{
  config,
  lib,
  pkgs,
  ...
}:
{
  services.discourse = {
    enable = true;
    admin = {
      email = "yisroel.d.baum@gmail.com";
      fullName = "Yisroel Baum";
      passwordFile = config.sops.secrets."discourse-admin-password".path;
      username = "yisroeldbaum";
    };
    database.ignorePostgresqlVersion = true;
    hostname = "discourse.torahimderecheretz.com";
    mail = {
      notificationEmailAddress = "system@torahimderecheretz.com";
      contactEmailAddress = "system@torahimderecheretz.com";

      outgoing = {
        serverAddress = "in-v3.mailjet.com";
        port = 587;
        username = "1ebdd73d944240c1a9c3201e52a1e8c6";
        passwordFile = config.sops.secrets."discourse-mail-key".path;
        authentication = "login";
      };
    };
    secretKeyBaseFile = config.sops.secrets."discourse-secret-key".path;
    siteSettings = {
      required = {
        title = "Torah Im Derech Eretz";
        site_description = "A forum to discuss the ideas of Rav Shamshon Refael Hirsch";
      };
    };
  };

  services.borgbackup.jobs.discourse = {
    paths = [
      "/var/lib/discourse"
      "/var/backup/discourse/discourse.dump"
    ];
    repo = "ssh://oas17j8p@oas17j8p.repo.borgbase.com/./repo";
    user = "root";
    group = "root";
    encryption = {
      mode = "repokey-blake2";
      passCommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg-passphrase".path}";
    };
    doInit = true;
    compression = "auto,zstd";
    startAt = "*-*-* 07:15:00";
    persistentTimer = true;
    prune.keep = {
      daily = 7;
      weekly = 4;
      monthly = 6;
    };
    readWritePaths = [ "/var/backup/discourse" ];
    environment.BORG_RSH = "ssh -i ${config.sops.secrets."borg-private-key".path} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts";
    preHook = ''
      discourseWasActive=/root/.cache/borg/discourse-was-active
      dumpFile=/var/backup/discourse/discourse.dump

      if ${pkgs.systemd}/bin/systemctl is-active --quiet discourse.service; then
        touch "$discourseWasActive"
        ${pkgs.systemd}/bin/systemctl stop discourse.service
      else
        rm -f "$discourseWasActive"
      fi

      rm -f "$dumpFile"
      umask 077
      ${lib.getExe' pkgs.su "su"} -s ${pkgs.runtimeShell} ${config.services.postgresql.superUser} -c '${config.services.postgresql.package}/bin/pg_dump --format=custom --dbname=${config.services.discourse.database.name}' > "$dumpFile"
    '';
    postHook = ''
      discourseWasActive=/root/.cache/borg/discourse-was-active
      dumpFile=/var/backup/discourse/discourse.dump

      rm -f "$dumpFile"

      if [ -e "$discourseWasActive" ]; then
        ${pkgs.systemd}/bin/systemctl start discourse.service
        rm -f "$discourseWasActive"
      fi
    '';
  };

  systemd.tmpfiles.rules = [
    "d /var/backup/discourse 0700 root root - -"
  ];

  systemd.services.borgbackup-job-discourse = {
    after = [
      "sops-install-secrets.service"
      "network-online.target"
      "postgresql.target"
      "discourse-postgresql.service"
    ];
    wants = [
      "network-online.target"
      "postgresql.target"
      "discourse-postgresql.service"
    ];
  };

  sops.secrets = {
    "discourse-admin-password" = {
      sopsFile = ./secrets/discourseAdminPassword.yaml;
      mode = "0400";
      key = "password";
      owner = "discourse";
      group = "discourse";
    };
    "discourse-secret-key" = {
      sopsFile = ./secrets/discourseSecretKey.yaml;
      mode = "0400";
      key = "key";
      owner = "discourse";
      group = "discourse";
    };
    "discourse-mail-key" = {
      sopsFile = ./secrets/discourseMailKey.yaml;
      mode = "0400";
      key = "key";
      owner = "discourse";
      group = "discourse";
    };
  };
}