diff --git a/files/scripts/close_pull_requests.py b/files/scripts/close_pull_requests.py
index 441aab9..cecbd32 100755
--- a/files/scripts/close_pull_requests.py
+++ b/files/scripts/close_pull_requests.py
@@ -16,6 +16,12 @@
 # Github pull requests closer reads a project config file called projects.yaml
 # It should look like:
 
+# - homepage: http://openstack.org
+#   team-id: 153703
+#   has-wiki: False
+#   has-issues: False
+#   has-downloads: False
+# ---
 # - project: PROJECT_NAME
 #   options:
 #   - has-pull-requests
@@ -54,7 +60,7 @@ Please visit http://wiki.openstack.org/GerritWorkflow and follow the instruction
 
 secure_config = ConfigParser.ConfigParser()
 secure_config.read(GITHUB_SECURE_CONFIG)
-config = yaml.load(open(PROJECTS_YAML))
+(defaults, config) = [config for config in yaml.load_all(open(PROJECTS_YAML))]
 
 if secure_config.has_option("github", "oauth_token"):
     ghub = github.Github(secure_config.get("github", "oauth_token"))
diff --git a/manifests/init.pp b/manifests/init.pp
index c04f75b..ee56ce4 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,6 +1,8 @@
 class github(
   $username,
   $oauth_token,
+  $project_username,
+  $project_password,
   $projects = []
 ) {
   include pip
@@ -55,6 +57,19 @@ class github(
     ],
   }
 
+  file { '/etc/github/github-projects.secure.config':
+    ensure  => present,
+    content => template('github/github-projects.secure.config.erb'),
+    group   => 'github',
+    mode    => '0440',
+    owner   => 'root',
+    replace => true,
+    require => [
+      Group['github'],
+      File['/etc/github']
+    ],
+  }
+
   file { '/usr/local/github':
     ensure => directory,
     group  => 'root',
diff --git a/templates/github-projects.secure.config.erb b/templates/github-projects.secure.config.erb
new file mode 100644
index 0000000..887c2a7
--- /dev/null
+++ b/templates/github-projects.secure.config.erb
@@ -0,0 +1,3 @@
+[github]
+username = <%= project_username %>
+password = <%= project_password %>