Keep wireguard keys Sensitive and generate missing private keys

modules/wireguard/manifests/init.pp

@@ -1,8 +1,8 @@
 # manage wireguard interfaces via wg-quick
 class wireguard (
-  Boolean $manage_package = true,
-  String  $package_name   = 'wireguard-tools',
-  Hash    $interfaces     = {},
+  Boolean                        $manage_package = true,
+  String                         $package_name   = 'wireguard-tools',
+  Variant[Hash, Sensitive[Hash]] $interfaces = {},
 ) {
 
   if $manage_package {
@@ -19,9 +19,26 @@ class wireguard (
     mode   => '0700',
   }
 
-  $interfaces.each |String $iface, Hash $data| {
+  # hiera hands eyaml secrets over as plain strings inside the (Sensitive) hash; re-wrap them per resource
+  $raw = $interfaces ? {
+    Sensitive => $interfaces.unwrap,
+    default   => $interfaces,
+  }
+
+  $raw.each |String $iface, Hash $data| {
+    $peers = $data.get('peers', []).map |Hash $peer| {
+      $peer['preshared_key'] =~ String ? {
+        true    => $peer + { 'preshared_key' => Sensitive($peer['preshared_key']) },
+        default => $peer,
+      }
+    }
+    $private_key = $data['private_key'] =~ String ? {
+      true    => Sensitive($data['private_key']),
+      default => $data['private_key'],
+    }
+
     wireguard::interface { $iface:
-      * => $data,
+      * => $data + { 'peers' => $peers, 'private_key' => $private_key },
     }
   }
 }