diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 8b466cfb..daceb642 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -131,19 +131,29 @@ You can install all needed gems for spec tests into the modules directory by
 running:
 
 ```sh
-bundle install --path .vendor/ --without development system_tests release --jobs "$(nproc)"
+bundle config set --local path '.vendor/'
+bundle config set --local without 'development system_tests release'
+bundle install --jobs "$(nproc)"
 ```
 
 If you also want to run acceptance tests:
 
 ```sh
-bundle install --path .vendor/ --with system_tests --without development release --jobs "$(nproc)"
+bundle config set --local path '.vendor/'
+bundle config set --local without 'development release'
+bundle config set --local with 'system_tests'
+bundle install --jobs "$(nproc)"
 ```
 
 Our all in one solution if you don't know if you need to install or update gems:
 
 ```sh
-bundle install --path .vendor/ --with system_tests --without development release --jobs "$(nproc)"; bundle update; bundle clean
+bundle config set --local path '.vendor/'
+bundle config set --local without 'development release'
+bundle config set --local with 'system_tests'
+bundle install --jobs "$(nproc)"
+bundle update
+bundle clean
 ```
 
 As an alternative to the `--jobs "$(nproc)` parameter, you can set an
@@ -232,18 +242,29 @@ simple tests against it after applying the module. You can run this
 with:
 
 ```sh
-BEAKER_setfile=debian11-64 bundle exec rake beaker
+BEAKER_PUPPET_COLLECTION=puppet7 BEAKER_setfile=debian11-64 bundle exec rake beaker
 ```
 
-You can replace the string `debian10` with any common operating system.
+or
+
+```sh
+BEAKER_PUPPET_COLLECTION=none BEAKER_setfile=archlinux-64 bundle exec rake beaker
+```
+
+This latter example will use the distribution's own version of Puppet.
+
+You can replace the string `debian11` with any common operating system.
 The following strings are known to work:
 
-* ubuntu1804
 * ubuntu2004
-* debian10
+* ubuntu2204
 * debian11
-* centos7
-* centos8
+* debian12
+* centos9
+* archlinux
+* almalinux8
+* almalinux9
+* fedora36
 
 For more information and tips & tricks, see [voxpupuli-acceptance's documentation](https://github.com/voxpupuli/voxpupuli-acceptance#running-tests).
 
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
deleted file mode 100644
index cacadf22..00000000
--- a/.github/SECURITY.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Vox Pupuli Security Policy
-
-Our vulnerabilities reporting process is at https://voxpupuli.org/security/
diff --git a/.rspec b/.github/labeler.yml
similarity index 63%
rename from .rspec
rename to .github/labeler.yml
index f634583d..f2d08d6b 100644
--- a/.rspec
+++ b/.github/labeler.yml
@@ -1,5 +1,6 @@
+---
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
---format documentation
---color
+skip-changelog:
+ - head-branch: ['^release-*', 'release']
diff --git a/.github/release.yml b/.github/release.yml
new file mode 100644
index 00000000..f5b5d7a9
--- /dev/null
+++ b/.github/release.yml
@@ -0,0 +1,42 @@
+---
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
+
+# https://docs.github.com/en/repositories/releasing-projects-on-github/automatically-generated-release-notes
+
+changelog:
+  exclude:
+    labels:
+      - duplicate
+      - invalid
+      - modulesync
+      - question
+      - skip-changelog
+      - wont-fix
+      - wontfix
+
+  categories:
+    - title: Breaking Changes 🛠
+      labels:
+        - backwards-incompatible
+
+    - title: New Features 🎉
+      labels:
+        - enhancement
+
+    - title: Bug Fixes 🐛
+      labels:
+        - bug
+
+    - title: Documentation Updates 📚
+      labels:
+        - documentation
+        - docs
+
+    - title: Dependency Updates ⬆️
+      labels:
+        - dependencies
+
+    - title: Other Changes
+      labels:
+        - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9ac5f4a3..8c32acf9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,97 +4,19 @@
 
 name: CI
 
-on: pull_request
+# yamllint disable-line rule:truthy
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+      - master
 
 concurrency:
   group: ${{ github.ref_name }}
   cancel-in-progress: true
 
 jobs:
-  setup_matrix:
-    name: 'Setup Test Matrix'
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    outputs:
-      beaker_setfiles: ${{ steps.get-outputs.outputs.beaker_setfiles }}
-      puppet_major_versions: ${{ steps.get-outputs.outputs.puppet_major_versions }}
-      puppet_unit_test_matrix: ${{ steps.get-outputs.outputs.puppet_unit_test_matrix }}
-    env:
-      BUNDLE_WITHOUT: development:system_tests:release
-    steps:
-      - uses: actions/checkout@v2
-      - name: Setup ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: '3.0'
-          bundler-cache: true
-      - name: Run static validations
-        run: bundle exec rake validate lint check
-      - name: Run rake rubocop
-        run: bundle exec rake rubocop
-      - name: Setup Test Matrix
-        id: get-outputs
-        run: bundle exec metadata2gha --use-fqdn --pidfile-workaround false
-
-  unit:
-    needs: setup_matrix
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    strategy:
-      fail-fast: false
-      matrix:
-        include: ${{fromJson(needs.setup_matrix.outputs.puppet_unit_test_matrix)}}
-    env:
-      BUNDLE_WITHOUT: development:system_tests:release
-      PUPPET_VERSION: "~> ${{ matrix.puppet }}.0"
-    name: Puppet ${{ matrix.puppet }} (Ruby ${{ matrix.ruby }})
-    steps:
-      - uses: actions/checkout@v2
-      - name: Setup ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: ${{ matrix.ruby }}
-          bundler-cache: true
-      - name: Run tests
-        run: bundle exec rake parallel_spec
-
-  acceptance:
-    needs: setup_matrix
-    runs-on: ubuntu-latest
-    env:
-      BUNDLE_WITHOUT: development:test:release
-    strategy:
-      fail-fast: false
-      matrix:
-        setfile:
-          - name: CentOS 8
-            value: centos8-64vpnserver.ma{hostname=vpnserver}-centos8-64vpnclienta.a{hostname=vpnclienta}
-          - name: Debian 11
-            value: debian11-64vpnserver.ma{hostname=vpnserver}-debian11-64vpnclienta.a{hostname=vpnclienta}
-          - name: Ubuntu 20.04
-            value: ubuntu2004-64vpnserver.ma{hostname=vpnserver}-ubuntu2004-64vpnclienta.a{hostname=vpnclienta}
-          - name: Ubuntu 22.04
-            value: ubuntu2204-64vpnserver.ma{hostname=vpnserver}-ubuntu2204-64vpnclienta.a{hostname=vpnclienta}
-        puppet: ${{fromJson(needs.setup_matrix.outputs.puppet_major_versions)}}
-    name: ${{ matrix.puppet.name }} - ${{ matrix.setfile.name }}
-    steps:
-      - uses: actions/checkout@v2
-      - name: Setup ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: '3.0'
-          bundler-cache: true
-      - name: Run tests
-        run: bundle exec rake beaker
-        env:
-          BEAKER_PUPPET_COLLECTION: ${{ matrix.puppet.collection }}
-          BEAKER_setfile: ${{ matrix.setfile.value }}
-
-  tests:
-    needs:
-      - unit
-      - acceptance
-    runs-on: ubuntu-latest
-    name: Test suite
-    steps:
-      - run: echo Test suite completed
+  puppet:
+    name: Puppet
+    uses: voxpupuli/gha-puppet/.github/workflows/beaker.yml@v3
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
new file mode 100644
index 00000000..73be88dc
--- /dev/null
+++ b/.github/workflows/labeler.yml
@@ -0,0 +1,18 @@
+---
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
+
+name: "Pull Request Labeler"
+
+# yamllint disable-line rule:truthy
+on:
+  pull_request_target: {}
+
+jobs:
+  labeler:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/labeler@v5
diff --git a/.github/workflows/prepare_release.yml b/.github/workflows/prepare_release.yml
new file mode 100644
index 00000000..01efa1a8
--- /dev/null
+++ b/.github/workflows/prepare_release.yml
@@ -0,0 +1,23 @@
+---
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
+
+name: 'Prepare Release'
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Module version to be released. Must be a valid semver string without leading v. (1.2.3)'
+        required: false
+
+jobs:
+  release_prep:
+    uses: 'voxpupuli/gha-puppet/.github/workflows/prepare_release.yml@v3'
+    with:
+      version: ${{ github.event.inputs.version }}
+      allowed_owner: 'voxpupuli'
+    secrets:
+      # Configure secrets here:
+      #  https://docs.github.com/en/actions/security-guides/encrypted-secrets
+      github_pat: '${{ secrets.PCCI_PAT_RELEASE_PREP }}'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 15f17213..3db60fbc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,7 @@
 
 name: Release
 
+# yamllint disable-line rule:truthy
 on:
   push:
     tags:
@@ -12,7 +13,7 @@ on:
 jobs:
   release:
     name: Release
-    uses: voxpupuli/gha-puppet/.github/workflows/release.yml@v1
+    uses: voxpupuli/gha-puppet/.github/workflows/release.yml@v3
     with:
       allowed_owner: 'voxpupuli'
     secrets:
diff --git a/.gitignore b/.gitignore
index 9b95224c..adea1b01 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,23 +1,25 @@
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-pkg/
-Gemfile.lock
-Gemfile.local
-vendor/
-.vendor/
-spec/fixtures/manifests/
-spec/fixtures/modules/
-.vagrant/
-.bundle/
-.ruby-version
-coverage/
-log/
-.idea/
-.dependencies/
-.librarian/
-Puppetfile.lock
+/pkg/
+/Gemfile.lock
+/Gemfile.local
+/vendor/
+/.vendor/
+/spec/fixtures/manifests/
+/spec/fixtures/modules/
+/.vagrant/
+/.bundle/
+/.ruby-version
+/coverage/
+/log/
+/.idea/
+/.dependencies/
+/.librarian/
+/Puppetfile.lock
 *.iml
 .*.sw?
-.yardoc/
-Guardfile
+/.yardoc/
+/Guardfile
+bolt-debug.log
+.rerun.json
diff --git a/.msync.yml b/.msync.yml
index 02353859..36e892e9 100644
--- a/.msync.yml
+++ b/.msync.yml
@@ -2,4 +2,4 @@
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-modulesync_config_version: '5.3.0'
+modulesync_config_version: '9.4.0'
diff --git a/.overcommit.yml b/.overcommit.yml
index d367adae..4ed994cc 100644
--- a/.overcommit.yml
+++ b/.overcommit.yml
@@ -43,10 +43,12 @@ PreCommit:
     enabled: true
     description: 'Runs rubocop on modified files only'
     command: ['bundle', 'exec', 'rubocop']
-  PuppetLint:
+  RakeTarget:
     enabled: true
-    description: 'Runs puppet-lint on modified files only'
-    command: ['bundle', 'exec', 'puppet-lint']
+    description: 'Runs lint on modified files only'
+    targets:
+      - 'lint'
+    command: ['bundle', 'exec', 'rake']
   YamlSyntax:
     enabled: true
   JsonSyntax:
diff --git a/.pmtignore b/.pmtignore
index 65f50514..a9d37aa0 100644
--- a/.pmtignore
+++ b/.pmtignore
@@ -1,37 +1,39 @@
 # Managed by modulesync - DO NOT EDIT
 # https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-docs/
-pkg/
-Gemfile
-Gemfile.lock
-Gemfile.local
-vendor/
-.vendor/
-spec/
-Rakefile
-.vagrant/
-.bundle/
-.ruby-version
-coverage/
-log/
-.idea/
-.dependencies/
-.github/
-.librarian/
-Puppetfile.lock
+/docs/
+/pkg/
+/Gemfile
+/Gemfile.lock
+/Gemfile.local
+/vendor/
+/.vendor/
+/spec/
+/Rakefile
+/.vagrant/
+/.bundle/
+/.ruby-version
+/coverage/
+/log/
+/.idea/
+/.dependencies/
+/.github/
+/.librarian/
+/Puppetfile.lock
+/Puppetfile
 *.iml
-.editorconfig
-.fixtures.yml
-.gitignore
-.msync.yml
-.overcommit.yml
-.pmtignore
-.rspec
-.rspec_parallel
-.rubocop.yml
-.sync.yml
+/.editorconfig
+/.fixtures.yml
+/.gitignore
+/.msync.yml
+/.overcommit.yml
+/.pmtignore
+/.rspec
+/.rspec_parallel
+/.rubocop.yml
+/.sync.yml
 .*.sw?
-.yardoc/
-.yardopts
-Dockerfile
+/.yardoc/
+/.yardopts
+/Dockerfile
+/HISTORY.md
diff --git a/.puppet-lint.rc b/.puppet-lint.rc
index dd8272c7..05d28a26 100644
--- a/.puppet-lint.rc
+++ b/.puppet-lint.rc
@@ -1,3 +1,6 @@
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
+
 --fail-on-warnings
 --no-parameter_documentation-check
 --no-parameter_types-check
diff --git a/.rspec_parallel b/.rspec_parallel
deleted file mode 100644
index a9a84f85..00000000
--- a/.rspec_parallel
+++ /dev/null
@@ -1,4 +0,0 @@
-# Managed by modulesync - DO NOT EDIT
-# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
-
---format progress
diff --git a/.sync.yml b/.sync.yml
index deb9d014..869961c7 100644
--- a/.sync.yml
+++ b/.sync.yml
@@ -1,3 +1,5 @@
 ---
 spec/spec_helper.rb:
   hiera_config: "'spec/fixtures/hiera/hiera.yaml'"
+spec/spec_helper_acceptance.rb:
+  unmanaged: false
diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index 8dd82d63..00000000
--- a/Dockerfile
+++ /dev/null
@@ -1,24 +0,0 @@
-# MANAGED BY MODULESYNC
-# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
-
-FROM ruby:2.7
-
-WORKDIR /opt/puppet
-
-# https://github.com/puppetlabs/puppet/blob/06ad255754a38f22fb3a22c7c4f1e2ce453d01cb/lib/puppet/provider/service/runit.rb#L39
-RUN mkdir -p /etc/sv
-
-ARG PUPPET_GEM_VERSION="~> 6.0"
-ARG PARALLEL_TEST_PROCESSORS=4
-
-# Cache gems
-COPY Gemfile .
-RUN bundle install --without system_tests development release --path=${BUNDLE_PATH:-vendor/bundle}
-
-COPY . .
-
-RUN bundle install
-RUN bundle exec rake release_checks
-
-# Container should not saved
-RUN exit 1
diff --git a/Gemfile b/Gemfile
index 07209b79..2ac98f89 100644
--- a/Gemfile
+++ b/Gemfile
@@ -4,10 +4,10 @@
 source ENV['GEM_SOURCE'] || 'https://rubygems.org'
 
 group :test do
-  gem 'voxpupuli-test', '~> 5.4',   :require => false
+  gem 'voxpupuli-test', '~> 9.0',   :require => false
   gem 'coveralls',                  :require => false
   gem 'simplecov-console',          :require => false
-  gem 'puppet_metadata', '~> 1.0',  :require => false
+  gem 'puppet_metadata', '~> 4.0',  :require => false
 end
 
 group :development do
@@ -16,19 +16,17 @@ group :development do
 end
 
 group :system_tests do
-  gem 'voxpupuli-acceptance', '~> 1.0',  :require => false
+  gem 'voxpupuli-acceptance', '~> 3.0',  :require => false
 end
 
 group :release do
-  gem 'github_changelog_generator', '>= 1.16.1',  :require => false if RUBY_VERSION >= '2.5'
-  gem 'voxpupuli-release', '>= 1.2.0',            :require => false
-  gem 'puppet-strings', '>= 2.2',                 :require => false
+  gem 'voxpupuli-release', '~> 3.0',  :require => false
 end
 
 gem 'rake', :require => false
 gem 'facter', ENV['FACTER_GEM_VERSION'], :require => false, :groups => [:test]
 
-puppetversion = ENV['PUPPET_GEM_VERSION'] || '>= 6.0'
+puppetversion = ENV['PUPPET_GEM_VERSION'] || [">= 7.24", "< 9"]
 gem 'puppet', puppetversion, :require => false, :groups => [:test]
 
 # vim: syntax=ruby
diff --git a/Rakefile b/Rakefile
index f92f0516..8c9810a2 100644
--- a/Rakefile
+++ b/Rakefile
@@ -24,6 +24,10 @@ end
 begin
   require 'voxpupuli/release/rake_tasks'
 rescue LoadError
+  # voxpupuli-release not present
+else
+  GCGConfig.user = 'voxpupuli'
+  GCGConfig.project = 'puppet-openvpn'
 end
 
 desc "Run main 'test' task and report merged results to coveralls"
@@ -37,36 +41,4 @@ task test_with_coveralls: [:test] do
   end
 end
 
-desc 'Generate REFERENCE.md'
-task :reference, [:debug, :backtrace] do |t, args|
-  patterns = ''
-  Rake::Task['strings:generate:reference'].invoke(patterns, args[:debug], args[:backtrace])
-end
-
-begin
-  require 'github_changelog_generator/task'
-  require 'puppet_blacksmith'
-  GitHubChangelogGenerator::RakeTask.new :changelog do |config|
-    metadata = Blacksmith::Modulefile.new
-    config.future_release = "v#{metadata.version}" if metadata.version =~ /^\d+\.\d+.\d+$/
-    config.header = "# Changelog\n\nAll notable changes to this project will be documented in this file.\nEach new release typically also includes the latest modulesync defaults.\nThese should not affect the functionality of the module."
-    config.exclude_labels = %w{duplicate question invalid wontfix wont-fix modulesync skip-changelog}
-    config.user = 'voxpupuli'
-    config.project = metadata.metadata['name']
-  end
-
-  # Workaround for https://github.com/github-changelog-generator/github-changelog-generator/issues/715
-  require 'rbconfig'
-  if RbConfig::CONFIG['host_os'] =~ /linux/
-    task :changelog do
-      puts 'Fixing line endings...'
-      changelog_file = File.join(__dir__, 'CHANGELOG.md')
-      changelog_txt = File.read(changelog_file)
-      new_contents = changelog_txt.gsub(%r{\r\n}, "\n")
-      File.open(changelog_file, "w") {|file| file.puts new_contents }
-    end
-  end
-
-rescue LoadError
-end
 # vim: syntax=ruby
diff --git a/spec/setup_acceptance_node.pp b/spec/setup_acceptance_node.pp
new file mode 100644
index 00000000..1f7ee29f
--- /dev/null
+++ b/spec/setup_acceptance_node.pp
@@ -0,0 +1,37 @@
+if $facts['os']['name'] == 'CentOS' {
+  package { 'epel-release':
+    ensure => present,
+  }
+}
+
+$netcat_package_name = $facts['os']['family'] ? {
+  'Debian' => 'netcat-openbsd',
+  'RedHat' => 'nc',
+  default  => 'netcat',
+}
+
+node /^vpnserver\./ {
+  package { $netcat_package_name:
+    ensure => present,
+  }
+}
+
+node /^vpnclienta\./ {
+  package { ['tar','openvpn'] :
+    ensure => present,
+  }
+}
+
+# CentOS 6 in docker doesn't get a hostname - install all packages
+node /^localhost\./ {
+  package { ['tar', 'openvpn', $netcat_package_name]:
+    ensure => present,
+  }
+}
+
+# changing the testing CI to out-of-the-box beaker requires a default node statement, so we just mimic what centos 6 requires
+node default {
+  package { ['tar', 'openvpn', $netcat_package_name]:
+    ensure => present,
+  }
+}
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index fe09954d..214e9835 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -10,6 +10,7 @@
 require 'voxpupuli/test/spec_helper'
 
 RSpec.configure do |c|
+  c.facterdb_string_keys = false
   c.hiera_config = 'spec/fixtures/hiera/hiera.yaml'
 end
 
@@ -21,3 +22,4 @@
     add_custom_fact name.to_sym, value
   end
 end
+Dir['./spec/support/spec/**/*.rb'].sort.each { |f| require f }
diff --git a/spec/spec_helper_acceptance.rb b/spec/spec_helper_acceptance.rb
index 254f1b61..2681792e 100644
--- a/spec/spec_helper_acceptance.rb
+++ b/spec/spec_helper_acceptance.rb
@@ -1,40 +1,10 @@
 # frozen_string_literal: true
 
-require 'voxpupuli/acceptance/spec_helper_acceptance'
-
-configure_beaker do |host|
-  manifest = <<-PUPPET
-    if $facts['os']['name'] == 'CentOS' {
-      package { 'epel-release':
-        ensure => present,
-      }
-    }
-
-    $netcat_package_name = $facts['os']['family'] ? {
-      'Debian' => 'netcat-openbsd',
-      'RedHat' => 'nc',
-      default  => 'netcat',
-    }
+# Managed by modulesync - DO NOT EDIT
+# https://voxpupuli.org/docs/updating-files-managed-with-modulesync/
 
-    node /^vpnserver\./ {
-      package { $netcat_package_name:
-        ensure => present,
-      }
-    }
-
-    node /^vpnclienta\./ {
-      package { ['tar','openvpn'] :
-        ensure => present,
-      }
-    }
+require 'voxpupuli/acceptance/spec_helper_acceptance'
 
-    # CentOS 6 in docker doesn't get a hostname - install all packages
-    node /^localhost\./ {
-      package { ['tar', 'openvpn', $netcat_package_name]:
-        ensure => present,
-      }
-    }
+configure_beaker(modules: :metadata)
 
-  PUPPET
-  apply_manifest_on(host, manifest, catch_failures: true)
-end
+Dir['./spec/support/acceptance/**/*.rb'].sort.each { |f| require f }