since Icinga2 supports the proxy CA, we have four PuppetDBs in different locations (and networks):
Linode
Datacenter 1
Datacenter 2
Office
With VPN, we made it possible, that the Director is able to connect to all PostgreSQL servers to fetch all nodes. So we have four sources and for all of them, we have sync rules. Two of the most important rules are:
Set host.zone, which is a Puppet fact from facts.datacenter
Add host templates for imports, out of the facts.role (which is a stripped hostname, like dc1-rack-mariadb-01. So the facts.role is mariadb)
We have a lot of them, all assigned via the PuppetDB Director module. We have a lot of rules too, to set many host.vars, like block devices, to assign rules for Samsung SSD smarts, or Crucial (Which brings it own check tool) and many many more.