add parameter to exclude Stanford local repo from sources list

manifests/os/debian.pp

@@ -36,11 +36,17 @@
 # regular debian repository, so some users may not want to use this extra
 # source; in that case, they should set this parameter to false.
 # Default: true
+#
+# $debian_stanford_repo_local: Include the Stanford private local (debian-local)
+# repository. Since this private repository is firewalled off from most of the internet,
+# if your service in the "cloud" you will probably want to set it to false.
+# Default: true
 
 class base::os::debian (
-  $apt_cache_notin_tmp       = false,
-  $apt_cache_tmp_dir         = '/var/cache/apt/tmp',
-  $debian_stanford_backports = true
+  $apt_cache_notin_tmp        = false,
+  $apt_cache_tmp_dir          = '/var/cache/apt/tmp',
+  $debian_stanford_backports  = true,
+  $debian_stanford_repo_local = true,
 ){
   include base::newsyslog
 

templates/os/sources/stanford.list.erb

@@ -20,10 +20,12 @@
 # The Stanford-specific Debian archive and source tree (world-accessible).
 deb     http://debian.stanford.edu/debian-stanford <%= dist %> main non-free contrib
 deb-src http://debian.stanford.edu/debian-stanford <%= dist %> main non-free contrib
+<% if (@debian_stanford_repo_local) -%>
 
 # The Stanford restricted Debian archive and source tree.
 deb     http://debian.stanford.edu/debian-local <%= dist %> main non-free contrib
 deb-src http://debian.stanford.edu/debian-local <%= dist %> main non-free contrib
+<% end -%>
 <% if (@debian_stanford_backports) &&
   (@lsbdistcodename == 'wheezy' || @lsbdistcodename == 'jessie' || @operatingsystem == 'Ubuntu') -%>