diff --git a/defaults/main.yml b/defaults/main.yml
index 03ff253..c601e5d 100755
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -23,6 +23,8 @@ gitea_domain: localhost
 gitea_domain_protocol: https
 gitea_port: 3000
 gitea_ssh_domain: localhost
+# use Gitea's built-in SSH server instead of the system sshd
+gitea_ssh_builtin: false
 
 gitea_internal_token: INTERNAL_TOKEN
 gitea_jwt_secret: JWT_SECRET
diff --git a/templates/etc/systemd/system/gitea.service.j2 b/templates/etc/systemd/system/gitea.service.j2
index c206e30..8765ad5 100755
--- a/templates/etc/systemd/system/gitea.service.j2
+++ b/templates/etc/systemd/system/gitea.service.j2
@@ -20,6 +20,11 @@ Group={{ gitea_grp }}
 WorkingDirectory={{ gitea_data_location }}
 ExecStart={{ gitea_link }}/gitea web --config {{ gitea_home }}/app.ini
 Restart=always
+{% if gitea_ssh_builtin | default(false) | bool and (gitea_ssh_listen_port | default(22) | int) < 1024 %}
+# built-in SSH server binds a privileged port
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+{% endif %}
 Environment=USER={{ gitea_usr }} HOME={{ gitea_home }} GITEA_WORK_DIR={{ gitea_data_location }}
 #Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin
 
diff --git a/templates/opt/gitea/home/app.ini.j2 b/templates/opt/gitea/home/app.ini.j2
index 882388e..303eff8 100755
--- a/templates/opt/gitea/home/app.ini.j2
+++ b/templates/opt/gitea/home/app.ini.j2
@@ -20,11 +20,15 @@ ROOT = {{ gitea_data_location }}/data/gitea-repositories
 [server]
 SSH_DOMAIN       = {{ gitea_ssh_domain }}
 DOMAIN           = {{ gitea_domain }}
-HTTP_PORT        = {{ gitea_port | default(3000) }}
+{% if gitea_http_addr is defined %}
+HTTP_ADDR        = {{ gitea_http_addr }}
+{% endif %}
+HTTP_PORT        ={{ gitea_port | default(3000) }}
 ROOT_URL         = {{ gitea_domain_protocol }}://{{ gitea_ssh_domain }}/
 DISABLE_SSH      = {{ gitea_ssh | default('false') }}
 SSH_PORT         = {{ gitea_ssh_show_port | default(22) }}
-SSH_LISTEN_PORT  = {{ ssh_port | default(22) }}
+SSH_LISTEN_PORT  = {{ gitea_ssh_listen_port | default(ssh_port | default(22)) }}
+START_SSH_SERVER = {{ gitea_ssh_builtin | default(false) | bool | lower }}
 LFS_START_SERVER = {{ gitea_lfs | default('true') }}
 LFS_JWT_SECRET   = """{{ gitea_jwt_secret }}"""
 OFFLINE_MODE     = {{ gitea_is_offline | default('false') }}