ysk-server-shared 1.0.0 → 1.1.9

package/locales/en/db.json

@@ -52,12 +52,26 @@
   "emptyDbInstallFirst": "Install {{engine}} via the banner, then Create database",
   "emptyDbCannotProvision": "Cannot create databases on the server right now",
   "emptyDbCreateHint": "Use Create database, then Apply",
+  "emptyDbHostHasRows": "The host already has databases that are not in this control-plane list.",
+  "registeredVsHostHint": "Registered in the panel / found on the host",
+  "registeredCount": "Registered",
+  "hostCount": "On host",
+  "registeredUsers": "Registered users",
+  "registeredUsersHint": "Panel registrations only — not every MySQL account",
+  "hostStillExists": "Still on host",
+  "expiresLabel": "Expires",
+  "dumpNeedRegistered": "Register a database in the panel first",
+  "dumpFirstDbTitle": "Export the first registered database",
+  "importNeedRegistered": "Register a database in the panel first",
+  "importLatestNeedConfirm": "Needs confirmation — imports into the registered database",
+  "hostHasUntracked": "{{count}} host databases are not registered in the panel",
+  "hostInventoryHint": "The table is control-plane rows only. Live names come from SHOW DATABASES.",
   "userList": "Users",
   "userListDesc": "Grant users access to databases",
   "createUserBtn": "+ Create user",
   "noUsersYet": "No users yet",
   "tempReadonlyUsers": "Temporary read-only users",
-  "tempReadonlyDesc": "Control plane marks expired after TTL;",
+  "tempReadonlyDesc": "Expired accounts are dropped from the server when this page loads (needs EXECUTE + root). Rows left below still exist on the host.",
   "dbName": "Database name",
   "ttlHours": "TTL (hours)",
   "ttlHoursHint": "Marked invalid after expiry",
@@ -66,7 +80,14 @@
   "expiresAt": "Expires",
   "revokeRegistration": "Revoke registration",
   "remoteDbHosts": "Remote database hosts",
-  "remoteDbHostsDesc": "Register connection targets (password not echoed back)",
+  "remoteDbHostsDesc": "Register connection targets (password not echoed back). Saved ≠ reachable until Test connection.",
+  "remoteTest": "Test connection",
+  "remoteTestDone": "Remote host probe finished",
+  "remoteTestOk": "reachable",
+  "remoteTestFail": "unreachable",
+  "remoteNotChecked": "not tested",
+  "remoteDeleteTitle": "Remove this registration only",
+  "remoteDeleteConfirm": "Remove registration {{name}}? The remote server is not changed.",
   "displayName": "Display name",
   "prodReplicaPlaceholder": "Production replica",
   "remoteHostSaved": "Remote host saved",
@@ -91,7 +112,7 @@
   "import": "Import",
   "importOk": "Import complete",
   "importFailed": "Import failed",
-  "deleteDbTitle": "Delete database registration?",
+  "deleteDbTitle": "Remove control-plane registration (does not DROP the server database)",
   "deleteDbDesc": "Removes control-plane record only; does not DROP the server database.",
   "deleteUserTitle": "Delete user registration?",
   "deleteUserDesc": "Removes control-plane record only.",
@@ -120,8 +141,28 @@
   "update": "Update",
   "alsoCreateRole": "Also create role",
   "cluster": {
+    "standaloneOtherEngines": "This engine is standalone. Other engines have clusters: {{names}}.",
+    "roleUnassigned": "No role assigned",
     "title": "Cluster",
-    "description": "Plan → write management → apply → probe → peer distribute / fleet. Default dry-run.",
+    "description": "Plan → write management files → apply → probe → distribute to peers / fleet. Default is dry-run (no host restart).",
+    "redirectedFromCluster": "You were redirected here from /cluster. This is the database cluster tab.",
+    "notApplied": "Not applied",
+    "plannedAt": "Created {{when}}",
+    "clearStalePlans": "Clear stale plans",
+    "clearStalePlansTitle": "Delete stale planned clusters?",
+    "clearStalePlansDesc": "Deletes {{n}} planned/draft registration(s) older than 7 days. Does not apply or push. System conf is not touched.",
+    "landingTitle": "Database cluster",
+    "landingDesc": "All planned and applied database clusters on this host. Open an engine to create or apply.",
+    "landingNoneInstalled": "MySQL, MariaDB, PostgreSQL, and Redis are not installed. Install an engine first.",
+    "openEngine": "Open {{engine}}",
+    "overviewPill": "Clusters {{n}}",
+    "enginesInstalled": "Engines",
+    "plannedCount": "Planned",
+    "overviewList": "Clusters ({{count}})",
+    "overviewEmpty": "No cluster registrations yet.",
+    "engine": "Engine",
+    "kind": "Kind",
+    "members": "Members",
     "kindGalera": "Simple Galera",
     "kindMysqlReplica": "MySQL primary/replica",
     "kindPgReplica": "PostgreSQL streaming replica",
@@ -150,10 +191,37 @@
     "registrationDeleted": "Registration deleted",
     "nodes": "Nodes",
     "remoteInstallPlan": "Remote install plan",
+    "fleetSession": "Fleet agent session id",
+    "fleetSessionHint": "Optional. Pick a registered fleet session (uses fleet, not SSH). Leave empty for SSH scp.",
+    "fleetSessionPh": "Agents page session UUID",
+    "fleetSessionNone": "None — use SSH",
+    "fleetSessionOpenAgents": "Open /agents to register a session",
+    "createWizardTitle": "Opens the plan wizard. Needs a local IP and ≥1 peer. Writes panel artifacts only (dry-run). Does not restart the engine until you apply.",
+    "bootstrap": "Bootstrap",
+    "fleetApply": "Fleet apply",
+    "planTitle": "Regenerate the cluster plan (no host change)",
+    "writeFileTitle": "Write management files under the panel data dir (dry-run)",
+    "probeLocalTitle": "Probe this host only",
+    "probeAllTitle": "Probe every registered member",
+    "bootstrapTitle": "Install local drop-in and bootstrap the first node",
+    "remoteInstallPlanTitle": "Preview remote install (no execute)",
+    "downloadBundleTitle": "Download peer conf bundle (.tar.gz)",
+    "pushPlanTitle": "Preview push to peer (no scp)",
+    "fleetSyncPlanTitle": "Preview fleet sync (no execute)",
+    "fleetApplyTitle": "Enqueue apply on fleet members?",
+    "status": {
+      "healthy": "Healthy",
+      "planned": "Planned",
+      "partial": "Partial",
+      "failed": "Failed",
+      "draft": "Draft",
+      "degraded": "Degraded",
+      "applied": "Applied"
+    },
     "fleetSyncPlan": "Fleet sync plan",
     "standaloneTitle": "Currently: standalone",
     "standaloneRepl": "No replica registered. Set primary/master + replica to generate conf and scripts.",
-    "standaloneHa": "No HA registered. Add peer nodes to generate conf plan, then bootstrap / join.",
+    "standaloneHa": "No HA registered. Add at least one peer, generate a conf plan, then bootstrap the first node and join the others.",
     "recentProbe": "Recent probe (local wsrep)",
     "probeRequired": "healthy requires a passing probe",
     "planPreview": "Plan preview",
@@ -200,6 +268,7 @@
     "remoteInstalled": "Remote installed",
     "fleetSynced": "Fleet sync queued",
     "fleetApplyQueued": "Fleet apply queued",
+    "engineNotInstalled": "{{engine}} is not installed on this host — install it first, or open the engine that is actually running.",
     "plan": "Plan",
     "writeFile": "Write files",
     "applyLocal": "Apply local",
@@ -216,8 +285,7 @@
     "delete": "Delete",
     "probe": "Probe",
     "name": "Name",
-    "type": "Type",
-    "status": "Status"
+    "type": "Type"
   },
   "console": {
     "dataBrowse": "Browse data",
@@ -225,6 +293,7 @@
     "realtime": "Live",
     "reload": "Reload",
     "needRestart": "Restart required",
+    "affectsProjects": "Sites and services that use this engine will be interrupted.",
     "lifecycle": "Lifecycle",
     "overview": "Overview",
     "actionDone": "{{action}} done",
@@ -256,6 +325,7 @@
     "installEngine": "Use the banner above to install {{title}}.",
     "reloadConfig": "Reload config",
     "disableBoot": "Disable on boot",
+    "disableBootConfirm": "The engine will not start after reboot until you enable it again.",
     "needRights": "Needs system-change rights and admin. Failures show reasons — never fake success.",
     "noneFetched": "— none —"
   },
@@ -283,5 +353,8 @@
   "unfreezeOk": "{{engine}} repair complete",
   "startAfterUnfreeze": "Start service (auto-runs repair plan on failure)",
   "serviceDownTitle": "Database service is down",
-  "serviceDownBody": "Service is unhealthy"
+  "serviceDownBody": "Service is unhealthy",
+  "adoptHostDb": "Register in panel (no create): {{name}}",
+  "adoptHostDbTitle": "Registers the name in the control plane only — does not change host data",
+  "cleanupExpiredTempUsersTitle": "Drops panel-issued temporary users that have expired"
 }

package/locales/en/dns.json

@@ -32,6 +32,8 @@
   "zonesTitle": "Zones ({{count}})",
   "zonesDesc": "After create, write/apply the zone",
   "createZone": "+ Create zone",
+  "mailZonesMissing": "Email domains have no DNS zone here: {{domains}}.",
+  "createMailZone": "Create mail zone",
   "colZoneName": "Zone name",
   "colServerIp": "Server IP",
   "colTemplate": "Template",
@@ -108,7 +110,10 @@
   "validateDesc": "Create/edit auto-validates (CNAME clashes, A/AAAA format, etc.).",
   "createZoneTitle": "Create DNS zone",
   "createZoneDesc": "Generate records from a template",
+  "createZoneNeedValid": "Enter a valid zone name and IPv4 address",
   "zoneNameHint": "e.g. example.com (no trailing dot)",
+  "invalidZone": "Invalid zone name. Use a real domain (e.g. example.com).",
+  "invalidIpv4": "Invalid IPv4. Each octet must be 0–255.",
   "serverIpv4": "Server IPv4",
   "serverIpv4Hint": "Address used for template A records",
   "thisHostIpv4": "This host public IPv4",
@@ -202,9 +207,16 @@
   "lookupServer": "Server (@)",
   "lookupServerHint": "127.0.0.1 = local auth; public IP tests external; empty = system resolver",
   "healthHealPdns": "Heal PowerDNS bind",
+  "healNeedInstall": "PowerDNS is not installed — install it on the Software tab first",
+  "applyNeedService": "DNS service is not running — start or install it before apply",
+  "goStartService": "Start DNS service",
+  "startBindHint": "If start returns to stopped, port 53 is often held by systemd-resolved. Use Heal bind below, then start again.",
+  "deleteZoneNeedName": "Delete this zone — you will type the zone name to confirm",
   "healthHealPdnsHint": "Set local-address to public IP to avoid clashing with systemd-resolved on 0",
   "healthHealPdnsOk": "PowerDNS bound to {{ip}} and start attempted",
   "healthHealPdnsFailed": "PowerDNS heal failed",
+  "startProbeFailed": "Could not re-check DNS health after start",
+  "startNotListening": "PowerDNS start returned, but the unit is not answering on port 53",
   "aboutTitle": "DNS essentials",
   "aboutSub": "Zones first; records, cluster, and DNSSEC need a selected domain.",
   "aboutZonesTitle": "Zones and scope",
@@ -212,5 +224,15 @@
   "aboutHealthTitle": "Service health",
   "aboutHealthBody": "Use Tools to probe PowerDNS, heal bind, and open port 53.",
   "aboutStackTitle": "Software",
-  "aboutStackBody": "Check/update the PowerDNS package under Software."
+  "aboutStackBody": "Check/update the PowerDNS package under Software.",
+  "createMailZoneNow": "Created mail zone {{domain}}",
+  "toolsFirewallTitle": "Firewall (UFW)",
+  "toolsFirewallHint": "Allow or deny port 53. This does not start or stop PowerDNS.",
+  "toolsUnitTitle": "PowerDNS unit",
+  "toolsUnitHint": "systemd unit pdns — start, stop, restart, reload.",
+  "installConfirmTitle": "Install PowerDNS?",
+  "installConfirmDesc": "Installs pdns-server and writes the managed authoritative config. Needs root and YSK_EXECUTE=1.",
+  "installConfirmConsequence": "After install and start, PowerDNS will bind port 53.",
+  "installPort53Busy": "Something already listens on port 53. PowerDNS may fail to bind until that listener is stopped or healed.",
+  "installPort53BusyConsequence": "Heal bind or stop the other listener before expecting answers on port 53."
 }

package/locales/en/docker.json

@@ -0,0 +1,248 @@
+{
+  "title": "Docker",
+  "subtitle": "Install Docker Engine, then manage containers, images, volumes, and validator Compose stacks on this host.",
+  "refresh": "Refresh",
+  "notInstalled": "Docker Engine is not installed. Install docker.io and docker-compose-v2 from this page.",
+  "protected": "Protected",
+  "pruneConfirm": "Type PRUNE to confirm any prune",
+  "needEngineTitle": "Install Docker Engine first",
+  "stopEngineDesc": "This stops the Docker engine and all {{n}} container(s) on this host.",
+  "notInstalledValue": "Not installed",
+  "nameHint": "Letters, digits, underscore, dot, hyphen (max 128)",
+  "volPlaceholder": "my-data",
+  "netPlaceholder": "my-net",
+  "runPorts": "Publish ports",
+  "runPortsHint": "host:container per line, e.g. 8080:80",
+  "runEnv": "Environment",
+  "runEnvHint": "KEY=value per line",
+  "runRestart": "Restart policy",
+  "runNetwork": "Network",
+  "runVolumes": "Volumes",
+  "runVolumesHint": "volume:dest per line",
+  "runAdvancedHint": "For multi-service stacks use validator nodes or Compose files already on this host.",
+  "daemonConfirmTitle": "Apply daemon settings?",
+  "daemonConfirmDesc": "Writes daemon.json and restarts docker.service. All containers will be interrupted.",
+  "settingsHint": "Safe daemon.json subset only. Apply writes the file and restarts docker.service.",
+  "cli": {
+    "usage": "Usage: ysk-server docker status|ps|images|volumes|networks|df|logs|inspect|exec|start|stop|restart|rm|pull|run|prune|engine|compose [--image IMG] [--name N] [--preset version|help|hostname] [--bin BIN] [--project P] [--execute] [--json]"
+  },
+  "tab": {
+    "overview": "Overview",
+    "containers": "Containers",
+    "images": "Images",
+    "compose": "Compose",
+    "volumes": "Volumes",
+    "networks": "Networks",
+    "prune": "Prune",
+    "settings": "Settings",
+    "about": "About"
+  },
+  "col": {
+    "engine": "Engine",
+    "containers": "Containers",
+    "version": "Version",
+    "dataRoot": "Data root",
+    "disk": "Disk",
+    "validators": "Validator stacks",
+    "name": "Name",
+    "image": "Image",
+    "status": "Status",
+    "ports": "Ports",
+    "managed": "Managed",
+    "size": "Size",
+    "driver": "Driver",
+    "type": "Type",
+    "reclaimable": "Reclaimable"
+  },
+  "state": {
+    "up": "Active",
+    "down": "Stopped",
+    "running": "Running",
+    "exited": "Exited",
+    "exitedCode": "Exited ({{n}})",
+    "restarting": "Restarting",
+    "restartingCount": "Restarting · {{n}} times",
+    "paused": "Paused",
+    "created": "Created",
+    "dead": "Dead",
+    "removing": "Removing",
+    "unknown": "Unknown"
+  },
+  "df": {
+    "images": "Images",
+    "containers": "Containers",
+    "volumes": "Local volumes",
+    "builder": "Build cache",
+    "other": "Other"
+  },
+  "actions": {
+    "start": "Start",
+    "stop": "Stop",
+    "restart": "Restart",
+    "remove": "Remove",
+    "logs": "Logs",
+    "inspect": "Inspect",
+    "exec": "Exec (version)",
+    "run": "Run image",
+    "pull": "Pull",
+    "up": "Up",
+    "down": "Down",
+    "createVolume": "Create volume",
+    "createNetwork": "Create network",
+    "pruneContainers": "Prune containers",
+    "pruneImages": "Prune images",
+    "pruneVolumes": "Prune volumes",
+    "pruneSystem": "System prune",
+    "startEngine": "Start engine",
+    "stopEngine": "Stop engine",
+    "restartEngine": "Restart engine",
+    "applyDaemon": "Apply daemon settings"
+  },
+  "empty": {
+    "containers": "No containers",
+    "images": "No images",
+    "compose": "No Compose projects",
+    "composeDesc": "Projects come from validator nodes or Compose files already on this host. This page does not accept arbitrary YAML uploads.",
+    "composeCta": "Open validator nodes",
+    "volumes": "No volumes",
+    "networks": "No networks"
+  },
+  "logs": {
+    "empty": "No log output.",
+    "follow": "Follow"
+  },
+  "deleteRunningWarn": "This container is still running or restarting. It will be force-removed.",
+  "settings": {
+    "logMaxSize": "Container log max size",
+    "liveRestore": "Live restore (keep containers if the daemon restarts)",
+    "mirrors": "Registry mirrors (one URL per line)",
+    "insecure": "Insecure registries (one host per line)"
+  },
+  "about": {
+    "body": "Docker is a first-class host service on YSK Server, like Nginx. Install via the panel (Ubuntu docker.io + docker-compose-v2). Validator nodes run as Compose projects named yskval-*.",
+    "honesty": "Host changes need root and YSK_EXECUTE=1. Dry-run is the default. This page manages Docker on one host; use external Kubernetes for cluster orchestration.",
+    "validators": "Open validator nodes"
+  },
+  "alerts": {
+    "daemonTitle": "Docker daemon is down",
+    "daemonBody": "The Docker engine is installed but docker.service is not active. Validator stacks cannot start."
+  },
+  "errors": {
+    "notInstalled": "Docker is not installed",
+    "daemonDown": "Docker daemon is not active",
+    "needCompose": "docker compose (v2 plugin) is required",
+    "badImage": "Invalid image reference",
+    "badName": "Invalid name",
+    "badPort": "Invalid port publish",
+    "badEnv": "Invalid environment variable",
+    "badVolume": "Invalid volume mount",
+    "badNetwork": "Invalid network",
+    "protectedNetwork": "Cannot remove a built-in Docker network",
+    "badRestart": "Invalid restart policy",
+    "badPrune": "Invalid prune scope",
+    "needPruneConfirm": "Volume or system prune requires confirm=PRUNE",
+    "badDaemon": "Invalid daemon setting",
+    "composeMissing": "Compose file for this project was not found",
+    "logsFailed": "Could not read container logs",
+    "mutateFailed": "Docker command failed",
+    "engineFailed": "Could not control docker.service",
+    "badExec": "Exec is limited to allowlisted binaries and presets (no shell, no TTY)",
+    "uninstallBusy": "Stop YSK-managed containers (including validator stacks) before uninstalling Docker"
+  },
+  "notes": {
+    "dryMutate": "Dry-run only. Pass --execute and YSK_EXECUTE=1 to change the host.",
+    "dryPrune": "Prune preview (not applied).",
+    "dryEngine": "Engine control is dry-run.",
+    "dryDaemon": "Would write /etc/docker/daemon.json and restart docker.service.",
+    "daemonWrote": "Wrote daemon.json",
+    "start": "Container started",
+    "stop": "Container stopped",
+    "restart": "Container restarted",
+    "remove": "Container removed",
+    "ran": "Container started from image",
+    "pulled": "Image pulled",
+    "exec": "Ran allowlisted exec",
+    "imageRemoved": "Image removed",
+    "volumeCreated": "Volume created",
+    "volumeRemoved": "Volume removed",
+    "networkCreated": "Network created",
+    "networkRemoved": "Network removed",
+    "pruned": "Prune finished",
+    "compose": {
+      "up": "Compose project started",
+      "down": "Compose project stopped",
+      "restart": "Compose project restarted",
+      "rm": "Compose project removed"
+    },
+    "engine": {
+      "start": "docker.service started",
+      "stop": "docker.service stopped",
+      "restart": "docker.service restarted"
+    }
+  },
+  "ui": {
+    "whatYouGet": "What this page does",
+    "whatYouGetLead": "Install Docker Engine once. After that you can run a single container, pull images, and see validator Compose stacks that already live on this host.",
+    "capEngine": "Engine",
+    "capEngineDesc": "One-click install of docker.io and docker-compose-v2. Start and stop docker.service here.",
+    "capWork": "Containers and images",
+    "capWorkDesc": "Pick a common image, pull it, run it, then read logs or inspect the container.",
+    "capStacks": "Validator stacks",
+    "capStacksDesc": "Multi-service stacks are validator Compose projects (yskval-*). This page does not accept YAML uploads.",
+    "cardEngine": "Engine",
+    "cardDisk": "Disk",
+    "cardWork": "On this host",
+    "compose": "Compose",
+    "cgroup": "cgroup",
+    "used": "Used",
+    "free": "Free",
+    "running": "Running",
+    "images": "Images",
+    "volumes": "Volumes",
+    "networks": "Networks",
+    "goImages": "Images",
+    "goValidators": "Validator nodes",
+    "imagePickHint": "Choose a common image. Use Other only when you need a different reference.",
+    "imageCustom": "Other",
+    "driver": "Driver",
+    "driverLocalOnly": "This panel creates local volumes only.",
+    "netDefaultDriver": "New networks use Docker’s default bridge driver.",
+    "pruneWhat": "What to remove",
+    "pruneAck": "I understand unused data will be deleted and cannot be restored",
+    "pruneAckDesc": "Volume and system prune cannot be undone. Stopped containers and unused images are removed for the selected scope.",
+    "pruneNow": "Prune now",
+    "useMirrors": "Use registry mirrors",
+    "useInsecure": "Allow insecure registries",
+    "publishPorts": "Publish ports to the host",
+    "attachVolume": "Attach a volume",
+    "setEnv": "Set environment variables",
+    "defaultNet": "Default",
+    "mountPath": "Mount path",
+    "restartNo": "Never",
+    "restartUnless": "Unless stopped",
+    "restartAlways": "Always",
+    "restartOnFail": "On failure",
+    "needAck": "Confirm before pruning",
+    "scopeContainers": "Stopped containers",
+    "scopeImages": "Unused images",
+    "scopeVolumes": "Unused volumes",
+    "scopeBuilder": "Build cache",
+    "scopeSystem": "Everything unused",
+    "noVolumesYet": "No volumes yet — create one on the Volumes tab first.",
+    "customPort": "Another host port",
+    "customPortHost": "Host port",
+    "customPortContainer": "Container port",
+    "pctUsed": "{{n}}% used",
+    "customPortHint": "1–65535. Example: 9090 → 80.",
+    "pickBridge": "Bridge network"
+  },
+  "deleteTitle": "Delete {{id}}",
+  "deleteDesc": "This cannot be undone.",
+  "deleteC1": "The resource is removed from this host.",
+  "deleteComposeVal": "This is a validator stack — the validator instance is also deleted.",
+  "pruneTitle": "Prune Docker resources",
+  "pruneDesc": "Type PRUNE to confirm. Unused data cannot be restored.",
+  "pruneC1": "Unused resources in the selected scope are deleted.",
+  "pruneC2": "Volume and system prune permanently delete unused data volumes.",
+  "pruneC3": "Stopped containers or unused images in this scope are removed."
+}

package/locales/en/email.json

@@ -41,13 +41,16 @@
   "webmailMovedHint": "Webmail is configured globally (not per domain).",
   "openGlobalWebmailSettings": "Open webmail settings",
   "domainsTitle": "Domains ({{filtered}}/{{total}})",
+  "domainsListDesc": "Mail domains registered on this host",
   "emptyFilterHint": "No domains match the search",
   "emptyCreateHint": "Use Create in the toolbar to register a domain;",
   "queueLocalTitle": "Mail queue",
   "needExecute": "Needs YSK_EXECUTE",
   "viewQueue": "View queue",
   "flushQueue": "Flush queue",
-  "queueHint": "Click View queue to read the local Postfix queue",
+  "flushQueueEmpty": "Queue is empty",
+  "flushQueueNeedExecute": "Flushing the queue needs YSK_EXECUTE (host execute permission)",
+  "queueHint": "Local Postfix queue. Viewing is a read probe; flush needs YSK_EXECUTE.",
   "deleteThisId": "Delete this ID",
   "queueEmpty": "No deferred mail",
   "queueEmptyHint": "No deferred messages",
@@ -69,7 +72,8 @@
   "opsHost": "Host provider: PTR, Port 25 outbound policy",
   "opsRegistrar": "Registrar: publish MX / SPF / DKIM / DMARC",
   "statusTitle": "Status",
-  "statusDraft": "draft: panel only",
+  "statusDraft": "Draft (panel only)",
+  "deliverabilityChecks": "Checks",
   "statusWritten": "written: management files written, may not be live",
   "statusApplied": "applied: successfully applied before (still check service is-active)",
   "statusReputation": "Inbox reputation can never be 100% automated",
@@ -105,6 +109,16 @@
   "copyAllRecords": "Copy all records",
   "openDnsPage": "Open DNS page",
   "healthScore": "Health score",
+  "healthUnchecked": "Not checked yet",
+  "healthUncheckedHint": "Live DNS / PTR / port 25 have not been probed yet.",
+  "healthPartialScore": "Partial {{n}}/100 (DNS only)",
+  "healthPartialHint": "DNS checklist only — live and blacklist not probed.",
+  "deliverabilityScore": "Deliverability pack",
+  "opendkimNoReload": "OpenDKIM has no reload — use restart after key or table changes.",
+  "opendkimNoReloadTitle": "systemctl reload opendkim is not supported on this stack",
+  "healthChecklist": "Checklist {{score}}/100",
+  "healthChecklistHint": "Checklist score — live DNS / PTR / port 25 not probed yet",
+  "healthLiveHint": "Live probe score",
   "suggestedRecords": "Suggested records",
   "externalTodosCount": "External todos",
   "colType": "Type",
@@ -189,7 +203,7 @@
   "hourlyMsgCap": "Hourly message cap",
   "hourlyMsgCapHint": "Global uses the minimum across domains",
   "enableAntispam": "Enable antispam mark (Rspamd multimap)",
-  "enableAntispamDesc": "Off marks domain antispam off",
+  "enableAntispamDesc": "Off keeps this domain out of the Rspamd antispam map. Write panel first, then apply to system.",
   "writeControlOnly": "Write panel only",
   "applyToSystemBtn": "Apply to system",
   "dnsblResult": "DNSBL result",
@@ -314,6 +328,7 @@
   "health": {
     "dnsUnconfirmed": "DNS records (MX/SPF/DKIM) not yet confirmed",
     "dmarcMissing": "DMARC missing — strongly recommended",
+    "dmarcUnpublished": "DMARC is generated in the panel but not published in public DNS yet",
     "ptrBad": "PTR reverse DNS missing or incorrect — request at VPS provider",
     "port25Blocked": "Outbound Port 25 appears blocked — request unblock or use SMTP relay",
     "port25Unknown": "Port 25 status unknown — run connectivity check"
@@ -357,7 +372,8 @@
     "postfixReloaded": "Postfix reloaded.",
     "postfixReloadFailed": "Postfix reload failed: {{detail}}",
     "dovecotApplied": "Wrote Dovecot TLS snippet and attempted reload.",
-    "dovecotSkipped": "Skipped Dovecot (not installed or doveconf unavailable)."
+    "dovecotSkipped": "Skipped Dovecot (not installed or doveconf unavailable).",
+    "dovecotSslOmitted": "Mail certificate is missing; wrote ssl=no so Dovecot can start without the LE files."
   },
   "policyApplySystemHint": "Check “apply to system” to write Postfix/Rspamd maps and reload;",
   "rateLimitAppliedNote": "Hourly outbound rate and antispam flag applied (when system apply is on).",
@@ -396,12 +412,12 @@
   "deliverabilityDesc": "PTR / DNS / port 25 checks",
   "dnsTodosDesc": "Copy then add at your DNS host",
   "deliverabilityHonesty": "Cannot set PTR or unlock port 25 for you",
-  "warmupSuggest": "暖身建議",
-  "writeSsoSkeleton": "寫入 Roundcube SSO 骨架",
-  "rateLimitPerHour": "每小時訊息上限",
-  "rateLimitGlobalHint": "全域取各域名最小值",
-  "savePolicyWritten": "只寫入控制面",
-  "dnsblMultiIp": "多 IP RBL",
+  "warmupSuggest": "Warm-up suggestions",
+  "writeSsoSkeleton": "Write Roundcube SSO skeleton",
+  "rateLimitPerHour": "Hourly message cap",
+  "rateLimitGlobalHint": "Global cap uses the lowest per-domain limit",
+  "savePolicyWritten": "Written to the control plane only",
+  "dnsblMultiIp": "Multi-IP RBL",
   "webmailTool": "Webmail software",
   "webmailToolRoundcube": "Roundcube (default)",
   "webmailToolSnappy": "SnappyMail (lightweight)",
@@ -411,6 +427,9 @@
   "webmailRisk": "Public webmail is risky — enable HTTPS soon.",
   "webmailForceHttps": "Force HTTPS (Roundcube; SSL required)",
   "reinstallWebmail": "Reinstall / upgrade",
+  "installWebmailTitle": "Create the shared webmail project (first install)",
+  "reinstallWebmailTitle": "Rebuild / upgrade the existing webmail project",
+  "reinstallNeedInstall": "Install webmail first",
   "webmailSsoAdvanced": "Advanced · SSO plugin",
   "tlsRoleMail": "mail (IMAP/SMTP)",
   "tlsRoleMailHint": "Mail server hostname",
@@ -419,6 +438,7 @@
   "tlsRoleApex": "Apex domain",
   "tlsRoleApexHint": "Web / apex certificate",
   "tlsRequestLe": "Request LE",
+  "tlsRequestLeFor": "Request LE for {{host}}",
   "advancedToolsTitle": "Queue & clients",
   "flushQueueConfirm": "Flush the local MTA queue? This cannot be undone.",
   "mailSslTitleShort": "Certificates & TLS",
@@ -434,6 +454,7 @@
   "deleteMailboxC3": "System Dovecot/Postfix may still need cleanup",
   "deleteAliasTitle": "Delete alias/forward?",
   "deleteAliasDesc": "Deletes {{source}}.",
+  "deleteImpact": "{{mailboxes}} mailboxes · {{records}} DNS records · {{aliases}} aliases",
   "deleteDomainC1": "All mailboxes and aliases",
   "deleteDomainC2": "Control-plane DKIM, DNS suggestions, and flags",
   "deleteDomainC3": "Local dataDir/email directory if present",
@@ -473,5 +494,23 @@
   "mailboxEmptyTitle": "No mailboxes yet",
   "passwordMismatch": "Passwords do not match",
   "passwordTooShort": "Password must be at least 8 characters",
-  "mailboxUpdateNeedField": "Set a new password or change status"
+  "mailboxUpdateNeedField": "Set a new password or change status",
+  "catchallHint": "Unknown local parts go to the target mailbox. Draft until mail apply.",
+  "queueSearchPh": "Search ID, sender, or recipient…",
+  "queueId": "Queue ID",
+  "queueSender": "Sender",
+  "queueRecipients": "Recipients",
+  "queueSize": "Size",
+  "queueReason": "Reason",
+  "queueActive": "Active",
+  "queueHeld": "Held",
+  "queueDeferred": "Deferred",
+  "deleteQueueTitle": "Delete this queued message?",
+  "deleteQueueDesc": "Remove {{id}} from the local MTA queue. Needs YSK_EXECUTE.",
+  "openQueuePage": "Open mail queue",
+  "dovecotFailedHint": "Dovecot failed. Open the Software tab for the unit status.",
+  "dovecotFailedStatus": "Dovecot is {{status}}. Open the Software tab for the unit summary.",
+  "mailCertMissing": "No certificate for {{hosts}}. Issue it on the SSL page.",
+  "mailCertPresent": "A mail certificate is already issued — this is not a missing-cert problem.",
+  "webmailNeedCert": "No certificate for {{host}} — issue it on SSL before forcing HTTPS."
 }

package/locales/en/errors.json

@@ -25,7 +25,7 @@
     "adminTotpStrict": "Admins must enable 2FA (strict). Use an enrolled account or disable strict mode.",
     "totpReplay": "Code already used; wait for the next period",
     "totpRequired": "A valid authentication code is required",
-    "mustEnrollTotp": "Admin policy: enable two-factor authentication now",
+    "mustEnrollTotp": "Policy: enable two-factor authentication now",
     "userNotFound": "User not found",
     "totpSetupNeedReauth": "Enabling 2FA requires your password (or a recent step-up code)",
     "totpBeginFirst": "Start 2FA setup first",
@@ -37,7 +37,9 @@
     "sessionExpired": "Session expired; sign in again",
     "sessionIdle": "Idle timeout; sign in again",
     "totpNotEnabled": "2FA is not enabled",
-    "totpSecretNoDataDir": "TOTP secret is encrypted but dataDir is not set"
+    "totpSecretNoDataDir": "TOTP secret is encrypted but dataDir is not set",
+    "mustChangePassword": "You must set a new password before continuing",
+    "policyNeedsOwn2fa": "Turn on 2FA for this account and confirm with a TOTP code before requiring 2FA for others"
   },
   "http": {
     "notFoundRoute": "Not found: {{method}} {{path}}",
@@ -47,7 +49,8 @@
     "unprocessable": "Request rejected by server",
     "requestFailed": "Request failed ({{status}})",
     "jsonInvalid": "Invalid JSON",
-    "internal": "Internal error"
+    "internal": "Internal error",
+    "payloadTooLarge": "Request body is too large"
   },
   "YSK_HOST_BROWSE_SSRF": "Host browse blocked by security policy",
   "YSK_HOST_BROWSE_SESSION": "Host browse session not found or expired",