- move puppetca from vm to lxd - remove old ca host hieradata - ensure this new ca (and all new ca's) can revoke certificates
- enable terraform to clean certificates Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/267