The ACL file is not actually a template, so do this with puppet instead