set -eo pipefail *after* confd loop, refs #514.