1diff --git a/config.example.scfg b/config.example.scfg
 2index 5c3e5e4ff8452643ed462be5a8d494f9c4499d18..59a04ad1644103962c89fb9c498e64d1035b3666 100644
 3--- a/config.example.scfg
 4+++ b/config.example.scfg
 5@@ -3,23 +3,31 @@ # listen-addr tcp://localhost:8080
 6 listen-addr unix://var/run/cerrado.sock
 7 
 8 root-readme /srv/git/README.md
 9+syntax-highlight monokailight
10+
11+# if passphrase is empty the whole authentication, private/public repository
12+# and login UI will be disabled, and only public repository will be displayed.
13 passphrase $2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq
14 aes-key 8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==
15-syntax-highlight monokailight
16 
17+# repository section is order dependent where the first repository has priority
18+# in case of conflict. Repository has also priority over scan. The order
19+# between scan and repository is irrelevant which means that all repository
20+# sections will be read first then all the scans.
21+repository /srv/git/cerrado.git {
22+    name cerrado
23+    description "Self host single person forge"
24+    public true
25+}
26 
27+# scan is order dependent where first scan has priority in case of conflict. So
28+# if you add another scan section bellow that scan the same folders it will be
29+# ignored.
30 scan /srv/git/private {
31     public false
32 }
33 
34 scan /srv/git/ {
35-    public true
36-}
37-
38-
39-repository /srv/git/cerrado.git {
40-    name cerrado
41-    description "Self host single person forge"
42     public true
43 }
44