@@ -14,9 +14,9 @@ Restart=always
 RestartSec=3
 TimeoutStopSec=10
 Environment="AWS_USE_DUALSTACK_ENDPOINT=true"
-{% if qemu %}
-Environment="AWS_SDK_LOAD_CONFIG=true"
-{% endif %}
+{% for env in adminapi_extra_env %}
+Environment="{{ env }}"
+{% endfor %}
 StandardOutput=journal
 StandardError=journal
 
 
@@ -90,15 +90,10 @@ Environment=GOTRUE_RELOADING_POLLER_ENABLED=false
 # ensures only 1 reload operation occurs during a burst of config updates.
 Environment=GOTRUE_RELOADING_GRACE_PERIOD_INTERVAL=2s
 
-{% if qemu %}
-# v3 does not use filesystem notifications for config reloads.
-Environment=GOTRUE_RELOADING_NOTIFY_ENABLED=false
-{% else %}
-# v2 currently relies on notify support, so we will enable it until both v2 / v3
-# have migrated to strictly use signals across all projects. The default is true
-# in gotrue but we will set it defensively here.
-Environment=GOTRUE_RELOADING_NOTIFY_ENABLED=true
-{% endif %}
+# v3 does not use filesystem notifications for config reloads. v2 relies on
+# notify support until both have migrated to strictly use signals. The default
+# is true in gotrue, but it is set explicitly here.
+Environment=GOTRUE_RELOADING_NOTIFY_ENABLED={{ gotrue_reloading_notify_enabled | lower }}
 
 Slice=services.slice
 
 
@@ -6,8 +6,7 @@ StartLimitBurst=0
 
 [Service]
 Type=simple
-ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal --collector.database_wraparound {% if qemu %}--no-collector.database {% endif %}
-
+ExecStart=/opt/postgres_exporter/postgres_exporter --disable-settings-metrics --extend.query-path="/opt/postgres_exporter/queries.yml" --disable-default-metrics --no-collector.locks --no-collector.replication --no-collector.replication_slot --no-collector.stat_bgwriter --no-collector.stat_database --no-collector.stat_user_tables --no-collector.statio_user_tables --no-collector.wal --collector.database_wraparound{% for flag in postgres_exporter_extra_flags %} {{ flag }}{% endfor %} 
 User=postgres
 Group=postgres
 Restart=always
 
@@ -6,15 +6,9 @@ Requires=local-fs.target
 
 [Service]
 Type=oneshot
-{% if qemu %}
-ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result --targets-key  targetsv3-main.yaml
-User=root
-Group=root
-{% else %}
-ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml salt --apply --store-result
-User=supabase-admin-agent
-Group=supabase-admin-agent
-{% endif %}
+ExecStart=/opt/supabase-admin-agent/supabase-admin-agent --config /opt/supabase-admin-agent/config.yaml {{ supabase_admin_agent_salt.args }}
+User={{ supabase_admin_agent_salt.user }}
+Group={{ supabase_admin_agent_salt.group }}
 StandardOutput=journal
 StandardError=journal
 StateDirectory=supabase-admin-agent
 
@@ -3,19 +3,13 @@ Description=Run Supabase supabase-admin-agent salt on a schedule
 Requires=supabase-admin-agent_salt.service
 
 [Timer]
-{# We're using a significantly lower frequency for triggering this agent on qemu images for the moment. Once we've performed additional validations re: the aggregate impact of running it more frequently, the frequency can be increased. #}
-{% if qemu %}
-OnCalendar=*-*-* 0,6,12,18:00:00
+OnCalendar={{ supabase_admin_agent_timer.on_calendar }}
 RandomizedDelaySec={{ supabase_admin_agent_splay }}
-AccuracySec=1h
-OnBootSec=5m
-Persistent=true
-{% else %}
-OnCalendar=*:0/10
-RandomizedDelaySec={{ supabase_admin_agent_splay }}
-AccuracySec=1s
-Persistent=true
+AccuracySec={{ supabase_admin_agent_timer.accuracy_sec }}
+{% if supabase_admin_agent_timer.on_boot_sec %}
+OnBootSec={{ supabase_admin_agent_timer.on_boot_sec }}
 {% endif %}
+Persistent=true
 
 [Install]
 WantedBy=timers.target
@@ -6,6 +6,7 @@
 
   vars_files:
     - ./vars.yml
+    - "./vars/{{ 'qemu' if qemu else 'aws' }}.yml"
 
   # Set facts only in here, never in any tasks.
   # This avoids redefining/duplicates or different values (buggy)
@@ -186,7 +187,7 @@
     - name: Run supascan baseline validation
       when: stage2
       shell: >-
-        baseline={{ 'ami' if not qemu else 'qemu' }}-build-{{ platform }}
+        baseline={{ supascan_baseline_prefix }}-build-{{ platform }}
         nix shell {{ nix_store_paths['supascan'] }} --command
         /tmp/ansible-playbook/ansible/files/supascan_ami.sh
         /tmp/ansible-playbook/audit-specs/baselines/$baseline
 
@@ -7,7 +7,7 @@
 - name: adminapi - system user
   ansible.builtin.user:
     name: adminapi
-    uid: "{{ 1006 if not qemu else 1007 }}"
+    uid: "{{ uids.adminapi }}"
     group: adminapi
     groups: admin,envoy,gotrue,kong,pgbouncer,postgres,postgrest,root,systemd-journal,vector,wal-g
 
 
@@ -1,7 +1,7 @@
 - name: supabase-admin-agent - system group
   ansible.builtin.group:
     name: supabase-admin-agent
-    gid: "{{ 987 if not qemu else 988 }}"
+    gid: "{{ gids.supabase_admin_agent }}"
     system: yes
 
 - name: supabase-admin-agent - system user
 
@@ -7,7 +7,7 @@
 - name: Envoy - user
   ansible.builtin.user:
     name: envoy
-    uid: "{{ 1003 if not qemu else 1004 }}"
+    uid: "{{ uids.envoy }}"
     group: envoy
     state: present