To not reveal sensitive Data

• either wrap the rendered Template in manifests/sentinel.pp, like

  file { $config_file_orig:
    ensure  => file,
    owner   => $service_user,
    group   => $service_group,
    mode    => $config_file_mode,
    content => Sensitive(template($conf_template)),
  }

• or use EPP instead of ERB, as EPP does handle sensitive Data natively