Enable using nested arrays for parameter 'set'

manifests/set.pp

@@ -31,7 +31,7 @@
 #   }
 #
 # @example setup multiple ipsets based on a hiera hash with multiple arrays and multiple IPv4/IPv6 prefixes. Use the voxpupuli/ferm module to create suitable iptables rules.
-#   $ip_ranges = lookup('ip_net_vlans').flatten.unique
+#   $ip_ranges = lookup('ip_net_vlans')
 #   $ip_ranges_ipv4 = $ip_ranges.filter |$ip_range| { $ip_range =~ Stdlib::IP::Address::V4 }
 #   $ip_ranges_ipv6 = $ip_ranges.filter |$ip_range| { $ip_range =~ Stdlib::IP::Address::V6 }
 #
@@ -108,7 +108,7 @@
     # content
     case $set {
       IPSet::Set::Array: { # lint:ignore:unquoted_string_in_case
-        $new_set = join($set, "\n")
+        $new_set = join(flatten($set).unique, "\n")
         # create file with ipset, one record per line
         file { "${config_path}/${title}.set":
           ensure  => file,

spec/acceptance/ipset_spec.rb

@@ -36,6 +36,25 @@
     end
   end
 
+  context 'with a nested array' do
+    it 'handles nested arrays with no errors' do
+      pp = <<-EOS
+      include ipset
+      ipset::set{'nested-set':
+        set  => ['10.0.0.1', ['10.0.0.2', '10.0.0.42']],
+        type => 'hash:net',
+        }
+      EOS
+      # Run it twice and test for idempotency
+      apply_manifest(pp, catch_failures: true)
+      apply_manifest(pp, catch_changes: true)
+    end
+
+    describe command('ipset list basic-set') do
+      its(:stdout) { is_expected.to match %r{.*basic-set.*Type: hash:net.*10\.0\.0\.2.*}m }
+    end
+  end
+
   context 'can delete ipsets' do
     it 'works even here idempotently with no errors' do
       pp = <<-EOS

types/set/array.pp

@@ -1,4 +1,4 @@
 #
-# @summary type to allow an array of ip addresses
+# @summary type to allow nested arrays of ip addresses
 #
-type IPSet::Set::Array = Array[String]
+type IPSet::Set::Array = Variant[Array, String[1]]