diff --git a/templates/config.exs b/templates/config.exs
index c77a181..cdfb11b 100644
--- a/templates/config.exs
+++ b/templates/config.exs
@@ -1,12 +1,35 @@
+#
+# This file managed via Ansible; changes will be overwritten
 # WARNING: THIS FILE CONTAINS SENSITIVE INFORMATION
+# DO NOT ALLOW WORLD READ ACCESS TO THIS FILE
+#
 import Config
 
-# Basic configuration
+# Endpoint configuration
 config :pleroma, Pleroma.Web.Endpoint,
 	url: [host: "{{ pleroma_hostname }}", scheme: "https", port: 443],
 	http: [ip: {127, 0, 0, 1}, port: 4000],
 	secret_key_base: "{{ pleroma_secret_key_base }}",
 	signing_salt: "{{ pleroma_secret_signing_salt }}"
+# DB configuration
+config :pleroma, Pleroma.Repo,
+	adapter: Ecto.Adapters.Postgres,
+	database: "{{ pleroma_db_name }}",
+	hostname: "{{ pleroma_db_host }}",
+	username: "{{ pleroma_db_user }}",
+	password: "{{ pleroma_db_pass }}",
+	pool_size: {{ pleroma_db_pool_size }}
+config :pleroma, :database, rum_enabled: false
+# Use in-DB configs
+config :pleroma, configurable_from_database: true
+
+#
+# NOTE: Everything below this line is only used before the initial DB migration
+# If you would like to change these settings, use the admin FE
+#
+# https://docs.pleroma.social/backend/configuration/howto_database_config/
+# 
+
 config :pleroma, :instance,
 	name: "{{ pleroma_instance_name }}",
 	desc: "{{ pleroma_instance_desc }}",
@@ -22,19 +45,6 @@ config :pleroma, :media_proxy,
 	enabled: false,
 	redirect_on_failure: true
 
-# Use in-db configs where possible
-config :pleroma, configurable_from_database: true
-
-# DB configuration
-config :pleroma, Pleroma.Repo,
-	adapter: Ecto.Adapters.Postgres,
-	database: "{{ pleroma_db_name }}",
-	hostname: "{{ pleroma_db_host }}",
-	username: "{{ pleroma_db_user }}",
-	password: "{{ pleroma_db_pass }}",
-	pool_size: {{ pleroma_db_pool_size }}
-config :pleroma, :database, rum_enabled: false
-
 # Mail
 config :pleroma, Pleroma.Emails.Mailer,
 	enabled: false