mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
48 lines
3.2 KiB
Bash
48 lines
3.2 KiB
Bash
ADMIN_EMAIL={{ lookup('users', 'administrator').email | dotenv_quote }}
|
|
|
|
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — web-svc-css is injected at the vhost level; assertCspInjections resolves the flag through a loop variable, never a literal gate
|
|
CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}
|
|
|
|
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
MCP_ENDPOINT_PATH={{ GITLAB_MCP_UPSTREAM_PATH | dotenv_quote }}
|
|
|
|
MCP_SERVICE_ENABLED={{ lookup('config', application_id, 'mcp.enabled') | string | lower }}
|
|
|
|
# nocheck: persona-block-rationale — GITLAB_ROOT_PASSWORD (templates/env.j2:10, vars/main.yml:31) belongs to GitLab's built-in `root` account, not to the Keycloak `administrator` username ADMIN_USERNAME renders, so the sso: false variants leave the persona without a matching native account (see README "Persona contract opt-outs").
|
|
PERSONA_ADMINISTRATOR_BLOCKED={{ 'false' if (lookup('config', application_id, 'services.sso.enabled') | bool) else 'true' }}
|
|
|
|
# nocheck: persona-block-rationale — no GitLab account is provisioned for biber anywhere in the role; the OmniAuth sign-in that would auto-create it is the only path, and the sso: false variants remove it (see README "Persona contract opt-outs").
|
|
PERSONA_BIBER_BLOCKED={{ 'false' if (lookup('config', application_id, 'services.sso.enabled') | bool) else 'true' }}
|
|
|
|
# nocheck: playwright-service-gate — the rails stack refuses to boot without its database, so every scenario already proves it and no DB surface exists in the UI
|
|
POSTGRES_SERVICE_ENABLED={{ lookup('config', application_id, 'services.postgres.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — sidekiq queue and session store behind every authenticated scenario, GitLab renders no Redis status surface
|
|
REDIS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.redis.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — object storage is consolidated server-side for LFS, artifacts and uploads, GitLab exposes no isolated upload surface to drive
|
|
SEAWEEDFS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.seaweedfs.enabled') | string | lower }}
|
|
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|
|
|
|
WEBMAIL_BASE_URL={{ (lookup('canonical_url', MAIL_PROVIDER, 'webmail') if lookup('config', MAIL_PROVIDER, 'domains.canonical.webmail', '') | length > 0 else '') | dotenv_quote }}
|