what I have so far

gitea/assets/gitea.service

@@ -2,7 +2,8 @@
 Description=Gitea (Git with a cup of tea)
 After=syslog.target
 After=network.target
-Requires=postgresql.service
+After=postgresql.service
+Wants=postgresql.service
 
 [Service]
 # Modify these two values and uncomment them if you have
@@ -16,20 +17,14 @@ Type=simple
 User=gitea
 Group=gitea
 WorkingDirectory=/var/lib/gitea/
-# If using Unix socket: tells systemd to create the /run/gitea folder, which will contain the gitea.sock file
+PermissionsStartOnly=true
-# (manually creating /run/gitea doesn't work, because it would not persist across reboots)
-#RuntimeDirectory=gitea
 ExecStartPre=/bin/bash -c "cat /vol/data/app.host.ini /vol/data/app.secret.ini /etc/gitea/app.config.ini > /etc/gitea/app.ini"
-ExecStartPre=/usr/local/bin/gitea --config /etc/gitea/app.ini admin regenerate keys
+ExecStartPre=/bin/bash -c "sudo -u gitea /usr/local/bin/gitea --config /etc/gitea/app.ini admin regenerate keys"
 ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
 Restart=always
 Environment=USER=gitea HOME=/var/lib/gitea GITEA_WORK_DIR=/var/lib/gitea
-# If you want to bind Gitea to a port below 1024, uncomment
-# the two values below, or use socket activation to pass Gitea its ports as above
-###
 CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 AmbientCapabilities=CAP_NET_BIND_SERVICE
-###
 
 [Install]
 WantedBy=multi-user.target