Separate the enabled and ensure parameters so that they don't both have to be the same - this is useful for HA setups where enabled should be false and ensure should be undef (don't start and don't touch the service, let the HA stack do that).