diff --git a/discourse.nix b/discourse.nix index f919b2e..3ecdbf1 100644 --- a/discourse.nix +++ b/discourse.nix @@ -10,53 +10,23 @@ admin = { email = "yisroel.d.baum@gmail.com"; fullName = "Yisroel Baum"; - passwordFile = config.sops.secrets."discourse-admin-password".path; + passwordFile = "/run/secrets/discourse-admin-password"; username = "yisroeldbaum"; }; - database.ignorePostgresqlVersion = true; + database.passwordFile = "/run/secrets/discourse-database-password"; hostname = "discourse.torahimderecheretz.com"; - mail = { - notificationEmailAddress = "noreply@discourse.torahimderecheretz.com"; - contactEmailAddress = ""; - - outgoing = { - serverAddress = "in-v3.mailjet.com"; - port = 587; - username = "1ebdd73d944240c1a9c3201e52a1e8c6"; - passwordFile = config.sops.secrets."discourse-mail-key".path; - authentication = "login"; - }; - }; - secretKeyBaseFile = config.sops.secrets."discourse-secret-key".path; - siteSettings = { - required = { - title = "Torah Im Derech Eretz"; - site_description = "A forum to discuss the ideas of Rav Shamshon Refael Hirsch"; - }; - }; + mail = {}; + secretKeyBaseFile = ""; }; sops.secrets = { "discourse-admin-password" = { sopsFile = ./secrets/discourseAdminPassword.yaml; mode = "0400"; - key = "password"; - owner = "discourse"; - group = "discourse"; }; - "discourse-secret-key" = { - sopsFile = ./secrets/discourseSecretKey.yaml; + "discourse-database-password" = { + sopsFile = ./secrets/discourseDbPassword.yaml; mode = "0400"; - key = "key"; - owner = "discourse"; - group = "discourse"; - }; - "discourse-mail-key" = { - sopsFile = ./secrets/discourseMailKey.yaml; - mode = "0400"; - key = "key"; - owner = "discourse"; - group = "discourse"; }; }; } diff --git a/secrets/discourseDbPassword.yaml b/secrets/discourseDbPassword.yaml new file mode 100644 index 0000000..6967141 --- /dev/null +++ b/secrets/discourseDbPassword.yaml @@ -0,0 +1,16 @@ +password: ENC[AES256_GCM,data:MoZw9B6VrFAUItDr8m/n2GPUCEq3sbMkNowJ,iv:CA980ZplHFC/toPQGmEbRezORowkyJjg3erDXFJeXgI=,tag:+WbqAQej5lMEDplSTEz32w==,type:str] +sops: + age: + - recipient: age1haj8v88kjna6ttkdufjpyjcf478kyvclnpdc8jwh97ewhqcc9eqsgrku4v + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERWtjZDJlRUtlTVBPL3R0 + OXhXcTJrMzhVMXI0ajV4MmREa0Jpc0gzNEFrCm5kYW9udExWa3crUjY2ek5JVnVQ + MURJQzB5VjlCZi91NTF5VC9aRmZ3VzAKLS0tIE5FZ2g1RG5HdXNGZlA1VFg0YTJk + cGpibm1IT2FIQ204UjcxejdBQVFxWjgKgknlHGId4ZYuM0Je9ZkReDLMgAnOvzh8 + qcQZKs2GYv1Gc5I/8H11SDtEdCeYAIjr4Brh65mRkuWr1yKX9y1QfA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-06-02T18:00:36Z" + mac: ENC[AES256_GCM,data:mAMyieqkB3Yz5SsqeS5Cl3S161W4hKuDzmFDakMheUT/JqmGO6GezHohBuKFRrJwgE+ZdJHVRtNjGe61xrSA9/al9YFJiApx5OcEjvLEsciIE5Fmey6kpo9F5q2FqoS/cuOMTy/BRFZe4uzMwOJVfx6Ky0C513xnS7LysNcIDGo=,iv:G9EDxYdAkItQwehO2J8TJM9mJdwdNwpBUXLlI1152j0=,tag:zqTnuZBRzmZjoFZsBYKizQ==,type:str] + unencrypted_suffix: _unencrypted + version: 3.12.2 diff --git a/secrets/discourseMailKey.yaml b/secrets/discourseMailKey.yaml deleted file mode 100644 index ff58b3b..0000000 --- a/secrets/discourseMailKey.yaml +++ /dev/null @@ -1,16 +0,0 @@ -key: ENC[AES256_GCM,data:Flvbs7sRCQ3BtSJXWurmVA+QQmvSo/fxrOVJNalBjj8=,iv:ddmk1XCjvNRmmqGhZwOWDlYSkdKz3ryyQwrav/T6Oz8=,tag:DvSjwdK01UAvBL1mYCe7kA==,type:str] -sops: - age: - - recipient: age1haj8v88kjna6ttkdufjpyjcf478kyvclnpdc8jwh97ewhqcc9eqsgrku4v - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVUGFmM010b3NhdCtPME5O - RWRkUjF0akVEZVFtNkhZeUVSeWpWL3pKNG1nCllObGlPOTcrSyt1a2NCc0U4TVZM - cWVQbjJocEUySHFYaDFmNzllOGhuQWcKLS0tIHFJeFdUWENxK1RRSlhvSEI4NXlO - TG1wM1FTWjBBWHdHNnBUUE1kNWE4akUK1Ehv5kYNZrbf3m3vH5Oyy/g2mz8kIX8T - l2k1LbhUo3cNzIjkNM05RSrLZEBPItoo2nc9oTAPZiF1U/K76SMP6g== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-06-03T07:59:50Z" - mac: ENC[AES256_GCM,data:E4WwhOqUCmOBXwYUR5nFzth59F50KE7k88NkOBc6ERnX4b5joy0lmExenprH019UVJ/HSXOCWphUMwTat70uzwhaKBtlfa7AWmWyMa6zhIzxTsFagI4h1nWQP00uGb0MM3ULR3mcLtxXyTtZFWuY/d8ttdYBuv2oe29ikJTX610=,iv:gAZPLiYcNGq8LSEpIxDzDqdan+CJKyQ+SnQXHmponns=,tag:3tI0it3h6foT9W7zK3rmxg==,type:str] - unencrypted_suffix: _unencrypted - version: 3.12.2