ysk-server-shared 1.0.0 → 1.1.0

package/locales/en/ftp.json

@@ -61,7 +61,13 @@
   "listenPortHint": "Default 21; open firewall if using another port",
   "customPort": "Custom port",
   "ipStack": "IP stack",
-  "ipStackHint": "Most vsftpd builds: listen and listen_ipv6 are mutually exclusive;",
+  "ipStackHint": "Most vsftpd builds: listen and listen_ipv6 are mutually exclusive.",
+  "listenConflictLive": "Live vsftpd.conf has listen={{v4}} and listen_ipv6={{v6}} — both YES will fail to start.",
+  "listenConflictNeedFix": "Fix listen / listen_ipv6 first (they cannot both be YES), then apply.",
+  "fixListenIpv4": "Use IPv4 only (listen=YES, listen_ipv6=NO)",
+  "liveFileValue": "File now: {{value}}",
+  "startBlockedFailed": "Service is failed — apply a valid config before start",
+  "ftpsNeedCert": "Pick a certificate domain first",
   "ipv4Only": "IPv4 only",
   "ipv6Mapped": "IPv6 (mapped OK)",
   "bannerHint": "Welcome string clients see after connect",
@@ -73,7 +79,10 @@
   "openFirewallPage": "Open firewall page",
   "customEnd": "Custom end",
   "pasvPublicIp": "PASV public IP",
+  "detectPublicIp": "Detect public IP",
+  "detectPublicIpTitle": "Fill the first non-loopback IPv4 from this host",
   "pasvPublicIpHint": "NAT/cloud: set public IP; local can leave empty",
+  "pasvIpRequired": "Set a public PASV IP before apply (NAT/cloud). Detect or type an address.",
   "optionalEmpty": "(optional)",
   "securityTitle": "Security settings",
   "securityDesc": "TLS, write access, chroot; Apply and restart to take effect",
@@ -95,7 +104,7 @@
   "opsResult": "Ops result",
   "saved": "Saved",
   "accountsList": "Account list",
-  "accountsListDesc": "After create, Apply to sync vsftpd. If service missing, install above then ",
+  "accountsListDesc": "After create, Apply to sync vsftpd. If it is not installed, use the Software tab.",
   "startService": " start.",
   "createAccountPlus": "+ Create account",
   "noFtpAccounts": "No FTP accounts yet",
@@ -131,5 +140,11 @@
   "sftpRegister": "Register key",
   "sftpAddedAt": "Added {{time}}",
   "sftpTechSummary": "Technical details (advanced)",
-  "sftpTechNote": "Keys are written under the managed path"
+  "sftpTechNote": "Keys are written under the managed path",
+  "filterProject": "Showing FTP accounts for this project",
+  "clearProjectFilter": "Show all accounts",
+  "vsftpdFailedHint": "vsftpd failed. Open the Service tab (listen and listen_ipv6 cannot both be YES).",
+  "vsftpdFailedGeneric": "vsftpd failed. Open the Service tab for live settings and journal.",
+  "stateFailed": "Failed to start",
+  "tabService": "Service"
 }

package/locales/en/hostBrowse.json

@@ -18,6 +18,7 @@
   "viaHost": "via host",
   "emptyTitle": "Host-mediated browse",
   "emptyBody": "Enter a URL. DNS, TLS, and egress use this server — not your browser. Cookies stay in a server-side jar.",
+  "needUrl": "Enter a URL above to start a session.",
   "ssrfBlocked": "Blocked by security policy (SSRF / mode)",
   "loadFailed": "Fetch failed on host",
   "sessionReady": "Session ready",
@@ -36,12 +37,15 @@
   "engineBrowser": "Real browser",
   "engineSwitchHint": "Switching engine opens a new session.",
   "needChrome": "Real browser needs system Chrome/Chromium (or set YSK_HOST_BROWSE_CHROME). Using proxy otherwise.",
+  "engineBrowserNeedChrome": "Real browser (Chrome not installed)",
+  "egressHint": "The target site sees this server’s outbound address ({{host}}), not your laptop. Cookies stay in the server session jar.",
   "needChromeFallback": "Chrome unavailable — switched to proxy engine.",
   "liveError": "Live stream failed",
   "liveWaiting": "Connecting host browser…",
   "tabSettings": "Settings",
   "softwareNeeded": "Chromium / Chrome required for real browser engine",
-  "softwareHint": "One-click installs distro Chromium via apt. Google Chrome binary is also detected if already present. Requires root + YSK_EXECUTE=1.",
+  "softwareHint": "One-click installs distro Chromium via apt. Google Chrome is also detected if already present. Needs superuser and system-change permission.",
+  "closeNoSession": "No session yet",
   "goInstallChrome": "Open Software tab",
   "settingsIntro": "These panel settings override process environment variables for Host Browse.",
   "settingsEngine": "Default engine",
@@ -82,6 +86,8 @@
   },
   "home": "Home",
   "bookmark": "Bookmark",
+  "bookmarkAdd": "Add or remove bookmark",
+  "bookmarkList": "Bookmark list",
   "bookmarks": "Bookmarks",
   "history": "History",
   "bookmarkToggled": "Bookmark updated",
@@ -90,6 +96,7 @@
   "mediaNote": "Real browser: video is streamed into the panel. Enable audio bridge in Settings to hear page audio (requires user gesture).",
   "isolationNote": "Real browser creates an ephemeral Linux user for Chrome; leaving the page or idle timeout destroys that user.",
   "resumeHint": "Resume previous session ({{count}} tabs)",
+  "resumeHintDetail": "Resume previous session ({{count}} tabs) · {{url}} · {{when}}",
   "resume": "Resume",
   "resumeDismiss": "Dismiss",
   "resumeDone": "Session resumed",
@@ -124,5 +131,18 @@
   "mediaAudioLabel": "Audio",
   "mediaAudioDesc": "Optional bridge from host Chrome; may require unlock click.",
   "mediaPolicyLabel": "Policy",
-  "mediaPolicyDesc": "Downloads and autoplay follow the safety and download settings above."
+  "mediaPolicyDesc": "Downloads and autoplay follow the safety and download settings above.",
+  "frameBlocked": "The page could not be shown in the panel frame.",
+  "historyEmpty": "No history in this session.",
+  "bookmarksEmpty": "No bookmarks yet.",
+  "closeSessionHint": "Clears cookies for this browse session. Bookmarks stay.",
+  "envUnset": "not set",
+  "envPanelValue": "panel: {{value}}",
+  "envColVar": "Variable",
+  "envColHost": "Host process",
+  "envColPanel": "Panel setting",
+  "envColEffective": "Effective",
+  "settingsNoSandboxWarn": "Disables Chromium sandbox. Use only inside a trusted container. Applies on next real-browser session.",
+  "settingsDangerDlWarn": "Allows executable and script downloads through the host browser. Confirm you need this.",
+  "settingsDangerConfirmTitle": "Enable a high-risk browse setting?"
 }

package/locales/en/listToolbar.json

@@ -8,5 +8,6 @@
   "activeFilters": "{{count}} filters active",
   "noResults": "No matches",
   "noResultsHint": "Try another keyword or clear filters.",
-  "searching": "Searching…"
+  "searching": "Searching…",
+  "emptyChip": "No items in this filter"
 }

package/locales/en/login.json

@@ -10,5 +10,10 @@
   "totpLabel": "Authentication code",
   "totpHint": "6-digit code from your authenticator app",
   "submitting": "Signing in…",
-  "sessionExpired": "Session expired; sign in again"
+  "sessionExpired": "Session expired; sign in again",
+  "newPassword": "New password",
+  "newPasswordAgain": "Confirm new password",
+  "changePassword": "Change password",
+  "passwordMismatch": "The two passwords do not match",
+  "passwordChanged": "Password updated"
 }

package/locales/en/logs.json

@@ -45,6 +45,9 @@
   "followingSse": " · following (SSE)",
   "loadingSources": "Loading sources…",
   "pickSource": "Pick a source on the left, or a shortcut · then Query",
+  "noRowsInWindow": "No records in this time window",
+  "showInactiveUnits": "Show inactive units",
+  "sseNeedFollow": "Turn on Follow first — SSE is only for live tail",
   "maintOverview": "Maintenance overview",
   "executable": "Executable",
   "restricted": "Restricted",
@@ -108,8 +111,11 @@
   "lines": "{{n}} lines",
   "followingSseDyn": " · following{{sse}}",
   "ipBan": "IP → ban",
-  "vacuumNote": "Free systemd-journal disk. No EXECUTE → blocked, no fake success.",
-  "vacuumTime": "Vacuum time",
+  "vacuumNote": "Reclaims systemd-journald disk. Without execute permission the action is blocked — it is not treated as success.",
+  "vacuumTime": "Clean by retention",
+  "vacuumNeedRetention": "Enter a retention window first (for example 14d)",
+  "vacuumNeedConfirm": "Needs confirmation — deletes old journal logs",
+  "vacuumSizeNeedConfirm": "Needs confirmation — caps journal disk use",
   "vacuumHint": "Keep ≥7 days recommended; re-probe disk after.",
   "logrotateStatus": "System logrotate status (read-only probe)",
   "logrotateMissing": "No status file or unreadable — check logrotate package in services matrix",
@@ -117,12 +123,13 @@
   "relatedOpsDesc": "Log observation vs incident response",
   "scLogsLine": "Observe journal / files / projects",
   "scProtLine": "Incident response, auto ban (click IP)",
-  "journalVacuumTitle": "Journal vacuum",
+  "journalVacuumTitle": "Clean journald disk",
   "journalSection": "Journal",
   "sseLabel": "SSE",
   "logrotateLabel": "logrotate",
   "srcNginx": "nginx",
   "srcSsh": "ssh",
+  "srcfail2ban": "fail2ban",
   "srcFail2ban": "fail2ban",
   "srcAuthLog": "auth.log",
   "srcNginxError": "nginx error",
@@ -131,5 +138,27 @@
   "groupVarLog": "/var/log",
   "prioErr": "err+",
   "prioWarn": "warn+",
-  "prioInfo": "info+"
+  "prioInfo": "info+",
+  "vacuumSize": "Limit to 500 MB",
+  "logrotateNoStatus": "No logrotate status file yet (normal if it has never run).",
+  "autoVacuumOff": "Automatic clean is off. Time is unused until you enable it.",
+  "aboutAllowlist": "Explore can only read allowlisted journal units and /var/log paths. Arbitrary host paths are not offered.",
+  "aboutCustomPath": "Add a custom path on Settings (only /var/log or /run/log). Then open it from Explore.",
+  "vacuumSizeAlreadyBelow": "Current usage already below cap, this will no-op",
+  "vacuumSizeNoopDesc": "Journal is already under 500 MB. This still runs vacuum --size=500M and typically deletes nothing.",
+  "journalDiskHint": "Current systemd-journald usage (active journal). Rotated files under /var/log are not included.",
+  "varLogDiskHint": "Estimated du of /var/log, including rotated files. Approximate.",
+  "queryFirst": "Query first",
+  "errorsWindowHint": "Recent errors from the last overview probe (not live-updating when you switch tabs)",
+  "sourceCount": "{{shown}} shown",
+  "sourceUnavailable": "This source has not produced a log yet",
+  "sourceNoLog": "No log yet",
+  "projectSourcesTitle": "{{n}} source(s) (files + journal)",
+  "logrotatePath": "Path",
+  "logrotateLast": "Last rotated",
+  "exportJsonl": "JSONL export",
+  "sseLive": " (live stream)",
+  "logrotateExpand": "Show {{n}} more",
+  "logrotateCollapse": "Show fewer",
+  "logrotateVersion": "Status version {{v}}"
 }

package/locales/en/metrics.json

@@ -27,6 +27,15 @@
     "alerts": "Alerts"
   },
   "load": "Load",
+  "load1m": "Load 1m",
+  "uptime": "Uptime",
+  "filterCpu5": "≥5% CPU",
+  "filterMem5": "≥5% memory",
+  "signalHint": "Select a process, then send TERM or KILL.",
+  "signalFromRow": "Select this process for TERM / KILL",
+  "selectForSignal": "Select",
+  "forceKillTitleNamed": "KILL PID {{pid}} ({{cmd}})?",
+  "sendSigTitleNamed": "Send TERM to PID {{pid}} ({{cmd}})?",
   "min1": "1m",
   "min5": "5m",
   "min15": "15m",
@@ -82,6 +91,8 @@
   "noProjectsDesc": "Create a project to see real home usage here",
   "usageNote": "Usage from local du (not estimated). Quota is a control-plane soft limit; hard setquota needs apply-to-host.",
   "thresholdAlerts": "Threshold alerts",
+  "alertsBuiltinOnly": "Built-in CPU / memory / disk thresholds only. No email, webhook, or Slack channel.",
+  "lastEvaluated": "Last checked",
   "alertsOkTitle": "All clear",
   "alertsOkDesc": "No memory / load / disk threshold alerts.",
   "cpu": "CPU",
@@ -98,6 +109,18 @@
   "selectAllAria": "Select all filtered",
   "selectPidAria": "Select PID {{pid}}",
   "controlPlane": "Control plane",
+  "controlPlaneNoSignal": "The control-plane process cannot be signalled",
+  "protectedPid": "PID 1 / init / systemd cannot be signalled from the panel",
+  "sigTermTitle": "Send SIGTERM (ask process to exit)",
+  "sigKillTitle": "Send SIGKILL (force kill — cannot be caught)",
+  "batchTerm": "TERM",
+  "batchKill": "KILL",
+  "rawTopLabel": "Raw top (untranslated)",
+  "followSseLabel": "Follow (live stream)",
+  "alertsReadOnly": "Built-in CPU / memory / disk thresholds only. No email, webhook, or Slack channel.",
+  "alertsGoNotifications": "Open notification centre",
+  "lastCheck": "Last check",
+  "rawTopHint": "Untranslated top(1) output",
   "detailShort": "Info",
   "procUnavailable": "Could not get processes",
   "noProcData": "No process data yet",
@@ -116,7 +139,7 @@
   "reniceHint": "-20 highest · 19 lowest (needs EXECUTE)",
   "noData": "No data",
   "mountsTitle": "Disk mounts ({{count}})",
-  "mountsDesc": "Real df -P -B1 (tmpfs filtered)",
+  "mountsDesc": "Real disk usage (temporary filesystems filtered)",
   "noMounts": "No mount list",
   "noMountsDesc": "df unavailable or filtered. Root disk still on Overview.",
   "seeProjectUsage": "Project home usage is on the Project usage tab (real du · {{size}})",
@@ -128,5 +151,17 @@
   "usageNoteFull": "Usage from local du (not estimated). Quota is a control-plane soft limit; hard setquota needs apply-to-host.",
   "sseNeedLogin": "Not logged in; cannot open SSE",
   "sseSessionExpired": "Not logged in or session expired; cannot open SSE",
-  "sseHttpError": "stream HTTP {{status}}"
+  "sseHttpError": "stream HTTP {{status}}",
+  "colFilesystem": "Filesystem",
+  "colMount": "Mount",
+  "colSize": "Size",
+  "colUsed": "Used",
+  "colAvail": "Available",
+  "colUsePct": "Used %",
+  "colHome": "Home",
+  "usageNoteLink": "Control-plane soft quota. Apply hard limits on the project Isolation tab.",
+  "shareNoQuotaHint": "No quota set, so share is not a percentage. Set a quota on the project Isolation tab.",
+  "setQuotaLink": "Set quota",
+  "unusualHome": "Unusual path",
+  "unusualHomeHint": "Not a /home/… project home. Canonical isolation is /home/ysk-server-{id}."
 }

package/locales/en/migrate.json

@@ -10,6 +10,7 @@
   "subtitle": "Source control plane → full copy to new host. Afterward only change public IP/DNS; accounts, paths, and projects stay the same.",
   "inventorying": "Inventorying",
   "inventoried": "Inventoried",
+  "inventoriedWarn": "Inventoried · {{n}} warnings",
   "inventoryFailed": "Inventory failed",
   "pendingInventory": "Pending inventory",
   "projects": "Projects",
@@ -38,6 +39,8 @@
   "authMethod": "Auth method",
   "rootPassword": "Root password",
   "notPersisted": "Not persisted",
+  "passwordNotStored": "Password is used for this SSH session only and is not saved on disk.",
+  "overwriteDanger": "Overwrite will replace existing YSK data on the target. This cannot be undone from the panel.",
   "outboundIdentity": "Outbound identity in vault",
   "dryRun": "Dry-run precheck",
   "startMigrate": "Start full-host migration",
@@ -66,6 +69,16 @@
   "restartApiHint": "If you just deployed a new version, restart the API (",
   "afterRestart": ") then Refresh.",
   "inventoryWarnings": "Inventory warnings ({{count}})",
+  "orphanHomesHint": "Leftover project homes (not in the store). Remove only after you confirm they are unused.",
+  "orphanRemove": "Remove leftover home",
+  "orphanRemoveTitle": "Delete leftover project home?",
+  "orphanRemoveDesc": "Permanently delete {{path}} from disk. This is not a store project. Needs superuser and system-change permission.",
+  "orphanRemovePhrase": "Type DELETE to confirm.",
+  "orphanRemoveNeedConfirm": "Needs confirmation",
+  "orphanBackupFirst": "Back up first (open Backups)",
+  "orphanMtime": "Last modified {{at}}",
+  "expandAllWarnings": "Show all {{n}} warnings",
+  "collapseWarnings": "Show fewer",
   "moreWarnings": "…and {{n}} more",
   "authPassword": "root password (switch to key after temp key install)",
   "authIdentity": "SSH identity vault identityId",
@@ -76,7 +89,7 @@
   "allowOverwriteDesc": "· Required if target already has ysk.json",
   "dryRunOnly": "Dry-run only",
   "dryRunOnlyDesc": "· Inventory + precheck only; no rsync or target writes",
-  "executeNote": "Host needs YSK_EXECUTE=1 and root API. After migrate, update DNS A/AAAA and check cloud firewall + mail PTR.",
+  "executeNote": "Host needs system-change permission and a superuser API. After migrate, update DNS A/AAAA and check cloud firewall + mail PTR.",
   "dnsCutover": "DNS cutover (manual)",
   "dnsCutoverDesc": "Point A/AAAA for these names to the new public IP;"
 }

package/locales/en/nav.json

@@ -53,7 +53,9 @@
     "runtimes": "Runtimes",
     "security": "Security",
     "system": "System",
-    "ai": "AI"
+    "ai": "AI",
+    "validators": "Validators",
+    "containers": "Containers"
   },
   "java": "Java",
   "kotlin": "Kotlin",
@@ -73,5 +75,10 @@
   "bookmarkAdded": "Pinned to sidebar",
   "bookmarkRemoved": "Removed from sidebar",
   "btTracker": "BT Tracker",
-  "support": "Support"
+  "support": "Support",
+  "noAccessTitle": "No access",
+  "noAccessDesc": "Your role does not include this page. Ask an admin if you need it.",
+  "backToDashboard": "Back to dashboard",
+  "validators": "Validators (Beta)",
+  "docker": "Docker"
 }

package/locales/en/network.json

@@ -3,6 +3,13 @@
   "canMutate": "Mutable",
   "readOnlyBlocked": "Read-only / blocked",
   "statIfaces": "Interfaces",
+  "statUp": "Up",
+  "oper": {
+    "up": "Up",
+    "down": "Down",
+    "unknown": "Unknown",
+    "other": "Other"
+  },
   "statGateway": "Gateway",
   "pageActions": "Page actions",
   "loadingSnap": "Loading network snapshot…",
@@ -35,6 +42,8 @@
   "defaultDev": "Default egress: {{dev}}",
   "saveNm": "Save (NetworkManager, survives reboot)",
   "ephemeralHint": "Unchecked = live ip route add only",
+  "nmUnavailable": "NetworkManager is not running — only a live route can be added",
+  "defaultRouteDownNeedName": "This is the default route egress. Type the interface name to confirm — the panel may disconnect.",
   "saveRoute": "Save route",
   "dnsSettings": "DNS settings",
   "dnsNmHint": "Writes NM connection “{{conn}}” and reconnects (persistent)",
@@ -103,9 +112,17 @@
   "applyDnsNotes": "Apply runs nmcli connection modify + up; brief disconnect is normal. Stub 127.0.0.53 is not written (local resolved).",
   "testResolve": "Test resolve",
   "loadRaw": "Load raw output",
+  "hideRaw": "Hide raw output",
+  "rawLoadedAt": "Loaded {{time}}",
   "confirmDown": "Confirm Down",
+  "linkDownTitle": "Take {{name}} offline",
+  "linkDownNeedConfirm": "Type the interface name to confirm",
   "defaultRouteDownWarn": "This interface is the default route egress; down may cut panel access.",
   "deleteDefaultMayDrop": " — deleting default may drop connectivity.",
+  "deleteDefaultPanelWarn": "Deleting the default route can drop this panel session. Type DEFAULT to confirm.",
+  "deleteDefaultNeedConfirm": "Needs confirmation — type DEFAULT (may drop this panel)",
+  "deleteRouteNeedConfirm": "Needs confirmation",
+  "typeDefaultToConfirm": "Type DEFAULT to confirm",
   "gateway": "Gateway",
   "nameservers": "Nameservers",
   "searchDomains": "Search domains",
@@ -135,8 +152,14 @@
       "azure_frontdoor": "Azure Front Door",
       "gcore": "Gcore CDN",
       "custom": "Custom proxies"
-    }
+    },
+    "needProvider": "Choose a CDN provider before fetching its IP list.",
+    "spoofWarn": "Trusting the wrong CIDR lets clients spoof X-Forwarded-For / CDN headers as their IP."
   },
   "linkUp": "Up",
-  "linkDown": "Down"
+  "linkDown": "Down",
+  "linkDownDefault": "Down default route",
+  "loopbackImmutable": "Loopback cannot be changed",
+  "operUnknownHint": "Kernel did not report UP/DOWN (common for lo). The interface is still usable.",
+  "persistNmHint": "Persistable means changes can survive reboot via NetworkManager."
 }

package/locales/en/notFound.json

@@ -0,0 +1,6 @@
+{
+  "title": "Page not found",
+  "body": "No panel page at {{path}}.",
+  "hint": "Unknown URLs no longer send you to the dashboard.",
+  "home": "Dashboard"
+}