At some point the

puppet agent -t -w 30

that we're using on the agent node to wait for the server node to start up stopped working. Now you get the following error:

    agent: Error: Request to https://puppet:8140/puppet-ca/v1 failed after 0.001 seconds: Failed to open TCP connection to puppet:8140 (Connection refused - connect(2) for "puppet" port 8140)
    agent: Wrapped exception:
    agent: Failed to open TCP connection to puppet:8140 (Connection refused - connect(2) for "puppet" port 8140)
    agent: Error: No more routes to ca
    agent: Error: Could not run: No more routes to ca
==> agent: Removing domain...
==> agent: An error occurred. The error will be shown after all tasks complete.

(And vagrant fails.)

This should include yamllint plus the equivalent of pdk validate and pdk test unit in both site/role and site/profile.

We should switch to Hiera v5. One of the nice features of v5 is the ability to do globbing. See Dylan's blog post for examples.

Since choria does not currently support Puppet 6, I removed it in #11 temporarily. I need to add it back in once it has been updated for Puppet 6.

Any additional VMs added to the Vagrantfile can't talk to the Puppet server due to firewall rules.

There doesn't appear to be an obvious solution for this. puppetlabs/puppetdb pulls in puppetlabs/firewall, which seems to turn on the iptables service with default rules. puppetlabs/firewall doesn't support rules in hiera (which would be the obvious solution). This leaves us with 2 options (that I can see):

1. Add in some other firewall module (and hope they don't conflict) plus hiera options.
2. Include a simple module that creates the firewall rules.

We need to drop the dependency on puppet-puppetserver since that module has been deprecated.