diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini
index ef276e4..5795308 100644
--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -44,7 +44,7 @@
 ;APP_NAME = Gitea: Git with a cup of tea
 ;;
 ;; RUN_USER will automatically detect the current user - but you can set it here change it if you run locally
-;RUN_USER =
+RUN_USER = _gitea
 ;;
 ;; Application run mode, affects performance and debugging: "dev" or "prod", default is "prod"
 ;; Mode "dev" makes Gitea easier to develop and debug, values other than "dev" are treated as "prod" which is for production use.
@@ -129,7 +129,7 @@
 ;PER_WRITE_PER_KB_TIMEOUT = 30s
 ;;
 ;; Permission for unix socket
-;UNIX_SOCKET_PERMISSION = 666
+UNIX_SOCKET_PERMISSION = 660
 ;;
 ;; Local (DMZ) URL for Gitea workers (such as SSH update) accessing web service. In
 ;; most cases you do not need to change the default value. Alter it only if
@@ -177,7 +177,7 @@
 ;;
 ;; Root path of SSH user directory for the system's standalone SSH server if Gitea is not using its builtin SSH server.
 ;; Default is the '.ssh' directory in the run user's home directory.
-;SSH_ROOT_PATH =
+SSH_ROOT_PATH = /var/lib/gitea/.ssh
 ;;
 ;; Gitea will create an authorized_keys file by default when it is not using the builtin SSH server
 ;; If you intend to use the AuthorizedKeysCommand functionality then you should turn this off.
@@ -282,7 +282,7 @@
 ;;
 ;; Root directory containing templates and static files.
 ;; default is the path where Gitea is executed
-;STATIC_ROOT_PATH = ; Will default to the built-in value _`StaticRootPath`_
+STATIC_ROOT_PATH = /var/lib/gitea
 ;;
 ;; Default path for App data
 ;APP_DATA_PATH = data ; relative paths will be made absolute with _`AppWorkPath`_
@@ -357,10 +357,10 @@
 ;;
 ;; MySQL Configuration
 ;;
-DB_TYPE = mysql
-HOST = 127.0.0.1:3306 ; can use socket e.g. /var/run/mysqld/mysqld.sock
-NAME = gitea
-USER = root
+;DB_TYPE = mysql
+;HOST = 127.0.0.1:3306 ; can use socket e.g. /var/run/mysqld/mysqld.sock
+;NAME = gitea
+;USER = root
 ;PASSWD = ;Use PASSWD = `your password` for quoting if you use special characters in the password.
 ;SSL_MODE = false ; either "false" (default), "true", or "skip-verify"
 ;CHARSET_COLLATION = ; Empty as default, Gitea will try to find a case-sensitive collation. Don't change it unless you clearly know what you need.
@@ -381,8 +381,8 @@ USER = root
 ;;
 ;; SQLite Configuration
 ;;
-;DB_TYPE = sqlite3
-;PATH= ; defaults to data/gitea.db
+DB_TYPE = sqlite3
+PATH = /var/lib/gitea/data/gitea.db
 ;SQLITE_TIMEOUT = ; Query timeout defaults to: 500
 ;SQLITE_JOURNAL_MODE = ; defaults to sqlite database default (often DELETE), can be used to enable WAL mode. https://www.sqlite.org/pragma.html#pragma_journal_mode
 ;;
@@ -599,7 +599,7 @@ ENABLED = true
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Root path for the log files - defaults to "{AppWorkPath}/log"
-;ROOT_PATH =
+ROOT_PATH = /var/log/gitea
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Main Logger
@@ -988,11 +988,11 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[repository]
+[repository]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Root path for storing all repository data. By default, it is set to "{APP_DATA_PATH}/gitea-repositories".
 ;; A relative path is interpreted as "{AppWorkPath}/{ROOT}" (use AppWorkPath as base path).
-;ROOT =
+ROOT = /var/lib/gitea/repositories
 ;;
 ;; The script type this server supports. Usually this is `bash`, but some users report that only `sh` is available.
 ;SCRIPT_TYPE = bash
@@ -1103,7 +1103,7 @@ LEVEL = Info
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[repository.upload]
+[repository.upload]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -1504,7 +1504,7 @@ LEVEL = Info
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[indexer]
+[indexer]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
@@ -1515,7 +1515,7 @@ LEVEL = Info
 ;ISSUE_INDEXER_TYPE = bleve
 ;;
 ;; Issue indexer storage path, available when ISSUE_INDEXER_TYPE is bleve
-;ISSUE_INDEXER_PATH = indexers/issues.bleve ; Relative paths will be made absolute against _`AppWorkPath`_.
+ISSUE_INDEXER_PATH = /var/lib/gitea/indexers/issues.bleve
 ;;
 ;; Issue indexer connection string, available when ISSUE_INDEXER_TYPE is elasticsearch (e.g. http://elastic:password@localhost:9200) or meilisearch (e.g. http://:apikey@localhost:7700)
 ;ISSUE_INDEXER_CONN_STR =
@@ -1954,11 +1954,11 @@ LEVEL = Info
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;[picture]
+[picture]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;AVATAR_UPLOAD_PATH = data/avatars
+AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars
 ;REPOSITORY_AVATAR_UPLOAD_PATH = data/repo-avatars
 ;;
 ;; How Gitea deals with missing repository avatars
@@ -2841,11 +2841,11 @@ LEVEL = Info
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; lfs storage will override storage
 ;;
-;[lfs]
+[lfs]
 ;STORAGE_TYPE = local
 ;;
 ;; Where your lfs files reside, default is data/lfs.
-;PATH = data/lfs
+PATH = /var/lib/gitea/lfs
 ;;
 ;; Allows the storage driver to redirect to authenticated URLs to serve files directly
 ;; Currently, only `minio` and `azureblob` is supported.
