diff --git a/Batali b/Batali
index 9520bb3..8d351ad 100644
--- a/Batali
+++ b/Batali
@@ -17,7 +17,7 @@ Batali.define do
   cookbook 'poise-ruby-build',      '~> 1.1.0'
   cookbook 'application',           '~> 5.2.0'
   cookbook 'application_javascript'
-  cookbook 'application_ruby'
+  cookbook 'application_ruby',      '~> 4.1.0'
   cookbook 'application_git',       '~> 1.1.0' # 1.2.0 doesn't work with knife-solo
   cookbook 'users',                 '~> 5.0.0'
   cookbook 'sudo',                  '~> 3.4.0'
diff --git a/batali.manifest b/batali.manifest
index 613c42e..06a7dd9 100644
--- a/batali.manifest
+++ b/batali.manifest
@@ -813,10 +813,6 @@
     {
       "name": "application_ruby",
       "dependencies": [
-        [
-          "poise-service",
-          "~> 1.0"
-        ],
         [
           "poise",
           "~> 2.0"
@@ -828,13 +824,17 @@
         [
           "poise-ruby",
           "~> 2.1"
+        ],
+        [
+          "poise-service",
+          "~> 1.0"
         ]
       ],
-      "version": "4.0.1",
+      "version": "4.1.0",
       "source": {
         "type": "Batali::Source::Site",
-        "url": "https://supermarket.chef.io:443/api/v1/cookbooks/application_ruby/versions/4.0.1/download",
-        "version": "4.0.1"
+        "url": "https://supermarket.chef.io:443/api/v1/cookbooks/application_ruby/versions/4.1.0/download",
+        "version": "4.1.0"
       }
     },
     {
diff --git a/cookbooks/application_ruby/CHANGELOG.md b/cookbooks/application_ruby/CHANGELOG.md
index 5200030..e8818bd 100644
--- a/cookbooks/application_ruby/CHANGELOG.md
+++ b/cookbooks/application_ruby/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Application_Ruby Changelog
 
+## v4.1.0
+
+* Add an `application_puma` resource to run a Puma application server.
+* Add support for `:initializer` style secrets for the `application_rails` resource.
+* Chef 13 support.
+
 ## v4.0.1
 
 * Correct `gem_binary` results for `application_ruby`.
diff --git a/cookbooks/application_ruby/README.md b/cookbooks/application_ruby/README.md
index 98ea3e3..288f5e2 100644
--- a/cookbooks/application_ruby/README.md
+++ b/cookbooks/application_ruby/README.md
@@ -33,7 +33,7 @@ end
 
 ## Requirements
 
-Chef 12 or newer is required.
+Chef 12.1 or newer is required.
 
 ## Resources
 
@@ -53,6 +53,34 @@ end
 
 All actions and properties are the same as the [`bundle_install` resource](https://github.com/poise/poise-ruby#bundle_install).
 
+### `application_puma`
+
+The `application_puma` resource creates a service for `puma`.
+
+```ruby
+application '/srv/myapp' do
+  puma do
+    port 8000
+  end
+end
+```
+
+#### Actions
+
+* `:enable` – Create, enable and start the service. *(default)*
+* `:disable` – Stop, disable, and destroy the service.
+* `:start` – Start the service.
+* `:stop` – Stop the service.
+* `:restart` – Stop and then start the service.
+* `:reload` – Send the configured reload signal to the service.
+
+#### Properties
+
+* `path` – Base path for the application. *(name attribute)*
+* `port` – Port to listen on. *(default: 80)*
+* `service_name` – Name of the service to create. *(default: auto-detect)*
+* `user` – User to run the service as. *(default: application owner)*
+
 ### `application_rackup`
 
 The `application_rackup` resource creates a service for `rackup`.
@@ -102,6 +130,8 @@ end
 #### Properties
 
 * `path` – Base path for the application. *(name attribute)*
+* `app_module` – Top-level application module. Only needed for the :initializer
+  style of secret token configuration. *(default: auto-detect)*
 * `database` – Database settings for Rails. See [the database section
   below](#database-parameters) for more information. *(option collector)*
 * `migrate` – Run database migrations. *(default: false)*
@@ -218,7 +248,7 @@ end
 * `config_path` – Path to a Thin configuration file.
 * `port` – Port to listen on. *(default: 80)*
 * `service_name` – Name of the service to create. *(default: auto-detect)*
-# `user` – User to run the service as. *(default: application owner)*
+* `user` – User to run the service as. *(default: application owner)*
 
 ### `application_unicorn`
 
@@ -246,7 +276,7 @@ end
 * `path` – Base path for the application. *(name attribute)*
 * `port` – Port to listen on. *(default: 80)*
 * `service_name` – Name of the service to create. *(default: auto-detect)*
-# `user` – User to run the service as. *(default: application owner)*
+* `user` – User to run the service as. *(default: application owner)*
 
 ## Sponsors
 
@@ -256,7 +286,7 @@ The Poise test server infrastructure is sponsored by [Rackspace](https://rackspa
 
 ## License
 
-Copyright 2015, Noah Kantrowitz
+Copyright 2015-2017, Noah Kantrowitz
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby.rb
index 7d480bf..a8da458 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/app_mixin.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/app_mixin.rb
index d377f7a..2f0bb45 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/app_mixin.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/app_mixin.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/cheftie.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/cheftie.rb
index ca8eb03..4f3781e 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/cheftie.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/cheftie.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/error.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/error.rb
index ae21fa0..ab04a50 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/error.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/error.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources.rb
index 4b58b49..5343ccb 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,6 +15,7 @@
 #
 
 require 'poise_application_ruby/resources/bundle_install'
+require 'poise_application_ruby/resources/puma'
 require 'poise_application_ruby/resources/rackup'
 require 'poise_application_ruby/resources/rails'
 require 'poise_application_ruby/resources/ruby'
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/bundle_install.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/bundle_install.rb
index d6ccd82..ce40017 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/bundle_install.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/bundle_install.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/puma.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/puma.rb
new file mode 100644
index 0000000..3f574c3
--- /dev/null
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/puma.rb
@@ -0,0 +1,86 @@
+#
+# Copyright 2015-2017, Noah Kantrowitz
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require 'chef/provider'
+require 'chef/resource'
+
+require 'poise_application_ruby/service_mixin'
+
+module PoiseApplicationRuby
+  module Resources
+    # (see Puma::Resource)
+    # @since 4.1.0
+    module Puma
+      # An `application_puma` resource to manage a puma web application
+      # server.
+      #
+      # @since 4.1.0
+      # @provides application_puma
+      # @action enable
+      # @action disable
+      # @action start
+      # @action stop
+      # @action restart
+      # @action reload
+      # @example
+      #   application '/srv/myapp' do
+      #     git '...'
+      #     bundle_install
+      #     puma do
+      #       port 8080
+      #     end
+      #   end
+      class Resource < Chef::Resource
+        include PoiseApplicationRuby::ServiceMixin
+        provides(:application_puma)
+
+        # @!attribute port
+        #   Port to bind to.
+        attribute(:port, kind_of: [String, Integer], default: 80)
+      end
+
+      # Provider for `application_puma`.
+      #
+      # @since 4.1.0
+      # @see Resource
+      # @provides application_puma
+      class Provider < Chef::Provider
+        include PoiseApplicationRuby::ServiceMixin
+        provides(:application_puma)
+
+        private
+
+        # Find the path to the config.ru. If the resource path was to a
+        # directory, apparent /config.ru.
+        #
+        # @return [String]
+        def configru_path
+          @configru_path ||= if ::File.directory?(new_resource.path)
+            ::File.join(new_resource.path, 'config.ru')
+          else
+            new_resource.path
+          end
+        end
+
+        # Set service resource options.
+        def service_options(resource)
+          super
+          resource.ruby_command("puma --port #{new_resource.port} #{configru_path}")
+        end
+      end
+    end
+  end
+end
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/rackup.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/rackup.rb
index 8b29730..869ea6b 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/rackup.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/rackup.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/rails.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/rails.rb
index 3ac56f9..6a06532 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/rails.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/rails.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ require 'chef/provider'
 require 'chef/resource'
 
 require 'poise_application_ruby/app_mixin'
+require 'poise_application_ruby/error'
 
 
 module PoiseApplicationRuby
@@ -47,6 +48,11 @@ module PoiseApplicationRuby
         provides(:application_rails)
         actions(:deploy)
 
+        # @!attribute app_module
+        #   Top-level application module. Only needed for the :initializer style
+        #   of secret token configuration, and generally auto-detected.
+        #   @return [String, false, nil]
+        attribute(:app_module, kind_of: [String, FalseClass, NilClass], default: lazy { default_app_module })
         # @!attribute database
         #   Option collector attribute for Rails database configuration.
         #   @return [Hash]
@@ -84,14 +90,20 @@ module PoiseApplicationRuby
         #   Secret token for Rails session verification and other purposes. On
         #   Rails 4.2 this will be used for secret_key_base. If not set, no
         #   secrets configuration is written.
-        #   @return [String]
-        attribute(:secret_token, kind_of: [String, FalseClass])
+        #   @return [String, false, nil]
+        attribute(:secret_token, kind_of: [String, FalseClass, NilClass])
         # @!attribute secrets_config
         #   Template content attribute for the contents of secrets.yml. Only
         #   used when secrets_mode is :yaml.
         #   @todo Redo this doc to cover the actual attributes created.
         #   @return [Poise::Helpers::TemplateContent]
         attribute(:secrets_config, template: true, default_source: 'secrets.yml.erb', default_options: lazy { default_secrets_options })
+        # @!attribute secrets_initializer
+        #   Template content attribute for the contents of secret_token.rb. Only
+        #   used when secrets_mode is :initializer.
+        #   @todo Redo this doc to cover the actual attributes created.
+        #   @return [Poise::Helpers::TemplateContent]
+        attribute(:secrets_initializer, template: true, default_source: 'secret_token.rb.erb', default_options: lazy { default_secrets_options })
         # @!attribute secrets_mode
         #   Secrets configuration mode. Set to `:yaml` to generate a Rails 4.2
         #   secrets.yml. Set to `:initializer` to update
@@ -140,21 +152,33 @@ module PoiseApplicationRuby
         #
         # @return [Symbol]
         def default_secrets_mode
-          ::File.exists?(::File.join(path, 'config', 'initializers', 'secret_token.rb')) ? :initialize : :yaml
+          ::File.exists?(::File.join(path, 'config', 'initializers', 'secret_token.rb')) ? :initializer : :yaml
         end
 
-        # Default template variables for the secrets.yml.
+        # Default template variables for the secrets.yml and secret_token.rb.
         #
         # @return [Hash<Symbol, Object>]
         def default_secrets_options
           {
-            config: {
+            yaml_config: {
               rails_env => {
                 'secret_key_base' => secret_token,
               }
             },
+            secret_token: secret_token,
+            app_module: if secrets_mode == :initializer
+              raise Error.new("Unable to extract app module for #{self}, please set app_module property") if !app_module || app_module.empty?
+              app_module
+            end
           }
         end
+
+        # Default application module name.
+        #
+        # @return [String]
+        def default_app_module
+          IO.read(::File.join(path, 'config', 'initializers', 'secret_token.rb'))[/(\w+)::Application\.config\.secret_token/, 1]
+        end
       end
 
       # Provider for `application_rails`.
@@ -205,6 +229,8 @@ module PoiseApplicationRuby
             write_secrets_yml
           when :initializer
             write_secrets_initializer
+          else
+            raise Error.new("Unknown secrets mode #{new_resource.secrets_mode.inspect}")
           end
         end
 
@@ -215,13 +241,19 @@ module PoiseApplicationRuby
             group new_resource.parent.group
             mode '640'
             content new_resource.secrets_config_content
+            sensitive true
           end
         end
 
         # In-place update a config/initializers/secret_token.rb file.
         def write_secrets_initializer
-          # @todo Implement initalizer-style secret support.
-          raise NotImplementedError.new('Sorry, intializer-style secrets loading is not yet supported.')
+          file ::File.join(new_resource.path, 'config', 'initializers', 'secret_token.rb') do
+            user new_resource.parent.owner
+            group new_resource.parent.group
+            mode '640'
+            content new_resource.secrets_initializer_content
+            sensitive true
+          end
         end
 
         # Precompile assets using the rake task.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby.rb
index 2519699..7523e4d 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby_execute.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby_execute.rb
index 8ca2b19..3d145b1 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby_execute.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby_execute.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby_gem.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby_gem.rb
index 6a637e2..e62ae45 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby_gem.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/ruby_gem.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/thin.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/thin.rb
index a106137..1124790 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/thin.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/thin.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/unicorn.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/unicorn.rb
index 3053d3e..0728b51 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/unicorn.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/resources/unicorn.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/service_mixin.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/service_mixin.rb
index 08ff095..c733ba8 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/service_mixin.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/service_mixin.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -39,6 +39,7 @@ module PoiseApplicationRuby
     module Provider
       include PoiseApplication::ServiceMixin::Provider
       include PoiseApplicationRuby::AppMixin::Provider
+      include PoiseRuby::RubyCommandMixin::Provider
       include PoiseRuby::BundlerMixin
 
       # Set up the service for running Ruby stuff.
@@ -48,10 +49,17 @@ module PoiseApplicationRuby
         self_ = self
         # Create a new singleton method that fills in Python for you.
         resource.define_singleton_method(:ruby_command) do |val|
-          path = self_.new_resource.app_state_environment_ruby['PATH']
+          path = self_.new_resource.app_state_environment_ruby['PATH'] || ENV['PATH']
           cmd = if self_.new_resource.parent_bundle
             bundle_exec_command(val, path: path)
           else
+            # Insert the gem executable directory at the front of the path.
+            gem_environment = self_.send(:ruby_shell_out!, self_.new_resource.gem_binary, 'environment')
+            matches = gem_environment.stdout.scan(/EXECUTABLE DIRECTORY: (.*)$/).first
+            if matches
+              Chef::Log.debug("[#{new_resource}] Prepending gem executable directory #{matches.first} to existing $PATH (#{path})")
+              path = "#{matches.first}:#{path}"
+            end
             "#{self_.new_resource.ruby} #{PoiseLanguages::Utils.absolute_command(val, path: path)}"
           end
           resource.command(cmd)
diff --git a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/version.rb b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/version.rb
index 48f7d53..2dfdd80 100644
--- a/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/version.rb
+++ b/cookbooks/application_ruby/files/halite_gem/poise_application_ruby/version.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -15,5 +15,5 @@
 #
 
 module PoiseApplicationRuby
-  VERSION = '4.0.1'
+  VERSION = '4.1.0'
 end
diff --git a/cookbooks/application_ruby/libraries/default.rb b/cookbooks/application_ruby/libraries/default.rb
index 673a63b..9b5b405 100644
--- a/cookbooks/application_ruby/libraries/default.rb
+++ b/cookbooks/application_ruby/libraries/default.rb
@@ -1,5 +1,5 @@
 #
-# Copyright 2015, Noah Kantrowitz
+# Copyright 2015-2017, Noah Kantrowitz
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
diff --git a/cookbooks/application_ruby/metadata.json b/cookbooks/application_ruby/metadata.json
index 3707047..544b213 100644
--- a/cookbooks/application_ruby/metadata.json
+++ b/cookbooks/application_ruby/metadata.json
@@ -1 +1 @@
-{"name":"application_ruby","version":"4.0.1","description":"A Chef cookbook for deploying application code.","long_description":"# Application_Ruby Cookbook\n\n[![Build Status](https://img.shields.io/travis/poise/application_ruby.svg)](https://travis-ci.org/poise/application_ruby)\n[![Gem Version](https://img.shields.io/gem/v/poise-application-ruby.svg)](https://rubygems.org/gems/poise-application-ruby)\n[![Cookbook Version](https://img.shields.io/cookbook/v/application_ruby.svg)](https://supermarket.chef.io/cookbooks/application_ruby)\n[![Coverage](https://img.shields.io/codecov/c/github/poise/application_ruby.svg)](https://codecov.io/github/poise/application_ruby)\n[![Gemnasium](https://img.shields.io/gemnasium/poise/application_ruby.svg)](https://gemnasium.com/poise/application_ruby)\n[![License](https://img.shields.io/badge/license-Apache_2-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)\n\nA [Chef](https://www.chef.io/) cookbook to deploy Ruby applications.\n\n## Quick Start\n\nTo deploy a Rails application from git:\n\n```ruby\napplication '/srv/myapp' do\n  git 'https://github.com/example/myapp.git'\n  bundle_install do\n    deployment true\n    without %w{development test}\n  end\n  rails do\n    database 'sqlite3:///db.sqlite3'\n    secret_token 'd78fe08df56c9'\n    migrate true\n  end\n  unicorn do\n    port 8000\n  end\nend\n```\n\n## Requirements\n\nChef 12 or newer is required.\n\n## Resources\n\n### `application_bundle_install`\n\nThe `application_bundle_install` resource installs gems using Bundler for a\ndeployment.\n\n```ruby\napplication '/srv/myapp' do\n  bundle_install do\n    deployment true\n    without %w{development test}\n  end\nend\n```\n\nAll actions and properties are the same as the [`bundle_install` resource](https://github.com/poise/poise-ruby#bundle_install).\n\n### `application_rackup`\n\nThe `application_rackup` resource creates a service for `rackup`.\n\n```ruby\napplication '/srv/myapp' do\n  rackup do\n    port 8000\n  end\nend\n```\n\n#### Actions\n\n* `:enable` – Create, enable and start the service. *(default)*\n* `:disable` – Stop, disable, and destroy the service.\n* `:start` – Start the service.\n* `:stop` – Stop the service.\n* `:restart` – Stop and then start the service.\n* `:reload` – Send the configured reload signal to the service.\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `port` – Port to listen on. *(default: 80)*\n* `service_name` – Name of the service to create. *(default: auto-detect)*\n# `user` – User to run the service as. *(default: application owner)*\n\n### `application_rails`\n\nThe `application_rails` resource\n\n```ruby\napplication '/srv/myapp' do\n  rails do\n    database 'sqlite3:///db.sqlite3'\n    secret_token 'd78fe08df56c9'\n    migrate true\n  end\nend\n```\n\n#### Actions\n\n* `:deploy` – Create config files and run required deployments steps. *(default)*\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `database` – Database settings for Rails. See [the database section\n  below](#database-parameters) for more information. *(option collector)*\n* `migrate` – Run database migrations. *(default: false)*\n* `precompile_assets` – Run `rake assets:precompile`. *(default: auto-detect)()\n* `rails_env` – Rails environment name. *(default: node.chef_environment)*\n* `secret_token` – Secret token for Rails session verification et al.\n* `secrets_mode` – Secrets configuration mode. Set to `:yaml` to generate a\n  Rails 4.2 secrets.yml. Set to `:initializer` to update\n  `config/initializers/secret_token.rb`. *(default: auto-detect)*\n\n**NOTE:** At this time `secrets_mode :initializer` is not implemented.\n\n#### Database Parameters\n\nThe database parameters can be set in three ways: URL, hash, and block.\n\nIf you have a single URL for the parameters, you can pass it directly to\n`database`:\n\n```ruby\nrails do\n  database 'mysql2://myuser@dbhost/myapp'\nend\n```\n\nPassing a single URL will also set the `$DATABASE_URL` environment variable\nautomatically for compatibility with Heroku-based applications.\n\nAs with other option collector resources, you can pass individual settings as\neither a hash or block:\n\n```ruby\nrails do\n  database do\n    adapter 'mysql2'\n    username 'myuser'\n    host 'dbhost'\n    database 'myapp'\n  end\nend\n\nrails do\n  database({\n    adapter: 'mysql2',\n    username: 'myuser',\n    host: 'dbhost',\n    database: 'myapp',\n  })\nend\n```\n\n### `application_ruby`\n\nThe `application_ruby` resource installs a Ruby runtime for the deployment.\n\n```ruby\napplication '/srv/myapp' do\n  ruby '2.2'\nend\n```\n\nAll actions and properties are the same as the [`ruby_runtime` resource](https://github.com/poise/poise-ruby#ruby_runtime).\n\n### `application_ruby_gem`\n\nThe `application_ruby_gem` resource installs Ruby gems for the deployment.\n\n```ruby\napplication '/srv/myapp' do\n  ruby_gem 'rake'\nend\n```\n\nAll actions and properties are the same as the [`ruby_gem` resource](https://github.com/poise/poise-ruby#ruby_gem).\n\n### `application_ruby_execute`\n\nThe `application_ruby_execute` resource runs Ruby commands for the deployment.\n\n```ruby\napplication '/srv/myapp' do\n  ruby_execute 'rake'\nend\n```\n\nAll actions and properties are the same as the [`ruby_execute` resource](https://github.com/poise/poise-ruby#ruby_execute),\nexcept that the `cwd`, `environment`, `group`, and `user` properties default to\nthe application-level data if not specified.\n\n### `application_thin`\n\nThe `application_thin` resource creates a service for `thin`.\n\n```ruby\napplication '/srv/myapp' do\n  thin do\n    port 8000\n  end\nend\n```\n\n#### Actions\n\n* `:enable` – Create, enable and start the service. *(default)*\n* `:disable` – Stop, disable, and destroy the service.\n* `:start` – Start the service.\n* `:stop` – Stop the service.\n* `:restart` – Stop and then start the service.\n* `:reload` – Send the configured reload signal to the service.\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `config_path` – Path to a Thin configuration file.\n* `port` – Port to listen on. *(default: 80)*\n* `service_name` – Name of the service to create. *(default: auto-detect)*\n# `user` – User to run the service as. *(default: application owner)*\n\n### `application_unicorn`\n\nThe `application_unicorn` resource creates a service for `unicorn`.\n\n```ruby\napplication '/srv/myapp' do\n  unicorn do\n    port 8000\n  end\nend\n```\n\n#### Actions\n\n* `:enable` – Create, enable and start the service. *(default)*\n* `:disable` – Stop, disable, and destroy the service.\n* `:start` – Start the service.\n* `:stop` – Stop the service.\n* `:restart` – Stop and then start the service.\n* `:reload` – Send the configured reload signal to the service.\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `port` – Port to listen on. *(default: 80)*\n* `service_name` – Name of the service to create. *(default: auto-detect)*\n# `user` – User to run the service as. *(default: application owner)*\n\n## Sponsors\n\nDevelopment sponsored by [Chef Software](https://www.chef.io/), [Symonds & Son](http://symondsandson.com/), and [Orion](https://www.orionlabs.co/).\n\nThe Poise test server infrastructure is sponsored by [Rackspace](https://rackspace.com/).\n\n## License\n\nCopyright 2015, Noah Kantrowitz\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\nhttp://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n","maintainer":"YOUR_COMPANY_NAME","maintainer_email":"YOUR_EMAIL","license":"none","platforms":{},"dependencies":{"poise":"~> 2.0","application":"~> 5.0","poise-ruby":"~> 2.1","poise-service":"~> 1.0"},"recommendations":{},"suggestions":{},"conflicting":{},"providing":{},"replacing":{},"attributes":{},"groupings":{},"recipes":{}}
\ No newline at end of file
+{"name":"application_ruby","version":"4.1.0","description":"A Chef cookbook for deploying application code.","long_description":"# Application_Ruby Cookbook\n\n[![Build Status](https://img.shields.io/travis/poise/application_ruby.svg)](https://travis-ci.org/poise/application_ruby)\n[![Gem Version](https://img.shields.io/gem/v/poise-application-ruby.svg)](https://rubygems.org/gems/poise-application-ruby)\n[![Cookbook Version](https://img.shields.io/cookbook/v/application_ruby.svg)](https://supermarket.chef.io/cookbooks/application_ruby)\n[![Coverage](https://img.shields.io/codecov/c/github/poise/application_ruby.svg)](https://codecov.io/github/poise/application_ruby)\n[![Gemnasium](https://img.shields.io/gemnasium/poise/application_ruby.svg)](https://gemnasium.com/poise/application_ruby)\n[![License](https://img.shields.io/badge/license-Apache_2-blue.svg)](https://www.apache.org/licenses/LICENSE-2.0)\n\nA [Chef](https://www.chef.io/) cookbook to deploy Ruby applications.\n\n## Quick Start\n\nTo deploy a Rails application from git:\n\n```ruby\napplication '/srv/myapp' do\n  git 'https://github.com/example/myapp.git'\n  bundle_install do\n    deployment true\n    without %w{development test}\n  end\n  rails do\n    database 'sqlite3:///db.sqlite3'\n    secret_token 'd78fe08df56c9'\n    migrate true\n  end\n  unicorn do\n    port 8000\n  end\nend\n```\n\n## Requirements\n\nChef 12.1 or newer is required.\n\n## Resources\n\n### `application_bundle_install`\n\nThe `application_bundle_install` resource installs gems using Bundler for a\ndeployment.\n\n```ruby\napplication '/srv/myapp' do\n  bundle_install do\n    deployment true\n    without %w{development test}\n  end\nend\n```\n\nAll actions and properties are the same as the [`bundle_install` resource](https://github.com/poise/poise-ruby#bundle_install).\n\n### `application_puma`\n\nThe `application_puma` resource creates a service for `puma`.\n\n```ruby\napplication '/srv/myapp' do\n  puma do\n    port 8000\n  end\nend\n```\n\n#### Actions\n\n* `:enable` – Create, enable and start the service. *(default)*\n* `:disable` – Stop, disable, and destroy the service.\n* `:start` – Start the service.\n* `:stop` – Stop the service.\n* `:restart` – Stop and then start the service.\n* `:reload` – Send the configured reload signal to the service.\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `port` – Port to listen on. *(default: 80)*\n* `service_name` – Name of the service to create. *(default: auto-detect)*\n* `user` – User to run the service as. *(default: application owner)*\n\n### `application_rackup`\n\nThe `application_rackup` resource creates a service for `rackup`.\n\n```ruby\napplication '/srv/myapp' do\n  rackup do\n    port 8000\n  end\nend\n```\n\n#### Actions\n\n* `:enable` – Create, enable and start the service. *(default)*\n* `:disable` – Stop, disable, and destroy the service.\n* `:start` – Start the service.\n* `:stop` – Stop the service.\n* `:restart` – Stop and then start the service.\n* `:reload` – Send the configured reload signal to the service.\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `port` – Port to listen on. *(default: 80)*\n* `service_name` – Name of the service to create. *(default: auto-detect)*\n# `user` – User to run the service as. *(default: application owner)*\n\n### `application_rails`\n\nThe `application_rails` resource\n\n```ruby\napplication '/srv/myapp' do\n  rails do\n    database 'sqlite3:///db.sqlite3'\n    secret_token 'd78fe08df56c9'\n    migrate true\n  end\nend\n```\n\n#### Actions\n\n* `:deploy` – Create config files and run required deployments steps. *(default)*\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `app_module` – Top-level application module. Only needed for the :initializer\n  style of secret token configuration. *(default: auto-detect)*\n* `database` – Database settings for Rails. See [the database section\n  below](#database-parameters) for more information. *(option collector)*\n* `migrate` – Run database migrations. *(default: false)*\n* `precompile_assets` – Run `rake assets:precompile`. *(default: auto-detect)()\n* `rails_env` – Rails environment name. *(default: node.chef_environment)*\n* `secret_token` – Secret token for Rails session verification et al.\n* `secrets_mode` – Secrets configuration mode. Set to `:yaml` to generate a\n  Rails 4.2 secrets.yml. Set to `:initializer` to update\n  `config/initializers/secret_token.rb`. *(default: auto-detect)*\n\n**NOTE:** At this time `secrets_mode :initializer` is not implemented.\n\n#### Database Parameters\n\nThe database parameters can be set in three ways: URL, hash, and block.\n\nIf you have a single URL for the parameters, you can pass it directly to\n`database`:\n\n```ruby\nrails do\n  database 'mysql2://myuser@dbhost/myapp'\nend\n```\n\nPassing a single URL will also set the `$DATABASE_URL` environment variable\nautomatically for compatibility with Heroku-based applications.\n\nAs with other option collector resources, you can pass individual settings as\neither a hash or block:\n\n```ruby\nrails do\n  database do\n    adapter 'mysql2'\n    username 'myuser'\n    host 'dbhost'\n    database 'myapp'\n  end\nend\n\nrails do\n  database({\n    adapter: 'mysql2',\n    username: 'myuser',\n    host: 'dbhost',\n    database: 'myapp',\n  })\nend\n```\n\n### `application_ruby`\n\nThe `application_ruby` resource installs a Ruby runtime for the deployment.\n\n```ruby\napplication '/srv/myapp' do\n  ruby '2.2'\nend\n```\n\nAll actions and properties are the same as the [`ruby_runtime` resource](https://github.com/poise/poise-ruby#ruby_runtime).\n\n### `application_ruby_gem`\n\nThe `application_ruby_gem` resource installs Ruby gems for the deployment.\n\n```ruby\napplication '/srv/myapp' do\n  ruby_gem 'rake'\nend\n```\n\nAll actions and properties are the same as the [`ruby_gem` resource](https://github.com/poise/poise-ruby#ruby_gem).\n\n### `application_ruby_execute`\n\nThe `application_ruby_execute` resource runs Ruby commands for the deployment.\n\n```ruby\napplication '/srv/myapp' do\n  ruby_execute 'rake'\nend\n```\n\nAll actions and properties are the same as the [`ruby_execute` resource](https://github.com/poise/poise-ruby#ruby_execute),\nexcept that the `cwd`, `environment`, `group`, and `user` properties default to\nthe application-level data if not specified.\n\n### `application_thin`\n\nThe `application_thin` resource creates a service for `thin`.\n\n```ruby\napplication '/srv/myapp' do\n  thin do\n    port 8000\n  end\nend\n```\n\n#### Actions\n\n* `:enable` – Create, enable and start the service. *(default)*\n* `:disable` – Stop, disable, and destroy the service.\n* `:start` – Start the service.\n* `:stop` – Stop the service.\n* `:restart` – Stop and then start the service.\n* `:reload` – Send the configured reload signal to the service.\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `config_path` – Path to a Thin configuration file.\n* `port` – Port to listen on. *(default: 80)*\n* `service_name` – Name of the service to create. *(default: auto-detect)*\n* `user` – User to run the service as. *(default: application owner)*\n\n### `application_unicorn`\n\nThe `application_unicorn` resource creates a service for `unicorn`.\n\n```ruby\napplication '/srv/myapp' do\n  unicorn do\n    port 8000\n  end\nend\n```\n\n#### Actions\n\n* `:enable` – Create, enable and start the service. *(default)*\n* `:disable` – Stop, disable, and destroy the service.\n* `:start` – Start the service.\n* `:stop` – Stop the service.\n* `:restart` – Stop and then start the service.\n* `:reload` – Send the configured reload signal to the service.\n\n#### Properties\n\n* `path` – Base path for the application. *(name attribute)*\n* `port` – Port to listen on. *(default: 80)*\n* `service_name` – Name of the service to create. *(default: auto-detect)*\n* `user` – User to run the service as. *(default: application owner)*\n\n## Sponsors\n\nDevelopment sponsored by [Chef Software](https://www.chef.io/), [Symonds & Son](http://symondsandson.com/), and [Orion](https://www.orionlabs.co/).\n\nThe Poise test server infrastructure is sponsored by [Rackspace](https://rackspace.com/).\n\n## License\n\nCopyright 2015-2017, Noah Kantrowitz\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\nhttp://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n","maintainer":"Noah Kantrowitz","maintainer_email":"noah@coderanger.net","license":"Apache 2.0","platforms":{},"dependencies":{"poise":"~> 2.0","application":"~> 5.0","poise-ruby":"~> 2.1","poise-service":"~> 1.0"},"recommendations":{},"suggestions":{},"conflicting":{},"providing":{},"replacing":{},"attributes":{},"groupings":{},"recipes":{},"source_url":"https://github.com/poise/application_ruby","issues_url":"https://github.com/poise/application_ruby/issues","chef_version":[["< 14",">= 12.1"]],"ohai_version":[]}
\ No newline at end of file
diff --git a/cookbooks/application_ruby/templates/secret_token.rb.erb b/cookbooks/application_ruby/templates/secret_token.rb.erb
new file mode 100644
index 0000000..d7acf98
--- /dev/null
+++ b/cookbooks/application_ruby/templates/secret_token.rb.erb
@@ -0,0 +1,3 @@
+# Generated by Chef for <%= @new_resource.to_s %>
+
+<%= @app_module %>::Application.config.secret_token = <%= @secret_token.inspect %>
diff --git a/cookbooks/application_ruby/templates/secrets.yml.erb b/cookbooks/application_ruby/templates/secrets.yml.erb
index a1bdc6e..c8c0fec 100644
--- a/cookbooks/application_ruby/templates/secrets.yml.erb
+++ b/cookbooks/application_ruby/templates/secrets.yml.erb
@@ -1,3 +1,3 @@
 # Generated by Chef for <%= @new_resource.to_s %>
 
-<%= @config.to_yaml %>
+<%= @yaml_config.to_yaml %>