I think I may have this problem. I want to declare http_proxy so that letsencrypt can do its work unmolested by our firewall.
I have a hiera declaration in common.yaml:
letsencrypt::onlycert::environment: [ 'http_proxy=http://example.com:8080', 'https_proxy=https://example.com:8080' ]

This works in my node declarations:
environment => [ 'http_proxy=http://example.com:8080', 'https_proxy=https://example.com:8080' ]
as does
environment => lookup('letsencrypt::onlycert::environment')
but if I remove the environment line entirely, I expect that my hiera common declaration will assert itself, and it doesn't.
Is it conflicting with hiera's %{::environment} as suggested in this ticket?