True, but I’m pretty sure that Discourse won’t serve the settings. You can run the command from any directory, and it’s assumed that if you’re doing this kind of stuff you understand what you’re doing.
So you could just
cd /shared/
mkdir -p my-settings
cd my-settings
rake ...
before you run the rake task.
Sure the dump has the keys in it, but lots of that is in plaintext in a bunch of places already (e.g., if you follow recommended procedures your S3 keys are in app.yml).
Yes.