diff --git a/cdist/conf/type/__ccollect_source/explorer/stat b/cdist/conf/type/__ccollect_source/explorer/stat
index 7c86d94f..9b5ad75b 100755
--- a/cdist/conf/type/__ccollect_source/explorer/stat
+++ b/cdist/conf/type/__ccollect_source/explorer/stat
@@ -25,7 +25,7 @@ destination="/$__object_id"
 
 os=$("$__explorer/os")
 case "$os" in
-   "freebsd"|"openbsd")
+   "freebsd"|"netbsd"|"openbsd")
       # FIXME: should be something like this based on man page, but can not test
       stat -f "type: %ST
 owner: %Du %Su
diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index 76bd6032..b4d1d75c 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -109,6 +109,12 @@ for param in $(ls "$__object/parameter/"); do
          # remove trailing ,
          printf '   ,"retry_join": [%s]\n' "${retry_join%*,}"
       ;;
+      retry-join-wan)
+         # join multiple parameters into json array over wan
+         retry_join_wan="$(awk '{printf "\""$1"\","}' "$__object/parameter/retry-join-wan")"
+         # remove trailing ,
+         printf '   ,"retry_join_wan": [%s]\n' "${retry_join_wan%*,}"
+      ;;
       bootstrap-expect)
          # integer key=value parameters
          key="$(echo "$param" | tr '-' '_')"
diff --git a/cdist/conf/type/__consul_agent/parameter/optional b/cdist/conf/type/__consul_agent/parameter/optional
index 8940023d..37aad8c1 100644
--- a/cdist/conf/type/__consul_agent/parameter/optional
+++ b/cdist/conf/type/__consul_agent/parameter/optional
@@ -17,3 +17,4 @@ key-file-source
 node-name
 user
 state
+advertise-wan
diff --git a/cdist/conf/type/__consul_agent/parameter/optional_multiple b/cdist/conf/type/__consul_agent/parameter/optional_multiple
index 12cd064c..740e4d7f 100644
--- a/cdist/conf/type/__consul_agent/parameter/optional_multiple
+++ b/cdist/conf/type/__consul_agent/parameter/optional_multiple
@@ -1 +1,2 @@
 retry-join
+retry-join-wan
diff --git a/cdist/conf/type/__directory/explorer/stat b/cdist/conf/type/__directory/explorer/stat
index 077aa43b..41bc8b04 100755
--- a/cdist/conf/type/__directory/explorer/stat
+++ b/cdist/conf/type/__directory/explorer/stat
@@ -25,7 +25,7 @@ destination="/$__object_id"
 
 os=$("$__explorer/os")
 case "$os" in
-   "freebsd"|"openbsd")
+   "freebsd"|"netbsd"|"openbsd")
       # FIXME: should be something like this based on man page, but can not test
       stat -f "type: %ST
 owner: %Du %Su
diff --git a/cdist/conf/type/__file/explorer/stat b/cdist/conf/type/__file/explorer/stat
index 00e34cca..8a917556 100755
--- a/cdist/conf/type/__file/explorer/stat
+++ b/cdist/conf/type/__file/explorer/stat
@@ -25,7 +25,7 @@ destination="/$__object_id"
 
 os=$("$__explorer/os")
 case "$os" in
-   "freebsd"|"openbsd")
+   "freebsd"|"netbsd"|"openbsd")
       # FIXME: should be something like this based on man page, but can not test
       stat -f "type: %ST
 owner: %Du %Su
diff --git a/cdist/conf/type/__group/explorer/gshadow b/cdist/conf/type/__group/explorer/gshadow
index 8d40e9e0..2e2ab29d 100755
--- a/cdist/conf/type/__group/explorer/gshadow
+++ b/cdist/conf/type/__group/explorer/gshadow
@@ -24,9 +24,11 @@
 name=$__object_id
 os="$($__explorer/os)"
 
-if [ "$os" = "freebsd" ]; then
-   echo "FreeBSD does not have getent gshadow"
-   exit 0
-fi
+case "$os" in
+    "freebsd"|"netbsd")
+	echo "$os does not have getent gshadow"
+	exit 0
+    ;;
+esac
 
 getent gshadow "$name" || true
diff --git a/cdist/conf/type/__timezone/manifest b/cdist/conf/type/__timezone/manifest
index 3bcb05c6..9b0cce73 100755
--- a/cdist/conf/type/__timezone/manifest
+++ b/cdist/conf/type/__timezone/manifest
@@ -34,7 +34,7 @@ case "$os" in
         __package timezone
         export require="__package/timezone"
     ;;
-    freebsd)
+    freebsd|netbsd)
         # whitelist
         :
     ;;
diff --git a/cdist/conf/type/__user_groups/explorer/group b/cdist/conf/type/__user_groups/explorer/group
index a8cb63af..5bad9a0b 100755
--- a/cdist/conf/type/__user_groups/explorer/group
+++ b/cdist/conf/type/__user_groups/explorer/group
@@ -20,4 +20,4 @@
 
 user="$(cat "$__object/parameter/user" 2>/dev/null || echo "$__object_id")"
 
-(id --groups --name "$user" | tr ' ' '\n' | sort) 2>/dev/null || true
+(id -G -n "$user" | tr ' ' '\n' | sort) 2>/dev/null || true
diff --git a/cdist/conf/type/__user_groups/explorer/oldusermod b/cdist/conf/type/__user_groups/explorer/oldusermod
index 6ef25b13..bf43fcec 100644
--- a/cdist/conf/type/__user_groups/explorer/oldusermod
+++ b/cdist/conf/type/__user_groups/explorer/oldusermod
@@ -18,4 +18,11 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
+os="$($__explorer/os)"
+
+if [ "$os" = "netbsd" ]; then
+    echo netbsd
+    exit
+fi
+
 usermod --help | grep -q -- '-A group' && echo true || echo false
diff --git a/cdist/conf/type/__user_groups/gencode-remote b/cdist/conf/type/__user_groups/gencode-remote
index 65404bfc..8b13f32c 100755
--- a/cdist/conf/type/__user_groups/gencode-remote
+++ b/cdist/conf/type/__user_groups/gencode-remote
@@ -21,8 +21,14 @@
 user="$(cat "$__object/parameter/user" 2>/dev/null || echo "$__object_id")"
 state_should="$(cat "$__object/parameter/state")"
 oldusermod="$(cat "$__object/explorer/oldusermod")"
+os=$(cat "$__global/explorer/os")
 
-if [ "$oldusermod" = "true" ]; then
+if [ "$os" = "netbsd" ]; then
+	# NetBSD does not have a command to remove a user from a group
+	oldusermod="true"
+	addparam="-G"
+	delparam=";;#"
+elif [ "$oldusermod" = "true" ]; then
         addparam="-A"
         delparam="-R"
 else