APP_BASE_URL={{ OPENTALK_URL | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}

# nocheck: playwright-service-gate — persona drives the OIDC path; LDAP federation is exercised in the LDAP-only matrix variant
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}

LOGIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

LOGIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}

# nocheck: persona-block-rationale — the OpenTalk frontend is a public-client OIDC SPA: templates/env.j2:9-12 wires nothing but OIDC_ISSUER and OIDC_CLIENT_ID, there is no server-side session and no HTML login form, so the role drives it through its own redirect-racing helper keyed on LOGIN_USERNAME / LOGIN_PASSWORD (files/playwright/_shared.js:12-15 and :33-73) and never renders the ADMIN_USERNAME / ADMIN_PASSWORD pair the shared helper reads (roles/test-e2e-playwright/files/personas/admin.js:29-30). The Keycloak → dashboard chain is covered by files/playwright/test-sso-login.js (see README "Persona contract opt-outs").
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above; biber's Keycloak → dashboard chain is covered by files/playwright/test-sso-login.js:22-34, which stops at the dashboard because the browser-side OIDC session leaves the persona contract's in-app logout leg without a target.
PERSONA_BIBER_BLOCKED=true

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}