ferm.conf is now (kind of, almost) under puppet control