diff --git a/examples/crash_reporter/backend/scripts/gitea/README.md b/examples/crash_reporter/backend/scripts/gitea/README.md
index 5a71ede..132051f 100644
--- a/examples/crash_reporter/backend/scripts/gitea/README.md
+++ b/examples/crash_reporter/backend/scripts/gitea/README.md
@@ -65,12 +65,26 @@ export GITEA_ADMIN_TOKEN='gitea_…'
 
 **Why auth?** Gitea rejects anonymous `git push`. The token (or CLI-generated token) proves write access to `foxx/android_cast`.
 
-**Prerequisite:** a **Gitea user** must exist (Site Admin → Users). Default script owner is `foxx`; if that user does not exist in Gitea, the script auto-picks the first admin (override with `GITEA_OWNER=admin` or whatever you created at install).
+**Prerequisite:** a **Gitea user** must exist (you have `admin`). Default owner is **`admin`** (override: `GITEA_OWNER=...`).
 
-Gitea usernames are **not** Linux users, FE logins, or crash-console `admin` — list them:
+**Run the script as root** (so it can `su` to `RUN_USER` from `app.ini`, usually `gitea`):
 
 ```bash
-gitea -c /etc/gitea/app.ini admin user list
+sudo ./gitea_attach_remote.sh git://10.7.0.10/android_cast
+```
+
+Or run directly as the Gitea service user:
+
+```bash
+sudo -u gitea ./gitea_attach_remote.sh git://10.7.0.10/android_cast
+```
+
+Running `gitea admin ...` as `foxx` fails with `Expect user 'gitea' but current user is: foxx` — that is normal.
+
+List users (on BE):
+
+```bash
+sudo -u gitea gitea -c /etc/gitea/app.ini admin user list
 ```
 
 **`remote: Not found`** = repo did not exist yet and nothing created it. Re-sync the updated script and re-run.
diff --git a/examples/crash_reporter/backend/scripts/gitea/gitea_attach_remote.sh b/examples/crash_reporter/backend/scripts/gitea/gitea_attach_remote.sh
index c44a544..442d426 100755
--- a/examples/crash_reporter/backend/scripts/gitea/gitea_attach_remote.sh
+++ b/examples/crash_reporter/backend/scripts/gitea/gitea_attach_remote.sh
@@ -22,7 +22,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 . "$SCRIPT_DIR/gitea_ini.sh"
 
 GITEA_MIRROR_URL="${GITEA_MIRROR_URL:-git://f0xx.org/android_cast}"
-GITEA_OWNER="${GITEA_OWNER:-foxx}"
+GITEA_OWNER="${GITEA_OWNER:-admin}"
 GITEA_REPO="${GITEA_REPO:-android_cast}"
 GITEA_MIRROR_INTERVAL="${GITEA_MIRROR_INTERVAL:-10m}"
 GITEA_PRIVATE="${GITEA_PRIVATE:-false}"
@@ -91,7 +91,7 @@ resolve_gitea_owner() {
   done
   _fallback="$(gitea_pick_owner_username)"
   if [ -z "$_fallback" ]; then
-    die "no Gitea users — open Gitea UI, create admin, then re-run (or GITEA_OWNER=username)"
+    die "no Gitea users in DB — complete first-run at $GITEA_ROOT_URL or: sudo -u $GITEA_RUN_USER gitea -c $GITEA_APP_INI admin user create --username admin --password '...' --email admin@local --admin"
   fi
   warn "using Gitea user '$_fallback' as repo owner (override: GITEA_OWNER=...)"
   GITEA_OWNER="$_fallback"
@@ -285,9 +285,10 @@ EOF
 # --- main ---
 
 gitea_load_config || exit 1
+gitea_ensure_cli_access || exit 1
 resolve_gitea_owner
 
-log "config ini=$GITEA_APP_INI"
+log "config ini=$GITEA_APP_INI  RUN_USER=$GITEA_RUN_USER"
 log "Gitea ROOT_URL=$GITEA_ROOT_URL (public)"
 log "local API=$(gitea_api_base)  local git=$(gitea_local_git_url)"
 log "target repo: $GITEA_OWNER/$GITEA_REPO"
diff --git a/examples/crash_reporter/backend/scripts/gitea/gitea_ini.sh b/examples/crash_reporter/backend/scripts/gitea/gitea_ini.sh
index c1e9726..8f7c457 100755
--- a/examples/crash_reporter/backend/scripts/gitea/gitea_ini.sh
+++ b/examples/crash_reporter/backend/scripts/gitea/gitea_ini.sh
@@ -71,8 +71,8 @@ gitea_load_config() {
   _load_ini_keys "$gitea_ini_file"
 
   [ -n "$GITEA_APP_DATA" ] || GITEA_APP_DATA="/var/lib/gitea"
-  # Live config may live under APP_DATA (Alpine package sometimes keeps /etc stub minimal).
-  if [ -z "$GITEA_ROOT_URL" ] && [ -r "$GITEA_APP_DATA/custom/conf/app.ini" ]; then
+  # Canonical config on Alpine is often under APP_DATA, not /etc stub.
+  if [ -r "$GITEA_APP_DATA/custom/conf/app.ini" ]; then
     _load_ini_keys "$GITEA_APP_DATA/custom/conf/app.ini"
     GITEA_APP_INI="$GITEA_APP_DATA/custom/conf/app.ini"
   fi
@@ -82,9 +82,12 @@ gitea_load_config() {
   [ -n "$GITEA_DB_TYPE" ] || GITEA_DB_TYPE="sqlite3"
   [ -n "$GITEA_ROOT_URL" ] || GITEA_ROOT_URL="${GITEA_ROOT_URL_DEFAULT:-https://apps.f0xx.org/app/androidcast_project/git/}"
 
+  GITEA_RUN_USER="$(ini_get "$GITEA_APP_INI" "" RUN_USER)"
+  [ -n "$GITEA_RUN_USER" ] || GITEA_RUN_USER="gitea"
+
   export GITEA_APP_INI GITEA_REPO_ROOT GITEA_APP_DATA GITEA_ROOT_URL GITEA_HTTP_PORT
   export GITEA_DOMAIN GITEA_DB_TYPE GITEA_DB_HOST GITEA_DB_NAME GITEA_DB_USER GITEA_DB_PASS
-  export GITEA_DB_PATH GITEA_LFS_PATH GITEA_LOG_ROOT
+  export GITEA_DB_PATH GITEA_LFS_PATH GITEA_LOG_ROOT GITEA_RUN_USER
 
   # External URL (ROOT_URL) includes nginx subpath; direct :3000 API/git do not.
   GITEA_HTTP_SUBPATH="${GITEA_HTTP_SUBPATH:-}"
@@ -112,27 +115,120 @@ gitea_path_is_safe_to_wipe() {
   return 1
 }
 
-gitea_run_as_git() {
+# Gitea admin CLI must run as RUN_USER from app.ini (Alpine package: user "gitea", not "git").
+gitea_run_as_service_user() {
+  _run="${GITEA_RUN_USER:-gitea}"
+  _cur="$(gitea_current_user)"
+  if [ "$_cur" = "$_run" ]; then
+    sh -c "$*"
+    return $?
+  fi
+  if id "$_run" >/dev/null 2>&1; then
+    su -s /bin/sh "$_run" -c "$*"
+    return $?
+  fi
   if id git >/dev/null 2>&1; then
     su -s /bin/sh git -c "$*"
-  else
-    sh -c "$*"
+    return $?
   fi
+  echo "ERROR: cannot run gitea as '$_run' (set RUN_USER in app.ini)" >&2
+  return 1
 }
 
 gitea_cli() {
   if command -v gitea >/dev/null 2>&1; then
-    gitea_run_as_git "gitea -c '$GITEA_APP_INI' $*"
+    gitea_run_as_service_user "gitea -c '$GITEA_APP_INI' $*"
   else
     echo "WARN: gitea binary not in PATH" >&2
     return 1
   fi
 }
 
-# One username per line from `gitea admin user list`.
+gitea_current_user() {
+  whoami 2>/dev/null || id -un 2>/dev/null || echo unknown
+}
+
+# Caller must be root (to su) or already GITEA_RUN_USER.
+gitea_ensure_cli_access() {
+  _run="${GITEA_RUN_USER:-gitea}"
+  _cur="$(gitea_current_user)"
+  if [ "$_cur" = "$_run" ]; then
+    return 0
+  fi
+  if [ "$(id -u 2>/dev/null || echo 1)" -eq 0 ]; then
+    return 0
+  fi
+  if id "$_run" >/dev/null 2>&1 && su -s /bin/sh "$_run" -c "true" 2>/dev/null; then
+    return 0
+  fi
+  echo "ERROR: Gitea admin CLI must run as OS user '$_run' (RUN_USER in app.ini)." >&2
+  echo "       You are '$_cur'. Re-run with:" >&2
+  echo "         sudo ./gitea_attach_remote.sh git://..." >&2
+  echo "       Or:" >&2
+  echo "         sudo -u $_run ./gitea_attach_remote.sh git://..." >&2
+  return 1
+}
+
+gitea_db_list_usernames() {
+  case "$(echo "$GITEA_DB_TYPE" | tr '[:upper:]' '[:lower:]')" in
+    mysql)
+      command -v mysql >/dev/null 2>&1 || return 1
+      _sock="${GITEA_DB_HOST:-/run/mysqld/mysqld.sock}"
+      case "$_sock" in
+        /*) mysql -u"$GITEA_DB_USER" ${GITEA_DB_PASS:+-p"$GITEA_DB_PASS"} -S "$_sock" "$GITEA_DB_NAME" \
+          -N -e "SELECT name FROM user ORDER BY id" 2>/dev/null ;;
+        *) mysql -u"$GITEA_DB_USER" ${GITEA_DB_PASS:+-p"$GITEA_DB_PASS"} -h "$_sock" "$GITEA_DB_NAME" \
+          -N -e "SELECT name FROM user ORDER BY id" 2>/dev/null ;;
+      esac
+      ;;
+    sqlite3|sqlite)
+      command -v sqlite3 >/dev/null 2>&1 || return 1
+      _db="${GITEA_DB_PATH:-}"
+      [ -n "$_db" ] || _db="$GITEA_APP_DATA/gitea.db"
+      [ -r "$_db" ] || _db="/var/lib/gitea/db/gitea.db"
+      [ -r "$_db" ] || return 1
+      sqlite3 "$_db" "SELECT name FROM user ORDER BY id" 2>/dev/null
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+gitea_db_pick_admin_username() {
+  case "$(echo "$GITEA_DB_TYPE" | tr '[:upper:]' '[:lower:]')" in
+    mysql)
+      command -v mysql >/dev/null 2>&1 || return 1
+      _sock="${GITEA_DB_HOST:-/run/mysqld/mysqld.sock}"
+      case "$_sock" in
+        /*) mysql -u"$GITEA_DB_USER" ${GITEA_DB_PASS:+-p"$GITEA_DB_PASS"} -S "$_sock" "$GITEA_DB_NAME" \
+          -N -e "SELECT name FROM user WHERE is_admin=1 ORDER BY id LIMIT 1" 2>/dev/null ;;
+        *) mysql -u"$GITEA_DB_USER" ${GITEA_DB_PASS:+-p"$GITEA_DB_PASS"} -h "$_sock" "$GITEA_DB_NAME" \
+          -N -e "SELECT name FROM user WHERE is_admin=1 ORDER BY id LIMIT 1" 2>/dev/null ;;
+      esac
+      ;;
+    sqlite3|sqlite)
+      command -v sqlite3 >/dev/null 2>&1 || return 1
+      _db="${GITEA_DB_PATH:-$GITEA_APP_DATA/gitea.db}"
+      [ -r "$_db" ] || _db="/var/lib/gitea/db/gitea.db"
+      [ -r "$_db" ] || return 1
+      sqlite3 "$_db" "SELECT name FROM user WHERE is_admin=1 ORDER BY id LIMIT 1" 2>/dev/null
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+# One username per line (CLI as RUN_USER, else DB).
 gitea_list_usernames() {
-  gitea_cli "admin" "user" "list" 2>/dev/null \
-    | awk 'NR > 1 { print $2 }'
+  _cli=""
+  _cli="$(gitea_cli "admin" "user" "list" 2>/dev/null)" || true
+  if [ -n "$_cli" ]; then
+    echo "$_cli" | awk 'NR > 1 && NF >= 2 { print $2 }'
+    return 0
+  fi
+  gitea_db_list_usernames
 }
 
 gitea_user_exists() {
@@ -140,11 +236,16 @@ gitea_user_exists() {
   gitea_list_usernames | grep -Fx "$_u" >/dev/null 2>&1
 }
 
-# First admin account (site admin), else first user.
+# First site-admin account, else first user.
 gitea_pick_owner_username() {
   _pick=""
   _pick="$(gitea_cli "admin" "user" "list" 2>/dev/null \
-    | awk 'NR > 1 && ($5 == "true" || $5 == "1") { print $2; exit }')"
+    | awk 'NR > 1 && NF >= 2 && ($5 == "true" || $5 == "1") { print $2; exit }')"
+  if [ -n "$_pick" ]; then
+    printf '%s' "$_pick"
+    return 0
+  fi
+  _pick="$(gitea_db_pick_admin_username)"
   if [ -n "$_pick" ]; then
     printf '%s' "$_pick"
     return 0