take two on local repo exclusion

manifests/os/debian.pp

@@ -56,9 +56,10 @@ class base::os::debian (
     before => Stage['main'],
   }
   class { 'base::os::debian::apt':
-    stage               => 'aptitude',
-    apt_cache_notin_tmp => $apt_cache_notin_tmp,
-    apt_cache_tmp_dir   => $apt_cache_tmp_dir,
+    stage                      => 'aptitude',
+    apt_cache_notin_tmp        => $apt_cache_notin_tmp,
+    apt_cache_tmp_dir          => $apt_cache_tmp_dir,
+    debian_stanford_repo_local => $debian_stanford_repo_local,
   }
 
   # Define an aptitude update exec that will only get run if it receives a
@@ -181,9 +182,15 @@ class base::os::debian (
 # class that wants to run 'aptitude update' will have to declare the
 # 'aptitude update' exec resource itself.
 
+# $debian_stanford_repo_local: Include the Stanford private local (debian-local)
+# repository. Since this private repository is firewalled off from most of the internet,
+# if your service in the "cloud" you will probably want to set it to false.
+# Default: true
+
 class base::os::debian::apt (
-  $apt_cache_notin_tmp = false,
-  $apt_cache_tmp_dir   = '/var/cache/apt/tmp'
+  $apt_cache_notin_tmp        = false,
+  $apt_cache_tmp_dir          = '/var/cache/apt/tmp'
+  $debian_stanford_repo_local = true,
 ){
 
   # Define aptitude update as a command we can run