You're entirely right, I got myself completely muddled between reviews and was starting to talk about templating the .yml config file, rather than the ENC script.

Yes, I think this script can be static, and /etc/foreman would be a better place for the config file.  Please disregard anything else I said!