diff --git a/forgejo/app_ini/README.md b/forgejo/app_ini/README.md
new file mode 100644
index 0000000..3f323f9
--- /dev/null
+++ b/forgejo/app_ini/README.md
@@ -0,0 +1,9 @@
+# app.ini
+## what
+The `app.ini` file for Forgejo. See the [Forgejo Configuration Cheat Sheet](https://forgejo.org/docs/latest/admin/config-cheat-sheet/).
+
+## where
+On the `prod-sourcecamp-starcatsys` server, this file is located at `/etc/forgejo/app.ini`.
+
+## env to ini
+Some values in the file are shown as `<REDACTED - GITEA__SERVER__LFS_JWT_SECRET>` in place of a secret value. According to [forgejo/contrib/environment-to-ini](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/contrib/environment-to-ini), we should be able to use environment variables for these secrets instead of hard-coding them into the `app.ini` file.
\ No newline at end of file
diff --git a/forgejo/app_ini/app.ini b/forgejo/app_ini/app.ini
new file mode 100644
index 0000000..6af747d
--- /dev/null
+++ b/forgejo/app_ini/app.ini
@@ -0,0 +1,99 @@
+APP_NAME = StarCat Git
+APP_SLOGAN = Git repo hosting for StarCat Systems
+RUN_USER = git
+WORK_PATH = /var/lib/forgejo
+RUN_MODE = prod
+
+[database]
+DB_TYPE = sqlite3
+HOST = 127.0.0.1:3306
+NAME = forgejo
+USER = forgejo
+PASSWD = 
+SCHEMA = 
+SSL_MODE = disable
+PATH = /var/lib/forgejo/data/forgejo.db
+LOG_SQL = false
+
+[repository]
+ROOT = /var/lib/forgejo/data/forgejo-repositories
+
+[server]
+SSH_DOMAIN = git.starcat.systems
+DOMAIN = git.starcat.systems
+HTTP_PORT = 3000
+ROOT_URL = https://git.starcat.systems/
+APP_DATA_PATH = /var/lib/forgejo/data
+DISABLE_SSH = false
+SSH_PORT = 22
+LFS_START_SERVER = true
+LFS_JWT_SECRET = <REDACTED - GITEA__SERVER__LFS_JWT_SECRET>
+OFFLINE_MODE = true
+
+[lfs]
+PATH = /var/lib/forgejo/data/lfs
+
+[mailer]
+ENABLED = true
+SMTP_ADDR = <REDACTED - GITEA__MAILER__SMTP_ADDR>
+SMTP_PORT = 465
+FROM = "git.starcat.systems" <git@git.starcat.systems>
+USER = git@git.starcat.systems
+PASSWD = <REDACTED - GITEA__MAILER__PASSWD>
+
+[service]
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = true
+DISABLE_REGISTRATION = true
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+ENABLE_CAPTCHA = false
+REQUIRE_SIGNIN_VIEW = false
+DEFAULT_KEEP_EMAIL_PRIVATE = true
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ENABLE_TIMETRACKING = true
+NO_REPLY_ADDRESS = noreply.git.starcat.systems
+
+[openid]
+ENABLE_OPENID_SIGNIN = false
+ENABLE_OPENID_SIGNUP = false
+
+[cron.update_checker]
+ENABLED = true
+
+[session]
+PROVIDER = file
+
+[log]
+MODE = console
+LEVEL = info
+ROOT_PATH = /var/lib/forgejo/log
+
+[repository.pull-request]
+DEFAULT_MERGE_STYLE = merge
+
+[repository.signing]
+DEFAULT_TRUST_MODEL = committer
+
+[security]
+INSTALL_LOCK = true
+INTERNAL_TOKEN = <REDACTED - GITEA__SECURITY__INTERNAL_TOKEN>
+PASSWORD_HASH_ALGO = pbkdf2_hi
+
+[oauth2]
+JWT_SECRET = <REDACTED - GITEA__OAUTH2__JWT_SECRET>
+
+[email.incoming]
+ENABLED = true
+REPLY_TO_ADDRESS = incoming+%{token}@git.starcat.systems
+HOST = <REDACTED - GITEA__EMAIL_0x2E_INCOMING__HOST>
+PORT = 993
+USERNAME = incoming@git.starcat.systems
+PASSWORD = <REDACTED - GITEA__EMAIL_0x2E_INCOMING__PASSWORD>
+USE_TLS = false
+MAILBOX = Inbox
+DELETE_HANDLED_MESSAGE = true
+MAXIMUM_MESSAGE_SIZE = 10485760
+
+[ui]
+THEMES = forgejo-auto,forgejo-light,forgejo-dark,gitea-auto,gitea-light,gitea-dark
+DEFAULT_THEME = gitea-auto
\ No newline at end of file