diff --git a/.cruft.json b/.cruft.json
index a761b2d..91e692f 100644
--- a/.cruft.json
+++ b/.cruft.json
@@ -58,34 +58,36 @@
       },
       "_settings": {
         "version": "latest",
-        "database": {
-          "db_type": "sqlite3",
-          "name": "gitea",
-          "user": "root",
-          "password": "hunter1"
-        },
-        "secrets": {
-          "internal_token": "",
-          "jwt_secret": "",
-          "lfs_jwt_secret": "",
-          "secret_key": ""
-        },
         "service": {
           "requires_mount": [],
           "socket_activation": false,
           "wants": []
         },
         "config": {
+          "database": {
+            "db_type": "sqlite3",
+            "name": "gitea",
+            "user": "root",
+            "password": "hunter1"
+          },
           "default": {
             "app_name": "Gitea",
             "run_user": "git",
             "run_mode": "prod"
           },
+          "oauth2": {
+            "jwt_secret": ""
+          },
+          "security": {
+            "internal_token": "",
+            "secret_key": ""
+          },
           "server": {
             "protocol": "http",
             "domain": "localhost",
             "http_addr": "0.0.0.0",
-            "http_port": 3000
+            "http_port": 3000,
+            "lfs_jwt_secret": ""
           },
           "log": {
             "mode": "console",
diff --git a/gitea/config/clean.sls b/gitea/config/clean.sls
index cca6b86..e1b834f 100644
--- a/gitea/config/clean.sls
+++ b/gitea/config/clean.sls
@@ -12,6 +12,8 @@ gitea-config-clean-file-absent:
   file.absent:
     - names:
       - {{ gitea.lookup.paths.conf | path_join('app.ini') }}
-      - {{ gitea.lookup.paths.custom | path_join('conf', 'app.ini') }}
+{%- if gitea._generate_token %}
+      - {{ gitea.lookup.paths.internal_token_uri[7:] }}
+{%- endif %}
     - require:
       - sls: {{ sls_service_clean }}
diff --git a/gitea/config/file.sls b/gitea/config/file.sls
index 7696762..852367c 100644
--- a/gitea/config/file.sls
+++ b/gitea/config/file.sls
@@ -9,27 +9,9 @@
 include:
   - {{ sls_package_install }}
 
-# Since this formula does not rely on the web installer,
-# the global configuration should include:
-#   - database configuration
-#   - secrets
-# Otherwise, gitea would not run at all.
-Required Gitea config is setup:
-  file.managed:
-    - name: {{ gitea.lookup.paths.conf | path_join('app.ini') }}
-    - source: {{ files_switch(['etc/app.ini.j2'],
-                              lookup='Required Gitea config is setup'
-                 )
-              }}
-    - template: jinja
-    - mode: '0640'
-    - user: root
-    - group: {{ gitea.lookup.group }}
-    - require:
-      - sls: {{ sls_package_install }}
-    - context:
-        gitea: {{ gitea | json }}
-{%- if not gitea.secrets.internal_token and 'file://' == gitea.lookup.paths.internal_token_uri[:7] %}
+{%- if gitea._generate_token %}
+
+Gitea internal token file is generated:
   # gitea complained about permissions with mode = 640, root:git ownership
   cmd.run:
     - name: >
@@ -41,20 +23,21 @@ Required Gitea config is setup:
       - sls: {{ sls_package_install }}
 {%- endif %}
 
-gitea-config-file-file-managed:
+Gitea config is setup:
   file.managed:
-    - name: {{ gitea.lookup.paths.custom | path_join('conf', 'app.ini') }}
+    - name: {{ gitea.lookup.paths.conf | path_join('app.ini') }}
     - source: {{ files_switch(['app.ini.j2'],
-                              lookup='gitea-config-file-file-managed'
+                              lookup='Gitea config is setup'
                  )
               }}
-    - mode: '0640'
-    - makedirs: true
-    - dir_mode: '0750'
-    - user: {{ gitea.lookup.user }}
-    - group: {{ gitea.lookup.group }}
     - template: jinja
+    - mode: '0640'
+    - user: root
+    - group: {{ gitea.lookup.group }}
     - require:
       - sls: {{ sls_package_install }}
+{%- if gitea._generate_token %}
+      - Gitea internal token file is generated
+{%- endif %}
     - context:
         gitea: {{ gitea | json }}
diff --git a/gitea/files/default/etc/app.ini.j2 b/gitea/files/default/etc/app.ini.j2
deleted file mode 100644
index 6c14646..0000000
--- a/gitea/files/default/etc/app.ini.j2
+++ /dev/null
@@ -1,24 +0,0 @@
-;; Global Gitea configuration managed by salt state.
-;; These values are necessary to skip the web installer.
-
-[database]
-{%- for conf, val in gitea.database.items() %}
-{{ conf | upper }} = {{ val if conf | upper != 'PASSWD' else '`{}`'.format(val) }}
-{%- endfor %}
-
-{#- The following secrets are guaranteed to be set by `post-map.jinja`. #}
-
-[oauth2]
-JWT_SECRET = {{ gitea.secrets.jwt_secret }}
-
-[security]
-INSTALL_LOCK = true
-{%- if gitea.secrets.internal_token %}
-INTERNAL_TOKEN = {{ gitea.secrets.internal_token }}
-{%- else %}
-INTERNAL_TOKEN_URI = {{ gitea.lookup.paths.internal_token_uri }}
-{%- endif %}
-SECRET_KEY = {{ gitea.secrets.secret_key }}
-
-[server]
-LFS_JWT_SECRET = {{ gitea.secrets.lfs_jwt_secret }}
diff --git a/gitea/parameters/defaults.yaml b/gitea/parameters/defaults.yaml
index d8962ac..e998daf 100644
--- a/gitea/parameters/defaults.yaml
+++ b/gitea/parameters/defaults.yaml
@@ -35,6 +35,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -43,23 +48,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/gitea/post-map.jinja b/gitea/post-map.jinja
index 783dd78..dce8708 100644
--- a/gitea/post-map.jinja
+++ b/gitea/post-map.jinja
@@ -47,30 +47,43 @@
       b) and special-casing to avoid regenerating those secrets every run.
 
     The INTERNAL_TOKEN has a special format, but it can be configured to be read from a separate file.
+
+    "." is used in place of ":" to avoid libmapstack automap. @TODO sensible to indulge in that magic?
 -#}
 
-{%- if not mapdata.secrets.secret_key -%}
+{%- if not mapdata.config | traverse("security:secret_key", "") -%}
   {%- set secret_key = salt['grains.get_or_set_hash'](
-        'gitea_secret_key',
+        'gitea.config.security.secret_key',
         length=64,
         chars='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',
       )
   -%}
-  {%- do mapdata.secrets.update({'secret_key': secret_key}) -%}
+  {%- do mapdata.config | update_dict_key_value("security", {"secret_key": secret_key}) -%}
 {%- endif -%}
 
-{%- for jwt in ['jwt_secret', 'lfs_jwt_secret'] -%}
-  {%- if not mapdata.secrets[jwt] -%}
+{%- for jwt in ['oauth2:jwt_secret', 'server:lfs_jwt_secret'] -%}
+  {%- if not mapdata.config | traverse(jwt, "") -%}
     {%- set secret = salt['grains.get_or_set_hash'](
-          'gitea_' ~ jwt ,
+          'gitea.config.' ~ jwt | replace(":", "."),
           length=43,
           chars='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-',
         )
     -%}
-    {%- do mapdata.secrets.update({jwt: secret}) -%}
+    {%- do mapdata.config | update_dict_key_value(jwt.split(":")[0], {jwt.split(":")[1]: secret}) -%}
   {%- endif -%}
 {%- endfor -%}
 
+{%- do mapdata.update({"_generate_token": false}) -%}
+{%- if not mapdata.config | traverse("security:internal_token") -%}
+  {%- do mapdata.config | update_dict_key_value("security", {"internal_token_uri": mapdata.lookup.paths.internal_token_uri}) -%}
+  {%- if 'file://' == mapdata.lookup.paths.internal_token_uri[:7] -%}
+    {%- do mapdata.update({"_generate_token": true}) -%}
+  {%- endif %}
+{%- endif -%}
+
+{%- do mapdata.config | update_dict_key_value("security", {"install_lock": true}) -%}
+
+
 {#-
     Automatically configure the socket path to use the one provided by Systemd.
 -#}
@@ -79,6 +92,7 @@
   {%- do mapdata.config.server.update({"http_addr": "/run/gitea/gitea.socket"}) -%}
 {%- endif -%}
 
+
 {#-
     Automatically configure basic service dependencies.
     Memcached/Redis are not as easy to discover (multiple settings)
diff --git a/pillar.example b/pillar.example
index 7d07036..744bce1 100644
--- a/pillar.example
+++ b/pillar.example
@@ -9,25 +9,6 @@ gitea:
     # will do that automatically on subsequent runs.
   version: latest
 
-    # Since this formula skips the web installer,
-    # the database configuration is required. This is just
-    # an example. All specified values will be dumped into the
-    # global configuration file.
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-
-    # (Some of) those secrets would be generated by the web installer.
-    # Specify them here explicitly or let Salt handle their generation.
-    # In the latter case, they will be saved in a grain value on the minion.
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
-
     # Service configuration allows to request mount paths or
     # other service units. This is especially important if you
     # run Memcached/Redis. For databases, `post-map.jinja` appends
@@ -41,12 +22,21 @@ gitea:
     socket_activation: false
     wants: []
 
-    # This is the custom configuration. Values in `default` are dumped
-    # without an associated scope. For possible configuration values,
+    # This is the custom configuration.  For possible configuration values,
     # see the official docs or the example file.
     # It is recommended to keep all the keys lowercase to avoid
     # issues with some autoconfiguration done by this formula.
   config:
+      # Since this formula skips the web installer,
+      # the database configuration is required. This is just
+      # an example.
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
+
+      # Values in `default` are dumped without an associated scope.
     default:
       app_name: Gitea
       run_mode: prod
@@ -57,13 +47,30 @@ gitea:
       mode: console
       stacktrace_level: None
 
+      # If this secret is unspecified, it will be autogenerated by Salt
+      # and be saved as a minion grain value.
+    oauth2:
+      jwt_secret: ''
+
+      # Children of scopes are expressed with a dot.
     repository.signing:
       signing_key: default
 
+      # Those secrets would be generated by the web installer.
+      # Specify them here explicitly or let Salt handle their generation.
+      # In the latter case, `internal_token_uri` will be set to a file
+      # generated by gitea and `secret_key` will be saved as a minion grain value.
+    security:
+      internal_token: ''
+      secret_key: ''
+
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+        # If this secret is unspecified, it will be autogenerated by Salt
+        # and be saved as a minion grain value.
+      lfs_jwt_secret: ''
       protocol: http
 
     # This is where a lot of the default parameters are looked up.
diff --git a/test/integration/default/files/_mapdata/almalinux-8.yaml b/test/integration/default/files/_mapdata/almalinux-8.yaml
index 74258c0..58aff21 100644
--- a/test/integration/default/files/_mapdata/almalinux-8.yaml
+++ b/test/integration/default/files/_mapdata/almalinux-8.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/amazonlinux-1.yaml b/test/integration/default/files/_mapdata/amazonlinux-1.yaml
index dd60846..61014d5 100644
--- a/test/integration/default/files/_mapdata/amazonlinux-1.yaml
+++ b/test/integration/default/files/_mapdata/amazonlinux-1.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/amazonlinux-2.yaml b/test/integration/default/files/_mapdata/amazonlinux-2.yaml
index a44f6c8..12762c7 100644
--- a/test/integration/default/files/_mapdata/amazonlinux-2.yaml
+++ b/test/integration/default/files/_mapdata/amazonlinux-2.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/arch-base-latest.yaml b/test/integration/default/files/_mapdata/arch-base-latest.yaml
index b0a0916..166f98f 100644
--- a/test/integration/default/files/_mapdata/arch-base-latest.yaml
+++ b/test/integration/default/files/_mapdata/arch-base-latest.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/centos-6.yaml b/test/integration/default/files/_mapdata/centos-6.yaml
index ac8cb20..a86eb4d 100644
--- a/test/integration/default/files/_mapdata/centos-6.yaml
+++ b/test/integration/default/files/_mapdata/centos-6.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/centos-7.yaml b/test/integration/default/files/_mapdata/centos-7.yaml
index e687bbf..cd6962f 100644
--- a/test/integration/default/files/_mapdata/centos-7.yaml
+++ b/test/integration/default/files/_mapdata/centos-7.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/centos-8.yaml b/test/integration/default/files/_mapdata/centos-8.yaml
index 5bc6b56..c95a2a7 100644
--- a/test/integration/default/files/_mapdata/centos-8.yaml
+++ b/test/integration/default/files/_mapdata/centos-8.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/debian-10.yaml b/test/integration/default/files/_mapdata/debian-10.yaml
index a6500d4..a432b80 100644
--- a/test/integration/default/files/_mapdata/debian-10.yaml
+++ b/test/integration/default/files/_mapdata/debian-10.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/debian-11.yaml b/test/integration/default/files/_mapdata/debian-11.yaml
index 34f25c8..9fe8b2d 100644
--- a/test/integration/default/files/_mapdata/debian-11.yaml
+++ b/test/integration/default/files/_mapdata/debian-11.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/debian-9.yaml b/test/integration/default/files/_mapdata/debian-9.yaml
index 2e5bc23..55bcd3d 100644
--- a/test/integration/default/files/_mapdata/debian-9.yaml
+++ b/test/integration/default/files/_mapdata/debian-9.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/fedora-31.yaml b/test/integration/default/files/_mapdata/fedora-31.yaml
index 2bf6e02..cfc21ba 100644
--- a/test/integration/default/files/_mapdata/fedora-31.yaml
+++ b/test/integration/default/files/_mapdata/fedora-31.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/fedora-32.yaml b/test/integration/default/files/_mapdata/fedora-32.yaml
index b2cf52f..9f4ace8 100644
--- a/test/integration/default/files/_mapdata/fedora-32.yaml
+++ b/test/integration/default/files/_mapdata/fedora-32.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/fedora-33.yaml b/test/integration/default/files/_mapdata/fedora-33.yaml
index af0ea19..bed3fb7 100644
--- a/test/integration/default/files/_mapdata/fedora-33.yaml
+++ b/test/integration/default/files/_mapdata/fedora-33.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/fedora-34.yaml b/test/integration/default/files/_mapdata/fedora-34.yaml
index 935085e..fc28699 100644
--- a/test/integration/default/files/_mapdata/fedora-34.yaml
+++ b/test/integration/default/files/_mapdata/fedora-34.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/fedora-35.yaml b/test/integration/default/files/_mapdata/fedora-35.yaml
index 4cdf333..5b8d27c 100644
--- a/test/integration/default/files/_mapdata/fedora-35.yaml
+++ b/test/integration/default/files/_mapdata/fedora-35.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/fedora-36.yaml b/test/integration/default/files/_mapdata/fedora-36.yaml
index 9246994..731b46f 100644
--- a/test/integration/default/files/_mapdata/fedora-36.yaml
+++ b/test/integration/default/files/_mapdata/fedora-36.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml b/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml
index d020397..71b9826 100644
--- a/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml
+++ b/test/integration/default/files/_mapdata/gentoo-2-sysd.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml b/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml
index d020397..71b9826 100644
--- a/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml
+++ b/test/integration/default/files/_mapdata/gentoo-2-sysv.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/opensuse-15.yaml b/test/integration/default/files/_mapdata/opensuse-15.yaml
index 1283680..0708fda 100644
--- a/test/integration/default/files/_mapdata/opensuse-15.yaml
+++ b/test/integration/default/files/_mapdata/opensuse-15.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml b/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
index 7a3e544..035aeca 100644
--- a/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
+++ b/test/integration/default/files/_mapdata/opensuse-tumbleweed.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/oraclelinux-7.yaml b/test/integration/default/files/_mapdata/oraclelinux-7.yaml
index 5555545..f5db34c 100644
--- a/test/integration/default/files/_mapdata/oraclelinux-7.yaml
+++ b/test/integration/default/files/_mapdata/oraclelinux-7.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/oraclelinux-8.yaml b/test/integration/default/files/_mapdata/oraclelinux-8.yaml
index cf4eacf..0603c49 100644
--- a/test/integration/default/files/_mapdata/oraclelinux-8.yaml
+++ b/test/integration/default/files/_mapdata/oraclelinux-8.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/rockylinux-8.yaml b/test/integration/default/files/_mapdata/rockylinux-8.yaml
index c3dc46d..c1e88d7 100644
--- a/test/integration/default/files/_mapdata/rockylinux-8.yaml
+++ b/test/integration/default/files/_mapdata/rockylinux-8.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/ubuntu-16.yaml b/test/integration/default/files/_mapdata/ubuntu-16.yaml
index 9535e1b..cf6a1f0 100644
--- a/test/integration/default/files/_mapdata/ubuntu-16.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-16.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/ubuntu-18.yaml b/test/integration/default/files/_mapdata/ubuntu-18.yaml
index 2591956..83b6fee 100644
--- a/test/integration/default/files/_mapdata/ubuntu-18.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-18.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/integration/default/files/_mapdata/ubuntu-20.yaml b/test/integration/default/files/_mapdata/ubuntu-20.yaml
index ac60eda..c6c74e1 100644
--- a/test/integration/default/files/_mapdata/ubuntu-20.yaml
+++ b/test/integration/default/files/_mapdata/ubuntu-20.yaml
@@ -37,6 +37,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -45,23 +50,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/salt/pillar/default.sls b/test/salt/pillar/default.sls
index 4f8ac49..8a8c427 100644
--- a/test/salt/pillar/default.sls
+++ b/test/salt/pillar/default.sls
@@ -36,6 +36,11 @@ gitea:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -44,23 +49,19 @@ gitea:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false
diff --git a/test/salt/pillar/upstart.sls b/test/salt/pillar/upstart.sls
index 4f8ac49..8a8c427 100644
--- a/test/salt/pillar/upstart.sls
+++ b/test/salt/pillar/upstart.sls
@@ -36,6 +36,11 @@ gitea:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -44,23 +49,19 @@ gitea:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false