diff --git a/states/gitea/app.ini b/states/gitea/app.ini
index e8c6998..1ca7482 100644
--- a/states/gitea/app.ini
+++ b/states/gitea/app.ini
@@ -1,31 +1,32 @@
 APP_NAME = Gitea: Git with a cup of tea
 RUN_USER = gitea
 RUN_MODE = prod
+WORK_PATH = /var/lib/gitea/
 
 [database]
-DB_TYPE  = sqlite3
-HOST     = 127.0.0.1:5432
-NAME     = gitea
-USER     = gitea
-PASSWD   = 
-SCHEMA   = 
+DB_TYPE = sqlite3
+HOST = 127.0.0.1:5432
+NAME = gitea
+USER = gitea
+PASSWD = 
+SCHEMA = 
 SSL_MODE = disable
-CHARSET  = utf8
-PATH     = /var/lib/gitea/data/gitea.db
-LOG_SQL  = false
+CHARSET = utf8
+PATH = /var/lib/gitea/data/gitea.db
+LOG_SQL = false
 
 [repository]
 ROOT = /var/lib/gitea/data/gitea-repositories
 
 [server]
-SSH_DOMAIN       = git.lunch.org.uk
-DOMAIN           = git.lunch.org.uk
-HTTP_PORT        = 3000
-ROOT_URL         = https://git.lunch.org.uk/
-DISABLE_SSH      = false
+SSH_DOMAIN = git.lunch.org.uk
+DOMAIN = git.lunch.org.uk
+HTTP_PORT = 3000
+ROOT_URL = https://git.lunch.org.uk/
+DISABLE_SSH = false
 LFS_START_SERVER = true
-LFS_JWT_SECRET   = {{ pillar['gitea']['lfs_jwt_secret'] }}
-OFFLINE_MODE     = false
+LFS_JWT_SECRET = {{ pillar['gitea']['lfs_jwt_secret'] }}
+OFFLINE_MODE = false
 
 [lfs]
 PATH = /var/lib/gitea/data/lfs
@@ -34,24 +35,24 @@ PATH = /var/lib/gitea/data/lfs
 ENABLED = true
 SMTP_ADDR = mail.lunch.org.uk
 SMTP_PORT = 587
-FROM    = gitea@lunch.org.uk
-USER    = 
-PASSWD  = 
+FROM = gitea@lunch.org.uk
+USER = 
+PASSWD = 
 
 [service]
-REGISTER_EMAIL_CONFIRM            = false
-ENABLE_NOTIFY_MAIL                = false
-DISABLE_REGISTRATION              = false
-ALLOW_ONLY_EXTERNAL_REGISTRATION  = false
-ENABLE_CAPTCHA                    = false
-REQUIRE_SIGNIN_VIEW               = false
-DEFAULT_KEEP_EMAIL_PRIVATE        = false
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = false
+DISABLE_REGISTRATION = false
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+ENABLE_CAPTCHA = false
+REQUIRE_SIGNIN_VIEW = false
+DEFAULT_KEEP_EMAIL_PRIVATE = false
 DEFAULT_ALLOW_CREATE_ORGANIZATION = true
-DEFAULT_ENABLE_TIMETRACKING       = true
-NO_REPLY_ADDRESS                  = noreply.lunch.org.uk
+DEFAULT_ENABLE_TIMETRACKING = true
+NO_REPLY_ADDRESS = noreply.lunch.org.uk
 
 [picture]
-DISABLE_GRAVATAR        = false
+DISABLE_GRAVATAR = false
 ENABLE_FEDERATED_AVATAR = true
 
 [openid]
@@ -68,7 +69,9 @@ DEFAULT_MERGE_STYLE = merge
 DEFAULT_TRUST_MODEL = committer
 
 [security]
-INSTALL_LOCK       = true
-INTERNAL_TOKEN     = {{ pillar['gitea']['internal_token'] }}
+INSTALL_LOCK = true
+INTERNAL_TOKEN = {{ pillar['gitea']['internal_token'] }}
 PASSWORD_HASH_ALGO = pbkdf2
 
+[oauth2]
+JWT_SECRET = E1YKdqfWnBpdO0EftSHKWzQF6CB7JEkxny79REJHAOU