mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
47 lines
2.9 KiB
Bash
47 lines
2.9 KiB
Bash
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
DOMAIN_PRIMARY={{ DOMAIN_PRIMARY | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
|
|
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — the injected panel renders on Keycloak's post-logout page, which the persona flows leave via the app under test rather than assert on
|
|
JAVASCRIPT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.javascript.enabled') | string | lower }}
|
|
|
|
KEYCLOAK_REALM_NAME={{ KEYCLOAK_REALM | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — persona drives the OIDC path; LDAP federation is exercised in the LDAP-only matrix variant
|
|
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}
|
|
|
|
# nocheck: persona-required-envs — auth-provider role; persona-flow runners are not used here
|
|
# nocheck: playwright-service-gate — auth-provider role; generic persona scenarios are exempt (covered by bespoke realm-account / admin-console tests above)
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MAPACHE_PASSWORD={{ PLAYWRIGHT_MAPACHE_PASSWORD | dotenv_quote }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
# nocheck: playwright-service-gate — auth-provider role; generic persona scenarios are exempt
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
# nocheck: persona-block-rationale — Keycloak's only admin surface is the master-realm console, which accepts the permanent super-admin (KEYCLOAK_PERMANENT_ADMIN_USERNAME / _PASSWORD, vars/main.yml) and not the normal-realm ADMIN_PASSWORD the shared helper types; the bespoke master-realm console test carries the journey (see README "Persona contract opt-outs").
|
|
PERSONA_ADMINISTRATOR_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale — Keycloak provides sso rather than consuming it: meta/services.yml declares no sso block and pins logout.enabled=false, so APP_BASE_URL has neither a proxy gate nor an in-app OIDC link for the shared helper to click or log out of; biber's journey is the realm account console, covered bespoke (see README "Persona contract opt-outs").
|
|
PERSONA_BIBER_BLOCKED=true
|
|
|
|
SUPER_ADMIN_PASSWORD={{ KEYCLOAK_PERMANENT_ADMIN_PASSWORD | dotenv_quote }}
|
|
|
|
SUPER_ADMIN_USERNAME={{ KEYCLOAK_PERMANENT_ADMIN_USERNAME | dotenv_quote }}
|
|
|