Move encapic config to /etc/encapi (#569)

encapic 0.4.0 reads /etc/encapi/encapic.conf ahead of the legacy RPM-owned /etc/encapic/encapic.conf, so puppet-managed config no longer collides with the packaged %config(noreplace) file.

- default profiles::puppet::encapic config_dir to /etc/encapi
- bump the encapic pin on puppet masters to 0.4.0

Reviewed-on: #569
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

hieradata/roles/infra/puppet/master.yaml

@@ -31,7 +31,7 @@ profiles::puppet::enc::repo: https://git.service.au-syd1.consul/unkinben/puppet-
 # Deep-merged with the entries in roles/infra/puppet.yaml.
 profiles::packages::include:
   encapic:
-    ensure: '0.2.0'
+    ensure: '0.4.0'
   certmanager:
     ensure: '0.2.0'
   sshsignhost:

site/profiles/manifests/puppet/encapic.pp

@@ -5,14 +5,14 @@
 # config so the encapi endpoint can change without repackaging.
 class profiles::puppet::encapic (
   Stdlib::HTTPUrl       $encapi_url,
-  Stdlib::AbsolutePath  $config_dir = '/etc/encapic',
+  Stdlib::AbsolutePath  $config_dir = '/etc/encapi',
   String                $config_name = 'encapic.conf',
   String                $owner = 'root',
   String                $group = 'root',
 ) {
 
-  # The RPM ships this file as %config(noreplace), so puppet must write it only
-  # once the package is present or the install overwrites it.
+  # encapic >= 0.4.0 reads this path ahead of the RPM-owned /etc/encapic one;
+  # order after the package so the shim exists before the config does.
   file { $config_dir:
     ensure  => directory,
     mode    => '0755',