APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
FEDIWALL_DEFAULT_SLUG={{ (FEDIWALL_WALLS | first).slug | dotenv_quote }}
FEDIWALL_WALL_SLUGS={{ (FEDIWALL_WALLS | map(attribute='slug') | list) | to_json | dotenv_quote }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MASTODON_SERVICE_ENABLED={{ ('true' if 'web-app-mastodon' in group_names else 'false') }}
FRIENDICA_SERVICE_ENABLED={{ ('true' if 'web-app-friendica' in group_names else 'false') }}

{% if 'web-app-mastodon' in group_names %}
MASTODON_BASE_URL={{ lookup('tls', 'web-app-mastodon', 'url.base') | dotenv_quote }}
{% endif %}
{% if 'web-app-friendica' in group_names %}
FRIENDICA_BASE_URL={{ lookup('tls', 'web-app-friendica', 'url.base') | dotenv_quote }}
{% endif %}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

# nocheck: persona-block-rationale — Fediwall is a read-only public wall: meta/services.yml pins `sso.enabled: false` and `logout.enabled: false`, and the container is a plain nginx serving the pre-built upstream tarball (`services.fediwall.image: nginx`, `services.fediwall.upstream.tarball_url`). It ships no account model, no login form and no logout control for the persona helper to drive.
PERSONA_BIBER_BLOCKED=true
# nocheck: persona-block-rationale — see PERSONA_BIBER_BLOCKED above; additionally every wall is baked at deploy time from `services.fediwall.walls` (vars/main.yml FEDIWALL_WALLS), so administration happens in Ansible and there is no in-app admin surface at all.
PERSONA_ADMINISTRATOR_BLOCKED=true

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
# nocheck: playwright-service-gate — SSO surface; auth flow gated by Keycloak realm not Playwright env var
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}