mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
47 lines
2.8 KiB
Bash
47 lines
2.8 KiB
Bash
ADMIN_EMAIL={{ lookup('users', 'administrator').email | dotenv_quote }}
|
|
|
|
ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}
|
|
|
|
ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}
|
|
|
|
APP_BASE_URL={{ lookup('tls', application_id, 'url.base') }}
|
|
|
|
BIBER_EMAIL={{ lookup('users', 'biber').email | dotenv_quote }}
|
|
|
|
BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}
|
|
|
|
BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}
|
|
|
|
CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}
|
|
|
|
LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}
|
|
|
|
MAPACHE_PASSWORD={{ PLAYWRIGHT_MAPACHE_PASSWORD | dotenv_quote }}
|
|
|
|
MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}
|
|
|
|
MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}
|
|
|
|
OIDC_ISSUER_URL={{ OIDC.CLIENT.ISSUER_URL | dotenv_quote }}
|
|
|
|
|
|
# nocheck: persona-block-rationale — Stalwart's WebAdmin is a username-first OAuth SPA: the login form takes the account's e-mail (ADMIN_EMAIL), not the Keycloak ADMIN_USERNAME the shared helper (roles/test-e2e-playwright/files/personas/admin.js) types, and it then bounces to Keycloak rather than authenticating in-app. Its logout also sits behind an account menu with no stable control. Both are covered instead by the role's own files/playwright/test-sso.js.
|
|
PERSONA_ADMINISTRATOR_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale — biber faces the same username-first WebAdmin login as the administrator above, so the shared in-app login/logout helper has no surface to drive. biber's real auth round-trip is proven by files/playwright/test-mailflow.js, which logs in and out of Roundcube over Keycloak SSO.
|
|
PERSONA_BIBER_BLOCKED=true
|
|
|
|
# nocheck: persona-block-rationale — the guest flow asserts a public landing page before the auth chain, but Stalwart's WebAdmin root redirects straight to /account/login and the role publishes no anonymous surface of its own. The dashboard tile page is the only public landing this role serves, so the persona runs exactly when that service is deployed.
|
|
PERSONA_GUEST_BLOCKED={{ (not (lookup('config', application_id, 'services.dashboard.enabled') | bool)) | string | lower }}
|
|
|
|
# nocheck: playwright-service-gate — SSO surface; auth flow gated by Keycloak realm not Playwright env var
|
|
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}
|
|
|
|
STALWART_ADMIN_PASSWORD={{ STALWART_ADMIN_PASSWORD | dotenv_quote }}
|
|
|
|
STALWART_ADMIN_USERNAME={{ STALWART_ADMIN_USER | dotenv_quote }}
|
|
|
|
TOR_SERVICE_ENABLED={{ lookup('config', application_id, 'services.tor.enabled') | string | lower }}
|
|
|
|
WEBMAIL_BASE_URL={{ lookup('canonical_url', application_id, 'webmail') | dotenv_quote }}
|