diff --git a/hieradata/roles/infra/git/gitea.eyaml b/hieradata/roles/infra/git/gitea.eyaml
index fa29e19..3d6508c 100644
--- a/hieradata/roles/infra/git/gitea.eyaml
+++ b/hieradata/roles/infra/git/gitea.eyaml
@@ -1,3 +1,3 @@
 ---
-profiles::gitea::init::mysql_pass: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAjmMVHQcvy0PLruFWI6UmYqM2uEqXntV8HdA54RCTm7GaneXsW+rom+ibFVd0i9L+spQPQzcidh7FlzBRYgny8yH8TqZlh7XMraXSYG2EvrjwzNvgnwhY5mGEQNQcQkqN9Orfsf6HjXmXg2CxajYibKu0/belJZFffzPzzrn15wy3Cj5lDjAziqYoD+8Ko1zkF9lWz4ewVjll82yo8iSpidN+PyvoeWsi/eJ9cW72TgFLt/rvGquLq3MuW54J716hrR1Z37Uf0OO18AiKCVjoCi5Cf/k0VKRsXM8Myu2KInqrGcUHAO+fsOXBXnmU0MOxW0OIOmwxfwY6LJfN23arlDBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB6GktEMe8gSTijJ/dIHC5/gCCblMojNKO1ig9fNsuT9I2u5Bt4iJrSMN+GBGnCzO1Bvw==]
+profiles::gitea::mysql_pass: ENC[PKCS7,MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEAjmMVHQcvy0PLruFWI6UmYqM2uEqXntV8HdA54RCTm7GaneXsW+rom+ibFVd0i9L+spQPQzcidh7FlzBRYgny8yH8TqZlh7XMraXSYG2EvrjwzNvgnwhY5mGEQNQcQkqN9Orfsf6HjXmXg2CxajYibKu0/belJZFffzPzzrn15wy3Cj5lDjAziqYoD+8Ko1zkF9lWz4ewVjll82yo8iSpidN+PyvoeWsi/eJ9cW72TgFLt/rvGquLq3MuW54J716hrR1Z37Uf0OO18AiKCVjoCi5Cf/k0VKRsXM8Myu2KInqrGcUHAO+fsOXBXnmU0MOxW0OIOmwxfwY6LJfN23arlDBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBB6GktEMe8gSTijJ/dIHC5/gCCblMojNKO1ig9fNsuT9I2u5Bt4iJrSMN+GBGnCzO1Bvw==]
 profiles::gitea::init::lfs_jwt_secret: ENC[PKCS7,MIIBmQYJKoZIhvcNAQcDoIIBijCCAYYCAQAxggEhMIIBHQIBADAFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEACd6q4E/4l1EYD3SFjc1okibyJ13kcGGWU+ShbCgwLgkW7INkyCxhbNm69yPA7WcyuRhH/Lfz/XjJKd3BSCyRQPr5IUOIRINspx82tLBcaMzY/99GFrfyDnf3+SV/AxrPJ/zD5TGkKQP7uX6WjC9DXpHE+pFJa9wBAipmV439y0JDVt2gXFmhqBWThSjBDBfJ5X4zO5wY8CfBX4APOcD5hIQP/T4n04dQLNpigEKKy6B+GFuooTbdmMmFj3ZpT+cUS8Aw9mFkBwyyN1o+50XU3vW4eieUz8cYkzDPu574XfTunqD2jcvPiFjCla8G1SpKfHkruKnZWwgO0Ntw9td5QDBcBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBAIRVL5j4dzbYg6f2XjvkQ6gDAd2qUNzPn2flZgKwsjIZcYdmFMTn48hGPUFfVaMDeyzPoJi84CyRJl8cQvcAe52sw=]
diff --git a/hieradata/roles/infra/git/gitea.yaml b/hieradata/roles/infra/git/gitea.yaml
index 3199ed6..6cd45fc 100644
--- a/hieradata/roles/infra/git/gitea.yaml
+++ b/hieradata/roles/infra/git/gitea.yaml
@@ -37,3 +37,43 @@ profiles::nginx::simpleproxy::nginx_aliases:
 profiles::nginx::simpleproxy::proxy_port: 3000
 profiles::nginx::simpleproxy::proxy_path: '/'
 nginx::client_max_body_size: 250M
+
+profiles::gitea::init::root:
+  APP_NAME: 'Gitea'
+  RUN_USER: 'git'
+  RUN_MODE: 'prod'
+profiles::gitea::init::repository:
+  ROOT: '/data/gitea/repos'
+  FORCE_PRIVATE: false
+  MAX_CREATION_LIMIT: -1
+  DISABLE_HTTP_GIT: false
+  DEFAULT_BRANCH: 'main'
+  DEFAULT_PRIVATE: 'last'
+profiles::gitea::init::ui:
+  SHOW_USER_EMAIL: false
+profiles::gitea::init::server:
+  PROTOCOL: 'http'
+  DOMAIN: 'git.query.consul'
+  ROOT_URL: 'https://git.query.consul'
+  HTTP_ADDR: '0.0.0.0'
+  HTTP_PORT: 3000
+  START_SSH_SERVER: false
+  SSH_DOMAIN: 'git.query.consul'
+  SSH_PORT: 2222
+  SSH_LISTEN_HOST: '0.0.0.0'
+  OFFLINE_MODE: true
+  APP_DATA_PATH: '/data/gitea'
+  SSH_LISTEN_PORT: 22
+  LFS_START_SERVER: true
+profiles::gitea::init::database:
+  DB_TYPE: 'mysql'
+  HOST: 'mariadb-prod.service.au-syd1.consul:3306'
+  NAME: 'gitea'
+  USER: 'gitea'
+  PASSWD: "%{hiera('profiles::gitea::mysql_pass')}"
+  SSL_MODE: 'disable'
+  LOG_SQL: false
+profiles::gitea::init::lfs:
+  PATH: '/data/gitea/lfs'
+profiles::gitea::init::session:
+  PROVIDER: db
diff --git a/site/profiles/manifests/gitea/init.pp b/site/profiles/manifests/gitea/init.pp
index 90e9e47..299a0d4 100644
--- a/site/profiles/manifests/gitea/init.pp
+++ b/site/profiles/manifests/gitea/init.pp
@@ -1,7 +1,13 @@
 # profiles::gitea::init
 class profiles::gitea::init (
-  String $mysql_pass = '',
   String $lfs_jwt_secret = '',
+  Hash   $root       = {},
+  Hash   $server     = {},
+  Hash   $database   = {},
+  Hash   $repository = {},
+  Hash   $session    = {},
+  Hash   $lfs        = {},
+  Hash   $ui         = {},
 ) {
 
   include profiles::nginx::simpleproxy
@@ -10,46 +16,13 @@ class profiles::gitea::init (
     ensure               => '1.22.0',
     checksum             => 'a31086f073cb9592d28611394b2de3655db515d961e4fdcf5b549cb40753ef3d',
     custom_configuration => {
-      ''           => {
-        'APP_NAME' => 'Gitea',
-        'RUN_USER' => 'git',
-        'RUN_MODE' => 'prod',
-      },
-      'repository' => {
-        'ROOT'               => '/data/gitea/repos',
-        'FORCE_PRIVATE'      => false,
-        'MAX_CREATION_LIMIT' => -1,
-        'DISABLE_HTTP_GIT'   => false,
-        'DEFAULT_BRANCH'     => 'main',
-        'DEFAULT_PRIVATE'    => 'last',
-      },
-      'ui'         => {
-        'SHOW_USER_EMAIL' => false,
-      },
-      'server'     => {
-        'PROTOCOL'         => 'http',
-        'DOMAIN'           => 'git.query.consul',
-        'ROOT_URL'         => 'https://git.query.consul',
-        'HTTP_ADDR'        => '0.0.0.0',
-        'HTTP_PORT'        => 3000,
-        'START_SSH_SERVER' => false,
-        'SSH_DOMAIN'       => 'git.query.consul',
-        'SSH_PORT'         => 2222,
-        'SSH_LISTEN_HOST'  => '0.0.0.0',
-        'OFFLINE_MODE'     => true,
-        'APP_DATA_PATH'    => '/var/lib/gitea/data',
-        'SSH_LISTEN_PORT'  => 22,
-      },
-      'database'   => {
-        'DB_TYPE'  => 'mysql',
-        'HOST'     => 'mariadb-prod.service.au-syd1.consul:3306',
-        'NAME'     => 'gitea',
-        'USER'     => 'gitea',
-        'PASSWD'   => Sensitive($mysql_pass),
-        'SSL_MODE' => 'disable',
-        'PATH'     => '/var/lib/gitea/data/gitea.db',
-        'LOG_SQL'  => false,
-      },
-    }
+      ''         => $root,
+      server     => $server,
+      database   => $database,
+      repository => $repository,
+      session    => $session,
+      lfs        => $lfs,
+      ui         => $ui,
+    },
   }
 }