diff --git a/Vagrantfile b/Vagrantfile
index e97d259..82410b0 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -1,979 +1,983 @@
 Vagrant.require_version ">= 2.2.0"
 ENV["LC_ALL"] = "en_US.UTF-8"
 
 # Default configuration for all defines node below
 environment = "staging"
 environment_path = "/tmp/puppet/environments"
 manifest_file = "site.pp"
 manifests_path = "swh-site/manifests"
 puppet_options = "--fileserverconfig=/etc/puppet/fileserver.conf --verbose" # --debug --trace"
 puppet_staging_facts = {
   "vagrant_testing" => "1",
   "testing"         => "vagrant",
   "deployment"      => "staging",
   "subnet"          => "vagrant"
 }
 puppet_production_facts = {
   "vagrant_testing" => "1",
   "testing"         => "vagrant",
   "deployment"      => "production",
   "subnet"          => "vagrant"
 }
 puppet_admin_facts = {
   "vagrant_testing" => "1",
   "testing"         => "vagrant",
   "deployment"      => "admin",
   "subnet"          => "vagrant"
 }
 # used to define the local vm template path
 puppet_env_path = ENV["SWH_PUPPET_ENVIRONMENT_HOME"]
 
 # Images/local configuration (libvirt)
-$local_debian10_box = "debian10-20201012-1352"
-$local_debian10_box_url = "file://#{puppet_env_path}/packer/builds/swh-debian-10.6-amd64-20201012-1352.qcow2"
+$local_debian10_box = "debian10-20210517-1348"
+$local_debian10_box_url = "file://#{puppet_env_path}/packer/builds/swh-debian-10.9-amd64-20210517-1348.qcow2"
 
 # Images/remote configuration
-$global_debian10_box = "debian10-20201012-1352"
-$global_debian10_box_url = "https://annex.softwareheritage.org/public/isos/libvirt/debian/swh-debian-10.6-amd64-20201012-1352.qcow2"
+$global_debian10_box = "debian10-20210517-1348"
+$global_debian10_box_url = "https://annex.softwareheritage.org/public/isos/libvirt/debian/swh-debian-10.9-amd64-20210517-1348.qcow2"
 
 unless Vagrant.has_plugin?("libvirt")
   $stderr.puts <<-MSG
   vagrant-libvirt plugin is required for this.
   To install: `$ sudo apt install vagrant-libvirt
 MSG
   exit 1
 end
 
 Vagrant.configure("2") do |global_config|
   ################
   ## STAGING
   ################
   global_config.vm.define :"staging-webapp" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "webapp.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.30", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-rp0" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "rp0.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.20", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 512
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-db1" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "db1.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.11", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 512
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-storage1" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "storage1.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.41", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-objstorage0" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "objstorage0.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.110", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 512
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-deposit" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "deposit.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.31", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 512
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-worker0" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "worker0.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.100", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   # indexer worker
   global_config.vm.define :"staging-worker3" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "worker3.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.103", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-scheduler0" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "scheduler0.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.50", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-journal0" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "journal0.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.70", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-esnode0" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "search-esnode0.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.80", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-search0" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "search0.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.90", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-counters0" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "counters0.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.95", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"staging-mirror-test" do |config|
     # config.ssh.insert_key = false
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "mirror-test.internal.staging.swh.network"
     config.vm.network   :private_network, ip: "10.168.130.160", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   ################
   # ADMIN
   ################
   global_config.vm.define :"bojimans" do |config|
     # config.ssh.insert_key = false
 
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "bojimans.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.199", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 512
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"pergamon" do |config|
     # config.ssh.insert_key = false
 
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "pergamon.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.29", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
     # As a puppet master, the path is different compared to the other servers
     config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
+    # config.vm.synced_folder "vagrant/puppet_master", "/var/lib/puppet/vagrant_certificates", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
-      provider.memory = 512
+      provider.memory = 3192
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
+    config.vm.provision "file", source: "vagrant/puppet_master/", destination: "/tmp/"
+    config.vm.provision :shell, :path => "vagrant/puppet_master/install_certs.sh"
+
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "production"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   ################
   ## PRODUCTION
   ################
   global_config.vm.define :"prod-worker01" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "worker01.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.21", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"esnode1" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "esnode1.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.61", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"esnode2" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "esnode2.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.62", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"esnode3" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update        = false
     config.vm.hostname                = "esnode3.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.63", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"logstash" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "logstash0.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.19", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 2048
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"admin-bardo" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "bardo.internal.admin.swh.network"
     config.vm.network   :private_network, ip: "10.168.50.10", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_admin_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"admin-rp1" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "rp1.internal.admin.swh.network"
     config.vm.network   :private_network, ip: "10.168.50.20", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_admin_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"prod-webapp1" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "webapp1.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.71", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"prod-moma" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "moma.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.31", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"prod-search1" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "search1.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.85", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"prod-search-esnode1" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "search-esnode1.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.81", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"prod-search-esnode2" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "search-esnode2.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.82", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"prod-search-esnode3" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "search-esnode3.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.83", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 4096
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   global_config.vm.define :"prod-counters1" do |config|
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.hostname                = "counters1.internal.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.95", netmask: "255.255.0.0"
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 1024
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
 
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_production_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 
   ################
   ## MISC
   ################
   global_config.vm.define :test do |config|
     config.ssh.insert_key = false
 
     config.vm.box                     = $global_debian10_box
     config.vm.box_url                 = $global_debian10_box_url
     config.vm.box_check_update = false
     config.vm.hostname                = "test.softwareheritage.org"
     config.vm.network   :private_network, ip: "10.168.100.30", netmask: "255.255.0.0"
     config.vm.network   :private_network, ip: "10.168.101.30", netmask: "255.255.0.0"
     config.vm.network "forwarded_port", guest: 10030, host: 22
 
     config.vm.synced_folder "/tmp/puppet/", "/tmp/puppet", type: 'nfs'
     # ssl certificates share
-    config.vm.synced_folder "vagrant/le_certs", "/etc/puppet/le_certs", type: 'nfs'
+    config.vm.synced_folder "vagrant/le_certs", "/var/lib/puppet/letsencrypt_exports", type: 'nfs'
 
     config.vm.provider :libvirt do |provider|
       provider.memory = 512
       provider.cpus = 2
       # local test run: https://github.com/vagrant-libvirt/vagrant-libvirt/issues/45
       provider.driver = 'kvm'
     end
     config.vm.provision "puppet" do |puppet|
       puppet.environment_path = "#{environment_path}"
       puppet.environment = "#{environment}"
       puppet.hiera_config_path = "#{puppet.environment_path}/#{puppet.environment}/hiera.yaml"
       puppet.manifest_file = "#{manifest_file}"
       puppet.manifests_path = "#{manifests_path}"
       puppet.options = "#{puppet_options}"
       puppet.facter = puppet_staging_facts
       puppet.synced_folder_type = 'nfs'
     end
   end
 end
diff --git a/vagrant/puppet_master/ca/ca_crl.pem b/vagrant/puppet_master/ca/ca_crl.pem
new file mode 100644
index 0000000..8421685
--- /dev/null
+++ b/vagrant/puppet_master/ca/ca_crl.pem
@@ -0,0 +1,18 @@
+-----BEGIN X509 CRL-----
+MIIC0TCBugIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDDChQdXBwZXQgQ0E6
+IHBlcmdhbW9uLnNvZnR3YXJlaGVyaXRhZ2Uub3JnFw0yMTA1MTgxMzE0MjJaFw0y
+NjA1MTcxMzE0MjNaMCIwIAIBAhcNMjEwNTE4MTMxNDIzWjAMMAoGA1UdFQQDCgEB
+oC8wLTAfBgNVHSMEGDAWgBQMd2NkFrcbv2EcL1AAq9iTFG51PTAKBgNVHRQEAwIB
+ATANBgkqhkiG9w0BAQsFAAOCAgEAqeyUPQB6jxR3gH9PRzNFxev6oZejWh6hVYrH
+ZmBOmFmPs1WtVnGM/fEWAH1gvpZ139VsH4ltNjZzEIeobIDfYWN23ggQpg1bqs7K
+V5pJolTLlZ/3Ox5kwlh+jQ0JLI0GOHi+HZ9ExhAitdhpnFDxDZ3+Efj4MFy8sDgm
+X7bKGsHERCl4VUS8xxrgR0AZukMF4h4Iq6JpdZDd20upsLRiw5KR55STydpVxQMu
+JGQLf7z+4OiopzsRj5JzMj2GC7Vb/MAQs68ugOEoTPWdOtVkRuE53PPURgak34RX
+3piTtek+Qhm9yrZL5n7HEAApMDN4/ew7Q44Nfu4kmdFd296H9lcY0DzvP2aM/n3s
+XJeBc4MktNU6ABHIAopE78OfGpTEQQS7B/O8OXcaDV5zvzSmbF5kXMX4IeXKSQkP
+ga6W2xsqDKEl44Lk8m7Uq0ZVprkKC+5fsfxGefBAqtkreIFIELbFz72whyqCoS+m
+GPZdtqcjz7pVD6wJk0kZom4GVtJ+bbHtrnj5hkVeLwMCxM88i6cRoS5jtQy/BV7z
+5BSQffkOvOYDh8E9VlnUMXJ1sJF+EJkk3L1UhKDmFFTwXy6t6uJMY1GEbaUM/fxZ
+vzTGyMwbcwf771XMUF7h/7IElBOqKSuf0WTvmv3jdJPp5QCiVHMQMN6E+4TT4Ik6
+GIr7ygQ=
+-----END X509 CRL-----
diff --git a/vagrant/puppet_master/ca/ca_crt.pem b/vagrant/puppet_master/ca/ca_crt.pem
new file mode 100644
index 0000000..91e46fd
--- /dev/null
+++ b/vagrant/puppet_master/ca/ca_crt.pem
@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFpTCCA42gAwIBAgIBATANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDDChQdXBw
+ZXQgQ0E6IHBlcmdhbW9uLnNvZnR3YXJlaGVyaXRhZ2Uub3JnMB4XDTIxMDUxNzEz
+MDUxN1oXDTI2MDUxNzEzMDUxN1owMzExMC8GA1UEAwwoUHVwcGV0IENBOiBwZXJn
+YW1vbi5zb2Z0d2FyZWhlcml0YWdlLm9yZzCCAiIwDQYJKoZIhvcNAQEBBQADggIP
+ADCCAgoCggIBALX3RDwFDEP2+zbH/LJVatv/BVP8u2zAnNvjQBQBJFm8UfZKYwJ7
+4TDdJVysRRBROhz8wIDHMR5gj+IeSvH+0LLLtSzx3I0bEtngst4vGwy4CI9IQSHj
+wzGebL91s5u13UeoKjMWnOOYuKbwNqF3jm99D/tFdm/+E2uN/fVP/IcOse/7JZDz
+99wwM+T5MFxmsTtPkgimmp9GCfqLdUeJaZ8QsdCR+I/g3VvpSof4eMkO6OVUtycd
+cJDCRkj+sHCFmUUrYkeViwyIpOv2krc6YVKacZjopHtLGU7yiS3qFTS0qrS+r8mb
+iC1KZ5+XFxxLTP+pwER5pmYhBc8eMbcb0MEuQi4SoXCDRUTD772x4obzg5bH6WeU
+1t7gebjMMQYbjgSUGwHx6w1IhODGsQKObobVEEUZeMf1jx/BpON4c7wLmRatYOkV
+l/pZ43VfVhdQCoZ44EJ1vlKf//AvonZSkEg/szF116GR3whj078TrQZuLbQd3Bkj
+wIwwesRz+2kyauRmLm2OGmpq0t4CSugAouY277WjIk6KpOe8ZDPKrBxCVicE8f4X
+Xas7+d+5mgpWnO+j0hFdDwpPU7eCyqhfUNqpVnEXw5+/ToH7jtOIAIjUDma3EVBU
+lHLDPU2a0B3WP2qb7d9o7ZzYPjy+jhOXN3a6nyle7z31dWA4Qh3Yb4E3AgMBAAGj
+gcMwgcAwNwYJYIZIAYb4QgENBCoMKFB1cHBldCBSdWJ5L09wZW5TU0wgSW50ZXJu
+YWwgQ2VydGlmaWNhdGUwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8w
+HQYDVR0OBBYEFAx3Y2QWtxu/YRwvUACr2JMUbnU9MEUGA1UdIwQ+MDyhN6Q1MDMx
+MTAvBgNVBAMMKFB1cHBldCBDQTogcGVyZ2Ftb24uc29mdHdhcmVoZXJpdGFnZS5v
+cmeCAQEwDQYJKoZIhvcNAQELBQADggIBADxfohBXjhti4ArO2ONVwk/+TZFGtjtT
+f31JkYk42ezmh7Ndnb1WsneeMg/TUc8WnTTyF4AkFcRp9mEEdtW/1jp61cOStr6I
+y1TZ/srMd3+5OHFPRcIQBTzvho/AIziXJrPOMWnJ/+WG5n0R7QZWt/XttPvmieE9
+LupqPEqp7up13SDD+uxTclaGKBHtw+wz9ASjj1WgCLu11Vm+YOtBMQqhFnJUuJ7Z
+hUXGXyoRysCorYZNqKnZFAFCgoML3vQRMZZu4mghJPsDDGhilEtnJnFP8dMkpRhF
+5WkVOmpVqGT9hlAduJeAkqzRntJJReFlNb5R6DyITmsV0MyJSgR0oj4DKgkyWUWa
+f84581xrTlIGJyBXNOrA4mczw5duITVoGQwZiwOoHNnqcvP/doZM4R1fPauV1E2n
+l3X643Ilo8p011s6iVBQFJMBJAY1zPKiMeXcHC5B2/StWBwIH5WCyHShknx4YjFE
+667IJ+gfTSq78EtAb7uL7kVE1wIYxnaq0F9KdjB5f+sAKtmLLBD0wREiQG75BpPx
+7oOgOm5xy3mNxuyj4qKDqDxvsO3AP1ArYzntpfw7CCCqzhtbq/vbjzNTi9Q5f+ZD
+v6ncKGO5yGkSIdmFyAewQLrw3iHE0kiwYVw5nN/DihaOKmdvZS59jiv9eBXJGX7i
+IcId7xKH7CI+
+-----END CERTIFICATE-----
diff --git a/vagrant/puppet_master/ca/ca_key.pem b/vagrant/puppet_master/ca/ca_key.pem
new file mode 100644
index 0000000..0173488
--- /dev/null
+++ b/vagrant/puppet_master/ca/ca_key.pem
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAtfdEPAUMQ/b7Nsf8slVq2/8FU/y7bMCc2+NAFAEkWbxR9kpj
+AnvhMN0lXKxFEFE6HPzAgMcxHmCP4h5K8f7Qssu1LPHcjRsS2eCy3i8bDLgIj0hB
+IePDMZ5sv3Wzm7XdR6gqMxac45i4pvA2oXeOb30P+0V2b/4Ta4399U/8hw6x7/sl
+kPP33DAz5PkwXGaxO0+SCKaan0YJ+ot1R4lpnxCx0JH4j+DdW+lKh/h4yQ7o5VS3
+Jx1wkMJGSP6wcIWZRStiR5WLDIik6/aStzphUppxmOike0sZTvKJLeoVNLSqtL6v
+yZuILUpnn5cXHEtM/6nARHmmZiEFzx4xtxvQwS5CLhKhcINFRMPvvbHihvODlsfp
+Z5TW3uB5uMwxBhuOBJQbAfHrDUiE4MaxAo5uhtUQRRl4x/WPH8Gk43hzvAuZFq1g
+6RWX+lnjdV9WF1AKhnjgQnW+Up//8C+idlKQSD+zMXXXoZHfCGPTvxOtBm4ttB3c
+GSPAjDB6xHP7aTJq5GYubY4aamrS3gJK6ACi5jbvtaMiToqk57xkM8qsHEJWJwTx
+/hddqzv537maClac76PSEV0PCk9Tt4LKqF9Q2qlWcRfDn79OgfuO04gAiNQOZrcR
+UFSUcsM9TZrQHdY/apvt32jtnNg+PL6OE5c3drqfKV7vPfV1YDhCHdhvgTcCAwEA
+AQKCAgAzB6v4FQZSjRH4U+9W58N2/La2zfqVzhJvS/StZ4CVNc3afxPzH2CQvoP6
+0EjyAYWFmZA2zSXGOhg/tnUYFnjam2wstYs/eyc3ON+Qla9FStsDq6SwZ1pXMPGY
+Y97BvSfYL53eA+ptnWezUUxQzeGA/JadxeYoFB3IHOLqh8ru6T0XatwnIXQSKOZ0
+wTlBwH7VfkQa7vYP0ql7vN5f+HZJaHolXrpRRyNs4ijHpvPglrDTl4Vhj80Am6rw
+T5SVibHpBvih0JtVIYD2t4h/n/ypGKzgz+VIuk/Xpwa3fJ0D0eLJm2xa4qY25VXY
+GJwfkDKAxE8qJN94ZqxlYDda/Y72FP9OJSTKrsGGbcWL/TvTn4+pLoOYqmOXIO64
+2qPBKcc2AbwWxxUrAKOJF/x1chQh8eLve8JLj7KkN6zFR4+M01+UHODCAfuHpUJ1
+Nk5hBKllEhzjEEA9Pq3Fwd3wm2fOcA2ghPbJ1UnaBzVWxqrrq5o92T3XjpBrgl01
+puLVXEjwQK4htNYNiv8wtwrjbAwyaocf3fm6zb1eFdAzFn2L814bPp+ao8NNAD0i
+514587PBASKDN7Pv/DtCuX+MSjfKu65CZgs2f5xFCOKZigioHqmWRGd3f3AivsgX
+KZXDSwWQDWsCFRdv9HFU5JBl+KDV3wXM3RgZK0rwhAw6OQMhgQKCAQEA2LxBxFS6
+ogp5VOW9XUTIIMEQ3lL/9N7u9dTZKu/MMxAfG+dmJU8aGth+/068uzoXhIcudaIA
+PRiKBJYtdu0+HhYUOOEMwNrKYCIHgoT/wKRi/7ZbrGwYLzTI0Io/1jq+Znjfycu6
+Z5YtQp3rfnghfrhA5v2utbaBxxZLeQnRBW0kTh+GSLY1OZFI4zDl6c6QFtRjTGFH
+HSHfKGuKQ7PqtfBKhTClX8lOzIMt+hgwa2Ma+CwofP9qrjPpWboOmw0EB60kBM7h
+WTKqqmj1zjuOh3X11OkwDyXumOuAueWXWFcIgs4L4UkLFjjdc6clEg5fc+aEl4hG
+ZxIKo1qYc6M6wQKCAQEA1u54wlCOqYZia1kmG99MB4vs29tPCl4877PLX0distih
+6jj6X9a+J1QFPdsSi4vaPy6EbqIuFZ39trEtwyr5L6B2aDrYJ+wQP5gGmMBxQxAI
+mOiH0SUiJlC2W2hadZY2dTsllCdxfg7BAxrN+Cl7VTJuf+cN8y+wh/+Oo29z8eaF
++Uw6JhGP5aAxH1R5sqhl6SZHOOHOkDTaUUaN4fHLRPgwtAhd1n0aYHllAar6nG8Z
+Xp0kuZK9sxpjN6UHx9uGdr8SJoD1dmGIUuTlR76Rer8C291UOjzpqqm/mEqqI5Sg
+oBvdDkz0p7D43FDv+3nCqPBVSbU+doa3azDW2MsR9wKCAQAzcrTV6xsGfiABJCwI
+aNxs0ge0DtXNheIJnwYSKCw77tbDo/FeZ+GVf9DdwA4TD54nioNfzx3pYtrYbeHK
++lQlhi40tk91tDoYCdvogrPHQf5yHxKx4lL3WbtVrYuryfQKlSTiXScZkc+aoawW
+MGQbFZfqfUusvO8fmE5AJDFm7VqR5O/WcNI/oRpBPAlHsA4KLU6JAgqEgtbbXHPM
+0Helyq2V4k9PZpT6/SS72mQcCcGMKcdOrL7hLVd2QjFXYwaS3+nN7mIV724N166J
+zx9tTnYVnWkYH3P8/uJmvnZntPlDO7AcQV+NXeBLpOCq4ZiNBapx4hp8Ow8lacsI
+oDXBAoIBAQDLYLCIPq4gH/d1WNBEw5Ev+unQSL+MMgw7Tch9ihEM5wyfk/bnRU59
+7HVhSLFNtrJ34s6R2Yj+D5gKjbGd4kYVGSOyESyE6k2dv39Of5stODjKaA5Mi3S7
+CNjlueMPLWqul59Bh+lOvStKgsyvrKD1x1jkUoDSwyeqKNqSMF5oYhgYBFdpumiN
+gn25Bbh6o/p7Git+2b0am8iR689KJACSbL+5O8l/srWI4JYBdAbcjAxXiR89Mmuq
+1KdZ+iFYrpOYPckxAgpDUJssxUdoEh2bJq/P2Klgyk7ZnPKdatl//Z3Yo0UTySIg
+o8d4wmWzck4OigxKSOSoR2W8WmSSk+WVAoIBAQCQk75grEfoB3PXYiGRT1ZnIoRR
+jdU5noFXr0ZnqYzykr5gv6wOxzrV7n+9i+wxb4DABW0yfgE3OgJ0+ZcpWuDKsBmP
+JElotps8j9YsUQV54CSPrmmj0OY7BG3yGKjLst6pysfLaurPWNzY1HfnDVqP8Tmu
+GkYQGOsmPJ3Ymk3TALsiRZLCM8IIr7G4+GnTj7h2r959mHBq6kFg3srYQByZBqTo
+JRKeUqKqQlt5KF1w4nssJh0G/oGWezWlZHNoBKQEN+q8/Xkr3Zor+6FGMSOS5z9L
+sgdrd5dawrcq5kxUG8pT+EOD6n+9knuuyawWBSZRskfybUiuose+UvXR5Luw
+-----END RSA PRIVATE KEY-----
diff --git a/vagrant/puppet_master/ca/ca_pub.pem b/vagrant/puppet_master/ca/ca_pub.pem
new file mode 100644
index 0000000..5773161
--- /dev/null
+++ b/vagrant/puppet_master/ca/ca_pub.pem
@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtfdEPAUMQ/b7Nsf8slVq
+2/8FU/y7bMCc2+NAFAEkWbxR9kpjAnvhMN0lXKxFEFE6HPzAgMcxHmCP4h5K8f7Q
+ssu1LPHcjRsS2eCy3i8bDLgIj0hBIePDMZ5sv3Wzm7XdR6gqMxac45i4pvA2oXeO
+b30P+0V2b/4Ta4399U/8hw6x7/slkPP33DAz5PkwXGaxO0+SCKaan0YJ+ot1R4lp
+nxCx0JH4j+DdW+lKh/h4yQ7o5VS3Jx1wkMJGSP6wcIWZRStiR5WLDIik6/aStzph
+UppxmOike0sZTvKJLeoVNLSqtL6vyZuILUpnn5cXHEtM/6nARHmmZiEFzx4xtxvQ
+wS5CLhKhcINFRMPvvbHihvODlsfpZ5TW3uB5uMwxBhuOBJQbAfHrDUiE4MaxAo5u
+htUQRRl4x/WPH8Gk43hzvAuZFq1g6RWX+lnjdV9WF1AKhnjgQnW+Up//8C+idlKQ
+SD+zMXXXoZHfCGPTvxOtBm4ttB3cGSPAjDB6xHP7aTJq5GYubY4aamrS3gJK6ACi
+5jbvtaMiToqk57xkM8qsHEJWJwTx/hddqzv537maClac76PSEV0PCk9Tt4LKqF9Q
+2qlWcRfDn79OgfuO04gAiNQOZrcRUFSUcsM9TZrQHdY/apvt32jtnNg+PL6OE5c3
+drqfKV7vPfV1YDhCHdhvgTcCAwEAAQ==
+-----END PUBLIC KEY-----
diff --git a/vagrant/puppet_master/ca/signed/pergamon.softwareheritage.org.pem b/vagrant/puppet_master/ca/signed/pergamon.softwareheritage.org.pem
new file mode 100644
index 0000000..babc288
--- /dev/null
+++ b/vagrant/puppet_master/ca/signed/pergamon.softwareheritage.org.pem
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGFTCCA/2gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDDChQdXBw
+ZXQgQ0E6IHBlcmdhbW9uLnNvZnR3YXJlaGVyaXRhZ2Uub3JnMB4XDTIxMDUxNzEz
+MTU1NloXDTI2MDUxNzEzMTU1NlowKDEmMCQGA1UEAwwdcGVyZ2Ftb24uc29mdHdh
+cmVoZXJpdGFnZS5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCi
+ZH4eBhr/6joW/RVVFUQQul/mOP0tsVn3B/Mt7BuIlFrjspvJCDTbngXod3OF1eEw
+PDB38rxptvtFrQembNZqX+PULNKS36WAYMr04KBh86qMGS2wN395TW2JmZGO9bNf
+u74eu5pgHGdpZFuAadvY7bFRI8qje/WMGs0RPs1fCMWUqLPPWiC6KO0zeSLmQ3Ac
+JEsQnmhZNqbvALKCHb5Cknt47uKXSvNuoPKg5alFrpOIgIVst2LYsV41U9qJF6Lx
+16Wg1yg5XbtsJyD/fvUO4MOvyxli+nAwZPcGW+kHWbNBoCekof7B8mNEMVK3Fdyw
+cC7zkq0ir+oq5ZDWyzAQVTOYE/xvXNI6Fds06C3JSQoyNjrbCwsiKoXJ9Hd0XwWz
+MtcIubBFQ5rjrnfdNLxFPCUwaLp4G8V7oMEiqbiCDeQTO3v5+ExXq09q1dfdLjh2
+hFtminchfZBJpAgnCVTjWRSggle5c6SBiB1InGwuwIoEFf5MfLP0Wd+vpkBXzdgP
+FnGgDtqiaWL6In31bZv3ZRFqju5Rrl/xy39dOzu+H1pDJ1EzZF9G+mVJE0Jdju9U
+npSHrxLXgVrBck94q0NTXkyJ+dV38NSSRlIWAshU0nrm8hd2HL4qGBHfxekTsvgJ
+KTnjWwXYDHNOXREoRVNJeekpIBo54KGCrTVE91ObiQIDAQABo4IBPTCCATkwNwYJ
+YIZIAYb4QgENBCoMKFB1cHBldCBSdWJ5L09wZW5TU0wgSW50ZXJuYWwgQ2VydGlm
+aWNhdGUwfgYDVR0RBHcwdYImcGVyZ2Ftb24uaW50ZXJuYWwuc29mdHdhcmVoZXJp
+dGFnZS5vcmeCHXBlcmdhbW9uLnNvZnR3YXJlaGVyaXRhZ2Uub3JnggZwdXBwZXSC
+JHB1cHBldC5pbnRlcm5hbC5zb2Z0d2FyZWhlcml0YWdlLm9yZzAOBgNVHQ8BAf8E
+BAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB
+/wQCMAAwHQYDVR0OBBYEFOfwuBnOAhUceIqVf7mIEoKrH8ZEMB8GA1UdIwQYMBaA
+FAx3Y2QWtxu/YRwvUACr2JMUbnU9MA0GCSqGSIb3DQEBCwUAA4ICAQAnMNH/cz6p
+ko+L6qlwS2eajfgL9Za0X1V2CRIHjP/aQsJGNSjhB9+8APqkR5DKrd0CIg3fulkb
+VzFVl4Tfar81h5G5aBBUIRGYTweKdt5UrxZBVveCv+LoGFSrSwP9/xJl5H1wr5kS
+CTjS3JItrL9A2oz0f7OCc176hY3sEh/h0+Fmkh6cJ9BB7fDMeJ/GbPtkwZu0DcOg
+sJ377BBro8PiaSK3yM9fUMK10TeTiRI0fVNhHru/VMQCVI+bwjkr1A6Hh+hrQ4SW
+WorEVlfCjlkR4Hpk8/7VrMLSiYlew392l/CqHDRLyJznTKAcPxl1BrNgb6ld+4aX
+9rTqWJZ13ueKkc47MXrpe8vfYzCVH3wdzGh7AHDmX8lJIN6kGK6cD1MKlXMN164N
+xUWScRPAuz7UilVHS3byzYqqf3EfVlU6vQliTvFYVg8vsen2EH+mSzOL/CXw7whh
+QiFC0NmPfjVneBPYFH4nAiHhYSVWwQBUar9IDOUec1yf0We59ZRmGOA9pj+Yv6ZE
+nI2eVfxO+UBJHesE2lXIgnFDvoZup/SgBoLHPtMBf3hHTPUpNsukIIuhpWsmSFQr
+bObQ3BBLq5GOqOlRvhTc9YvCgEfBn3V3gdE92BvQXLGriHDywqR5bzayn92zucO7
+vxA0qR8bIZ1drUEjvHDVuYNl+W56Scdc+Q==
+-----END CERTIFICATE-----
diff --git a/vagrant/puppet_master/certs/pergamon.softwareheritage.org.pem b/vagrant/puppet_master/certs/pergamon.softwareheritage.org.pem
new file mode 100644
index 0000000..babc288
--- /dev/null
+++ b/vagrant/puppet_master/certs/pergamon.softwareheritage.org.pem
@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGFTCCA/2gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAzMTEwLwYDVQQDDChQdXBw
+ZXQgQ0E6IHBlcmdhbW9uLnNvZnR3YXJlaGVyaXRhZ2Uub3JnMB4XDTIxMDUxNzEz
+MTU1NloXDTI2MDUxNzEzMTU1NlowKDEmMCQGA1UEAwwdcGVyZ2Ftb24uc29mdHdh
+cmVoZXJpdGFnZS5vcmcwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCi
+ZH4eBhr/6joW/RVVFUQQul/mOP0tsVn3B/Mt7BuIlFrjspvJCDTbngXod3OF1eEw
+PDB38rxptvtFrQembNZqX+PULNKS36WAYMr04KBh86qMGS2wN395TW2JmZGO9bNf
+u74eu5pgHGdpZFuAadvY7bFRI8qje/WMGs0RPs1fCMWUqLPPWiC6KO0zeSLmQ3Ac
+JEsQnmhZNqbvALKCHb5Cknt47uKXSvNuoPKg5alFrpOIgIVst2LYsV41U9qJF6Lx
+16Wg1yg5XbtsJyD/fvUO4MOvyxli+nAwZPcGW+kHWbNBoCekof7B8mNEMVK3Fdyw
+cC7zkq0ir+oq5ZDWyzAQVTOYE/xvXNI6Fds06C3JSQoyNjrbCwsiKoXJ9Hd0XwWz
+MtcIubBFQ5rjrnfdNLxFPCUwaLp4G8V7oMEiqbiCDeQTO3v5+ExXq09q1dfdLjh2
+hFtminchfZBJpAgnCVTjWRSggle5c6SBiB1InGwuwIoEFf5MfLP0Wd+vpkBXzdgP
+FnGgDtqiaWL6In31bZv3ZRFqju5Rrl/xy39dOzu+H1pDJ1EzZF9G+mVJE0Jdju9U
+npSHrxLXgVrBck94q0NTXkyJ+dV38NSSRlIWAshU0nrm8hd2HL4qGBHfxekTsvgJ
+KTnjWwXYDHNOXREoRVNJeekpIBo54KGCrTVE91ObiQIDAQABo4IBPTCCATkwNwYJ
+YIZIAYb4QgENBCoMKFB1cHBldCBSdWJ5L09wZW5TU0wgSW50ZXJuYWwgQ2VydGlm
+aWNhdGUwfgYDVR0RBHcwdYImcGVyZ2Ftb24uaW50ZXJuYWwuc29mdHdhcmVoZXJp
+dGFnZS5vcmeCHXBlcmdhbW9uLnNvZnR3YXJlaGVyaXRhZ2Uub3JnggZwdXBwZXSC
+JHB1cHBldC5pbnRlcm5hbC5zb2Z0d2FyZWhlcml0YWdlLm9yZzAOBgNVHQ8BAf8E
+BAMCBaAwIAYDVR0lAQH/BBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB
+/wQCMAAwHQYDVR0OBBYEFOfwuBnOAhUceIqVf7mIEoKrH8ZEMB8GA1UdIwQYMBaA
+FAx3Y2QWtxu/YRwvUACr2JMUbnU9MA0GCSqGSIb3DQEBCwUAA4ICAQAnMNH/cz6p
+ko+L6qlwS2eajfgL9Za0X1V2CRIHjP/aQsJGNSjhB9+8APqkR5DKrd0CIg3fulkb
+VzFVl4Tfar81h5G5aBBUIRGYTweKdt5UrxZBVveCv+LoGFSrSwP9/xJl5H1wr5kS
+CTjS3JItrL9A2oz0f7OCc176hY3sEh/h0+Fmkh6cJ9BB7fDMeJ/GbPtkwZu0DcOg
+sJ377BBro8PiaSK3yM9fUMK10TeTiRI0fVNhHru/VMQCVI+bwjkr1A6Hh+hrQ4SW
+WorEVlfCjlkR4Hpk8/7VrMLSiYlew392l/CqHDRLyJznTKAcPxl1BrNgb6ld+4aX
+9rTqWJZ13ueKkc47MXrpe8vfYzCVH3wdzGh7AHDmX8lJIN6kGK6cD1MKlXMN164N
+xUWScRPAuz7UilVHS3byzYqqf3EfVlU6vQliTvFYVg8vsen2EH+mSzOL/CXw7whh
+QiFC0NmPfjVneBPYFH4nAiHhYSVWwQBUar9IDOUec1yf0We59ZRmGOA9pj+Yv6ZE
+nI2eVfxO+UBJHesE2lXIgnFDvoZup/SgBoLHPtMBf3hHTPUpNsukIIuhpWsmSFQr
+bObQ3BBLq5GOqOlRvhTc9YvCgEfBn3V3gdE92BvQXLGriHDywqR5bzayn92zucO7
+vxA0qR8bIZ1drUEjvHDVuYNl+W56Scdc+Q==
+-----END CERTIFICATE-----
diff --git a/vagrant/puppet_master/install_certs.sh b/vagrant/puppet_master/install_certs.sh
new file mode 100644
index 0000000..4ea9583
--- /dev/null
+++ b/vagrant/puppet_master/install_certs.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+CERT_DIR="/tmp/puppet_master"
+PUPPET_CERT_DIR=/var/lib/puppet/ssl
+
+sudo mkdir -p ${PUPPET_CERT_DIR}/ 
+
+sudo rsync -avP $CERT_DIR/* ${PUPPET_CERT_DIR}
+
+sudo chown -R puppet:puppet ${PUPPET_CERT_DIR}
diff --git a/vagrant/puppet_master/private_keys/pergamon.softwareheritage.org.pem b/vagrant/puppet_master/private_keys/pergamon.softwareheritage.org.pem
new file mode 100644
index 0000000..025b74f
--- /dev/null
+++ b/vagrant/puppet_master/private_keys/pergamon.softwareheritage.org.pem
@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJJwIBAAKCAgEAomR+HgYa/+o6Fv0VVRVEELpf5jj9LbFZ9wfzLewbiJRa47Kb
+yQg0254F6HdzhdXhMDwwd/K8abb7Ra0HpmzWal/j1CzSkt+lgGDK9OCgYfOqjBkt
+sDd/eU1tiZmRjvWzX7u+HruaYBxnaWRbgGnb2O2xUSPKo3v1jBrNET7NXwjFlKiz
+z1oguijtM3ki5kNwHCRLEJ5oWTam7wCygh2+QpJ7eO7il0rzbqDyoOWpRa6TiICF
+bLdi2LFeNVPaiRei8deloNcoOV27bCcg/371DuDDr8sZYvpwMGT3BlvpB1mzQaAn
+pKH+wfJjRDFStxXcsHAu85KtIq/qKuWQ1sswEFUzmBP8b1zSOhXbNOgtyUkKMjY6
+2wsLIiqFyfR3dF8FszLXCLmwRUOa46533TS8RTwlMGi6eBvFe6DBIqm4gg3kEzt7
++fhMV6tPatXX3S44doRbZop3IX2QSaQIJwlU41kUoIJXuXOkgYgdSJxsLsCKBBX+
+THyz9Fnfr6ZAV83YDxZxoA7aomli+iJ99W2b92URao7uUa5f8ct/XTs7vh9aQydR
+M2RfRvplSRNCXY7vVJ6Uh68S14FawXJPeKtDU15MifnVd/DUkkZSFgLIVNJ65vIX
+dhy+KhgR38XpE7L4CSk541sF2AxzTl0RKEVTSXnpKSAaOeChgq01RPdTm4kCAwEA
+AQKCAgBn2kytdsodj/XGbeQOnaMB768U1K1VY25dhUAHxk91cSsPI1JtpknniY/N
+s1a16Koy5ss4aowEL3lSfe2+iSw2q0xQjLm+JDj7eOtS37Sx79rJ7fBCGbv0H4hF
+z2g/PPKR7scPcHqxrHiV9hBud0SZ3qjfczxMgSHvj9RFixxcAogZIiqcGM+FPlcz
+6+xdxhMUbEF1R1kEdOcdQhznCY57lKJSHLPcfZpgzZ1dOIKghZzkVwz9EeqtGgFd
+qVrBAdS7RWYvDmozBbau2/dGbjLaaPO8oO6DVhYZXPh9oJnOkZcKCRpRNyhtcE37
+dm+nltukGppsOwlufYIMHPQb6aW6RzqNu7aVt07b/XoZUKliq/8G17ntZRc4jqtE
+Kb8K1CaopTzeM56HifqdnO44IxfL8ouhTZtOnmetXbYzchFSQ9/CnOevhOESv3N7
+KPr+8m0eWfleIfaKItcsh4ZBAvsbWJPZ/K9INXQre+l4Z/0zICi1bWN52eoUiWau
+CTUC5vdwGQsRgc7JYhU9CZuHK99BGLJF88PNneMiWyOzKg38lcl3iIzcpgeSUhRE
+YCeewbFvlcmZ4neCZiHYQSpXYAZ+MfCfjM3DFWDGtXHWiT+pECPv7KYXvZ67cd7h
+lNSgvzCRRpjZUIjSY2eGzsFkBvvCPcvaOorQbG3h1BLIPTDm4QKCAQEA1N3v1fTj
+oFJTYU6nVmftKiPw58d4/whfLMM10QtNAZDas+L+6OW5dloLM6tOz+dBeKvBXb24
+i8L96MWgK45LsQl0HtUyCLyIC9B+VzSvAyTy4Dle1XY8IiIe0ydDHzxkw8ADaSTI
++Ovz+en4aDwbAUKvyLhTpZ18ybQCN+tvc0sAEH7cKd5M2/HL2AakTVN2gOcfXye2
+2/yLoZUnOfzmcS/6s+FdLSbCa7mFwjgh89OZDGjdZQuXx+WgDaz+3nywuO6Qms1T
+xDdaZVB/0ka3QsZ/1CEQz4VDxmHycsFBL+yK9kQh8pTEm32MSuQ3F+2ls6sNtwob
+SlDhXsPdMhwpwwKCAQEAw0xLNxz9EMM3Tgseb2ehD00lXRr0yti0MsEk8QYY4bkU
+bbgomNyOx4XkstKuouPgFA3cJjm0gj2Lg60G0NBsFOnT21rRocQlnvgXXsoHJDXc
+bt9g6bMUNaZ2dz6PUqPdmhNENgVqtXpXzeOjXKl8YbqdahkFgxDn7gTueFSKXQdf
+KGDXQ4lJxVntQnLqEzJ79M6ucSU/F95jlZ+nh8MHWUy/qt74pbncA6kiO5zuGV9a
+YnjGaP/wPJVXhC9lp0Lb9gybILKIIaUb/QCJRTxcVChO+XkUs6aw9KKp6xXnZwmi
+HpISqSyAYf7uWj/JZkbAAilv9Jascd9fkm8VF5hEwwKCAQBTXhRnREC98mArdQV+
+hrdQ0MCx1eKiZ2H3AwEZvQZMvbGZ0CYrioUHQB6w/r+gFx8CJqpVj08ulZCh0Hx5
+coJcdKpgxPiSiVvy3JYOi1ibr6XbgTyN9393kstlwTO9kQaZz6LGVBzNuINV9ndO
+Q3QEG10DDIXeD/7mdDSGOBPvIImG7FhHoYOShHFkSr2gdzarJ1mXB9PK9m6tOuAh
+CtYpsDPMrU+ztkFgtUkYlqldeBqxzIQg5dhs9panpIAxHL6NvwktR4suBsvFcDCP
+Zxiw81Lu/oA59iRkFspAfUWNgmOuLWLqQa96gkImtpiJK47A/hYiALhNc73AQo9n
+57XHAoIBABFpdO9F+14KOZ0Qqrb+A0MM+r7RT2/iYDaCN9vxUjiVureJir0ONQCe
+9GPpGr7VGD5RegZCcNCH0i98NrZZTrmSm1vcPgJxLXV94v+FfZuB3dRYwBg16iBa
+Zgd9oWOZzoEVJKi4VOo3LSrjF8aEKd3AuJYkAvTLhhIXiHdb+jYPGTHNaIPR8qzQ
+trGM80eg4aJS5wSZcIWdQz2szU/yWG5ixFfkp0CHUJFW/AFanXPPp4xN/kqQPwf3
+vKTBYQvHjzrhptcEc9SkFtm4uYRdvFGYgmoFnI3j17UH56RZAJeUKUsWdOl2WT/j
+bbbIJxmiRy4qKZwh7t/8LVYt5zCCV+cCggEAVx2rWowQ3z2L//qLJmwQRtjz2vP8
+v8CA+FBwfDJ4RiDAMoq13UHVOhKZEd1HlRAwyVo5e6vGIP/3f/f2eKvG1XPXOMs1
+DTrFeyONcXEBki8cN2vneGt06+eYOoVKezm0Pyy+ShOUGo4sJHMHfdRQgIwmo3lt
+cgPCJi4QHL9C5t1In858e0SqMU5E0LRYh5OC3u6m4paYQzstIgAiCzX0yyvcQOrI
+B8OIOamAEm7HM4mCwBz+4MtGgUk0dtCaNyqOdMnwsMMBK808UCOzGSL5zQLNtzbN
+LoxlR8i22Fsn3qYX/zvvJWk9T5WB0qIFCM8n59Ga552uDHP02/R9u9luhw==
+-----END RSA PRIVATE KEY-----
diff --git a/vagrant/puppet_master/public_keys/pergamon.softwareheritage.org.pem b/vagrant/puppet_master/public_keys/pergamon.softwareheritage.org.pem
new file mode 100644
index 0000000..df40911
--- /dev/null
+++ b/vagrant/puppet_master/public_keys/pergamon.softwareheritage.org.pem
@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAomR+HgYa/+o6Fv0VVRVE
+ELpf5jj9LbFZ9wfzLewbiJRa47KbyQg0254F6HdzhdXhMDwwd/K8abb7Ra0HpmzW
+al/j1CzSkt+lgGDK9OCgYfOqjBktsDd/eU1tiZmRjvWzX7u+HruaYBxnaWRbgGnb
+2O2xUSPKo3v1jBrNET7NXwjFlKizz1oguijtM3ki5kNwHCRLEJ5oWTam7wCygh2+
+QpJ7eO7il0rzbqDyoOWpRa6TiICFbLdi2LFeNVPaiRei8deloNcoOV27bCcg/371
+DuDDr8sZYvpwMGT3BlvpB1mzQaAnpKH+wfJjRDFStxXcsHAu85KtIq/qKuWQ1ssw
+EFUzmBP8b1zSOhXbNOgtyUkKMjY62wsLIiqFyfR3dF8FszLXCLmwRUOa46533TS8
+RTwlMGi6eBvFe6DBIqm4gg3kEzt7+fhMV6tPatXX3S44doRbZop3IX2QSaQIJwlU
+41kUoIJXuXOkgYgdSJxsLsCKBBX+THyz9Fnfr6ZAV83YDxZxoA7aomli+iJ99W2b
+92URao7uUa5f8ct/XTs7vh9aQydRM2RfRvplSRNCXY7vVJ6Uh68S14FawXJPeKtD
+U15MifnVd/DUkkZSFgLIVNJ65vIXdhy+KhgR38XpE7L4CSk541sF2AxzTl0RKEVT
+SXnpKSAaOeChgq01RPdTm4kCAwEAAQ==
+-----END PUBLIC KEY-----