I'm thinking `app_base_dir` and `venv_dir` should move to the common role but we can do that later once we figure out the secure_dir stuff.