diff --git a/puppet/zulip/lib/puppet/functions/zulipconf.rb b/puppet/zulip/lib/puppet/functions/zulipconf.rb
new file mode 100644
index 0000000000..7866a8a2fd
--- /dev/null
+++ b/puppet/zulip/lib/puppet/functions/zulipconf.rb
@@ -0,0 +1,19 @@
+require "shellwords"
+
+Puppet::Functions.create_function(:zulipconf) do
+  def zulipconf(section, key, default)
+    zulip_conf_path = Facter.value("zulip_conf_path")
+    output = `/usr/bin/crudini --get -- #{[zulip_conf_path, section, key].shelljoin} 2>&1`; result = $?.success?
+    if result
+      if [true, false].include? default
+        # If the default is a bool, coerce into a bool.  This list is also
+        # maintained in scripts/lib/zulip_tools.py
+        ["1", "y", "t", "true", "yes", "enable", "enabled"].include? output.strip.downcase
+      else
+        output.strip
+      end
+    else
+      default
+    end
+  end
+end
diff --git a/puppet/zulip/lib/puppet/functions/zulipconf_keys.rb b/puppet/zulip/lib/puppet/functions/zulipconf_keys.rb
new file mode 100644
index 0000000000..ed6d6d5800
--- /dev/null
+++ b/puppet/zulip/lib/puppet/functions/zulipconf_keys.rb
@@ -0,0 +1,13 @@
+require "shellwords"
+
+Puppet::Functions.create_function(:zulipconf_keys) do
+  def zulipconf_keys(section)
+    zulip_conf_path = Facter.value("zulip_conf_path")
+    output = `/usr/bin/crudini --get -- #{[zulip_conf_path, section].shelljoin} 2>&1`; result = $?.success?
+    if result
+      return output.lines.map { |l| l.strip }
+    else
+      return []
+    end
+  end
+end
diff --git a/puppet/zulip/lib/puppet/functions/zulipconf_nagios_hosts.rb b/puppet/zulip/lib/puppet/functions/zulipconf_nagios_hosts.rb
new file mode 100644
index 0000000000..2435a3264a
--- /dev/null
+++ b/puppet/zulip/lib/puppet/functions/zulipconf_nagios_hosts.rb
@@ -0,0 +1,23 @@
+require "shellwords"
+
+Puppet::Functions.create_function(:zulipconf_nagios_hosts) do
+  def zulipconf_nagios_hosts
+    section = "nagios"
+    prefix = "hosts_"
+    zulip_conf_path = Facter.value("zulip_conf_path")
+    keys = `/usr/bin/crudini --get -- #{[zulip_conf_path, section].shelljoin} 2>&1`; result = $?.success?
+    if result
+      filtered_keys = keys.lines.map { |l| l.strip }.select { |l| l.start_with?(prefix) }
+      all_values = []
+      filtered_keys.each do |key|
+        values = `/usr/bin/crudini --get -- #{[zulip_conf_path, section, key].shelljoin} 2>&1`; result = $?.success?
+        if result
+          all_values += values.strip.split(/,\s*/)
+        end
+      end
+      return all_values
+    else
+      return []
+    end
+  end
+end
diff --git a/puppet/zulip/lib/puppet/functions/zulipsecret.rb b/puppet/zulip/lib/puppet/functions/zulipsecret.rb
new file mode 100644
index 0000000000..1741fcc0dd
--- /dev/null
+++ b/puppet/zulip/lib/puppet/functions/zulipsecret.rb
@@ -0,0 +1,12 @@
+require "shellwords"
+
+Puppet::Functions.create_function(:zulipsecret) do
+  def zulipsecret(section, key, default)
+    output = `/usr/bin/crudini --get -- /etc/zulip/zulip-secrets.conf #{[section, key].shelljoin} 2>&1`; result = $?.success?
+    if result
+      output.strip()
+    else
+      default
+    end
+  end
+end
diff --git a/puppet/zulip/lib/puppet/parser/functions/zulipconf.rb b/puppet/zulip/lib/puppet/parser/functions/zulipconf.rb
deleted file mode 100644
index 4ec32dc9e3..0000000000
--- a/puppet/zulip/lib/puppet/parser/functions/zulipconf.rb
+++ /dev/null
@@ -1,50 +0,0 @@
-require "shellwords"
-
-module Puppet::Parser::Functions
-  newfunction(:zulipconf, :type => :rvalue, :arity => -2) do |args|
-    default = args.pop
-    zulip_conf_path = lookupvar("zulip_conf_path")
-    output = `/usr/bin/crudini --get -- #{[zulip_conf_path, *args].shelljoin} 2>&1`; result = $?.success?
-    if result
-      if [true, false].include? default
-        # If the default is a bool, coerce into a bool.  This list is also
-        # maintained in scripts/lib/zulip_tools.py
-        ["1", "y", "t", "true", "yes", "enable", "enabled"].include? output.strip.downcase
-      else
-        output.strip
-      end
-    else
-      default
-    end
-  end
-
-  newfunction(:zulipconf_keys, :type => :rvalue, :arity => 1) do |args|
-    zulip_conf_path = lookupvar("zulip_conf_path")
-    output = `/usr/bin/crudini --get -- #{[zulip_conf_path, args[0]].shelljoin} 2>&1`; result = $?.success?
-    if result
-      return output.lines.map { |l| l.strip }
-    else
-      return []
-    end
-  end
-
-  newfunction(:zulipconf_nagios_hosts, :type => :rvalue, :arity => 0) do |args|
-    section = "nagios"
-    prefix = "hosts_"
-    zulip_conf_path = lookupvar("zulip_conf_path")
-    keys = `/usr/bin/crudini --get -- #{[zulip_conf_path, section].shelljoin} 2>&1`; result = $?.success?
-    if result
-      filtered_keys = keys.lines.map { |l| l.strip }.select { |l| l.start_with?(prefix) }
-      all_values = []
-      filtered_keys.each do |key|
-        values = `/usr/bin/crudini --get -- #{[zulip_conf_path, section, key].shelljoin} 2>&1`; result = $?.success?
-        if result
-          all_values += values.strip.split(/,\s*/)
-        end
-      end
-      return all_values
-    else
-      return []
-    end
-  end
-end
diff --git a/puppet/zulip/lib/puppet/parser/functions/zulipsecret.rb b/puppet/zulip/lib/puppet/parser/functions/zulipsecret.rb
deleted file mode 100644
index 89cb33b960..0000000000
--- a/puppet/zulip/lib/puppet/parser/functions/zulipsecret.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-module Puppet::Parser::Functions
-  newfunction(:zulipsecret, :type => :rvalue) do |args|
-    default = args.pop
-    output = `/usr/bin/crudini --get /etc/zulip/zulip-secrets.conf #{args.shelljoin} 2>&1`; result = $?.success?
-    if result
-      output.strip()
-    else
-      default
-    end
-  end
-end
diff --git a/puppet/zulip/manifests/profile/postgresql.pp b/puppet/zulip/manifests/profile/postgresql.pp
index 23f24b00f3..8f4ec3b5ae 100644
--- a/puppet/zulip/manifests/profile/postgresql.pp
+++ b/puppet/zulip/manifests/profile/postgresql.pp
@@ -54,7 +54,7 @@ class zulip::profile::postgresql {
     fail("PostgreSQL ${version} not supported")
   }
 
-  if $replication_primary != '' and $replication_user != '' {
+  if $replication_primary != undef and $replication_user != undef {
     if $s3_backups_bucket == '' {
       $message = @(EOT/L)
           Replication is enabled, but s3_backups_bucket is not set in zulip-secrets.conf!  \
diff --git a/puppet/zulip/templates/postgresql/12/postgresql.conf.template.erb b/puppet/zulip/templates/postgresql/12/postgresql.conf.template.erb
index 74318c92f5..b9e8caa567 100644
--- a/puppet/zulip/templates/postgresql/12/postgresql.conf.template.erb
+++ b/puppet/zulip/templates/postgresql/12/postgresql.conf.template.erb
@@ -776,14 +776,14 @@ work_mem = <%= scope["zulip::profile::postgresql::work_mem"] %>MB
 shared_buffers = <%= scope["zulip::profile::postgresql::shared_buffers"] %>MB
 wal_buffers = 4MB
 checkpoint_completion_target = 0.7
-<% if @random_page_cost != '' -%>
+<% unless @random_page_cost.nil? -%>
 random_page_cost = <%= @random_page_cost %>
 <% end -%>
-<% if @effective_io_concurrency != '' -%>
+<% unless @effective_io_concurrency.nil? -%>
 effective_io_concurrency = <%= @effective_io_concurrency %>
 <% end -%>
 
-<% if @listen_addresses != '' -%>
+<% unless @listen_addresses.nil? -%>
 listen_addresses = <%= @listen_addresses %>
 <% end -%>
 
@@ -793,20 +793,20 @@ max_wal_senders = 5
 archive_mode = on
 archive_command = '/usr/bin/timeout 10m /usr/local/bin/env-wal-g wal-push %p'
 restore_command = '/usr/local/bin/env-wal-g wal-fetch "%f" "%p"'
-<% if @replication_primary != '' && @replication_user != '' -%>
+<% unless @replication_primary.nil? || @replication_user.nil? -%>
 primary_conninfo = 'host=<%= @replication_primary %> user=<%= @replication_user -%>
 <% if @replication_password != '' %> password=<%= @replication_password %><% end -%>
-<% if @ssl_mode != '' %> sslmode=<%= @ssl_mode %><% end -%>
+<% unless @ssl_mode.nil? %> sslmode=<%= @ssl_mode %><% end -%>
 '
 <% end -%>
 <% end -%>
 
-<% if @ssl_cert_file != '' -%>
+<% unless @ssl_cert_file.nil? -%>
 ssl_cert_file = '<%= @ssl_cert_file %>'		# (change requires restart)
 <% end -%>
-<% if @ssl_key_file != '' -%>
+<% unless @ssl_key_file.nil? -%>
 ssl_key_file = '<%= @ssl_key_file %>'		# (change requires restart)
 <% end -%>
-<% if @ssl_ca_file != '' -%>
+<% unless @ssl_ca_file.nil? -%>
 ssl_ca_file = '<%= @ssl_ca_file %>'		# (change requires restart)
 <% end -%>
diff --git a/puppet/zulip/templates/postgresql/13/postgresql.conf.template.erb b/puppet/zulip/templates/postgresql/13/postgresql.conf.template.erb
index 7323274e4d..97e230adde 100644
--- a/puppet/zulip/templates/postgresql/13/postgresql.conf.template.erb
+++ b/puppet/zulip/templates/postgresql/13/postgresql.conf.template.erb
@@ -807,14 +807,14 @@ work_mem = <%= scope["zulip::profile::postgresql::work_mem"] %>MB
 shared_buffers = <%= scope["zulip::profile::postgresql::shared_buffers"] %>MB
 wal_buffers = 4MB
 checkpoint_completion_target = 0.7
-<% if @random_page_cost != '' -%>
+<% unless @random_page_cost.nil? -%>
 random_page_cost = <%= @random_page_cost %>
 <% end -%>
-<% if @effective_io_concurrency != '' -%>
+<% unless @effective_io_concurrency.nil? -%>
 effective_io_concurrency = <%= @effective_io_concurrency %>
 <% end -%>
 
-<% if @listen_addresses != '' -%>
+<% unless @listen_addresses.nil? -%>
 listen_addresses = <%= @listen_addresses %>
 <% end -%>
 
@@ -824,20 +824,20 @@ max_wal_senders = 5
 archive_mode = on
 archive_command = '/usr/bin/timeout 10m /usr/local/bin/env-wal-g wal-push %p'
 restore_command = '/usr/local/bin/env-wal-g wal-fetch "%f" "%p"'
-<% if @replication_primary != '' && @replication_user != '' -%>
+<% unless @replication_primary.nil? || @replication_user.nil? -%>
 primary_conninfo = 'host=<%= @replication_primary %> user=<%= @replication_user -%>
 <% if @replication_password != '' %> password=<%= @replication_password %><% end -%>
-<% if @ssl_mode != '' %> sslmode=<%= @ssl_mode %><% end -%>
+<% unless @ssl_mode.nil? %> sslmode=<%= @ssl_mode %><% end -%>
 '
 <% end -%>
 <% end -%>
 
-<% if @ssl_cert_file != '' -%>
+<% unless @ssl_cert_file.nil? -%>
 ssl_cert_file = '<%= @ssl_cert_file %>'		# (change requires restart)
 <% end -%>
-<% if @ssl_key_file != '' -%>
+<% unless @ssl_key_file.nil? -%>
 ssl_key_file = '<%= @ssl_key_file %>'		# (change requires restart)
 <% end -%>
-<% if @ssl_ca_file != '' -%>
+<% unless @ssl_ca_file.nil? -%>
 ssl_ca_file = '<%= @ssl_ca_file %>'		# (change requires restart)
 <% end -%>
diff --git a/puppet/zulip/templates/postgresql/14/postgresql.conf.template.erb b/puppet/zulip/templates/postgresql/14/postgresql.conf.template.erb
index 295b796464..da8e54c1f5 100644
--- a/puppet/zulip/templates/postgresql/14/postgresql.conf.template.erb
+++ b/puppet/zulip/templates/postgresql/14/postgresql.conf.template.erb
@@ -828,14 +828,14 @@ work_mem = <%= scope["zulip::profile::postgresql::work_mem"] %>MB
 shared_buffers = <%= scope["zulip::profile::postgresql::shared_buffers"] %>MB
 wal_buffers = 4MB
 checkpoint_completion_target = 0.7
-<% if @random_page_cost != '' -%>
+<% unless @random_page_cost.nil? -%>
 random_page_cost = <%= @random_page_cost %>
 <% end -%>
-<% if @effective_io_concurrency != '' -%>
+<% unless @effective_io_concurrency.nil? -%>
 effective_io_concurrency = <%= @effective_io_concurrency %>
 <% end -%>
 
-<% if @listen_addresses != '' -%>
+<% unless @listen_addresses.nil? -%>
 listen_addresses = <%= @listen_addresses %>
 <% end -%>
 
@@ -845,20 +845,20 @@ max_wal_senders = 5
 archive_mode = on
 archive_command = '/usr/bin/timeout 10m /usr/local/bin/env-wal-g wal-push %p'
 restore_command = '/usr/local/bin/env-wal-g wal-fetch "%f" "%p"'
-<% if @replication_primary != '' && @replication_user != '' -%>
+<% unless @replication_primary.nil? || @replication_user.nil? -%>
 primary_conninfo = 'host=<%= @replication_primary %> user=<%= @replication_user -%>
 <% if @replication_password != '' %> password=<%= @replication_password %><% end -%>
-<% if @ssl_mode != '' %> sslmode=<%= @ssl_mode %><% end -%>
+<% unless @ssl_mode.nil? %> sslmode=<%= @ssl_mode %><% end -%>
 '
 <% end -%>
 <% end -%>
 
-<% if @ssl_cert_file != '' -%>
+<% unless @ssl_cert_file.nil? -%>
 ssl_cert_file = '<%= @ssl_cert_file %>'		# (change requires restart)
 <% end -%>
-<% if @ssl_key_file != '' -%>
+<% unless @ssl_key_file.nil? -%>
 ssl_key_file = '<%= @ssl_key_file %>'		# (change requires restart)
 <% end -%>
-<% if @ssl_ca_file != '' -%>
+<% unless @ssl_ca_file.nil? -%>
 ssl_ca_file = '<%= @ssl_ca_file %>'		# (change requires restart)
 <% end -%>
diff --git a/puppet/zulip/templates/postgresql/zulip.conf.template.erb b/puppet/zulip/templates/postgresql/zulip.conf.template.erb
index bc196c3c55..943c12a269 100644
--- a/puppet/zulip/templates/postgresql/zulip.conf.template.erb
+++ b/puppet/zulip/templates/postgresql/zulip.conf.template.erb
@@ -1,4 +1,4 @@
-<% if @listen_addresses != '' -%>
+<% unless @listen_addresses.nil? -%>
 # Bind to specific address
 listen_addresses = <%= @listen_addresses %>
 <% end -%>
@@ -32,10 +32,10 @@ work_mem = <%= scope["zulip::profile::postgresql::work_mem"] %>MB
 shared_buffers = <%= scope["zulip::profile::postgresql::shared_buffers"] %>MB
 wal_buffers = 4MB
 checkpoint_completion_target = 0.7
-<% if @random_page_cost != '' -%>
+<% unless @random_page_cost.nil? -%>
 random_page_cost = <%= @random_page_cost %>
 <% end -%>
-<% if @effective_io_concurrency != '' -%>
+<% unless @effective_io_concurrency.nil? -%>
 effective_io_concurrency = <%= @effective_io_concurrency %>
 <% end -%>
 
@@ -44,20 +44,20 @@ effective_io_concurrency = <%= @effective_io_concurrency %>
 archive_mode = on
 archive_command = '/usr/bin/timeout 10m /usr/local/bin/env-wal-g wal-push %p'
 restore_command = '/usr/local/bin/env-wal-g wal-fetch "%f" "%p"'
-<% if @replication_primary != '' && @replication_user != '' -%>
+<% unless @replication_primary.nil? || @replication_user.nil? -%>
 primary_conninfo = 'host=<%= @replication_primary %> user=<%= @replication_user -%>
 <% if @replication_password != '' %> password=<%= @replication_password %><% end -%>
-<% if @ssl_mode != '' %> sslmode=<%= @ssl_mode %><% end -%>
+<% unless @ssl_mode.nil? %> sslmode=<%= @ssl_mode %><% end -%>
 '
 <% end -%>
 <% end -%>
 
-<% if @ssl_cert_file != '' -%>
+<% unless @ssl_cert_file.nil? -%>
 ssl_cert_file = '<%= @ssl_cert_file %>'		# (change requires restart)
 <% end -%>
-<% if @ssl_key_file != '' -%>
+<% unless @ssl_key_file.nil? -%>
 ssl_key_file = '<%= @ssl_key_file %>'		# (change requires restart)
 <% end -%>
-<% if @ssl_ca_file != '' -%>
+<% unless @ssl_ca_file.nil? -%>
 ssl_ca_file = '<%= @ssl_ca_file %>'		# (change requires restart)
 <% end -%>