ADMIN_PASSWORD={{ lookup('users', 'administrator').password | dotenv_quote }}

ADMIN_USERNAME={{ lookup('users', 'administrator').username | dotenv_quote }}

APP_BASE_URL={{ lookup('tls', application_id, 'url.base') | dotenv_quote }}

BIBER_PASSWORD={{ lookup('users', 'biber').password | dotenv_quote }}

BIBER_USERNAME={{ lookup('users', 'biber').username | dotenv_quote }}

CANONICAL_DOMAIN={{ lookup('domain', application_id) | dotenv_quote }}

# nocheck: playwright-service-gate — web-svc-css injects the shared stylesheet; the persona CSP helper resolves injectors through a computed loop, never a literal gate argument
CSS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.css.enabled') | string | lower }}

# nocheck: playwright-service-gate — templates/env.j2 sets EMAIL_CONFIG for outbound signup and moderation notices; no persona surface sends mail, real delivery is asserted in roles/web-app-mailu/files/playwright/playwright.spec.js
EMAIL_SERVICE_ENABLED={{ lookup('config', application_id, 'services.email.enabled') | string | lower }}

# nocheck: playwright-service-gate — the persona authenticates through the oauth2-proxy SSO chain; the LDAP_ENABLED bind login is exercised in the LDAP-only matrix variant
LDAP_SERVICE_ENABLED={{ lookup('config', application_id, 'services.ldap.enabled') | string | lower }}

LOGOUT_SERVICE_ENABLED={{ lookup('config', application_id, 'services.logout.enabled') | string | lower }}

MATOMO_BASE_URL={{ lookup('tls', 'web-app-matomo', 'url.base') | dotenv_quote }}

MATOMO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.matomo.enabled') | string | lower }}

# nocheck: persona-block-rationale — the oauth2 ACL blacklists only /login (meta/services.yml:98-108), and sys-svc-proxy renders a blacklist as "expose everything by default, then protect the listed paths", so the shared helper's landing on / is never intercepted; Funkwhale renders its own sign-in control as a bare div, which the helper's link/button role query cannot match; and app-level authentication is Funkwhale's LDAP form (templates/env.j2:42-50) rather than OIDC, so even a Keycloak round trip at the proxy leaves the application session anonymous. files/playwright/test-native-login.js drives the same journey for both personas through Funkwhale's own chain (see README "Persona contract opt-outs").
PERSONA_ADMINISTRATOR_BLOCKED=true

# nocheck: persona-block-rationale — see PERSONA_ADMINISTRATOR_BLOCKED above.
PERSONA_BIBER_BLOCKED=true

# nocheck: playwright-service-gate — the Django API refuses to serve without DATABASE_URL, so every page assertion already proves Postgres
POSTGRES_SERVICE_ENABLED={{ lookup('config', application_id, 'services.postgres.enabled') | string | lower }}

# nocheck: playwright-service-gate — Celery broker and session cache behind every authenticated request, with no user-facing surface of its own
REDIS_SERVICE_ENABLED={{ lookup('config', application_id, 'services.redis.enabled') | string | lower }}

SSO_SERVICE_ENABLED={{ lookup('config', application_id, 'services.sso.enabled') | string | lower }}

# nocheck: playwright-service-gate — search index backend reachable only through library search, a surface the persona journey does not visit
TYPESENSE_SERVICE_ENABLED={{ lookup('config', application_id, 'services.typesense.enabled') | string | lower }}