diff --git a/config_defaults.yml b/config_defaults.yml
index a5ae25de..4d49534b 100644
--- a/config_defaults.yml
+++ b/config_defaults.yml
@@ -1,4 +1,37 @@
 ---
+.github/settings.yml:
+  repository:
+    private: false
+    has_issues: true
+    has_projects: false
+    has_wiki: false
+    has_downloads: true
+    default_branch: master
+    allow_squash_merge: true
+    allow_merge_commit: true
+    allow_rebase_merge: true
+    archived: false
+  branches:
+    - name: master
+      protection:
+        required_pull_request_reviews: undef
+        required_status_checks:
+          strict: true
+          contexts: []
+        enforce_admins: undef
+        restrictions: undef
+        required_signatures: false
+    - name: modulesync
+      protection:
+        required_pull_request_reviews: undef
+        required_status_checks:
+          strict: true
+          contexts: []
+        enforce_admins: undef
+        restrictions: undef
+        required_signatures: true
+        allow_force_pushes: true
+        allow_deletions: true
 .travis.yml:
   before_install:
     - yes | gem update --system
@@ -35,6 +68,9 @@
     channels:
     - "chat.freenode.org#voxpupuli-notifications"
   user: puppet
+CODEOWNERS:
+  permissions:
+    '.github/settings.yml': '@voxpupuli/project-maintainers'
 Gemfile:
   required:
     ':test':
diff --git a/moduleroot/.github/settings.yml.erb b/moduleroot/.github/settings.yml.erb
new file mode 100644
index 00000000..9090a96c
--- /dev/null
+++ b/moduleroot/.github/settings.yml.erb
@@ -0,0 +1 @@
+<%= @configs.slice('repository', 'labels', 'milestones', 'collaborators', 'teams', 'branches').to_yaml.gsub(/undef/, 'null') -%>
diff --git a/moduleroot/CODEOWNERS.erb b/moduleroot/CODEOWNERS.erb
new file mode 100644
index 00000000..a97f517f
--- /dev/null
+++ b/moduleroot/CODEOWNERS.erb
@@ -0,0 +1,3 @@
+<% @configs['permissions']&.each do |key, value| -%>
+<%= key %> <%= value %>
+<% end -%>