--- a/custom/conf/app.example.ini
+++ b/custom/conf/app.example.ini
@@ -15,7 +15,7 @@
 APP_NAME = ; Gitea: Git with a cup of tea
 ;;
 ;; RUN_USER will automatically detect the current user - but you can set it here change it if you run locally
-RUN_USER = ; git
+RUN_USER = _gitea
 ;;
 ;; Application run mode, affects performance and debugging. Either "dev", "prod" or "test", default is "prod"
 RUN_MODE = ; prod
@@ -58,7 +58,7 @@ RUN_MODE = ; prod
 ;PER_WRITE_PER_KB_TIMEOUT = 30s
 ;;
 ;; Permission for unix socket
-;UNIX_SOCKET_PERMISSION = 666
+UNIX_SOCKET_PERMISSION = 660
 ;;
 ;; Local (DMZ) URL for Gitea workers (such as SSH update) accessing web service.
 ;; In most cases you do not need to change the default value.
@@ -88,7 +88,7 @@ RUN_MODE = ; prod
 ;SSH_LISTEN_PORT = %(SSH_PORT)s
 ;;
 ;; Root path of SSH directory, default is '~/.ssh', but you have to use '/home/git/.ssh'.
-;SSH_ROOT_PATH =
+SSH_ROOT_PATH = /var/lib/gitea
 ;;
 ;; Gitea will create a authorized_keys file by default when it is not using the internal ssh server
 ;; If you intend to use the AuthorizedKeysCommand functionality then you should turn this off.
@@ -178,7 +178,7 @@ RUN_MODE = ; prod
 ;;
 ;; Root directory containing templates and static files.
 ;; default is the path where Gitea is executed
-;STATIC_ROOT_PATH =
+STATIC_ROOT_PATH = /var/lib/gitea
 ;;
 ;; Default path for App data
 ;APP_DATA_PATH = data
@@ -202,7 +202,7 @@ RUN_MODE = ; prod
 ;LFS_START_SERVER = false
 ;;
 ;; Where your lfs files reside, default is data/lfs.
-;LFS_CONTENT_PATH = data/lfs
+LFS_CONTENT_PATH = /var/lib/gitea/lfs
 ;;
 ;; LFS authentication secret, change this yourself
 LFS_JWT_SECRET =
@@ -243,10 +243,10 @@ LFS_JWT_SECRET =
 ;;
 ;; MySQL Configuration
 ;;
-DB_TYPE = mysql
-HOST = 127.0.0.1:3306 ; can use socket e.g. /var/run/mysqld/mysqld.sock
-NAME = gitea
-USER = root
+;DB_TYPE = mysql
+;HOST = 127.0.0.1:3306 ; can use socket e.g. /var/run/mysqld/mysqld.sock
+;NAME = gitea
+;USER = root
 ;PASSWD = ;Use PASSWD = `your password` for quoting if you use special characters in the password.
 ;SSL_MODE = false ; either "false" (default), "true", or "skip-verify"
 ;CHARSET = utf8mb4 ;either "utf8" or "utf8mb4", default is "utf8mb4".
@@ -269,8 +269,8 @@ USER = root
 ;;
 ;; SQLite Configuration
 ;;
-;DB_TYPE = sqlite3
-;PATH= ; defaults to data/gitea.db
+DB_TYPE = sqlite3
+PATH = /var/lib/gitea/data/gitea.db
 ;SQLITE_TIMEOUT = ; Query timeout defaults to: 500
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -431,7 +431,7 @@ TRUSTED_FACETS = ; e.g. http://localhost:3000/
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Root path for the log files - defaults to %(GITEA_WORK_DIR)/log
-;ROOT_PATH =
+ROOT_PATH = /var/log/gitea
 ;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Main Logger
@@ -736,7 +736,7 @@ PATH =
 ;[repository]
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Root path for storing all repository data. It must be an absolute path. By default, it is stored in a sub-directory of `APP_DATA_PATH`.
-;ROOT =
+ROOT = /var/lib/gitea/repositories
 ;;
 ;; The script type this server supports. Usually this is `bash`, but some users report that only `sh` is available.
 ;SCRIPT_TYPE = bash
@@ -834,7 +834,7 @@ PATH =
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
 ;; Path for local repository copy. Defaults to `tmp/local-repo`
-;LOCAL_COPY_PATH = tmp/local-repo
+LOCAL_COPY_PATH = /var/lib/gitea/tmp/local-repo
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -846,7 +846,7 @@ PATH =
 ;ENABLED = true
 ;;
 ;; Path for uploads. Defaults to `data/tmp/uploads` (tmp gets deleted on gitea restart)
-;TEMP_PATH = data/tmp/uploads
+TEMP_PATH = /var/lib/gitea/uploads
 ;;
 ;; Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types.
 ;ALLOWED_TYPES =
@@ -1172,7 +1172,7 @@ PATH =
 ;ISSUE_INDEXER_TYPE = bleve
 ;;
 ;; Issue indexer storage path, available when ISSUE_INDEXER_TYPE is bleve
-;ISSUE_INDEXER_PATH = indexers/issues.bleve
+ISSUE_INDEXER_PATH = /var/lib/gitea/indexers/issues.bleve
 ;;
 ;; Issue indexer connection string, available when ISSUE_INDEXER_TYPE is elasticsearch
 ;ISSUE_INDEXER_CONN_STR = http://elastic:changeme@localhost:9200
@@ -1543,7 +1543,7 @@ PATH =
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;
-;AVATAR_UPLOAD_PATH = data/avatars
+AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars
 ;REPOSITORY_AVATAR_UPLOAD_PATH = data/repo-avatars
 ;;
 ;; How Gitea deals with missing repository avatars
