adjust secrets permissions and remove db password

discourse.nix

@@ -13,20 +13,32 @@
       passwordFile = "/run/secrets/discourse-admin-password";
       username = "yisroeldbaum";
     };
-    database.passwordFile = "/run/secrets/discourse-database-password";
+    database.ignorePostgresqlVersion = true;
     hostname = "discourse.torahimderecheretz.com";
     mail = {};
-    secretKeyBaseFile = "";
+    secretKeyBaseFile = "/run/secrets/discourse-secret-key";
+    siteSettings = {
+      required = {
+        title = "Torah Im Derech Eretz";
+        site_description = "A forum to discuss the ideas of Rav Shamshon Refael Hirsch";
+      };
+    };
   };
 
   sops.secrets = {
     "discourse-admin-password" = {
       sopsFile = ./secrets/discourseAdminPassword.yaml;
       mode = "0400";
+      key = "password";
+      owner = "discourse";
+      group = "discourse";
     };
-    "discourse-database-password" = {
+    "discourse-secret-key" = {
-      sopsFile = ./secrets/discourseDbPassword.yaml;
+      sopsFile = ./secrets/discourseSecretKey.yaml;
       mode = "0400";
+      key = "key";
+      owner = "discourse";
+      group = "discourse";
     };
   };
 }

secrets/discourseDbPassword.yaml

@@ -1,16 +0,0 @@
-password: ENC[AES256_GCM,data:MoZw9B6VrFAUItDr8m/n2GPUCEq3sbMkNowJ,iv:CA980ZplHFC/toPQGmEbRezORowkyJjg3erDXFJeXgI=,tag:+WbqAQej5lMEDplSTEz32w==,type:str]
-sops:
-    age:
-        - recipient: age1haj8v88kjna6ttkdufjpyjcf478kyvclnpdc8jwh97ewhqcc9eqsgrku4v
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERWtjZDJlRUtlTVBPL3R0
-            OXhXcTJrMzhVMXI0ajV4MmREa0Jpc0gzNEFrCm5kYW9udExWa3crUjY2ek5JVnVQ
-            MURJQzB5VjlCZi91NTF5VC9aRmZ3VzAKLS0tIE5FZ2g1RG5HdXNGZlA1VFg0YTJk
-            cGpibm1IT2FIQ204UjcxejdBQVFxWjgKgknlHGId4ZYuM0Je9ZkReDLMgAnOvzh8
-            qcQZKs2GYv1Gc5I/8H11SDtEdCeYAIjr4Brh65mRkuWr1yKX9y1QfA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-06-02T18:00:36Z"
-    mac: ENC[AES256_GCM,data:mAMyieqkB3Yz5SsqeS5Cl3S161W4hKuDzmFDakMheUT/JqmGO6GezHohBuKFRrJwgE+ZdJHVRtNjGe61xrSA9/al9YFJiApx5OcEjvLEsciIE5Fmey6kpo9F5q2FqoS/cuOMTy/BRFZe4uzMwOJVfx6Ky0C513xnS7LysNcIDGo=,iv:G9EDxYdAkItQwehO2J8TJM9mJdwdNwpBUXLlI1152j0=,tag:zqTnuZBRzmZjoFZsBYKizQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.12.2