do nsec3 via puppet