Move firewall stuff to foo/init.sls to keep jinja out of overstate