# Stock pixelfed /login expects an email, not a username; used by the native-login test that exercises the upstream form without OIDC.
ADMIN_EMAIL={{ lookup('users', 'administrator').email | dotenv_quote }}

ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}

BIBER_OIDC_EMAIL_OVERRIDE={{ (lookup('users', 'biber').username ~ '@' ~ SOFTWARE_DOMAIN) | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}

KEYCLOAK_ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

KEYCLOAK_ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

KEYCLOAK_BASE_URL={{ lookup('tls', 'web-app-keycloak', 'url.base') | dotenv_quote }}

KEYCLOAK_REALM={{ OIDC.CLIENT.REALM | dotenv_quote }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}

# nocheck: persona-block-rationale — pixelfed's login id is the account e-mail (ADMIN_EMAIL above, files/playwright/test-native-login-administrator.js:20 and :47), not the Keycloak username the shared helper types into the login field (roles/test-e2e-playwright/files/personas/admin.js:74-81), and the artisan-bootstrapped administrator name is reserved so pixelfed's first-time OIDC registration cannot mint it either (tasks/03_administrator.yml:29-45, files/playwright/_shared.js:24-27). Coverage: files/playwright/test-native-login-administrator.js and test-oidc-login-administrator.js (see README "Persona contract opt-outs").
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — biber's first OIDC login only passes pixelfed's `email:strict,…,dns,spoof` validator after the spec rewrites his Keycloak e-mail to a resolvable domain through the Keycloak admin API (BIBER_OIDC_EMAIL_OVERRIDE above, files/playwright/_shared.js:1-7 and :405-440); without that setup step the callback dies in a ValidationException, and the shared helper has no such step. Coverage: files/playwright/test-oidc-login-biber.js (see README "Persona contract opt-outs").
PERSONA_BIBER_BLOCKED=true

PIXELFED_BASE_URL={{ lookup('tls', 'web-app-pixelfed', 'url.base') | dotenv_quote }}

SEAWEEDFS_ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

SEAWEEDFS_ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

SEAWEEDFS_APP_BUCKET={{ lookup('objstore', application_id, 'bucket') | dotenv_quote }}

SEAWEEDFS_FILER_URL={{ lookup('canonical_url', 'web-app-seaweedfs', 'filer', consumer=application_id) | dotenv_quote }}

SEAWEEDFS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.seaweedfs.enabled') | string | lower }}

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}