diff --git a/cmd/web.go b/cmd/web.go
index 3a5c36833b272..9c7d493339f04 100644
--- a/cmd/web.go
+++ b/cmd/web.go
@@ -16,7 +16,6 @@ import (
 	"code.gitea.io/gitea/modules/graceful"
 	"code.gitea.io/gitea/modules/log"
 	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/util"
 	"code.gitea.io/gitea/routers"
 	"code.gitea.io/gitea/routers/routes"
 
@@ -152,19 +151,6 @@ func setPort(port string) error {
 	case setting.FCGI:
 	case setting.FCGIUnix:
 	default:
-		// Save LOCAL_ROOT_URL if port changed
-		cfg := ini.Empty()
-		isFile, err := util.IsFile(setting.CustomConf)
-		if err != nil {
-			log.Fatal("Unable to check if %s is a file", err)
-		}
-		if isFile {
-			// Keeps custom settings if there is already something.
-			if err := cfg.Append(setting.CustomConf); err != nil {
-				return fmt.Errorf("Failed to load custom conf '%s': %v", setting.CustomConf, err)
-			}
-		}
-
 		defaultLocalURL := string(setting.Protocol) + "://"
 		if setting.HTTPAddr == "0.0.0.0" {
 			defaultLocalURL += "localhost"
@@ -173,10 +159,10 @@ func setPort(port string) error {
 		}
 		defaultLocalURL += ":" + setting.HTTPPort + "/"
 
-		cfg.Section("server").Key("LOCAL_ROOT_URL").SetValue(defaultLocalURL)
-		if err := cfg.SaveTo(setting.CustomConf); err != nil {
-			return fmt.Errorf("Error saving generated LOCAL_ROOT_URL to custom config: %v", err)
-		}
+		// Save LOCAL_ROOT_URL if port changed
+		setting.CreateOrAppendToCustomConf(func(cfg *ini.File) {
+			cfg.Section("server").Key("LOCAL_ROOT_URL").SetValue(defaultLocalURL)
+		})
 	}
 	return nil
 }
diff --git a/modules/setting/lfs.go b/modules/setting/lfs.go
index ab475bbeb4b31..38c656fc29858 100644
--- a/modules/setting/lfs.go
+++ b/modules/setting/lfs.go
@@ -6,14 +6,11 @@ package setting
 
 import (
 	"encoding/base64"
-	"os"
-	"path/filepath"
 	"time"
 
 	"code.gitea.io/gitea/modules/generate"
 	"code.gitea.io/gitea/modules/git"
 	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/util"
 
 	ini "gopkg.in/ini.v1"
 )
@@ -64,27 +61,9 @@ func newLFSService() {
 			}
 
 			// Save secret
-			cfg := ini.Empty()
-			isFile, err := util.IsFile(CustomConf)
-			if err != nil {
-				log.Error("Unable to check if %s is a file. Error: %v", CustomConf, err)
-			}
-			if isFile {
-				// Keeps custom settings if there is already something.
-				if err := cfg.Append(CustomConf); err != nil {
-					log.Error("Failed to load custom conf '%s': %v", CustomConf, err)
-				}
-			}
-
-			cfg.Section("server").Key("LFS_JWT_SECRET").SetValue(LFS.JWTSecretBase64)
-
-			if err := os.MkdirAll(filepath.Dir(CustomConf), os.ModePerm); err != nil {
-				log.Fatal("Failed to create '%s': %v", CustomConf, err)
-			}
-			if err := cfg.SaveTo(CustomConf); err != nil {
-				log.Fatal("Error saving generated JWT Secret to custom config: %v", err)
-				return
-			}
+			CreateOrAppendToCustomConf(func(cfg *ini.File) {
+				cfg.Section("server").Key("LFS_JWT_SECRET").SetValue(LFS.JWTSecretBase64)
+			})
 		}
 	}
 }
diff --git a/modules/setting/setting.go b/modules/setting/setting.go
index ec8e64578bf91..c16520572d357 100644
--- a/modules/setting/setting.go
+++ b/modules/setting/setting.go
@@ -793,27 +793,10 @@ func NewContext() {
 				log.Fatal("error generating JWT secret: %v", err)
 				return
 			}
-			cfg := ini.Empty()
-			isFile, err := util.IsFile(CustomConf)
-			if err != nil {
-				log.Error("Unable to check if %s is a file. Error: %v", CustomConf, err)
-			}
-			if isFile {
-				if err := cfg.Append(CustomConf); err != nil {
-					log.Error("failed to load custom conf %s: %v", CustomConf, err)
-					return
-				}
-			}
-			cfg.Section("oauth2").Key("JWT_SECRET").SetValue(OAuth2.JWTSecretBase64)
 
-			if err := os.MkdirAll(filepath.Dir(CustomConf), os.ModePerm); err != nil {
-				log.Fatal("failed to create '%s': %v", CustomConf, err)
-				return
-			}
-			if err := cfg.SaveTo(CustomConf); err != nil {
-				log.Fatal("error saving generating JWT secret to custom config: %v", err)
-				return
-			}
+			CreateOrAppendToCustomConf(func(cfg *ini.File) {
+				cfg.Section("oauth2").Key("JWT_SECRET").SetValue(OAuth2.JWTSecretBase64)
+			})
 		}
 	}
 
@@ -1075,26 +1058,9 @@ func loadOrGenerateInternalToken(sec *ini.Section) string {
 		}
 
 		// Save secret
-		cfgSave := ini.Empty()
-		isFile, err := util.IsFile(CustomConf)
-		if err != nil {
-			log.Error("Unable to check if %s is a file. Error: %v", CustomConf, err)
-		}
-		if isFile {
-			// Keeps custom settings if there is already something.
-			if err := cfgSave.Append(CustomConf); err != nil {
-				log.Error("Failed to load custom conf '%s': %v", CustomConf, err)
-			}
-		}
-
-		cfgSave.Section("security").Key("INTERNAL_TOKEN").SetValue(token)
-
-		if err := os.MkdirAll(filepath.Dir(CustomConf), os.ModePerm); err != nil {
-			log.Fatal("Failed to create '%s': %v", CustomConf, err)
-		}
-		if err := cfgSave.SaveTo(CustomConf); err != nil {
-			log.Fatal("Error saving generated INTERNAL_TOKEN to custom config: %v", err)
-		}
+		CreateOrAppendToCustomConf(func(cfg *ini.File) {
+			cfg.Section("security").Key("INTERNAL_TOKEN").SetValue(token)
+		})
 	}
 	return token
 }
@@ -1160,6 +1126,32 @@ func MakeManifestData(appName string, appURL string, absoluteAssetURL string) []
 	return bytes
 }
 
+// CreateOrAppendToCustomConf creates or updates the custom config.
+// Use the callback to set individual values.
+func CreateOrAppendToCustomConf(callback func(cfg *ini.File)) {
+	cfg := ini.Empty()
+	isFile, err := util.IsFile(CustomConf)
+	if err != nil {
+		log.Error("Unable to check if %s is a file. Error: %v", CustomConf, err)
+	}
+	if isFile {
+		if err := cfg.Append(CustomConf); err != nil {
+			log.Error("failed to load custom conf %s: %v", CustomConf, err)
+			return
+		}
+	}
+
+	callback(cfg)
+
+	if err := os.MkdirAll(filepath.Dir(CustomConf), os.ModePerm); err != nil {
+		log.Fatal("failed to create '%s': %v", CustomConf, err)
+		return
+	}
+	if err := cfg.SaveTo(CustomConf); err != nil {
+		log.Fatal("error saving to custom config: %v", err)
+	}
+}
+
 // NewServices initializes the services
 func NewServices() {
 	InitDBConfig()