ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

LITELLM_UI_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}

# nocheck: persona-block-rationale: without Keycloak the LiteLLM admin UI knows only the single UI_USERNAME account svc-ai-litellm provisions, so the administrator persona holds no credential it accepts; with SSO on, test-oidc-login.js drives the Keycloak round-trip instead of the shared persona helper, because the UI offers no DOM logout control the helper can reach afterwards (see TODO.md).
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale: PROXY_ADMIN_ID names the administrator account alone, so an SSO round-trip as biber lands on the UI without admin rights and there is no biber-shaped surface to assert.
PERSONA_BIBER_BLOCKED=true

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}