One question: Is the "base" relation configured via manifests/*server.pp enough?
mhennig@kali:~/AdBlockPlus/infrastructure$ grep base manifests/*
manifests/codereviewserver.pp: include base
manifests/downloadserver.pp: include base, statsclient
manifests/filtermasterserver.pp: include base, filtermaster
manifests/filterserver.pp: include base, statsclient
manifests/intraforumserver.pp: include base, statsclient
manifests/issuesserver.pp: include base
manifests/monitoringserver.pp: include base, ssh, puppetmaster
manifests/statsserver.pp: include base
manifests/updateserver.pp: include base, statsclient
manifests/webserver.pp: include base, statsclient
Especially when using concat::fragment for sshd_config (which is set up in modules/ssh and then included in modules/base), wouldn't it be more clean if we include base or include ssh explicitly?
(See also the review link.)