ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

# nocheck: playwright-service-gate — web-svc-css is injected at the vhost level; assertCspInjections resolves the flag through a loop variable, never a literal gate
CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}

# nocheck: playwright-service-gate — ldap is pinned true in services.yml and no variant toggles it, so a gate on it could never skip; LAM is the LDAP front-end itself
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

# nocheck: persona-block-rationale — LAM answers / with a redirect to /lam/, whose body is only a meta refresh to templates/login.php, so the shared helper's landing probe samples an empty interstitial and never reaches the form; and LAM authenticates by binding the DN in its Admins list, which templates/env.j2 fills with LDAP.DN.ADMINISTRATOR.DATA and LDAP.BIND_CREDENTIAL, not the lookup('users','administrator').password the helper types (see README "Persona contract opt-outs").
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — meta/services.yml admits only the web-app-lam administrator RBAC group to the oauth2-proxy (sso.oauth2.allowed_groups) and biber carries no roles, so biber is denied at the proxy before LAM is reached (see README "Persona contract opt-outs").
PERSONA_BIBER_BLOCKED=true

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}