Have a production config which sets ssh keys etc..
Set deploys password
Use more secure deploy password
Fix broken puppet files
Actually disable root and machine accounts rather than just locking
Have a sensible sshd_config
Use source not contents