Do not reveal sensitive Data

To not reveal sensitive Data like f.e. the LDAP-Password,

• either wrap the rendered Template in manifests/vhost.pp, like

      concat::fragment { "${name}-directories":
        target  => "${priority_real}${filename}.conf",
        order   => 60,
        content => Sensitive(template('apache/vhost/_directories.erb')),
      }
  

  concat is able do handle Sensitive since 7.4.0.
• or use EPP instead of ERB, as EPP does handle sensitive Data natively

Start with manifests/vhost.pp and the rendered apache/vhost/_directories.erb template, then compare the two proposed approaches: Sensitive wrapping via concat 7.4.0 or EPP. Done means the generated Apache configuration does not reveal sensitive values such as an LDAP password.