I just made the change in puppet to block port 80 on our publictest machines. Theoretically, the apps on those servers shouldn't be touching our production db, but we shouldn't underestimate human stupidity. Let us know if stuff breaks. luke