ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

DOMAIN_PRIMARY={{ DOMAIN_PRIMARY | dotenv_quote }}

# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}

# nocheck: playwright-service-gate — the injected panel renders on Keycloak's post-logout page, which the persona flows leave via the app under test rather than assert on
JAVASCRIPT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.javascript.enabled') | string | lower }}

KEYCLOAK_REALM_NAME={{ KEYCLOAK_REALM | dotenv_quote }}

# nocheck: playwright-service-gate — persona drives the OIDC path; LDAP federation is exercised in the LDAP-only matrix variant
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}

# nocheck: persona-required-envs — auth-provider role; persona-flow runners are not used here
# nocheck: playwright-service-gate — auth-provider role; generic persona scenarios are exempt (covered by bespoke realm-account / admin-console tests above)
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MAPACHE_PASSWORD={{ PLAYWRIGHT_MAPACHE_PASSWORD | dotenv_quote }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

# nocheck: playwright-service-gate — auth-provider role; generic persona scenarios are exempt
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

# nocheck: persona-block-rationale — Keycloak's only admin surface is the master-realm console, which accepts the permanent super-admin (KEYCLOAK_PERMANENT_ADMIN_USERNAME / _PASSWORD, vars/main.yml) and not the normal-realm ADMIN_PASSWORD the shared helper types; the bespoke master-realm console test carries the journey (see README "Persona contract opt-outs").
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — Keycloak provides sso rather than consuming it: meta/services.yml declares no sso block and pins logout.enabled=false, so APP_BASE_URL has neither a proxy gate nor an in-app OIDC link for the shared helper to click or log out of; biber's journey is the realm account console, covered bespoke (see README "Persona contract opt-outs").
PERSONA_BIBER_BLOCKED=true

SUPER_ADMIN_PASSWORD={{ KEYCLOAK_PERMANENT_ADMIN_PASSWORD | dotenv_quote }}

SUPER_ADMIN_USERNAME={{ KEYCLOAK_PERMANENT_ADMIN_USERNAME | dotenv_quote }}