diff --git a/defaults/main.yml b/defaults/main.yml
index 93e0be3..c6598a4 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -122,9 +122,19 @@ gitea_log_systemd: false
 gitea_log_level: 'Warn'
 gitea_log_extra_config: ''
 
+# Metrics (metrics)
+gitea_metrics_enabled: false
+gitea_metrics_token: ''
+
+# OAuth2 (oauth2)
+gitea_oauth2_enabled: true
+gitea_oauth2_jwt_secret: ''
+gitea_oauth2_extra_config: ''
+
+
+
 # security
 gitea_lfs_jwt_secret: ''
-gitea_oauth2_jwt_secret: ''
 
 gitea_systemd_cap_net_bind_service: false
 
@@ -135,10 +145,7 @@ gitea_fail2ban_jail_findtime: 3600
 gitea_fail2ban_jail_bantime: 900
 gitea_fail2ban_jail_action: iptables-allports
 
-gitea_oauth2_enabled: true
 
-gitea_metrics_enabled: false
-gitea_metrics_token: ~
 
 gitea_extra_config: ""
 
diff --git a/templates/gitea.ini.j2 b/templates/gitea.ini.j2
index 082f70e..824a53b 100644
--- a/templates/gitea.ini.j2
+++ b/templates/gitea.ini.j2
@@ -154,13 +154,18 @@ LEVEL      = {{ gitea_log_level }}
 {{ gitea_log_extra_config }}
 ;
 ;
-;
-[oauth2]
-ENABLE     = {{ gitea_oauth2_enabled }}
-JWT_SECRET = {{ gitea_oauth2_jwt_secret }}
-
+; -> https://docs.gitea.io/en-us/config-cheat-sheet/#metrics-metrics
 [metrics]
 ENABLED = {{ gitea_metrics_enabled }}
 TOKEN   = {{ gitea_metrics_token }}
-
+;
+;
+; https://docs.gitea.io/en-us/config-cheat-sheet/#oauth2-oauth2
+[oauth2]
+ENABLE     = {{ gitea_oauth2_enabled }}
+JWT_SECRET = {{ gitea_oauth2_jwt_secret }}
+{{ gitea_oauth2_extra_config }}
+;
+;
+; Optional additional config
 {{ gitea_extra_config }}