx') }
             it { is_expected.to contain_file('/etc/nginx/nginx.conf').with_content %r{^user nginx;} }
             it do
               is_expected.to contain_file('/var/log/nginx').with(
                 ensure: 'directory',
                 owner: 'nginx',
                 group: 'nginx',
                 mode: '0750'
               )
             end
           when 'Debian'
             it { is_expected.to contain_file('/run/nginx/client_body_temp').with(owner: 'www-data') }
             it { is_expected.to contain_file('/run/nginx/proxy_temp').with(owner: 'www-data') }
             it { is_expected.to contain_file('/etc/nginx/nginx.conf').with_content %r{^user www-data;} }
             it do
               is_expected.to contain_file('/var/log/nginx').with(
                 ensure: 'directory',
                 owner: 'root',
                 group: 'adm',
                 mode: '0755'
               )
             end
           end
 
           describe 'nginx.conf template content' do
             [
               {
                 title: 'should not set load_module',
                 attr: 'dynamic_modules',
                 value: :undef,
                 notmatch: %r{load_module}
               },
               {
                 title: 'should not set user',
                 attr: 'super_user',
                 value: false,
                 notmatch: %r{user}
               },
               {
                 title: 'should not set group',
                 attr: 'daemon_group',
                 value: :undef,
                 notmatch: %r{^user \S+ \S+;}
               },
               {
                 title: 'should set user',
                 attr: 'daemon_user',
                 value: 'test-user',
                 match: 'user test-user;'
               },
               {
                 title: 'should not set daemon',
                 attr: 'daemon',
                 value: :undef,
                 notmatch: %r{^\s*daemon\s+}
               },
               {
                 title: 'should set daemon on',
                 attr: 'daemon',
                 value: 'on',
                 match: %r{^daemon\s+on;$}
               },
               {
                 title: 'should set daemon off',
                 attr: 'daemon',
                 value: 'off',
                 match: %r{^daemon\s+off;$}
               },
               {
                 title: 'should set worker_processes',
                 attr: 'worker_processes',
                 value: 4,
                 match: 'worker_processes 4;'
               },
               {
                 title: 'should set worker_processes',
                 attr: 'worker_processes',
                 value: 'auto',
                 match: 'worker_processes auto;'
               },
               {
                 title: 'should set worker_rlimit_nofile',
                 attr: 'worker_rlimit_nofile',
                 value: 10_000,
                 match: 'worker_rlimit_nofile 10000;'
               },
               {
                 title: 'should set error_log',
                 attr: 'nginx_error_log',
                 value: '/path/to/error.log',
                 match: '  error_log /path/to/error.log error;'
               },
               {
                 title: 'should set multiple error_logs',
                 attr: 'nginx_error_log',
                 value: ['/path/to/error.log', 'syslog:server=localhost'],
                 match: [
                   '  error_log /path/to/error.log error;',
                   '  error_log syslog:server=localhost error;'
                 ]
               },
               {
                 title: 'should set error_log severity level',
                 attr: 'nginx_error_log_severity',
                 value: 'warn',
                 match: '  error_log /var/log/nginx/error.log warn;'
               },
               {
                 title: 'should set limit_req_zone',
                 attr: 'limit_req_zone',
                 value: [
                   '$binary_remote_addr zone=myzone1:10m rate=5r/s',
                   '$binary_remote_addr zone=myzone2:10m rate=5r/s'
                 ],
                 match: [
                   '  limit_req_zone $binary_remote_addr zone=myzone1:10m rate=5r/s;',
                   '  limit_req_zone $binary_remote_addr zone=myzone2:10m rate=5r/s;'
                 ]
               },
               {
                 title: 'should set pid',
                 attr: 'pid',
                 value: '/path/to/pid',
                 match: 'pid        /path/to/pid;'
               },
               {
                 title: 'should not set pid',
                 attr: 'pid',
                 value: false,
                 notmatch: %r{pid}
               },
               {
                 title: 'should not set absolute_redirect',
                 attr: 'absolute_redirect',
                 value: :undef,
                 notmatch: %r{absolute_redirect}
               },
               {
                 title: 'should set absolute_redirect off',
                 attr: 'absolute_redirect',
                 value: 'off',
                 match: '  absolute_redirect off;'
               },
               {
                 title: 'should set accept_mutex on',
                 attr: 'accept_mutex',
                 value: 'on',
                 match: '  accept_mutex on;'
               },
               {
                 title: 'should set accept_mutex off',
                 attr: 'accept_mutex',
                 value: 'off',
                 match: '  accept_mutex off;'
               },
               {
                 title: 'should set accept_mutex_delay',
                 attr: 'accept_mutex_delay',
                 value: '500s',
                 match: '  accept_mutex_delay 500s;'
               },
               {
                 title: 'should set worker_connections',
                 attr: 'worker_connections',
                 value: 100,
                 match: '  worker_connections 100;'
               },
               {
                 title: 'should set log formats',
                 attr: 'log_format',
                 value: {
                   'format1' => 'FORMAT1',
                   'format2' => 'FORMAT2'
                 },
                 match: [
                   '  log_format format1 \'FORMAT1\';',
                   '  log_format format2 \'FORMAT2\';'
                 ]
               },
               {
                 title: 'should not set log formats',
                 attr: 'log_format',
                 value: {},
                 notmatch: %r{log_format}
               },
               {
                 title: 'should set multi_accept',
                 attr: 'multi_accept',
                 value: 'on',
                 match: %r{\s*multi_accept\s+on;}
               },
               {
                 title: 'should not set multi_accept',
                 attr: 'multi_accept',
                 value: 'off',
                 notmatch: %r{multi_accept}
               },
               {
                 title: 'should set etag',
                 attr: 'etag',
                 value: 'off',
                 match: '  etag off;'
               },
               {
                 title: 'should set events_use',
                 attr: 'events_use',
                 value: 'eventport',
                 match: %r{\s*use\s+eventport;}
               },
               {
                 title: 'should set access_log',
                 attr: 'http_access_log',
                 value: '/path/to/access.log',
                 match: '  access_log /path/to/access.log;'
               },
               {
                 title: 'should set multiple access_logs',
                 attr: 'http_access_log',
                 value: ['/path/to/access.log', 'syslog:server=localhost'],
                 match: [
                   '  access_log /path/to/access.log;',
                   '  access_log syslog:server=localhost;'
                 ]
               },
               {
                 title: 'should set custom log format',
                 attr: 'http_format_log',
                 value: 'mycustomformat',
                 match: '  access_log /var/log/nginx/access.log mycustomformat;'
               },
               {
                 title: 'should set sendfile',
                 attr: 'sendfile',
                 value: 'on',
                 match: '  sendfile on;'
               },
               {
                 title: 'should not set sendfile',
                 attr: 'sendfile',
                 value: 'off',
                 notmatch: %r{sendfile}
               },
               {
                 title: 'should set server_tokens',
                 attr: 'server_tokens',
                 value: 'on',
                 match: '  server_tokens on;'
               },
               {
                 title: 'should set types_hash_max_size',
                 attr: 'types_hash_max_size',
                 value: 10,
                 match: '  types_hash_max_size 10;'
               },
               {
                 title: 'should set types_hash_bucket_size',
                 attr: 'types_hash_bucket_size',
                 value: 10,
                 match: '  types_hash_bucket_size 10;'
               },
               {
                 title: 'should set server_names_hash_bucket_size',
                 attr: 'names_hash_bucket_size',
                 value: 10,
                 match: '  server_names_hash_bucket_size 10;'
               },
               {
                 title: 'should set server_names_hash_max_size',
                 attr: 'names_hash_max_size',
                 value: 10,
                 match: '  server_names_hash_max_size 10;'
               },
               {
                 title: 'should set keepalive_timeout',
                 attr: 'keepalive_timeout',
                 value: '123',
                 match: '  keepalive_timeout   123;'
               },
               {
                 title: 'should set keepalive_requests',
                 attr: 'keepalive_requests',
                 value: '345',
                 match: '  keepalive_requests  345;'
               },
               {
                 title: 'should set client_body_timeout',
                 attr: 'client_body_timeout',
                 value: '888',
                 match: '  client_body_timeout 888;'
               },
               {
                 title: 'should set send_timeout',
                 attr: 'send_timeout',
                 value: '963',
                 match: '  send_timeout        963;'
               },
               {
                 title: 'should set lingering_close',
                 attr: 'lingering_close',
                 value: 'always',
                 match: '  lingering_close      always;'
               },
               {
                 title: 'should set lingering_time',
                 attr: 'lingering_time',
                 value: '30s',
                 match: '  lingering_time      30s;'
               },
               {
                 title: 'should set lingering_timeout',
                 attr: 'lingering_timeout',
                 value: '385',
                 match: '  lingering_timeout   385;'
               },
               {
                 title: 'should set tcp_nodelay',
                 attr: 'http_tcp_nodelay',
                 value: 'on',
                 match: '  tcp_nodelay         on;'
               },
               {
                 title: 'should set tcp_nopush',
                 attr: 'http_tcp_nopush',
                 value: 'on',
                 match: '  tcp_nopush on;'
               },
               {
                 title: 'should not set gzip',
                 attr: 'gzip',
                 value: 'off',
                 notmatch: %r{gzip}
               },
               {
                 title: 'should set proxy_cache_path',
                 attr: 'proxy_cache_path',
                 value: '/path/to/proxy.cache',
                 match: %r{\s+proxy_cache_path\s+/path/to/proxy.cache levels=1 keys_zone=d2:100m max_size=500m inactive=20m;}
               },
               {
                 title: 'should set fastcgi_cache_path',
                 attr: 'fastcgi_cache_path',
                 value: '/path/to/proxy.cache',
                 match: %r{\s*fastcgi_cache_path\s+/path/to/proxy.cache levels=1 keys_zone=d3:100m max_size=500m inactive=20m;}
               },
               {
                 title: 'should set fastcgi_cache_use_stale',
                 attr: 'fastcgi_cache_use_stale',
                 value: 'invalid_header',
                 match: '  fastcgi_cache_use_stale invalid_header;'
               },
               {
                 title: 'should contain http_raw_prepend directives',
                 attr: 'http_raw_prepend',
                 value: [
                   'if (a) {',
                   '  b;',
                   '}'
                 ],
                 match: %r{^\s+if \(a\) \{\n\s++b;\n\s+\}}
               },
               {
                 title: 'should contain ordered appended directives from hash',
                 attr: 'http_cfg_prepend',
                 value: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'allow' => 'test value 3' },
                 match: [
                   '  allow test value 3;',
                   '  test1 test value 1;',
                   '  test2 test value 2;'
                 ]
               },
               {
                 title: 'should contain duplicate appended directives from list of hashes',
                 attr: 'http_cfg_prepend',
                 value: [['allow', 'test value 1'], ['allow', 'test value 2']],
                 match: [
                   '  allow test value 1;',
                   '  allow test value 2;'
                 ]
               },
               {
                 title: 'should contain duplicate appended directives from array values',
                 attr: 'http_cfg_prepend',
                 value: { 'test1' => ['test value 1', 'test value 2', 'test value 3'] },
                 match: [
                   '  test1 test value 1;',
                   '  test1 test value 2;'
                 ]
               },
               {
                 title: 'should contain http_raw_append directives',
                 attr: 'http_raw_append',
                 value: [
                   'if (a) {',
                   '  b;',
                   '}'
                 ],
                 match: %r{^\s+if \(a\) \{\n\s++b;\n\s+\}}
               },
               {
                 title: 'should contain ordered appended directives from hash',
                 attr: 'http_cfg_append',
                 value: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'allow' => 'test value 3' },
                 match: [
                   '  allow test value 3;',
                   '  test1 test value 1;',
                   '  test2 test value 2;'
                 ]
               },
               {
                 title: 'should contain duplicate appended directives from list of hashes',
                 attr: 'http_cfg_append',
                 value: [['allow', 'test value 1'], ['allow', 'test value 2']],
                 match: [
                   '  allow test value 1;',
                   '  allow test value 2;'
                 ]
               },
               {
                 title: 'should contain duplicate appended directives from array values',
                 attr: 'http_cfg_append',
                 value: { 'test1' => ['test value 1', 'test value 2', 'test value 3'] },
                 match: [
                   '  test1 test value 1;',
                   '  test1 test value 2;'
                 ]
               },
               {
                 title: 'should contain ordered appended directives from hash',
                 attr: 'nginx_cfg_prepend',
                 value: { 'test1' => 'test value 1', 'test2' => 'test value 2', 'allow' => 'test value 3' },
                 match: [
                   'allow test value 3;',
                   'test1 test value 1;',
                   'test2 test value 2;'
                 ]
               },
               {
                 title: 'should contain duplicate appended directives from list of hashes',
                 attr: 'nginx_cfg_prepend',
                 value: [['allow', 'test value 1'], ['allow', 'test value 2']],
                 match: [
                   'allow test value 1;',
                   'allow test value 2;'
                 ]
               },
               {
                 title: 'should contain duplicate appended directives from array values',
                 attr: 'nginx_cfg_prepend',
                 value: { 'test1' => ['test value 1', 'test value 2', 'test value 3'] },
                 match: [
                   'test1 test value 1;',
                   'test1 test value 2;',
                   'test1 test value 3;'
                 ]
               },
               {
                 title: 'should set pid',
                 attr: 'pid',
                 value: '/path/to/pid',
                 match: 'pid        /path/to/pid;'
               },
               {
                 title: 'should set mail',
                 attr: 'mail',
                 value: true,
                 match: 'mail {'
               },
               {
                 title: 'should not set mail',
                 attr: 'mail',
                 value: false,
                 notmatch: %r{mail}
               },
               {
                 title: 'should set proxy_buffers',
                 attr: 'proxy_buffers',
                 value: '50 5k',
                 match: '  proxy_buffers           50 5k;'
               },
               {
                 title: 'should set proxy_buffer_size',
                 attr: 'proxy_buffer_size',
                 value: '2k',
                 match: '  proxy_buffer_size       2k;'
               },
               {
                 title: 'should set proxy_http_version',
                 attr: 'proxy_http_version',
                 value: '1.1',
                 match: '  proxy_http_version      1.1;'
               },
               {
                 title: 'should not set proxy_http_version',
                 attr: 'proxy_http_version',
                 value: nil,
                 notmatch: 'proxy_http_version'
               },
               {
                 title: 'should contain ordered appended proxy_set_header directives',
                 attr: 'proxy_set_header',
                 value: %w[header1 header2],
                 match: [
                   '  proxy_set_header        header1;',
                   '  proxy_set_header        header2;'
                 ]
               },
               {
                 title: 'should contain ordered appended proxy_hide_header directives',
                 attr: 'proxy_hide_header',
                 value: %w[header1 header2],
                 match: [
                   '  proxy_hide_header        header1;',
                   '  proxy_hide_header        header2;'
                 ]
               },
               {
                 title: 'should contain ordered appended proxy_pass_header directives',
                 attr: 'proxy_pass_header',
                 value: %w[header1 header2],
                 match: [
                   '  proxy_pass_header        header1;',
                   '  proxy_pass_header        header2;'
                 ]
               },
               {
                 title: 'should set client_body_temp_path',
                 attr: 'client_body_temp_path',
                 value: '/path/to/body_temp',
                 match: '  client_body_temp_path   /path/to/body_temp;'
               },
               {
                 title: 'should set proxy_temp_path',
                 attr: 'proxy_temp_path',
                 value: '/path/to/proxy_temp',
                 match: '  proxy_temp_path         /path/to/proxy_temp;'
               },
               {
                 title: 'should set proxy_max_temp_file_size',
                 attr: 'proxy_max_temp_file_size',
                 value: '1024m',
                 match: '  proxy_max_temp_file_size 1024m;'
               },
               {
                 title: 'should set proxy_busy_buffers_size',
                 attr: 'proxy_busy_buffers_size',
                 value: '16k',
                 match: '  proxy_busy_buffers_size 16k;'
               },
               {
                 title: 'should set ssl_stapling_verify',
                 attr: 'ssl_stapling_verify',
                 value: 'on',
                 match: '  ssl_stapling_verify       on;'
               },
               {
                 title: 'should set ssl_protocols',
                 attr: 'ssl_protocols',
                 value: 'TLSv1.2',
                 match: '  ssl_protocols             TLSv1.2;'
               },
               {
                 title: 'should set ssl_ciphers',
                 attr: 'ssl_ciphers',
                 value: 'ECDHE-ECDSA-CHACHA20-POLY1305',
                 match: '  ssl_ciphers               ECDHE-ECDSA-CHACHA20-POLY1305;'
               },
               {
                 title: 'should set ssl_dhparam',
                 attr: 'ssl_dhparam',
                 value: '/path/to/dhparam',
                 match: '  ssl_dhparam               /path/to/dhparam;'
               },
               {
                 title: 'should not set ssl_ecdh_curve',
                 attr: 'ssl_ecdh_curve',
                 value: :undef,
                 notmatch: 'ssl_ecdh_curve'
               },
               {
                 title: 'should set ssl_ecdh_curve',
                 attr: 'ssl_ecdh_curve',
                 value: 'prime256v1:secp384r1',
                 match: '  ssl_ecdh_curve            prime256v1:secp384r1;'
               },
               {
                 title: 'should set ssl_session_cache',
                 attr: 'ssl_session_cache',
                 value: 'shared:SSL:10m',
                 match: '  ssl_session_cache         shared:SSL:10m;'
               },
               {
                 title: 'should set ssl_session_timeout',
                 attr: 'ssl_session_timeout',
                 value: '5m',
                 match: '  ssl_session_timeout       5m;'
               },
               {
                 title: 'should not set ssl_session_tickets',
                 attr: 'ssl_session_tickets',
                 value: :undef,
                 notmatch: 'ssl_session_tickets'
               },
               {
                 title: 'should set ssl_session_tickets',
                 attr: 'ssl_session_tickets',
                 value: 'on',
                 match: '  ssl_session_tickets       on;'
               },
               {
                 title: 'should not set ssl_session_ticket_key',
                 attr: 'ssl_session_ticket_key',
                 value: :undef,
                 notmatch: 'ssl_session_ticket_key'
               },
               {
                 title: 'should set ssl_session_ticket_key',
                 attr: 'ssl_session_ticket_key',
                 value: '/path/to/ticket_key',
                 match: '  ssl_session_ticket_key    /path/to/ticket_key;'
               },
               {
                 title: 'should not set ssl_buffer_size',
                 attr: 'ssl_buffer_size',
                 value: :undef,
                 notmatch: 'ssl_buffer_size'
               },
               {
                 title: 'should set ssl_buffer_size',
                 attr: 'ssl_buffer_size',
                 value: '16k',
                 match: '  ssl_buffer_size           16k;'
               },
               {
                 title: 'should not set ssl_crl',
                 attr: 'ssl_crl',
                 value: :undef,
                 notmatch: 'ssl_crl'
               },
               {
                 title: 'should set ssl_crl',
                 attr: 'ssl_crl',
                 value: '/path/to/crl',
                 match: '  ssl_crl                   /path/to/crl;'
               },
               {
                 title: 'should not set ssl_stapling_file',
                 attr: 'ssl_stapling_file',
                 value: :undef,
                 notmatch: 'ssl_stapling_file'
               },
               {
                 title: 'should set ssl_stapling_file',
                 attr: 'ssl_stapling_file',
                 value: '/path/to/stapling_file',
                 match: '  ssl_stapling_file         /path/to/stapling_file;'
               },
               {
                 title: 'should not set ssl_stapling_responder',
                 attr: 'ssl_stapling_responder',
                 value: :undef,
                 notmatch: 'ssl_stapling_responder'
               },
               {
                 title: 'should set ssl_stapling_responder',
                 attr: 'ssl_stapling_responder',
                 value: 'http://stapling.responder/',
                 match: '  ssl_stapling_responder    http://stapling.responder/;'
               },
               {
                 title: 'should not set ssl_trusted_certificate',
                 attr: 'ssl_trusted_certificate',
                 value: :undef,
                 notmatch: 'ssl_trusted_certificate'
               },
               {
                 title: 'should set ssl_trusted_certificate',
                 attr: 'ssl_trusted_certificate',
                 value: '/path/to/trusted_cert',
                 match: '  ssl_trusted_certificate   /path/to/trusted_cert;'
               },
               {
                 title: 'should not set ssl_verify_depth',
                 attr: 'ssl_verify_depth',
                 value: :undef,
                 notmatch: 'ssl_verify_depth'
               },
               {
                 title: 'should set ssl_verify_depth',
                 attr: 'ssl_verify_depth',
                 value: 5,
                 match: '  ssl_verify_depth          5;'
               },
               {
                 title: 'should not set ssl_password_file',
                 attr: 'ssl_password_file',
                 value: :undef,
                 notmatch: 'ssl_password_file'
               },
               {
                 title: 'should set ssl_password_file',
                 attr: 'ssl_password_file',
                 value: '/path/to/password_file',
                 match: '  ssl_password_file         /path/to/password_file;'
               },
               {
                 title: 'should contain debug_connection directives',
                 attr: 'debug_connections',
                 value: %w[127.0.0.1 unix:],
                 match: [
                   '  debug_connection 127.0.0.1;',
                   '  debug_connection unix:;'
                 ]
               }
             ].each do |param|
               context "when #{param[:attr]} is #{param[:value]}" do
                 let(:params) { { param[:attr].to_sym => param[:value] } }
 
                 it { is_expected.to contain_file('/etc/nginx/nginx.conf').with_mode('0644') }
                 it param[:title] do
                   matches = Array(param[:match])
 
                   if matches.all? { |m| m.is_a? Regexp }
                     matches.each { |item| is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(item) }
                   else
                     lines = catalogue.resource('file', '/etc/nginx/nginx.conf').send(:parameters)[:content].split("\n")
                     expect(lines & Array(param[:match])).to eq(Array(param[:match]))
                   end
 
                   Array(param[:notmatch]).each do |item|
                     is_expected.to contain_file('/etc/nginx/nginx.conf').without_content(item)
                   end
                 end
               end
             end
           end
 
           context 'when mime.types is "[\'text/css css\']"' do
             let(:params) do
               {
                 mime_types: { 'text/css' => 'css' }
               }
             end
 
             it { is_expected.to contain_file('/etc/nginx/mime.types').with_content(%r{text/css css;}) }
           end
 
           context 'when mime.types is default' do
             it { is_expected.to contain_file('/etc/nginx/mime.types').with_content(%r{text/css css;}) }
             it { is_expected.to contain_file('/etc/nginx/mime.types').with_content(%r{audio/mpeg mp3;}) }
           end
 
           context 'when mime.types is "[\'custom/file customfile\']" and mime.types.preserve.defaults is true' do
             let(:params) do
               {
                 mime_types: { 'custom/file' => 'customfile' },
                 mime_types_preserve_defaults: true
               }
             end
 
             it { is_expected.to contain_file('/etc/nginx/mime.types').with_content(%r{audio/mpeg mp3;}) }
             it { is_expected.to contain_file('/etc/nginx/mime.types').with_content(%r{custom/file customfile;}) }
           end
 
           context 'when dynamic_modules is "[\'ngx_http_geoip_module\']" ' do
             let(:params) do
               {
                 dynamic_modules: ['ngx_http_geoip_module']
               }
             end
 
             it { is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(%r{load_module "modules/ngx_http_geoip_module.so";}) }
           end
 
           context 'when dynamic_modules is "[\'/path/to/module/ngx_http_geoip_module.so\']" ' do
             let(:params) do
               {
                 dynamic_modules: ['/path/to/module/ngx_http_geoip_module.so']
               }
             end
 
             it { is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(%r{load_module "/path/to/module/ngx_http_geoip_module.so";}) }
           end
 
           context 'when proxy_cache_path is /path/to/proxy.cache and loader_files is 1000' do
             let(:params) do
               {
                 conf_dir: '/path/to/nginx',
                 proxy_cache_path: '/path/to/proxy.cache',
                 proxy_cache_loader_files: 1000
               }
             end
 
             it { is_expected.to contain_file('/path/to/nginx/nginx.conf').with_content(%r{\s+proxy_cache_path\s+/path/to/proxy.cache levels=1 keys_zone=d2:100m max_size=500m inactive=20m loader_files=1000;}) }
           end
 
           context 'when proxy_cache_path is /path/to/nginx and loader_sleep is 50ms' do
             let(:params) { { conf_dir: '/path/to/nginx', proxy_cache_path: '/path/to/proxy.cache', proxy_cache_loader_sleep: '50ms' } }
 
             it { is_expected.to contain_file('/path/to/nginx/nginx.conf').with_content(%r{\s+proxy_cache_path\s+/path/to/proxy.cache levels=1 keys_zone=d2:100m max_size=500m inactive=20m loader_sleep=50ms;}) }
           end
 
           context 'when proxy_cache_path is /path/to/nginx and loader_threshold is 300ms' do
             let(:params) { { conf_dir: '/path/to/nginx', proxy_cache_path: '/path/to/proxy.cache', proxy_cache_loader_threshold: '300ms' } }
 
             it { is_expected.to contain_file('/path/to/nginx/nginx.conf').with_content(%r{\s+proxy_cache_path\s+/path/to/proxy.cache levels=1 keys_zone=d2:100m max_size=500m inactive=20m loader_threshold=300ms;}) }
           end
 
           context 'when conf_dir is /path/to/nginx' do
             let(:params) { { conf_dir: '/path/to/nginx' } }
 
             it { is_expected.to contain_file('/path/to/nginx/nginx.conf').with_content(%r{include       mime\.types;}) }
             it { is_expected.to contain_file('/path/to/nginx/nginx.conf').with_content(%r{include /path/to/nginx/conf\.d/\*\.conf;}) }
             it { is_expected.to contain_file('/path/to/nginx/nginx.conf').with_content(%r{include /path/to/nginx/sites-enabled/\*;}) }
           end
 
           context 'when mime_types_path is /path/to/mime.types' do
             let(:params) { { mime_types_path: '/path/to/mime.types' } }
 
             it { is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(%r{include       /path/to/mime\.types;}) }
           end
 
           context 'when confd_purge true' do
             let(:params) { { confd_purge: true } }
 
             it do
               is_expected.to contain_file('/etc/nginx/conf.d').with(
                 purge: true,
                 recurse: true
               )
             end
           end
 
           context 'when confd_purge false' do
             let(:params) { { confd_purge: false } }
 
             it do
               is_expected.to contain_file('/etc/nginx/conf.d').without(
                 %w[
                   ignore
                   purge
                   recurse
                 ]
               )
             end
           end
 
           context 'when confd_only true' do
             let(:params) { { confd_only: true } }
 
             it do
               is_expected.to contain_file('/etc/nginx/conf.d').without(
                 %w[
                   ignore
                   purge
                   recurse
                 ]
               )
               is_expected.not_to contain_file('/etc/nginx/sites-available')
               is_expected.not_to contain_file('/etc/nginx/sites-enabled')
               is_expected.to contain_file('/etc/nginx/nginx.conf').without_content(%r{include /path/to/nginx/sites-enabled/\*;})
               is_expected.not_to contain_file('/etc/nginx/streams-available')
               is_expected.not_to contain_file('/etc/nginx/streams-enabled')
             end
           end
 
           context 'when server_purge true' do
             let(:params) { { server_purge: true } }
 
             it do
               is_expected.to contain_file('/etc/nginx/sites-available').with(
                 purge: true,
                 recurse: true
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/sites-enabled').with(
                 purge: true,
                 recurse: true
               )
             end
           end
 
           context 'when confd_purge true, server_purge true, and confd_only true' do
             let(:params) do
               {
                 confd_purge: true,
                 confd_only: true,
                 server_purge: true
               }
             end
 
             it do
               is_expected.to contain_file('/etc/nginx/conf.d').with(
                 purge: true,
                 recurse: true
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/conf.stream.d').with(
                 purge: true,
                 recurse: true
               )
             end
           end
 
           context 'when confd_purge true, server_purge default (false), confd_only true' do
             let(:params) do
               {
                 confd_purge: true,
                 confd_only: true
               }
             end
 
             it do
               is_expected.to contain_file('/etc/nginx/conf.d').without(
                 %w[
                   purge
                 ]
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/conf.stream.d').without(
                 %w[
                   purge
                 ]
               )
             end
           end
 
           context 'when server_purge false' do
             let(:params) { { server_purge: false } }
 
             it do
               is_expected.to contain_file('/etc/nginx/sites-available').without(
                 %w[
                   ignore
                   purge
                   recurse
                 ]
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/sites-enabled').without(
                 %w[
                   ignore
                   purge
                   recurse
                 ]
               )
             end
             it do
               is_expected.to contain_file('/var/log/nginx').without(
                 %w[
                   ignore
                   purge
                   recurse
                 ]
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/streams-available').without(
                 %w[
                   ignore
                   purge
                   recurse
                 ]
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/streams-enabled').without(
                 %w[
                   ignore
                   purge
                   recurse
                 ]
               )
             end
           end
 
           context 'when daemon_user = www-data' do
             let(:params) { { daemon_user: 'www-data' } }
 
             case facts[:osfamily]
             when 'Debian'
               it { is_expected.to contain_file('/run/nginx/client_body_temp').with(owner: 'www-data') }
               it { is_expected.to contain_file('/run/nginx/proxy_temp').with(owner: 'www-data') }
             else
               it { is_expected.to contain_file('/var/nginx/client_body_temp').with(owner: 'www-data') }
               it { is_expected.to contain_file('/var/nginx/proxy_temp').with(owner: 'www-data') }
             end
             it { is_expected.to contain_file('/etc/nginx/nginx.conf').with_content %r{^user www-data;} }
           end
 
           context 'when daemon_group = test-group' do
             let(:params) { { daemon_group: 'test-group' } }
 
             it { is_expected.to contain_file('/etc/nginx/nginx.conf').with_content %r{^user .* test-group;} }
           end
 
           context 'when log_dir is non-default' do
             let(:params) { { log_dir: '/foo/bar' } }
 
             it { is_expected.to contain_file('/foo/bar').with(ensure: 'directory') }
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{access_log /foo/bar/access.log;}
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{error_log /foo/bar/error.log error;}
               )
             end
           end
 
           context 'when log_mode is non-default' do
             let(:params) { { log_mode: '0771' } }
 
             it { is_expected.to contain_file('/var/log/nginx').with(mode: '0771') }
           end
 
           context 'when gzip is non-default (on) test gzip defaults' do
             let(:params) { { gzip: 'on' } }
 
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip              on;}
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_comp_level   1;}
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_disable      msie6;}
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_min_length   20;}
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_http_version 1.1;}
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_vary         off;}
               )
             end
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_proxied      off;}
               )
             end
           end
 
           context 'when gzip is non-default (on) set gzip_types (array)' do
             let(:params) do
               {
                 gzip: 'on',
                 gzip_types: ['text/plain', 'text/html']
               }
             end
 
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_types        text/plain text/html;}
               )
             end
           end
 
           context 'when gzip is non-default (on) set gzip types (string)' do
             let(:params) do
               {
                 gzip: 'on',
                 gzip_types: 'text/plain'
               }
             end
 
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_types        text/plain;}
               )
             end
           end
 
           context 'when gzip is non-default (on) set gzip buffers' do
             let(:params) do
               {
                 gzip: 'on',
                 gzip_buffers: '32 4k'
               }
             end
 
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_buffers      32 4k;}
               )
             end
           end
 
           context 'when gzip_static is non-default set gzip_static' do
             let(:params) do
               {
                 gzip_static: 'on'
               }
             end
 
             it do
               is_expected.to contain_file('/etc/nginx/nginx.conf').with_content(
                 %r{  gzip_static       on;}
               )
             end
           end
         end
       end
     end
   end
 end