APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

NODE_TLS_REJECT_UNAUTHORIZED=0

# nocheck: persona-block-rationale — ejabberd's only HTTP surface is ejabberd_web_admin on /admin (templates/configuration.yml.j2:19-20); it authenticates a bare JID against LDAP via HTTP Basic (templates/configuration.yml.j2:26-37), so there is no Keycloak redirect and no logout control to click. Client authentication itself runs over 5222/5269 (README "Watch Points").
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above; acl.admin lists only the administrator JID (templates/configuration.yml.j2:47-50), so the web admin refuses biber outright.
PERSONA_BIBER_BLOCKED=true

# nocheck: playwright-service-gate — SSO surface; auth flow gated by Keycloak realm not Playwright env var
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}

XMPP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}