a hard-fought battle, lessons learned: don't reboot after updates, move default configs out of the way, and librarian-puppet isn't magic