puppet-prod/modules/wireguard/manifests/init.pp

# manage wireguard interfaces via wg-quick
class wireguard (
  Boolean                        $manage_package = true,
  String                         $package_name   = 'wireguard-tools',
  Variant[Hash, Sensitive[Hash]] $interfaces = {},
) {

  if $manage_package {
    package { $package_name:
      ensure => installed,
      before => File['/etc/wireguard'],
    }
  }

  file { '/etc/wireguard':
    ensure => directory,
    owner  => 'root',
    group  => 'root',
    mode   => '0700',
  }

  # hiera hands eyaml secrets over as plain strings inside the (Sensitive) hash; re-wrap them per resource
  $raw = $interfaces ? {
    Sensitive => $interfaces.unwrap,
    default   => $interfaces,
  }

  $raw.each |String $iface, Hash $data| {
    $peers = $data.get('peers', []).map |Hash $peer| {
      $peer['preshared_key'] =~ String ? {
        true    => $peer + { 'preshared_key' => Sensitive($peer['preshared_key']) },
        default => $peer,
      }
    }
    $private_key = $data['private_key'] =~ String ? {
      true    => Sensitive($data['private_key']),
      default => $data['private_key'],
    }

    wireguard::interface { $iface:
      * => $data + { 'peers' => $peers, 'private_key' => $private_key },
    }
  }
}