diff --git a/global/overlay/etc/puppet/cosmos-modules.conf b/global/overlay/etc/puppet/cosmos-modules.conf
deleted file mode 100644
index 991a570..0000000
--- a/global/overlay/etc/puppet/cosmos-modules.conf
+++ /dev/null
@@ -1,36 +0,0 @@
-#
-# name source (puppetlabs fq name or git url) upgrade (yes/no) tag-pattern
-#
-# NOTE that Git packages MUST be tagged with signatures by someone
-# in the Cosmos trust list. That is why all the URLs point to forked
-# versions in the SUNET github organization.
-#
-concat          https://github.com/SUNET/puppetlabs-concat.git yes sunet-*
-stdlib          https://github.com/SUNET/puppetlabs-stdlib.git yes sunet-*
-cosmos          https://github.com/SUNET/puppet-cosmos.git yes sunet-*
-ufw             https://github.com/SUNET/puppet-module-ufw.git yes sunet_dev-*
-apt             https://github.com/SUNET/puppetlabs-apt.git yes sunet_dev-*
-vcsrepo         https://github.com/SUNET/puppetlabs-vcsrepo.git yes sunet-*
-xinetd          https://github.com/SUNET/puppetlabs-xinetd.git yes sunet-*
-hiera-gpg       https://github.com/SUNET/hiera-gpg.git yes sunet-*
-#
-# Alternate sources you might or might not want to use:
-#concat          puppetlabs/concat no
-#stdlib          puppetlabs/stdlib no
-#ufw             attachmentgenie/ufw no
-#apt             puppetlabs/apt no
-#vcsrepo         puppetlabs/vcsrepo no
-#xinetd          puppetlabs/xinetd no
-#cosmos          https://github.com/SUNET/puppet-cosmos.git yes
-#python          https://github.com/SUNET/puppet-python.git yes sunet-*
-#erlang          https://github.com/SUNET/garethr-erlang.git yes sunet-*
-#rabbitmq        https://github.com/SUNET/puppetlabs-rabbitmq.git yes sunet_dev-*
-#pound           https://github.com/SUNET/puppet-pound.git yes sunet_dev-*
-#augeas          https://github.com/SUNET/puppet-augeas.git yes sunet-*
-#bastion         https://github.com/SUNET/puppet-bastion.git yes sunet-*
-#postgresql      https://github.com/SUNET/puppetlabs-postgresql.git yes sunet_dev-*
-#munin           https://github.com/SUNET/ssm-munin.git yes sunet-*
-#nagios          https://github.com/SUNET/puppet-nagios.git yes sunet-*
-#staging         https://github.com/SUNET/puppet-staging.git yes sunet-*
-#apparmor        https://github.com/SUNET/puppet-apparmor.git yes sunet-*
-#docker          https://github.com/SUNET/garethr-docker.git yes sunet_dev-*
diff --git a/global/overlay/etc/puppet/manifests/cosmos-site.pp b/global/overlay/etc/puppet/manifests/cosmos-site.pp
index c276f84..1549a00 100644
--- a/global/overlay/etc/puppet/manifests/cosmos-site.pp
+++ b/global/overlay/etc/puppet/manifests/cosmos-site.pp
@@ -11,13 +11,13 @@ Exec {
 #include cosmos::ntp
 #include cosmos::rngtools
 #include cosmos::preseed
-include ufw
-include apt
-include cosmos
+#include ufw
+#include apt
+#include cosmos
 
 # you need a default node
 
-node default { 
+node default {
 
 }
 
@@ -33,8 +33,8 @@ node default {
 
 #class nameserver {
 #   package {'bind9':
-#      ensure => latest 
-#   } 
+#      ensure => latest
+#   }
 #   service {'bind9':
 #      ensure => running
 #   }
@@ -49,4 +49,3 @@ node default {
 #      proto => "tcp"
 #   }
 #}
-
diff --git a/global/post-tasks.d/010cosmos-modules b/global/post-tasks.d/010cosmos-modules
new file mode 100755
index 0000000..f099a86
--- /dev/null
+++ b/global/post-tasks.d/010cosmos-modules
@@ -0,0 +1,38 @@
+#!/bin/sh
+#
+# Dynamically configure /etc/puppet/cosmos-modules.conf
+#
+# The content of that file is chosen according to:
+#
+#   1. If the file is actually present in the model, use that.
+#   2. If there is a script called /etc/puppet/setup_cosmos_models, run that.
+#   3. If the file still doesn't exist, create it with the defaults in this script.
+#
+
+set -e
+
+if [ -f "${COSMOS_MODEL}/overlay/etc/puppet/cosmos-modules.conf" ]; then
+    test "$COSMOS_VERBOSE" = "y" && \
+        echo "$0: /etc/puppet/cosmos-modules.conf is present in the model, exiting"
+    exit 0
+fi
+
+if [ -x /etc/puppet/setup_cosmos_models ]; then
+    test "$COSMOS_VERBOSE" = "y" && \
+        echo "$0: Updating /etc/puppet/cosmos-modules.conf with /etc/puppet/setup_cosmos_models"
+    /etc/puppet/setup_cosmos_models
+
+    test -f /etc/puppet/cosmos-modules.conf && exit 0
+fi
+
+test "$COSMOS_VERBOSE" = "y" && \
+    echo "$0: Creating/updating /etc/puppet/cosmos-modules.conf with defaults from this script"
+
+cat > /etc/puppet/cosmos-modules.conf << EOF
+# File created/updated by $0
+#
+concat          puppetlabs/concat     yes
+stdlib          puppetlabs/stdlib     yes
+#ufw             attachmentgenie/ufw   yes
+#apt             puppetlabs/apt        yes
+EOF