ysk-server-shared 1.0.0 → 1.1.0

package/locales/en/dns.json

@@ -32,6 +32,8 @@
   "zonesTitle": "Zones ({{count}})",
   "zonesDesc": "After create, write/apply the zone",
   "createZone": "+ Create zone",
+  "mailZonesMissing": "Email domains have no DNS zone here: {{domains}}.",
+  "createMailZone": "Create mail zone",
   "colZoneName": "Zone name",
   "colServerIp": "Server IP",
   "colTemplate": "Template",
@@ -108,7 +110,10 @@
   "validateDesc": "Create/edit auto-validates (CNAME clashes, A/AAAA format, etc.).",
   "createZoneTitle": "Create DNS zone",
   "createZoneDesc": "Generate records from a template",
+  "createZoneNeedValid": "Enter a valid zone name and IPv4 address",
   "zoneNameHint": "e.g. example.com (no trailing dot)",
+  "invalidZone": "Invalid zone name. Use a real domain (e.g. example.com).",
+  "invalidIpv4": "Invalid IPv4. Each octet must be 0–255.",
   "serverIpv4": "Server IPv4",
   "serverIpv4Hint": "Address used for template A records",
   "thisHostIpv4": "This host public IPv4",
@@ -202,6 +207,9 @@
   "lookupServer": "Server (@)",
   "lookupServerHint": "127.0.0.1 = local auth; public IP tests external; empty = system resolver",
   "healthHealPdns": "Heal PowerDNS bind",
+  "healNeedInstall": "PowerDNS is not installed — install it on the Software tab first",
+  "applyNeedService": "DNS service is not running — start or install it before apply",
+  "deleteZoneNeedName": "Delete this zone — you will type the zone name to confirm",
   "healthHealPdnsHint": "Set local-address to public IP to avoid clashing with systemd-resolved on 0",
   "healthHealPdnsOk": "PowerDNS bound to {{ip}} and start attempted",
   "healthHealPdnsFailed": "PowerDNS heal failed",
@@ -212,5 +220,15 @@
   "aboutHealthTitle": "Service health",
   "aboutHealthBody": "Use Tools to probe PowerDNS, heal bind, and open port 53.",
   "aboutStackTitle": "Software",
-  "aboutStackBody": "Check/update the PowerDNS package under Software."
+  "aboutStackBody": "Check/update the PowerDNS package under Software.",
+  "createMailZoneNow": "Created mail zone {{domain}}",
+  "toolsFirewallTitle": "Firewall (UFW)",
+  "toolsFirewallHint": "Allow or deny port 53. This does not start or stop PowerDNS.",
+  "toolsUnitTitle": "PowerDNS unit",
+  "toolsUnitHint": "systemd unit pdns — start, stop, restart, reload.",
+  "installConfirmTitle": "Install PowerDNS?",
+  "installConfirmDesc": "Installs pdns-server and writes the managed authoritative config. Needs root and YSK_EXECUTE=1.",
+  "installConfirmConsequence": "After install and start, PowerDNS will bind port 53.",
+  "installPort53Busy": "Something already listens on port 53. PowerDNS may fail to bind until that listener is stopped or healed.",
+  "installPort53BusyConsequence": "Heal bind or stop the other listener before expecting answers on port 53."
 }

package/locales/en/docker.json

@@ -0,0 +1,247 @@
+{
+  "title": "Docker",
+  "subtitle": "Install Docker Engine, then manage containers, images, volumes, and validator Compose stacks on this host.",
+  "refresh": "Refresh",
+  "notInstalled": "Docker Engine is not installed. Install docker.io and docker-compose-v2 from this page.",
+  "protected": "Protected",
+  "pruneConfirm": "Type PRUNE to confirm any prune",
+  "needEngineTitle": "Install Docker Engine first",
+  "stopEngineDesc": "This stops the Docker engine and all {{n}} container(s) on this host.",
+  "notInstalledValue": "Not installed",
+  "nameHint": "Letters, digits, underscore, dot, hyphen (max 128)",
+  "volPlaceholder": "my-data",
+  "netPlaceholder": "my-net",
+  "runPorts": "Publish ports",
+  "runPortsHint": "host:container per line, e.g. 8080:80",
+  "runEnv": "Environment",
+  "runEnvHint": "KEY=value per line",
+  "runRestart": "Restart policy",
+  "runNetwork": "Network",
+  "runVolumes": "Volumes",
+  "runVolumesHint": "volume:dest per line",
+  "runAdvancedHint": "For multi-service stacks use validator nodes or Compose files already on this host.",
+  "daemonConfirmTitle": "Apply daemon settings?",
+  "daemonConfirmDesc": "Writes daemon.json and restarts docker.service. All containers will be interrupted.",
+  "settingsHint": "Safe daemon.json subset only. Apply writes the file and restarts docker.service.",
+  "cli": {
+    "usage": "Usage: ysk-server docker status|ps|images|volumes|networks|df|logs|inspect|exec|start|stop|restart|rm|pull|run|prune|engine|compose [--image IMG] [--name N] [--preset version|help|hostname] [--bin BIN] [--project P] [--execute] [--json]"
+  },
+  "tab": {
+    "overview": "Overview",
+    "containers": "Containers",
+    "images": "Images",
+    "compose": "Compose",
+    "volumes": "Volumes",
+    "networks": "Networks",
+    "prune": "Prune",
+    "settings": "Settings",
+    "about": "About"
+  },
+  "col": {
+    "engine": "Engine",
+    "containers": "Containers",
+    "version": "Version",
+    "dataRoot": "Data root",
+    "disk": "Disk",
+    "validators": "Validator stacks",
+    "name": "Name",
+    "image": "Image",
+    "status": "Status",
+    "ports": "Ports",
+    "managed": "Managed",
+    "size": "Size",
+    "driver": "Driver",
+    "type": "Type",
+    "reclaimable": "Reclaimable"
+  },
+  "state": {
+    "up": "Active",
+    "down": "Stopped",
+    "running": "Running",
+    "exited": "Exited",
+    "restarting": "Restarting",
+    "restartingCount": "Restarting · {{n}} times",
+    "paused": "Paused",
+    "created": "Created",
+    "dead": "Dead",
+    "removing": "Removing",
+    "unknown": "Unknown"
+  },
+  "df": {
+    "images": "Images",
+    "containers": "Containers",
+    "volumes": "Local volumes",
+    "builder": "Build cache",
+    "other": "Other"
+  },
+  "actions": {
+    "start": "Start",
+    "stop": "Stop",
+    "restart": "Restart",
+    "remove": "Remove",
+    "logs": "Logs",
+    "inspect": "Inspect",
+    "exec": "Exec (version)",
+    "run": "Run image",
+    "pull": "Pull",
+    "up": "Up",
+    "down": "Down",
+    "createVolume": "Create volume",
+    "createNetwork": "Create network",
+    "pruneContainers": "Prune containers",
+    "pruneImages": "Prune images",
+    "pruneVolumes": "Prune volumes",
+    "pruneSystem": "System prune",
+    "startEngine": "Start engine",
+    "stopEngine": "Stop engine",
+    "restartEngine": "Restart engine",
+    "applyDaemon": "Apply daemon settings"
+  },
+  "empty": {
+    "containers": "No containers",
+    "images": "No images",
+    "compose": "No Compose projects",
+    "composeDesc": "Projects come from validator nodes or Compose files already on this host. This page does not accept arbitrary YAML uploads.",
+    "composeCta": "Open validator nodes",
+    "volumes": "No volumes",
+    "networks": "No networks"
+  },
+  "logs": {
+    "empty": "No log output.",
+    "follow": "Follow"
+  },
+  "deleteRunningWarn": "This container is still running or restarting. It will be force-removed.",
+  "settings": {
+    "logMaxSize": "Container log max size",
+    "liveRestore": "Live restore (keep containers if the daemon restarts)",
+    "mirrors": "Registry mirrors (one URL per line)",
+    "insecure": "Insecure registries (one host per line)"
+  },
+  "about": {
+    "body": "Docker is a first-class host service on YSK Server, like Nginx. Install via the panel (Ubuntu docker.io + docker-compose-v2). Validator nodes run as Compose projects named yskval-*.",
+    "honesty": "Host changes need root and YSK_EXECUTE=1. Dry-run is the default. This page manages Docker on one host; use external Kubernetes for cluster orchestration.",
+    "validators": "Open validator nodes"
+  },
+  "alerts": {
+    "daemonTitle": "Docker daemon is down",
+    "daemonBody": "The Docker engine is installed but docker.service is not active. Validator stacks cannot start."
+  },
+  "errors": {
+    "notInstalled": "Docker is not installed",
+    "daemonDown": "Docker daemon is not active",
+    "needCompose": "docker compose (v2 plugin) is required",
+    "badImage": "Invalid image reference",
+    "badName": "Invalid name",
+    "badPort": "Invalid port publish",
+    "badEnv": "Invalid environment variable",
+    "badVolume": "Invalid volume mount",
+    "badNetwork": "Invalid network",
+    "protectedNetwork": "Cannot remove a built-in Docker network",
+    "badRestart": "Invalid restart policy",
+    "badPrune": "Invalid prune scope",
+    "needPruneConfirm": "Volume or system prune requires confirm=PRUNE",
+    "badDaemon": "Invalid daemon setting",
+    "composeMissing": "Compose file for this project was not found",
+    "logsFailed": "Could not read container logs",
+    "mutateFailed": "Docker command failed",
+    "engineFailed": "Could not control docker.service",
+    "badExec": "Exec is limited to allowlisted binaries and presets (no shell, no TTY)",
+    "uninstallBusy": "Stop YSK-managed containers (including validator stacks) before uninstalling Docker"
+  },
+  "notes": {
+    "dryMutate": "Dry-run only. Pass --execute and YSK_EXECUTE=1 to change the host.",
+    "dryPrune": "Prune preview (not applied).",
+    "dryEngine": "Engine control is dry-run.",
+    "dryDaemon": "Would write /etc/docker/daemon.json and restart docker.service.",
+    "daemonWrote": "Wrote daemon.json",
+    "start": "Container started",
+    "stop": "Container stopped",
+    "restart": "Container restarted",
+    "remove": "Container removed",
+    "ran": "Container started from image",
+    "pulled": "Image pulled",
+    "exec": "Ran allowlisted exec",
+    "imageRemoved": "Image removed",
+    "volumeCreated": "Volume created",
+    "volumeRemoved": "Volume removed",
+    "networkCreated": "Network created",
+    "networkRemoved": "Network removed",
+    "pruned": "Prune finished",
+    "compose": {
+      "up": "Compose project started",
+      "down": "Compose project stopped",
+      "restart": "Compose project restarted",
+      "rm": "Compose project removed"
+    },
+    "engine": {
+      "start": "docker.service started",
+      "stop": "docker.service stopped",
+      "restart": "docker.service restarted"
+    }
+  },
+  "ui": {
+    "whatYouGet": "What this page does",
+    "whatYouGetLead": "Install Docker Engine once. After that you can run a single container, pull images, and see validator Compose stacks that already live on this host.",
+    "capEngine": "Engine",
+    "capEngineDesc": "One-click install of docker.io and docker-compose-v2. Start and stop docker.service here.",
+    "capWork": "Containers and images",
+    "capWorkDesc": "Pick a common image, pull it, run it, then read logs or inspect the container.",
+    "capStacks": "Validator stacks",
+    "capStacksDesc": "Multi-service stacks are validator Compose projects (yskval-*). This page does not accept YAML uploads.",
+    "cardEngine": "Engine",
+    "cardDisk": "Disk",
+    "cardWork": "On this host",
+    "compose": "Compose",
+    "cgroup": "cgroup",
+    "used": "Used",
+    "free": "Free",
+    "running": "Running",
+    "images": "Images",
+    "volumes": "Volumes",
+    "networks": "Networks",
+    "goImages": "Images",
+    "goValidators": "Validator nodes",
+    "imagePickHint": "Choose a common image. Use Other only when you need a different reference.",
+    "imageCustom": "Other",
+    "driver": "Driver",
+    "driverLocalOnly": "This panel creates local volumes only.",
+    "netDefaultDriver": "New networks use Docker’s default bridge driver.",
+    "pruneWhat": "What to remove",
+    "pruneAck": "I understand unused data will be deleted and cannot be restored",
+    "pruneAckDesc": "Volume and system prune cannot be undone. Stopped containers and unused images are removed for the selected scope.",
+    "pruneNow": "Prune now",
+    "useMirrors": "Use registry mirrors",
+    "useInsecure": "Allow insecure registries",
+    "publishPorts": "Publish ports to the host",
+    "attachVolume": "Attach a volume",
+    "setEnv": "Set environment variables",
+    "defaultNet": "Default",
+    "mountPath": "Mount path",
+    "restartNo": "Never",
+    "restartUnless": "Unless stopped",
+    "restartAlways": "Always",
+    "restartOnFail": "On failure",
+    "needAck": "Confirm before pruning",
+    "scopeContainers": "Stopped containers",
+    "scopeImages": "Unused images",
+    "scopeVolumes": "Unused volumes",
+    "scopeBuilder": "Build cache",
+    "scopeSystem": "Everything unused",
+    "noVolumesYet": "No volumes yet — create one on the Volumes tab first.",
+    "customPort": "Another host port",
+    "customPortHost": "Host port",
+    "customPortContainer": "Container port",
+    "pctUsed": "{{n}}% used",
+    "customPortHint": "1–65535. Example: 9090 → 80.",
+    "pickBridge": "Bridge network"
+  },
+  "deleteTitle": "Delete {{id}}",
+  "deleteDesc": "This cannot be undone.",
+  "deleteC1": "The resource is removed from this host.",
+  "deleteComposeVal": "This is a validator stack — the validator instance is also deleted.",
+  "pruneTitle": "Prune Docker resources",
+  "pruneDesc": "Type PRUNE to confirm. Unused data cannot be restored.",
+  "pruneC1": "Unused resources in the selected scope are deleted.",
+  "pruneC2": "Volume and system prune permanently delete unused data volumes.",
+  "pruneC3": "Stopped containers or unused images in this scope are removed."
+}

package/locales/en/email.json

@@ -41,13 +41,16 @@
   "webmailMovedHint": "Webmail is configured globally (not per domain).",
   "openGlobalWebmailSettings": "Open webmail settings",
   "domainsTitle": "Domains ({{filtered}}/{{total}})",
+  "domainsListDesc": "Mail domains registered on this host",
   "emptyFilterHint": "No domains match the search",
   "emptyCreateHint": "Use Create in the toolbar to register a domain;",
   "queueLocalTitle": "Mail queue",
   "needExecute": "Needs YSK_EXECUTE",
   "viewQueue": "View queue",
   "flushQueue": "Flush queue",
-  "queueHint": "Click View queue to read the local Postfix queue",
+  "flushQueueEmpty": "Queue is empty",
+  "flushQueueNeedExecute": "Flushing the queue needs YSK_EXECUTE (host execute permission)",
+  "queueHint": "Local Postfix queue. Viewing is a read probe; flush needs YSK_EXECUTE.",
   "deleteThisId": "Delete this ID",
   "queueEmpty": "No deferred mail",
   "queueEmptyHint": "No deferred messages",
@@ -69,7 +72,8 @@
   "opsHost": "Host provider: PTR, Port 25 outbound policy",
   "opsRegistrar": "Registrar: publish MX / SPF / DKIM / DMARC",
   "statusTitle": "Status",
-  "statusDraft": "draft: panel only",
+  "statusDraft": "Draft (panel only)",
+  "deliverabilityChecks": "Checks",
   "statusWritten": "written: management files written, may not be live",
   "statusApplied": "applied: successfully applied before (still check service is-active)",
   "statusReputation": "Inbox reputation can never be 100% automated",
@@ -105,6 +109,14 @@
   "copyAllRecords": "Copy all records",
   "openDnsPage": "Open DNS page",
   "healthScore": "Health score",
+  "healthUnchecked": "Not checked yet",
+  "healthUncheckedHint": "Live DNS / PTR / port 25 have not been probed yet.",
+  "deliverabilityScore": "Deliverability pack",
+  "opendkimNoReload": "OpenDKIM has no reload — use restart after key or table changes.",
+  "opendkimNoReloadTitle": "systemctl reload opendkim is not supported on this stack",
+  "healthChecklist": "Checklist {{score}}/100",
+  "healthChecklistHint": "Checklist score — live DNS / PTR / port 25 not probed yet",
+  "healthLiveHint": "Live probe score",
   "suggestedRecords": "Suggested records",
   "externalTodosCount": "External todos",
   "colType": "Type",
@@ -189,7 +201,7 @@
   "hourlyMsgCap": "Hourly message cap",
   "hourlyMsgCapHint": "Global uses the minimum across domains",
   "enableAntispam": "Enable antispam mark (Rspamd multimap)",
-  "enableAntispamDesc": "Off marks domain antispam off",
+  "enableAntispamDesc": "Off keeps this domain out of the Rspamd antispam map. Write panel first, then apply to system.",
   "writeControlOnly": "Write panel only",
   "applyToSystemBtn": "Apply to system",
   "dnsblResult": "DNSBL result",
@@ -314,6 +326,7 @@
   "health": {
     "dnsUnconfirmed": "DNS records (MX/SPF/DKIM) not yet confirmed",
     "dmarcMissing": "DMARC missing — strongly recommended",
+    "dmarcUnpublished": "DMARC is generated in the panel but not published in public DNS yet",
     "ptrBad": "PTR reverse DNS missing or incorrect — request at VPS provider",
     "port25Blocked": "Outbound Port 25 appears blocked — request unblock or use SMTP relay",
     "port25Unknown": "Port 25 status unknown — run connectivity check"
@@ -357,7 +370,8 @@
     "postfixReloaded": "Postfix reloaded.",
     "postfixReloadFailed": "Postfix reload failed: {{detail}}",
     "dovecotApplied": "Wrote Dovecot TLS snippet and attempted reload.",
-    "dovecotSkipped": "Skipped Dovecot (not installed or doveconf unavailable)."
+    "dovecotSkipped": "Skipped Dovecot (not installed or doveconf unavailable).",
+    "dovecotSslOmitted": "Mail certificate is missing; wrote ssl=no so Dovecot can start without the LE files."
   },
   "policyApplySystemHint": "Check “apply to system” to write Postfix/Rspamd maps and reload;",
   "rateLimitAppliedNote": "Hourly outbound rate and antispam flag applied (when system apply is on).",
@@ -396,12 +410,12 @@
   "deliverabilityDesc": "PTR / DNS / port 25 checks",
   "dnsTodosDesc": "Copy then add at your DNS host",
   "deliverabilityHonesty": "Cannot set PTR or unlock port 25 for you",
-  "warmupSuggest": "暖身建議",
-  "writeSsoSkeleton": "寫入 Roundcube SSO 骨架",
-  "rateLimitPerHour": "每小時訊息上限",
-  "rateLimitGlobalHint": "全域取各域名最小值",
-  "savePolicyWritten": "只寫入控制面",
-  "dnsblMultiIp": "多 IP RBL",
+  "warmupSuggest": "Warm-up suggestions",
+  "writeSsoSkeleton": "Write Roundcube SSO skeleton",
+  "rateLimitPerHour": "Hourly message cap",
+  "rateLimitGlobalHint": "Global cap uses the lowest per-domain limit",
+  "savePolicyWritten": "Written to the control plane only",
+  "dnsblMultiIp": "Multi-IP RBL",
   "webmailTool": "Webmail software",
   "webmailToolRoundcube": "Roundcube (default)",
   "webmailToolSnappy": "SnappyMail (lightweight)",
@@ -411,6 +425,9 @@
   "webmailRisk": "Public webmail is risky — enable HTTPS soon.",
   "webmailForceHttps": "Force HTTPS (Roundcube; SSL required)",
   "reinstallWebmail": "Reinstall / upgrade",
+  "installWebmailTitle": "Create the shared webmail project (first install)",
+  "reinstallWebmailTitle": "Rebuild / upgrade the existing webmail project",
+  "reinstallNeedInstall": "Install webmail first",
   "webmailSsoAdvanced": "Advanced · SSO plugin",
   "tlsRoleMail": "mail (IMAP/SMTP)",
   "tlsRoleMailHint": "Mail server hostname",
@@ -419,6 +436,7 @@
   "tlsRoleApex": "Apex domain",
   "tlsRoleApexHint": "Web / apex certificate",
   "tlsRequestLe": "Request LE",
+  "tlsRequestLeFor": "Request LE for {{host}}",
   "advancedToolsTitle": "Queue & clients",
   "flushQueueConfirm": "Flush the local MTA queue? This cannot be undone.",
   "mailSslTitleShort": "Certificates & TLS",
@@ -473,5 +491,23 @@
   "mailboxEmptyTitle": "No mailboxes yet",
   "passwordMismatch": "Passwords do not match",
   "passwordTooShort": "Password must be at least 8 characters",
-  "mailboxUpdateNeedField": "Set a new password or change status"
+  "mailboxUpdateNeedField": "Set a new password or change status",
+  "catchallHint": "Unknown local parts go to the target mailbox. Draft until mail apply.",
+  "queueSearchPh": "Search ID, sender, or recipient…",
+  "queueId": "Queue ID",
+  "queueSender": "Sender",
+  "queueRecipients": "Recipients",
+  "queueSize": "Size",
+  "queueReason": "Reason",
+  "queueActive": "Active",
+  "queueHeld": "Held",
+  "queueDeferred": "Deferred",
+  "deleteQueueTitle": "Delete this queued message?",
+  "deleteQueueDesc": "Remove {{id}} from the local MTA queue. Needs YSK_EXECUTE.",
+  "openQueuePage": "Open mail queue",
+  "dovecotFailedHint": "Dovecot failed. Open the Software tab for the unit status.",
+  "dovecotFailedStatus": "Dovecot is {{status}}. Open the Software tab for the unit summary.",
+  "mailCertMissing": "No certificate for {{hosts}}. Issue it on the SSL page.",
+  "mailCertPresent": "A mail certificate is already issued — this is not a missing-cert problem.",
+  "webmailNeedCert": "No certificate for {{host}} — issue it on SSL before forcing HTTPS."
 }

package/locales/en/errors.json

@@ -25,7 +25,7 @@
     "adminTotpStrict": "Admins must enable 2FA (strict). Use an enrolled account or disable strict mode.",
     "totpReplay": "Code already used; wait for the next period",
     "totpRequired": "A valid authentication code is required",
-    "mustEnrollTotp": "Admin policy: enable two-factor authentication now",
+    "mustEnrollTotp": "Policy: enable two-factor authentication now",
     "userNotFound": "User not found",
     "totpSetupNeedReauth": "Enabling 2FA requires your password (or a recent step-up code)",
     "totpBeginFirst": "Start 2FA setup first",
@@ -37,7 +37,9 @@
     "sessionExpired": "Session expired; sign in again",
     "sessionIdle": "Idle timeout; sign in again",
     "totpNotEnabled": "2FA is not enabled",
-    "totpSecretNoDataDir": "TOTP secret is encrypted but dataDir is not set"
+    "totpSecretNoDataDir": "TOTP secret is encrypted but dataDir is not set",
+    "mustChangePassword": "You must set a new password before continuing",
+    "policyNeedsOwn2fa": "Turn on 2FA for this account and confirm with a TOTP code before requiring 2FA for others"
   },
   "http": {
     "notFoundRoute": "Not found: {{method}} {{path}}",
@@ -47,7 +49,8 @@
     "unprocessable": "Request rejected by server",
     "requestFailed": "Request failed ({{status}})",
     "jsonInvalid": "Invalid JSON",
-    "internal": "Internal error"
+    "internal": "Internal error",
+    "payloadTooLarge": "Request body is too large"
   },
   "YSK_HOST_BROWSE_SSRF": "Host browse blocked by security policy",
   "YSK_HOST_BROWSE_SESSION": "Host browse session not found or expired",

package/locales/en/fail2ban.json

@@ -8,10 +8,10 @@
   "startService": "Start service",
   "notInstalled": "fail2ban is not installed",
   "toolHintPrefix": "Underlying tools:",
-  "toolHintBody": "fail2ban = after scanning logs,",
-  "toolHintTemp": "temporary",
-  "toolHintBody2": "bans · for attack response use",
-  "toolHintUfw": "UFW = ports / permanent rules",
+  "toolHintBody": "fail2ban temporarily bans after scanning logs. For attack response use",
+  "toolHintTemp": "",
+  "toolHintBody2": "",
+  "toolHintUfw": "handles ports and permanent rules.",
   "tabs": {
     "bans": "Ban list",
     "whitelist": "Whitelist",
@@ -36,11 +36,15 @@
   "emptyBansDesc": "Or no permission to read fail2ban-client",
   "ignoreipTitle": "ignoreip whitelist",
   "ignoreipDesc": "IPs never banned (panel file + optional live fail2ban-client)",
+  "whitelistEmptyWarn": "Whitelist is empty while jails can ban you. Add your login IP before applying ignoreip.",
+  "suggestIgnoreLogin": "Your login IP {{ip}}",
+  "applyIgnoreEmptyWarn": "Applying with an empty whitelist clears ignoreip",
+  "applyIgnoreNeedConfirm": "Rewrites jail ignoreip and reloads fail2ban",
   "addIp": "Add IP",
   "addWhitelist": "Add to whitelist",
   "applyPolicyIgnoreip": "Apply policy (incl. ignoreip)",
   "applyIgnoreipOk": "Wrote ignoreip into jail.local and applied",
-  "ignoreipHint": "Without YSK_EXECUTE only panel file is written (apply_status=written);",
+  "ignoreipHint": "Without system-change permission only the panel file is written. Apply policy rebuilds jail.local ignoreip and reloads.",
   "whitelistTitle": "Whitelist ({{count}})",
   "whitelistRemoved": "Removed from whitelist",
   "remove": "Remove",
@@ -78,5 +82,26 @@
     "reload": "fail2ban reloaded",
     "restart": "fail2ban restarted",
     "stop": "fail2ban stopped"
-  }
+  },
+  "statWhitelist": "Whitelist",
+  "invalidIp": "Enter a valid IPv4, IPv6, or CIDR.",
+  "whitelistPendingApply": "Saved to the panel list. Press Apply policy to write jail.local.",
+  "ignoreipFile": "dataDir/fail2ban/ignoreip.txt",
+  "jailsTabHint": "Status of active jails. Turn jails on or off in the Policy tab.",
+  "colJail": "Jail",
+  "colEnabled": "On",
+  "serviceStateLine": "Unit {{unit}} · {{state}} · boot {{boot}}",
+  "jail": {
+    "sshd": "SSH brute-force",
+    "nginxHttpAuth": "Nginx HTTP authentication",
+    "nginxBotsearch": "Nginx scanner / bot probes",
+    "nginxBadbots": "Nginx known bad bots",
+    "nginxLimitReq": "Nginx rate-limit jail",
+    "postfix": "Postfix mail brute-force",
+    "dovecot": "Dovecot mail login",
+    "recidive": "Repeat offenders"
+  },
+  "cannotBanSelf": "This is the host or your login IP — add it to ignoreip instead of banning",
+  "suggestIgnoreHint": "Suggested admin IPs (panel file only until you apply policy):",
+  "suggestIgnoreAdd": "Add {{ip}}"
 }

package/locales/en/files.json

@@ -1,5 +1,7 @@
 {
   "pillFiles": "{{count}} files",
+  "pillTrash": "{{count}} in trash",
+  "pillSpace": "{{used}} used",
   "statFiles": "Files",
   "statFolders": "Folders",
   "statUsage": "Usage",
@@ -58,10 +60,14 @@
   "selectAllAria": "Select all",
   "selectAll": "Select all",
   "folder": "Folder",
+  "dirNamedLikeFile": "(folder leftover; name looks like a file)",
   "dropToUpload": "Drop to upload",
   "trashTitle": "Trash ({{count}})",
   "trashDesc": "Deleted files can be restored or permanently removed",
   "emptyTrash": "Empty trash",
+  "emptyTrashTitle": "Empty trash?",
+  "emptyTrashDesc": "Every file in trash will be permanently deleted. This cannot be undone.",
+  "purgeForeverDesc": "This file will be permanently deleted. This cannot be undone.",
   "emptyTrashDone": "Trash emptied",
   "colOrigPath": "Original path",
   "colDeletedAt": "Deleted at",
@@ -89,12 +95,15 @@
   "enabledMount": "Enabled · {{path}}",
   "notEnabled": "Not enabled",
   "disable": "Disable",
+  "webdavAlreadyOff": "WebDAV is already off",
   "webdavDisabled": "WebDAV disabled",
   "webdavEnabledNoEcho": "Enabled (password will not be shown again; re-issue if needed)",
   "webdavDefaultOff": "Off by default — click Enable and issue token to start",
+  "webdavAfterEnable": "Available after you enable WebDAV and issue a token.",
   "webdavOn": "Enabled",
   "webdavOff": "Disabled",
   "webdavTokenId": "Token #{{id}}",
+  "webdavTokenInactive": "Disabled — token #{{id}} is not active",
   "webdavUpdated": "Updated {{at}}",
   "webdavTokenOnceTitle": "Copy the password now",
   "webdavTokenOnceHint": "This password is shown only once; it cannot be retrieved after you leave this page.",
@@ -186,6 +195,9 @@
   "movedToTrash": "Moved to trash",
   "moveToTrashTitle": "Move to trash?",
   "moveToTrashDesc": "Delete {{count}} item(s) (restorable from trash)",
+  "deleteMore": " and {{n}} more",
+  "unshareTitle": "Revoke this share?",
+  "unshareDesc": "Revoke the link for {{name}} ({{url}}). The link stops working immediately.",
   "preview": "Preview",
   "imagePreviewNeedLogin": "Image preview needs login; use download instead",
   "pdfDownloadHint": "Download PDF to open (needs auth headers)",
@@ -316,5 +328,35 @@
   "publicShareBtFailed": "WebTorrent failed: {{detail}}",
   "publicShareBtNeedMagnet": "No magnet URI for this share",
   "publicShareBtUnsupported": "This browser cannot run WebTorrent; use magnet or .torrent instead",
-  "btNone": "—"
+  "btNone": "—",
+  "uploadStatusSkipped": "Skipped",
+  "uploadStatusCancelled": "Cancelled",
+  "conflict": {
+    "titleFile": "An item named “{{name}}” already exists",
+    "titleFolder": "A folder named “{{name}}” already exists",
+    "descFile": "Choose what to do. Nothing is overwritten until you pick Replace.",
+    "descFolder": "Choose what to do. Merge keeps the existing folder and continues with its contents.",
+    "incoming": "Incoming",
+    "existing": "Already here",
+    "kindFile": "File",
+    "kindFolder": "Folder",
+    "skip": "Skip",
+    "skipHint": "Do not add this item",
+    "keepBoth": "Keep both",
+    "keepBothHint": "Save incoming as {{name}}",
+    "replace": "Replace",
+    "replaceHint": "Overwrite the existing file. A version snapshot is kept when possible.",
+    "replaceFolderHint": "Overwrite files with the same names inside this folder. Other files stay.",
+    "merge": "Merge",
+    "mergeHint": "Keep the existing folder and add incoming files into it",
+    "applyAll": "Apply to all remaining conflicts",
+    "applyAllHint": "Use this action for the rest of this drop or transfer",
+    "cancelRest": "Cancel remaining",
+    "progress": "{{current}} of {{total}}",
+    "typeMismatch": "A {{destKind}} named “{{name}}” is already here. Incoming is a {{incomingKind}}.",
+    "skipped": "Skipped",
+    "cancelled": "Cancelled"
+  },
+  "webdavReissueUnchanged": "Token id did not change after re-issue — the write may not have persisted. Try again.",
+  "webdavDisableFailed": "WebDAV is still enabled after disable — the write may not have persisted. Try again."
 }

package/locales/en/firewall.json

@@ -20,6 +20,8 @@
   "statAllow": "Allow",
   "statDeny": "Deny",
   "statDefaultIn": "Default incoming",
+  "defaultNotApplied": "n/a (UFW off)",
+  "ufwOffHint": "Default incoming is not applied while UFW is off",
   "executeOn": "On",
   "executeOff": "Off",
   "ufwDisabled": "UFW disabled",
@@ -29,6 +31,7 @@
   "notInstalled": "UFW is not installed",
   "toolHintPrefix": "Underlying tools:",
   "toolHintBody": "UFW = ports / permanent rules · for attack response and auto-ban use",
+  "toolHintfail2ban": "fail2ban = temporary log-based bans",
   "toolHintFail2ban": "fail2ban = temporary log-based bans",
   "executeOffHint": "System changes off — status is readable;",
   "tabs": {
@@ -89,6 +92,7 @@
   "deleteRuleDesc": "Removes that UFW rule number (needs system-change permission).",
   "servicesTitle": "Managed services",
   "servicesHint": "Desired network exposure for YSK services. Opening a service syncs these rules automatically.",
+  "servicesUfwOff": "UFW is off. This list is the desired exposure, not rules the host is enforcing.",
   "servicesEmpty": "No service exposure data yet",
   "servicesEmptyDesc": "Start a managed service (web, FTPS, VPN, DB…) to populate this list.",
   "servicesManualHint": "Manual port chips are under the Ports tab — prefer managing access here so rules stay tagged (ysk-svc).",
@@ -98,5 +102,10 @@
   "colPorts": "Ports",
   "colSync": "Status",
   "synced": "Synced",
-  "syncNow": "Sync"
+  "syncNow": "Sync",
+  "disableConfirmTitle": "Disable UFW?",
+  "disableConfirmDesc": "The host firewall will stop filtering traffic. SSH and the panel can be exposed if the host is on a public network.",
+  "disableConfirmConsequence": "Existing allow/deny rules stay stored but are not enforced until UFW is enabled again.",
+  "desiredOnlyUfwOff": "Desired: {{mode}} · UFW off (not applied)",
+  "syncNotApplied": "UFW off · not applied"
 }