diff --git a/Puppetfile b/Puppetfile
index adce7a9be3..5f42bf957b 100644
--- a/Puppetfile
+++ b/Puppetfile
@@ -90,6 +90,7 @@ mod 'puppet/selinux', '4.0.0'
 mod 'puppet/ssh_keygen', '6.0.0'
 mod 'puppet/sssd', '1.0.0'
 mod 'puppet/systemd', '5.2.0'
+mod 'puppet/tang', '0.1.1'
 mod 'puppet/telegraf', '5.2.0'
 mod 'puppet/tuned', '1.0.0'
 mod 'puppet/yum', '7.1.0'
diff --git a/hieradata/common.yaml b/hieradata/common.yaml
index d0e8fbb3c0..3b5eb6ea10 100644
--- a/hieradata/common.yaml
+++ b/hieradata/common.yaml
@@ -325,8 +325,7 @@ yum::manage_os_default_repos: true
 letsencrypt::email: "rubinobs-it-las@lsst.org"
 
 ipset::sets:
-  # rubin/aura "internal" prefixes
-  aura:
+  aura:  # rubin/aura "internal" prefixes
     ensure: "present"
     type: "hash:net"
     set:
@@ -334,8 +333,7 @@ ipset::sets:
       - "139.229.0.0/16"
       - "198.19.0.0/16"
       - "10.0.0.0/8"
-  # rubin "internal" prefixes
-  rubin:
+  rubin:  # rubin "internal" prefixes
     ensure: "present"
     type: "hash:net"
     set:
@@ -352,6 +350,20 @@ ipset::sets:
     type: "hash:net"
     set:
       - "139.229.144.0/26"
+  dev:  # dev site hosts
+    ensure: "present"
+    type: "hash:net"
+    set:
+      - "139.229.134.0/24"
+  tufde:  # tu/tts site hosts which might need FDE
+    ensure: "present"
+    type: "hash:net"
+    set:
+      - "140.252.146.32/27"
+      - "140.252.146.64/27"
+      - "140.252.147.0/28"
+      - "140.252.147.32/28"
+      - "140.252.147.64/27"
 
 # sssd ipa client setup -- do not use on ipa servers
 sssd::main_config:
@@ -517,7 +529,6 @@ profile::core::firewall::firewall:
     ipset: "rubin src"
     dport: "22"
     action: "accept"
-    require: "Ipset::Set[rubin]"
   "020 accept dhcp":
     proto: "udp"
     sport: ["67", "68"]
diff --git a/hieradata/node/tang01.dev.lsst.org.yaml b/hieradata/node/tang01.dev.lsst.org.yaml
new file mode 100644
index 0000000000..1826f40555
--- /dev/null
+++ b/hieradata/node/tang01.dev.lsst.org.yaml
@@ -0,0 +1,18 @@
+---
+nm::connections:
+  enp1s0:
+    content:
+      connection:
+        id: "enp1s0"
+        uuid: "03da7500-2101-c722-2438-d0d006c28c73"
+        type: "ethernet"
+        interface-name: "enp1s0"
+      ethernet: {}
+      ipv4:
+        address1: "139.229.134.4/24,139.229.134.254"
+        dns: "139.229.134.53;139.229.135.54;139.229.135.55;"
+        dns-search: "dev.lsst.org;"
+        method: "manual"
+      ipv6:
+        method: "ignore"
+      proxy: {}
diff --git a/hieradata/node/tang01.tu.lsst.org.yaml b/hieradata/node/tang01.tu.lsst.org.yaml
new file mode 100644
index 0000000000..ebba7a8059
--- /dev/null
+++ b/hieradata/node/tang01.tu.lsst.org.yaml
@@ -0,0 +1,18 @@
+---
+nm::connections:
+  enp1s0:
+    content:
+      connection:
+        id: "enp1s0"
+        uuid: "03da7500-2101-c722-2438-d0d006c28c73"
+        type: "ethernet"
+        interface-name: "enp1s0"
+      ethernet: {}
+      ipv4:
+        address1: "140.252.146.87/27,140.252.146.65"
+        dns: "140.252.146.71;140.252.146.72;140.252.146.73;"
+        dns-search: "tu.lsst.org;"
+        method: "manual"
+      ipv6:
+        method: "ignore"
+      proxy: {}
diff --git a/hieradata/node/tang02.dev.lsst.org.yaml b/hieradata/node/tang02.dev.lsst.org.yaml
new file mode 100644
index 0000000000..7143ce3ec3
--- /dev/null
+++ b/hieradata/node/tang02.dev.lsst.org.yaml
@@ -0,0 +1,18 @@
+---
+nm::connections:
+  enp1s0:
+    content:
+      connection:
+        id: "enp1s0"
+        uuid: "03da7500-2101-c722-2438-d0d006c28c73"
+        type: "ethernet"
+        interface-name: "enp1s0"
+      ethernet: {}
+      ipv4:
+        address1: "139.229.134.58/24,139.229.134.254"
+        dns: "139.229.134.53;139.229.135.54;139.229.135.55;"
+        dns-search: "dev.lsst.org;"
+        method: "manual"
+      ipv6:
+        method: "ignore"
+      proxy: {}
diff --git a/hieradata/node/tang02.tu.lsst.org.yaml b/hieradata/node/tang02.tu.lsst.org.yaml
new file mode 100644
index 0000000000..e3319eeecf
--- /dev/null
+++ b/hieradata/node/tang02.tu.lsst.org.yaml
@@ -0,0 +1,18 @@
+---
+nm::connections:
+  enp1s0:
+    content:
+      connection:
+        id: "enp1s0"
+        uuid: "03da7500-2101-c722-2438-d0d006c28c73"
+        type: "ethernet"
+        interface-name: "enp1s0"
+      ethernet: {}
+      ipv4:
+        address1: "140.252.146.88/27,140.252.146.65"
+        dns: "140.252.146.71;140.252.146.72;140.252.146.73;"
+        dns-search: "tu.lsst.org;"
+        method: "manual"
+      ipv6:
+        method: "ignore"
+      proxy: {}
diff --git a/hieradata/node/tang03.dev.lsst.org.yaml b/hieradata/node/tang03.dev.lsst.org.yaml
new file mode 100644
index 0000000000..38fe638d92
--- /dev/null
+++ b/hieradata/node/tang03.dev.lsst.org.yaml
@@ -0,0 +1,18 @@
+---
+nm::connections:
+  enp1s0:
+    content:
+      connection:
+        id: "enp1s0"
+        uuid: "03da7500-2101-c722-2438-d0d006c28c73"
+        type: "ethernet"
+        interface-name: "enp1s0"
+      ethernet: {}
+      ipv4:
+        address1: "139.229.134.59/24,139.229.134.254"
+        dns: "139.229.134.53;139.229.135.54;139.229.135.55;"
+        dns-search: "dev.lsst.org;"
+        method: "manual"
+      ipv6:
+        method: "ignore"
+      proxy: {}
diff --git a/hieradata/node/tang03.tu.lsst.org.yaml b/hieradata/node/tang03.tu.lsst.org.yaml
new file mode 100644
index 0000000000..59ddbc7603
--- /dev/null
+++ b/hieradata/node/tang03.tu.lsst.org.yaml
@@ -0,0 +1,18 @@
+---
+nm::connections:
+  enp1s0:
+    content:
+      connection:
+        id: "enp1s0"
+        uuid: "03da7500-2101-c722-2438-d0d006c28c73"
+        type: "ethernet"
+        interface-name: "enp1s0"
+      ethernet: {}
+      ipv4:
+        address1: "140.252.146.89/27,140.252.146.65"
+        dns: "140.252.146.71;140.252.146.72;140.252.146.73;"
+        dns-search: "tu.lsst.org;"
+        method: "manual"
+      ipv6:
+        method: "ignore"
+      proxy: {}
diff --git a/hieradata/role/perfsonar.yaml b/hieradata/role/perfsonar.yaml
index 71d7938947..81f4fc2d45 100644
--- a/hieradata/role/perfsonar.yaml
+++ b/hieradata/role/perfsonar.yaml
@@ -23,7 +23,6 @@ profile::core::firewall::firewall:
     ipset: "aura src"
     dport: "22"
     action: "accept"
-    require: "Ipset::Set[aura]"
 
 files:
   # perfsonar packaging installs this one file with the wrong mode
diff --git a/hieradata/role/tang.yaml b/hieradata/role/tang.yaml
new file mode 100644
index 0000000000..709f829799
--- /dev/null
+++ b/hieradata/role/tang.yaml
@@ -0,0 +1,19 @@
+---
+classes:
+  - "profile::core::common"
+  - "profile::core::firewall"
+  - "restic"
+  - "tang"
+packages:
+  - "jose"
+
+firewall::ensure: "running"
+
+restic::repositories:
+  awsrepo:
+    backup_path:
+      - "/var/db/tang"
+    backup_timer: "*-*-* *:47:00"
+    enable_forget: true
+    forget_timer: "*-*-* 15:00:00"
+    forget_flags: "--keep-within 1y"
diff --git a/hieradata/site/dev.yaml b/hieradata/site/dev.yaml
index 60d804360a..e09c32c3f3 100644
--- a/hieradata/site/dev.yaml
+++ b/hieradata/site/dev.yaml
@@ -56,4 +56,3 @@ profile::core::firewall::firewall:
     ipset: "ayekan src"
     dport: "9100"
     action: "accept"
-    require: "Ipset::Set[ayekan]"
diff --git a/hieradata/site/dev/role/tang.yaml b/hieradata/site/dev/role/tang.yaml
new file mode 100644
index 0000000000..785db3af75
--- /dev/null
+++ b/hieradata/site/dev/role/tang.yaml
@@ -0,0 +1,8 @@
+---
+profile::core::firewall::firewall:
+  "200 accept tang":
+    proto: "tcp"
+    state: "NEW"
+    ipset: "dev src"
+    dport: "7500"
+    action: "accept"
diff --git a/hieradata/site/ls.yaml b/hieradata/site/ls.yaml
index 0650acb533..4585f9fe15 100644
--- a/hieradata/site/ls.yaml
+++ b/hieradata/site/ls.yaml
@@ -55,4 +55,3 @@ profile::core::firewall::firewall:
     ipset: "ayekan src"
     dport: "9100"
     action: "accept"
-    require: "Ipset::Set[ayekan]"
diff --git a/hieradata/site/tu/role/tang.yaml b/hieradata/site/tu/role/tang.yaml
new file mode 100644
index 0000000000..2eea5c3e12
--- /dev/null
+++ b/hieradata/site/tu/role/tang.yaml
@@ -0,0 +1,8 @@
+---
+profile::core::firewall::firewall:
+  "200 accept tang":
+    proto: "tcp"
+    state: "NEW"
+    ipset: "tufde src"
+    dport: "7500"
+    action: "accept"
diff --git a/site/profile/manifests/core/firewall.pp b/site/profile/manifests/core/firewall.pp
index 306dc0b47c..6499a10d9d 100644
--- a/site/profile/manifests/core/firewall.pp
+++ b/site/profile/manifests/core/firewall.pp
@@ -14,6 +14,9 @@
   include firewall
   include ipset
 
+  Class['ipset'] -> Class['firewall']
+  Ipset::Set <| |> -> Class['firewall']
+
   if $purge_firewall {
     resources { 'firewall': purge => true }
   }
diff --git a/spec/classes/archive/commmon_spec.rb b/spec/classes/archive/commmon_spec.rb
index 58a45b5483..5495fff573 100644
--- a/spec/classes/archive/commmon_spec.rb
+++ b/spec/classes/archive/commmon_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::archive::common' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:pre_condition) do
         <<~PP
           # change service unit name from sssd.service to sssd
diff --git a/spec/classes/archive/data/auxtel_spec.rb b/spec/classes/archive/data/auxtel_spec.rb
index a1ad29a2bf..4a835dddde 100644
--- a/spec/classes/archive/data/auxtel_spec.rb
+++ b/spec/classes/archive/data/auxtel_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::archive::data::auxtel' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/archive/data/comcam_spec.rb b/spec/classes/archive/data/comcam_spec.rb
index b8952d6569..c09c888fe5 100644
--- a/spec/classes/archive/data/comcam_spec.rb
+++ b/spec/classes/archive/data/comcam_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::archive::data::comcam' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/archive/data_spec.rb b/spec/classes/archive/data_spec.rb
index f9f64c8d43..0b98529864 100644
--- a/spec/classes/archive/data_spec.rb
+++ b/spec/classes/archive/data_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::archive::data' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/ccs/common_spec.rb b/spec/classes/ccs/common_spec.rb
index 0a9b876a05..7ed24b7de8 100644
--- a/spec/classes/ccs/common_spec.rb
+++ b/spec/classes/ccs/common_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::ccs::common' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts.merge(site: 'ls') }
+      let(:facts) { override_facts(os_facts, site: 'ls') }
       let(:pre_condition) do
         <<~PP
           include ssh
diff --git a/spec/classes/ccs/el9_spec.rb b/spec/classes/ccs/el9_spec.rb
index 22a941f06e..ed97758ab4 100644
--- a/spec/classes/ccs/el9_spec.rb
+++ b/spec/classes/ccs/el9_spec.rb
@@ -3,11 +3,11 @@
 require 'spec_helper'
 
 describe 'profile::ccs::el9' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
-      let(:facts) { facts.merge(site: 'ls') }
+      let(:facts) { override_facts(os_facts, site: 'ls') }
       let(:pre_condition) do
         <<~PP
           include ssh
diff --git a/spec/classes/ccs/file_transfer_spec.rb b/spec/classes/ccs/file_transfer_spec.rb
index 7eb9401c0c..e85f7ed6f4 100644
--- a/spec/classes/ccs/file_transfer_spec.rb
+++ b/spec/classes/ccs/file_transfer_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::ccs::file_transfer' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with param install => true' do
         let(:params) do
diff --git a/spec/classes/ccs/graphical_spec.rb b/spec/classes/ccs/graphical_spec.rb
index 6117a8e8c6..5ced520d4c 100644
--- a/spec/classes/ccs/graphical_spec.rb
+++ b/spec/classes/ccs/graphical_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::ccs::graphical' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:unwanted_pkgs) do
         %w[
           gnome-initial-setup
@@ -22,9 +22,9 @@
 
       it { is_expected.to compile.with_all_deps }
 
-      include_examples 'x2go packages', facts: facts
+      include_examples 'x2go packages', os_facts: os_facts
 
-      if facts[:os]['release']['major'] == '7'
+      if os_facts[:os]['release']['major'] == '7'
         it do
           unwanted_pkgs.each do |pkg|
             is_expected.to contain_yum__group('GNOME Desktop').with(
diff --git a/spec/classes/ccs/sal_dx_spec.rb b/spec/classes/ccs/sal_dx_spec.rb
index c6130d29ae..af4bb4f690 100644
--- a/spec/classes/ccs/sal_dx_spec.rb
+++ b/spec/classes/ccs/sal_dx_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::ccs::sal_dx' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with no params' do
         it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/core/bash_completion_spec.rb b/spec/classes/core/bash_completion_spec.rb
index 1ecdc24167..a48a8f4a82 100644
--- a/spec/classes/core/bash_completion_spec.rb
+++ b/spec/classes/core/bash_completion_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'profile::core::bash_completion' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
-      include_examples 'bash_completion', facts: facts
+      include_examples 'bash_completion', os_facts: os_facts
     end
   end
 end
diff --git a/spec/classes/core/ca_spec.rb b/spec/classes/core/ca_spec.rb
index a419b8f25e..79c8614182 100644
--- a/spec/classes/core/ca_spec.rb
+++ b/spec/classes/core/ca_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::ca' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
       it { is_expected.to contain_package('ca-certificates').with_ensure('latest') }
diff --git a/spec/classes/core/common_spec.rb b/spec/classes/core/common_spec.rb
index 3db30409dd..841161d635 100644
--- a/spec/classes/core/common_spec.rb
+++ b/spec/classes/core/common_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::common' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:pre_condition) do
         <<~PP
           # change service unit name from sssd.service to sssd
@@ -22,7 +22,7 @@ class { 'sssd': service_names => ['sssd'] }
         it { is_expected.to contain_class('profile::core::nm_dispatch') }
         it { is_expected.to contain_package('ca-certificates').with_ensure('latest') }
 
-        if facts[:os]['release']['major'] == '7'
+        if os_facts[:os]['release']['major'] == '7'
           it { is_expected.to contain_class('network') }
         else
           it { is_expected.not_to contain_class('network') }
diff --git a/spec/classes/core/convenience_spec.rb b/spec/classes/core/convenience_spec.rb
index 8571d65d15..3d746096fa 100644
--- a/spec/classes/core/convenience_spec.rb
+++ b/spec/classes/core/convenience_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::convenience' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/core/debugutils_spec.rb b/spec/classes/core/debugutils_spec.rb
index 9e62b44dc2..1fccd489c9 100644
--- a/spec/classes/core/debugutils_spec.rb
+++ b/spec/classes/core/debugutils_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::debugutils' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/core/docker_spec.rb b/spec/classes/core/docker_spec.rb
index 60ea35df0f..b346e3ed7a 100644
--- a/spec/classes/core/docker_spec.rb
+++ b/spec/classes/core/docker_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::docker' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
@@ -24,7 +24,7 @@
           .that_notifies('Service[docker]')
       end
 
-      if facts[:os]['release']['major'] == '9'
+      if os_facts[:os]['release']['major'] == '9'
         it do
           is_expected.to contain_systemd__dropin_file('ceph.conf').with(
             unit: 'containerd.service',
diff --git a/spec/classes/core/dtn_spec.rb b/spec/classes/core/dtn_spec.rb
index 60963cd36e..fea133b343 100644
--- a/spec/classes/core/dtn_spec.rb
+++ b/spec/classes/core/dtn_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::dtn' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/core/firewall_spec.rb b/spec/classes/core/firewall_spec.rb
index 1cf9c79696..b7a220d5ed 100644
--- a/spec/classes/core/firewall_spec.rb
+++ b/spec/classes/core/firewall_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'profile::core::firewall' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
       it { is_expected.to contain_class('firewall') }
-      it { is_expected.to contain_class('ipset') }
+      it { is_expected.to contain_class('ipset').that_comes_before('Class[firewall]') }
       it { is_expected.to have_resources_resource_count(0) }
       it { is_expected.to have_firewall_resource_count(0) }
 
diff --git a/spec/classes/core/foreman/fog_hack_spec.rb b/spec/classes/core/foreman/fog_hack_spec.rb
index b06f2cbfda..0f448ef475 100644
--- a/spec/classes/core/foreman/fog_hack_spec.rb
+++ b/spec/classes/core/foreman/fog_hack_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::foreman::fog_hack' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/core/foreman_spec.rb b/spec/classes/core/foreman_spec.rb
index 1ac8971c75..219c5c9359 100644
--- a/spec/classes/core/foreman_spec.rb
+++ b/spec/classes/core/foreman_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::foreman' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:params) { { smee_url: 'https://foo.example.org' } }
 
       it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/core/hardware_spec.rb b/spec/classes/core/hardware_spec.rb
index 600a7794ae..44e22d6b4d 100644
--- a/spec/classes/core/hardware_spec.rb
+++ b/spec/classes/core/hardware_spec.rb
@@ -5,9 +5,9 @@
 # XXX testing for classes in the catalog is not a great practice but it is
 # expendent to do here as the goal is primary to test branching based on facts.
 describe 'profile::core::hardware' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with PowerEdge' do
         let(:facts) do
@@ -53,7 +53,7 @@
         it { is_expected.to compile.with_all_deps }
         it { is_expected.to contain_class('ipmi') }
 
-        if (facts[:os]['family'] == 'RedHat') && (facts[:os]['release']['major'] == '7')
+        if (os_facts[:os]['family'] == 'RedHat') && (os_facts[:os]['release']['major'] == '7')
           it { is_expected.to contain_class('profile::core::kernel::pcie_aspm') }
           it { is_expected.to contain_class('profile::core::kernel::nvme_apst') }
 
diff --git a/spec/classes/core/ipa_spec.rb b/spec/classes/core/ipa_spec.rb
index b9fc9e0a84..99f9f7350b 100644
--- a/spec/classes/core/ipa_spec.rb
+++ b/spec/classes/core/ipa_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::ipa' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with no params' do
         it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/core/kernel_spec.rb b/spec/classes/core/kernel_spec.rb
index af1402d41c..c278f42235 100644
--- a/spec/classes/core/kernel_spec.rb
+++ b/spec/classes/core/kernel_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::kernel' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with no params' do
         it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/core/keytab_spec.rb b/spec/classes/core/keytab_spec.rb
index e3219f0f9e..7c58deded0 100644
--- a/spec/classes/core/keytab_spec.rb
+++ b/spec/classes/core/keytab_spec.rb
@@ -3,11 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::keytab' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) do
-        facts
-      end
+      let(:facts) { os_facts }
 
       context 'with no parameters' do
         it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/core/krb5_spec.rb b/spec/classes/core/krb5_spec.rb
index 256e7f7cae..ce9315a8f8 100644
--- a/spec/classes/core/krb5_spec.rb
+++ b/spec/classes/core/krb5_spec.rb
@@ -3,14 +3,14 @@
 require 'spec_helper'
 
 describe 'profile::core::krb5' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with no params' do
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'krb5.conf.d files', facts: facts
+        include_examples 'krb5.conf.d files', os_facts: os_facts
       end
     end
   end
diff --git a/spec/classes/core/letsencrypt_spec.rb b/spec/classes/core/letsencrypt_spec.rb
index c3c2c1c2f4..5ed6c8345d 100644
--- a/spec/classes/core/letsencrypt_spec.rb
+++ b/spec/classes/core/letsencrypt_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::letsencrypt' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with no params' do
         it { is_expected.to compile.with_all_deps }
@@ -25,7 +25,7 @@
 
         it { is_expected.to contain_package('python-s3transfer') }
 
-        if facts[:os]['name'] == 'CentOS'
+        if os_facts[:os]['name'] == 'CentOS'
           it { is_expected.to contain_package('python2-futures.noarch') }
         end
 
diff --git a/spec/classes/core/lhnrouting_spec.rb b/spec/classes/core/lhnrouting_spec.rb
index 99b829f404..9cebf99f56 100644
--- a/spec/classes/core/lhnrouting_spec.rb
+++ b/spec/classes/core/lhnrouting_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'profile::core::lhnrouting' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
-      if facts[:os]['release']['major'] == '7'
+      if os_facts[:os]['release']['major'] == '7'
         it { is_expected.to contain_kmod__load('dummy') }
 
         it do
diff --git a/spec/classes/core/nm_dispatch_spec.rb b/spec/classes/core/nm_dispatch_spec.rb
index b883fd37e2..bef887779f 100644
--- a/spec/classes/core/nm_dispatch_spec.rb
+++ b/spec/classes/core/nm_dispatch_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::nm_dispatch' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:pre_condition) do
         <<~PP
           if fact('os.release.major') == '7' {
@@ -32,7 +32,7 @@
         end
 
         let(:net_class) do
-          if facts[:os]['release']['major'] == '7'
+          if os_facts[:os]['release']['major'] == '7'
             'Class[network]'
           else
             'Class[nm]'
diff --git a/spec/classes/core/perccli_spec.rb b/spec/classes/core/perccli_spec.rb
index 26866ceb4c..df3acbded4 100644
--- a/spec/classes/core/perccli_spec.rb
+++ b/spec/classes/core/perccli_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::perccli' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
       it { is_expected.to contain_yumrepo('dell') }
diff --git a/spec/classes/core/perfsonar_spec.rb b/spec/classes/core/perfsonar_spec.rb
index 6a7e77429d..11327efa90 100644
--- a/spec/classes/core/perfsonar_spec.rb
+++ b/spec/classes/core/perfsonar_spec.rb
@@ -3,16 +3,16 @@
 require 'spec_helper'
 
 describe 'profile::core::perfsonar' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:fqdn) { facts[:fqdn] }
       let(:le_root) { "/etc/letsencrypt/live/#{fqdn}" }
       let(:perfsonar_version) { '4.4.0' }
 
       it { is_expected.to compile.with_all_deps }
 
-      include_examples 'generic perfsonar', facts: facts
+      include_examples 'generic perfsonar', os_facts: os_facts
 
       context 'with version param' do
         context 'with 5.0.0' do
@@ -23,7 +23,7 @@
             }
           end
 
-          include_examples 'generic perfsonar', facts: facts
+          include_examples 'generic perfsonar', os_facts: os_facts
         end
       end
     end
diff --git a/spec/classes/core/rke_spec.rb b/spec/classes/core/rke_spec.rb
index 4ee96a663e..59faa9f0b5 100644
--- a/spec/classes/core/rke_spec.rb
+++ b/spec/classes/core/rke_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::rke' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:pre_condition) do
         <<~PP
           include docker
diff --git a/spec/classes/core/sssd_spec.rb b/spec/classes/core/sssd_spec.rb
index 557747ff6b..c76e518b0f 100644
--- a/spec/classes/core/sssd_spec.rb
+++ b/spec/classes/core/sssd_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::sssd' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:pre_condition) do
         <<~PP
           # change service unit name from sssd.service to sssd
diff --git a/spec/classes/core/sysctl/lhn_spec.rb b/spec/classes/core/sysctl/lhn_spec.rb
index ea8ced6bad..18abe0342a 100644
--- a/spec/classes/core/sysctl/lhn_spec.rb
+++ b/spec/classes/core/sysctl/lhn_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::sysctl::lhn', :lhn_node do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
       it { is_expected.to have_sysctl__value_resource_count(7) }
diff --git a/spec/classes/core/sysctl/rp_filter_spec.rb b/spec/classes/core/sysctl/rp_filter_spec.rb
index 19b3a9ef4a..12bd658d92 100644
--- a/spec/classes/core/sysctl/rp_filter_spec.rb
+++ b/spec/classes/core/sysctl/rp_filter_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 describe 'profile::core::sysctl::rp_filter' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
       let(:net_int) do
         {
@@ -33,8 +33,8 @@
         }
       end
       let(:facts) do
-        facts.delete(:networking)
-        override_facts(facts, networking: { interfaces: net_int })
+        os_facts.delete(:networking)
+        override_facts(os_facts, networking: { interfaces: net_int })
       end
 
       interfaces = %w[
diff --git a/spec/classes/core/x2go_spec.rb b/spec/classes/core/x2go_spec.rb
index 6067997d28..ebb2d4b7ae 100644
--- a/spec/classes/core/x2go_spec.rb
+++ b/spec/classes/core/x2go_spec.rb
@@ -3,11 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::x2go' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) do
-        facts
-      end
+      let(:facts) { os_facts }
       let(:pre_condition) do
         <<~PP
         sudo::conf { 'bogus':
@@ -19,7 +17,7 @@
       context 'with no parameters' do
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'x2go packages', facts: facts
+        include_examples 'x2go packages', os_facts: os_facts
 
         it do
           is_expected.to contain_file('/etc/sudoers.d/x2goserver')
diff --git a/spec/classes/core/yum/dell_spec.rb b/spec/classes/core/yum/dell_spec.rb
index 529083ef85..70b334d641 100644
--- a/spec/classes/core/yum/dell_spec.rb
+++ b/spec/classes/core/yum/dell_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::yum::dell' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/core/yum/lsst_ts_private_spec.rb b/spec/classes/core/yum/lsst_ts_private_spec.rb
index 95657ae258..b45689a1c0 100644
--- a/spec/classes/core/yum/lsst_ts_private_spec.rb
+++ b/spec/classes/core/yum/lsst_ts_private_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::yum::lsst_ts_private' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'without params' do
         it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/core/yum/lsst_ts_spec.rb b/spec/classes/core/yum/lsst_ts_spec.rb
index d269199b75..3b94f865db 100644
--- a/spec/classes/core/yum/lsst_ts_spec.rb
+++ b/spec/classes/core/yum/lsst_ts_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::yum::lsst_ts' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/core/yum_spec.rb b/spec/classes/core/yum_spec.rb
index b0e05be304..8f07475ac7 100644
--- a/spec/classes/core/yum_spec.rb
+++ b/spec/classes/core/yum_spec.rb
@@ -3,11 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::core::yum' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) do
-        facts
-      end
+      let(:facts) { os_facts }
 
       context 'with no parameters' do
         it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/daq/commmon_spec.rb b/spec/classes/daq/commmon_spec.rb
index 48263ad162..26e10a6eb1 100644
--- a/spec/classes/daq/commmon_spec.rb
+++ b/spec/classes/daq/commmon_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::daq::common' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       include_examples 'daq common'
     end
diff --git a/spec/classes/daq/daq_interface_spec.rb b/spec/classes/daq/daq_interface_spec.rb
index ae5a7ecfc5..7c96638c49 100644
--- a/spec/classes/daq/daq_interface_spec.rb
+++ b/spec/classes/daq/daq_interface_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::daq::daq_interface' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with no params' do
         it { is_expected.to compile.with_all_deps }
@@ -29,7 +29,7 @@
             )
           end
 
-          if facts[:os]['release']['major'] == '7'
+          if os_facts[:os]['release']['major'] == '7'
             it { is_expected.to compile.with_all_deps }
 
             it do
@@ -64,7 +64,7 @@
             )
           end
 
-          if facts[:os]['release']['major'] == '7'
+          if os_facts[:os]['release']['major'] == '7'
             it { is_expected.to compile.with_all_deps }
 
             it do
diff --git a/spec/classes/daq/sysctl_spec.rb b/spec/classes/daq/sysctl_spec.rb
index f3c699770a..bffd51a5b1 100644
--- a/spec/classes/daq/sysctl_spec.rb
+++ b/spec/classes/daq/sysctl_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::daq::sysctl' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
       it { is_expected.to have_sysctl__value_resource_count(2) }
diff --git a/spec/classes/nfs/csc_spec.rb b/spec/classes/nfs/csc_spec.rb
index e964d4141f..4353c190c5 100644
--- a/spec/classes/nfs/csc_spec.rb
+++ b/spec/classes/nfs/csc_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::nfs::client::csc' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with default module data' do
         it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/nfs/v2_spec.rb b/spec/classes/nfs/v2_spec.rb
index 34e09de729..cba8bac353 100644
--- a/spec/classes/nfs/v2_spec.rb
+++ b/spec/classes/nfs/v2_spec.rb
@@ -3,11 +3,11 @@
 require 'spec_helper'
 
 describe 'profile::nfs::v2' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
-      include_examples 'nfsv2 enabled', facts: facts
+      include_examples 'nfsv2 enabled', os_facts: os_facts
     end
   end
 end
diff --git a/spec/classes/ts/dco_spec.rb b/spec/classes/ts/dco_spec.rb
index 98f924d59f..a730754de6 100644
--- a/spec/classes/ts/dco_spec.rb
+++ b/spec/classes/ts/dco_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::ts::dco' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/ts/love_spec.rb b/spec/classes/ts/love_spec.rb
index bcb10424c3..aa4de87634 100644
--- a/spec/classes/ts/love_spec.rb
+++ b/spec/classes/ts/love_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::ts::love' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/classes/ts/opensplicedds_spec.rb b/spec/classes/ts/opensplicedds_spec.rb
index 283a31323b..bd6878381c 100644
--- a/spec/classes/ts/opensplicedds_spec.rb
+++ b/spec/classes/ts/opensplicedds_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::ts::opensplicedds' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       context 'with no params' do
         it { is_expected.to compile.with_all_deps }
diff --git a/spec/classes/ts/rpi_spec.rb b/spec/classes/ts/rpi_spec.rb
index f243bebe8e..3a893f1c0c 100644
--- a/spec/classes/ts/rpi_spec.rb
+++ b/spec/classes/ts/rpi_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::ts::rpi' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
 
       it { is_expected.to compile.with_all_deps }
 
diff --git a/spec/defines/util/kernel_param_spec.rb b/spec/defines/util/kernel_param_spec.rb
index 925a15c6f6..4f6c297a41 100644
--- a/spec/defines/util/kernel_param_spec.rb
+++ b/spec/defines/util/kernel_param_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::util::kernel_param' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:title) { 'foo' }
 
       it { is_expected.to compile.with_all_deps }
diff --git a/spec/defines/util/keytab_spec.rb b/spec/defines/util/keytab_spec.rb
index ec809e306b..3c0e32f205 100644
--- a/spec/defines/util/keytab_spec.rb
+++ b/spec/defines/util/keytab_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe 'profile::util::keytab' do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:title) { 'foo' }
       let(:params) { { 'uid' => 123, 'keytab_base64' => sensitive('YmFy') } }
 
diff --git a/spec/hosts/nodes/auxtel-archiver.cp.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-archiver.cp.lsst.org_spec.rb
index 6248acbf34..5ed68c1777 100644
--- a/spec/hosts/nodes/auxtel-archiver.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-archiver.cp.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'auxtel-archiver.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-archiver.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/auxtel-archiver.ls.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-archiver.ls.lsst.org_spec.rb
index f5d495ee9f..4de7533075 100644
--- a/spec/hosts/nodes/auxtel-archiver.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-archiver.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'auxtel-archiver.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-archiver.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/auxtel-archiver.tu.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-archiver.tu.lsst.org_spec.rb
index 748a873014..3c520bab24 100644
--- a/spec/hosts/nodes/auxtel-archiver.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-archiver.tu.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'auxtel-archiver.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-archiver.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/auxtel-daq-mgt-cp.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-daq-mgt-cp.lsst.org_spec.rb
index 47ef24a474..abe3af9b14 100644
--- a/spec/hosts/nodes/auxtel-daq-mgt-cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-daq-mgt-cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'auxtel-daq-mgt.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-daq-mgt.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/auxtel-dc01.cp.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-dc01.cp.lsst.org_spec.rb
index 99c0289d3e..39c74a4040 100644
--- a/spec/hosts/nodes/auxtel-dc01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-dc01.cp.lsst.org_spec.rb
@@ -3,10 +3,10 @@
 require 'spec_helper'
 
 describe 'auxtel-dc01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-dc01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/auxtel-dc01.ls.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-dc01.ls.lsst.org_spec.rb
index 592ea51b17..0bb6a11f2b 100644
--- a/spec/hosts/nodes/auxtel-dc01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-dc01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'auxtel-dc01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-dc01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/auxtel-fp01.ls.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-fp01.ls.lsst.org_spec.rb
index 88a95bf453..76e5a97c9a 100644
--- a/spec/hosts/nodes/auxtel-fp01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-fp01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'auxtel-fp01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-fp01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/auxtel-mcm.cp.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-mcm.cp.lsst.org_spec.rb
index 423b3e3288..fcc2ead346 100644
--- a/spec/hosts/nodes/auxtel-mcm.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-mcm.cp.lsst.org_spec.rb
@@ -3,10 +3,10 @@
 require 'spec_helper'
 
 describe 'auxtel-mcm.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-mcm.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/auxtel-mcm.ls.lsst.org_spec.rb b/spec/hosts/nodes/auxtel-mcm.ls.lsst.org_spec.rb
index c55b5df9d6..831b3701bb 100644
--- a/spec/hosts/nodes/auxtel-mcm.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/auxtel-mcm.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'auxtel-mcm.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'auxtel-mcm.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/ayekan01.ls.lsst.org_spec.rb b/spec/hosts/nodes/ayekan01.ls.lsst.org_spec.rb
index 1ba6f90771..a929c48798 100644
--- a/spec/hosts/nodes/ayekan01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/ayekan01.ls.lsst.org_spec.rb
@@ -3,11 +3,11 @@
 require 'spec_helper'
 
 describe 'ayekan01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
-      let(:facts) { override_facts(facts, fqdn: 'ayekan01.ls.lsst.org') }
+      let(:facts) { override_facts(os_facts, fqdn: 'ayekan01.ls.lsst.org') }
       let(:node_params) do
         {
           role: 'rke',
diff --git a/spec/hosts/nodes/azar01.ls.lsst.org_spec.rb b/spec/hosts/nodes/azar01.ls.lsst.org_spec.rb
index b8bec174c9..99e000f389 100644
--- a/spec/hosts/nodes/azar01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/azar01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'azar01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'azar01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/azar03.cp.lsst.org_spec.rb b/spec/hosts/nodes/azar03.cp.lsst.org_spec.rb
index f549668637..93a41d68fa 100644
--- a/spec/hosts/nodes/azar03.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/azar03.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'azar03.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'azar03.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/chango01.ls.lsst.org_spec.rb b/spec/hosts/nodes/chango01.ls.lsst.org_spec.rb
index 7808cff76c..0c6d52a11c 100644
--- a/spec/hosts/nodes/chango01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/chango01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'chango01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'chango01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/chonchon01.cp.lsst.org_spec.rb b/spec/hosts/nodes/chonchon01.cp.lsst.org_spec.rb
index eb68caf1fe..59d200e778 100644
--- a/spec/hosts/nodes/chonchon01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/chonchon01.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'chonchon01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'chonchon01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/comcam-archiver.cp.lsst.org_spec.rb b/spec/hosts/nodes/comcam-archiver.cp.lsst.org_spec.rb
index 2c03375f35..3fcdf35139 100644
--- a/spec/hosts/nodes/comcam-archiver.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/comcam-archiver.cp.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'comcam-archiver.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'comcam-archiver.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/comcam-archiver.tu.lsst.org_spec.rb b/spec/hosts/nodes/comcam-archiver.tu.lsst.org_spec.rb
index cd7e8a690d..6738ccdc66 100644
--- a/spec/hosts/nodes/comcam-archiver.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/comcam-archiver.tu.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'comcam-archiver.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'comcam-archiver.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/comcam-daq-mgt-cp.lsst.org_spec.rb b/spec/hosts/nodes/comcam-daq-mgt-cp.lsst.org_spec.rb
index 612171bce6..fb61d755e5 100644
--- a/spec/hosts/nodes/comcam-daq-mgt-cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/comcam-daq-mgt-cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'comcam-daq-mgt.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'comcam-daq-mgt.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core01.cp.lsst.org_spec.rb b/spec/hosts/nodes/core01.cp.lsst.org_spec.rb
index 70d4bc65c3..a24ba02b44 100644
--- a/spec/hosts/nodes/core01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core01.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core01.dev.lsst.org_spec.rb b/spec/hosts/nodes/core01.dev.lsst.org_spec.rb
index eb50137a44..17ded43b33 100644
--- a/spec/hosts/nodes/core01.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core01.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core01.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core01.dev.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core01.ls.lsst.org_spec.rb b/spec/hosts/nodes/core01.ls.lsst.org_spec.rb
index d837b47603..4df67f761b 100644
--- a/spec/hosts/nodes/core01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core02.cp.lsst.org_spec.rb b/spec/hosts/nodes/core02.cp.lsst.org_spec.rb
index d65931d013..5c29617034 100644
--- a/spec/hosts/nodes/core02.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core02.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core02.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core02.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core02.dev.lsst.org_spec.rb b/spec/hosts/nodes/core02.dev.lsst.org_spec.rb
index 4faaeddcc8..a28d4c739d 100644
--- a/spec/hosts/nodes/core02.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core02.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core02.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core02.dev.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core02.ls.lsst.org_spec.rb b/spec/hosts/nodes/core02.ls.lsst.org_spec.rb
index e03d923533..3d9d3472d7 100644
--- a/spec/hosts/nodes/core02.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core02.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core02.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core02.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core03.cp.lsst.org_spec.rb b/spec/hosts/nodes/core03.cp.lsst.org_spec.rb
index f5de4a8715..dbd38bb86c 100644
--- a/spec/hosts/nodes/core03.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core03.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core03.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core03.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core03.dev.lsst.org_spec.rb b/spec/hosts/nodes/core03.dev.lsst.org_spec.rb
index 275e03e59f..3403930868 100644
--- a/spec/hosts/nodes/core03.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core03.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core03.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core03.dev.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core03.ls.lsst.org_spec.rb b/spec/hosts/nodes/core03.ls.lsst.org_spec.rb
index 383aad5753..2a0ddc4468 100644
--- a/spec/hosts/nodes/core03.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core03.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core03.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core03.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core1.cp.lsst.org_spec.rb b/spec/hosts/nodes/core1.cp.lsst.org_spec.rb
index 14cb979887..09e18d8c83 100644
--- a/spec/hosts/nodes/core1.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core1.cp.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'core1.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core1.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core1.ls.lsst.org_spec.rb b/spec/hosts/nodes/core1.ls.lsst.org_spec.rb
index 6f5614346e..eed1824373 100644
--- a/spec/hosts/nodes/core1.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core1.ls.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'core1.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core1.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core1.tu.lsst.org_spec.rb b/spec/hosts/nodes/core1.tu.lsst.org_spec.rb
index a4b8c3b6d4..874b1bb2b5 100644
--- a/spec/hosts/nodes/core1.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core1.tu.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core1.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core1.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core2.cp.lsst.org_spec.rb b/spec/hosts/nodes/core2.cp.lsst.org_spec.rb
index d68fb6e91f..dbbb008569 100644
--- a/spec/hosts/nodes/core2.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core2.cp.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'core2.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core2.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core2.ls.lsst.org_spec.rb b/spec/hosts/nodes/core2.ls.lsst.org_spec.rb
index 2be227418b..87028d37bb 100644
--- a/spec/hosts/nodes/core2.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core2.ls.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'core2.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core2.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core2.tu.lsst.org_spec.rb b/spec/hosts/nodes/core2.tu.lsst.org_spec.rb
index 4e33c6c13d..f2f443ff59 100644
--- a/spec/hosts/nodes/core2.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core2.tu.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core2.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core2.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core3.cp.lsst.org_spec.rb b/spec/hosts/nodes/core3.cp.lsst.org_spec.rb
index 6363cc118f..6c59eb405a 100644
--- a/spec/hosts/nodes/core3.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core3.cp.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'core3.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core3.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core3.ls.lsst.org_spec.rb b/spec/hosts/nodes/core3.ls.lsst.org_spec.rb
index 0b2be3dab5..937b23dce2 100644
--- a/spec/hosts/nodes/core3.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core3.ls.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'core3.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core3.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/core3.tu.lsst.org_spec.rb b/spec/hosts/nodes/core3.tu.lsst.org_spec.rb
index d047cafadd..681730ddf2 100644
--- a/spec/hosts/nodes/core3.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/core3.tu.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'core3.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'core3.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/daq-mgt.tu.lsst.org_spec.rb b/spec/hosts/nodes/daq-mgt.tu.lsst.org_spec.rb
index 55f6cbaf39..5965e174e8 100644
--- a/spec/hosts/nodes/daq-mgt.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/daq-mgt.tu.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'daq-mgt.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'daq-mgt.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/dimm.cp.lsst.org_spec.rb b/spec/hosts/nodes/dimm.cp.lsst.org_spec.rb
index 4c01f8abe6..a2d2a44133 100644
--- a/spec/hosts/nodes/dimm.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dimm.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dimm.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dimm.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/dns1.cp.lsst.org_spec.rb b/spec/hosts/nodes/dns1.cp.lsst.org_spec.rb
index 93edf6e8f7..a89d7b6b02 100644
--- a/spec/hosts/nodes/dns1.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns1.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns1.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns1.cp.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns1.dev.lsst.org_spec.rb b/spec/hosts/nodes/dns1.dev.lsst.org_spec.rb
index 3238cf24ce..4962093c1a 100644
--- a/spec/hosts/nodes/dns1.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns1.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns1.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns1.dev.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns1.ls.lsst.org_spec.rb b/spec/hosts/nodes/dns1.ls.lsst.org_spec.rb
index e8bda5d570..2b38210f96 100644
--- a/spec/hosts/nodes/dns1.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns1.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns1.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns1.ls.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns1.tu.lsst.org_spec.rb b/spec/hosts/nodes/dns1.tu.lsst.org_spec.rb
index efc4091e80..cb31946e9f 100644
--- a/spec/hosts/nodes/dns1.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns1.tu.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns1.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns1.tu.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns2.cp.lsst.org_spec.rb b/spec/hosts/nodes/dns2.cp.lsst.org_spec.rb
index 778d391b76..5b68cbddee 100644
--- a/spec/hosts/nodes/dns2.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns2.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns2.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns2.cp.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns2.dev.lsst.org_spec.rb b/spec/hosts/nodes/dns2.dev.lsst.org_spec.rb
index 1bd528abf1..a224ccc92d 100644
--- a/spec/hosts/nodes/dns2.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns2.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns2.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns2.dev.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns2.ls.lsst.org_spec.rb b/spec/hosts/nodes/dns2.ls.lsst.org_spec.rb
index ac9a694c6a..21439886c6 100644
--- a/spec/hosts/nodes/dns2.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns2.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns2.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns2.ls.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns2.tu.lsst.org_spec.rb b/spec/hosts/nodes/dns2.tu.lsst.org_spec.rb
index 5b7350cadc..4a43463f86 100644
--- a/spec/hosts/nodes/dns2.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns2.tu.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns2.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns2.tu.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns3.cp.lsst.org_spec.rb b/spec/hosts/nodes/dns3.cp.lsst.org_spec.rb
index dde7795ca4..cf5bca28b5 100644
--- a/spec/hosts/nodes/dns3.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns3.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns3.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns3.cp.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns3.dev.lsst.org_spec.rb b/spec/hosts/nodes/dns3.dev.lsst.org_spec.rb
index 06809d8dcc..89544111e5 100644
--- a/spec/hosts/nodes/dns3.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns3.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns3.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns3.dev.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns3.ls.lsst.org_spec.rb b/spec/hosts/nodes/dns3.ls.lsst.org_spec.rb
index acdf8f6307..f2a5da8bdf 100644
--- a/spec/hosts/nodes/dns3.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns3.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns3.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns3.ls.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/dns3.tu.lsst.org_spec.rb b/spec/hosts/nodes/dns3.tu.lsst.org_spec.rb
index 0d3bed5b92..2d668e089e 100644
--- a/spec/hosts/nodes/dns3.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/dns3.tu.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'dns3.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'dns3.tu.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/foreman.cp.lsst.org_spec.rb b/spec/hosts/nodes/foreman.cp.lsst.org_spec.rb
index 477d21bd1b..17554e1c09 100644
--- a/spec/hosts/nodes/foreman.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/foreman.cp.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'foreman.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'foreman.cp.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/foreman.dev.lsst.org_spec.rb b/spec/hosts/nodes/foreman.dev.lsst.org_spec.rb
index 13ba865507..849331449a 100644
--- a/spec/hosts/nodes/foreman.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/foreman.dev.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'foreman.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'foreman.dev.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/foreman.ls.lsst.org_spec.rb b/spec/hosts/nodes/foreman.ls.lsst.org_spec.rb
index a6c1ef1de5..ddcedd01ce 100644
--- a/spec/hosts/nodes/foreman.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/foreman.ls.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'foreman.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'foreman.ls.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/foreman.tuc.lsst.cloud_spec.rb b/spec/hosts/nodes/foreman.tuc.lsst.cloud_spec.rb
index c570207c2e..961d5cb0e7 100644
--- a/spec/hosts/nodes/foreman.tuc.lsst.cloud_spec.rb
+++ b/spec/hosts/nodes/foreman.tuc.lsst.cloud_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'foreman.tuc.lsst.cloud', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'foreman.tuc.lsst.cloud',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/gis-bastion01.cp.lsst.org_spec.rb b/spec/hosts/nodes/gis-bastion01.cp.lsst.org_spec.rb
index f3948bd5c5..753290f7b8 100644
--- a/spec/hosts/nodes/gis-bastion01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/gis-bastion01.cp.lsst.org_spec.rb
@@ -3,10 +3,10 @@
 require 'spec_helper'
 
 describe 'gis-bastion01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'gis-bastion01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
@@ -27,7 +27,7 @@
 
       include_examples 'baremetal'
 
-      if facts[:os]['release']['major'] == '7'
+      if os_facts[:os]['release']['major'] == '7'
         it do
           is_expected.to contain_network__interface('enp1s0f0').with(
             bootproto: 'dhcp',
diff --git a/spec/hosts/nodes/konkong01.lsst.org_spec.rb b/spec/hosts/nodes/konkong01.lsst.org_spec.rb
index d84c72e6f3..1e4d0612dd 100644
--- a/spec/hosts/nodes/konkong01.lsst.org_spec.rb
+++ b/spec/hosts/nodes/konkong01.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'konkong01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'konkong01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/kueyen01.dev.lsst.org_spec.rb b/spec/hosts/nodes/kueyen01.dev.lsst.org_spec.rb
index ce2812b556..3f29203c76 100644
--- a/spec/hosts/nodes/kueyen01.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/kueyen01.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'kueyen01.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'kueyen01.dev.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/love01.ls.lsst.org_spec.rb b/spec/hosts/nodes/love01.ls.lsst.org_spec.rb
index 5b31b8da1c..d53c996c51 100644
--- a/spec/hosts/nodes/love01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/love01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'love01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'love01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-archiver.ls.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-archiver.ls.lsst.org_spec.rb
index 73ed2b3745..c585491c60 100644
--- a/spec/hosts/nodes/lsstcam-archiver.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-archiver.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-archiver.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-archiver.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-daq-mgt.ls.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-daq-mgt.ls.lsst.org_spec.rb
index 2cd7bebe8f..bd4559497a 100644
--- a/spec/hosts/nodes/lsstcam-daq-mgt.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-daq-mgt.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-daq-mgt.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-daq-mgt.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-db01.cp.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-db01.cp.lsst.org_spec.rb
index 5b4ad3249f..1487e58c8c 100644
--- a/spec/hosts/nodes/lsstcam-db01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-db01.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-db01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-db01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-db01.ls.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-db01.ls.lsst.org_spec.rb
index 06ba84ec05..3e8eb6f982 100644
--- a/spec/hosts/nodes/lsstcam-db01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-db01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-db01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-db01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-dc01.cp.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-dc01.cp.lsst.org_spec.rb
index 1a1eaa67c0..5e84c11dc7 100644
--- a/spec/hosts/nodes/lsstcam-dc01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-dc01.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-dc01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-dc01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-dc01.ls.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-dc01.ls.lsst.org_spec.rb
index 658bcc9539..57100a8d31 100644
--- a/spec/hosts/nodes/lsstcam-dc01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-dc01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-dc01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-dc01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-mcm.cp.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-mcm.cp.lsst.org_spec.rb
index d88ed71fd2..4dccc365b7 100644
--- a/spec/hosts/nodes/lsstcam-mcm.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-mcm.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-mcm.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-mcm.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-mcm.ls.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-mcm.ls.lsst.org_spec.rb
index d3341438db..d56ceb0384 100644
--- a/spec/hosts/nodes/lsstcam-mcm.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-mcm.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-mcm.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-mcm.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lsstcam-vs01.cp.lsst.org_spec.rb b/spec/hosts/nodes/lsstcam-vs01.cp.lsst.org_spec.rb
index a5f8287a7f..5ec6a1cdd0 100644
--- a/spec/hosts/nodes/lsstcam-vs01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lsstcam-vs01.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lsstcam-vs01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lsstcam-vs01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/luan01.ls.lsst.org_spec.rb b/spec/hosts/nodes/luan01.ls.lsst.org_spec.rb
index 3dc6aa3914..821b7c2c91 100644
--- a/spec/hosts/nodes/luan01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/luan01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'luan01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'luan01.ls.sst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/lukay01.cp.lsst.org_spec.rb b/spec/hosts/nodes/lukay01.cp.lsst.org_spec.rb
index b8aeca950b..2f1baca2d0 100644
--- a/spec/hosts/nodes/lukay01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/lukay01.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'lukay01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'lukay01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/manke01.ls.lsst.org_spec.rb b/spec/hosts/nodes/manke01.ls.lsst.org_spec.rb
index ed6002866a..859b409292 100644
--- a/spec/hosts/nodes/manke01.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/manke01.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'manke01.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'manke01.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/namkueyen01.dev.lsst.org_spec.rb b/spec/hosts/nodes/namkueyen01.dev.lsst.org_spec.rb
index 4eda1d4e6c..21d7037630 100644
--- a/spec/hosts/nodes/namkueyen01.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/namkueyen01.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'namkueyen01.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'namkueyen01.dev.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/perfsonar1.cp.lsst.org_spec.rb b/spec/hosts/nodes/perfsonar1.cp.lsst.org_spec.rb
index 630db5ddbb..ee92f6e75b 100644
--- a/spec/hosts/nodes/perfsonar1.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/perfsonar1.cp.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'perfsonar1.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'perfsonar1.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/perfsonar1.ls.lsst.org_spec.rb b/spec/hosts/nodes/perfsonar1.ls.lsst.org_spec.rb
index 878337c087..8b9e11f675 100644
--- a/spec/hosts/nodes/perfsonar1.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/perfsonar1.ls.lsst.org_spec.rb
@@ -3,13 +3,13 @@
 require 'spec_helper'
 
 describe 'perfsonar1.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     # XXX networking needs to be updated to support EL8+
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'perfsonar1.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/pillan01.tu.lsst.org_spec.rb b/spec/hosts/nodes/pillan01.tu.lsst.org_spec.rb
index cc0d9ad448..2dbb6cfcef 100644
--- a/spec/hosts/nodes/pillan01.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/pillan01.tu.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'pillan01.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'pillan01.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/pillan08.tu.lsst.org_spec.rb b/spec/hosts/nodes/pillan08.tu.lsst.org_spec.rb
index de3f83b02f..dd0bdf893b 100644
--- a/spec/hosts/nodes/pillan08.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/pillan08.tu.lsst.org_spec.rb
@@ -6,12 +6,12 @@
 # pillan08 is "special" and has different PCI bus addresses for the X550T NIC.
 #
 describe 'pillan08.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'pillan08.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/rancher01.dev.lsst.org_spec.rb b/spec/hosts/nodes/rancher01.dev.lsst.org_spec.rb
index c7258f0f47..37d2217c6b 100644
--- a/spec/hosts/nodes/rancher01.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/rancher01.dev.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'rancher01.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'rancher01.dev.lsst.org',
                        is_virtual: true,
                        virtual: 'kvm',
diff --git a/spec/hosts/nodes/ruka01.dev.lsst.org_spec.rb b/spec/hosts/nodes/ruka01.dev.lsst.org_spec.rb
index bdb13e73b3..a17c5101bd 100644
--- a/spec/hosts/nodes/ruka01.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/ruka01.dev.lsst.org_spec.rb
@@ -6,12 +6,12 @@
 # testing cluster/ruka & cluster/ruka/variant/r440
 #
 describe 'ruka01.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'ruka01.dev.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/ruka04.dev.lsst.org_spec.rb b/spec/hosts/nodes/ruka04.dev.lsst.org_spec.rb
index 7149e00b09..306d528da2 100644
--- a/spec/hosts/nodes/ruka04.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/ruka04.dev.lsst.org_spec.rb
@@ -7,12 +7,12 @@
 # ruka01.dev.lsst.org.yaml
 #
 describe 'ruka04.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'ruka04.dev.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/ruka06.dev.lsst.org_spec.rb b/spec/hosts/nodes/ruka06.dev.lsst.org_spec.rb
index 250d7bdaed..e5cfaefb47 100644
--- a/spec/hosts/nodes/ruka06.dev.lsst.org_spec.rb
+++ b/spec/hosts/nodes/ruka06.dev.lsst.org_spec.rb
@@ -6,12 +6,12 @@
 # Testing network interfaces from the site/dev/role/hypervisor/major/** layers.
 #
 describe 'ruka06.dev.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'ruka06.dev.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/tang01.dev.lsst.org_spec.rb b/spec/hosts/nodes/tang01.dev.lsst.org_spec.rb
new file mode 100644
index 0000000000..437b8e197c
--- /dev/null
+++ b/spec/hosts/nodes/tang01.dev.lsst.org_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'tang01.dev.lsst.org', :sitepp do
+  on_supported_os.each do |os, os_facts|
+    next unless os =~ %r{almalinux-9-x86_64}
+
+    context "on #{os}" do
+      let(:facts) do
+        override_facts(os_facts,
+                       fqdn: 'tang01.dev.lsst.org',
+                       is_virtual: true,
+                       virtual: 'kvm',
+                       dmi: {
+                         'product' => {
+                           'name' => 'KVM',
+                         },
+                       })
+      end
+      let(:node_params) do
+        {
+          role: 'tang',
+          site: 'dev',
+        }
+      end
+
+      it { is_expected.to compile.with_all_deps }
+
+      include_examples 'vm'
+      include_context 'with nm interface'
+      it { is_expected.to have_nm__connection_resource_count(1) }
+
+      context 'with enp1s0' do
+        let(:interface) { 'enp1s0' }
+
+        it_behaves_like 'nm enabled interface'
+        it_behaves_like 'nm ethernet interface'
+        it { expect(nm_keyfile['ipv4']['address1']).to eq('139.229.134.4/24,139.229.134.254') }
+        it { expect(nm_keyfile['ipv4']['dns']).to eq('139.229.134.53;139.229.135.54;139.229.135.55;') }
+        it { expect(nm_keyfile['ipv4']['dns-search']).to eq('dev.lsst.org;') }
+        it { expect(nm_keyfile['ipv4']['method']).to eq('manual') }
+      end
+    end # on os
+  end # on_supported_os
+end
diff --git a/spec/hosts/nodes/tang01.tu.lsst.org_spec.rb b/spec/hosts/nodes/tang01.tu.lsst.org_spec.rb
new file mode 100644
index 0000000000..7057b6b9f0
--- /dev/null
+++ b/spec/hosts/nodes/tang01.tu.lsst.org_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'tang01.tu.lsst.org', :sitepp do
+  on_supported_os.each do |os, os_facts|
+    next unless os =~ %r{almalinux-9-x86_64}
+
+    context "on #{os}" do
+      let(:facts) do
+        override_facts(os_facts,
+                       fqdn: 'tang01.tu.lsst.org',
+                       is_virtual: true,
+                       virtual: 'kvm',
+                       dmi: {
+                         'product' => {
+                           'name' => 'KVM',
+                         },
+                       })
+      end
+      let(:node_params) do
+        {
+          role: 'tang',
+          site: 'tu',
+        }
+      end
+
+      it { is_expected.to compile.with_all_deps }
+
+      include_examples 'vm'
+      include_context 'with nm interface'
+      it { is_expected.to have_nm__connection_resource_count(1) }
+
+      context 'with enp1s0' do
+        let(:interface) { 'enp1s0' }
+
+        it_behaves_like 'nm enabled interface'
+        it_behaves_like 'nm ethernet interface'
+        it { expect(nm_keyfile['ipv4']['address1']).to eq('140.252.146.87/27,140.252.146.65') }
+        it { expect(nm_keyfile['ipv4']['dns']).to eq('140.252.146.71;140.252.146.72;140.252.146.73;') }
+        it { expect(nm_keyfile['ipv4']['dns-search']).to eq('tu.lsst.org;') }
+        it { expect(nm_keyfile['ipv4']['method']).to eq('manual') }
+      end
+    end # on os
+  end # on_supported_os
+end
diff --git a/spec/hosts/nodes/tang02.dev.lsst.org_spec.rb b/spec/hosts/nodes/tang02.dev.lsst.org_spec.rb
new file mode 100644
index 0000000000..37fd8205ff
--- /dev/null
+++ b/spec/hosts/nodes/tang02.dev.lsst.org_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'tang02.dev.lsst.org', :sitepp do
+  on_supported_os.each do |os, os_facts|
+    next unless os =~ %r{almalinux-9-x86_64}
+
+    context "on #{os}" do
+      let(:facts) do
+        override_facts(os_facts,
+                       fqdn: 'tang02.dev.lsst.org',
+                       is_virtual: true,
+                       virtual: 'kvm',
+                       dmi: {
+                         'product' => {
+                           'name' => 'KVM',
+                         },
+                       })
+      end
+      let(:node_params) do
+        {
+          role: 'tang',
+          site: 'dev',
+        }
+      end
+
+      it { is_expected.to compile.with_all_deps }
+
+      include_examples 'vm'
+      include_context 'with nm interface'
+      it { is_expected.to have_nm__connection_resource_count(1) }
+
+      context 'with enp1s0' do
+        let(:interface) { 'enp1s0' }
+
+        it_behaves_like 'nm enabled interface'
+        it_behaves_like 'nm ethernet interface'
+        it { expect(nm_keyfile['ipv4']['address1']).to eq('139.229.134.58/24,139.229.134.254') }
+        it { expect(nm_keyfile['ipv4']['dns']).to eq('139.229.134.53;139.229.135.54;139.229.135.55;') }
+        it { expect(nm_keyfile['ipv4']['dns-search']).to eq('dev.lsst.org;') }
+        it { expect(nm_keyfile['ipv4']['method']).to eq('manual') }
+      end
+    end # on os
+  end # on_supported_os
+end
diff --git a/spec/hosts/nodes/tang02.tu.lsst.org_spec.rb b/spec/hosts/nodes/tang02.tu.lsst.org_spec.rb
new file mode 100644
index 0000000000..dfc4563b03
--- /dev/null
+++ b/spec/hosts/nodes/tang02.tu.lsst.org_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'tang02.tu.lsst.org', :sitepp do
+  on_supported_os.each do |os, os_facts|
+    next unless os =~ %r{almalinux-9-x86_64}
+
+    context "on #{os}" do
+      let(:facts) do
+        override_facts(os_facts,
+                       fqdn: 'tang02.tu.lsst.org',
+                       is_virtual: true,
+                       virtual: 'kvm',
+                       dmi: {
+                         'product' => {
+                           'name' => 'KVM',
+                         },
+                       })
+      end
+      let(:node_params) do
+        {
+          role: 'tang',
+          site: 'tu',
+        }
+      end
+
+      it { is_expected.to compile.with_all_deps }
+
+      include_examples 'vm'
+      include_context 'with nm interface'
+      it { is_expected.to have_nm__connection_resource_count(1) }
+
+      context 'with enp1s0' do
+        let(:interface) { 'enp1s0' }
+
+        it_behaves_like 'nm enabled interface'
+        it_behaves_like 'nm ethernet interface'
+        it { expect(nm_keyfile['ipv4']['address1']).to eq('140.252.146.88/27,140.252.146.65') }
+        it { expect(nm_keyfile['ipv4']['dns']).to eq('140.252.146.71;140.252.146.72;140.252.146.73;') }
+        it { expect(nm_keyfile['ipv4']['dns-search']).to eq('tu.lsst.org;') }
+        it { expect(nm_keyfile['ipv4']['method']).to eq('manual') }
+      end
+    end # on os
+  end # on_supported_os
+end
diff --git a/spec/hosts/nodes/tang03.dev.lsst.org_spec.rb b/spec/hosts/nodes/tang03.dev.lsst.org_spec.rb
new file mode 100644
index 0000000000..85067b2e71
--- /dev/null
+++ b/spec/hosts/nodes/tang03.dev.lsst.org_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'tang03.dev.lsst.org', :sitepp do
+  on_supported_os.each do |os, os_facts|
+    next unless os =~ %r{almalinux-9-x86_64}
+
+    context "on #{os}" do
+      let(:facts) do
+        override_facts(os_facts,
+                       fqdn: 'tang03.dev.lsst.org',
+                       is_virtual: true,
+                       virtual: 'kvm',
+                       dmi: {
+                         'product' => {
+                           'name' => 'KVM',
+                         },
+                       })
+      end
+      let(:node_params) do
+        {
+          role: 'tang',
+          site: 'dev',
+        }
+      end
+
+      it { is_expected.to compile.with_all_deps }
+
+      include_examples 'vm'
+      include_context 'with nm interface'
+      it { is_expected.to have_nm__connection_resource_count(1) }
+
+      context 'with enp1s0' do
+        let(:interface) { 'enp1s0' }
+
+        it_behaves_like 'nm enabled interface'
+        it_behaves_like 'nm ethernet interface'
+        it { expect(nm_keyfile['ipv4']['address1']).to eq('139.229.134.59/24,139.229.134.254') }
+        it { expect(nm_keyfile['ipv4']['dns']).to eq('139.229.134.53;139.229.135.54;139.229.135.55;') }
+        it { expect(nm_keyfile['ipv4']['dns-search']).to eq('dev.lsst.org;') }
+        it { expect(nm_keyfile['ipv4']['method']).to eq('manual') }
+      end
+    end # on os
+  end # on_supported_os
+end
diff --git a/spec/hosts/nodes/tang03.tu.lsst.org_spec.rb b/spec/hosts/nodes/tang03.tu.lsst.org_spec.rb
new file mode 100644
index 0000000000..05161fcaa1
--- /dev/null
+++ b/spec/hosts/nodes/tang03.tu.lsst.org_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'tang03.tu.lsst.org', :sitepp do
+  on_supported_os.each do |os, os_facts|
+    next unless os =~ %r{almalinux-9-x86_64}
+
+    context "on #{os}" do
+      let(:facts) do
+        override_facts(os_facts,
+                       fqdn: 'tang03.tu.lsst.org',
+                       is_virtual: true,
+                       virtual: 'kvm',
+                       dmi: {
+                         'product' => {
+                           'name' => 'KVM',
+                         },
+                       })
+      end
+      let(:node_params) do
+        {
+          role: 'tang',
+          site: 'tu',
+        }
+      end
+
+      it { is_expected.to compile.with_all_deps }
+
+      include_examples 'vm'
+      include_context 'with nm interface'
+      it { is_expected.to have_nm__connection_resource_count(1) }
+
+      context 'with enp1s0' do
+        let(:interface) { 'enp1s0' }
+
+        it_behaves_like 'nm enabled interface'
+        it_behaves_like 'nm ethernet interface'
+        it { expect(nm_keyfile['ipv4']['address1']).to eq('140.252.146.89/27,140.252.146.65') }
+        it { expect(nm_keyfile['ipv4']['dns']).to eq('140.252.146.71;140.252.146.72;140.252.146.73;') }
+        it { expect(nm_keyfile['ipv4']['dns-search']).to eq('tu.lsst.org;') }
+        it { expect(nm_keyfile['ipv4']['method']).to eq('manual') }
+      end
+    end # on os
+  end # on_supported_os
+end
diff --git a/spec/hosts/nodes/tel-hw1.ls.lsst.org_spec.rb b/spec/hosts/nodes/tel-hw1.ls.lsst.org_spec.rb
index 730610f062..8fbe71f98a 100644
--- a/spec/hosts/nodes/tel-hw1.ls.lsst.org_spec.rb
+++ b/spec/hosts/nodes/tel-hw1.ls.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'tel-hw1.ls.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'tel-hw1.ls.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/tel-hw1.tu.lsst.org_spec.rb b/spec/hosts/nodes/tel-hw1.tu.lsst.org_spec.rb
index 7ccc472ba4..74a47a521e 100644
--- a/spec/hosts/nodes/tel-hw1.tu.lsst.org_spec.rb
+++ b/spec/hosts/nodes/tel-hw1.tu.lsst.org_spec.rb
@@ -3,10 +3,10 @@
 require 'spec_helper'
 
 describe 'tel-hw1.tu.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'tel-hw1.tu.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/yagan01.cp.lsst.org_spec.rb b/spec/hosts/nodes/yagan01.cp.lsst.org_spec.rb
index 1f4bf50606..0d71338cfd 100644
--- a/spec/hosts/nodes/yagan01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/yagan01.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'yagan01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'yagan01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/yagan11.cp.lsst.org_spec.rb b/spec/hosts/nodes/yagan11.cp.lsst.org_spec.rb
index b12c4b2d38..8a26a88645 100644
--- a/spec/hosts/nodes/yagan11.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/yagan11.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'yagan11.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'yagan11.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/nodes/yepun01.cp.lsst.org_spec.rb b/spec/hosts/nodes/yepun01.cp.lsst.org_spec.rb
index c75b394b37..03ca86dc69 100644
--- a/spec/hosts/nodes/yepun01.cp.lsst.org_spec.rb
+++ b/spec/hosts/nodes/yepun01.cp.lsst.org_spec.rb
@@ -3,12 +3,12 @@
 require 'spec_helper'
 
 describe 'yepun01.cp.lsst.org', :sitepp do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
       let(:facts) do
-        override_facts(facts,
+        override_facts(os_facts,
                        fqdn: 'yepun01.cp.lsst.org',
                        is_virtual: false,
                        virtual: 'physical',
diff --git a/spec/hosts/roles/amor_spec.rb b/spec/hosts/roles/amor_spec.rb
index b42cb674ae..b115e1b4ac 100644
--- a/spec/hosts/roles/amor_spec.rb
+++ b/spec/hosts/roles/amor_spec.rb
@@ -5,9 +5,9 @@
 role = 'amor'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -18,14 +18,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           include_examples 'docker'
           include_examples 'dco'
 
diff --git a/spec/hosts/roles/atsccs_spec.rb b/spec/hosts/roles/atsccs_spec.rb
index d68936ee20..15452b4ac3 100644
--- a/spec/hosts/roles/atsccs_spec.rb
+++ b/spec/hosts/roles/atsccs_spec.rb
@@ -5,9 +5,9 @@
 role = 'atsccs'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -18,15 +18,15 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'ccs common', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'ccs common', os_facts: os_facts
           it { is_expected.to contain_class('ccs_sal') }
         end # host
       end # lsst_sites
diff --git a/spec/hosts/roles/atsdaq_spec.rb b/spec/hosts/roles/atsdaq_spec.rb
index a367b2c2cc..7c7f6fa5e6 100644
--- a/spec/hosts/roles/atsdaq_spec.rb
+++ b/spec/hosts/roles/atsdaq_spec.rb
@@ -5,9 +5,9 @@
 role = 'atsdaq'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -18,15 +18,15 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'ccs common', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'ccs common', os_facts: os_facts
           include_examples 'lsst-daq sysctls'
           # it { is_expected.to contain_class('ccs_daq') }
           # it { is_expected.to contain_class('daq::daqsdk').with_version('R5-V0.6') }
diff --git a/spec/hosts/roles/atshcu_spec.rb b/spec/hosts/roles/atshcu_spec.rb
index 0dc49b340c..ce6adbba21 100644
--- a/spec/hosts/roles/atshcu_spec.rb
+++ b/spec/hosts/roles/atshcu_spec.rb
@@ -5,9 +5,9 @@
 role = 'atshcu'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,16 +17,16 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'ccs common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'ccs common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
           it { is_expected.to contain_class('ccs_hcu') }
         end # host
       end # lsst_sites
diff --git a/spec/hosts/roles/auxtel_archiver_spec.rb b/spec/hosts/roles/auxtel_archiver_spec.rb
index 4e8cf9a044..e5fbe07c33 100644
--- a/spec/hosts/roles/auxtel_archiver_spec.rb
+++ b/spec/hosts/roles/auxtel_archiver_spec.rb
@@ -5,9 +5,9 @@
 role = 'auxtel-archiver'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           include_examples 'lhn sysctls'
           include_examples 'archiver'
           include_examples 'docker'
diff --git a/spec/hosts/roles/bastion_spec.rb b/spec/hosts/roles/bastion_spec.rb
index da7c46b31e..56678f46f7 100644
--- a/spec/hosts/roles/bastion_spec.rb
+++ b/spec/hosts/roles/bastion_spec.rb
@@ -5,9 +5,9 @@
 role = 'bastion'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,15 +17,15 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
           it { is_expected.to contain_class('mate') }
 
           %w[
diff --git a/spec/hosts/roles/catchall_spec.rb b/spec/hosts/roles/catchall_spec.rb
index 90181bf3af..12e35c7baa 100644
--- a/spec/hosts/roles/catchall_spec.rb
+++ b/spec/hosts/roles/catchall_spec.rb
@@ -14,9 +14,9 @@ def roles_without_spec
 
 roles_without_spec.each do |role|
   describe "#{role} role" do
-    on_supported_os.each do |os, facts|
+    on_supported_os.each do |os, os_facts|
       context "on #{os}" do
-        let(:facts) { facts }
+        let(:facts) { os_facts }
         let(:node_params) do
           {
             role: role,
@@ -29,14 +29,14 @@ def roles_without_spec
         # file.
         [lsst_sites.sample].each do |site|
           fqdn = "#{role}.#{site}.lsst.org"
-          override_facts(facts, fqdn: fqdn, networking: { 'fqdn' => fqdn })
+          override_facts(os_facts, fqdn: fqdn, networking: { 'fqdn' => fqdn })
 
           describe fqdn, :sitepp do
             let(:site) { site }
 
             it { is_expected.to compile.with_all_deps }
 
-            include_examples 'common', facts: facts
+            include_examples 'common', os_facts: os_facts
           end # host
         end # site
       end # on os
diff --git a/spec/hosts/roles/ccs_dc_spec.rb b/spec/hosts/roles/ccs_dc_spec.rb
index b1b2ea928e..09a90dc999 100644
--- a/spec/hosts/roles/ccs_dc_spec.rb
+++ b/spec/hosts/roles/ccs_dc_spec.rb
@@ -5,9 +5,9 @@
 role = 'ccs-dc'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -18,17 +18,17 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'ccs common', facts: facts
-          include_examples 'x2go packages', facts: facts
-          include_examples 'lsst-daq sysctls', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'ccs common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
+          include_examples 'lsst-daq sysctls', os_facts: os_facts
 
           %w[
             ccs_daq
diff --git a/spec/hosts/roles/ccs_desktop_spec.rb b/spec/hosts/roles/ccs_desktop_spec.rb
index 5294e61fb6..128862dad6 100644
--- a/spec/hosts/roles/ccs_desktop_spec.rb
+++ b/spec/hosts/roles/ccs_desktop_spec.rb
@@ -5,9 +5,9 @@
 role = 'ccs-desktop'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,16 +17,16 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'ccs common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'ccs common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
         end # host
       end # lsst_sites
     end # on os
diff --git a/spec/hosts/roles/ccs_hcu_spec.rb b/spec/hosts/roles/ccs_hcu_spec.rb
index c975b395de..22ecbbb366 100644
--- a/spec/hosts/roles/ccs_hcu_spec.rb
+++ b/spec/hosts/roles/ccs_hcu_spec.rb
@@ -5,9 +5,9 @@
 role = 'ccs-hcu'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,16 +17,16 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'ccs common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'ccs common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
           it { is_expected.to contain_class('ccs_hcu') }
         end # host
       end # lsst_sites
diff --git a/spec/hosts/roles/ccs_mcm_spec.rb b/spec/hosts/roles/ccs_mcm_spec.rb
index 834dfad412..e18982754a 100644
--- a/spec/hosts/roles/ccs_mcm_spec.rb
+++ b/spec/hosts/roles/ccs_mcm_spec.rb
@@ -5,14 +5,14 @@
 role = 'ccs-mcm'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
       %w[
         comcam-ccs
         auxtel-ccs
       ].each do |cluster|
         context "#{cluster} cluster" do
-          let(:facts) { facts }
+          let(:facts) { os_facts }
           let(:node_params) do
             {
               role: role,
@@ -23,16 +23,16 @@
 
           lsst_sites.each do |site|
             fqdn = "#{role}.#{site}.lsst.org"
-            override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+            override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
             describe fqdn, :sitepp do
               let(:site) { site }
 
               it { is_expected.to compile.with_all_deps }
 
-              include_examples 'common', facts: facts
-              include_examples 'ccs common', facts: facts
-              include_examples 'x2go packages', facts: facts
+              include_examples 'common', os_facts: os_facts
+              include_examples 'ccs common', os_facts: os_facts
+              include_examples 'x2go packages', os_facts: os_facts
             end # host
           end # lsst_sites
         end # cluster
diff --git a/spec/hosts/roles/ccs_viswork_spec.rb b/spec/hosts/roles/ccs_viswork_spec.rb
index e9cf32f4a7..a21df6738c 100644
--- a/spec/hosts/roles/ccs_viswork_spec.rb
+++ b/spec/hosts/roles/ccs_viswork_spec.rb
@@ -5,9 +5,9 @@
 role = 'ccs-viswork'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,16 +17,16 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'ccs common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'ccs common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
         end # host
       end # lsst_sites
     end # on os
diff --git a/spec/hosts/roles/cmms_spec.rb b/spec/hosts/roles/cmms_spec.rb
index 2960dd8da3..60495ab197 100644
--- a/spec/hosts/roles/cmms_spec.rb
+++ b/spec/hosts/roles/cmms_spec.rb
@@ -6,9 +6,9 @@
 role = 'cmms'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -18,7 +18,7 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
diff --git a/spec/hosts/roles/comcam_archiver_spec.rb b/spec/hosts/roles/comcam_archiver_spec.rb
index 2792112444..d9dcd80b6f 100644
--- a/spec/hosts/roles/comcam_archiver_spec.rb
+++ b/spec/hosts/roles/comcam_archiver_spec.rb
@@ -5,9 +5,9 @@
 role = 'comcam-archiver'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           include_examples 'lhn sysctls'
           include_examples 'archiver'
           include_examples 'docker'
diff --git a/spec/hosts/roles/comcam_fp_spec.rb b/spec/hosts/roles/comcam_fp_spec.rb
index fa47e7b131..a5b8d8ba06 100644
--- a/spec/hosts/roles/comcam_fp_spec.rb
+++ b/spec/hosts/roles/comcam_fp_spec.rb
@@ -5,9 +5,9 @@
 role = 'comcam-fp'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -18,15 +18,15 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
           include_examples 'lsst-daq sysctls'
           it { is_expected.not_to contain_class('profile::core::sysctl::lhn') }
           it { is_expected.not_to contain_class('dhcp') }
diff --git a/spec/hosts/roles/daq_mgt_spec.rb b/spec/hosts/roles/daq_mgt_spec.rb
index e9ae58a431..919cc2418a 100644
--- a/spec/hosts/roles/daq_mgt_spec.rb
+++ b/spec/hosts/roles/daq_mgt_spec.rb
@@ -2,10 +2,10 @@
 
 require 'spec_helper'
 
-shared_examples 'generic daq manager' do |facts:|
-  include_examples 'common', facts: facts, chrony: false
+shared_examples 'generic daq manager' do |os_facts:|
+  include_examples 'common', os_facts: os_facts, chrony: false
   include_examples 'lsst-daq sysctls'
-  include_examples 'nfsv2 enabled', facts: facts
+  include_examples 'nfsv2 enabled', os_facts: os_facts
   include_examples 'daq common'
 
   it { is_expected.to contain_class('hosts') }
@@ -46,11 +46,12 @@
 role = 'daq-mgt'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
+
       let(:node_params) do
         {
           role: role,
@@ -60,14 +61,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'generic daq manager', facts: facts
+          include_examples 'generic daq manager', os_facts: os_facts
         end # host
       end # lsst_sites
     end # on os
diff --git a/spec/hosts/roles/dco_spec.rb b/spec/hosts/roles/dco_spec.rb
index c1f11c162b..c482764363 100644
--- a/spec/hosts/roles/dco_spec.rb
+++ b/spec/hosts/roles/dco_spec.rb
@@ -5,9 +5,9 @@
 role = 'dco'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           include_examples 'docker'
           include_examples 'dco'
 
diff --git a/spec/hosts/roles/dimm_spec.rb b/spec/hosts/roles/dimm_spec.rb
index ee605da250..aab59ce479 100644
--- a/spec/hosts/roles/dimm_spec.rb
+++ b/spec/hosts/roles/dimm_spec.rb
@@ -5,9 +5,9 @@
 role = 'dimm'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           it { is_expected.to contain_class('profile::core::yum::lsst_ts_private') }
           it { is_expected.to contain_package('ts_dimm_app-2.0-1.el8.x86_64') }
           it { is_expected.to contain_package('telnet') }
diff --git a/spec/hosts/roles/dm_bastion_spec.rb b/spec/hosts/roles/dm_bastion_spec.rb
index 1e4b2d01e3..d68deaa2d3 100644
--- a/spec/hosts/roles/dm_bastion_spec.rb
+++ b/spec/hosts/roles/dm_bastion_spec.rb
@@ -5,9 +5,9 @@
 role = 'dm-bastion'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           it { is_expected.to have_nfs__client__mount_resource_count(6) }
 
           it do
diff --git a/spec/hosts/roles/dnscache_spec.rb b/spec/hosts/roles/dnscache_spec.rb
index 4042e0bc03..a74f3dcb9a 100644
--- a/spec/hosts/roles/dnscache_spec.rb
+++ b/spec/hosts/roles/dnscache_spec.rb
@@ -5,11 +5,11 @@
 role = 'dnscache'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next if os =~ %r{centos-7-x86_64}
 
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -19,14 +19,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
 
           it do
             is_expected.to contain_class('dns').with(
diff --git a/spec/hosts/roles/docker_compose_spec.rb b/spec/hosts/roles/docker_compose_spec.rb
index 637e1abc67..5492b5fe13 100644
--- a/spec/hosts/roles/docker_compose_spec.rb
+++ b/spec/hosts/roles/docker_compose_spec.rb
@@ -5,9 +5,9 @@
 role = 'docker-compose'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           include_examples 'docker'
 
           it { is_expected.to contain_package('docker-compose-plugin') }
diff --git a/spec/hosts/roles/dtn_spec.rb b/spec/hosts/roles/dtn_spec.rb
index 8c793b1cf2..7d2f459a26 100644
--- a/spec/hosts/roles/dtn_spec.rb
+++ b/spec/hosts/roles/dtn_spec.rb
@@ -5,9 +5,9 @@
 role = 'dtn'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           it { is_expected.to contain_class('profile::core::common') }
           it { is_expected.to contain_class('profile::core::dtn') }
 
diff --git a/spec/hosts/roles/foreman_spec.rb b/spec/hosts/roles/foreman_spec.rb
index 4244fe2c85..3b9e09ec5c 100644
--- a/spec/hosts/roles/foreman_spec.rb
+++ b/spec/hosts/roles/foreman_spec.rb
@@ -5,11 +5,11 @@
 role = 'foreman'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ (%r{^centos-7-x86_64$}) || os =~ (%r{^almalinux-8-x86_64$})
 
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -19,7 +19,7 @@
       let(:smee_url) { 'https://smee.io/lpxrggGObEn5YTA' }
 
       describe 'foreman.dev.lsst.org', :sitepp do
-        facts.merge!(fqdn: 'foreman.dev.lsst.org')
+        os_facts.merge!(fqdn: 'foreman.dev.lsst.org')
         let(:site) { 'dev' }
         let(:ntpservers) do
           %w[
@@ -44,12 +44,12 @@
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'common', facts: facts
+        include_examples 'common', os_facts: os_facts
         include_examples 'generic foreman'
       end # host
 
       describe 'foreman.tuc.lsst.cloud', :sitepp do
-        facts.merge!(fqdn: 'foreman.tuc.lsst.cloud')
+        os_facts.merge!(fqdn: 'foreman.tuc.lsst.cloud')
         let(:site) { 'tu' }
         let(:ntpservers) do
           %w[
@@ -73,12 +73,12 @@
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'common', facts: facts
+        include_examples 'common', os_facts: os_facts
         include_examples 'generic foreman'
       end # host
 
       describe 'foreman.ls.lsst.org', :sitepp do
-        facts.merge!(fqdn: 'foreman.ls.lsst.org')
+        os_facts.merge!(fqdn: 'foreman.ls.lsst.org')
         let(:site) { 'ls' }
         let(:ntpservers) do
           %w[
@@ -103,12 +103,12 @@
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'common', facts: facts
+        include_examples 'common', os_facts: os_facts
         include_examples 'generic foreman'
       end # host
 
       describe 'foreman.cp.lsst.org', :sitepp do
-        facts.merge!(fqdn: 'foreman.cp.lsst.org')
+        os_facts.merge!(fqdn: 'foreman.cp.lsst.org')
         let(:site) { 'cp' }
         let(:ntpservers) do
           %w[
@@ -132,7 +132,7 @@
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'common', facts: facts
+        include_examples 'common', os_facts: os_facts
         include_examples 'generic foreman'
       end # host
     end
diff --git a/spec/hosts/roles/generic_spec.rb b/spec/hosts/roles/generic_spec.rb
index f69f021d39..3f24280e96 100644
--- a/spec/hosts/roles/generic_spec.rb
+++ b/spec/hosts/roles/generic_spec.rb
@@ -5,9 +5,9 @@
 role = 'generic'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
         end # host
       end # lsst_sites
     end # on os
diff --git a/spec/hosts/roles/hexrot_spec.rb b/spec/hosts/roles/hexrot_spec.rb
index e8ba76819c..6d539beb6c 100644
--- a/spec/hosts/roles/hexrot_spec.rb
+++ b/spec/hosts/roles/hexrot_spec.rb
@@ -5,9 +5,9 @@
 role = 'hexrot'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,15 +17,15 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
           it { is_expected.to contain_class('mate') }
 
           # XXX hexrot uses devicemapper, so the docker example group isn't included
diff --git a/spec/hosts/roles/hvac_spec.rb b/spec/hosts/roles/hvac_spec.rb
index c6e726251f..4be16f19d6 100644
--- a/spec/hosts/roles/hvac_spec.rb
+++ b/spec/hosts/roles/hvac_spec.rb
@@ -5,9 +5,9 @@
 role = 'hvac'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,15 +17,15 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
           it { is_expected.to contain_class('mate') }
         end # host
       end # lsst_sites
diff --git a/spec/hosts/roles/hypervisor_spec.rb b/spec/hosts/roles/hypervisor_spec.rb
index ae2f0437b3..0895a2c1e0 100644
--- a/spec/hosts/roles/hypervisor_spec.rb
+++ b/spec/hosts/roles/hypervisor_spec.rb
@@ -5,9 +5,9 @@
 role = 'hypervisor'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
 
           %w[
             libguestfs
@@ -42,7 +42,7 @@
 
           it { is_expected.to contain_class('tuned').with_active_profile('virtual-host') }
 
-          if facts[:os]['release']['major'] == '9'
+          if os_facts[:os]['release']['major'] == '9'
             it do
               is_expected.to contain_service('virtproxyd').with(
                 enable: true,
diff --git a/spec/hosts/roles/ipareplica_spec.rb b/spec/hosts/roles/ipareplica_spec.rb
index ca073dd763..30e6b7cd39 100644
--- a/spec/hosts/roles/ipareplica_spec.rb
+++ b/spec/hosts/roles/ipareplica_spec.rb
@@ -5,9 +5,9 @@
 role = 'ipareplica'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,14 +17,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts, no_auth: true
+          include_examples 'common', os_facts: os_facts, no_auth: true
 
           it do
             is_expected.to contain_class('tailscale').with_up_options(
diff --git a/spec/hosts/roles/it_ansible_spec.rb b/spec/hosts/roles/it_ansible_spec.rb
index d2e6feea60..a12c6bc8f8 100644
--- a/spec/hosts/roles/it_ansible_spec.rb
+++ b/spec/hosts/roles/it_ansible_spec.rb
@@ -5,7 +5,7 @@
 role = 'it-ansible'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
       let(:pre_condition) do
         <<~PP
@@ -13,7 +13,7 @@
         PP
       end
 
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -23,14 +23,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
         end # host
       end # lsst_sites
     end # on os
diff --git a/spec/hosts/roles/m1m3_spec.rb b/spec/hosts/roles/m1m3_spec.rb
index 1bf0731502..0fbae5c458 100644
--- a/spec/hosts/roles/m1m3_spec.rb
+++ b/spec/hosts/roles/m1m3_spec.rb
@@ -5,9 +5,9 @@
 role = 'm1m3'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,15 +17,15 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
           it { is_expected.to contain_class('mate') }
 
           %w[
diff --git a/spec/hosts/roles/m2_spec.rb b/spec/hosts/roles/m2_spec.rb
index 73ad5945c3..914ad3a376 100644
--- a/spec/hosts/roles/m2_spec.rb
+++ b/spec/hosts/roles/m2_spec.rb
@@ -5,9 +5,9 @@
 role = 'm2'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,15 +17,15 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'x2go packages', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'x2go packages', os_facts: os_facts
           it { is_expected.to contain_class('mate') }
           it { is_expected.to contain_class('profile::core::common') }
           it { is_expected.to contain_class('profile::core::debugutils') }
diff --git a/spec/hosts/roles/nfsserver_spec.rb b/spec/hosts/roles/nfsserver_spec.rb
index 7e079084fb..433153fc5e 100644
--- a/spec/hosts/roles/nfsserver_spec.rb
+++ b/spec/hosts/roles/nfsserver_spec.rb
@@ -5,9 +5,9 @@
 role = 'nfsserver'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,12 +17,11 @@
 
       describe 'nfsserver.cp.lsst.org', :sitepp do
         let(:site) { 'cp' }
-
-        facts.merge!(fqdn: 'nfsserver.cp.lsst.org')
+        let(:facts) { override_facts(os_facts, fqdn: 'nfsserver.cp.lsst.org') }
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'common', facts: facts
+        include_examples 'common', os_facts: os_facts
 
         it do
           is_expected.to contain_class('nfs').with(
diff --git a/spec/hosts/roles/perfsonar_spec.rb b/spec/hosts/roles/perfsonar_spec.rb
index aae57c53d4..458daf26c8 100644
--- a/spec/hosts/roles/perfsonar_spec.rb
+++ b/spec/hosts/roles/perfsonar_spec.rb
@@ -5,9 +5,9 @@
 role = 'perfsonar'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,7 +17,7 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { 'fqdn' => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { 'fqdn' => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
@@ -27,10 +27,10 @@
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
-          include_examples 'generic perfsonar', facts: facts
+          include_examples 'common', os_facts: os_facts
+          include_examples 'generic perfsonar', os_facts: os_facts
           include_examples 'ipset'
-          include_examples 'firewall default', facts: facts
+          include_examples 'firewall default', os_facts: os_facts
           include_examples 'firewall node_exporter scraping', site: site
 
           it do
@@ -46,7 +46,6 @@
               ipset: 'aura src',
               dport: '22',
               action: 'accept',
-              require: 'Ipset::Set[aura]',
             )
           end
         end # host
diff --git a/spec/hosts/roles/puppetdb_spec.rb b/spec/hosts/roles/puppetdb_spec.rb
index b7094c24ac..1993da5b24 100644
--- a/spec/hosts/roles/puppetdb_spec.rb
+++ b/spec/hosts/roles/puppetdb_spec.rb
@@ -12,11 +12,11 @@
 role = 'puppetdb'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     next unless os =~ %r{almalinux-9-x86_64}
 
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -26,14 +26,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           include_examples 'puppetdb'
         end # host
       end # lsst_sites
diff --git a/spec/hosts/roles/rke_spec.rb b/spec/hosts/roles/rke_spec.rb
index 4f60eb1c23..037417dfe7 100644
--- a/spec/hosts/roles/rke_spec.rb
+++ b/spec/hosts/roles/rke_spec.rb
@@ -2,8 +2,8 @@
 
 require 'spec_helper'
 
-shared_examples 'generic rke' do |facts:|
-  include_examples 'common', facts: facts, node_exporter: false
+shared_examples 'generic rke' do |os_facts:|
+  include_examples 'common', os_facts: os_facts, node_exporter: false
   include_examples 'debugutils'
   include_examples 'docker'
   include_examples 'rke profile'
@@ -39,9 +39,9 @@
 role = 'rke'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -53,12 +53,12 @@
       # rubocop:disable RSpec/RepeatedExampleGroupDescription
       describe fqdn, :sitepp do
         # rubocop:enable RSpec/RepeatedExampleGroupDescription
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
         let(:site) { 'tu' }
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'generic rke', facts: facts
+        include_examples 'generic rke', os_facts: os_facts
 
         it do
           is_expected.to contain_class('rke').with(
@@ -72,12 +72,12 @@
       # rubocop:disable RSpec/RepeatedExampleGroupDescription
       describe fqdn, :sitepp do
         # rubocop:enable RSpec/RepeatedExampleGroupDescription
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
         let(:site) { 'ls' }
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'generic rke', facts: facts
+        include_examples 'generic rke', os_facts: os_facts
 
         it do
           is_expected.to contain_class('rke').with(
@@ -91,12 +91,12 @@
       # rubocop:disable RSpec/RepeatedExampleGroupDescription
       describe fqdn, :sitepp do
         # rubocop:enable RSpec/RepeatedExampleGroupDescription
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
         let(:site) { 'cp' }
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'generic rke', facts: facts
+        include_examples 'generic rke', os_facts: os_facts
 
         it do
           is_expected.to contain_class('rke').with(
@@ -110,12 +110,12 @@
       # rubocop:disable RSpec/RepeatedExampleGroupDescription
       describe fqdn, :sitepp do
         # rubocop:enable RSpec/RepeatedExampleGroupDescription
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
         let(:site) { 'dev' }
 
         it { is_expected.to compile.with_all_deps }
 
-        include_examples 'generic rke', facts: facts
+        include_examples 'generic rke', os_facts: os_facts
 
         it do
           is_expected.to contain_class('rke').with(
diff --git a/spec/hosts/roles/rpi_spec.rb b/spec/hosts/roles/rpi_spec.rb
index 241b442f01..74eeccad24 100644
--- a/spec/hosts/roles/rpi_spec.rb
+++ b/spec/hosts/roles/rpi_spec.rb
@@ -6,9 +6,9 @@
 role = 'rpi'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -18,7 +18,7 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
diff --git a/spec/hosts/roles/sal_dx_spec.rb b/spec/hosts/roles/sal_dx_spec.rb
index 19a70f494e..3cb638fd56 100644
--- a/spec/hosts/roles/sal_dx_spec.rb
+++ b/spec/hosts/roles/sal_dx_spec.rb
@@ -5,9 +5,9 @@
 role = 'sal-dx'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,16 +17,16 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           include_examples 'debugutils'
-          include_examples 'x2go packages', facts: facts
+          include_examples 'x2go packages', os_facts: os_facts
           it { is_expected.to contain_class('mate') }
         end # host
       end # lsst_sites
diff --git a/spec/hosts/roles/tang_spec.rb b/spec/hosts/roles/tang_spec.rb
new file mode 100644
index 0000000000..874a08b04f
--- /dev/null
+++ b/spec/hosts/roles/tang_spec.rb
@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+role = 'tang'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, os_facts|
+    next unless os =~ %r{almalinux-9-x86_64}
+
+    context "on #{os}" do
+      let(:facts) { os_facts }
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+        }
+      end
+
+      lsst_sites.each do |site|
+        fqdn = "#{role}.#{site}.lsst.org"
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
+
+        describe fqdn, :sitepp do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          include_examples 'common', os_facts: os_facts
+          include_examples 'ipset'
+          include_examples 'firewall default', os_facts: os_facts
+          include_examples 'firewall node_exporter scraping', site: site
+          include_examples 'restic common'
+
+          it { is_expected.to contain_class('tang') }
+          it { is_expected.to contain_package('jose') }
+
+          case site
+          when 'dev'
+            it do
+              is_expected.to contain_firewall('200 accept tang').with(
+                proto: 'tcp',
+                state: 'NEW',
+                ipset: 'dev src',
+                dport: '7500',
+                action: 'accept',
+              )
+            end
+          when 'tu'
+            it do
+              is_expected.to contain_firewall('200 accept tang').with(
+                proto: 'tcp',
+                state: 'NEW',
+                ipset: 'tufde src',
+                dport: '7500',
+                action: 'accept',
+              )
+            end
+          end
+
+          it do
+            is_expected.to contain_restic__repository('awsrepo').with(
+              backup_path: %w[
+                /var/db/tang
+              ],
+              backup_timer: '*-*-* *:47:00',
+              enable_forget: true,
+              forget_timer: '*-*-* 15:00:00',
+              forget_flags: '--keep-within 1y',
+            )
+          end
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/ts_csc_spec.rb b/spec/hosts/roles/ts_csc_spec.rb
index 885d80c677..ffebbabd84 100644
--- a/spec/hosts/roles/ts_csc_spec.rb
+++ b/spec/hosts/roles/ts_csc_spec.rb
@@ -5,9 +5,9 @@
 role = 'ts-csc'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -18,14 +18,14 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
 
           it { is_expected.to compile.with_all_deps }
 
-          include_examples 'common', facts: facts
+          include_examples 'common', os_facts: os_facts
           include_examples 'docker'
 
           it { is_expected.to contain_package('docker-compose-plugin') }
diff --git a/spec/hosts/roles/ubuntu_spec.rb b/spec/hosts/roles/ubuntu_spec.rb
index b86e5747d7..175c032d02 100644
--- a/spec/hosts/roles/ubuntu_spec.rb
+++ b/spec/hosts/roles/ubuntu_spec.rb
@@ -14,9 +14,9 @@
     ],
   }
 
-  on_supported_os(test_on).each do |os, facts|
+  on_supported_os(test_on).each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -26,7 +26,7 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
diff --git a/spec/hosts/roles/vms-data_spec.rb b/spec/hosts/roles/vms-data_spec.rb
index 9e9d1fada2..5f81cc6532 100644
--- a/spec/hosts/roles/vms-data_spec.rb
+++ b/spec/hosts/roles/vms-data_spec.rb
@@ -5,9 +5,9 @@
 role = 'vms-data'
 
 describe "#{role} role" do
-  on_supported_os.each do |os, facts|
+  on_supported_os.each do |os, os_facts|
     context "on #{os}" do
-      let(:facts) { facts }
+      let(:facts) { os_facts }
       let(:node_params) do
         {
           role: role,
@@ -17,7 +17,7 @@
 
       lsst_sites.each do |site|
         fqdn = "#{role}.#{site}.lsst.org"
-        override_facts(facts, fqdn: fqdn, networking: { fqdn => fqdn })
+        override_facts(os_facts, fqdn: fqdn, networking: { fqdn => fqdn })
 
         describe fqdn, :sitepp do
           let(:site) { site }
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index b6e595a399..a36b00de82 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -147,8 +147,8 @@ def node_files
 
 # XXX The network param is a kludge until the el8 dnscache nodes are converted
 # to NM.
-shared_examples 'common' do |facts:, no_auth: false, chrony: true, network: true, node_exporter: true|
-  include_examples 'bash_completion', facts: facts
+shared_examples 'common' do |os_facts:, no_auth: false, chrony: true, network: true, node_exporter: true|
+  include_examples 'bash_completion', os_facts: os_facts
   include_examples 'convenience'
   include_examples 'telegraf'
   include_examples 'rsyslog defaults'
@@ -158,7 +158,7 @@ def node_files
     # being caught by hiera string interpolation
     include_examples 'krb5.conf content', %r{default_ccache_name = FILE:/tmp/krb5cc_%{uid}}
 
-    include_examples 'krb5.conf.d files', facts: facts
+    include_examples 'krb5.conf.d files', os_facts: os_facts
     include_examples 'sssd services'
 
     it { is_expected.to contain_class('ssh').that_requires('Class[ipa]') }
@@ -206,7 +206,7 @@ def node_files
       ).that_requires('Class[ipa]')
     end
 
-    if facts[:os]['release']['major'] == '7'
+    if os_facts[:os]['release']['major'] == '7'
       it do
         is_expected.to contain_file('/etc/sssd/sssd.conf').with_content(<<~SSSD)
           #
@@ -276,7 +276,7 @@ def node_files
     include_examples 'no node_exporter'
   end
 
-  if facts[:os]['family'] == 'RedHat'
+  if os_facts[:os]['family'] == 'RedHat'
     it { is_expected.to contain_class('epel') }
     it { is_expected.to contain_class('yum::plugin::versionlock').with_clean(true) }
     it { is_expected.to contain_yum__versionlock('puppet-agent').with_version('7.21.0') }
@@ -291,7 +291,7 @@ def node_files
       expect(catalogue.resource('class', 'yum')[:repos]['extras']).to include('enabled' => true)
     end
 
-    if facts[:os]['release']['major'] == '7'
+    if os_facts[:os]['release']['major'] == '7'
       it { is_expected.not_to contain_package('NetworkManager-initscripts-updown') }
       it { is_expected.to contain_class('yum').with_managed_repos(['extras']) }
       it { is_expected.to contain_class('lldpd').with_manage_repo(true) }
@@ -299,7 +299,7 @@ def node_files
       network and it { is_expected.to contain_class('network') }
       it { is_expected.not_to contain_class('nm') }
 
-      if facts[:os]['architecture'] == 'x86_64'
+      if os_facts[:os]['architecture'] == 'x86_64'
         it { is_expected.to contain_class('scl') }
       else
         it { is_expected.not_to contain_class('scl') }
@@ -320,7 +320,7 @@ def node_files
       end
     end
 
-    if facts[:os]['release']['major'] == '8'
+    if os_facts[:os]['release']['major'] == '8'
       it { is_expected.to contain_class('lldpd').with_manage_repo(true) }
 
       network and it { is_expected.not_to contain_class('network') }
@@ -328,7 +328,7 @@ def node_files
       it { is_expected.to contain_package('NetworkManager-initscripts-updown') }
     end
 
-    if facts[:os]['release']['major'] == '9'
+    if os_facts[:os]['release']['major'] == '9'
       it { is_expected.to contain_class('lldpd').with_manage_repo(false) }
 
       network and it { is_expected.not_to contain_class('network') }
@@ -467,8 +467,8 @@ def node_files
   end
 end
 
-shared_examples 'nfsv2 enabled' do |facts:|
-  if facts[:os]['release']['major'] == '7'
+shared_examples 'nfsv2 enabled' do |os_facts:|
+  if os_facts[:os]['release']['major'] == '7'
     it 'enables NFS V2 exports via /etc/sysconfig/nfs' do
       is_expected.to contain_augeas('enable nfs v2 exports').with(
         context: '/files/etc/sysconfig/nfs',
@@ -899,11 +899,11 @@ def node_files
   end
 end
 
-shared_examples 'bash_completion' do |facts:|
-  if facts[:os]['family'] == 'RedHat'
+shared_examples 'bash_completion' do |os_facts:|
+  if os_facts[:os]['family'] == 'RedHat'
     it { is_expected.to contain_package('bash-completion') }
 
-    if facts[:os]['release']['major'] == '7'
+    if os_facts[:os]['release']['major'] == '7'
       it { is_expected.to contain_package('bash-completion-extras') }
     else
       it { is_expected.not_to contain_package('bash-completion-extras') }
@@ -1118,8 +1118,8 @@ def node_files
   end
 end
 
-shared_examples 'x2go packages' do |facts:|
-  packages = if (facts[:os]['family'] == 'RedHat') && (facts[:os]['release']['major'] == '7')
+shared_examples 'x2go packages' do |os_facts:|
+  packages = if (os_facts[:os]['family'] == 'RedHat') && (os_facts[:os]['release']['major'] == '7')
                %w[
                  x2goagent
                  x2goclient
@@ -1215,8 +1215,8 @@ def node_files
   end
 end
 
-shared_examples 'krb5.conf.d files' do |facts:|
-  to = if (facts[:os]['family'] == 'RedHat') && (facts[:os]['release']['major'] == '7')
+shared_examples 'krb5.conf.d files' do |os_facts:|
+  to = if (os_facts[:os]['family'] == 'RedHat') && (os_facts[:os]['release']['major'] == '7')
          'not_to'
        else
          'to'
diff --git a/spec/support/spec/firewall.rb b/spec/support/spec/firewall.rb
index 32caa5c5fb..49aaee735b 100644
--- a/spec/support/spec/firewall.rb
+++ b/spec/support/spec/firewall.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-shared_examples 'firewall default' do |facts:|
-  if (facts[:os]['family'] == 'RedHat') && (facts[:os]['release']['major'] == '9')
+shared_examples 'firewall default' do |os_facts:|
+  if (os_facts[:os]['family'] == 'RedHat') && (os_facts[:os]['release']['major'] == '9')
     it { is_expected.to contain_service('nftables').with_enable(true) }
   end
 
@@ -66,7 +66,6 @@
         ipset: 'ayekan src',
         dport: '9100',
         action: 'accept',
-        require: 'Ipset::Set[ayekan]',
       )
     end
   end
diff --git a/spec/support/spec/ipset.rb b/spec/support/spec/ipset.rb
index 27a97700e5..4b23e5012e 100644
--- a/spec/support/spec/ipset.rb
+++ b/spec/support/spec/ipset.rb
@@ -11,7 +11,7 @@
         198.19.0.0/16
         10.0.0.0/8
       ],
-    )
+    ).that_comes_before('Class[firewall]')
   end
 
   it do
@@ -26,7 +26,7 @@
         198.19.0.0/16
         10.0.0.0/8
       ],
-    )
+    ).that_comes_before('Class[firewall]')
   end
 
   it do
@@ -34,6 +34,26 @@
       %w[
         139.229.144.0/26
       ],
-    )
+    ).that_comes_before('Class[firewall]')
+  end
+
+  it do
+    is_expected.to contain_ipset__set('dev').with_set(
+      %w[
+        139.229.134.0/24
+      ],
+    ).that_comes_before('Class[firewall]')
+  end
+
+  it do
+    is_expected.to contain_ipset__set('tufde').with_set(
+      %w[
+        140.252.146.32/27
+        140.252.146.64/27
+        140.252.147.0/28
+        140.252.147.32/28
+        140.252.147.64/27
+      ],
+    ).that_comes_before('Class[firewall]')
   end
 end