ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

AI_GATEWAY_BASE_URL={{ LITELLM_OPENAI_BASE_LOCAL_URL | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}

# nocheck: playwright-service-gate — gated by the ldap-authenticator addon spec, not the main persona spec
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}

# nocheck: playwright-service-gate — gated by the ai-llm addon spec, whose addon flag is itself bound to services.litellm.enabled
LITELLM_SERVICE_ENABLED={{ lookup('config', application_id, 'services.litellm.enabled') | string | lower }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

NODE_TLS_REJECT_UNAUTHORIZED=0

# nocheck: persona-block-rationale — the administrator is provisioned as an XWiki.XWikiUsers object carrying no password property (templates/xml/user/xwikiusers_object.xml.j2:3-8), and every privileged call of the role authenticates as the built-in superadmin with credentials.superadminpassword (vars/main.yml:28-29); neither is the Keycloak secret the persona helpers submit. The Keycloak coupling is proven through XWiki's own login action in files/playwright/addons/oidc-authenticator.spec.js:35-51.
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above; biber has no XWiki user page at all (tasks/03_administrator.yml provisions the administrator only) and the OIDC group mapping stays commented out (templates/xwiki.properties.j2:23-25), so an auto-provisioned biber would land without rights.
PERSONA_BIBER_BLOCKED=true

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}

{{ lookup('addon_env_flags', application_id) }}