$server_git_repo = true with default $server_git_repo_path fails on 'Permission denied'

Enabling the $server_git_repo for the default path throws this error under CentOS 7 with agent v5.5:

Notice: /Stage[main]/Puppet::Server::Config/Git::Repo[puppet_repo]/Exec[git_repo_for_puppet_repo]/returns: fatal: cannot mkdir /opt/puppetlabs/puppet/cache/puppet.git: Permission denied
Error: '/usr/bin/git init  --bare /opt/puppetlabs/puppet/cache/puppet.git' returned 128 instead of one of [0]
Error: /Stage[main]/Puppet::Server::Config/Git::Repo[puppet_repo]/Exec[git_repo_for_puppet_repo]/returns: change from 'notrun' to ['0'] failed: '/usr/bin/git init  --bare /opt/puppetlabs/puppet/cache/puppet.git' returned 128 instead of one of [0] (corrective)

Appears to be due to $vardir being set to explicit root ownership, yet the git repo resource owned by $user:$group by default, i.e by puppet:puppet:
https://github.com/theforeman/puppet-puppet/blob/master/manifests/server/config.pp#L241

One could set $server_git_repo_user and $server_git_repo_group explicitly to root, but that seems suboptimal.

Start in manifests/server/config.pp at the Git::Repo resource referenced by the issue, and compare the default server_git_repo_user and server_git_repo_group with the ownership of the default $vardir. Reproduce the default server_git_repo configuration on CentOS 7 with agent v5.5; done means the bare repository initializes at the default path without the reported permission error.