diff --git a/Dockerfile.tinc b/Dockerfile.tinc
index 9dfad1f..0301f1c 100644
--- a/Dockerfile.tinc
+++ b/Dockerfile.tinc
@@ -6,4 +6,4 @@ RUN apk add tinc
 EXPOSE 9993/tcp 655/udp
 VOLUME /etc/tinc
 
-CMD [ "sh", "-c", "/usr/sbin/tincd --net=$NETNAME --no-detach --user nobody --debug=3" ]
+CMD [ "sh", "-c", "/usr/sbin/tincd --net=$NETNAME --no-detach --user=nobody --debug=3" ]
diff --git a/tinc/lixonet/tinc.conf.tmpl b/tinc/lixonet/tinc.conf.tmpl
index c0fc565..b553ef6 100644
--- a/tinc/lixonet/tinc.conf.tmpl
+++ b/tinc/lixonet/tinc.conf.tmpl
@@ -18,23 +18,22 @@ BindToAddress ${tinc_bind_address}
 Port = ${tinc_bind_port:-9994}
 
 # Device is named "lixonet" by Tinc and visible directly in host kernel
-DeviceType = ${tinc_device_type:tap}
-Device = ${tinc_device:/dev/net/tun}
-Mode = ${tinc_mode:switch}
-AddressFamily = ${tinc_address_family:ipv4}
+DeviceType = ${tinc_device_type:-tap}
+Device = ${tinc_device:-/dev/net/tun}
+Mode = ${tinc_mode:-switch}
+AddressFamily = ${tinc_address_family:-ipv4}
 
 # Default over-the-wire security for Lixonet.
 # Blowfish: https://en.wikipedia.org/wiki/Blowfish_(cipher)
 # SHA1: https://en.wikipedia.org/wiki/SHA-1
-Cipher = ${tinc_cipher:blowfish}
-Digest = ${tinc_digest:sha1}
+Cipher = ${tinc_cipher:-blowfish}
+Digest = ${tinc_digest:-sha1}
 
 # When this option is enabled, packets that cannot be sent directly to the
-# estination node, but which would have to be forwarded by an intermediate node,
+# destination node, but which would have to be forwarded by an intermediate node,
 # are dropped instead. When combined with the IndirectData option, packets for
 # nodes for which we do not have a meta connection with are also dropped.
-DirectOnly = ${tinc_direct_only:yes}
-
+DirectOnly = ${tinc_direct_only:-yes}
 
 {{ if len "${tinc_connect_to:-}" }}
 # Custom connect-to list
@@ -42,7 +41,7 @@ DirectOnly = ${tinc_direct_only:yes}
 ConnectTo = {{.}}
 {{ end }}
 {{ else }}
-# In the following section, list backbone/core Lxn3 nodes to connect to at boot
+# In the following section, list built-in backbone/core Lxn3 nodes to connect to at boot
 ConnectTo = denco_mane_lixo
 ConnectTo = phxaz_nurd_lixo
 ConnectTo = daltx_nurd_lixo