diff --git a/manifests/config.pp b/manifests/config.pp
index 1f4d770..d407764 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -1,99 +1,105 @@
 # Set up the puppet config
 # @api private
 class puppet::config(
   $allow_any_crl_auth  = $puppet::allow_any_crl_auth,
   $auth_allowed        = $puppet::auth_allowed,
   $auth_template       = $puppet::auth_template,
   $ca_server           = $puppet::ca_server,
   $ca_port             = $puppet::ca_port,
   $dns_alt_names       = $puppet::dns_alt_names,
   $module_repository   = $puppet::module_repository,
   $pluginsource        = $puppet::pluginsource,
   $pluginfactsource    = $puppet::pluginfactsource,
   $puppet_dir          = $puppet::dir,
   $puppetmaster        = $puppet::puppetmaster,
   $syslogfacility      = $puppet::syslogfacility,
   $srv_domain          = $puppet::srv_domain,
   $use_srv_records     = $puppet::use_srv_records,
   $additional_settings = $puppet::additional_settings,
   $client_certname     = $puppet::client_certname,
 ) {
   puppet::config::main{
     'vardir': value => $puppet::vardir;
     'logdir': value => $puppet::logdir;
     'rundir': value => $puppet::rundir;
     'ssldir': value => $puppet::ssldir;
     'privatekeydir': value => '$ssldir/private_keys { group = service }';
     'hostprivkey': value => '$privatekeydir/$certname.pem { mode = 640 }';
     'show_diff': value  => $puppet::show_diff;
     'codedir': value => $puppet::codedir;
   }
 
   if $module_repository and !empty($module_repository) {
     puppet::config::main{'module_repository': value => $module_repository; }
   }
   if $ca_server and !empty($ca_server) {
     puppet::config::main{'ca_server': value => $ca_server; }
   }
   if $ca_port {
     puppet::config::main{'ca_port': value => $ca_port; }
   }
   if $dns_alt_names and !empty($dns_alt_names) {
     puppet::config::main{'dns_alt_names': value => $dns_alt_names; }
   }
   if $use_srv_records {
     unless $srv_domain {
       fail('$::domain fact found to be undefined and $srv_domain is undefined')
     }
     puppet::config::main{
       'use_srv_records': value => true;
       'srv_domain': value => $srv_domain;
     }
   } else {
     puppet::config::main {
       'server': value => pick($puppetmaster, $facts['networking']['fqdn']);
     }
   }
   if $pluginsource {
     puppet::config::main{'pluginsource': value => $pluginsource; }
   }
   if $pluginfactsource {
     puppet::config::main{'pluginfactsource': value => $pluginfactsource; }
   }
   if $syslogfacility and !empty($syslogfacility) {
     puppet::config::main{'syslogfacility': value => $syslogfacility; }
   }
   if $client_certname {
     puppet::config::main {
       'certname': value => $client_certname;
     }
   }
 
   $additional_settings.each |$key,$value| {
     puppet::config::main { $key: value => $value }
   }
 
+  concat::fragment { 'puppet.conf_comment':
+    target  => "${puppet_dir}/puppet.conf",
+    content => '# file managed by puppet',
+    order   => '0_comment',
+  }
+
   file { $puppet_dir:
     ensure => directory,
     owner  => $puppet::dir_owner,
     group  => $puppet::dir_group,
   }
   -> case $facts['os']['family'] {
     'Windows': {
       concat { "${puppet_dir}/puppet.conf":
         mode  => '0674',
       }
     }
 
     default: {
       concat { "${puppet_dir}/puppet.conf":
         owner => 'root',
         group => $puppet::params::root_group,
         mode  => '0644',
       }
     }
   }
   ~> file { "${puppet_dir}/auth.conf":
     content => template($auth_template),
   }
 }
diff --git a/manifests/config/entry.pp b/manifests/config/entry.pp
index 1ac7f75..cf30f47 100644
--- a/manifests/config/entry.pp
+++ b/manifests/config/entry.pp
@@ -1,52 +1,57 @@
 # Set a config entry
 #
 # @param key
 #   The key of the config entry
 # @param value
 #   The value for the config entry
 # @param section
 #   The section for the config entry
 # @param sectionorder
 #   How to order the section. This is only used on the first definition of the
 #   section via ensure_resource.
 # @param joiner
 #   How to join an array value into a string
 define puppet::config::entry (
   String $key,
   Variant[Array[String], Boolean, String, Integer] $value,
   String $section,
   Variant[Integer[0], String] $sectionorder = 5,
   String $joiner       = ',',
 ) {
   if ($value =~ Array) {
     $_value = join(flatten($value), $joiner)
   } elsif ($value =~ Boolean) {
     $_value = bool2str($value)
   } else {
     $_value = $value
   }
 
   # note the spaces at he end of the 'order' parameters,
   # they make sure that '1_main ' is ordered before '1_main_*'
   ensure_resource('concat::fragment', "puppet.conf_${section}", {
       target  => "${puppet::dir}/puppet.conf",
-      content => "\n\n[${section}]",
+      content => "\n[${section}]",
       order   => "${sectionorder}_${section} ",
   })
+  ensure_resource('concat::fragment', "puppet.conf_${section}_end", {
+      target  => "${puppet::dir}/puppet.conf",
+      content => "\n",
+      order   => "${sectionorder}_${section}~end",
+  })
 
   # this adds the '$key =' for the first value,
   # otherwise it just appends it with the joiner to separate it from the previous value.
   if (!defined(Concat::Fragment["puppet.conf_${section}_${key}"])){
     concat::fragment{"puppet.conf_${section}_${key}":
       target  => "${puppet::dir}/puppet.conf",
       content => "\n    ${key} = ${_value}",
       order   => "${sectionorder}_${section}_${key} ",
     }
   } else {
     concat::fragment{"puppet.conf_${section}_${key}_${name}":
       target  => "${puppet::dir}/puppet.conf",
       content => "${joiner}${_value}",
       order   => "${sectionorder}_${section}_${key}_${name} ",
     }
   }
 }
diff --git a/spec/defines/puppet_config_entry_spec.rb b/spec/defines/puppet_config_entry_spec.rb
index 73f2157..43886aa 100644
--- a/spec/defines/puppet_config_entry_spec.rb
+++ b/spec/defines/puppet_config_entry_spec.rb
@@ -1,77 +1,89 @@
 require 'spec_helper'
 
 describe 'puppet::config::entry' do
   on_supported_os.each do |os, facts|
     context "on #{os}" do
       let(:facts) { facts }
 
       let(:title) { 'foo' }
 
       context 'with a plain value' do
         let :pre_condition do
           "class {'puppet': }"
         end
         let :params do
           {
             :key          => 'foo',
             :value        => 'bar',
             :section      => 'main',
             :sectionorder => 1,
           }
         end
         it 'should contain the section header' do
-          should contain_concat__fragment('puppet.conf_main').with_content("\n\n[main]")
+          should contain_concat__fragment('puppet.conf_main').with_content("\n[main]")
           should contain_concat__fragment('puppet.conf_main').with_order("1_main ")
         end
+        it 'should contain the section end' do
+          should contain_concat__fragment('puppet.conf_main_end').with_content("\n")
+          should contain_concat__fragment('puppet.conf_main_end').with_order("1_main~end")
+        end
         it 'should contain the keyvalue pair' do
           should contain_concat__fragment('puppet.conf_main_foo').with_content(/^\s+foo = bar$/)
           should contain_concat__fragment('puppet.conf_main_foo').with_order("1_main_foo ")
         end
       end
       context 'with an array value' do
         let :pre_condition do
           "class {'puppet': }"
         end
         let :params do
           {
             :key          => 'foo',
             :value        => ['bar','baz'],
             :section      => 'main',
             :sectionorder => 1,
           }
         end
         it 'should contain the section header' do
-          should contain_concat__fragment('puppet.conf_main').with_content("\n\n[main]")
+          should contain_concat__fragment('puppet.conf_main').with_content("\n[main]")
           should contain_concat__fragment('puppet.conf_main').with_order("1_main ")
         end
+        it 'should contain the section end' do
+          should contain_concat__fragment('puppet.conf_main_end').with_content("\n")
+          should contain_concat__fragment('puppet.conf_main_end').with_order("1_main~end")
+        end
         it 'should contain the keyvalue pair' do
           should contain_concat__fragment('puppet.conf_main_foo').with_content(/^\s+foo = bar,baz$/)
           should contain_concat__fragment('puppet.conf_main_foo').with_order("1_main_foo ")
         end
       end
       context 'with a custom joiner' do
         let :pre_condition do
           "class {'puppet': }"
         end
         let :params do
           {
             :key          => 'foo',
             :value        => ['bar','baz'],
             :joiner       => ':',
             :section      => 'main',
             :sectionorder => 1,
           }
         end
         it 'should contain the section header' do
-          should contain_concat__fragment('puppet.conf_main').with_content("\n\n[main]")
+          should contain_concat__fragment('puppet.conf_main').with_content("\n[main]")
           should contain_concat__fragment('puppet.conf_main').with_order("1_main ")
         end
+        it 'should contain the section end' do
+          should contain_concat__fragment('puppet.conf_main_end').with_content("\n")
+          should contain_concat__fragment('puppet.conf_main_end').with_order("1_main~end")
+        end
         it 'should contain the keyvalue pair' do
           should contain_concat__fragment('puppet.conf_main_foo').with_content(/^\s+foo = bar:baz$/)
           should contain_concat__fragment('puppet.conf_main_foo').with_order("1_main_foo ")
         end
       end
 
     end
   end
 end