--- custom/conf/app.example.ini	2020-12-29 05:19:36.000000000 +1100
+++ custom/conf/app.example.ini	2021-01-04 20:50:52.849861177 +1100
@@ -7,7 +7,7 @@
 ; App name that shows in every page title
 APP_NAME = Gitea: Git with a cup of tea
 ; Change it if you run locally
-RUN_USER = git
+RUN_USER = _gitea
 ; Application run mode, affects performance and debugging. Either "dev", "prod" or "test", default is "prod"
 RUN_MODE = prod
 
@@ -17,7 +17,7 @@
 PROJECT_BOARD_BUG_TRIAGE_TYPE = Needs Triage, High Priority, Low Priority, Closed
 
 [repository]
-ROOT =
+ROOT = /var/lib/gitea/repositories
 SCRIPT_TYPE = bash
 ; DETECTED_CHARSETS_ORDER tie-break order for detected charsets.
 ; If the charsets have equal confidence, tie-breaking will be done by order in this list
@@ -81,13 +81,13 @@
 
 [repository.local]
 ; Path for local repository copy. Defaults to `tmp/local-repo`
-LOCAL_COPY_PATH = tmp/local-repo
+LOCAL_COPY_PATH = /var/lib/gitea/tmp/local-repo
 
 [repository.upload]
 ; Whether repository file uploads are enabled. Defaults to `true`
 ENABLED = true
 ; Path for uploads. Defaults to `data/tmp/uploads` (tmp gets deleted on gitea restart)
-TEMP_PATH = data/tmp/uploads
+TEMP_PATH = /var/lib/gitea/tmp/uploads
 ; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
 ALLOWED_TYPES =
 ; Max size of each file in megabytes. Defaults to 3MB
@@ -272,7 +272,7 @@
 REDIRECT_OTHER_PORT = false
 PORT_TO_REDIRECT = 80
 ; Permission for unix socket
-UNIX_SOCKET_PERMISSION = 666
+UNIX_SOCKET_PERMISSION = 660
 ; Local (DMZ) URL for Gitea workers (such as SSH update) accessing web service.
 ; In most cases you do not need to change the default value.
 ; Alter it only if your SSH server node is not the same as HTTP node.
@@ -293,7 +293,7 @@
 ; The port number the builtin SSH server should listen on
 SSH_LISTEN_PORT = %(SSH_PORT)s
 ; Root path of SSH directory, default is '~/.ssh', but you have to use '/home/git/.ssh'.
-SSH_ROOT_PATH =
+SSH_ROOT_PATH = /var/lib/gitea
 ; Gitea will create a authorized_keys file by default when it is not using the internal ssh server
 ; If you intend to use the AuthorizedKeysCommand functionality then you should turn this off.
 SSH_CREATE_AUTHORIZED_KEYS_FILE = true
@@ -354,7 +354,7 @@
 KEY_FILE = https/key.pem
 ; Root directory containing templates and static files.
 ; default is the path where Gitea is executed
-STATIC_ROOT_PATH =
+STATIC_ROOT_PATH = /var/lib/gitea
 ; Default path for App data
 APP_DATA_PATH = data
 ; Application level GZIP support
@@ -371,7 +371,7 @@
 ; Enables git-lfs support. true or false, default is false.
 LFS_START_SERVER = false
 ; Where your lfs files reside, default is data/lfs.
-LFS_CONTENT_PATH = data/lfs
+LFS_CONTENT_PATH = /var/lib/gitea/lfs
 ; LFS authentication secret, change this yourself
 LFS_JWT_SECRET =
 ; LFS authentication validity period (in time.Duration), pushes taking longer than this may fail.
@@ -401,7 +401,7 @@
 
 [database]
 ; Database to use. Either "mysql", "postgres", "mssql" or "sqlite3".
-DB_TYPE = mysql
+DB_TYPE = sqlite3
 HOST = 127.0.0.1:3306
 NAME = gitea
 USER = root
@@ -418,7 +418,7 @@
 ; NOTICE: for "utf8mb4" you must use MySQL InnoDB > 5.6. Gitea is unable to check this.
 CHARSET = utf8mb4
 ; For "sqlite3" and "tidb", use an absolute path when you start gitea as service
-PATH = data/gitea.db
+PATH = /var/lib/gitea/data/gitea.db
 ; For "sqlite3" only. Query timeout
 SQLITE_TIMEOUT = 500
 ; For iterate buffer, default is 50
@@ -444,7 +444,7 @@
 ; Issue indexer name, available when ISSUE_INDEXER_TYPE is elasticsearch
 ISSUE_INDEXER_NAME = gitea_issues
 ; Issue indexer storage path, available when ISSUE_INDEXER_TYPE is bleve
-ISSUE_INDEXER_PATH = indexers/issues.bleve
+ISSUE_INDEXER_PATH = /var/lib/gitea/indexers/issues.bleve
 ; Issue indexer queue, currently support: channel, levelqueue or redis, default is levelqueue
 ISSUE_INDEXER_QUEUE_TYPE = levelqueue
 ; When ISSUE_INDEXER_QUEUE_TYPE is levelqueue, this will be the queue will be saved path,
@@ -773,7 +773,7 @@
 SESSION_LIFE_TIME = 86400
 
 [picture]
-AVATAR_UPLOAD_PATH = data/avatars
+AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars
 REPOSITORY_AVATAR_UPLOAD_PATH = data/repo-avatars
 ; How Gitea deals with missing repository avatars
 ; none = no avatar will be displayed; random = random avatar will be displayed; image = default image will be used
@@ -838,7 +838,7 @@
 DEFAULT_UI_LOCATION =
 
 [log]
-ROOT_PATH =
+ROOT_PATH = /var/log/gitea
 ; Either "console", "file", "conn", "smtp" or "database", default is "console"
 ; Use comma to separate multiple modes, e.g. "console, file"
 MODE = console
@@ -1132,14 +1132,6 @@
 LANGS = en-US,zh-CN,zh-HK,zh-TW,de-DE,fr-FR,nl-NL,lv-LV,ru-RU,uk-UA,ja-JP,es-ES,pt-BR,pt-PT,pl-PL,bg-BG,it-IT,fi-FI,tr-TR,cs-CZ,sr-SP,sv-SE,ko-KR
 NAMES = English,简体中文,繁體中文（香港）,繁體中文（台灣）,Deutsch,français,Nederlands,latviešu,русский,Українська,日本語,español,português do Brasil,Português de Portugal,polski,български,italiano,suomi,Türkçe,čeština,српски,svenska,한국어
 
-[U2F]
-; NOTE: THE DEFAULT VALUES HERE WILL NEED TO BE CHANGED
-; Two Factor authentication with security keys
-; https://developers.yubico.com/U2F/App_ID.html
-;APP_ID = http://localhost:3000/
-; Comma separated list of trusted facets
-;TRUSTED_FACETS = http://localhost:3000/
-
 ; Extension mapping to highlight class
 ; e.g. .toml=ini
 [highlight.mapping]