ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

# nocheck: playwright-service-gate — assertCspInjections resolves this injector through a computed loop variable (personas/utils/csp.js), never a literal gate argument, so this rule's literal-only regex cannot see the gate
CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}

# nocheck: playwright-service-gate — the flag only decides whether templates/env.j2 renders the SMTP_* block; every persona logs in through Keycloak (OMNIAUTH_ONLY), so no scenario in this spec triggers a confirmation or digest mail
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

# nocheck: playwright-service-gate — the role's own provider service; a spec cannot skip itself on its own flag, so there is nothing to gate
MASTODON_SERVICE_ENABLED={{ lookup('config', application_id, 'services.mastodon.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

# nocheck: persona-block-rationale — tasks/05_administrator.yml creates the account with `tootctl accounts create` and never sets or captures a password, so ADMIN_PASSWORD (the Keycloak secret) cannot drive Mastodon's native /auth/sign_in once the sso: false variants remove the OIDC chain (see README "Persona contract opt-outs").
PERSONA_ADMINISTRATOR_BLOCKED={{ 'false' if (lookup('config', application_id, 'services.sso.enabled') | bool) else 'true' }}

# nocheck: persona-block-rationale — no Mastodon account is provisioned for biber; the OIDC sign-in (templates/env.j2:61-72) is the only path that would create one, and the sso: false variants remove it (see README "Persona contract opt-outs").
PERSONA_BIBER_BLOCKED={{ 'false' if (lookup('config', application_id, 'services.sso.enabled') | bool) else 'true' }}

# nocheck: playwright-service-gate — Rails refuses to boot without its database, so every scenario in this spec already proves Postgres is reachable
POSTGRES_SERVICE_ENABLED={{ lookup('config', application_id, 'services.postgres.enabled') | string | lower }}

# nocheck: playwright-service-gate — Sidekiq queue and session store behind every authenticated scenario; it has no browser-visible surface of its own
REDIS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.redis.enabled') | string | lower }}

SEAWEEDFS_ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

SEAWEEDFS_ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

SEAWEEDFS_APP_BUCKET={{ lookup('objstore', application_id, 'bucket') | dotenv_quote }}

SEAWEEDFS_FILER_URL={{ lookup('canonical_url', 'web-app-seaweedfs', 'filer', consumer=application_id) | dotenv_quote }}

SEAWEEDFS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.seaweedfs.enabled') | string | lower }}

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}