ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', DASHBOARD_APPLICATION_ID, 'url.base') }}

ASSET_SERVICE_ENABLED={{ lookup('config', application_id, 'services.asset.enabled') | string | lower }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

CDN_BASE_URL={{ lookup('tls', 'web-svc-cdn', 'url.base') | dotenv_quote }}

CDN_SERVICE_ENABLED={{ lookup('config', application_id, 'services.cdn.enabled') | string | lower }}

CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}

DASHBOARD_JS_BASE_URL={{ DASHBOARD_JS_BASE_URL | dotenv_quote }}

DASHBOARD_TARGET_ROLES_JSON={{ lookup('roles_with_service', 'dashboard') | to_json | dotenv_quote }}

LOGIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

LOGIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}

# nocheck: persona-block-rationale — the dashboard is port-ui, a tile launcher whose whole Keycloak integration is the browser-side `oidc.js` bundle; vars/main.yml `DASHBOARD_JS_FILES` ships that file only when `services.sso.enabled` is true, so with SSO off the page renders neither a Login link nor a logout control. port-ui has no admin tier either — meta/services.yml declares `sso.flavor: oidc` and nothing role-scoped.
PERSONA_ADMINISTRATOR_BLOCKED={{ (not (lookup('config', application_id, 'services.sso.enabled') | bool)) | string | lower }}

# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above: with SSO off `oidc.js` is not rendered, so the dashboard shows no Login link and the persona helpers have no auth surface to drive.
PERSONA_BIBER_BLOCKED={{ (not (lookup('config', application_id, 'services.sso.enabled') | bool)) | string | lower }}

PLATFORM_FAVICON_URL={{ DASHBOARD_PLATFORM_FAVICON_URL | dotenv_quote }}

PLATFORM_LOGO_URL={{ DASHBOARD_PLATFORM_LOGO_URL | dotenv_quote }}

SIMPLEICONS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.simpleicons.enabled') | string | lower }}

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}