It's probably best to read it from a separate file and generate that if it's missing. This way we can generate a file in RPM's %post section and people won't have to "oh no, it's not running" because "you forgot to run rake foo". A file can have secure permissions and owned by awesome users.