ADMIN_NATIVE_PASSWORD={{ lookup('config', application_id, 'secrets.credentials.administrator_password') | dotenv_quote }}

ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

# nocheck: playwright-service-gate — assertCspInjections resolves this injector through a computed loop variable (personas/utils/csp.js), never a literal gate argument, so this rule's literal-only regex cannot see the gate
ASSET_SERVICE_ENABLED={{ lookup('config', application_id, 'services.asset.enabled') | string | lower }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

# nocheck: playwright-service-gate — assertCspInjections resolves this injector through a computed loop variable (personas/utils/csp.js), never a literal gate argument, so this rule's literal-only regex cannot see the gate
CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}

# nocheck: playwright-service-gate — the SMTP sender is pushed into Listmonk's settings table by tasks/02_manager_ops.yml (the `smtp` entry in vars/main.yml), never into a browser-visible surface, and no scenario in this spec sends a campaign
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}

# nocheck: playwright-service-gate — hCaptcha guards the public subscription form, which no persona scenario submits and which no headless run can solve
HCAPTCHA_SERVICE_ENABLED={{ lookup('config', application_id, 'services.hcaptcha.enabled') | string | lower }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

MCP_SERVICE_ENABLED={{ lookup('config', application_id, 'mcp.enabled') | string | lower }}

# nocheck: persona-block-rationale — Listmonk matches OIDC users by e-mail and provisions no biber account; cmd/auth.go OIDCFinish 404s unless security.oidc.auto_create_users is set, and createOIDCUser needs a real default_user_role_id, of which the seeded database has only Super Admin (see TODO.md).
PERSONA_BIBER_BLOCKED=true

# nocheck: playwright-service-gate — Listmonk refuses to start without its Postgres DSN, so every scenario already proves it and no DB status surface exists in the UI
POSTGRES_SERVICE_ENABLED={{ lookup('config', application_id, 'services.postgres.enabled') | string | lower }}

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}