ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

CDN_BASE_URL={{ lookup('tls', 'web-svc-cdn', 'url.base') | dotenv_quote }}

{% set logout_targets = [] %}
{% for _t in lookup('roles_with_service', 'logout') %}
{% set _ = logout_targets.append(_t | combine({'is_proxy_gated': lookup('sso', _t.id, 'is_proxy_gated') | bool})) %}
{% endfor %}
LOGOUT_TARGET_ROLES_JSON={{ logout_targets | to_json | dotenv_quote }}

# nocheck: persona-block-rationale — meta/services.yml declares no sso service, so this role is never registered as a Keycloak client; its only surface is the anonymous logout conductor plus the /logout endpoints proxied in templates/logout-proxy.conf.j2. There is no login form and no session to end.
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above; the injected logout JS is asserted per consumer role via roles_with_service('logout') in files/playwright/playwright.spec.js.
PERSONA_BIBER_BLOCKED=true