move puppet.conf enforcement around