The 'Templates' feature was added to the foreman proxy so that clients could retrieve templates from their Capsule instead of the Satellite.  It was done by the Foreman team as part of their side of the capsule isolation feature. It works like this:

+-----------+
| Client    |
+-----+-----+
      |
      |  8000/http
+-----v-----+
| Capsule   |
+-----+-----+
      |
      |   443/https
+-----v-----+
| Satellite |
+-----------+

In all of our provisioning templates, we use a macro called foreman_url that is replaced with the appropriate URL. The Capsule URL is used for a host ONLY used when 3 conditions are true:

   1. The capsule supports TFTP
   2. The capsule's TFTP Feature is associated to the host's subnet
   3. The capsule also has the templates feature

This is very confusing for a number of edge cases. Generally, proxies relevant to a host are assigned directly - but individually.  The puppet CA, puppet master, openscap proxies, etc are all assigned each.  The magic was added to avoid having an explicit Templates association but I think we need it anyway.

No one intuitively understands this feature, and because it affects a number of features like boot disk, discovery, normal provisioning, etc.

Neither Boot disk ISO's nor finish templates use TFTP, why does this feature need to be enabled for them to work correctly with the template URL? Additionally, numerous users enable the feature on the Satellite and end up uselessly proxying their templates through the foreman-proxy service as well.