this should use the `enterprise.puppetlabs.lan` cname. Also, this is only useful inside our firewall. Is that a reasonable thing for the sample cfg?