feat: manage puppet clients

- manage the service
- manage the package, version lock it
- deploy the /etc/puppetlabs/puppet/puppet.conf from template for puppet
  clients only

site/profiles/manifests/base.pp

@@ -1,6 +1,7 @@
 # this is the base class, which will be used by all servers
 class profiles::base (
   Array  $ntp_servers,
+  Array  $puppet_servers,
 ) {
   class { 'chrony':
     servers => $ntp_servers,
@@ -24,6 +25,11 @@ class profiles::base (
     ensure   => 'installed',
   }
 
+  # manage puppet clients
+  if ! member($puppet_servers, $trusted['certname']) {
+    include profiles::puppet::client
+  }
+
   # include admin scripts
   include profiles::base::scripts