If you’re not going to use the same S3 bucket then there is a hidden setting that forces the backup to download the S3 files. You can look in the settings file for the name and set it at the rails console. There’s a topic that discusses it, but it might be easiest to look in settings.yml.
You don’t need to run discourse-setup, just copy the app.yml and rebuild.
You can rsync over the let’s encrypt certificates. In fact you can copy over the whole /var/discourse (perhaps excluding some logs and such).