APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}
MOODLE_OIDC_SCOPE_NAME={{ MOODLE_OIDC_CUSTOM_SCOPE | dotenv_quote }}
OIDC_CLIENT_ID={{ OIDC.CLIENT.ID | dotenv_quote }}
{% if lookup('config', application_id, 'services.lam.enabled', false) | bool %}
LAM_BASE_URL={{ lookup('tls', 'web-app-lam', 'url.base') | dotenv_quote }}
LAM_PASSWORD={{ lookup('config', 'web-app-lam', 'secrets.credentials.administrator_password') | dotenv_quote }}
LAM_OAUTH2_FRONTED={{ lookup('sso', 'web-app-lam', 'is_proxy_gated') | string | lower }}
LDAP_ADMIN_PASSWORD={{ LDAP.BIND_CREDENTIAL | dotenv_quote }}
{% endif %}
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
ADMIN_NATIVE_PASSWORD={{ MOODLE_ADMIN_PASSWORD | dotenv_quote }}
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

# nocheck: persona-block-rationale — in the SSO variant tasks/04_oidc.yml replaces the login page with an alternateloginurl bounce and flips every mdl_user row to auth='oidc', so no form accepts the administrator secret, and the sso-off variants in meta/variants.yml have no OIDC chain to substitute — one env file is rendered per role, not per variant (see README "Persona contract opt-outs").
PERSONA_ADMINISTRATOR_BLOCKED=true

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

LITELLM_SERVICE_ENABLED={{ lookup('config', application_id, 'services.litellm.enabled') | string | lower }}
MOODLE_AI_PROVIDER_NAME={{ MOODLE_LITELLM_PROVIDER_NAME | dotenv_quote }}
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}
LAM_SERVICE_ENABLED={{ lookup('config', application_id, 'services.lam.enabled', false) | string | lower }}
MCP_SERVICE_ENABLED={{ lookup('config', application_id, 'mcp.enabled') | string | lower }}
MCP_ENDPOINT_PATH={{ lookup('config', application_id, 'mcp.endpoint.path') | dotenv_quote }}

{{ lookup('addon_env_flags', application_id) }}