ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

KEYCLOAK_ADMIN_CLI_CLIENT_ID={{ OIDC.ADMIN.CLI_CLIENT_ID | dotenv_quote }}

KEYCLOAK_ADMIN_REALM={{ OIDC.ADMIN.REALM | dotenv_quote }}

KEYCLOAK_BASE_URL={{ OIDC.URL | dotenv_quote }}

KEYCLOAK_REALM_NAME={{ OIDC.CLIENT.REALM | dotenv_quote }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}

# nocheck: persona-block-rationale  with sso off the dashboard only accepts the internal admin/kibanaserver HTTP basic accounts, and the persona helper drives Keycloak login only.
PERSONA_ADMINISTRATOR_BLOCKED={{ (not (WAZUH_OIDC_ENABLED | bool)) | string | lower }}

RBAC_GROUP_PATH_PREFIX={{ ('/' ~ (RBAC.GROUP.NAME | trim('/')) ~ '/' ~ application_id ~ '/') | dotenv_quote }}

SSO_SERVICE_ENABLED={{ WAZUH_OIDC_ENABLED | string | lower }}

SUPER_ADMIN_PASSWORD={{ (lookup('config', 'web-app-keycloak', 'secrets.credentials.administrator_password') | dotenv_quote) if (WAZUH_OIDC_ENABLED | bool) else '""' }}

SUPER_ADMIN_USERNAME={{ (lookup('config', 'web-app-keycloak', 'services.keycloak.accounts.system.username') | dotenv_quote) if (WAZUH_OIDC_ENABLED | bool) else '""' }}