diff --git a/metadata.json b/metadata.json
new file mode 100644
index 0000000000..2bb16f7a1e
--- /dev/null
+++ b/metadata.json
@@ -0,0 +1,23 @@
+{
+  "name": "lsst-itconf",
+  "version": "0.1.0",
+  "author": "AURA/LSST/Rubin Observatory",
+  "summary": "LSST/Rubin control repo",
+  "license": "Apache-2.0",
+  "source": "https://github.com/lsst-it/lsst-itconf",
+  "dependencies": [],
+  "operatingsystem_support": [
+    {
+      "operatingsystem": "CentOS",
+      "operatingsystemrelease": [
+        "7"
+      ]
+    }
+  ],
+  "requirements": [
+    {
+      "name": "puppet",
+      "version_requirement": ">= 6.0.0 < 8.0.0"
+    }
+  ]
+}
diff --git a/spec/classes/core/docker_spec.rb b/spec/classes/core/docker_spec.rb
index 85f37f080e..03df75a130 100644
--- a/spec/classes/core/docker_spec.rb
+++ b/spec/classes/core/docker_spec.rb
@@ -3,34 +3,42 @@
 require 'spec_helper'
 
 describe 'profile::core::docker' do
-  it { is_expected.to compile.with_all_deps }
-
-  it do
-    is_expected.to contain_class('docker').with(
-      overlay2_override_kernel_check: true,
-      socket_group: 70_014,
-      socket_override: false,
-      storage_driver: 'overlay2',
-      version: '19.03.15',
-    )
-  end
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts
+      end
 
-  it { is_expected.to contain_class('yum::plugin::versionlock') }
-  it { is_expected.to have_yum__versionlock_resource_count(2) }
-  it { is_expected.to contain_class('docker::networks') }
+      it { is_expected.to compile.with_all_deps }
 
-  it do
-    is_expected.to contain_systemd__dropin_file('wait-for-docker-group.conf').with(
-      unit: 'docker.socket',
-      content: %r{SocketGroup=root},
-    )
-  end
+      it do
+        is_expected.to contain_class('docker').with(
+          overlay2_override_kernel_check: true,
+          socket_group: 70_014,
+          socket_override: false,
+          storage_driver: 'overlay2',
+          version: '19.03.15',
+        )
+      end
 
-  it do
-    is_expected.to contain_file('/etc/systemd/system/docker.service.d/wait-for-docker-group.conf').with_content(%r{Requires=docker.socket containerd.service sssd.service})
-  end
+      it { is_expected.to contain_class('yum::plugin::versionlock') }
+      it { is_expected.to have_yum__versionlock_resource_count(2) }
+      it { is_expected.to contain_class('docker::networks') }
+
+      it do
+        is_expected.to contain_systemd__dropin_file('wait-for-docker-group.conf').with(
+          unit: 'docker.socket',
+          content: %r{SocketGroup=root},
+        )
+      end
+
+      it do
+        is_expected.to contain_file('/etc/systemd/system/docker.service.d/wait-for-docker-group.conf').with_content(%r{Requires=docker.socket containerd.service sssd.service})
+      end
 
-  it do
-    is_expected.to contain_file('/etc/docker/daemon.json').with_content(%r{"live-restore": true})
+      it do
+        is_expected.to contain_file('/etc/docker/daemon.json').with_content(%r{"live-restore": true})
+      end
+    end
   end
 end
diff --git a/spec/hosts/roles/amor_spec.rb b/spec/hosts/roles/amor_spec.rb
index 7f48051010..909ecb5492 100644
--- a/spec/hosts/roles/amor_spec.rb
+++ b/spec/hosts/roles/amor_spec.rb
@@ -2,22 +2,33 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'amor role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'amor',
-            cluster: 'amor',
-          }
-        end
+role = 'amor'
 
-        it { is_expected.to compile.with_all_deps }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-        it { is_expected.to contain_class('docker::networks') }
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+          cluster: role,
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+          it { is_expected.to contain_class('docker::networks') }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/atsccs_spec.rb b/spec/hosts/roles/atsccs_spec.rb
index d6f024af2e..94d6abd1f2 100644
--- a/spec/hosts/roles/atsccs_spec.rb
+++ b/spec/hosts/roles/atsccs_spec.rb
@@ -2,45 +2,34 @@
 
 require 'spec_helper'
 
-shared_examples 'generic auxtel-mcm' do
-  it { is_expected.to contain_class('ccs_sal') }
-end
-
-describe 'atsccs role' do
-  let(:node_params) do
-    {
-      role: 'atsccs',
-      cluster: 'auxtel-ccs',
-    }
-  end
-
-  let(:facts) { { fqdn: self.class.description } }
-
-  context 'with tu site' do
-    let(:node_params) do
-      super().merge(
-        site: 'tu',
-      )
-    end
-
-    describe 'auxtel-mcm.tu.lsst.org', :site, :common do
-      it { is_expected.to compile.with_all_deps }
-
-      include_examples 'generic auxtel-mcm'
-    end
-  end # site
-
-  context 'with cp site' do
-    let(:node_params) do
-      super().merge(
-        site: 'cp',
-      )
-    end
-
-    describe 'auxtel-mcm.cp.lsst.org', :site, :common do
-      it { is_expected.to compile.with_all_deps }
-
-      include_examples 'generic auxtel-mcm'
-    end
-  end # site
-end
+role = 'atsccs'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+          cluster: 'auxtel-ccs',
+        }
+      end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          it { is_expected.to contain_class('ccs_sal') }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/atsdaq_spec.rb b/spec/hosts/roles/atsdaq_spec.rb
index 1eeb2d77bf..be2434297c 100644
--- a/spec/hosts/roles/atsdaq_spec.rb
+++ b/spec/hosts/roles/atsdaq_spec.rb
@@ -2,43 +2,39 @@
 
 require 'spec_helper'
 
-shared_examples 'generic auxtel-fp' do
-  include_examples 'lsst-daq client'
-  # it { is_expected.to contain_class('ccs_daq') }
-  # it { is_expected.to contain_class('daq::daqsdk').with_version('R5-V0.6') }
-end
-
-describe 'atsdaq role' do
-  let(:node_params) do
-    {
-      role: 'atsdaq',
-      cluster: 'auxtel-ccs',
-    }
-  end
-
-  let(:facts) { { fqdn: self.class.description } }
-
-  describe 'auxtel-fp01.cp.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'cp',
-      )
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic auxtel-fp'
-  end # host
-
-  describe 'auxtel-fp01.tu.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'tu',
-      )
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic auxtel-fp'
-  end # host
+role = 'atsdaq'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+          cluster: 'auxtel-ccs',
+        }
+      end
+
+      lsst_sites.each do |site|
+        describe "auxtel-fp01.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          case site
+          when 'tu', 'cp'
+            include_examples 'lsst-daq client'
+          end
+          # it { is_expected.to contain_class('ccs_daq') }
+          # it { is_expected.to contain_class('daq::daqsdk').with_version('R5-V0.6') }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
 end # role
diff --git a/spec/hosts/roles/auxtel_archiver_spec.rb b/spec/hosts/roles/auxtel_archiver_spec.rb
index a34c01b67d..33873e124d 100644
--- a/spec/hosts/roles/auxtel_archiver_spec.rb
+++ b/spec/hosts/roles/auxtel_archiver_spec.rb
@@ -2,43 +2,55 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'auxtel-archiver role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'auxtel-archiver',
-          }
-        end
-
-        it { is_expected.to compile.with_all_deps }
-
-        include_examples 'lhn sysctls'
-        include_examples 'archiver'
-
-        it { is_expected.to contain_file('/data/repo/LATISS') }
-
-        it { is_expected.to contain_rabbitmq_vhost('/test_at') }
-        it { is_expected.to contain_rabbitmq_user_permissions('iip@/test_at') }
-        it { is_expected.to contain_rabbitmq_user_permissions('guest@/test_at') }
-        it { is_expected.to contain_rabbitmq_exchange('message@/test_at') }
-
-        %w[
-          f98_consume@/test_at
-          f99_consume@/test_at
-          at_foreman_ack_publish@/test_at
-          at_publish_to_oods@/test_at
-          oods_publish_to_at@/test_at
-          archive_ctrl_publish@/test_at
-          archive_ctrl_consume@/test_at
-          telemetry_queue@/test_at
-        ].each do |q|
-          it { is_expected.to contain_rabbitmq_queue(q) }
-          it { is_expected.to contain_rabbitmq_binding("message@#{q}") }
-        end
+role = 'auxtel-archiver'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          include_examples 'lhn sysctls'
+          include_examples 'archiver'
+
+          it { is_expected.to contain_file('/data/repo/LATISS') }
+
+          it { is_expected.to contain_rabbitmq_vhost('/test_at') }
+          it { is_expected.to contain_rabbitmq_user_permissions('iip@/test_at') }
+          it { is_expected.to contain_rabbitmq_user_permissions('guest@/test_at') }
+          it { is_expected.to contain_rabbitmq_exchange('message@/test_at') }
+
+          %w[
+            f98_consume@/test_at
+            f99_consume@/test_at
+            at_foreman_ack_publish@/test_at
+            at_publish_to_oods@/test_at
+            oods_publish_to_at@/test_at
+            archive_ctrl_publish@/test_at
+            archive_ctrl_consume@/test_at
+            telemetry_queue@/test_at
+          ].each do |q|
+            it { is_expected.to contain_rabbitmq_queue(q) }
+            it { is_expected.to contain_rabbitmq_binding("message@#{q}") }
+          end
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/ccs_dc_spec.rb b/spec/hosts/roles/ccs_dc_spec.rb
index bdd814cf4a..989eb85b65 100644
--- a/spec/hosts/roles/ccs_dc_spec.rb
+++ b/spec/hosts/roles/ccs_dc_spec.rb
@@ -2,41 +2,37 @@
 
 require 'spec_helper'
 
-shared_examples 'generic ccs-dc' do
-  include_examples 'lsst-daq client'
-end
-
-describe 'ccs-dc role' do
-  let(:node_params) do
-    {
-      role: 'ccs-dc',
-      cluster: 'comcam-ccs',
-    }
-  end
-
-  let(:facts) { { fqdn: self.class.description } }
-
-  describe 'comcam-dc01.cp.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'cp',
-      )
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic ccs-dc'
-  end # host
-
-  describe 'comcam-dc01.tu.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'tu',
-      )
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic ccs-dc'
-  end # host
+role = 'ccs-dc'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+          cluster: 'comcam-ccs',
+        }
+      end
+
+      lsst_sites.each do |site|
+        describe "comcam-dc01.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          case site
+          when 'tu', 'cp'
+            include_examples 'lsst-daq client'
+          end
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
 end # role
diff --git a/spec/hosts/roles/comcam_archiver_spec.rb b/spec/hosts/roles/comcam_archiver_spec.rb
index ce6663babe..3c92cb2ab3 100644
--- a/spec/hosts/roles/comcam_archiver_spec.rb
+++ b/spec/hosts/roles/comcam_archiver_spec.rb
@@ -2,43 +2,55 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'comcam-archiver role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'comcam-archiver',
-          }
-        end
-
-        it { is_expected.to compile.with_all_deps }
-
-        include_examples 'lhn sysctls'
-        include_examples 'archiver'
-
-        it { is_expected.to contain_file('/data/repo/LSSTComCam') }
-
-        it { is_expected.to contain_rabbitmq_vhost('/test_cc') }
-        it { is_expected.to contain_rabbitmq_user_permissions('iip@/test_cc') }
-        it { is_expected.to contain_rabbitmq_user_permissions('guest@/test_cc') }
-        it { is_expected.to contain_rabbitmq_exchange('message@/test_cc') }
-
-        %w[
-          f98_consume@/test_cc
-          f99_consume@/test_cc
-          cc_foreman_ack_publish@/test_cc
-          cc_publish_to_oods@/test_cc
-          oods_publish_to_cc@/test_cc
-          archive_ctrl_publish@/test_cc
-          archive_ctrl_consume@/test_cc
-          telemetry_queue@/test_cc
-        ].each do |q|
-          it { is_expected.to contain_rabbitmq_queue(q) }
-          it { is_expected.to contain_rabbitmq_binding("message@#{q}") }
-        end
+role = 'comcam-archiver'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          include_examples 'lhn sysctls'
+          include_examples 'archiver'
+
+          it { is_expected.to contain_file('/data/repo/LSSTComCam') }
+
+          it { is_expected.to contain_rabbitmq_vhost('/test_cc') }
+          it { is_expected.to contain_rabbitmq_user_permissions('iip@/test_cc') }
+          it { is_expected.to contain_rabbitmq_user_permissions('guest@/test_cc') }
+          it { is_expected.to contain_rabbitmq_exchange('message@/test_cc') }
+
+          %w[
+            f98_consume@/test_cc
+            f99_consume@/test_cc
+            cc_foreman_ack_publish@/test_cc
+            cc_publish_to_oods@/test_cc
+            oods_publish_to_cc@/test_cc
+            archive_ctrl_publish@/test_cc
+            archive_ctrl_consume@/test_cc
+            telemetry_queue@/test_cc
+          ].each do |q|
+            it { is_expected.to contain_rabbitmq_queue(q) }
+            it { is_expected.to contain_rabbitmq_binding("message@#{q}") }
+          end
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/comcam_fp_spec.rb b/spec/hosts/roles/comcam_fp_spec.rb
index 7e70737318..046e2ce402 100644
--- a/spec/hosts/roles/comcam_fp_spec.rb
+++ b/spec/hosts/roles/comcam_fp_spec.rb
@@ -2,49 +2,43 @@
 
 require 'spec_helper'
 
-shared_examples 'generic comcam-fp' do
-  include_examples 'lsst-daq client'
-  it { is_expected.not_to contain_class('profile::core::sysctl::lhn') }
-  it { is_expected.not_to contain_class('dhcp') }
-  it { is_expected.to contain_class('dhcp::disable') }
-  it { is_expected.to contain_class('ccs_daq') }
-end
-
-describe 'comcam-fp role' do
-  let(:node_params) do
-    {
-      role: 'comcam-fp',
-      cluster: 'comcam-ccs',
-    }
-  end
-
-  let(:facts) { { fqdn: self.class.description } }
-
-  describe 'comcam-fp01.cp.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'cp',
-      )
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic comcam-fp'
-
-    it { is_expected.to contain_class('daq::daqsdk').with_version('R5-V3.2') }
-  end # host
-
-  describe 'comcam-fp01.tu.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'tu',
-      )
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic comcam-fp'
-
-    it { is_expected.to contain_class('daq::daqsdk').with_version('R5-V3.2') }
-  end # host
+role = 'comcam-fp'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+          cluster: 'comcam-ccs',
+        }
+      end
+
+      lsst_sites.each do |site|
+        describe "comcam-fp01.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          case site
+          when 'tu', 'cp'
+            include_examples 'lsst-daq client'
+          end
+
+          it { is_expected.not_to contain_class('profile::core::sysctl::lhn') }
+          it { is_expected.not_to contain_class('dhcp') }
+          it { is_expected.to contain_class('dhcp::disable') }
+          it { is_expected.to contain_class('ccs_daq') }
+          it { is_expected.to contain_class('daq::daqsdk').with_version('R5-V3.2') }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
 end # role
diff --git a/spec/hosts/roles/daq_mgt_spec.rb b/spec/hosts/roles/daq_mgt_spec.rb
index 8d7d120bf4..e330fbabee 100644
--- a/spec/hosts/roles/daq_mgt_spec.rb
+++ b/spec/hosts/roles/daq_mgt_spec.rb
@@ -97,119 +97,121 @@
   end
 end
 
-describe 'daq-mgt role' do
-  let(:node_params) do
-    {
-      role: 'daq-mgt',
-    }
-  end
-
-  let(:facts) { { fqdn: self.class.description } }
-
-  # XXX is it wrong to tie role and host specific details together?  This may
-  # cause grief when refactoring in the future but it is also the only way to
-  # fully test features when depend upon host specific data.  An alternative
-  # would be to construct an alternate hiera hierarchy for testing each role
-  # with synthetic node data.
-  describe 'auxtel-daq-mgt.cp.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'cp',
-      )
-    end
-
-    include_examples 'generic daq manager'
-
-    it { is_expected.to contain_network__interface('p3p1').with_ensure('absent') }
-
-    it do
-      is_expected.to contain_class('hosts').with(
-        host_entries: {
-          'auxtel-sm' => {
-            'ip' => '192.168.101.2',
-          },
-        },
-      )
-    end
-
-    it do
-      is_expected.to contain_network__interface('em2').with(
-        bootproto: 'none',
-        # defroute: 'no',
-        ipaddress: '192.168.101.1',
-        # ipv6init: 'no',
-        netmask: '255.255.255.0',
-        onboot: 'yes',
-        type: 'Ethernet',
-      )
-    end
-  end
-
-  describe 'daq-mgt.tu.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'tu',
-      )
-    end
-
-    include_examples 'generic daq manager'
-
-    it { is_expected.to contain_network__interface('p2p1').with_ensure('absent') }
-
-    it do
-      is_expected.to contain_class('hosts').with(
-        host_entries: {
-          'tts-sm' => {
-            'ip' => '10.0.0.212',
-          },
-        },
-      )
-    end
-
-    it do
-      is_expected.to contain_network__interface('em4').with(
-        bootproto: 'none',
-        # defroute: 'no',
-        ipaddress: '10.0.0.1',
-        # ipv6init: 'no',
-        netmask: '255.255.255.0',
-        onboot: 'yes',
-        type: 'Ethernet',
-      )
-    end
-  end
-
-  describe 'comcam-daq-mgt.cp.lsst.org', :site, :common do
-    let(:node_params) do
-      super().merge(
-        site: 'cp',
-      )
-    end
-
-    include_examples 'generic daq manager'
-
-    it { is_expected.to contain_network__interface('p2p1').with_ensure('absent') }
-
-    it do
-      is_expected.to contain_class('hosts').with(
-        host_entries: {
-          'comcam-sm' => {
-            'ip' => '10.0.0.212',
-          },
-        },
-      )
-    end
-
-    it do
-      is_expected.to contain_network__interface('em2').with(
-        bootproto: 'none',
-        defroute: 'no',
-        ipaddress: '10.0.0.1',
-        ipv6init: 'no',
-        netmask: '255.255.255.0',
-        onboot: 'yes',
-        type: 'Ethernet',
-      )
-    end
-  end
-end
+# XXX is it wrong to tie role and host specific details together?  This may
+# cause grief when refactoring in the future but it is also the only way to
+# fully test features when depend upon host specific data.  An alternative
+# would be to construct an alternate hiera hierarchy for testing each role
+# with synthetic node data.
+
+role = 'daq-mgt'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+        }
+      end
+
+      describe 'auxtel-daq-mgt.cp.lsst.org', :site, :common do
+        let(:site) { 'cp' }
+
+        it { is_expected.to compile.with_all_deps }
+
+        include_examples 'generic daq manager'
+
+        it { is_expected.to contain_network__interface('p3p1').with_ensure('absent') }
+
+        it do
+          is_expected.to contain_class('hosts').with(
+            host_entries: {
+              'auxtel-sm' => {
+                'ip' => '192.168.101.2',
+              },
+            },
+          )
+        end
+
+        it do
+          is_expected.to contain_network__interface('em2').with(
+            bootproto: 'none',
+            # defroute: 'no',
+            ipaddress: '192.168.101.1',
+            # ipv6init: 'no',
+            netmask: '255.255.255.0',
+            onboot: 'yes',
+            type: 'Ethernet',
+          )
+        end
+      end
+
+      describe 'daq-mgt.tu.lsst.org', :site, :common do
+        let(:site) { 'tu' }
+
+        include_examples 'generic daq manager'
+
+        it { is_expected.to contain_network__interface('p2p1').with_ensure('absent') }
+
+        it do
+          is_expected.to contain_class('hosts').with(
+            host_entries: {
+              'tts-sm' => {
+                'ip' => '10.0.0.212',
+              },
+            },
+          )
+        end
+
+        it do
+          is_expected.to contain_network__interface('em4').with(
+            bootproto: 'none',
+            # defroute: 'no',
+            ipaddress: '10.0.0.1',
+            # ipv6init: 'no',
+            netmask: '255.255.255.0',
+            onboot: 'yes',
+            type: 'Ethernet',
+          )
+        end
+      end
+
+      describe 'comcam-daq-mgt.cp.lsst.org', :site, :common do
+        let(:site) { 'cp' }
+
+        include_examples 'generic daq manager'
+
+        it { is_expected.to contain_network__interface('p2p1').with_ensure('absent') }
+
+        it do
+          is_expected.to contain_class('hosts').with(
+            host_entries: {
+              'comcam-sm' => {
+                'ip' => '10.0.0.212',
+              },
+            },
+          )
+        end
+
+        it do
+          is_expected.to contain_network__interface('em2').with(
+            bootproto: 'none',
+            defroute: 'no',
+            ipaddress: '10.0.0.1',
+            ipv6init: 'no',
+            netmask: '255.255.255.0',
+            onboot: 'yes',
+            type: 'Ethernet',
+          )
+        end
+      end
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/docker_compose_spec.rb b/spec/hosts/roles/docker_compose_spec.rb
index 13ffd9c8f5..31a451e7c5 100644
--- a/spec/hosts/roles/docker_compose_spec.rb
+++ b/spec/hosts/roles/docker_compose_spec.rb
@@ -2,23 +2,35 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'docker-compose role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'docker-compose',
-            cluster: 'azar',
-          }
-        end
+role = 'docker-compose'
 
-        it { is_expected.to compile.with_all_deps }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-        it { is_expected.to contain_class('docker') }
-        it { is_expected.to contain_class('docker::networks') }
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+          cluster: 'azar',
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          it { is_expected.to contain_class('docker') }
+          it { is_expected.to contain_class('docker::networks') }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/dtn_spec.rb b/spec/hosts/roles/dtn_spec.rb
index e530e9df1a..b7e36a3155 100644
--- a/spec/hosts/roles/dtn_spec.rb
+++ b/spec/hosts/roles/dtn_spec.rb
@@ -2,27 +2,39 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'dtn role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'dtn',
-          }
-        end
+role = 'dtn'
 
-        it { is_expected.to compile.with_all_deps }
-        it { is_expected.to contain_class('profile::core::common') }
-        it { is_expected.to contain_class('profile::core::dtn') }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-        it do
-          expect(catalogue.resource('class', 'ssh')[:server_options]).to include(
-            'Port' => [22, 2712],
-          )
-        end
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+          it { is_expected.to contain_class('profile::core::common') }
+          it { is_expected.to contain_class('profile::core::dtn') }
+
+          it do
+            expect(catalogue.resource('class', 'ssh')[:server_options]).to include(
+              'Port' => [22, 2712],
+            )
+          end
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/foreman_spec.rb b/spec/hosts/roles/foreman_spec.rb
index dcbffa3d64..c2baeb294e 100644
--- a/spec/hosts/roles/foreman_spec.rb
+++ b/spec/hosts/roles/foreman_spec.rb
@@ -141,88 +141,97 @@
   it { is_expected.to contain_foreman_config_entry('template_sync_branch').with_value(site) }
 end
 
-describe 'foreman role' do
-  let(:node_params) do
-    {
-      role: 'foreman',
-      site: site,
-    }
-  end
-
-  let(:facts) { { fqdn: self.class.description } }
-
-  describe 'foreman.dev.lsst.org', :site, :common do
-    let(:site) { 'dev' }
-    let(:ntpservers) do
-      %w[
-        ntp.shoa.cl
-        ntp.cp.lsst.org
-        1.cl.pool.ntp.org
-        1.south-america.pool.ntp.org
-      ]
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic foreman'
-
-    it { is_expected.to contain_foreman_global_parameter('site').with_value('dev') }
-    it { is_expected.to contain_foreman_hostgroup('dev') }
-  end # host
-
-  describe 'foreman.tu.lsst.org', :site, :common do
-    let(:site) { 'tu' }
-    let(:ntpservers) do
-      %w[
-        140.252.1.140
-        140.252.1.141
-        140.252.1.142
-      ]
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic foreman'
-
-    it { is_expected.to contain_foreman_global_parameter('site').with_value('tu') }
-    it { is_expected.to contain_foreman_hostgroup('tu') }
-  end # host
-
-  describe 'foreman.ls.lsst.org', :site, :common do
-    let(:site) { 'ls' }
-    let(:ntpservers) do
-      %w[
-        ntp.shoa.cl
-        ntp.cp.lsst.org
-        1.cl.pool.ntp.org
-        1.south-america.pool.ntp.org
-      ]
-    end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic foreman'
-
-    it { is_expected.to contain_foreman_global_parameter('site').with_value('ls') }
-    it { is_expected.to contain_foreman_hostgroup('ls') }
-  end # host
-
-  describe 'foreman.cp.lsst.org', :site, :common do
-    let(:site) { 'cp' }
-    let(:ntpservers) do
-      %w[
-        ntp.cp.lsst.org
-        ntp.shoa.cl
-        1.cl.pool.ntp.org
-        1.south-america.pool.ntp.org
-      ]
+role = 'foreman'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+      let(:node_params) do
+        {
+          role: 'foreman',
+          site: site,
+        }
+      end
+
+      describe 'foreman.dev.lsst.org', :site, :common do
+        let(:site) { 'dev' }
+        let(:ntpservers) do
+          %w[
+            ntp.shoa.cl
+            ntp.cp.lsst.org
+            1.cl.pool.ntp.org
+            1.south-america.pool.ntp.org
+          ]
+        end
+
+        it { is_expected.to compile.with_all_deps }
+
+        include_examples 'generic foreman'
+
+        it { is_expected.to contain_foreman_global_parameter('site').with_value('dev') }
+        it { is_expected.to contain_foreman_hostgroup('dev') }
+      end # host
+
+      describe 'foreman.tu.lsst.org', :site, :common do
+        let(:site) { 'tu' }
+        let(:ntpservers) do
+          %w[
+            140.252.1.140
+            140.252.1.141
+            140.252.1.142
+          ]
+        end
+
+        it { is_expected.to compile.with_all_deps }
+
+        include_examples 'generic foreman'
+
+        it { is_expected.to contain_foreman_global_parameter('site').with_value('tu') }
+        it { is_expected.to contain_foreman_hostgroup('tu') }
+      end # host
+
+      describe 'foreman.ls.lsst.org', :site, :common do
+        let(:site) { 'ls' }
+        let(:ntpservers) do
+          %w[
+            ntp.shoa.cl
+            ntp.cp.lsst.org
+            1.cl.pool.ntp.org
+            1.south-america.pool.ntp.org
+          ]
+        end
+
+        it { is_expected.to compile.with_all_deps }
+
+        include_examples 'generic foreman'
+
+        it { is_expected.to contain_foreman_global_parameter('site').with_value('ls') }
+        it { is_expected.to contain_foreman_hostgroup('ls') }
+      end # host
+
+      describe 'foreman.cp.lsst.org', :site, :common do
+        let(:site) { 'cp' }
+        let(:ntpservers) do
+          %w[
+            ntp.cp.lsst.org
+            ntp.shoa.cl
+            1.cl.pool.ntp.org
+            1.south-america.pool.ntp.org
+          ]
+        end
+
+        it { is_expected.to compile.with_all_deps }
+
+        include_examples 'generic foreman'
+
+        it { is_expected.to contain_foreman_global_parameter('site').with_value('cp') }
+        it { is_expected.to contain_foreman_hostgroup('cp') }
+      end # host
     end
-
-    it { is_expected.to compile.with_all_deps }
-
-    include_examples 'generic foreman'
-
-    it { is_expected.to contain_foreman_global_parameter('site').with_value('cp') }
-    it { is_expected.to contain_foreman_hostgroup('cp') }
-  end # host
-end # role
+  end
+end
diff --git a/spec/hosts/roles/forwarder_spec.rb b/spec/hosts/roles/forwarder_spec.rb
index 7595cf6663..dd902651f6 100644
--- a/spec/hosts/roles/forwarder_spec.rb
+++ b/spec/hosts/roles/forwarder_spec.rb
@@ -2,22 +2,36 @@
 
 require 'spec_helper'
 
-describe 'forwarder role' do
-  lsst_sites.each do |site|
-    context "with site #{site}", :site, :common do
+role = 'forwarder'
+
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
+
       let(:node_params) do
         {
+          role: role,
           site: site,
-          role: 'forwarder',
           cluster: 'comcam-archive',
         }
       end
 
-      it { is_expected.to compile.with_all_deps }
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
 
-      include_examples 'lhn sysctls'
+          include_examples 'lhn sysctls'
 
-      it { is_expected.to contain_package('git') }
-    end
-  end # site
+          it { is_expected.to contain_package('git') }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
 end # role
diff --git a/spec/hosts/roles/generic_spec.rb b/spec/hosts/roles/generic_spec.rb
index 7f672086c0..aab64bbb25 100644
--- a/spec/hosts/roles/generic_spec.rb
+++ b/spec/hosts/roles/generic_spec.rb
@@ -2,24 +2,31 @@
 
 require 'spec_helper'
 
-describe 'generic role' do
-  let(:node_params) do
-    {
-      role: 'generic',
-    }
-  end
+role = 'generic'
 
-  let(:facts) { { fqdn: self.class.description } }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-  lsst_sites.each do |site|
-    describe "generic.#{site}.lsst.org", :site, :common do
       let(:node_params) do
-        super().merge(
+        {
+          role: role,
           site: site,
-        )
+        }
       end
 
-      it { is_expected.to compile.with_all_deps }
-    end # host
-  end # lsst_sites
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
 end # role
diff --git a/spec/hosts/roles/hexrot_spec.rb b/spec/hosts/roles/hexrot_spec.rb
index cf417df4c7..383b6a6e80 100644
--- a/spec/hosts/roles/hexrot_spec.rb
+++ b/spec/hosts/roles/hexrot_spec.rb
@@ -2,34 +2,43 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  role = 'hexrot'
-  let(:role) { role }
+role = 'hexrot'
 
-  describe "#{role} role" do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: role,
-          }
-        end
-
-        it { is_expected.to compile.with_all_deps }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-        %w[
-          profile::core::common
-          profile::core::debugutils
-          profile::core::docker
-          profile::core::docker::prune
-          profile::core::ni_packages
-          profile::core::x2go_agent
-          python
-        ].each do |c|
-          it { is_expected.to contain_class(c) }
-        end
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          %w[
+            profile::core::common
+            profile::core::debugutils
+            profile::core::docker
+            profile::core::docker::prune
+            profile::core::ni_packages
+            profile::core::x2go_agent
+            python
+          ].each do |c|
+            it { is_expected.to contain_class(c) }
+          end
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/hvac_spec.rb b/spec/hosts/roles/hvac_spec.rb
index 17ebd4e122..3c65c10871 100644
--- a/spec/hosts/roles/hvac_spec.rb
+++ b/spec/hosts/roles/hvac_spec.rb
@@ -2,24 +2,31 @@
 
 require 'spec_helper'
 
-describe 'hvac role' do
-  let(:node_params) do
-    {
-      role: 'hvac',
-    }
-  end
+role = 'hvac'
 
-  let(:facts) { { fqdn: self.class.description } }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-  lsst_sites.each do |site|
-    describe "hvac.#{site}.lsst.org", :site, :common do
       let(:node_params) do
-        super().merge(
+        {
+          role: role,
           site: site,
-        )
+        }
       end
 
-      it { is_expected.to compile.with_all_deps }
-    end # host
-  end # lsst_sites
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
 end # role
diff --git a/spec/hosts/roles/icinga_master_spec.rb b/spec/hosts/roles/icinga_master_spec.rb
index 5d7b67dffe..cd92c6e01a 100644
--- a/spec/hosts/roles/icinga_master_spec.rb
+++ b/spec/hosts/roles/icinga_master_spec.rb
@@ -2,25 +2,37 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'icinga-master role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'icinga-master',
-          }
-        end
+role = 'icinga-master'
 
-        it { is_expected.to compile.with_all_deps }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-        it do
-          is_expected.to contain_nginx__resource__server('icingaweb2').with(
-            ssl_cert: %r{fullchain.pem$},
-          )
-        end
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+
+          it do
+            is_expected.to contain_nginx__resource__server('icingaweb2').with(
+              ssl_cert: %r{fullchain.pem$},
+            )
+          end
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/m2_spec.rb b/spec/hosts/roles/m2_spec.rb
index 66b2795a88..778cfdc871 100644
--- a/spec/hosts/roles/m2_spec.rb
+++ b/spec/hosts/roles/m2_spec.rb
@@ -2,30 +2,42 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'm2 role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'm2',
-          }
-        end
+role = 'm2'
 
-        it { is_expected.to compile.with_all_deps }
-        it { is_expected.to contain_class('profile::core::common') }
-        it { is_expected.to contain_class('profile::core::debugutils') }
-        it { is_expected.to contain_class('profile::core::ni_packages') }
-        it { is_expected.to contain_class('profile::core::x2go_agent') }
-        it { is_expected.to contain_class('profile::ts::opensplicedds') }
-        it { is_expected.to contain_yumrepo('lsst-ts-private') }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-        it do
-          is_expected.to contain_package('OpenSpliceDDS')
-            .that_requires('Yumrepo[lsst-ts-private]')
-        end
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+          it { is_expected.to contain_class('profile::core::common') }
+          it { is_expected.to contain_class('profile::core::debugutils') }
+          it { is_expected.to contain_class('profile::core::ni_packages') }
+          it { is_expected.to contain_class('profile::core::x2go_agent') }
+          it { is_expected.to contain_class('profile::ts::opensplicedds') }
+          it { is_expected.to contain_yumrepo('lsst-ts-private') }
+
+          it do
+            is_expected.to contain_package('OpenSpliceDDS')
+              .that_requires('Yumrepo[lsst-ts-private]')
+          end
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/rke_spec.rb b/spec/hosts/roles/rke_spec.rb
index 73c4485aa0..0d92cb43ea 100644
--- a/spec/hosts/roles/rke_spec.rb
+++ b/spec/hosts/roles/rke_spec.rb
@@ -2,45 +2,62 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'rke role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'rke',
-          }
-        end
+shared_examples 'generic rke' do
+  include_examples 'debugutils'
 
-        it { is_expected.to compile.with_all_deps }
+  it { is_expected.to contain_class('profile::core::rke') }
 
-        include_examples 'debugutils'
+  it do
+    is_expected.to contain_file('/home/rke/.bashrc.d/kubectl.sh')
+      .with_content(%r{^alias k='kubectl'$})
+      .with_content(%r{^complete -o default -F __start_kubectl k$})
+  end
+end
 
-        it { is_expected.to contain_class('profile::core::rke') }
+role = 'rke'
 
-        it do
-          is_expected.to contain_file('/home/rke/.bashrc.d/kubectl.sh')
-            .with_content(%r{^alias k='kubectl'$})
-            .with_content(%r{^complete -o default -F __start_kubectl k$})
-        end
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
       end
-    end # site
 
-    context 'with antu cluster', :lhn_node, :site, :common do
       let(:node_params) do
         {
-          site: 'ls',
-          role: 'rke',
-          cluster: 'antu',
+          role: role,
+          site: site,
         }
       end
 
-      it { is_expected.to compile.with_all_deps }
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
 
-      include_examples 'debugutils'
+          it { is_expected.to compile.with_all_deps }
 
-      it { is_expected.to contain_class('profile::core::rke') }
-    end
-  end # role
-end
+          include_examples 'generic rke'
+        end # host
+      end # lsst_sites
+
+      context 'with antu cluster' do
+        describe 'antu01.ls.lsst.org', :lhn_node, :site, :common do
+          let(:site) { 'ls' }
+          let(:node_params) do
+            super().merge(
+              site: site,
+              role: 'rke',
+              cluster: 'antu',
+            )
+          end
+
+          it { is_expected.to compile.with_all_deps }
+
+          include_examples 'generic rke'
+        end
+      end
+    end # on os
+  end # on_supported_os
+end # role
diff --git a/spec/hosts/roles/ts_csc_spec.rb b/spec/hosts/roles/ts_csc_spec.rb
index 9fb6838b6d..480878b06d 100644
--- a/spec/hosts/roles/ts_csc_spec.rb
+++ b/spec/hosts/roles/ts_csc_spec.rb
@@ -2,22 +2,33 @@
 
 require 'spec_helper'
 
-describe 'test1.dev.lsst.org' do
-  describe 'ts-csc role' do
-    lsst_sites.each do |site|
-      context "with site #{site}", :site, :common do
-        let(:node_params) do
-          {
-            site: site,
-            role: 'ts-csc',
-            cluster: 'trewa',
-          }
-        end
+role = 'ts-csc'
 
-        it { is_expected.to compile.with_all_deps }
+describe "#{role} role" do
+  on_supported_os.each do |os, facts|
+    context "on #{os}" do
+      let(:facts) do
+        facts.merge(
+          fqdn: self.class.description,
+        )
+      end
 
-        it { is_expected.to contain_class('docker::networks') }
+      let(:node_params) do
+        {
+          role: role,
+          site: site,
+          cluster: 'trewa',
+        }
       end
-    end # site
-  end # role
-end
+
+      lsst_sites.each do |site|
+        describe "#{role}.#{site}.lsst.org", :site, :common do
+          let(:site) { site }
+
+          it { is_expected.to compile.with_all_deps }
+          it { is_expected.to contain_class('docker::networks') }
+        end # host
+      end # lsst_sites
+    end # on os
+  end # on_supported_os
+end # role