diff --git a/attributes/default.rb b/attributes/default.rb
index fa939f3..50b91a1 100644
--- a/attributes/default.rb
+++ b/attributes/default.rb
@@ -6,7 +6,7 @@
 default['stash']['service_type'] = 'init'
 default['stash']['url_base']     = 'http://www.atlassian.com/software/stash/downloads/binary/atlassian-stash'
 default['stash']['user']         = 'stash'
-default['stash']['version']      = '3.1.1'
+default['stash']['version']      = '3.3.0'
 
 default['stash']['url']      = "#{node['stash']['url_base']}-#{node['stash']['version']}.tar.gz"
 default['stash']['checksum'] =
@@ -70,8 +70,14 @@
 when '3.0.1' then '53312a7d26e68b50eb778b8847e04162074b645c2d4014bc404eba59ff90f624'
 when '3.0.4' then '2dc4db2a0fd306bad39d46b9e6a58d7c9d82c73711e002a93103f19e8133aa6a'
 when '3.0.5' then 'f06b4d545d0e7acae6255f3f4d8c9a02bbdfebf16da793eaef8e1b8eef9303b2'
+when '3.0.6' then '2b5cc70cba6e63aecd7591f02a1ed290825bf3916ffd867cc78b0fabb5badb48'
 when '3.1.0' then '9eb7ba9eec7b67cf14a3ae450c8ec3d8e9289a120672825ec8ba6a290b48c6a6'
 when '3.1.1' then '14710e220ca4258cd81c0bd205e5df668abd7b0ed56be9fd6e74e82a394f53b9'
+when '3.1.3' then 'b203d8d58bf95414077cac948066f5c84d600db258bb6168cc482b948f63529e'
+when '3.2.0' then '4e8c38b9450e718020d6f74df891987abe491529c66b3df19eff9a325856417e'
+when '3.2.2' then 'a4e4b299c08432d4852872d6f8b754636ae640d434e5d1544637a54e5f1a3d39'
+when '3.2.4' then 'd52b1b8ca50351bf9056d11bf584d6ca1e3ca70eddd936cb799543b487a6ba01'
+when '3.3.0' then '4cb441824c08f28550d5ee2f883016461a356f626e5f38c0a29d345f174d34fd'
 end
 
 default['stash']['apache2']['access_log']         = ''
@@ -98,11 +104,24 @@
 default['stash']['backup_client']['baseurl']      = "https://#{node['fqdn']}/"
 default['stash']['backup_client']['install_path'] = node['stash']['install_path']
 default['stash']['backup_client']['password']     = 'changeit'
-default['stash']['backup_client']['url_base']     = 'http://downloads.atlassian.com/software/stash/downloads/stash-backup-client'
 default['stash']['backup_client']['user']         = 'admin'
-default['stash']['backup_client']['version']      = '1.2.1'
+default['stash']['backup_client']['version']      = '1.4.0'
+stash_backup_client_version = Chef::Version.new(node['stash']['backup_client']['version'])
+
+default['stash']['backup_client']['url_base']     =
+if stash_backup_client_version <= Chef::Version.new('1.2.1')
+  'http://downloads.atlassian.com/software/stash/downloads/stash-backup-client'
+else
+  'https://maven.atlassian.com/public/com/atlassian/stash/backup/stash-backup-distribution/'
+end
+
+default['stash']['backup_client']['url']      =
+if stash_backup_client_version <= Chef::Version.new('1.2.1')
+  "#{node['stash']['backup_client']['url_base']}-#{node['stash']['backup_client']['version']}.zip"
+else
+  "#{node['stash']['backup_client']['url_base']}/#{node['stash']['backup_client']['version']}/stash-backup-distribution-#{node['stash']['backup_client']['version']}.zip"
+end
 
-default['stash']['backup_client']['url']      = "#{node['stash']['backup_client']['url_base']}-#{node['stash']['backup_client']['version']}.zip"
 default['stash']['backup_client']['checksum'] =
 case node['stash']['backup_client']['version']
 when '1.0.0-beta-11' then 'b1ec42ef96db0cbb3f5678c75da119019d8894c3b09ee886ced075c694bbafb2'
@@ -111,6 +130,9 @@
 when '1.1.0' then 'd2276df535e0f8e909cd0c1c9700ca275be378145451f9d62a5980b62fdfab74'
 when '1.2.0' then '5dee33dfdf78605caa0bee33caf5cff633613604ec3a30e93dead81c4401f9b9'
 when '1.2.1' then 'eb680d58838b6218cbcb32f4bbf8e9be46adf1df43801e5e83e420ae58bc0d07'
+when '1.3.0' then 'b9674f3235d4937d39186417594efdb3213b564d783aa09618a8086cc57f5170'
+when '1.3.1' then '625af0a8402e85d62768f99a409ce4e140ef3afc961514b549fb9f98877c39db'
+when '1.4.0' then 'c57a5fafb8aaaccea0bd57aae0bce24472ee6d172c0a558c11759b26b6c0196c'
 end
 
 default['stash']['backup_client']['cron']['day'] = '*'
diff --git a/recipes/configuration.rb b/recipes/configuration.rb
index 78e648b..f4d6d0e 100644
--- a/recipes/configuration.rb
+++ b/recipes/configuration.rb
@@ -1,6 +1,22 @@
 settings = Stash.settings(node)
+stash_version = Chef::Version.new(node['stash']['version'])
 
-template "#{node['stash']['home_path']}/stash-config.properties" do
+# Config path changed to shared/ from 3.2.0
+# https://confluence.atlassian.com/display/STASHKB/Upgrading+your+Stash+home+directory+for+Stash+3.2+manually
+if stash_version >= Chef::Version.new('3.2.0')
+  config_path = 'shared/'
+  directory("#{node['stash']['home_path']}/#{config_path}") do
+    owner node['stash']['user']
+    group node['stash']['user']
+    mode '0755'
+    action :create
+    recursive true
+  end
+else
+  config_path = '/'
+end
+
+template "#{node['stash']['home_path']}/#{config_path}stash-config.properties" do
   source 'stash-config.properties.erb'
   owner node['stash']['user']
   mode '0644'
diff --git a/recipes/tomcat_configuration.rb b/recipes/tomcat_configuration.rb
index 0f7b921..3a6aa98 100644
--- a/recipes/tomcat_configuration.rb
+++ b/recipes/tomcat_configuration.rb
@@ -11,6 +11,8 @@
 template "#{node['stash']['install_path']}/stash/conf/server.xml" do
   if stash_version.major == 1
     source 'server.xml.erb'
+  elsif stash_version >= Chef::Version.new('3.3.0')
+    source 'server-tomcat8.xml.erb'
   else
     source 'server-tomcat7.xml.erb'
   end
diff --git a/templates/default/server-tomcat8.xml.erb b/templates/default/server-tomcat8.xml.erb
new file mode 100644
index 0000000..69c26d3
--- /dev/null
+++ b/templates/default/server-tomcat8.xml.erb
@@ -0,0 +1,194 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!--
+  Dynamically generated by Chef on <%= node["fqdn"] %>
+  Local modifications will be overwritten by Chef.
+-->
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+-->
+<!-- Note:  A "Server" is not itself a "Container", so you may not
+     define subcomponents such as "Valves" at this level.
+     Documentation at /docs/config/server.html
+ -->
+<Server port="8006" shutdown="SHUTDOWN">
+    <!-- Security listener. Documentation at /docs/config/listeners.html
+    <Listener className="org.apache.catalina.security.SecurityListener" />
+    -->
+    <!--APR library loader. Documentation at /docs/apr.html -->
+    <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
+    <!-- Prevent memory leaks due to use of particular java/javax APIs-->
+    <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
+    <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
+    <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
+
+    <!-- Global JNDI resources
+         Documentation at /docs/jndi-resources-howto.html
+    -->
+    <GlobalNamingResources>
+        <!-- Editable user database that can also be used by
+             UserDatabaseRealm to authenticate users
+        -->
+        <Resource name="UserDatabase" auth="Container"
+                  type="org.apache.catalina.UserDatabase"
+                  description="User database that can be updated and saved"
+                  factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+                  pathname="conf/tomcat-users.xml" />
+    </GlobalNamingResources>
+
+    <!-- A "Service" is a collection of one or more "Connectors" that share
+        a single "Container" Note:  A "Service" is not itself a "Container",
+        so you may not define subcomponents such as "Valves" at this level.
+        Documentation at /docs/config/service.html
+    -->
+    <Service name="Catalina">
+
+        <!--The connectors can use a shared executor, you can define one or more named thread pools-->
+        <!--
+        <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
+            maxThreads="150" minSpareThreads="4"/>
+        -->
+
+
+        <!-- A "Connector" represents an endpoint by which requests are received
+             and responses are returned. Documentation at :
+             Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
+             Java AJP  Connector: /docs/config/ajp.html
+             APR (HTTP/AJP) Connector: /docs/apr.html
+             Define a non-SSL HTTP/1.1 Connector on port 7990
+
+             If you change this port, you have to update scripts.cfg as well
+             to have the same port configuration.
+        -->
+        <Connector port="<%= node['stash']['tomcat']['port'] %>" protocol="HTTP/1.1"
+                   connectionTimeout="20000"
+                   useBodyEncodingForURI="true"
+                   compression="on"
+                   compressableMimeType="text/html,text/xml,text/plain,text/css,application/json,application/javascript,application/x-javascript"
+                   <% if node['stash']['apache2'] -%>
+                   redirectPort="<%= node['stash']['apache2']['ssl']['port'] %>"
+                   secure="true"
+                   scheme="https"
+                   proxyName="<%= node['stash']['apache2']['virtual_host_alias'] %>"
+                   proxyPort="<%= node['stash']['apache2']['ssl']['port'] %>"
+                   <% else -%>
+                   redirectPort="<%= node['stash']['tomcat']['ssl_port'] %>"
+                   <% end -%>
+                   />
+
+        <!-- A "Connector" using the shared thread pool-->
+        <!--
+        <Connector executor="tomcatThreadPool"
+                   port="7990" protocol="HTTP/1.1"
+                   connectionTimeout="20000"
+                   redirectPort="8443" />
+        -->
+        <!-- Define a SSL HTTP/1.1 Connector on port 8443
+             This connector uses the JSSE configuration, when using APR, the
+             connector should be using the OpenSSL style configuration
+             described in the APR documentation -->
+        <Connector port="<%= node['stash']['tomcat']['ssl_port'] %>"
+             maxHttpHeaderSize="8192"
+             SSLEnabled="true"
+             maxThreads="150"
+             minSpareThreads="25"
+             maxSpareThreads="75"
+             enableLookups="false"
+             disableUploadTimeout="true"
+             useBodyEncodingForURI="true"
+             acceptCount="100"
+             scheme="https"
+             secure="true"
+             clientAuth="false"
+             sslProtocol="TLS"
+             <%- if @tomcat %>
+             <%= "keyAlias=\"#{@tomcat['keyAlias']}\"" if @tomcat['keyAlias'] %>
+             <%= "keystoreFile=\"#{@tomcat['keystoreFile']}\"" if @tomcat['keystoreFile'] %>
+             <%= "keystorePass=\"#{@tomcat['keystorePass']}\"" if @tomcat['keystorePass'] %>
+             <%- end %>
+        />
+        <!--
+        <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
+                   maxThreads="150" scheme="https" secure="true"
+                   clientAuth="false" sslProtocol="TLS" />
+        -->
+
+
+        <!-- An Engine represents the entry point (within Catalina) that processes
+             every request.  The Engine implementation for Tomcat stand alone
+             analyzes the HTTP headers included with the request, and passes them
+             on to the appropriate Host (virtual host).
+             Documentation at /docs/config/engine.html -->
+
+        <!-- You should set jvmRoute to support load-balancing via AJP ie :
+        <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
+        -->
+        <Engine name="Catalina" defaultHost="localhost">
+
+            <!-- For clustering, please take a look at documentation at:
+                 /docs/cluster-howto.html  (simple how to)
+                 /docs/config/cluster.html (reference documentation) -->
+            <!--
+            <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
+            -->
+
+            <!-- Use the LockOutRealm to prevent attempts to guess user passwords
+                 via a brute-force attack -->
+            <Realm className="org.apache.catalina.realm.LockOutRealm">
+                <!-- This Realm uses the UserDatabase configured in the global JNDI
+                     resources under the key "UserDatabase".  Any edits
+                     that are performed against this UserDatabase are immediately
+                     available for use by the Realm.  -->
+                <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+                       resourceName="UserDatabase"/>
+            </Realm>
+
+
+            <Host name="localhost" appBase="webapps"
+                  unpackWARs="true" autoDeploy="true"
+                  xmlValidation="false" xmlNamespaceAware="false">
+
+
+         <!-- Before changing the context path for Stash, please read our documentation:
+      https://confluence.atlassian.com/x/5oCNEQ
+
+        You will have to update scripts.cfg AND
+        rename webapps/ROOT directory.
+
+          -->
+
+                <Context docBase="${catalina.home}/atlassian-stash"
+                         path=""
+                         reloadable="false"
+                         useHttpOnly="true"/>
+
+                <!-- SingleSignOn valve, share authentication between web applications
+                     Documentation at: /docs/config/valve.html -->
+                <!--
+                <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
+                -->
+
+                <!-- Access log processes all example.
+                     Documentation at: /docs/config/valve.html
+                     Note: The pattern used is equivalent to using pattern="common" -->
+                <!--
+                <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
+                       prefix="localhost_access_log." suffix=".txt"
+                       pattern="%h %l %u %t &quot;%r&quot; %s %b" />
+                -->
+            </Host>
+        </Engine>
+    </Service>
+</Server>
diff --git a/templates/default/server.xml.erb b/templates/default/server.xml.erb
index d247f64..472e35b 100644
--- a/templates/default/server.xml.erb
+++ b/templates/default/server.xml.erb
@@ -95,7 +95,7 @@
              This connector uses the JSSE configuration, when using APR, the
              connector should be using the OpenSSL style configuration
              described in the APR documentation -->
-        
+
         <Connector port="<%= node['stash']['tomcat']['ssl_port'] %>"
              maxHttpHeaderSize="8192"
              SSLEnabled="true"