ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('applications', application_id).domains.canonical.console | dotenv_quote }}

LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

MINIO_API_URL={{ MINIO_API_URL | dotenv_quote }}

MINIO_CONSOLE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

OIDC_CLIENT_ID={{ OIDC.CLIENT.ID | dotenv_quote }}

OIDC_CLIENT_SECRET={{ OIDC.CLIENT.SECRET | dotenv_quote }}

OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}

# nocheck: persona-block-rationale — the MinIO Console version pinned by this role never renders an SSO button: /api/v1/login answers redirectRules: null however the IdP is registered server-side, so there is no in-page OIDC entry point for the shared helper to click. The integrated OIDC path is proven at the STS AssumeRoleWithWebIdentity tier by the role's own spec instead (see README "Persona contract opt-outs").
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — the only MinIO policy this role creates is the administrator RBAC group path (vars/main.yml MINIO_OIDC_POLICY_NAME, attached in tasks/02_ldap.yml), and MinIO has no self-service signup; biber maps to no policy, so neither the STS exchange nor the Console yields an authenticated surface for him (see README "Persona contract opt-outs").
PERSONA_BIBER_BLOCKED=true

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}