CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

HOMEASSISTANT_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

# nocheck: playwright-service-gate
MCP_SERVICE_ENABLED={{ lookup('config', application_id, 'mcp.enabled') | string | lower }}

# nocheck: persona-block-rationale: Home Assistant runs its own auth provider. The hub account is provisioned from secrets.credentials.administrator_password rather than the platform user password, and meta/services.yml pins sso.enabled false, so the administrator persona holds no credential the hub accepts.
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale: the deploy provisions only the hub administrator and the MCP service account in Home Assistant's own auth provider, and meta/services.yml pins sso.enabled false, so no auth path exists that would admit biber.
PERSONA_BIBER_BLOCKED=true