+The puppet repository is public, but we sometimes need to keep passwords
+in puppet. There are many ways to do this - hiera-gpg, ENC, etc. We've
+settled on a fairly simple one. Log into handel, create a new manifest
+in the relevant module (call is something like "params.pp"). You can add
+passwords to this file. To stop git complaining on push, make sure you
+update .gitignore for the new file. Now you can import this file where
+you need passwords and use them.