diff --git a/tasks/gitea/configure.yml b/tasks/gitea/configure.yml
index ae424cf..932a18e 100644
--- a/tasks/gitea/configure.yml
+++ b/tasks/gitea/configure.yml
@@ -1,17 +1,35 @@
 ---
+- name: Check for gitea.configured
+  stat:
+    path: "/etc/gitea.configured"
+  register: gitea_configured_file
+  check_mode: false
+  changed_when: "1 != 1"
+  tags:
+    - mock
+
+- name: Deploy Gitea configuration
+  template:
+    src: "etc/gitea/conf/app.ini.j2"
+    dest: "/etc/gitea/conf/app.ini"
+    owner: git
+    group: git
+    mode: '0660'
+  notify: restart_gitea
+  when:
+    - not gitea_configured_file.stat.exists|bool
+
 # Configuration for gitea
 - name: Enable Gitea
   ansible.builtin.service:
     name: gitea
     state: started
     enabled: true
+  when:
+    - not gitea_configured_file.stat.exists|bool
 
-# - name: Deploy Gitea configuration
-#   template:
-#     src: "etc/gitea/conf/app.ini.j2"
-#     dest: "/etc/gitea/conf/app.ini"
-#     owner: git
-#     group: git
-#     mode: '0660'
-#   notify: restart_gitea
+- name: Drop file to prevent further configuration
+  ansible.builtin.file:
+    name: /etc/gitea.configured
+    state: touch
 ...
diff --git a/templates/etc/gitea/conf/app.ini.j2 b/templates/etc/gitea/conf/app.ini.j2
index e69de29..61b268c 100644
--- a/templates/etc/gitea/conf/app.ini.j2
+++ b/templates/etc/gitea/conf/app.ini.j2
@@ -0,0 +1,82 @@
+APP_NAME = Rocky Enterprise Software Foundation Git Service
+RUN_USER = git
+RUN_MODE = prod
+
+[database]
+DB_TYPE  = postgres
+HOST     = {{ gitea_database_host }}
+NAME     = {{ gitea_database_name }}
+USER     = {{ gitea_database_user }}
+PASSWD   = {{ gitea_database_pass }}
+SCHEMA   =
+SSL_MODE = disable
+
+[repository]
+ROOT                        = /var/lib/gitea/data/repositories
+DEFAULT_PRIVATE             = public
+DEFAULT_PUSH_CREATE_PRIVATE = false
+ENABLE_PUSH_CREATE_USER     = true
+ENABLE_PUSH_CREATE_ORG      = true
+DEFAULT_BRANCH              = main
+
+[server]
+SSH_DOMAIN       = git.resf.org
+DOMAIN           = git.resf.org
+HTTP_PORT        = 3000
+ROOT_URL         = https://git.resf.org/
+DISABLE_SSH      = false
+SSH_PORT         = 22
+LFS_START_SERVER = true
+LFS_CONTENT_PATH = /var/lib/gitea/data/lfs
+LFS_JWT_SECRET   = {{ gitea_lfs_secret | default('0000000000000000010001000100000000000000000') }}
+OFFLINE_MODE     = false
+LANDING_PAGE     = explore
+;PROTOCOL        = unix
+PROTOCOL         = http
+;HTTP_ADDR       = /run/gitea/gitea.socket
+APP_DATA_PATH    = /var/lib/gitea/data
+LFS_CONTENT_PATH = /var/lib/gitea/data/lfs
+
+[mailer]
+ENABLED = false
+FROM = noreply@resf.org
+MAILER_TYPE = sendmail
+
+[service]
+REGISTER_EMAIL_CONFIRM            = false
+ENABLE_NOTIFY_MAIL                = false
+DISABLE_REGISTRATION              = true
+ALLOW_ONLY_EXTERNAL_REGISTRATION  = false
+ENABLE_CAPTCHA                    = false
+REQUIRE_SIGNIN_VIEW               = false
+DEFAULT_KEEP_EMAIL_PRIVATE        = true
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ENABLE_TIMETRACKING       = true
+NO_REPLY_ADDRESS                  = noreply@resf.org
+DEFAULT_ORG_MEMBER_VISIBLE        = true
+
+[picture]
+DISABLE_GRAVATAR        = false
+ENABLE_FEDERATED_AVATAR = true
+
+[openid]
+ENABLE_OPENID_SIGNIN = false
+ENABLE_OPENID_SIGNUP = false
+
+[session]
+PROVIDER = postgres
+COOKIE_SECURE = true
+COOKIE_NAME = RESF_cookie_TOKEN
+
+[log]
+MODE      = console
+LEVEL     = info
+ROOT_PATH = /var/lib/gitea/log
+ROUTER    = console
+
+[ui]
+DEFAULT_THEME = gitea-blue
+THEMES = auto,gitea,arc-green,gitea-blue,gitea-modern,carbonred,darkred,pitchblack
+
+[admin]
+DISABLE_REGULAR_ORG_CREATION = true