Make it easier to twiddle TLS from hiera; turn TLS on by default