I've found that puppet is a huge exercise in taxonomy and the pain comes from we don't always think about things in a strictly first filter/second filter way (e.g. first filter might be os, second filter might be web server but sometimes we flip them the other way). mapping those buckets onto puppet code is always a treat and everyone organizes things slightly differently. Eventually it does click though.