The Stretch nginx package has a post-install script that starts the service. This happens before Puppet has had a chance to modify the configuration files which in turn means that if the default port (80) is in use the package install will fail. MediaWiki-Vagrant runs Apache2 on port 8080 by default, but it turns out that a service apache2 restart after changing the port does not actually release the default bind of port 80. A hard restart via service apache2 stop && service apache2 start does release the port.