--- conf/app.ini.orig	2017-10-19 23:49:52.358629509 -0700
+++ conf/app.ini	2017-10-19 23:50:36.007964774 -0700
@@ -1,12 +1,12 @@
 ; App name that shows on every page title
 APP_NAME = Gitea: Git with a cup of tea
 ; Change it if you run locally
-RUN_USER = git
+RUN_USER = _gitea
 ; Either "dev", "prod" or "test", default is "dev"
-RUN_MODE = dev
+RUN_MODE = prod
 
 [repository]
-ROOT =
+ROOT = /var/lib/gitea/repositories
 SCRIPT_TYPE = bash
 ; Default ANSI charset
 ANSI_CHARSET =
@@ -34,13 +34,13 @@
 
 [repository.local]
 ; Path for uploads. Defaults to `tmp/local-repo`
-LOCAL_COPY_PATH = tmp/local-repo
+LOCAL_COPY_PATH = /var/lib/gitea/tmp/local-repo
 
 [repository.upload]
 ; Whether repository file uploads are enabled. Defaults to `true`
 ENABLED = true
 ; Path for uploads. Defaults to `data/tmp/uploads` (tmp gets deleted on gitea restart)
-TEMP_PATH = data/tmp/uploads
+TEMP_PATH = /var/lib/gitea/tmp/uploads
 ; One or more allowed types, e.g. image/jpeg|image/png. Nothing means any file type
 ALLOWED_TYPES =
 ; Max size of each file in MB. Defaults to 3MB
@@ -102,7 +102,7 @@
 HTTP_ADDR = 0.0.0.0
 HTTP_PORT = 3000
 ; Permission for unix socket
-UNIX_SOCKET_PERMISSION = 666
+UNIX_SOCKET_PERMISSION = 660
 ; Local (DMZ) URL for Gitea workers (such as SSH update) accessing web service.
 ; In most cases you do not need to change the default value.
 ; Alter it only if your SSH server node is not the same as HTTP node.
@@ -116,11 +116,11 @@
 ; Network interface builtin SSH server listens on
 SSH_LISTEN_HOST =
 ; Port number to be exposed in clone URL
-SSH_PORT = 22
+SSH_PORT = 2222
 ; Port number builtin SSH server listens on
 SSH_LISTEN_PORT = %(SSH_PORT)s
 ; Root path of SSH directory, default is '~/.ssh', but you have to use '/home/git/.ssh'.
-SSH_ROOT_PATH =
+SSH_ROOT_PATH = /var/lib/gitea/ssh
 ; Directory to create temporary files when test public key using ssh-keygen,
 ; default is system temporary directory.
 SSH_KEY_TEST_PATH =
@@ -148,7 +148,7 @@
 ; default is the path where Gitea is executed
 STATIC_ROOT_PATH =
 ; Default path for App data
-APP_DATA_PATH = data
+APP_DATA_PATH = /var/lib/gitea/data
 ; Application level GZIP support
 ENABLE_GZIP = false
 ; Landing page for non-logged users, can be "home" or "explore"
@@ -156,7 +156,7 @@
 ; Enables git-lfs support. true or false, default is false.
 LFS_START_SERVER = false
 ; Where your lfs files put on, default is data/lfs.
-LFS_CONTENT_PATH = data/lfs
+LFS_CONTENT_PATH = /var/lib/gitea/data/lfs
 ; LFS authentication secret, changed this to yourself.
 LFS_JWT_SECRET   =
 
@@ -177,12 +177,12 @@
 ; For "postgres" only, either "disable", "require" or "verify-full"
 SSL_MODE = disable
 ; For "sqlite3" and "tidb", use absolute path when you start as service
-PATH = data/gitea.db
+PATH = /var/lib/gitea/data/gitea.db
 ; For "sqlite3" only. Query timeout
 SQLITE_TIMEOUT = 500
 
 [indexer]
-ISSUE_INDEXER_PATH = indexers/issues.bleve
+ISSUE_INDEXER_PATH = /var/lib/gitea/indexers/issues.bleve
 UPDATE_BUFFER_LEN = 20
 
 [admin]
@@ -193,7 +193,7 @@
 ; Whether the installer is disabled
 INSTALL_LOCK = false
 ; !!CHANGE THIS TO KEEP YOUR USER DATA SAFE!!
-SECRET_KEY = !#@FDEWREWR&*(
+SECRET_KEY = <SECRET_KEY>
 ; Auto-login remember days
 LOGIN_REMEMBER_DAYS = 7
 COOKIE_USERNAME = gitea_awesome
@@ -323,13 +323,13 @@
 
 [session]
 ; Either "memory", "file", or "redis", default is "memory"
-PROVIDER = memory
+PROVIDER = file
 ; Provider config options
 ; memory: not have any config yet
 ; file: session file path, e.g. `data/sessions`
 ; redis: network=tcp,addr=:6379,password=macaron,db=0,pool_size=100,idle_timeout=180
 ; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
-PROVIDER_CONFIG = data/sessions
+PROVIDER_CONFIG = /var/lib/gitea/data/sessions
 ; Session cookie name
 COOKIE_NAME = i_like_gitea
 ; If you use session in https only, default is false
@@ -342,7 +342,7 @@
 SESSION_LIFE_TIME = 86400
 
 [picture]
-AVATAR_UPLOAD_PATH = data/avatars
+AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars
 ; Chinese users can choose "duoshuo"
 ; or a custom avatar source, like: http://cn.gravatar.com/avatar/
 GRAVATAR_SOURCE = gravatar
@@ -357,7 +357,7 @@
 ; Whether attachments are enabled. Defaults to `true`
 ENABLE = true
 ; Path for attachments. Defaults to `data/attachments`
-PATH = data/attachments
+PATH = /var/lib/gitea/data/attachments
 ; One or more allowed types, e.g. image/jpeg|image/png
 ALLOWED_TYPES = image/jpeg|image/png|application/zip|application/gzip
 ; Max size of each file. Defaults to 32MB
@@ -372,14 +372,14 @@
 FORMAT =
 
 [log]
-ROOT_PATH =
+ROOT_PATH = /var/log/gitea/
 ; Either "console", "file", "conn", "smtp" or "database", default is "console"
 ; Use comma to separate multiple modes, e.g. "console, file"
-MODE = console
+MODE = file
 ; Buffer length of channel, keep it as it is if you don't know what it is.
 BUFFER_LEN = 10000
 ; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace"
-LEVEL = Trace
+LEVEL = Info
 
 ; For "console" mode only
 [log.console]
@@ -387,7 +387,7 @@
 
 ; For "file" mode only
 [log.file]
-LEVEL =
+LEVEL = Info
 ; This enables automated log rotate(switch of following options), default is true
 LOG_ROTATE = true
 ; Max line number of single file, default is 1000000