Index: custom/conf/app.example.ini
--- custom/conf/app.example.ini.orig
+++ custom/conf/app.example.ini
@@ -15,7 +15,7 @@
 APP_NAME = ; Gitea: Git with a cup of tea
 ;;
 ;; RUN_USER will automatically detect the current user - but you can set it here change it if you run locally
-RUN_USER = ; git
+RUN_USER = _forgejo
 ;;
 ;; Application run mode, affects performance and debugging. Either "dev", "prod" or "test", default is "prod"
 RUN_MODE = ; prod
@@ -95,7 +95,7 @@ RUN_MODE = ; prod
 ;SSH_LISTEN_HOST =
 ;;
 ;; Port number to be exposed in clone URL
-;SSH_PORT = 22
+SSH_PORT =
 ;;
 ;; The port number the builtin SSH server should listen on
 ;SSH_LISTEN_PORT = %(SSH_PORT)s
@@ -224,7 +224,7 @@ RUN_MODE = ; prod
 ;STATIC_ROOT_PATH =
 ;;
 ;; Default path for App data
-;APP_DATA_PATH = data
+APP_DATA_PATH = ${LOCALSTATEDIR}/forgejo/data
 ;;
 ;; Enable gzip compression for runtime-generated content, static resources excluded
 ;ENABLE_GZIP = false
@@ -235,7 +235,7 @@ RUN_MODE = ; prod
 ;ENABLE_PPROF = false
 ;;
 ;; PPROF_DATA_PATH, use an absolute path when you start forgejo as service
-;PPROF_DATA_PATH = data/tmp/pprof
+PPROF_DATA_PATH = ${LOCALSTATEDIR}/forgejo/data/tmp/pprof
 ;;
 ;; Landing page, can be "home", "explore", "organizations", "login", or any URL such as "/org/repo" or even "https://anotherwebsite.com"
 ;; The "login" choice is not a security measure but just a UI flow change, use REQUIRE_SIGNIN_VIEW to force users to log in.
@@ -284,10 +284,10 @@ LFS_JWT_SECRET =
 ;;
 ;; MySQL Configuration
 ;;
-DB_TYPE = mysql
-HOST = 127.0.0.1:3306 ; can use socket e.g. /var/run/mysqld/mysqld.sock
-NAME = forgejo
-USER = root
+;DB_TYPE = mysql
+;HOST = 127.0.0.1:3306 ; can use socket e.g. /var/run/mysqld/mysqld.sock
+;NAME = forgejo
+;USER = root
 ;PASSWD = ;Use PASSWD = `your password` for quoting if you use special characters in the password.
 ;SSL_MODE = false ; either "false" (default), "true", or "skip-verify"
 ;CHARSET = utf8mb4 ;either "utf8" or "utf8mb4", default is "utf8mb4".
@@ -299,9 +299,9 @@ USER = root
 ;; Postgres Configuration
 ;;
 ;DB_TYPE = postgres
-;HOST = 127.0.0.1:5432 ; can use socket e.g. /var/run/postgresql/
+;HOST = /tmp
 ;NAME = forgejo
-;USER = root
+;USER = %(RUN_USER)s
 ;PASSWD =
 ;SCHEMA =
 ;SSL_MODE=disable ;either "disable" (default), "require", or "verify-full"
@@ -310,8 +310,8 @@ USER = root
 ;;
 ;; SQLite Configuration
 ;;
-;DB_TYPE = sqlite3
-;PATH= ; defaults to data/forgejo.db
+DB_TYPE = sqlite3
+PATH = ${LOCALSTATEDIR}/forgejo/data/forgejo.db
 ;SQLITE_TIMEOUT = ; Query timeout defaults to: 500
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -362,7 +362,7 @@ INSTALL_LOCK = false
 SECRET_KEY =
 ;;
 ;; Secret used to validate communication within Gitea binary.
-INTERNAL_TOKEN=
+INTERNAL_TOKEN =
 ;;
 ;; Instead of defining internal token in the configuration, this configuration option can be used to give Gitea a path to a file that contains the internal token (example value: file:/etc/forgejo/internal_token)
 ;INTERNAL_TOKEN_URI = ;e.g. /etc/forgejo/internal_token
@@ -397,7 +397,7 @@ INTERNAL_TOKEN=
 ;; This enables the users to access and modify this config file and the Gitea database and interrupt the Gitea service.
 ;; By modifying the Gitea database, users can gain Gitea administrator privileges.
 ;; It also enables them to access other resources available to the user on the operating system that is running the Gitea instance and perform arbitrary actions in the name of the Gitea OS user.
-;; WARNING: This maybe harmful to you website or your operating system.
+;; WARNING: This maybe harmful to your website or your operating system.
 ;; WARNING: Setting this to true does not change existing hooks in git repos; adjust it before if necessary.
 ;DISABLE_GIT_HOOKS = true
 ;;
@@ -457,7 +457,7 @@ ENABLE = true
 ;; Private key file path used to sign OAuth2 tokens. The path is relative to APP_DATA_PATH.
 ;; This setting is only needed if JWT_SIGNING_ALGORITHM is set to RS256, RS384, RS512, ES256, ES384 or ES512.
 ;; The file must contain a RSA or ECDSA private key in the PKCS8 format. If no key exists a 4096 bit key will be created for you.
-;JWT_SIGNING_PRIVATE_KEY_FILE = jwt/private.pem
+JWT_SIGNING_PRIVATE_KEY_FILE = ${LOCALSTATEDIR}/forgejo/jwt/private.pem
 ;;
 ;; OAuth2 authentication secret for access and refresh tokens, change this yourself to a unique string. CLI generate option is helpful in this case. https://docs.forgejo.io/en-us/command-line/#generate
 ;; This setting is only needed if JWT_SIGNING_ALGORITHM is set to HS256, HS384 or HS512.
@@ -477,7 +477,7 @@ ENABLE = true
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-[U2F]
+;[U2F]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -486,7 +486,7 @@ ENABLE = true
 ;; https://developers.yubico.com/U2F/App_ID.html
 ;;
 ;; DEPRECATED - this only applies to previously registered security keys using the U2F standard
-APP_ID = ; e.g. http://localhost:3000/
+;APP_ID = ; e.g. http://localhost:3000/
 
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -495,14 +495,14 @@ APP_ID = ; e.g. http://localhost:3000/
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Root path for the log files - defaults to %(GITEA_WORK_DIR)/log
-;ROOT_PATH =
+ROOT_PATH = ${LOCALSTATEDIR}/log/forgejo
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Main Logger
 ;;
 ;; Either "console", "file", "conn", "smtp" or "database", default is "console"
 ;; Use comma to separate multiple modes, e.g. "console, file"
-MODE = console
+MODE = file
 ;;
 ;; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical" or "None", default is "Info"
 LEVEL = Info
@@ -683,7 +683,7 @@ ROUTER = console
 ;EMAIL_DOMAIN_BLOCKLIST =
 ;;
 ;; Disallow registration, only allow admins to create accounts.
-;DISABLE_REGISTRATION = false
+DISABLE_REGISTRATION = true
 ;;
 ;; Allow registration only using forgejo itself, it works only when DISABLE_REGISTRATION is false
 ;ALLOW_ONLY_INTERNAL_REGISTRATION = false
@@ -692,7 +692,7 @@ ROUTER = console
 ;ALLOW_ONLY_EXTERNAL_REGISTRATION = false
 ;;
 ;; User must sign in to view anything.
-;REQUIRE_SIGNIN_VIEW = false
+REQUIRE_SIGNIN_VIEW = true
 ;;
 ;; Mail notification
 ;ENABLE_NOTIFY_MAIL = false
@@ -727,11 +727,11 @@ ROUTER = console
 ;;
 ;; Default value for KeepEmailPrivate
 ;; Each new user will get the value of this setting copied into their profile
-;DEFAULT_KEEP_EMAIL_PRIVATE = false
+DEFAULT_KEEP_EMAIL_PRIVATE = true
 ;;
 ;; Default value for AllowCreateOrganization
 ;; Every new user will have rights set to create organizations depending on this setting
-;DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ALLOW_CREATE_ORGANIZATION = false
 ;; Default value for IsRestricted
 ;; Every new user will have restricted permissions depending on this setting
 ;DEFAULT_USER_IS_RESTRICTED = false
@@ -740,7 +740,7 @@ ROUTER = console
 ;; Limited is for users visible only to signed users
 ;; Private is for users visible only to members of their organizations
 ;; Public is for users visible for everyone
-;DEFAULT_USER_VISIBILITY = public
+DEFAULT_USER_VISIBILITY = private
 ;;
 ;; Set which visibility modes a user can have
 ;ALLOWED_USER_VISIBILITY_MODES = public,limited,private
@@ -749,7 +749,7 @@ ROUTER = console
 ;; Limited is for organizations visible only to signed users
 ;; Private is for organizations visible only to members of the organization
 ;; Public is for organizations visible to everyone
-;DEFAULT_ORG_VISIBILITY = public
+DEFAULT_ORG_VISIBILITY = private
 ;;
 ;; Default value for DefaultOrgMemberVisible
 ;; True will make the membership of the users visible when added to the organisation
@@ -818,10 +818,10 @@ ROUTER = console
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Root path for storing all repository data. By default, it is set to %(APP_DATA_PATH)/forgejo-repositories.
 ;; A relative path is interpreted as %(GITEA_WORK_DIR)/%(ROOT)
-;ROOT =
+ROOT = ${LOCALSTATEDIR}/forgejo/forgejo-repositories
 ;;
 ;; The script type this server supports. Usually this is `bash`, but some users report that only `sh` is available.
-;SCRIPT_TYPE = bash
+SCRIPT_TYPE = sh
 ;;
 ;; DETECTED_CHARSETS_ORDER tie-break order for detected charsets.
 ;; If the charsets have equal confidence, tie-breaking will be done by order in this list
@@ -836,7 +836,7 @@ ROUTER = console
 ;FORCE_PRIVATE = false
 ;;
 ;; Default privacy setting when creating a new repository, allowed values: last, private, public. Default is last which means the last setting used.
-;DEFAULT_PRIVATE = last
+DEFAULT_PRIVATE = private
 ;;
 ;; Default private when using push-to-create
 ;DEFAULT_PUSH_CREATE_PRIVATE = true
@@ -852,7 +852,7 @@ ROUTER = console
 ;;
 ;; Preferred Licenses to place at the top of the List
 ;; The name here must match the filename in options/license or custom/options/license
-;PREFERRED_LICENSES = Apache License 2.0,MIT License
+PREFERRED_LICENSES = BSD-2-Clause,ISC ; Apache License 2.0,MIT License
 ;;
 ;; Disable the ability to interact with repositories using the HTTP protocol
 ;DISABLE_HTTP_GIT = false
@@ -911,16 +911,16 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[repository.local]
+[repository.local]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Path for local repository copy. Defaults to `tmp/local-repo` (content gets deleted on forgejo restart)
-;LOCAL_COPY_PATH = tmp/local-repo
+LOCAL_COPY_PATH = ${LOCALSTATEDIR}/forgejo/tmp/local-repo
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[repository.upload]
+[repository.upload]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -928,7 +928,7 @@ ROUTER = console
 ;ENABLED = true
 ;;
 ;; Path for uploads. Defaults to `data/tmp/uploads` (content gets deleted on forgejo restart)
-;TEMP_PATH = data/tmp/uploads
+TEMP_PATH = ${LOCALSTATEDIR}/forgejo/data/tmp/uploads
 ;;
 ;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
 ;ALLOWED_TYPES =
@@ -1087,7 +1087,7 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[ui]
+[ui]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -1118,7 +1118,7 @@ ROUTER = console
 ;MAX_DISPLAY_FILE_SIZE = 8388608
 ;;
 ;; Whether the email of the user should be shown in the Explore Users page
-;SHOW_USER_EMAIL = true
+SHOW_USER_EMAIL = false
 ;;
 ;; Set the default theme for the Gitea install
 ;DEFAULT_THEME = auto
@@ -1253,7 +1253,7 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[indexer]
+[indexer]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -1264,7 +1264,7 @@ ROUTER = console
 ;ISSUE_INDEXER_TYPE = bleve
 ;;
 ;; Issue indexer storage path, available when ISSUE_INDEXER_TYPE is bleve
-;ISSUE_INDEXER_PATH = indexers/issues.bleve
+ISSUE_INDEXER_PATH = ${LOCALSTATEDIR}/forgejo/indexers/issues.bleve
 ;;
 ;; Issue indexer connection string, available when ISSUE_INDEXER_TYPE is elasticsearch
 ;ISSUE_INDEXER_CONN_STR = http://elastic:changeme@localhost:9200
@@ -1282,7 +1282,7 @@ ROUTER = console
 ;; When ISSUE_INDEXER_QUEUE_TYPE is levelqueue, this will be the path where the queue will be saved.
 ;; This can be overridden by `ISSUE_INDEXER_QUEUE_CONN_STR`.
 ;; default is queues/common
-;ISSUE_INDEXER_QUEUE_DIR = queues/common; **DEPRECATED** use settings in `[queue.issue_indexer]`.
+ISSUE_INDEXER_QUEUE_DIR = ${LOCALSTATEDIR}/forgejo/indexers/issues.queue; **DEPRECATED** use settings in `[queue.issue_indexer]`.
 ;;
 ;; When `ISSUE_INDEXER_QUEUE_TYPE` is `redis`, this will store the redis connection string.
 ;; When `ISSUE_INDEXER_QUEUE_TYPE` is `levelqueue`, this is a directory or additional options of
@@ -1303,7 +1303,7 @@ ROUTER = console
 ;REPO_INDEXER_TYPE = bleve
 ;;
 ;; Index file used for code search. available when `REPO_INDEXER_TYPE` is bleve
-;REPO_INDEXER_PATH = indexers/repos.bleve
+REPO_INDEXER_PATH = ${LOCALSTATEDIR}/forgejo/indexers/repos.bleve
 ;;
 ;; Code indexer connection string, available when `REPO_INDEXER_TYPE` is elasticsearch. i.e. http://elastic:changeme@localhost:9200
 ;REPO_INDEXER_CONN_STR =
@@ -1383,19 +1383,19 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[admin]
+[admin]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Disallow regular (non-admin) users from creating organizations.
-;DISABLE_REGULAR_ORG_CREATION = false
+DISABLE_REGULAR_ORG_CREATION = true
 ;;
 ;; Default configuration for email notifications for users (user configurable). Options: enabled, onmention, disabled
 ;DEFAULT_EMAIL_NOTIFICATIONS = enabled
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[openid]
+[openid]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -1416,7 +1416,7 @@ ROUTER = console
 ;;  - <username>.livejournal.com
 ;;
 ;; Whether to allow signin in via OpenID
-;ENABLE_OPENID_SIGNIN = true
+ENABLE_OPENID_SIGNIN = false
 ;;
 ;; Whether to allow registering via OpenID
 ;; Do not include to rely on rhw DISABLE_REGISTRATION setting
@@ -1501,7 +1501,7 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[mailer]
+[mailer]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -1518,7 +1518,7 @@ ROUTER = console
 ;; QQ: smtp.qq.com:465
 ;; As per RFC 8314 using Implicit TLS/SMTPS on port 465 (if supported) is recommended,
 ;; otherwise STARTTLS on port 587 should be used.
-;HOST =
+HOST = localhost:25
 ;;
 ;; Disable HELO operation when hostnames are different.
 ;DISABLE_HELO =
@@ -1531,15 +1531,15 @@ ROUTER = console
 ;;
 ;; Use client certificate
 ;USE_CERTIFICATE = false
-;CERT_FILE = custom/mailer/cert.pem
-;KEY_FILE = custom/mailer/key.pem
+CERT_FILE = ${LOCALSTATEDIR}/forgejo/custom/mailer/cert.pem
+KEY_FILE = ${LOCALSTATEDIR}/forgejo/custom/mailer/key.pem
 ;;
 ;; Should SMTP connect with TLS, (if port ends with 465 TLS will always be used.)
 ;; If this is false but STARTTLS is supported the connection will be upgraded to TLS opportunistically.
 ;IS_TLS_ENABLED = false
 ;;
 ;; Mail from address, RFC 5322. This can be just an email address, or the `"Name" <email@example.com>` format
-;FROM =
+FROM = forgejo@%(DOMAIN)s
 ;;
 ;; Sometimes it is helpful to use a different address on the envelope. Set this to use ENVELOPE_FROM as the from on the envelope. Set to `<>` to send an empty address.
 ;ENVELOPE_FROM =
@@ -1552,13 +1552,13 @@ ROUTER = console
 ;PASSWD =
 ;;
 ;; Send mails as plain text
-;SEND_AS_PLAIN_TEXT = false
+SEND_AS_PLAIN_TEXT = true
 ;;
 ;; Set Mailer Type (either SMTP, sendmail or dummy to just send to the log)
 ;MAILER_TYPE = smtp
 ;;
 ;; Specify an alternative sendmail binary
-;SENDMAIL_PATH = sendmail
+SENDMAIL_PATH = /usr/sbin/sendmail
 ;;
 ;; Specify any extra sendmail arguments
 ;; WARNING: if your sendmail program interprets options you should set this to "--" or terminate these args with "--"
@@ -1614,20 +1614,20 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[session]
+[session]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Either "memory", "file", "redis", "db", "mysql", "couchbase", "memcache" or "postgres"
 ;; Default is "memory". "db" will reuse the configuration in [database]
-;PROVIDER = memory
+PROVIDER = file
 ;;
 ;; Provider config options
 ;; memory: doesn't have any config yet
 ;; file: session file path, e.g. `data/sessions`
 ;; redis: network=tcp,addr=:6379,password=macaron,db=0,pool_size=100,idle_timeout=180
 ;; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
-;PROVIDER_CONFIG = data/sessions
+PROVIDER_CONFIG = ${LOCALSTATEDIR}/forgejo/data/sessions
 ;;
 ;; Session cookie name
 ;COOKIE_NAME = i_like_forgejo
@@ -1646,12 +1646,12 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[picture]
+[picture]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;AVATAR_UPLOAD_PATH = data/avatars
-;REPOSITORY_AVATAR_UPLOAD_PATH = data/repo-avatars
+AVATAR_UPLOAD_PATH = ${LOCALSTATEDIR}/forgejo/data/avatars
+REPOSITORY_AVATAR_UPLOAD_PATH = ${LOCALSTATEDIR}/forgejo/data/repo-avatars
 ;;
 ;; How Gitea deals with missing repository avatars
 ;; none = no avatar will be displayed; random = random avatar will be displayed; image = default image will be used
@@ -1676,7 +1676,7 @@ ROUTER = console
 ;GRAVATAR_SOURCE = gravatar
 ;;
 ;; This value will always be true in offline mode.
-;DISABLE_GRAVATAR = false
+DISABLE_GRAVATAR = true
 ;;
 ;; Federated avatar lookup uses DNS to discover avatar associated
 ;; with emails, see https://www.libravatar.org
@@ -1685,7 +1685,7 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[attachment]
+[attachment]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -1710,7 +1710,7 @@ ROUTER = console
 ;SERVE_DIRECT = false
 ;;
 ;; Path for attachments. Defaults to `data/attachments` only available when STORAGE_TYPE is `local`
-;PATH = data/attachments
+PATH = ${LOCALSTATEDIR}/forgejo/data/attachments
 ;;
 ;; Minio endpoint to connect only available when STORAGE_TYPE is `minio`
 ;MINIO_ENDPOINT = localhost:9000
@@ -1735,14 +1735,14 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[time]
+[time]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Specifies the format for fully outputted dates. Defaults to RFC1123
 ;; Special supported values are ANSIC, UnixDate, RubyDate, RFC822, RFC822Z, RFC850, RFC1123, RFC1123Z, RFC3339, RFC3339Nano, Kitchen, Stamp, StampMilli, StampMicro and StampNano
 ;; For more information about the format see http://golang.org/pkg/time/#pkg-constants
-;FORMAT =
+FORMAT = RFC1123Z
 ;;
 ;; Location the UI time display i.e. Asia/Shanghai
 ;; Empty means server's location setting
@@ -2143,14 +2143,14 @@ ROUTER = console
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[other]
+[other]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;SHOW_FOOTER_BRANDING = false
 ;; Show version information about Gitea and Go in the footer
-;SHOW_FOOTER_VERSION = true
+SHOW_FOOTER_VERSION = false
 ;; Show template execution time in the footer
-;SHOW_FOOTER_TEMPLATE_LOAD_TIME = true
+SHOW_FOOTER_TEMPLATE_LOAD_TIME = false
 
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2268,7 +2268,7 @@ ROUTER = console
 ;ENABLED = true
 ;;
 ;; Path for chunked uploads. Defaults to APP_DATA_PATH + `tmp/package-upload`
-;CHUNKED_UPLOAD_PATH = tmp/package-upload
+CHUNKED_UPLOAD_PATH = ${LOCALSTATEDIR}/forgejo/data/tmp/package-upload
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -2298,7 +2298,7 @@ ROUTER = console
 ;STORAGE_TYPE = local
 ;;
 ;; Where your lfs files reside, default is data/lfs.
-;PATH = data/lfs
+;PATH = ${LOCALSTATEDIR}/forgejo/data/lfs
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;