APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

DESIGN_FAVICON_URL={{ (lookup('design', application_id).urls.favicon_ico if lookup('design', application_id).logo is string else '') | dotenv_quote }}

DESIGN_ICON_URL={{ (lookup('design', application_id).urls.icon.svg if lookup('design', application_id).logo is string else '') | dotenv_quote }}

DESIGN_LOGO_URL={{ (lookup('design', application_id).urls['sidebar-logo'].svg if lookup('design', application_id).logo is string else '') | dotenv_quote }}

DESIGN_SERVICE_ENABLED={{ lookup('config', application_id, 'services.design.enabled') | string | lower }}

DESIGN_TITLE={{ (lookup('design', application_id).title if lookup('design', application_id).title is string else '') | dotenv_quote }}

{% set docs_subject = lookup('env', 'APP_ID') | trim %}
DOCS_I18N_ASSERT_LANGUAGES={{ (docs_subject in ('', application_id)) | string | lower }}

{% set docs_samples = {} %}
{% for docs_code in DOCS_I18N_PRELOAD_LANGUAGES if docs_code != HOST_LL %}
{%   set _ = docs_samples.update({docs_code: lookup('i18n_sample', 'docs', docs_code, 'README.md', 5)}) %}
{% endfor %}
DOCS_I18N_PRELOAD_LANGUAGES_JSON={{ DOCS_I18N_PRELOAD_LANGUAGES | to_json | dotenv_quote }}

DOCS_I18N_SAMPLES_JSON={{ docs_samples | to_json | dotenv_quote }}

# nocheck: playwright-service-gate — covered by sys-svc-mail integration tests, not the persona surface
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('landing_url', 'web-app-matomo') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

# nocheck: persona-block-rationale — meta/services.yml:10-12 pins sso.enabled and sso.shared to false and the role ships no env.j2, no users.yml and no account provisioning (tasks/main.yml only wires the static-site stack), so there is no auth chain to drive.
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above.
PERSONA_BIBER_BLOCKED=true

# nocheck: playwright-service-gate — SSO surface; auth flow gated by Keycloak realm not Playwright env var
SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}