fix: enable repos before installing packages

site/profiles/manifests/base.pp

@@ -6,20 +6,6 @@ class profiles::base (
   # install the vault ca first
   include profiles::pki::vaultca
 
-  # manage package repositories
-  case $facts['os']['family'] {
-    'RedHat': {
-      include profiles::yum::global
-      include profiles::firewall::firewalld
-    }
-    'Debian': {
-      include profiles::apt::global
-    }
-    default: {
-      fail("Unsupported OS family ${facts['os']['family']}")
-    }
-  }
-
   # manage the puppet agent
   include profiles::puppet::agent
 
@@ -29,6 +15,7 @@ class profiles::base (
   }
 
   # include the base profiles
+  include profiles::base::repos
   include profiles::packages
   include profiles::base::facts
   include profiles::base::motd
@@ -63,4 +50,10 @@ class profiles::base (
 
   # include classes from hiera
   lookup('hiera_classes', Array[String], 'unique').include
+
+  # specifc ordering constraints
+  Class['profiles::pki::vaultca']
+  -> Class['profiles::base::repos']
+  -> Class['profiles::packages']
+
 }

site/profiles/manifests/base/repos.pp

@@ -0,0 +1,16 @@
+# profiles::base::repos
+class profiles::base::repos {
+  # manage package repositories
+  case $facts['os']['family'] {
+    'RedHat': {
+      include profiles::yum::global
+      include profiles::firewall::firewalld
+    }
+    'Debian': {
+      include profiles::apt::global
+    }
+    default: {
+      fail("Unsupported OS family ${facts['os']['family']}")
+    }
+  }
+}